thinkpool-pair 0.7.310 → 0.7.311

package/account.mjs

@@ -13,7 +13,7 @@ import path from 'node:path'
 import fs from 'node:fs'
 import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
-import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
+import { saveAuth, loadAuth, markAuthReconnectRequired, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack, presenceSelfEchoObservation } from './presence.mjs'
 import { publicKeyB64, announceProviders, listProviders, addProvider, addProviderModel, removeProvider, unseal } from './providers.mjs'
@@ -252,16 +252,33 @@ export async function refreshAccountSession(sb, holdRefreshToken, deps = {}) {
     if (adopted) return adopted
     const rt = load()?.refresh_token || rt0
     const { data, error } = await sb.auth.refreshSession({ refresh_token: rt })
-    if (error || !data?.session) return null
+    // Preserve the server's structured Auth error. The caller must distinguish a
+    // retryable network/service failure from a refresh token that is definitively
+    // gone; collapsing both to null is what let a disconnected account keep painting
+    // as a healthy bridge until its presence JWT finally expired.
+    if (error || !data?.session) return { session: null, error: error || null }
     save(data.session)   // atomic (auth-store) — never a torn token file
     return { session: data.session, adopted: false }
   } finally { if (locked) release() }
 }
 
+// Supabase documents these as terminal session/refresh-token states. They require a
+// fresh device-code login; request timeouts, rate limits and 5xx errors remain retryable.
+export const ACCOUNT_RECONNECT_ERROR_CODES = new Set([
+  'refresh_token_not_found',
+  'refresh_token_already_used',
+  'session_not_found',
+])
+
+export function accountRefreshNeedsReconnect(error) {
+  return ACCOUNT_RECONNECT_ERROR_CODES.has(String(error?.code || ''))
+}
+
 // Exchange the stored credentials for a live session + authed client.
 export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
   const a = loadAuth()
   if (!a?.refresh_token) return null
+  if (a.reconnect_required) return { reconnectRequired: true }
   const sb = createClient(SUPABASE_URL, SUPABASE_ANON, { auth: { persistSession: false, autoRefreshToken: false } })
   // F1: skip the refresh entirely when the saved access token is still comfortably valid
   // (>5 min to expiry). Every gratuitous startup rotation is a race window — and, killed
@@ -273,7 +290,13 @@ export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
   }
   // Near-expiry / missing / invalid access token → do a serialized rotation (F3).
   const r = await refreshAccountSession(sb, a.refresh_token)
-  if (!r?.session) return null
+  if (!r?.session) {
+    if (accountRefreshNeedsReconnect(r?.error)) {
+      markAuthReconnectRequired(r.error.code)
+      return { reconnectRequired: true }
+    }
+    return null
+  }
   return { sb, session: r.session }
 }
 
