thinkpool-pair 0.7.285 → 0.7.287

package/account.mjs

@@ -22,6 +22,7 @@ import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 import { installedAgentCommands } from './agent-detect.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
+import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -431,8 +432,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // relays peek/post requests between a local room child and the partner's supervisor.
   // Spec: docs/specs/2026-06-30-cross-room-pair-bus.md
   const roomPartner = new Map()   // room -> the OTHER participant's uid (the pair partner), for 2-person rooms
-  const pairChannels = new Map()  // partnerUid -> { channel, key } (one bus per distinct partner)
-  const busWaiters = new Map()    // nonce -> { mode:'first'|'collect', resolve, timer, acc? } for OUR outbound bus requests
+  const pairChannels = new Map()  // partnerUid -> { channel, key, status } (one bus per distinct partner)
   const postBucket = new Map()    // partnerUid -> { count, resetAt } inbound cross-room-post rate limit (runaway-cost backstop)
   const POST_BUCKET = { max: 6, windowMs: 60_000 }   // ≤6 inbound cross-room posts / partner / minute
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
@@ -706,34 +706,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
 
   // ── pair-bus plumbing (function declarations hoist, so order here is free) ──
-  // Resolve one of OUR outbound bus requests. 'first' resolves on the first reply
-  // (peek/post — a single partner answers); 'collect' accumulates every reply within
-  // the window (list — several partners may each answer) and resolves when it closes.
-  const resolveBus = (payload) => {
-    if (!payload?.nonce) return
-    const w = busWaiters.get(payload.nonce)
-    if (!w) return
-    if (w.mode === 'collect') { w.acc.push(payload); return }
-    clearTimeout(w.timer); busWaiters.delete(payload.nonce); w.resolve(payload)
-  }
-  const busSendAll = (event, payload) => {
-    let sent = 0
-    for (const { channel } of pairChannels.values()) { try { channel.send({ type: 'broadcast', event, payload }); sent++ } catch { /* channel down */ } }
-    return sent
+  const pairBus = createPairBusBroker({ channels: pairChannels, randomId: randomUUID })
+  const resolveBus = (payload) => pairBus.resolve(payload)
+  const busRequestFirst = (event, payload, timeoutMs) => pairBus.requestFirst(event, payload, timeoutMs)
+  const busRequestCollect = (event, payload, windowMs) => pairBus.requestCollect(event, payload, windowMs)
+  const authorizedPairRooms = async (sourceRoom) => {
+    try {
+      const listed = await withTimeout(sb.rpc('list_pair_rooms', { p_code: sourceRoom }), 2500, 'paired-room roster')
+      if (listed?.error || !Array.isArray(listed?.data)) return { verified: false, rooms: [] }
+      return { verified: true, rooms: listed.data }
+    } catch { return { verified: false, rooms: [] } }
   }
-  const busRequestFirst = (event, payload, timeoutMs) => new Promise((resolve) => {
-    const nonce = randomUUID()
-    if (!busSendAll(event, { ...payload, nonce })) return resolve(null)
-    const timer = setTimeout(() => { busWaiters.delete(nonce); resolve(null) }, timeoutMs); timer.unref?.()
-    busWaiters.set(nonce, { mode: 'first', resolve, timer })
-  })
-  const busRequestCollect = (event, payload, windowMs) => new Promise((resolve) => {
-    const nonce = randomUUID()
-    if (!busSendAll(event, { ...payload, nonce })) return resolve([])
-    const acc = []
-    const timer = setTimeout(() => { busWaiters.delete(nonce); resolve(acc) }, windowMs); timer.unref?.()
-    busWaiters.set(nonce, { mode: 'collect', acc, resolve, timer })
-  })
   // Inbound cross-room-post rate limit, per partner (a partner's agent posting into
   // MY rooms spends MY tokens — the runaway-cost backstop, on top of the per-turn cap).
   const allowInboundPost = (partnerUid) => {
@@ -787,15 +770,19 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     if (!partnerUid || pairChannels.has(partnerUid)) return
     const topic = pairTopic(key); if (!topic) return
     const ch = sb.channel(topic, { config: { private: true, broadcast: { self: false } } })
+    const entry = { channel: ch, key, status: PAIR_BUS_STATUS.JOINING }
     ch.on('broadcast', { event: 'peer-list-req' }, ({ payload }) => onPeerListReq(partnerUid, ch, payload))
       .on('broadcast', { event: 'peer-list-res' }, ({ payload }) => resolveBus(payload))
       .on('broadcast', { event: 'peer-peek-req' }, ({ payload }) => onPeerPeekReq(partnerUid, ch, payload))
       .on('broadcast', { event: 'peer-peek-res' }, ({ payload }) => resolveBus(payload))
       .on('broadcast', { event: 'peer-post-req' }, ({ payload }) => onPeerPostReq(partnerUid, ch, payload))
       .on('broadcast', { event: 'peer-post-res' }, ({ payload }) => resolveBus(payload))
-      .subscribe()
-    pairChannels.set(partnerUid, { channel: ch, key })
-    process.stderr.write(`\n  ◆ pair bus open — cross-machine Ensemble reach with your partner.\n`)
+      .subscribe((status) => {
+        entry.status = pairBusStatusFromRealtime(status)
+        if (status === 'SUBSCRIBED') process.stderr.write(`\n  ◆ pair bus subscribed — cross-machine Ensemble reach with your partner.\n`)
+        else if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') process.stderr.write(`\n  ◇ pair bus ${status.toLowerCase().replace('_', ' ')} — partner sessions are offline until it reconnects.\n`)
+      })
+    pairChannels.set(partnerUid, entry)
   }
   // Forward a local child's cross-room request to the bus (Tier 2 peek / Tier 3 post)
   // when the target room is NOT served on this machine. Used inside the child handler.
@@ -923,11 +910,15 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           ;(async () => {
             if (process.env.TP_CROSSROOM_OFF === '1') { try { child.send({ t: 'pair-list-res', reqId: m.reqId, rooms: [], error: 'Cross-session reach is turned off on this bridge.' }) } catch { /* child gone */ } return }
             const local = [...children.keys()].filter((r) => r !== room).map((r) => ({ code: r, name: roomNames.get(r) || null }))
-            let remote = []
-            if (process.env.TP_PAIRBUS_OFF !== '1' && pairChannels.size) {
-              const replies = await busRequestCollect('peer-list-req', {}, 1200)
-              remote = replies.flatMap((p) => (Array.isArray(p?.rooms) ? p.rooms : []))
+            let authorized = []; let replies = []
+            if (process.env.TP_PAIRBUS_OFF !== '1') {
+              const result = await Promise.all([
+                authorizedPairRooms(room),
+                pairChannels.size ? busRequestCollect('peer-list-req', {}, 1200) : Promise.resolve([]),
+              ])
+              authorized = result[0].rooms; replies = result[1]
             }
+            const remote = mergePairRoomRoster({ authorized, replies, myUid: session.user.id, localCodes: children.keys() })
             try { child.send({ t: 'pair-list-res', reqId: m.reqId, rooms: [...local, ...remote] }) } catch { /* child gone */ }
           })()
         }
@@ -946,7 +937,14 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
               return
             }
             // REMOTE target — ask the pair bus(es).
-            if (process.env.TP_PAIRBUS_OFF === '1' || !pairChannels.size) return reply({ error: `Session ${target} is not running on this machine, and no pair bus is open to reach it.` })
+            if (process.env.TP_PAIRBUS_OFF === '1') return reply({ error: 'Cross-session reach is turned off on this bridge.' })
+            const [authorized, live] = await Promise.all([
+              authorizedPairRooms(room),
+              pairChannels.size ? busRequestCollect('peer-list-req', {}, 800) : Promise.resolve([]),
+            ])
+            if (authorized.verified && !authorized.rooms.some((r) => r?.code === target && r?.owner_id !== session.user.id)) return reply({ error: `Room ${target} is not shared with this pair.` })
+            if (!pairChannels.size) return reply({ error: authorized.verified ? `Room ${target} is paired with you, but its host bridge is offline.` : `Session ${target} is not running on this machine, and no pair bus is open to reach it.` })
+            if (!live.some((p) => p?.rooms?.some((r) => r?.code === target))) return reply({ error: `Room ${target} is paired with you, but its host bridge is offline.` })
             const res = await busPeek(target, m.terminal, m.lines)
             if (!res) return reply({ error: `Room ${target} did not respond — it may be offline, or not shared with you.` })
             reply({ text: res.text, error: res.error })
@@ -966,8 +964,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
               catch { pairPending.delete(reqId); reply({ error: `Could not reach session ${target}.` }) }
               return
             }
-            // REMOTE target — over the pair bus.
-            if (!pairChannels.size) return reply({ error: `Room ${target} is not on this machine, and no pair bus is open to reach it.` })
+            // REMOTE target — prove the partner's bridge is currently answering
+            // before starting a 180s human-approval wait. The DB-backed roster may
+            // legitimately list an offline paired room; reachability comes from the bus.
+            const [authorized, live] = await Promise.all([
+              authorizedPairRooms(room),
+              pairChannels.size ? busRequestCollect('peer-list-req', {}, 1200) : Promise.resolve([]),
+            ])
+            if (authorized.verified && !authorized.rooms.some((r) => r?.code === target && r?.owner_id !== session.user.id)) return reply({ error: `Room ${target} is not shared with this pair.` })
+            if (!pairChannels.size) return reply({ error: authorized.verified ? `Room ${target} is paired with you, but its host bridge is offline.` : `Room ${target} is not on this machine, and no pair bus is open to reach it.` })
+            if (!live.some((p) => p?.rooms?.some((r) => r?.code === target))) return reply({ error: `Room ${target} is paired with you, but its host bridge is offline — no recipient approval card can be raised yet.` })
             const res = await busPost(target, m.terminal, m.text, room, m.fromTerminalName)
             if (!res) return reply({ error: `Room ${target} did not respond to the hand-off in time.` })
             reply({ ok: res.ok, ref: res.ref, error: res.error })
@@ -1101,6 +1107,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     keepFresh.cancel()
     releaseSingleton()
     for (const c of children.values()) { try { c.kill(sig || 'SIGTERM') } catch { /* noop */ } }
+    pairBus.close()
     for (const { channel } of pairChannels.values()) { try { sb.removeChannel(channel) } catch { /* noop */ } }   // tear down pair buses (Tier 2/3)
     // Flush the presence LEAVE before exiting so the dashboard flips to
     // "not connected" in realtime (don't fire-and-forget the untrack).

package/bridge.mjs

@@ -113,7 +113,8 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
+import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
+import { createStandalonePairResponder, standalonePairIdentity } from './direct-pair-room.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { turnInFlight } from './update-gate.mjs'
@@ -1186,6 +1187,7 @@ const announce = () => {
 // Spec: docs/specs/2026-06-30-cross-room-ensemble.md
 const IS_ACCOUNT_CHILD = !!(process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1')
 const pairWaiters = new Map()   // reqId -> { resolve, timer } for our OUTBOUND requests
+let standalonePairChannel = null // standalone owner bridge's direct paired-session responder
 // Send a cross-room request to the supervisor and resolve with its reply ({ rooms }
 // or { text } / { error }). Fails soft (never throws into the tool handler): a
 // standalone bridge (no supervisor) or a disabled/timed-out request returns { error }.
@@ -1267,6 +1269,51 @@ async function receiveCrossRoomPost({ fromRoom, fromHost, fromTerminalName, text
   return { ok: true, ref: String(targetId).slice(0, 8) }
 }
 
+// A room can be legitimately live without the account supervisor: `npx
+// thinkpool-pair <ROOM>` and room-specific services run bridge.mjs directly. The
+// old Tier-2 route listened only in account.mjs, so those rooms appeared live in
+// the dashboard (`tpcode:<room>`) but falsely offline to list/read/post_session.
+// Join the SAME private, RLS-gated pair bus here when this process is standalone
+// and owns a real two-person room. The target bridge then answers for this room
+// directly and reuses receiveCrossRoomPost(), including the mandatory red receipt
+// card. Account children skip this path to avoid duplicate replies/cards.
+async function startStandalonePairResponder () {
+  if (IS_ACCOUNT_CHILD || process.env.TP_PAIRBUS_OFF === '1' || process.env.TP_CROSSROOM_OFF === '1') return
+  if (!codeAuthToken || !myServeUid) return
+  let row = null
+  try {
+    const url = `${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&select=code,name,owner_id,participants`
+    const res = await fetch(url, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } })
+    if (!res.ok) return
+    const rows = await res.json().catch(() => [])
+    row = Array.isArray(rows) ? rows[0] : null
+  } catch { return }
+  const identity = standalonePairIdentity({ row, myUid: myServeUid })
+  if (!identity?.topic) return
+
+  const responder = createStandalonePairResponder({
+    room,
+    roomName: row?.name || null,
+    host: os.hostname().replace(/\.local$/, ''),
+    formatPeek: (payload) => formatPeek({ selfId: null, sessions, terms, names: termNames, terminal: payload.terminal, lines: payload.lines }),
+    receivePost: (payload) => receiveCrossRoomPost(payload),
+  })
+  const ch = supabase.channel(identity.topic, { config: { private: true, broadcast: { self: false } } })
+  const reply = async (event, payload) => {
+    if (!payload) return
+    try { await ch.send({ type: 'broadcast', event, payload }) } catch { /* bus reconnect handles the next request */ }
+  }
+  ch.on('broadcast', { event: 'peer-list-req' }, ({ payload }) => { void reply('peer-list-res', responder.list(payload)) })
+    .on('broadcast', { event: 'peer-peek-req' }, ({ payload }) => { const out = responder.peek(payload); if (out) void reply('peer-peek-res', out) })
+    .on('broadcast', { event: 'peer-post-req' }, ({ payload }) => { void responder.post(payload).then((out) => { if (out) return reply('peer-post-res', out) }) })
+    .subscribe((status) => {
+      if (status === 'SUBSCRIBED') process.stderr.write(`\n  ◆ standalone pair bus subscribed — this live room can receive approval-gated cross-session tasks.\n`)
+      else if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') process.stderr.write(`\n  ◇ standalone pair bus ${status.toLowerCase().replace('_', ' ')} — cross-session reach will retry with realtime.\n`)
+    })
+  standalonePairChannel = ch
+}
+void startStandalonePairResponder()
+
 if (IS_ACCOUNT_CHILD) {
   // A SECOND message listener (Node allows many) dedicated to pair traffic — leaves
   // the account-child idle/token listener (bottom of file) untouched.
@@ -2306,7 +2353,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           if (target === room) return okText('That is this room — use read_terminal for terminals in your own room.')
           entry.pairPeekCount = (entry.pairPeekCount || 0) + 1
           if (entry.pairPeekCount > CROSSROOM.peekPerTurnCap) return okText(`Cross-session read limit reached for this turn (${CROSSROOM.peekPerTurnCap}). Continue with what you have.`)
-          const res = await pairRequest('pair-peek-req', { targetRoom: target, terminal: args?.terminal, lines: args?.lines })
+          const res = await pairRequest('pair-peek-req', { targetRoom: target, terminal: args?.terminal, lines: args?.lines }, CROSSROOM_BUS.busTimeoutMs + 2_000)
           if (res?.error) return okText(res.error)
           return okText(res?.text || `Room ${target} returned nothing.`)
         },
@@ -4833,6 +4880,7 @@ async function shutdown(code = 0, farewell = true) {
   // socket is alive; on a wedge it won't flush and the hard backstop above wins).
   try { await channel.untrack() } catch { /* noop */ }
   try { await supabase.removeChannel(channel) } catch { /* noop */ }
+  try { if (standalonePairChannel) await supabase.removeChannel(standalonePairChannel) } catch { /* noop */ }
   // BRG-2 (audit 2026-07-02): shutdown removed only the room channel, leaking the flow
   // topic (no presence to untrack, but the subscription + socket join outlived the
   // process teardown). Close it too so shutdown is symmetric.

package/claude-session.mjs

@@ -720,7 +720,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       'CROSS-TERMINAL HAND-OFF: you also have post_to_terminal(terminal, text) to send a message or task to ANOTHER AGENT terminal in this room (not a plain shell). Use it sparingly and only when the people clearly want the lanes to coordinate — e.g. "tell the backend terminal the API is ready", or to hand a sibling agent a concrete task. Every post requires a person in the room to approve a card before it is delivered, and an agent that was itself reached via a cross-post cannot post onward — so do not rely on it for chit-chat or loops. Prefer read_terminal to understand a sibling before you ever post to it.',
       'TERMINAL CREATION CONTRACT: conductors and workers use different tools. When a person explicitly asks to open, launch, start, or spawn a separate Cascade/conductor terminal, use open_main_terminal(name?, task?, model?) — it creates an independent MAIN terminal with no Ensemble owner. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for bounded WORKER SUB-TERMINALS when your authoritative role permits delegation. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers are always autonomous in bypassPermissions and never ask the room for an approval card; the bridge still enforces room caps, hop limits, the kill-switch, and isolated linked worktrees. Collect each worker with read_terminal and close_terminal immediately after using its result. Main conductors are independent terminals, keep their requested permission mode, and are not owned/closed through Ensemble.',
       'CROSS-SESSION AWARENESS: the Ensemble reaches across your SESSIONS, not just the terminals in this room. list_sessions() lists your OTHER ThinkPool Code rooms — both your own rooms running on this machine AND your partner\'s rooms in the same pair, reachable over the per-pair bus (a room on the partner\'s machine shows its host). read_session(session, terminal?) reads recent activity inside one (omit `terminal` to list that room\'s terminals, or pass a ref/name to read that lane). Both are READ-ONLY — they never change another session, and they reach ONLY your own rooms and rooms you share with your partner, never a stranger\'s. Reach for them when work spans rooms — "what\'s the other project up to", "pick up where the other session left off", or to check a long-running task elsewhere before you act here.',
-      'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. All of this works only under the ThinkPool account bridge; a standalone room sees just its own terminals.',
+      'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. Outbound list/read/post tools need the ThinkPool account bridge; a standalone owner room can still receive a paired hand-off directly and will always raise its own approval card before delivery.',
       'SUBAGENT POLICY: in this room, a main conductor delegates worker slices through visible spawn_terminal Ensemble lanes. A requested separate conductor is created with open_main_terminal, never Ensemble. Worker, leaf, Side, and managed Flow lanes do their assigned work directly. Do NOT reach for built-in Task/Agent subagents: an in-process subagent is invisible to the room, cannot be peered at or steered, and its work is lost to the Ensemble.',
       'RESEARCH LANE: you have a `research` tool that runs a REAL multi-source web search + adversarial verification and returns each claim marked HELD or REJECTED with citations. Reach for it when the people would genuinely benefit from looking something external up or settling a question of current fact — pricing, "is X still maintained / deprecated", "is that benchmark real", a debate over facts you are not sure of. Do NOT run it unprompted or for things you already know: first OFFER in plain language ("want me to spawn a research lane on that and check it?"), and only call `research(question)` once they agree — it spends real budget (plan-gated Free 5 / Plus 100 runs a month) and takes ~a minute. When it returns, present the held/rejected findings clearly and invite both people to weigh the sources, flagging any held claim that rests on a source they might not trust — that shared scrutiny is the point.',
       'PEER FIRST: other lanes may be working in the same repo as you, right now. Before starting substantive work — and before any code edit that could overlap another lane — check what the room is doing: the ROOM NOW snapshot appended to your latest turn, or read_terminal for detail; list_sessions/read_session when the question spans your other rooms. If a sibling is touching the same files or branch, coordinate (read its lane, or raise it in chat) instead of colliding.',

package/cross-terminal.mjs

@@ -644,7 +644,7 @@ export const formatPairRoster = (rooms, { thisRoom, error } = {}) => {
   // `host` is set for a Tier-2 cross-MACHINE room (it lives on a partner's Mac,
   // reached over the pair bus); a same-machine Tier-1 room has none. Rendering the
   // host tells the agent (and the people) which rooms are "over there".
-  const rows = list.map((r) => `- ${r.code}${r.name ? ` · "${r.name}"` : ''}${r.host ? ` · on ${r.host}` : ''}`)
+  const rows = list.map((r) => `- ${r.code}${r.name ? ` · "${r.name}"` : ''}${r.host ? ` · on ${r.host}` : ''}${r.online === false ? ' · partner bridge offline' : ''}`)
   return `Your other ThinkPool Code sessions (call read_session with a room code to look inside one):\n${rows.join('\n')}`
 }
 

package/direct-pair-room.mjs

@@ -0,0 +1,57 @@
+import { pairKeyFor, pairTopic } from './cross-terminal.mjs'
+
+// A standalone room bridge is already the authoritative process for its room. It
+// must be reachable over the pair bus even when the account-level supervisor is
+// not running. Keep the identity and request handling in a small tested module so
+// the standalone path preserves the same pair-only and bounded-post invariants as
+// account.mjs.
+
+export function standalonePairIdentity ({ row, myUid } = {}) {
+  const participants = Array.isArray(row?.participants) ? row.participants.map(String) : []
+  const me = String(myUid || '')
+  if (!me || String(row?.owner_id || '') !== me || participants.length !== 2 || !participants.includes(me)) return null
+  const partnerUid = participants.find((uid) => uid !== me)
+  const key = pairKeyFor(me, partnerUid)
+  if (!partnerUid || !key) return null
+  return { partnerUid, key, topic: pairTopic(key) }
+}
+
+export function createStandalonePairResponder ({
+  room,
+  roomName = null,
+  host = null,
+  formatPeek,
+  receivePost,
+  now = () => Date.now(),
+  postLimit = 6,
+  postWindowMs = 60_000,
+} = {}) {
+  if (!room || typeof formatPeek !== 'function' || typeof receivePost !== 'function') {
+    throw new TypeError('room, formatPeek, and receivePost are required')
+  }
+  let bucket = { count: 0, resetAt: 0 }
+
+  const isTarget = (payload) => String(payload?.targetRoom || '').toUpperCase().trim() === room
+  const allowPost = () => {
+    const t = now()
+    if (t >= bucket.resetAt) bucket = { count: 0, resetAt: t + postWindowMs }
+    if (bucket.count >= postLimit) return false
+    bucket.count += 1
+    return true
+  }
+
+  return Object.freeze({
+    list: (payload) => ({ nonce: payload?.nonce, rooms: [{ code: room, name: roomName, host }] }),
+    peek: (payload) => {
+      if (!isTarget(payload)) return null
+      try { return { nonce: payload?.nonce, text: formatPeek(payload) } }
+      catch { return { nonce: payload?.nonce, error: 'Could not read that session.' } }
+    },
+    post: async (payload) => {
+      if (!isTarget(payload)) return null
+      if (!allowPost()) return { nonce: payload?.nonce, error: 'Too many cross-room posts to this device right now — try again shortly.' }
+      try { return { nonce: payload?.nonce, ...(await receivePost(payload)) } }
+      catch { return { nonce: payload?.nonce, error: `Could not deliver to room ${room}.` } }
+    },
+  })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.285",
+  "version": "0.7.287",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -55,6 +55,8 @@
     "session-store.mjs",
     "side-lane.mjs",
     "cross-terminal.mjs",
+    "pair-bus.mjs",
+    "direct-pair-room.mjs",
     "lane-lifecycle.mjs",
     "interrupted-resume.mjs",
     "dispatch-lease.mjs",

package/pair-bus.mjs

@@ -0,0 +1,98 @@
+// Deterministic request broker for the cross-machine pair bus.
+//
+// Supabase channel.send() is asynchronous and a channel is not usable until its
+// subscription callback reports SUBSCRIBED. Keeping those facts in one tested
+// primitive prevents a joining/dead channel from impersonating a reachable peer
+// and prevents a fast reply from arriving before its waiter exists.
+
+export const PAIR_BUS_STATUS = Object.freeze({
+  JOINING: 'joining',
+  SUBSCRIBED: 'subscribed',
+  ERROR: 'error',
+  CLOSED: 'closed',
+})
+
+export const pairBusStatusFromRealtime = (status) => {
+  if (status === 'SUBSCRIBED') return PAIR_BUS_STATUS.SUBSCRIBED
+  if (status === 'CLOSED') return PAIR_BUS_STATUS.CLOSED
+  if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') return PAIR_BUS_STATUS.ERROR
+  return PAIR_BUS_STATUS.JOINING
+}
+
+export const subscribedPairChannels = (channels) =>
+  [...(channels?.values?.() || [])].filter((entry) =>
+    entry?.status === PAIR_BUS_STATUS.SUBSCRIBED && entry?.channel?.send)
+
+export async function sendPairBroadcast (channels, event, payload) {
+  const results = await Promise.all(subscribedPairChannels(channels).map(async ({ channel }) => {
+    try { return (await channel.send({ type: 'broadcast', event, payload })) === 'ok' }
+    catch { return false }
+  }))
+  return results.filter(Boolean).length
+}
+
+export function createPairBusBroker ({ channels, randomId, setTimer = setTimeout, clearTimer = clearTimeout } = {}) {
+  if (!channels?.values || typeof randomId !== 'function') throw new TypeError('channels and randomId are required')
+  const waiters = new Map()
+
+  const resolve = (payload) => {
+    if (!payload?.nonce) return false
+    const waiter = waiters.get(payload.nonce)
+    if (!waiter) return false
+    if (waiter.mode === 'collect') { waiter.acc.push(payload); return true }
+    clearTimer(waiter.timer); waiters.delete(payload.nonce); waiter.finish(payload)
+    return true
+  }
+
+  const requestFirst = (event, payload = {}, timeoutMs) => new Promise((finish) => {
+    const nonce = randomId()
+    const timer = setTimer(() => { waiters.delete(nonce); finish(null) }, timeoutMs)
+    timer?.unref?.()
+    waiters.set(nonce, { mode: 'first', finish, timer })
+    void sendPairBroadcast(channels, event, { ...payload, nonce }).then((sent) => {
+      if (sent || !waiters.has(nonce)) return
+      clearTimer(timer); waiters.delete(nonce); finish(null)
+    })
+  })
+
+  const requestCollect = (event, payload = {}, windowMs) => new Promise((finish) => {
+    const nonce = randomId()
+    const acc = []
+    const timer = setTimer(() => { waiters.delete(nonce); finish(acc) }, windowMs)
+    timer?.unref?.()
+    waiters.set(nonce, { mode: 'collect', acc, finish, timer })
+    void sendPairBroadcast(channels, event, { ...payload, nonce }).then((sent) => {
+      if (sent || !waiters.has(nonce)) return
+      clearTimer(timer); waiters.delete(nonce); finish(acc)
+    })
+  })
+
+  const close = () => {
+    for (const [nonce, waiter] of waiters) {
+      clearTimer(waiter.timer)
+      waiter.finish(waiter.mode === 'collect' ? waiter.acc : null)
+      waiters.delete(nonce)
+    }
+  }
+
+  return Object.freeze({ resolve, requestFirst, requestCollect, close, pendingCount: () => waiters.size })
+}
+
+// The database is the authorization/discovery source; bus replies are the live
+// reachability source. Paired rooms remain visible while their host bridge is
+// offline and become online only when that host actually answers on the bus.
+export function mergePairRoomRoster ({ authorized = [], replies = [], myUid, localCodes = [] } = {}) {
+  const local = new Set(localCodes)
+  const rooms = new Map()
+  for (const row of authorized) {
+    if (!row?.code || row.owner_id === myUid || local.has(row.code)) continue
+    rooms.set(row.code, { code: row.code, name: row.name || null, online: false })
+  }
+  for (const reply of replies) {
+    for (const row of Array.isArray(reply?.rooms) ? reply.rooms : []) {
+      if (!row?.code || local.has(row.code)) continue
+      rooms.set(row.code, { code: row.code, name: row.name || rooms.get(row.code)?.name || null, host: row.host || null, online: true })
+    }
+  }
+  return [...rooms.values()]
+}