thinkpool-pair 0.7.325 → 0.7.327

package/account.mjs

@@ -25,6 +25,7 @@ import { hostMemoryAdmission } from './host-memory.mjs'
 import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
 import { clearSupervisorReady, supervisorPresenceEchoed, writeSupervisorReady } from './supervisor-ready.mjs'
 import { PAIR_CLI, pairCli } from './command-guidance.mjs'
+import { syncRealtimeAuth } from './design-edit.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -515,7 +516,11 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let lastClaimHeld = null // track state changes for claim_tick logging
   console.log(`◇ supervisor boot sup=${SUP_ID} host=${machine} pid=${process.pid} npx=${VERSION || 'dev'}`)
 
+  if (!await syncRealtimeAuth(sb, currentAccessToken, SUPABASE_ANON)) {
+    process.stderr.write('\n  ⚠ realtime auth could not be initialized; private bridge control is unavailable.\n')
+  }
   const acct = sb.channel(`tpacct:${session.user.id}`, { config: { presence: { key: machine }, broadcast: { self: false } } })
+  const acctControl = sb.channel(`tpacct-control:${session.user.id}`, { config: { private: true, broadcast: { self: false } } })
   // One id per account-bridge PROCESS. The dashboard keeps its restart indicator
   // up until this value changes, so stale presence + fresh claim heartbeats can
   // never impersonate a completed restart.
@@ -523,8 +528,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let restarting = false   // set by the "restart" broadcast → stop() exits non-zero so a supervisor respawns us
   // Web "attach this session" card → bind an unbound/new room to a local dir (and
   // optionally set it as the account default) so it serves WITHOUT a terminal command.
-  // Rides tpacct (keyed to the owner's uid); the dir must exist on THIS machine.
-  acct.on('broadcast', { event: 'bind-room' }, ({ payload }) => {
+  // Rides the private, owner-gated control topic; the dir must exist on THIS machine.
+  acctControl.on('broadcast', { event: 'bind-room' }, ({ payload }) => {
     const code = String(payload?.code || '').toUpperCase().trim()
     let dir = String(payload?.dir || '').trim()
     if (dir.startsWith('~')) dir = path.join(os.homedir(), dir.slice(1))
@@ -541,7 +546,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // so the toggle would appear to do nothing (presence leaves, then rejoins).
   // Uninstall the account service FIRST so the supervisor won't restart us, then
   // stop. Mirrors the per-room session-deleted guard in bridge.mjs.
-  acct.on('broadcast', { event: 'shutdown' }, async () => {
+  acctControl.on('broadcast', { event: 'shutdown' }, async () => {
     process.stderr.write('\n  ◇ disconnect requested from the dashboard — stopping bridge.\n')
     // Hard-exit backstop, armed FIRST — independent of the SIGTERM round-trip,
     // the realtime socket, and every await below. If the graceful stop() wedges
@@ -565,14 +570,10 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
   // don't subscribe to this event, so the dashboard button is a harmless no-op there.
   let restartPreparationRunning = false
-  acct.on('broadcast', { event: 'restart' }, async ({ payload } = {}) => {
+  acctControl.on('broadcast', { event: 'restart' }, async ({ payload } = {}) => {
     const nonce = payload?.nonce
     const reply = async (ok, error) => {
-      try { await acct.send({ type: 'broadcast', event: 'restart-status', payload: { nonce, ok, error } }) } catch { /* channel down */ }
-    }
-    if (!(await isOwner(payload?.jwt))) {
-      await reply(false, 'unauthorized')
-      return
+      try { await acctControl.send({ type: 'broadcast', event: 'restart-status', payload: { nonce, ok, error } }) } catch { /* channel down */ }
     }
     // A dashboard restart is an EXPLICIT apply request, but it is not permission
     // to interrupt a live turn or a pending human decision. Stage the immutable
@@ -636,22 +637,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
 
   // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
-  // AUTH: the account channel `tpacct:<uid>` is created WITHOUT config.private:true,
-  // so it is a PUBLIC realtime channel — NOT RLS-gated (the existing shutdown/restart
-  // handlers ride the same public channel; accepted for those, NOT for key management).
-  // Every provider event therefore carries the sender's `jwt` (session access token);
-  // we verify getUser(jwt).id === the owner uid before ANY registry mutation or read.
-  // Only the owner manages their own keys on their own machine — a partner is refused.
-  const OWNER_UID = session.user.id
-  const isOwner = async (jwt) => {
-    if (!jwt || typeof jwt !== 'string') return false
-    try { const { data } = await sb.auth.getUser(jwt); return !!data?.user && data.user.id === OWNER_UID } catch { return false }
-  }
-  const provReply = (event, payload) => { try { acct.send({ type: 'broadcast', event, payload }) } catch { /* channel down */ } }
-  // provider-add {sealed, nonce, jwt} → decrypt, validate, append, re-announce.
-  acct.on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
+  // The private tpacct-control:<uid> join/send policy binds the sender to this
+  // exact owner. Credentials stay in the Realtime handshake, never the payload.
+  const provReply = (event, payload) => { try { acctControl.send({ type: 'broadcast', event, payload }) } catch { /* channel down */ } }
+  // provider-add {sealed, nonce} → decrypt, validate, append, re-announce.
+  acctControl.on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('provider-add-res', { nonce, ok: false, error: 'unauthorized' })
     let fields
     // Decrypt failures answer ok:false WITHOUT logging the ciphertext or plaintext
     // (security invariant d) — a bare boolean, never the sealed blob or the key.
@@ -660,29 +651,26 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
     provReply('provider-add-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
   })
-  // provider-add-model {id, model, name?, nonce, jwt} → clone the source row's
+  // provider-add-model {id, model, name?, nonce} → clone the source row's
   // baseUrl + key HOST-SIDE onto a new model, re-announce. Deliberately carries NO
   // `sealed` envelope: the key never leaves the bridge for this op, so there is
   // nothing to decrypt. Owner-authed exactly like its siblings.
-  acct.on('broadcast', { event: 'provider-add-model' }, async ({ payload }) => {
+  acctControl.on('broadcast', { event: 'provider-add-model' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('provider-add-model-res', { nonce, ok: false, error: 'unauthorized' })
     const r = addProviderModel({ id: payload?.id, model: payload?.model, name: payload?.name })
     if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ model added to an existing provider (${String(payload?.model || '').slice(0, 40)}) — re-announced.\n`) }
     provReply('provider-add-model-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
   })
-  // provider-remove {id, nonce, jwt} → remove (built-in refuses), re-announce.
-  acct.on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
+  // provider-remove {id, nonce} → remove (built-in refuses), re-announce.
+  acctControl.on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('provider-remove-res', { nonce, ok: false, error: 'unauthorized' })
     const r = removeProvider(payload?.id)
     if (r.ok) { pushPresence(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
     provReply('provider-remove-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error })
   })
-  // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
-  acct.on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
+  // providers-list-req {nonce} → the masked list (keyHint = last 4 chars only).
+  acctControl.on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('providers-list-res', { nonce, ok: false, error: 'unauthorized', providers: [] })
     provReply('providers-list-res', { nonce, ok: true, providers: listProviders() })
   })
 
@@ -735,6 +723,14 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   if (!initialAccountRealtime.connected) {
     process.stderr.write(`\n  ◇ account realtime not ready at startup (${initialAccountRealtime.status}) — staying alive and recovering in process.\n`)
   }
+  const initialAccountControl = await subscribeWithoutStartupDeadlock(acctControl, (st) => {
+    if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
+      process.stderr.write(`\n  ⚠ private account control ${st}; host-changing dashboard actions are unavailable until Realtime reconnects.\n`)
+    }
+  })
+  if (!initialAccountControl.connected) {
+    process.stderr.write(`\n  ◇ private account control not ready at startup (${initialAccountControl.status}) — presence remains available.\n`)
+  }
 
   // Keep the account JWT fresh so the presence socket never gets deauthed at
   // expiry (the 2026-06-17 "No bridge connected while sessions run" bug). On each
@@ -1275,7 +1271,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     // until it lapses), never lost data. No caller remains to surface an error to, and a
     // throw here would skip process.exit.
     // fail-open-ok: exit-path teardown; a lost release_bridge expires on its own TTL
-    ;(async () => { try { if (claimHeld) await sb.rpc('release_bridge', { p_bridge_id: BRIDGE_ID }) } catch { /* noop */ } try { await acct.untrack() } catch { /* noop */ } try { await sb.removeChannel(acct) } catch { /* noop */ } process.exit(code) })()
+    ;(async () => { try { if (claimHeld) await sb.rpc('release_bridge', { p_bridge_id: BRIDGE_ID }) } catch { /* noop */ } try { await acct.untrack() } catch { /* noop */ } try { await sb.removeChannel(acctControl) } catch { /* noop */ } try { await sb.removeChannel(acct) } catch { /* noop */ } process.exit(code) })()
     setTimeout(() => process.exit(code), 1500)   // hard backstop if the flush hangs
   }
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => stop(sig))

package/bridge.mjs

@@ -47,7 +47,7 @@ import { createPermNotifier, shouldNotifyTurnDone, shouldRecordTurnDone, permiss
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
 import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
@@ -764,30 +764,6 @@ function reconcileTerminalRows() {
     if (reaped.length) process.stderr.write(`\n  ◆ removed ${reaped.length} stale terminal row${reaped.length === 1 ? '' : 's'} after restore.\n`)
   })
 }
-// Auth: is the sender a PARTICIPANT of THIS room (owner OR granted OR joined)? Room mode
-// serves the room, so RLS returns participants; we confirm the jwt's user is one of them.
-// Pattern (per #218/#219): getUser + uid → REST existence check on code_sessions
-// (code=room, participants cs.{uid}) — NOT byte comparison of the jwt against codeAuthToken
-// (that bug already happened once tonight: a freshly-refreshed jwt has a new signature/iat/jti
-// per the grant cycle, so a byte compare rejects the legitimate sender). Hoisted to module
-// scope so provider-switch + providers-list-req share the ONE implementation. Returns false
-// for anon / missing / invalid jwt without throwing. Fails closed on any fetch error.
-const isRoomParticipant = async (jwt) => {
-  if (!jwt || typeof jwt !== 'string') return false
-  try {
-    const { data } = await supabase.auth.getUser(jwt)
-    if (!data?.user) return false
-    const uid = data.user.id
-    // Query with the CALLER's jwt (not the bridge host's codeAuthToken) so RLS scopes
-    // the read to what THIS user may see, and require an actual matching row — `r.ok`
-    // alone is true for an empty [] result, which let ANY authenticated user pass.
-    // participants is a uuid[]; PostgREST array-contains is cs.{uid} (braces required).
-    const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.%7B${encodeURIComponent(uid)}%7D&select=code`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${jwt}` } })
-    if (!r.ok) return false
-    const rows = await r.json().catch(() => [])
-    return Array.isArray(rows) && rows.length > 0
-  } catch { return false }
-}
 // ── Room-serve owner consent (Contract C-CODE-3, owner-only since 2026-07-06) ──
 // A room is served by its OWNER's bridge ONLY — no cross-person grantee path
 // (removed 2026-07-06; see docs/specs/2026-07-06-remove-cross-person-serve.md).
@@ -983,6 +959,12 @@ const designChannel = supabase.channel(`tpdesign:${room}`, {
   config: { private: true, broadcast: { self: false } },
 })
 
+// Host-changing room commands are isolated from the public collaboration topic.
+// Realtime RLS admits current room members and authenticates every send/receive.
+const controlChannel = supabase.channel(`tpcontrol:${room}`, {
+  config: { private: true, broadcast: { self: false } },
+})
+
 // ── terminal registry ──────────────────────────────────────────────
 // id → { term (pty), cmd, attached, scrollback, buf }
 const terms = new Map()
@@ -3884,6 +3866,85 @@ process.stdout.on('resize', () => {
 let realtimeHealthy = false
 let brokenSince = Date.now()
 
+// ── Private room control plane ──────────────────────────────────────────────
+// Authentication and membership are enforced by realtime.messages RLS when
+// tpcontrol:<room> joins and broadcasts. Access tokens never enter payloads.
+controlChannel
+  .on('broadcast', { event: 'apply-update' }, () => {
+    if (!pendingUpdate) return
+    applyRequested = true
+    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+      try { process.send({ t: 'apply-update' }) } catch { /* parent gone */ }
+    }
+  })
+  .on('broadcast', { event: 'bridge-update' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error, state) => controlChannel.send({
+      type: 'broadcast', event: 'bridge-update-res',
+      payload: { nonce, ok, ...(error ? { error } : {}), ...(state ? { state } : {}) },
+    })
+    if (!nonce) return reply(false, 'invalid request')
+    const target = typeof payload?.v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(payload.v)
+      ? payload.v : null
+    if (!target) return reply(false, 'invalid bridge version')
+
+    surfaceUpdate(target)
+    applyRequested = true
+    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+      try { process.send({ t: 'apply-update' }) } catch { return reply(false, 'account supervisor is unavailable') }
+      return reply(true, null, 'queued')
+    }
+
+    let managed = false
+    try {
+      const svc = await import('./service.mjs')
+      managed = svc.serviceActive(room)
+    } catch { /* reported as an explicit foreground refusal below */ }
+    if (!managed) {
+      applyRequested = false
+      return reply(false, 'This bridge is running in a terminal. Restart it once with npx thinkpool-pair@latest, or install the background service to enable remote updates.')
+    }
+    if (!betweenUpdateTurns()) return reply(true, null, 'queued')
+    await reply(true, null, 'applying')
+    void applyStandaloneManagedUpdate()
+  })
+  .on('broadcast', { event: 'providers-list-req' }, ({ payload }) => {
+    controlChannel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce: payload?.nonce, ok: true, providers: listProviders() } })
+  })
+  .on('broadcast', { event: 'provider-switch' }, ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error, restarted) => controlChannel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}), ...(restarted === undefined ? {} : { restarted }) } })
+    const term = payload?.term
+    const s = term ? sessions.get(term) : null
+    if (!s) return reply(false, 'no such live lane')
+    const v = validateProviderSwitch({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      registeredIds: listProviders().map((p) => p.id),
+    })
+    if (!v.ok) return reply(false, v.error)
+    const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
+    const plan = providerSwitchPlan({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      sameEnv: sameProviderEnv(s.provider, target),
+      targetModel: providerModel(target),
+    })
+    if (plan.action === 'noop') return reply(true, undefined, false)
+    if (plan.action === 'in-place' && switchModelInPlace(term, target)) {
+      process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched model → ${providerModel(target)} (same key, context kept).\n`)
+      announce()
+      return reply(true, undefined, false)
+    }
+    const done = respawnStructured(term, target)
+    if (!done) return reply(false, 'no such live lane')
+    process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
+    reply(true, undefined, true)
+  })
+  .subscribe((status) => {
+    if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT' || status === 'CLOSED') process.stderr.write(`\n  ⚠ private bridge control ${status} (tpcontrol:${room}).\n`)
+  })
+
 channel
   .on('broadcast', { event: 'pty-in' }, ({ payload }) => {
     if (!payload?.data) return
@@ -4532,54 +4593,6 @@ channel
   .on('broadcast', { event: 'code-close' }, ({ payload }) => {
     endStructured(payload?.id)
   })
-  // Slice 3 — the user clicked "apply" on the update chip. Mark it requested; the
-  // actual restart is gated to between turns. Account-child: forward to the
-  // supervisor (it owns the restart, applied only when every child is idle).