@@ -289,6 +312,7 @@ export async function authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, opts =
   let delay = baseMs
   for (let n = 1; n <= maxAttempts; n++) {
     const a = await attempt(SUPABASE_URL, SUPABASE_ANON)
+    if (a?.reconnectRequired) return a
     if (a) return a
     if (!load()?.refresh_token) return null   // not linked — caller says `login`, exits 0
     if (n >= maxAttempts) break
@@ -320,10 +344,11 @@ export function claimLoopWedged({ lastClaimOkAt, now, quietMsThreshold = 40_000
 //   skewMs  — refresh this far ahead of expiry (default 90s)
 //   forceMs — fixed interval override (test hook: TP_TOKEN_REFRESH_FORCE_MS)
 //   retryMs — backoff after a transient failure (offline / rotation race)
-export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000, forceMs = 0, retryMs = 30_000, refresh = refreshAccountSession }) {
+export function scheduleTokenRefresh({ sb, session, onRefreshed, onReconnectRequired, skewMs = 90_000, forceMs = 0, retryMs = 30_000, refresh = refreshAccountSession }) {
   let timer = null
   let cur = session
   let cancelled = false
+  let reconnectRequired = false
   const arm = (delay) => {
     if (cancelled) return
     clearTimeout(timer)
@@ -343,12 +368,21 @@ export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000
       // instead of blindly refreshing with our in-memory `cur.refresh_token` — the old
       // tick retried with a stale token it held and could lose the family to a race.
       const r = await refresh(sb, cur.refresh_token)
-      if (!r?.session) throw new Error('no session')
+      if (!r?.session) {
+        if (accountRefreshNeedsReconnect(r?.error)) {
+          if (!reconnectRequired) {
+            reconnectRequired = true
+            try { await onReconnectRequired?.(r.error) } catch { /* reporting is best-effort; retry still owns recovery */ }
+          }
+        }
+        throw r?.error || new Error('no session')
+      }
       cur = r.session
       // Hand the fresh token to the live realtime socket so the presence
       // connection stays authed across the swap (no drop, no rejoin needed).
       try { sb.realtime?.setAuth?.(cur.access_token) } catch { /* noop */ }
-      try { onRefreshed?.(cur) } catch { /* noop */ }
+      reconnectRequired = false
+      try { await onRefreshed?.(cur) } catch { /* noop */ }
       arm(nextDelay())
     } catch {
       // Transient (offline, or a refresh-token rotation race with another login).
@@ -394,6 +428,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.error('\n  ◇ Not linked to a ThinkPool account on this machine.\n    Link it:  npx thinkpool-pair login\n')
     process.exit(0)
   }
+  if (auth.reconnectRequired) {
+    releaseStartupAnchor()
+    releaseSingleton()
+    console.error('\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n')
+    process.exit(0)
+  }
   const { sb, session } = auth
   const email = session.user?.email || 'your account'
   // Current owner JWT, handed to each room-bridge child for authed web writes
@@ -548,6 +588,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // lastTrackStatus retains the most recent track()'s server verdict ('ok'|'timed out'|
   // 'error') so the presence self-echo watchdog can log WHY presence went dark.
   let lastTrackStatus = 'init'
+  let accountAuthState = 'connected'
   const trackPresence = makeThrottledTrack(acct, { minMs: 5000, onStatus: (s) => { lastTrackStatus = s } })
   // `service` lets the dashboard show whether this bridge is the durable installed
   // service (always-on, survives reboot) vs a foreground `npx` run that dies with its
@@ -560,7 +601,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // to spawn against — re-read each announce so an add/remove reflects immediately.
   // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
   const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), accountAuthState, ts: Date.now() })
+
+  // Persist account-auth truth separately from process presence. Presence will vanish
+  // when the old JWT expires; the claim row keeps the reconnect instruction visible on
+  // the dashboard until this same bridge refreshes successfully or another bridge takes
+  // over with a healthy login. Older databases simply reject this best-effort RPC.
+  const reportAccountAuthState = async (state) => {
+    try {
+      await withTimeout(sb.rpc('report_bridge_auth_state', { p_bridge_id: BRIDGE_ID, p_state: state }), 5000, 'report_bridge_auth_state')
+    } catch { /* migration not present yet, offline, or the old JWT already expired */ }
+  }
 
   // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
   // AUTH: the account channel `tpacct:<uid>` is created WITHOUT config.private:true,
@@ -647,13 +698,22 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const keepFresh = scheduleTokenRefresh({
     sb,
     session,
-    onRefreshed: (s) => {
+    onRefreshed: async (s) => {
+      accountAuthState = 'connected'
       saveAuth(s); pushPresence()
+      await reportAccountAuthState('connected')
       // Push the rotated owner token to every live child so their authed writes
       // (code-mockup) never go stale on a long session (whip L16).
       currentAccessToken = s.access_token || currentAccessToken
       for (const c of children.values()) { try { c.send({ t: 'token', accessToken: currentAccessToken }) } catch { /* child not ready */ } }
     },
+    onReconnectRequired: async (error) => {
+      accountAuthState = 'reconnect-required'
+      markAuthReconnectRequired(error?.code || 'refresh-token-invalid')
+      pushPresence()
+      await reportAccountAuthState('reconnect-required')
+      process.stderr.write('\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n')
+    },
     forceMs: parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS, 10) || 0,
   })
 

package/auth-store.mjs

@@ -19,19 +19,8 @@ const SERVED = path.join(DIR, 'served.json')
 
 function ensureDir() { try { fs.mkdirSync(DIR, { recursive: true }) } catch { /* noop */ } }
 
-export function saveAuth(session) {
-  if (!session?.refresh_token) return
+function writeAuthPayload(payload) {
   ensureDir()
-  const payload = JSON.stringify({
-    refresh_token: session.refresh_token,
-    access_token: session.access_token || null,
-    // Unix SECONDS. Lets the bridge adopt the saved access token WITHOUT a refresh while
-    // it's still comfortably valid (account.mjs F1) — every skipped rotation is one fewer
-    // race window (and one fewer chance to be killed mid-rotation and brick the login).
-    expires_at: session.expires_at || null,
-    email: session.user?.email || session.email || null,
-    savedAt: Date.now(),
-  })
   // ATOMIC write (2026-07-08): a crash/kill/kickstart mid-write must never leave a
   // truncated auth.json — an unparseable token file reads as "not linked" and bricks the
   // saved login (three bridge outages in two days, one from a restart landing mid-rotation).
@@ -43,13 +32,38 @@ export function saveAuth(session) {
   const tmp = `${AUTH}.tmp.${process.pid}.${Date.now()}`
   try {
     const fd = fs.openSync(tmp, 'w', 0o600)
-    try { fs.writeSync(fd, payload); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+    try { fs.writeSync(fd, JSON.stringify(payload)); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
     fs.renameSync(tmp, AUTH)
   } catch {
     try { fs.rmSync(tmp, { force: true }) } catch { /* noop */ }
   }
 }
+
+export function saveAuth(session) {
+  if (!session?.refresh_token) return
+  writeAuthPayload({
+    refresh_token: session.refresh_token,
+    access_token: session.access_token || null,
+    // Unix SECONDS. Lets the bridge adopt the saved access token WITHOUT a refresh while
+    // it's still comfortably valid (account.mjs F1) — every skipped rotation is one fewer
+    // race window (and one fewer chance to be killed mid-rotation and brick the login).
+    expires_at: session.expires_at || null,
+    email: session.user?.email || session.email || null,
+    savedAt: Date.now(),
+  })
+}
 export function loadAuth() { try { return JSON.parse(fs.readFileSync(AUTH, 'utf8')) } catch { return null } }
+export function markAuthReconnectRequired(errorCode = null) {
+  const current = loadAuth()
+  if (!current?.refresh_token) return false
+  writeAuthPayload({
+    ...current,
+    reconnect_required: true,
+    reconnect_error_code: errorCode || null,
+    reconnect_required_at: Date.now(),
+  })
+  return true
+}
 export function clearAuth() { try { fs.unlinkSync(AUTH) } catch { /* noop */ } }
 
 export function loadDirs() { try { return JSON.parse(fs.readFileSync(DIRS, 'utf8')) } catch { return {} } }

package/launcher.mjs

@@ -75,8 +75,10 @@ export function detectState() {
   const hermesInstalled = onPath('hermes')
   const hermesReady = onPath('thinkpool') && probeHermesRuntime().available
   const accountSvc = serviceLoaded(null)
+  const reconnectRequired = !!auth?.reconnect_required
   return {
-    loggedIn: !!auth?.refresh_token,
+    loggedIn: !!auth?.refresh_token && !reconnectRequired,
+    reconnectRequired,
     email: auth?.email || auth?.user?.email || null,
     provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
     providerModel: isCustom ? (provider.model || null) : null,
@@ -106,6 +108,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     ...next,
     agents: Array.isArray(next?.agents) ? next.agents : [],
     loggedIn: !!next?.loggedIn,
+    reconnectRequired: !!next?.reconnectRequired,
     accountSvc: !!next?.accountSvc,
     serviceVersion: typeof next?.serviceVersion === 'string' && next.serviceVersion ? next.serviceVersion : null,
     platform: next?.platform || process.platform,
@@ -130,7 +133,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     io.print('')
     io.print('  ' + C.dim('┌ ') + C.bold('thinkpool-pair') + C.dim(' ' + '─'.repeat(40)))
     io.print(`  ${C.dim('│ launcher ')} ${state.version ? `v${state.version}` : 'version unavailable'}`)
-    io.print(`  ${C.dim('│ account  ')} ${state.loggedIn ? C.green((state.email || 'linked') + ' ✓') : C.yellow('not linked')}`)
+    io.print(`  ${C.dim('│ account  ')} ${state.reconnectRequired ? C.yellow('reconnect required') : state.loggedIn ? C.green((state.email || 'linked') + ' ✓') : C.yellow('not linked')}`)
     io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none ready')}`)
     io.print(`  ${C.dim('│ directory')} ${C.dim(state.cwd)}`)
     const bridgeStatus = !state.accountSvc
@@ -165,7 +168,9 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
   // logged in — offers to link on the spot, re-reads disk, and refuses to serve if still not.
   const ensureLoggedIn = async () => {
     if (state.loggedIn) return true
-    io.print('\n  ' + C.yellow('You are not linked to a ThinkPool account yet.'))
+    io.print('\n  ' + C.yellow(state.reconnectRequired
+      ? 'This bridge lost its Thinkpool account link.'
+      : 'You are not linked to a ThinkPool account yet.'))
     if (await askYesNo('  Link this device now?', true)) { await actions.login(); resync() }
     if (!state.loggedIn) { io.print('  ' + C.yellow('login needed to serve your sessions — back to menu')); return false }
     return true
@@ -230,7 +235,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     for (;;) {
       const options = [
         { key: 'provider', label: 'Provider', hint: `current: ${state.provider}` },
-        { key: 'account', label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
+        { key: 'account', label: 'Account', hint: state.reconnectRequired ? 'reconnect required' : state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
       ]
       if (state.hermesInstalled) options.push({ key: 'hermes', label: state.hermesReady ? 'Hermes profile' : 'Set up Hermes', hint: state.hermesReady ? 'isolated profile ready' : 'set up isolated profile + delegation guard' })
       options.push({ key: 'back', label: 'Back to main menu', hint: '' })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.310",
+  "version": "0.7.311",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {