thinkpool-pair 0.7.292 → 0.7.294

package/README.md

@@ -144,12 +144,25 @@ npx thinkpool-pair@latest <ROOM> -- claude           # structured Claude, no TTY
 - `pty-in` — keystrokes/prompts from the web → written to that terminal's PTY.
 - `term-open` / `term-close` / `term-exit` — web-driven terminal lifecycle.
 - `replay-request` / `pty-replay` — each terminal keeps a rolling ~120 KB
-  scrollback buffer; joining/reloading clients get it replayed, so the room
-  never opens blank while the bridge is up. **Nothing is stored server-side** —
-  history lives exactly as long as the bridge runs.
+  scrollback buffer for live recovery. Thinkpool also stores the cleaned reader
+  transcript and room events so members can reopen the room. It does not store
+  a copy of the repository or the raw PTY byte stream.
 - `resize` — web viewport size → headless PTYs only (the attached terminal
   follows your own TTY).
 
+## Inspect the privacy boundary
+
+Run a local report before pairing a repository:
+
+```bash
+npx thinkpool-pair@latest privacy-report
+```
+
+It lists the project directories configured for this bridge, the local records
+present under `~/.thinkpool-pair`, known outbound service domains, what
+Thinkpool stores remotely, and the limits of the report. It never prints a
+provider key, refresh token, or bridge private key.
+
 ## Run any model
 
 ThinkPool Code runs **any model you choose** — not just Anthropic. The agent

package/account.mjs

@@ -416,6 +416,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
   const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
   const childPeer = new Map()  // room -> bool (a web client is watching this room)
+  const readyRooms = new Set() // child subscribed + restored + announced usable room state
   // Thinkpool Ensemble cross-ROOM router (Tier 1): the supervisor is the only process
   // that knows every room on this machine, so it routes a child's read_session into the
   // target room's child and relays the reply back. roomNames feeds list_sessions; pairPending
@@ -562,7 +563,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // to spawn against — re-read each announce so an add/remove reflects immediately.
   // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
   const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), ts: Date.now() })
 
   // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
   // AUTH: the account channel `tpacct:<uid>` is created WITHOUT config.private:true,
@@ -895,12 +896,18 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       console.log(`child_spawn sup=${SUP_ID} room=${room} pid=${child.pid} dir=${dir} had_prior=${alreadyHad}`)
 
       children.set(room, child)
+      readyRooms.delete(room)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child
       childBetween.set(room, false)
       childPeer.set(room, false)
       child.on('message', (m) => {
         if (!m) return
-        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childBetween.set(room, m.between != null ? !!m.between : !!m.idle); childPeer.set(room, !!m.webPeer) }
+        if (m.t === 'room-ready') {
+          readyRooms.add(room)
+          console.log(`child_ready sup=${SUP_ID} room=${room} pid=${child.pid}`)
+          pushPresence()
+        }
+        else if (m.t === 'idle') { childIdle.set(room, !!m.idle); childBetween.set(room, m.between != null ? !!m.between : !!m.idle); childPeer.set(room, !!m.webPeer) }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
         // ── Thinkpool Ensemble cross-ROOM routing ──────────────────────────────
         // `room` here is the room that sent the message (this closure is per-child).
@@ -993,7 +1000,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
         // ── supervisor child_exit logging (cascade brg-instrument) ─────────────────
         console.log(`child_exit sup=${SUP_ID} room=${room} pid=${child?.pid || '?'} code=${code || '?'}`)
 
-        children.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room); roomNames.delete(room); roomPartner.delete(room)   // re-served on the next tick
+        children.delete(room); readyRooms.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room); roomNames.delete(room); roomPartner.delete(room)   // re-served on the next tick
         // Fail any in-flight cross-room peeks/posts this dead room had ASKED (bus-origin
         // entries have askerRoom null and just time out on their own).
         for (const [reqId, w] of pairPending) { if (w?.askerRoom === room) pairPending.delete(reqId) }

package/bridge.mjs

@@ -226,6 +226,12 @@ const pickAgent = (installed) => new Promise((resolve) => {
 
 const argv = process.argv.slice(2)
 
+if (argv[0] === 'privacy-report') {
+  const { runPrivacyReport } = await import('./privacy-report.mjs')
+  runPrivacyReport()
+  process.exit(0)
+}
+
 // Boot-persistent service install (cross-platform: launchd / systemd / Windows
 // Startup). Subcommand form: `thinkpool-pair install-service <ROOM> [-- <cmd>]`.
 if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
@@ -1111,7 +1117,7 @@ const announce = () => {
   // on a custom provider without the owner's account-channel registry.
   const provNames = providerNameMap()
   const rev = ++announceRev
-  return bcast('bridge', {
+  return bcastAwait('bridge', {
     v: 2, name, bridge_id: BRIDGE_ID, started_at: BRIDGE_STARTED_AT, rev, repo: repoLabel, branch: readBranch(),
     // sdkWarn: the auto-pulled agent SDK failed its boot compatibility smoke test —
     // surfaced so the room can show a banner (turns may misbehave; pin a good SDK).
@@ -4453,7 +4459,14 @@ channel
           openTerm({ id: ptyId, cmd: startCmd, args: attachedArgs, attached: !autoAgent })
         }
       }
-      announce()
+      await announce()
+      // Account presence must distinguish a spawned child from a usable room.
+      // Signal only after realtime subscribed, durable sessions restored, and the
+      // first authoritative roster was announced. The dashboard keeps the bridge
+      // in "Restarting" until every pre-restart room reaches this boundary.
+      if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+        try { process.send({ t: 'room-ready', room, bridgeId: BRIDGE_ID }) } catch { /* supervisor exited */ }
+      }
       process.stderr.write(headless
         ? `\n  ◆ thinkpool — relaying room ${room} (headless). Open terminals from the web UI.\n\n`
         : `\n  ◆ thinkpool — sharing "${attachedCmd}"${continuing ? ' (continuing your latest session)' : ''} into room ${room}.  Open the web UI and you're both in.\n\n`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.292",
+  "version": "0.7.294",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
     "sdk-admission.mjs",
     "sdk-admission.mjs",
     "launcher.mjs",
+    "privacy-report.mjs",
     "byok-detect.mjs",
     "context-windows.mjs",
     "claude-session.mjs",

package/privacy-report.mjs

@@ -0,0 +1,108 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const cleanHost = (value) => {
+  try { return new URL(value).host } catch { return null }
+}
+
+const readJson = (file, fallback) => {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return fallback }
+}
+
+const displayPath = (value, home) => {
+  const resolved = path.resolve(String(value || ''))
+  return resolved === home ? '~' : resolved.startsWith(`${home}${path.sep}`) ? `~${resolved.slice(home.length)}` : resolved
+}
+
+export function buildPrivacyReport({
+  home = os.homedir(),
+  cwd = process.cwd(),
+  env = process.env,
+  exists = fs.existsSync,
+  read = readJson,
+} = {}) {
+  const configDir = path.join(home, '.thinkpool-pair')
+  const dirs = read(path.join(configDir, 'dirs.json'), {}) || {}
+  const served = read(path.join(configDir, 'served.json'), {}) || {}
+  const providers = read(path.join(configDir, 'providers.json'), []) || []
+  const legacyProvider = read(path.join(configDir, 'provider.json'), null)
+  let defaultDir = ''
+  try { defaultDir = fs.readFileSync(path.join(configDir, 'default-dir'), 'utf8').trim() } catch { /* not configured */ }
+
+  const projectDirs = new Set([cwd, defaultDir, ...Object.values(dirs), ...Object.values(served)].filter(Boolean).map((p) => displayPath(p, home)))
+  const providerHosts = new Set([
+    ...providers.map((provider) => cleanHost(provider?.baseUrl)),
+    cleanHost(legacyProvider?.baseUrl),
+  ].filter(Boolean))
+  const supabaseHost = cleanHost(env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co')
+  const webHost = cleanHost(env.TP_WEB_BASE || 'https://thinkpool.io')
+
+  const localRecords = [
+    ['Saved login', 'auth.json', exists(path.join(configDir, 'auth.json')), 'refresh token and account identity'],
+    ['Provider registry', 'providers.json', exists(path.join(configDir, 'providers.json')), 'provider endpoint, model, and API key'],
+    ['Bridge keypair', 'bridge-key.json', exists(path.join(configDir, 'bridge-key.json')), 'private key used to open browser-sealed provider keys'],
+    ['Room directories', 'dirs.json / served.json', exists(path.join(configDir, 'dirs.json')) || exists(path.join(configDir, 'served.json')), 'room-to-project directory mappings'],
+    ['Bridge logs', 'update.log and service logs', exists(path.join(configDir, 'update.log')), 'update and background-service diagnostics'],
+  ]
+
+  return {
+    generatedAt: new Date().toISOString(),
+    configDir: displayPath(configDir, home),
+    projectDirs: [...projectDirs].sort(),
+    localRecords,
+    outbound: [
+      [webHost, 'Thinkpool configuration, linking, version checks, and product APIs'],
+      [supabaseHost, 'authentication, room database, storage, and realtime transport'],
+      ['registry.npmjs.org', 'package installation and updates initiated with npm or npx'],
+      ...[...providerHosts].sort().map((host) => [host, 'AI provider selected on this bridge']),
+    ].filter(([host]) => host),
+    remote: [
+      ['Thinkpool cloud receives', 'account/profile data; room membership and metadata; room chat; cleaned terminal output; terminal and room events; attachments; operational request metadata'],
+      ['Thinkpool cloud does not receive as a repository', 'a crawled copy of the project directory or repository file tree'],
+      ['Readable provider key', 'stored locally by the bridge; Thinkpool relays only a browser-sealed envelope'],
+      ['AI prompts and code context', 'sent by the local coding agent to the selected AI provider; content depends on that runtime and the task'],
+    ],
+    limits: [
+      'Coding-agent runtimes and commands can contact domains beyond the bridge list above.',
+      'Thinkpool room transcripts are readable by Thinkpool infrastructure today; they are not end-to-end encrypted.',
+      'This report describes configured access. It is not a packet capture or a guarantee that a third-party agent obeys the same boundary.',
+    ],
+  }
+}
+
+export function formatPrivacyReport(report) {
+  const yn = (value) => value ? 'present' : 'not present'
+  const lines = [
+    '',
+    '  THINKPOOL PRIVACY REPORT',
+    `  generated ${report.generatedAt}`,
+    '',
+    '  LOCAL ACCESS',
+    `  Bridge configuration: ${report.configDir}`,
+    ...report.projectDirs.map((dir) => `  Project directory:     ${dir}`),
+    '',
+    '  LOCAL RECORDS',
+    ...report.localRecords.map(([label, file, present, contains]) => `  ${label}: ${yn(present)} (${file})\n    contains: ${contains}`),
+    '',
+    '  OUTBOUND DOMAINS',
+    ...report.outbound.map(([host, reason]) => `  ${host}\n    ${reason}`),
+    '',
+    '  REMOTE DATA',
+    ...report.remote.map(([label, detail]) => `  ${label}:\n    ${detail}`),
+    '',
+    '  IMPORTANT LIMITS',
+    ...report.limits.map((line) => `  - ${line}`),
+    '',
+    '  Full data map: https://thinkpool.io/data',
+    '',
+  ]
+  return lines.join('\n')
+}
+
+export function runPrivacyReport(options) {
+  const report = buildPrivacyReport(options)
+  process.stdout.write(formatPrivacyReport(report))
+  return report
+}
+