-  // Standalone service tier: its applyIfIdle loop lands it at the next idle. Either
-  // way it never interrupts a turn (Contract #1).
-  .on('broadcast', { event: 'apply-update' }, () => {
-    if (!pendingUpdate) return
-    applyRequested = true
-    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
-      try { process.send({ t: 'apply-update' }) } catch { /* parent gone */ }
-    }
-  })
-  // Authenticated + acknowledged update contract used by both the room card and
-  // the dashboard's room-scoped fallback. Unlike the legacy apply-update event,
-  // this does not depend on the bridge having discovered npm first: the web names
-  // the advertised target, the host updater independently resolves npm latest,
-  // and only a managed service is allowed to accept the operation.
-  .on('broadcast', { event: 'bridge-update' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    const reply = (ok, error, state) => channel.send({
-      type: 'broadcast', event: 'bridge-update-res',
-      payload: { nonce, ok, ...(error ? { error } : {}), ...(state ? { state } : {}) },
-    })
-    if (!nonce || !(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
-    const target = typeof payload?.v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(payload.v)
-      ? payload.v : null
-    if (!target) return reply(false, 'invalid bridge version')
-
-    surfaceUpdate(target)
-    applyRequested = true
-    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
-      try { process.send({ t: 'apply-update' }) } catch { return reply(false, 'account supervisor is unavailable') }
-      return reply(true, null, 'queued')
-    }
-
-    let managed = false
-    try {
-      const svc = await import('./service.mjs')
-      managed = svc.serviceActive(room)
-    } catch { /* reported as an explicit foreground refusal below */ }
-    if (!managed) {
-      applyRequested = false
-      return reply(false, 'This bridge is running in a terminal. Restart it once with npx thinkpool-pair@latest, or install the background service to enable remote updates.')
-    }
-    if (!betweenUpdateTurns()) return reply(true, null, 'queued')
-    await reply(true, null, 'applying')
-    void applyStandaloneManagedUpdate()
-  })
   // Persist + re-announce terminal renames. The web also echoes term-rename to
   // online peers directly; storing it here is what reaches a device that joins
   // LATER (or a second machine) — those only ever see the announce.
@@ -4593,111 +4606,6 @@ channel
     announce()
   })
   .on('broadcast', { event: 'who' }, announce)
-  // ── Provider registry — the multi-BYOK wire contract (room mode). ─────────────
-  // AUTH: room mode serves a room the user may not own (post-#208 grant). We verify
-  // the sender is a participant of THIS room before ANY operation. List is open to
-  // any participant; add/remove mutate the HOST's registry, so gate to the BRIDGE
-  // HOST's own uid (the authed login). Anon is refused for all three.
-  .on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    // Auth: must be the bridge host (the authed login running this bridge)
-    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
-    try {
-      const { data } = await supabase.auth.getUser(payload?.jwt)
-      if (!data?.user || data.user.id !== myServeUid) {
-        return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-      }
-    } catch {
-      return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-    }
-    let fields
-    try { fields = unseal(payload?.sealed) } catch { return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'could not decrypt the sealed payload' } }) }
-    const r = addProvider(fields)
-    if (r.ok) { announce(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
-    channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined } })
-  })
-  // provider-remove {id, nonce, jwt} → remove, re-announce.
-  .on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    // Auth: must be the bridge host (the authed login running this bridge)
-    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
-    try {
-      const { data } = await supabase.auth.getUser(payload?.jwt)
-      if (!data?.user || data.user.id !== myServeUid) {
-        return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-      }
-    } catch {
-      return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-    }
-    const r = removeProvider(payload?.id)
-    if (r.ok) { announce(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
-    channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error } })
-  })
-  // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
-  // Auth via the shared isRoomParticipant (hoisted; same pattern as provider-switch).
-  .on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    if (!(await isRoomParticipant(payload?.jwt))) return channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: false, error: 'unauthorized', providers: [] } })
-    channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: true, providers: listProviders() } })
-  })
-  // ── Per-lane provider SWITCH (multi-BYOK slice 2). Switch a LIVE structured lane to a
-  // different LLM provider by restarting that lane's agent process under the SAME terminal
-  // id with the new provider's env. Visible transcript persists; the agent's conversational
-  // memory resets (cross-backend, no SDK resume) — accepted UX the UI warns about. Same-
-  // provider model changes keep using the EXISTING /model path (in-process setModel); the UI
-  // only sends provider-switch when the provider ACTUALLY changes.
-  //   provider-switch  {term, provider, nonce, jwt}  → bridge validates + respawns
-  //   provider-switch-res {nonce, ok, error?}        ← reply (NEVER key material)
-  // Auth: participant check via supabase.auth.getUser (isRoomParticipant) — NOT byte
-  // comparison of the jwt (a refreshed jwt has a new signature/iat/jti). Anon refused.
-  // After the respawn the lane's next announce reflects its new provider (additive {id,name}
-  // projection the client already renders from #219). Spec: docs/specs/2026-07-05-provider-switch.md.
-  .on('broadcast', { event: 'provider-switch' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    // `restarted` (0.7.179+): did the agent lose its context? false for a same-key model
-    // change, true for a real provider change. Older clients ignore the extra field.
-    const reply = (ok, error, restarted) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}), ...(restarted === undefined ? {} : { restarted }) } })
-    // AUTH first — anon / non-participant / bad jwt → ok:false 'unauthorized'. No lane
-    // state is touched for a rejected sender (fail closed before any lookup).
-    if (!(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
-    const term = payload?.term
-    const s = term ? sessions.get(term) : null
-    // The target must be a LIVE structured session this bridge serves.
-    if (!s) return reply(false, 'no such live lane')
-    // VALIDATE — pure: missing / unknown provider, or a no-op same-provider switch.
-    const v = validateProviderSwitch({
-      provider: payload?.provider,
-      currentProvider: s.provider,
-      registeredIds: listProviders().map((p) => p.id),
-    })
-    if (!v.ok) return reply(false, v.error)
-    const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
-
-    // The three-way choice is pure + unit-tested (switch-provider.mjs). Two registry rows
-    // on ONE endpoint + key (Max's glm-4.6 and glm-5.2 on the same z.ai account) are the
-    // same provider asked for a different model: the child's env is identical, so tearing
-    // the agent down and recapping it is pure loss. Only a different endpoint/key earns a
-    // respawn. An in-place attempt that fails (lane raced closed, setModel threw) falls
-    // back to the respawn rather than leaving the lane on a stale model.
-    const plan = providerSwitchPlan({
-      provider: payload?.provider,
-      currentProvider: s.provider,
-      sameEnv: sameProviderEnv(s.provider, target),
-      targetModel: providerModel(target),
-    })
-    if (plan.action === 'noop') return reply(true, undefined, false)   // idempotent (UI guarantees a change)
-
-    if (plan.action === 'in-place' && switchModelInPlace(term, target)) {
-      process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched model → ${providerModel(target)} (same key, context kept).\n`)
-      announce()
-      return reply(true, undefined, false)
-    }
-
-    const done = respawnStructured(term, target)
-    if (!done) return reply(false, 'no such live lane')   // raced closed between the lookup + respawn
-    process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
-    reply(true, undefined, true)
-  })
   .subscribe(async status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
@@ -5395,6 +5303,7 @@ async function shutdown(code = 0, farewell = true) {
   // process teardown). Close it too so shutdown is symmetric.
   try { await supabase.removeChannel(flowChannel) } catch { /* noop */ }
   try { await supabase.removeChannel(designChannel) } catch { /* noop */ }
+  try { await supabase.removeChannel(controlChannel) } catch { /* noop */ }
   setTimeout(() => process.exit(code), 250)   // grace for the leave/close frames to flush
 }
 process.on('SIGINT', () => shutdown(0))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.325",
+  "version": "0.7.327",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {