thinkpool-pair 0.7.248 → 0.7.250

package/bridge.mjs

@@ -39,6 +39,7 @@ import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { serveDecision, fetchServeRow, refusalMessage, gateFailAction } from './serve-consent.mjs'
 import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
+import { cancelDurableDispatchPermissions } from './dispatch-permission-cleanup.mjs'
 // Slice 3 — the pure decision layer for agent push events (turn-done / needs-input).
 // Unit-tested in bridge/agent-notify.test.mjs; everything with I/O stays here.
 import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummary, isUserFacingLane, DEFAULT_MIN_TURN_MS } from './agent-notify.mjs'
@@ -3120,12 +3121,42 @@ function pendingResolution(pending, payload = {}) {
     : decision
 }
 
+// The bridge is the only component that knows when the SDK promise it created
+// has died. Persist that lifecycle boundary so a card cannot outlive its
+// executable intent after a steer, stop, close, or restart.
+function cancelPendingDispatchPermissions(s, permissionIds = null, reason = 'dispatch_superseded') {
+  const ids = permissionIds || [...(s?.pending?.entries?.() || [])]
+    .filter(([, pending]) => pending?.payload?.answerFormat === 'dispatch')
+    .map(([id]) => id)
+  if (!ids.length || !s?.id) return
+  void cancelDurableDispatchPermissions({
+    supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, roomCode: room,
+    bridgeId: BRIDGE_ID, terminalId: s.id, permissionIds: ids, reason,
+  }).then((result) => {
+    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ durable dispatch cleanup incomplete (${result.code})\n`)
+  })
+}
+
+async function cancelRestoredDispatchPermissions(terminalIds) {
+  const terminals = [...new Set((terminalIds || []).filter(Boolean))]
+  await Promise.all(terminals.map(async (terminalId) => {
+    const result = await cancelDurableDispatchPermissions({
+      supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, roomCode: room,
+      // New bridge process, old durable bridge authority: filter by the
+      // restored terminal and let the cleanup read each historical binding.
+      terminalId, reason: 'bridge_restarted',
+    })
+    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ restored dispatch cleanup incomplete (${result.code})\n`)
+  }))
+}
+
 function drainPending(s) {
   if (!s?.pending) return
   // Invalidate the execution fence before settling promises. A dispatch that
   // was already approved but is still re-reading durable authority must also
   // fail closed when this terminal stops or its turn settles.
   supersedeDispatchLease(s)
+  cancelPendingDispatchPermissions(s, null, 'dispatch_aborted')
   for (const [, p] of s.pending) {
     if (p?.timer) clearTimeout(p.timer)
     try { p.resolve(pendingResolution(p, { decision: 'deny' })) } catch { /* noop */ }
@@ -3139,6 +3170,7 @@ function supersedePendingDispatch(s) {
   const lease = supersedeDispatchLease(s)
   if (!lease) return null
   const pending = s.pending?.get(lease.permissionId)
+  cancelPendingDispatchPermissions(s, [lease.permissionId], 'dispatch_superseded')
   if (pending?.timer) clearTimeout(pending.timer)
   s.pending?.delete(lease.permissionId)
   s.permNotifier?.resolve(lease.permissionId)
@@ -3650,7 +3682,6 @@ channel
     // running turn must not silently answer unrelated permissions.
     const supersededDispatchId = supersedePendingDispatch(s)
     if (supersededDispatchId) {
-      bcast('code-perm', { term: payload.term, id: supersededDispatchId, decision: 'deny', name: 'agent' })
       announce()
     }
     // A human turn supersedes a restart's still-pending auto-continue. Without this,
@@ -4021,7 +4052,7 @@ channel
     process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
     reply(true, undefined, true)
   })
-  .subscribe(status => {
+  .subscribe(async status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
       trackPresence({ name, role: 'bridge', bridge_id: BRIDGE_ID })
@@ -4045,6 +4076,11 @@ channel
           // the tabs (Max, 2026-07-02). Legacy recs fall back to their first event ts / savedAt.
           const okey = (r) => r._bt || r.openedAt || r.savedAt || 0
           all.sort((a, b) => okey(a) - okey(b))
+          // `pending` promises are intentionally process-local and never restore.
+          // Cancel their durable dispatch rows BEFORE opening a restored SDK
+          // session, so a new permission raised during resume can never be
+          // mistaken for a pre-restart card from the same terminal.
+          await cancelRestoredDispatchPermissions(all.map((rec) => rec.id))
           if (all.length) for (const rec of all) {
             const wasInterrupted = restoredTurnOpen(rec.log || [])
             // Codex can persist a thread id before its rollout receives the

package/dispatch-permission-cleanup.mjs

@@ -0,0 +1,71 @@
+// Durable cleanup for dispatch approvals that no longer have a live bridge
+// promise behind them.  A dispatch row is intentionally human-resolvable only
+// while its originating bridge intent is live.  When that intent is replaced
+// or a bridge restarts, cancel the exact pending row through the normal
+// authenticated RPC rather than leaving a misleading, non-executable card.
+
+const PENDING = new Set(['pending'])
+const SETTLED = new Set(['denied', 'idempotent_replay', 'already_resolved', 'stale_or_already_resolved', 'item_expired'])
+
+const safeString = (value) => typeof value === 'string' && value.length > 0
+
+export function pendingDispatchItems (items, { bridgeId = null, terminalId, permissionIds = null } = {}) {
+  if ((bridgeId != null && !safeString(bridgeId)) || !safeString(terminalId)) return []
+  const requested = permissionIds == null ? null : new Set(permissionIds.filter(safeString))
+  return (Array.isArray(items) ? items : []).filter((item) => {
+    const permissionId = item?.request_context?.permission_id
+    return PENDING.has(item?.status) && item?.item_kind === 'approval' && item?.action_kind === 'dispatch' &&
+      (!bridgeId || item?.bridge_authority_id === bridgeId) && item?.local_authority_id === terminalId &&
+      safeString(permissionId) && (!requested || requested.has(permissionId))
+  })
+}
+
+const rpc = async ({ fetchImpl, supabaseUrl, headers, name, body }) => {
+  const response = await fetchImpl(`${String(supabaseUrl).replace(/\/$/, '')}/rest/v1/rpc/${name}`, {
+    method: 'POST', headers, body: JSON.stringify(body),
+  })
+  if (!response?.ok) throw new Error(`${name}_failed`)
+  return response.json()
+}
+
+// Fetch through list_code_pair_controls so RLS applies to the bridge's current
+// room-member identity.  Never accept an id supplied by a public broadcast.
+export async function cancelDurableDispatchPermissions ({
+  fetchImpl = globalThis.fetch, supabaseUrl, anonKey, token, roomCode, bridgeId,
+  terminalId, permissionIds = null, reason = 'dispatch_superseded',
+} = {}) {
+  if (typeof fetchImpl !== 'function' || !safeString(supabaseUrl) || !safeString(anonKey) ||
+      !safeString(token) || !safeString(roomCode) || (bridgeId != null && !safeString(bridgeId)) || !safeString(terminalId)) {
+    return Object.freeze({ ok: false, code: 'cleanup_unavailable', canceled: 0 })
+  }
+  if (permissionIds != null && (!Array.isArray(permissionIds) || !permissionIds.length)) {
+    return Object.freeze({ ok: true, code: 'nothing_to_cancel', canceled: 0 })
+  }
+  const headers = { apikey: anonKey, Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
+  try {
+    const listed = await rpc({ fetchImpl, supabaseUrl, headers, name: 'list_code_pair_controls', body: {
+      p_session_code: String(roomCode).toUpperCase(), p_status: null, p_limit: 100,
+    } })
+    const candidates = pendingDispatchItems(listed, { bridgeId, terminalId, permissionIds })
+    const outcomes = await Promise.all(candidates.map(async (item) => {
+      const result = await rpc({ fetchImpl, supabaseUrl, headers, name: 'resolve_code_pair_control', body: {
+        p_item_id: item.id,
+        p_expected_version: item.version,
+        p_decision: 'deny',
+        p_resolution_code: 'canceled',
+        p_resolution_payload: { decision: 'deny', reason },
+        // A restart receives a fresh bridge ID. The old row remains protected
+        // by its immutable authority binding, so resolve it with that exact
+        // value after the owner-authenticated RLS list—not a guessed current ID.
+        p_bridge_authority_id: item.bridge_authority_id,
+        p_local_authority_id: terminalId,
+        p_idempotency_key: `cancel-dispatch:${item.id}:${reason}`.slice(0, 160),
+      } })
+      return { id: item.id, code: result?.code || 'invalid_response', ok: Boolean(result?.ok) && SETTLED.has(result.code) }
+    }))
+    const canceled = outcomes.filter((outcome) => outcome.ok).length
+    return Object.freeze({ ok: canceled === outcomes.length, code: canceled === outcomes.length ? 'canceled' : 'cleanup_partial', canceled, outcomes: Object.freeze(outcomes) })
+  } catch {
+    return Object.freeze({ ok: false, code: 'cleanup_failed', canceled: 0 })
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.248",
+  "version": "0.7.250",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -50,6 +50,7 @@
     "lane-lifecycle.mjs",
     "interrupted-resume.mjs",
     "dispatch-lease.mjs",
+    "dispatch-permission-cleanup.mjs",
     "flow-conductor.mjs",
     "flow-worktree.mjs",
     "flow-task-graph.mjs",