thinkpool-pair 0.7.247 → 0.7.249

package/bridge.mjs

@@ -39,6 +39,7 @@ import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { serveDecision, fetchServeRow, refusalMessage, gateFailAction } from './serve-consent.mjs'
 import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
+import { cancelDurableDispatchPermissions } from './dispatch-permission-cleanup.mjs'
 // Slice 3 — the pure decision layer for agent push events (turn-done / needs-input).
 // Unit-tested in bridge/agent-notify.test.mjs; everything with I/O stays here.
 import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummary, isUserFacingLane, DEFAULT_MIN_TURN_MS } from './agent-notify.mjs'
@@ -110,6 +111,7 @@ const flowRedispatch = new Map()
 const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDispatchApproval, verifyDurableDispatchAuthority } from './cross-terminal.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
+import { beginDispatchLease, finishDispatchLease, isDispatchLeaseCurrent, supersedeDispatchLease } from './dispatch-lease.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, ImageEventQueue, imageQueueConfig, uploadCodeImage as uploadCodeImageRequest, usageReportLine, codexUsageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
@@ -2401,9 +2403,16 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
             })
           } catch { return okText('Dispatch preview could not be built safely. No lane was created.') }
           const permissionId = randomUUID()
+          const dispatchAdmission = beginDispatchLease(entry, permissionId)
+          if (!dispatchAdmission.ok) {
+            return okText('A dispatch choice is already awaiting approval in the room. Do not retry or switch runtimes; wait for that choice to be approved or canceled, or for a new human turn to supersede it.')
+          }
+          const dispatchLease = dispatchAdmission.lease
+          try {
           let approval = { decision: 'deny' }
           try { approval = await requestDispatchApproval({ id: permissionId, input: effectiveArgs, dispatchPreview: preview }) } catch { /* fail closed */ }
           if (approval?.decision !== 'allow') return okText('Dispatch canceled. No lane or worktree was created.')
+          if (!isDispatchLeaseCurrent(entry, dispatchLease)) return okText('That dispatch choice was superseded by a newer turn. No lane or worktree was created.')
           const currentNow = Date.now()
           const current = dispatchContext(currentNow)
           const durable = await readDurableDispatchAuthority({
@@ -2416,6 +2425,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
             },
           })
           if (!durable.ok) return okText('Dispatch approval could not be verified from the durable room authority. No lane was created.')
+          if (!isDispatchLeaseCurrent(entry, dispatchLease)) return okText('That dispatch choice was superseded by a newer turn. No lane or worktree was created.')
           const authorization = authorizeDispatchApproval({
             preview,
             approvedFingerprint: durable.fingerprint,
@@ -2477,6 +2487,9 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
             return okText(`Opened agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''} and handed it the task. It runs in its own lane — check back with read_terminal, then close_terminal when done.`)
           }
           return okText(`Opened idle agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''}. Hand it work with post_to_terminal, or a person can type into it.`)
+          } finally {
+            finishDispatchLease(entry, dispatchLease)
+          }
         },
       )] : []),
       // Research lane — run a REAL multi-source search + adversarial verification and
@@ -3108,8 +3121,40 @@ function pendingResolution(pending, payload = {}) {
     : decision
 }
 
+// The bridge is the only component that knows when the SDK promise it created
+// has died. Persist that lifecycle boundary so a card cannot outlive its
+// executable intent after a steer, stop, close, or restart.
+function cancelPendingDispatchPermissions(s, permissionIds = null, reason = 'dispatch_superseded') {
+  const ids = permissionIds || [...(s?.pending?.entries?.() || [])]
+    .filter(([, pending]) => pending?.payload?.answerFormat === 'dispatch')
+    .map(([id]) => id)
+  if (!ids.length || !s?.id) return
+  void cancelDurableDispatchPermissions({
+    supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, roomCode: room,
+    bridgeId: BRIDGE_ID, terminalId: s.id, permissionIds: ids, reason,
+  }).then((result) => {
+    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ durable dispatch cleanup incomplete (${result.code})\n`)
+  })
+}
+
+async function cancelRestoredDispatchPermissions(terminalIds) {
+  const terminals = [...new Set((terminalIds || []).filter(Boolean))]
+  await Promise.all(terminals.map(async (terminalId) => {
+    const result = await cancelDurableDispatchPermissions({
+      supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, roomCode: room,
+      bridgeId: BRIDGE_ID, terminalId, reason: 'bridge_restarted',
+    })
+    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ restored dispatch cleanup incomplete (${result.code})\n`)
+  }))
+}
+
 function drainPending(s) {
   if (!s?.pending) return
+  // Invalidate the execution fence before settling promises. A dispatch that
+  // was already approved but is still re-reading durable authority must also
+  // fail closed when this terminal stops or its turn settles.
+  supersedeDispatchLease(s)
+  cancelPendingDispatchPermissions(s, null, 'dispatch_aborted')
   for (const [, p] of s.pending) {
     if (p?.timer) clearTimeout(p.timer)
     try { p.resolve(pendingResolution(p, { decision: 'deny' })) } catch { /* noop */ }
@@ -3119,6 +3164,18 @@ function drainPending(s) {
   s.permNotifier?.clearAll()
 }
 
+function supersedePendingDispatch(s) {
+  const lease = supersedeDispatchLease(s)
+  if (!lease) return null
+  const pending = s.pending?.get(lease.permissionId)
+  cancelPendingDispatchPermissions(s, [lease.permissionId], 'dispatch_superseded')
+  if (pending?.timer) clearTimeout(pending.timer)
+  s.pending?.delete(lease.permissionId)
+  s.permNotifier?.resolve(lease.permissionId)
+  try { pending?.resolve(pendingResolution(pending, { decision: 'deny' })) } catch { /* noop */ }
+  return lease.permissionId
+}
+
 // Switching a terminal to bypassPermissions must RETROACTIVELY clear the cards the
 // current turn already raised — setPermissionMode is a streaming control request that
 // only applies going forward, so without this a user who flips to bypass mid-turn keeps
@@ -3617,6 +3674,14 @@ channel
     s.hop = 0
     s.roomHop = 0   // a human turn is room-hop 0 — clears any injected cross-room hop depth
     const text = String(payload.text)
+    // A fresh person-authored turn is a newer dispatch intent boundary. Retract
+    // any older runtime choice and invalidate its lease before it can resume from
+    // a late durable approval. Ordinary tool cards remain untouched: steering a
+    // running turn must not silently answer unrelated permissions.
+    const supersededDispatchId = supersedePendingDispatch(s)
+    if (supersededDispatchId) {
+      announce()
+    }
     // A human turn supersedes a restart's still-pending auto-continue. Without this,
     // their message starts the cold runtime; its init event then queues a second stale
     // `continue` behind the request. Codex normally resumes immediately at restore, while
@@ -3985,7 +4050,7 @@ channel
     process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
     reply(true, undefined, true)
   })
-  .subscribe(status => {
+  .subscribe(async status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
       trackPresence({ name, role: 'bridge', bridge_id: BRIDGE_ID })
@@ -4009,6 +4074,11 @@ channel
           // the tabs (Max, 2026-07-02). Legacy recs fall back to their first event ts / savedAt.
           const okey = (r) => r._bt || r.openedAt || r.savedAt || 0
           all.sort((a, b) => okey(a) - okey(b))
+          // `pending` promises are intentionally process-local and never restore.
+          // Cancel their durable dispatch rows BEFORE opening a restored SDK
+          // session, so a new permission raised during resume can never be
+          // mistaken for a pre-restart card from the same terminal.
+          await cancelRestoredDispatchPermissions(all.map((rec) => rec.id))
           if (all.length) for (const rec of all) {
             const wasInterrupted = restoredTurnOpen(rec.log || [])
             // Codex can persist a thread id before its rollout receives the

package/dispatch-lease.mjs

@@ -0,0 +1,37 @@
+// One live dispatch intent per structured terminal.
+//
+// Durable permission rows can outlive the agent turn that requested them. The
+// lease is the bridge-local execution fence: arguments still need the durable
+// fingerprint/authority checks, and the matching intent must also remain current
+// until the lane is created. A newer human turn or abort supersedes the lease, so
+// a late (otherwise valid) approval cannot resurrect an old runtime choice.
+
+const nextGeneration = (entry) =>
+  (Number.isSafeInteger(entry?.dispatchGeneration) ? entry.dispatchGeneration : 0) + 1
+
+export function beginDispatchLease (entry, permissionId) {
+  if (!entry || !permissionId) return Object.freeze({ ok: false, code: 'invalid_dispatch' })
+  if (entry.dispatchLease) return Object.freeze({ ok: false, code: 'dispatch_pending', active: entry.dispatchLease })
+  const lease = Object.freeze({ permissionId, generation: nextGeneration(entry) })
+  entry.dispatchGeneration = lease.generation
+  entry.dispatchLease = lease
+  return Object.freeze({ ok: true, lease })
+}
+
+export function isDispatchLeaseCurrent (entry, lease) {
+  return Boolean(entry && lease && entry.dispatchLease === lease && entry.dispatchGeneration === lease.generation)
+}
+
+export function finishDispatchLease (entry, lease) {
+  if (!isDispatchLeaseCurrent(entry, lease)) return false
+  entry.dispatchLease = null
+  return true
+}
+
+export function supersedeDispatchLease (entry) {
+  const lease = entry?.dispatchLease || null
+  if (!entry || !lease) return null
+  entry.dispatchGeneration = nextGeneration(entry)
+  entry.dispatchLease = null
+  return lease
+}

package/dispatch-permission-cleanup.mjs

@@ -0,0 +1,68 @@
+// Durable cleanup for dispatch approvals that no longer have a live bridge
+// promise behind them.  A dispatch row is intentionally human-resolvable only
+// while its originating bridge intent is live.  When that intent is replaced
+// or a bridge restarts, cancel the exact pending row through the normal
+// authenticated RPC rather than leaving a misleading, non-executable card.
+
+const PENDING = new Set(['pending'])
+const SETTLED = new Set(['denied', 'idempotent_replay', 'already_resolved', 'stale_or_already_resolved', 'item_expired'])
+
+const safeString = (value) => typeof value === 'string' && value.length > 0
+
+export function pendingDispatchItems (items, { bridgeId, terminalId, permissionIds = null } = {}) {
+  if (!safeString(bridgeId) || !safeString(terminalId)) return []
+  const requested = permissionIds == null ? null : new Set(permissionIds.filter(safeString))
+  return (Array.isArray(items) ? items : []).filter((item) => {
+    const permissionId = item?.request_context?.permission_id
+    return PENDING.has(item?.status) && item?.item_kind === 'approval' && item?.action_kind === 'dispatch' &&
+      item?.bridge_authority_id === bridgeId && item?.local_authority_id === terminalId &&
+      safeString(permissionId) && (!requested || requested.has(permissionId))
+  })
+}
+
+const rpc = async ({ fetchImpl, supabaseUrl, headers, name, body }) => {
+  const response = await fetchImpl(`${String(supabaseUrl).replace(/\/$/, '')}/rest/v1/rpc/${name}`, {
+    method: 'POST', headers, body: JSON.stringify(body),
+  })
+  if (!response?.ok) throw new Error(`${name}_failed`)
+  return response.json()
+}
+
+// Fetch through list_code_pair_controls so RLS applies to the bridge's current
+// room-member identity.  Never accept an id supplied by a public broadcast.
+export async function cancelDurableDispatchPermissions ({
+  fetchImpl = globalThis.fetch, supabaseUrl, anonKey, token, roomCode, bridgeId,
+  terminalId, permissionIds = null, reason = 'dispatch_superseded',
+} = {}) {
+  if (typeof fetchImpl !== 'function' || !safeString(supabaseUrl) || !safeString(anonKey) ||
+      !safeString(token) || !safeString(roomCode) || !safeString(bridgeId) || !safeString(terminalId)) {
+    return Object.freeze({ ok: false, code: 'cleanup_unavailable', canceled: 0 })
+  }
+  if (permissionIds != null && (!Array.isArray(permissionIds) || !permissionIds.length)) {
+    return Object.freeze({ ok: true, code: 'nothing_to_cancel', canceled: 0 })
+  }
+  const headers = { apikey: anonKey, Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
+  try {
+    const listed = await rpc({ fetchImpl, supabaseUrl, headers, name: 'list_code_pair_controls', body: {
+      p_session_code: String(roomCode).toUpperCase(), p_status: null, p_limit: 100,
+    } })
+    const candidates = pendingDispatchItems(listed, { bridgeId, terminalId, permissionIds })
+    const outcomes = await Promise.all(candidates.map(async (item) => {
+      const result = await rpc({ fetchImpl, supabaseUrl, headers, name: 'resolve_code_pair_control', body: {
+        p_item_id: item.id,
+        p_expected_version: item.version,
+        p_decision: 'deny',
+        p_resolution_code: 'canceled',
+        p_resolution_payload: { decision: 'deny', reason },
+        p_bridge_authority_id: bridgeId,
+        p_local_authority_id: terminalId,
+        p_idempotency_key: `cancel-dispatch:${item.id}:${reason}`.slice(0, 160),
+      } })
+      return { id: item.id, code: result?.code || 'invalid_response', ok: Boolean(result?.ok) && SETTLED.has(result.code) }
+    }))
+    const canceled = outcomes.filter((outcome) => outcome.ok).length
+    return Object.freeze({ ok: canceled === outcomes.length, code: canceled === outcomes.length ? 'canceled' : 'cleanup_partial', canceled, outcomes: Object.freeze(outcomes) })
+  } catch {
+    return Object.freeze({ ok: false, code: 'cleanup_failed', canceled: 0 })
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.247",
+  "version": "0.7.249",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -49,6 +49,8 @@
     "cross-terminal.mjs",
     "lane-lifecycle.mjs",
     "interrupted-resume.mjs",
+    "dispatch-lease.mjs",
+    "dispatch-permission-cleanup.mjs",
     "flow-conductor.mjs",
     "flow-worktree.mjs",
     "flow-task-graph.mjs",