thinkpool-pair 0.7.217 → 0.7.219

package/bridge.mjs

@@ -65,7 +65,7 @@ import { writeLaneArtifact, digestSlice, appendDigest, resumeLane } from './flow
 import { createFlowWorktree, worktreeSpec } from './flow-worktree.mjs'
 import { startPreview, stopAllPreviews, previews } from './flow-preview.mjs'
 import { ViewportManager, createViewportTools, sharedViewportBrowser } from './viewport.mjs'
-import { designPrompt, resolveDesignSource, validateDesignRequest } from './design-edit.mjs'
+import { designPrompt, resolveDesignSource, restoreDesignSources, syncRealtimeAuth, validateDesignRequest } from './design-edit.mjs'
 // FL-M9 — per-lane preview servers leak (one per done lane, never stopped until shutdown).
 // Lane previews are keyed `lane:<flowId>:<laneId>`; stop a whole flow's set when it assembles
 // (the assembled preview supersedes them) or when a lane is reverted.
@@ -739,6 +739,13 @@ let myServeUid = null        // this bridge's authed uid (null = anon)
   }
 }
 
+// Private realtime topics authorize the JWT carried by the socket at join time.
+// Supabase's REST auth helpers do not propagate codeAuthToken to Realtime, so pin
+// it before constructing any channel. A direct/anonymous bridge stays on anon.
+if (!await syncRealtimeAuth(supabase, codeAuthToken, SUPABASE_ANON) && codeAuthToken) {
+  process.stderr.write('\n  ⚠ realtime auth could not be initialized; private bridge features are unavailable.\n')
+}
+
 refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken now set from env OR the stored login)
 
 // ── Pre-flight budget caps — spec docs/specs/2026-07-01-budget-caps.md (nexos steal #1).
@@ -1855,6 +1862,9 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
   // they land on this session even after other terminals open/close.
   const mockupOutbox = ownerOutbox('sessions', id)
   entry.mockupWatcher = watchOutbox(mockupOutbox, () => id, true)
+  const restoredDesigns = restoreDesignSources(mockupOutbox, cwd || process.cwd(), id)
+  for (const record of restoredDesigns) designArtifacts.set(record.previewId, record)
+  if (restoredDesigns.length) process.stderr.write(`\n  ◆ restored ${restoredDesigns.length} Thinkpool Design artifact${restoredDesigns.length === 1 ? '' : 's'} (${id.slice(0, 8)}).\n`)
   // Visual QA runs in the bridge process, outside either agent runtime's sandbox.
   // It remains scoped to this lane's cwd and private mockup outbox.
   entry.viewport = new ViewportManager({ workspaceRoot: cwd || process.cwd(), ownerId: id, outbox: mockupOutbox })
@@ -4014,7 +4024,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     if (m.t === 'update-available') surfaceUpdate(m.version)
     // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
     // it so our authed writes (code-mockup) never go stale on a long session (L16).
-    else if (m.t === 'token') { codeAuthToken = m.accessToken || null; refreshOwnerPlan() }
+    else if (m.t === 'token') {
+      codeAuthToken = m.accessToken || null
+      syncRealtimeAuth(supabase, codeAuthToken, SUPABASE_ANON).then((ok) => {
+        if (!ok && codeAuthToken) process.stderr.write('\n  ⚠ realtime auth refresh failed; private bridge features may need a reconnect.\n')
+      })
+      refreshOwnerPlan()
+    }
   })
   setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {

package/design-edit.mjs

@@ -8,6 +8,20 @@ const MAX_TEXT = 4_000
 
 const clean = (value, max) => String(value ?? '').replace(/\0/g, '').trim().slice(0, max)
 
+// supabase-js does not copy the Auth session into an already-created Realtime
+// client. Private tpdesign:* joins therefore need the bridge owner's JWT pinned
+// explicitly, both at boot and whenever the account supervisor rotates it.
+export async function syncRealtimeAuth(client, accessToken, fallbackToken = null) {
+  const token = accessToken || fallbackToken
+  if (!token || typeof client?.realtime?.setAuth !== 'function') return false
+  try {
+    await client.realtime.setAuth(token)
+    return true
+  } catch {
+    return false
+  }
+}
+
 export function sourceRevision(source) {
   return crypto.createHash('sha256').update(String(source)).digest('hex').slice(0, 24)
 }
@@ -34,6 +48,44 @@ export function resolveDesignSource(file, workspaceRoot) {
   return { previewId, revision, sourcePath, workspaceRoot: root, source }
 }
 
+// Design provenance is intentionally host-only, but it must survive a bridge
+// restart. Rebuild the in-memory registry from manifests already written by the
+// trusted lane render workflow; do not re-upload or re-broadcast old cards.
+export function restoreDesignSources(box, workspaceRoot, term, limit = 100) {
+  if (!box || !workspaceRoot || !term) return []
+  let files
+  try {
+    files = fs.readdirSync(box, { withFileTypes: true })
+      .filter((entry) => entry.isFile() && entry.name.endsWith('.json') && !entry.name.endsWith('.receipt.json'))
+      .map((entry) => {
+        const file = path.join(box, entry.name)
+        return { file, mtimeMs: fs.statSync(file).mtimeMs }
+      })
+      .sort((a, b) => b.mtimeMs - a.mtimeMs)
+      .slice(0, Math.max(0, limit))
+  } catch { return [] }
+  const restored = []
+  for (const { file } of files) {
+    try {
+      const manifest = JSON.parse(fs.readFileSync(file, 'utf8'))
+      if (!manifest?.source) continue
+      const record = resolveDesignSource(manifest.source, workspaceRoot)
+      if (!record) continue
+      Object.assign(record, {
+        term,
+        slug: String(manifest.slug || ''),
+        title: String(manifest.title || manifest.slug || ''),
+        desktop: manifest.desktop || null,
+        mobile: manifest.mobile || null,
+      })
+      const backupPath = path.join(box, '.design-revisions', `${record.revision}.html`)
+      if (fs.existsSync(backupPath)) record.backupPath = backupPath
+      restored.push(record)
+    } catch { /* stale or malformed manifests are ignored */ }
+  }
+  return restored
+}
+
 function safeTarget(value) {
   if (!value || typeof value !== 'object') return null
   const rect = value.rect && typeof value.rect === 'object' ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.217",
+  "version": "0.7.219",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {