thinkpool-pair 0.7.261 → 0.7.263

package/bridge.mjs

@@ -39,7 +39,7 @@ import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { serveDecision, fetchServeRow, refusalMessage, gateFailAction } from './serve-consent.mjs'
 import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
-import { cancelDurableDispatchPermissions } from './dispatch-permission-cleanup.mjs'
+import { cancelDurableDispatchPermissions, cancelDurablePermissions } from './dispatch-permission-cleanup.mjs'
 // Slice 3 — the pure decision layer for agent push events (turn-done / needs-input).
 // Unit-tested in bridge/agent-notify.test.mjs; everything with I/O stays here.
 import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummary, isUserFacingLane, DEFAULT_MIN_TURN_MS } from './agent-notify.mjs'
@@ -3091,30 +3091,36 @@ function pendingResolution(pending, payload = {}) {
 // The bridge is the only component that knows when the SDK promise it created
 // has died. Persist that lifecycle boundary so a card cannot outlive its
 // executable intent after a steer, stop, close, or restart.
-function cancelPendingDispatchPermissions(s, permissionIds = null, reason = 'dispatch_superseded') {
+function cancelPendingDurablePermissions(s, permissionIds = null, reason = 'permission_aborted', dispatchOnly = false) {
   const ids = permissionIds || [...(s?.pending?.entries?.() || [])]
-    .filter(([, pending]) => pending?.payload?.answerFormat === 'dispatch')
     .map(([id]) => id)
   if (!ids.length || !s?.id) return
-  void cancelDurableDispatchPermissions({
+  const cancel = dispatchOnly ? cancelDurableDispatchPermissions : cancelDurablePermissions
+  void cancel({
     supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, roomCode: room,
     bridgeId: BRIDGE_ID, terminalId: s.id, permissionIds: ids, reason,
   }).then((result) => {
-    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ durable dispatch cleanup incomplete (${result.code})\n`)
+    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ durable permission cleanup incomplete (${result.code})\n`)
   })
 }
 
-async function cancelRestoredDispatchPermissions(terminalIds) {
-  const terminals = [...new Set((terminalIds || []).filter(Boolean))]
-  await Promise.all(terminals.map(async (terminalId) => {
-    const result = await cancelDurableDispatchPermissions({
+const restoredPermissionCleanupPending = new Set()
+
+async function cancelRestoredDurablePermissions(terminalIds = []) {
+  for (const terminalId of terminalIds) if (terminalId) restoredPermissionCleanupPending.add(terminalId)
+  const terminals = [...restoredPermissionCleanupPending]
+  const outcomes = await Promise.all(terminals.map(async (terminalId) => {
+    const result = await cancelDurablePermissions({
       supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, roomCode: room,
       // New bridge process, old durable bridge authority: filter by the
       // restored terminal and let the cleanup read each historical binding.
       terminalId, reason: 'bridge_restarted',
     })
-    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ restored dispatch cleanup incomplete (${result.code})\n`)
+    if (!result.ok && process.env.TP_DEBUG) process.stderr.write(`\n  ◇ restored permission cleanup incomplete (${result.code})\n`)
+    return { terminalId, ok: result.ok }
   }))
+  for (const outcome of outcomes) if (outcome.ok) restoredPermissionCleanupPending.delete(outcome.terminalId)
+  return { ok: restoredPermissionCleanupPending.size === 0, pending: [...restoredPermissionCleanupPending] }
 }
 
 function drainPending(s) {
@@ -3123,7 +3129,7 @@ function drainPending(s) {
   // was already approved but is still re-reading durable authority must also
   // fail closed when this terminal stops or its turn settles.
   supersedeDispatchLease(s)
-  cancelPendingDispatchPermissions(s, null, 'dispatch_aborted')
+  cancelPendingDurablePermissions(s, null, 'permission_aborted')
   for (const [, p] of s.pending) {
     if (p?.timer) clearTimeout(p.timer)
     try { p.resolve(pendingResolution(p, { decision: 'deny' })) } catch { /* noop */ }
@@ -3137,7 +3143,7 @@ function supersedePendingDispatch(s) {
   const lease = supersedeDispatchLease(s)
   if (!lease) return null
   const pending = s.pending?.get(lease.permissionId)
-  cancelPendingDispatchPermissions(s, [lease.permissionId], 'dispatch_superseded')
+  cancelPendingDurablePermissions(s, [lease.permissionId], 'dispatch_superseded', true)
   if (pending?.timer) clearTimeout(pending.timer)
   s.pending?.delete(lease.permissionId)
   s.permNotifier?.resolve(lease.permissionId)
@@ -4059,7 +4065,7 @@ channel
           // Cancel their durable dispatch rows BEFORE opening a restored SDK
           // session, so a new permission raised during resume can never be
           // mistaken for a pre-restart card from the same terminal.
-          await cancelRestoredDispatchPermissions(all.map((rec) => rec.id))
+          await cancelRestoredDurablePermissions(all.map((rec) => rec.id))
           if (all.length) for (const rec of all) {
             const wasInterrupted = restoredTurnOpen(rec.log || [])
             // Codex can persist a thread id before its rollout receives the
@@ -4601,6 +4607,10 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
         if (!ok && codeAuthToken) process.stderr.write('\n  ⚠ realtime auth refresh failed; private bridge features may need a reconnect.\n')
       })
       refreshOwnerPlan()
+      // A restart sweep may have raced an expiring owner JWT. Keep failed
+      // terminal ids until the supervisor hands us its next fresh token, then
+      // retry the exact cleanup instead of leaving dead question cards forever.
+      if (restoredPermissionCleanupPending.size) void cancelRestoredDurablePermissions()
     }
   })
   setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()

package/dispatch-permission-cleanup.mjs

@@ -1,25 +1,30 @@
-// Durable cleanup for dispatch approvals that no longer have a live bridge
-// promise behind them.  A dispatch row is intentionally human-resolvable only
-// while its originating bridge intent is live.  When that intent is replaced
-// or a bridge restarts, cancel the exact pending row through the normal
-// authenticated RPC rather than leaving a misleading, non-executable card.
+// Durable cleanup for approvals that no longer have a live bridge promise behind
+// them. A row is human-resolvable only while its originating local intent is live.
+// When that intent is replaced, aborted, or restarted, cancel the exact pending
+// row through the normal authenticated RPC rather than leaving a non-executable
+// card/lifecycle blocker.
 
 const PENDING = new Set(['pending'])
 const SETTLED = new Set(['denied', 'idempotent_replay', 'already_resolved', 'stale_or_already_resolved', 'item_expired'])
 
 const safeString = (value) => typeof value === 'string' && value.length > 0
 
-export function pendingDispatchItems (items, { bridgeId = null, terminalId, permissionIds = null } = {}) {
+export function pendingDurablePermissionItems (items, { bridgeId = null, terminalId, permissionIds = null, actionKinds = ['approval', 'dispatch'] } = {}) {
   if ((bridgeId != null && !safeString(bridgeId)) || !safeString(terminalId)) return []
   const requested = permissionIds == null ? null : new Set(permissionIds.filter(safeString))
+  const actions = new Set(actionKinds)
   return (Array.isArray(items) ? items : []).filter((item) => {
     const permissionId = item?.request_context?.permission_id
-    return PENDING.has(item?.status) && item?.item_kind === 'approval' && item?.action_kind === 'dispatch' &&
+    return PENDING.has(item?.status) && item?.item_kind === 'approval' && actions.has(item?.action_kind) &&
       (!bridgeId || item?.bridge_authority_id === bridgeId) && item?.local_authority_id === terminalId &&
       safeString(permissionId) && (!requested || requested.has(permissionId))
   })
 }
 
+export function pendingDispatchItems (items, options = {}) {
+  return pendingDurablePermissionItems(items, { ...options, actionKinds: ['dispatch'] })
+}
+
 const rpc = async ({ fetchImpl, supabaseUrl, headers, name, body }) => {
   const response = await fetchImpl(`${String(supabaseUrl).replace(/\/$/, '')}/rest/v1/rpc/${name}`, {
     method: 'POST', headers, body: JSON.stringify(body),
@@ -30,9 +35,9 @@ const rpc = async ({ fetchImpl, supabaseUrl, headers, name, body }) => {
 
 // Fetch through list_code_pair_controls so RLS applies to the bridge's current
 // room-member identity.  Never accept an id supplied by a public broadcast.
-export async function cancelDurableDispatchPermissions ({
+export async function cancelDurablePermissions ({
   fetchImpl = globalThis.fetch, supabaseUrl, anonKey, token, roomCode, bridgeId,
-  terminalId, permissionIds = null, reason = 'dispatch_superseded',
+  terminalId, permissionIds = null, reason = 'permission_aborted', actionKinds = ['approval', 'dispatch'],
 } = {}) {
   if (typeof fetchImpl !== 'function' || !safeString(supabaseUrl) || !safeString(anonKey) ||
       !safeString(token) || !safeString(roomCode) || (bridgeId != null && !safeString(bridgeId)) || !safeString(terminalId)) {
@@ -46,7 +51,7 @@ export async function cancelDurableDispatchPermissions ({
     const listed = await rpc({ fetchImpl, supabaseUrl, headers, name: 'list_code_pair_controls', body: {
       p_session_code: String(roomCode).toUpperCase(), p_status: null, p_limit: 100,
     } })
-    const candidates = pendingDispatchItems(listed, { bridgeId, terminalId, permissionIds })
+    const candidates = pendingDurablePermissionItems(listed, { bridgeId, terminalId, permissionIds, actionKinds })
     const outcomes = await Promise.all(candidates.map(async (item) => {
       const result = await rpc({ fetchImpl, supabaseUrl, headers, name: 'resolve_code_pair_control', body: {
         p_item_id: item.id,
@@ -59,7 +64,7 @@ export async function cancelDurableDispatchPermissions ({
         // value after the owner-authenticated RLS list—not a guessed current ID.
         p_bridge_authority_id: item.bridge_authority_id,
         p_local_authority_id: terminalId,
-        p_idempotency_key: `cancel-dispatch:${item.id}:${reason}`.slice(0, 160),
+        p_idempotency_key: `cancel-permission:${item.id}:${reason}`.slice(0, 160),
       } })
       return { id: item.id, code: result?.code || 'invalid_response', ok: Boolean(result?.ok) && SETTLED.has(result.code) }
     }))
@@ -69,3 +74,7 @@ export async function cancelDurableDispatchPermissions ({
     return Object.freeze({ ok: false, code: 'cleanup_failed', canceled: 0 })
   }
 }
+
+export function cancelDurableDispatchPermissions (options = {}) {
+  return cancelDurablePermissions({ ...options, actionKinds: ['dispatch'] })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.261",
+  "version": "0.7.263",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {