thinkpool-pair 0.7.299 → 0.7.301

package/codex-session.mjs

@@ -577,14 +577,13 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       appServerThreadReady = true
       pushMappedEvent({ type: 'thread.started', thread_id: sessionId })
       return true
-    } catch (error) {
+    } catch {
       // Fallback is safe only here: no turn/start request has been accepted, so
       // there is no possibility of running the same prompt twice.
       appServerDisabled = true
       try { appServer?.end() } catch { /* noop */ }
       appServer = null
       appServerThreadReady = false
-      note(`Codex App Server unavailable; using codex exec: ${error?.message || error}`)
       return false
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.299",
+  "version": "0.7.301",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 9,
+  "bundleVersion": 10,
   "contracts": [
     {
       "id": "room-coordination",
@@ -88,13 +88,13 @@
     },
     {
       "id": "visual-proof",
-      "version": 1,
+      "version": 2,
       "routes": [
         {
           "id": "visual-proof",
           "tools": ["preview_start", "preview_capture", "preview_inspect", "preview_stop"],
           "trigger": "\\b(ui|ux|visual|design|frontend|html|css|page|route|mockup|screenshot|responsive|desktop|mobile|preview)\\b",
-          "prompt": "For built visual work, run the build, use preview_start, preview_capture at desktop and mobile, preview_inspect when rendered state matters, and preview_stop when finished. Surface PNG evidence only when no interactive source-backed Design card is displayed."
+          "prompt": "For built visual work, run the build, use preview_start, preview_capture at desktop and mobile, preview_inspect when rendered state matters, and preview_stop when finished. preview_capture uses a fresh isolated browser, so authenticated app routes require an authenticated visual harness; if a room route resolves to the signed-out invitation, the capture is rejected and no mockup card is created. Surface PNG evidence only when no interactive source-backed Design card is displayed."
         }
       ],
       "impact": [

package/viewport.mjs

@@ -64,6 +64,12 @@ export function safeSlug(value = 'viewport') {
     .slice(0, 56) || 'viewport'
 }
 
+export function isSignedOutRoomPreview(route, snapshot) {
+  const parsed = new URL(normalizeRoute(route), 'http://127.0.0.1')
+  if (!parsed.searchParams.get('r')) return false
+  return /\bid\s*=\s*["']invitation-room-title["']/i.test(String(snapshot || ''))
+}
+
 export function findBrowserExecutable({ env = process.env, platform = process.platform, exists = fs.existsSync } = {}) {
   const candidates = [
     env.TP_BROWSER_PATH,
@@ -425,6 +431,17 @@ export class ViewportManager {
     if (names.some((name) => !DEFAULT_VIEWPORTS[name])) throw new Error('viewports must be "both", "desktop", or "mobile".')
     await fsp.mkdir(this.outbox, { recursive: true })
     const slug = `${safeSlug(title)}-${Date.now().toString(36)}`
+    // A preview browser is deliberately isolated and cannot inherit the room
+    // member's Supabase session. Catch the production failure mode where an
+    // agent requests /?r=ROOM expecting Code, but actually renders the public
+    // invitation landing and publishes it under an unrelated feature title.
+    // Validate before writing screenshots or a manifest so no misleading card
+    // can enter the room.
+    const snapshotViewport = names.includes('desktop') ? DEFAULT_VIEWPORTS.desktop : DEFAULT_VIEWPORTS[names[0]]
+    const snapshot = await this.browser.snapshot({ url, viewport: snapshotViewport, waitMs })
+    if (isSignedOutRoomPreview(normalizedRoute, snapshot)) {
+      throw new Error('Preview resolved to the signed-out room invitation instead of the authenticated Code room. preview_capture uses a fresh isolated browser and cannot inherit a person\'s login. Use an authenticated visual harness or signed-in browser evidence; no mockup card was created.')
+    }
     const captures = {}
     for (const name of names) {
       const result = await this.browser.capture({ url, viewport: DEFAULT_VIEWPORTS[name], fullPage, waitMs })
@@ -432,8 +449,6 @@ export class ViewportManager {
       await fsp.writeFile(file, result.png)
       captures[name] = { ...result, file }
     }
-    const snapshotViewport = names.includes('desktop') ? DEFAULT_VIEWPORTS.desktop : DEFAULT_VIEWPORTS[names[0]]
-    const snapshot = await this.browser.snapshot({ url, viewport: snapshotViewport, waitMs })
     const snapshotPath = path.join(this.outbox, `${slug}--source.html`)
     await fsp.writeFile(snapshotPath, snapshot)
     const workspace = await fsp.realpath(this.workspaceRoot)
@@ -487,7 +502,7 @@ export function createViewportTools({ tool, z, manager }) {
     ),
     tool(
       'preview_capture',
-      'Capture this lane preview at exact desktop (1440×900) and mobile (390×844) CSS viewports. Defaults to both and full-page. Returns the PNGs to your vision context and also surfaces a mockup card in the ThinkPool room.',
+      'Capture this lane preview in a fresh isolated browser at exact desktop (1440×900) and mobile (390×844) CSS viewports. Defaults to both and full-page. Authenticated app routes require an authenticated visual harness; a room route that resolves to the signed-out invitation is rejected. Successful captures return PNGs to your vision context and surface a mockup card in the ThinkPool room.',
       {
         path: z.string().max(500).optional().describe('route within the preview, e.g. / or /settings; never a full URL'),
         viewports: z.enum(['both', 'desktop', 'mobile']).optional(),