thinkpool-pair 0.7.326 → 0.7.328

package/README.md

@@ -1,235 +1,272 @@
-# thinkpool-pair — the ThinkPool Code bridge
+# `thinkpool-pair`
 
-Pair two people on one live **coding agent** — running **any model you choose**
-(Claude, GPT, Gemini, Llama, or a local model) — in a ThinkPool Code room. Both
-people see the live stream and can both drive it, no copy/paste.
+`thinkpool-pair` connects coding agents running on a machine you control to a
+Thinkpool Code room. Both people in the room can watch and steer the visible
+agent lanes from a browser or phone.
 
-> A web page can't read your terminal directly (browser security). This tiny
-> helper is the bridge: it runs CLIs in PTYs and streams them to the room.
+The bridge makes outbound connections to Thinkpool’s Supabase project. It does
+not require an inbound port, tunnel, or public IP.
 
-> **Don't want it tied to your laptop?** Run this same bridge on an always-on box
-> you control (a cheap VM, a home server, a Raspberry Pi) so the agent stays live
-> with your laptop closed. It's outbound-only — no ports, no public IP. See
-> [**Run it in the cloud**](#run-it-in-the-cloud-remote-host--vm--container) below.
+## Requirements
 
-## Run it (one command)
+- Node.js 18 or newer
+- A Thinkpool account and Code session
+- At least one supported runtime available on the host:
+  - Claude
+  - Codex
+  - Hermes
+- The provider login or API credentials required by that runtime
+
+## Start the bridge
+
+Run the launcher from the project directory the agents should use:
 
 ```bash
-cd bridge && npm i        # one-time (builds node-pty — needs Xcode CLT / build-essential)
-node bridge.mjs <ROOM>    # picks an installed agent, shared into room <ROOM>
+npx thinkpool-pair@latest
 ```
 
-- `<ROOM>` is the 5-char room code from the ThinkPool Code web UI (`/code`).
-- Share a specific CLI: `node bridge.mjs <ROOM> -- aider`  /  `… -- bash`.
-- Pure relay (no local terminal): `node bridge.mjs <ROOM> --headless`.
-
-## Keep it stable (auto-restart)
-
-The bridge self-heals at three levels — all cross-platform (macOS / Linux / Windows):
-
-- **`--supervise`** — wrap it so a crash respawns automatically (exponential
-  backoff). Zero-dependency. Combined with session restore (below), a crash is
-  invisible — the room reconnects and the Claude session resumes where it left off.
-  ```bash
-  npx thinkpool-pair@latest <ROOM> --supervise -- claude
-  ```
-- **Boot-persistent service** — survive reboot/logout too. Installs the right
-  native service for your OS (launchd on macOS, systemd `--user` on Linux, a
-  Startup-folder script on Windows):
-  ```bash
-  npx thinkpool-pair@latest install-service <ROOM> -- claude   # set and forget
-  npx thinkpool-pair@latest uninstall-service <ROOM>           # remove it
-  ```
-  The service runs `npx thinkpool-pair@latest`, so it **auto-updates** — new
-  versions apply on the next restart, no re-install. (Linux: run
-  `loginctl enable-linger $USER` once to keep it running after logout.)
-- **Watchdog** — if the realtime channel wedges for >60s, the bridge exits so the
-  supervisor/service restarts a clean process. Brief network blips reconnect on
-  their own.
-
-Structured Claude sessions persist their scrollback + session id to
-`~/.thinkpool-pair/<ROOM>/` and **resume on restart** (live context if recent),
-so none of the above loses your place.
-
-### Codex App Server driver
-
-Structured Codex lanes use the long-lived App Server transport (streaming prose,
-mid-turn steering, shared approval and question cards, and native image inputs)
-when the installed Codex CLI is in the bridge's tested protocol range. To force
-the stable `codex exec --json` fallback, set the kill switch before starting the
-bridge:
-
-```bash
-export TP_CODEX_APP_SERVER=0
-```
-
-The bridge performs the initialize handshake before creating a thread and falls
-back to `codex exec` when App Server is disabled, outside the tested version
-range, or cannot initialize before a turn. It never retries a prompt via the
-fallback after `turn/start` has been accepted, preventing duplicate work.
-
-Your first agent runs **attached** — use it exactly like your normal terminal,
-every byte mirrors to the web. The web's **"+ New terminal"** spawns additional
-**headless** terminals here (same directory, same env), driven entirely from
-the room. One bridge, many terminals.
-
-### Built-in viewport capture
-
-Structured Claude and Codex lanes have bridge-owned visual QA tools, even when
-their own sandbox cannot bind localhost or launch Chrome:
-
-- `preview_start` serves a built directory inside that lane's workspace
-  (`dist` by default; it must contain `index.html`).
-- `preview_capture` returns exact desktop (1440×900) and mobile (390×844)
-  screenshots to the agent as verification evidence. It creates no transcript
-  artifact by default. Pass `card: true` only for an intentional user-facing
-  mockup/Design deliverable; a settled complete pair is then queued after the
-  agent's final response. Loading, empty, and public-auth fallback shells are
-  rejected before a card can be created.
-- `preview_inspect` returns rendered DOM text, document size, and optional
-  selector geometry at either viewport.
-- `preview_stop` releases the preview port.
-
-The bridge launches the host's Chrome/Chromium lazily. Set `TP_BROWSER_PATH`
-if it is installed somewhere non-standard. Preview files are read-only, roots
-cannot escape the lane workspace (including through symlinks), and page network
-requests are restricted to the preview server's exact loopback origin. The
-tools never execute a caller-supplied command or open an arbitrary URL.
-
-## Run it in the cloud (remote host / VM / container)
-
-The bridge connects **outbound** to Supabase — no inbound ports, no public IP, no
-tunnel. So a cloud VM, container, devcontainer, or remote dev box can stream its
-Claude Code into the room exactly like a laptop. Run the same command there:
-
-```bash
-export ANTHROPIC_API_KEY=sk-ant-...                  # headless auth (no Keychain login)
-cd /path/to/your/repo
-npx thinkpool-pair@latest <ROOM> -- claude           # structured Claude, no TTY needed
-```
-
-- **Auth** — two ways to sign in on a box with no browser. Both are your own
-  account on your own hardware, so both are fine:
-  - **API key** — `export ANTHROPIC_API_KEY=sk-ant-...` from your Anthropic
-    Console. Simplest, pay-per-token, cleanest cost tracking.
-  - **Your Claude subscription** — a server has no browser, so mint a long-lived
-    token *on a machine that does*: run `claude setup-token` there (prints a
-    ~1-year `CLAUDE_CODE_OAUTH_TOKEN`), then `export CLAUDE_CODE_OAUTH_TOKEN=...`
-    on the box. Uses your existing Pro/Max plan — no per-token bill.
-
-  The Agent SDK reads either one automatically and runs its bundled `claude`, so
-  you don't need Claude Code installed separately. (Note: this is *you* running
-  *your* login on *your* machine. Handing a subscription token to a third-party
-  host to run for you is what Anthropic's terms forbid — that's why a future
-  "we host it for you" option would require an API key, not your subscription.)
-- **Use `@latest`**: a bare `npx thinkpool-pair` reuses npx's local cache and can
-  run a stale version across restarts. `@latest` (and the service below) always
-  re-resolve the newest publish.
-- **No TTY required**: the agent picker auto-selects and raw-mode is skipped when
-  there's no terminal, so it runs fine under CI / a service / `nohup`.
-- **Always-on + auto-update**: `npx thinkpool-pair@latest install-service <ROOM> -- claude`
-  installs a systemd `--user` unit (auto-restart + boot-persistent). The bridge
-  polls npm for new publishes and **self-restarts at the next idle moment** into
-  the new version — the structured session resumes, so an away/unattended box
-  upgrades itself with nobody losing their place. On a server, also run
-  `loginctl enable-linger $USER` so it survives logout.
-  Tune with `THINKPOOL_PAIR_UPDATE_INTERVAL` (poll seconds, default 1800) and
-  `THINKPOOL_PAIR_UPDATE_IDLE` (idle seconds before restart, default 90). Live
-  auto-update applies to the launchd/systemd service tiers; bare `--supervise`
-  respawns the same version, so it updates only on the next manual/boot restart.
-- **Security**: anyone with the room code can drive the agent (shell-trust by
-  design) — on a server that's a real shell, so treat the room code like a secret.
-
-## How it works
-
-`bridge.mjs` ⇄ **Supabase realtime** (`tpcode:<ROOM>`) ⇄ web `xterm`:
-- `bridge` — announce: installed agents + live terminals.
-- `pty-out` — terminal bytes (base64, per-terminal) → web clients render them.
-- `pty-in` — keystrokes/prompts from the web → written to that terminal's PTY.
-- `term-open` / `term-close` / `term-exit` — web-driven terminal lifecycle.
-- `replay-request` / `pty-replay` — each terminal keeps a rolling ~120 KB
-  scrollback buffer for live recovery. Thinkpool also stores the cleaned reader
-  transcript and room events so members can reopen the room. It does not store
-  a copy of the repository or the raw PTY byte stream.
-- `resize` — web viewport size → headless PTYs only (the attached terminal
-  follows your own TTY).
-
-## Inspect the privacy boundary
-
-Run a local report before pairing a repository:
+The launcher shows the linked account, detected runtimes, current directory,
+and background-service state. On first use it asks to link the machine in a
+browser. Then choose one of:
+
+- **Serve all my sessions** — runs in the current terminal until `Ctrl-C`.
+- **Always-on background service** — starts at login/reboot and restarts after a
+  crash. The normal install is pinned to the confirmed package version; use the
+  launcher’s **Restart & update bridge** action when a new version should land.
+
+Back in the room, open the runtime/model you want for each terminal.
+
+## Account and service commands
+
+Link the machine without opening the full launcher:
 
 ```bash
-npx thinkpool-pair@latest privacy-report
+npx thinkpool-pair@latest login
+```
+
+Install or remove the account-wide background service:
+
+```bash
+npx thinkpool-pair@latest install-service
+npx thinkpool-pair@latest restart-service
+npx thinkpool-pair@latest uninstall-service
+```
+
+`install-service` is pinned by default so a later bad npm publish cannot
+silently replace a working unattended bridge. Opt into tracking `@latest` only
+when that trade-off is intentional:
+
+```bash
+npx thinkpool-pair@latest install-service --auto-update
 ```
 
-It lists the project directories configured for this bridge, the local records
-present under `~/.thinkpool-pair`, known outbound service domains, what
-Thinkpool stores remotely, and the limits of the report. It never prints a
-provider key, refresh token, or bridge private key.
+Service implementation by platform:
 
-## Run any model
+- macOS: LaunchAgent
+- Linux: systemd user service; run `loginctl enable-linger "$USER"` once if it
+  must survive logout
+- Windows: Startup-folder command file
 
-ThinkPool Code runs **any model you choose** — not just Anthropic. The agent
-talks the Anthropic Messages API, so you point it at any endpoint that speaks
-that format:
+On Windows the startup entry launches at login; update it from the launcher and
+relaunch the bridge window to apply the new version.
 
-- **Anthropic-compatible endpoints directly** — Z.ai GLM, Moonshot Kimi, OpenRouter, your own proxy.
-- **Any other model via a translating gateway** — put **LiteLLM** (or a proxy of
-  your own) in front and run **GPT, Gemini, Llama, DeepSeek, or a local model**;
-  it presents the Anthropic Messages API while calling whatever you pick.
+## Project directories
 
-> OpenRouter is the exception worth knowing: its `/v1/messages` surface is a
-> pass-through for **Anthropic models only**. Per OpenRouter's own docs, "Claude
-> Code expects Anthropic request semantics, so non-Anthropic models aren't
-> supported through the native endpoint" — and this bridge spawns the `claude`
-> CLI. To reach a non-Anthropic model, use a translating gateway (LiteLLM),
-> not OpenRouter's Anthropic endpoint.
+The account bridge serves sessions from their bound project directories. Set a
+default for new/unbound sessions:
 
 ```bash
-npx thinkpool-pair@latest provider custom --base <url> --token <key> [--model <name>]
+npx thinkpool-pair@latest set-default-dir /path/to/project
 ```
 
-Common base urls (the agent appends `/v1/messages`):
+Bind one room explicitly when needed:
 
-| Provider / gateway | Base url                          | Models                       |
-|--------------------|-----------------------------------|------------------------------|
-| Z.ai GLM           | `https://api.z.ai/api/anthropic`  | GLM                          |
-| Moonshot Kimi      | `https://api.moonshot.ai/anthropic` | Kimi                       |
-| OpenRouter         | `https://openrouter.ai/api`       | Anthropic models only        |
-| LiteLLM (your own) | `http://localhost:4000`           | GPT, Gemini, Llama, local, … |
+```bash
+npx thinkpool-pair@latest bind <ROOM> /path/to/project
+```
+
+Room codes are treated as secrets because room members can drive agents that
+have access to the bound project and the host permissions granted to that lane.
 
-> The endpoint must serve the Anthropic Messages API (`/v1/messages`). A raw
-> OpenAI-style `/v1/chat/completions` won't work directly — that's exactly what a
-> gateway is for. Avoid LiteLLM 1.82.7 / 1.82.8 (compromised releases); use a
-> current version.
+## Runtimes and providers
 
-Show the current provider (`npx thinkpool-pair@latest provider`), or reset back to your
-regular Claude login:
+| Runtime | Authentication/provider behavior |
+|---|---|
+| Claude | Uses the host’s normal Anthropic login by default. A registered Anthropic-compatible provider can be selected for a lane. |
+| Codex | Uses the host’s Codex/OpenAI login. Custom bridge providers are not wired to Codex lanes. |
+| Hermes | Uses an isolated Thinkpool ACP profile. Set it up explicitly before the first Hermes lane. |
+
+The launcher’s **Settings → Provider** flow configures the host default for
+Claude-compatible lanes. The equivalent CLI commands are:
 
 ```bash
+npx thinkpool-pair@latest provider
 npx thinkpool-pair@latest provider anthropic
+npx thinkpool-pair@latest provider custom --base <url> --token <key> --model <id>
 ```
 
-Provider config is stored in `~/.thinkpool-pair/provider.json` (mode 0600) and
-applies to every bridge on the machine. Restart the bridge (or its launchd
-service) after changing it — the choice is read once at startup.
+The custom endpoint must implement the Anthropic Messages API. A raw
+OpenAI-compatible chat-completions endpoint is not enough; place a translating
+gateway in front of it or use the runtime that natively owns that provider.
 
-### Context meter for non-Claude models
+Set up an isolated Hermes profile with one of:
 
-The context-usage meter (`ctx N%` in the room) is computed by the Agent SDK from
-the model id it thinks it's talking to — for a non-Claude model bridged in over
-an Anthropic-compatible endpoint, that assumed window is wrong, so the meter can
-run past 100%. The bridge corrects it for common models automatically (GLM-4.5/4.6,
-DeepSeek V3.x, Kimi K2, Qwen3-Coder — matched by model id).
+```bash
+npx thinkpool-pair@latest setup-hermes --clone
+npx thinkpool-pair@latest setup-hermes --clean
+```
+
+`--clone` copies the active Hermes provider/configuration into the isolated
+profile. `--clean` creates the isolation boundary without copying credentials.
+
+## Direct single-room mode
+
+The account-wide launcher is the normal path. A direct room process is still
+available for debugging or a deliberately single-room host:
+
+```bash
+npx thinkpool-pair@latest <ROOM> -- claude
+npx thinkpool-pair@latest <ROOM> -- codex
+npx thinkpool-pair@latest <ROOM> -- hermes
+```
 
-For any model not in that list, set the real window explicitly per bridge:
+Add `--headless` when the process should be driven only from the room. Direct
+room services use the same command with the room code:
 
 ```bash
-export TP_CONTEXT_MAX=131072   # your model's context window, in tokens
+npx thinkpool-pair@latest install-service <ROOM> -- claude
+npx thinkpool-pair@latest uninstall-service <ROOM>
 ```
 
-`TP_CONTEXT_MAX` overrides the built-in map (and applies even to Claude ids if
-you set it). Unset it to fall back to the automatic correction.
+## Cloud or always-on host
+
+The bridge can run on a VM, dev box, home server, or container because its room
+connection is outbound-only. Use the same launcher/service commands and provide
+the runtime’s headless credentials through the host’s secret manager.
+
+For Claude, either an Anthropic API key or a valid Claude Code OAuth token can
+authenticate the runtime. Treat subscription/OAuth tokens as personal secrets;
+do not hand them to a third-party host.
+
+## What crosses the boundary
+
+The bridge and web app deliberately split responsibility:
+
+- Agent processes, repository access, provider credentials, and raw terminal
+  bytes remain on the bridge machine.
+- Thinkpool relays room events and terminal output to authorized room members.
+- Thinkpool stores the cleaned reader transcript and room events so members can
+  reopen the room.
+- Thinkpool does not store a copy of the repository or a second copy of the raw
+  PTY byte stream.
+- Voice dictation is an application API path and uses the configured
+  transcription service; it is not a local-only bridge operation.
+
+Inspect the host-side boundary before pairing a sensitive repository:
+
+```bash
+npx thinkpool-pair@latest privacy-report
+```
+
+The report lists configured project directories, local bridge records, known
+outbound domains, remote storage categories, and the report’s limits. It does
+not print provider keys, refresh tokens, or bridge private keys.
+
+Structured session state is stored below `~/.thinkpool-pair/` so an agent lane
+can resume after a bridge restart. Protect that directory like other local
+developer credentials and session state.
+
+## Visual verification tools
+
+Structured Claude and Codex lanes can use bridge-owned preview tools even when
+their own sandbox cannot bind a port or launch a browser:
+
+- `preview_start` serves a built directory inside the lane worktree.
+- `preview_capture` records exact desktop and mobile renders.
+- `preview_inspect` reads rendered DOM text and geometry.
+- `preview_stop` releases the preview server.
+
+Preview roots are read-only, cannot escape the lane worktree, and accept only
+the preview server’s loopback origin for page requests.
+
+## Optional bridge environment variables
+
+| Variable | Purpose |
+|---|---|
+| `TP_NAME` | Label this bridge in the room |
+| `TP_PAIR_ROOT` | Override the local state directory |
+| `TP_SUPABASE_URL` / `TP_SUPABASE_ANON` | Override the built-in Thinkpool project endpoint/public key |
+| `TP_ANTHROPIC_BASE_URL` / `TP_ANTHROPIC_AUTH_TOKEN` / `TP_ANTHROPIC_MODEL` | Override the Claude-compatible provider without writing provider config |
+| `TP_CONTEXT_MAX` | Override the context-window size used by the room meter |
+| `TP_BROWSER_PATH` | Point preview capture at a non-standard Chrome/Chromium binary |
+| `TP_FLOW_OFF=1` | Disable Flow dispatch on this bridge |
+| `TP_SPAWN_OFF=1` | Disable agent-spawned worker lanes |
+| `TP_PAIRBUS_OFF=1` | Disable the paired-room bus |
+| `TP_CROSSROOM_OFF=1` | Disable cross-session reach |
+
+Provider and account configuration written by the launcher is preferred for a
+managed service because shell startup files are not guaranteed to be sourced.
+
+## Troubleshooting
+
+### The room cannot see the bridge
+
+Run the launcher and check its account/runtime/service header. If the account
+link is missing or expired, rerun:
+
+```bash
+npx thinkpool-pair@latest login
+```
+
+### A service is installed but not serving
+
+Use the launcher’s restart/update action or:
+
+```bash
+npx thinkpool-pair@latest restart-service
+```
+
+The install command prints the platform-specific log directory. Inspect that
+log before reinstalling; repeated installation can hide the original failure.
+
+### No runtimes are available
+
+Install/sign in to Claude, Codex, or Hermes on the host, then restart the
+launcher. Runtime availability is detected from the host; the web room cannot
+install a missing CLI for you.
+
+### A custom model fails immediately
+
+Check that the endpoint implements Anthropic Messages semantics and that the
+model ID exists on that provider. Codex lanes ignore the bridge’s custom Claude
+provider configuration and use the Codex/OpenAI login.
+
+### Preview capture cannot find Chrome
+
+Install Chrome/Chromium on the bridge host or set `TP_BROWSER_PATH` to its
+executable.
+
+## Develop the bridge package
+
+From the repository root:
+
+```bash
+npm --prefix bridge ci
+npm run test:bridge
+node bridge/test-packed-artifact.mjs
+```
+
+Run the checked-out launcher with:
+
+```bash
+node bridge/bridge.mjs
+```
+
+Publishing is separate from the web-app deploy:
+
+```bash
+npm --prefix bridge run release
+```
 
-Public anon creds are embedded (the same ones the web app ships). Override with
-`TP_SUPABASE_URL` / `TP_SUPABASE_ANON` if needed. Set `TP_NAME` to label yourself.
+The release command has external side effects and requires npm publish
+authority. Do not use it as a local verification command.

package/account.mjs

@@ -25,6 +25,7 @@ import { hostMemoryAdmission } from './host-memory.mjs'
 import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
 import { clearSupervisorReady, supervisorPresenceEchoed, writeSupervisorReady } from './supervisor-ready.mjs'
 import { PAIR_CLI, pairCli } from './command-guidance.mjs'
+import { syncRealtimeAuth } from './design-edit.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -515,7 +516,11 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let lastClaimHeld = null // track state changes for claim_tick logging
   console.log(`◇ supervisor boot sup=${SUP_ID} host=${machine} pid=${process.pid} npx=${VERSION || 'dev'}`)
 
+  if (!await syncRealtimeAuth(sb, currentAccessToken, SUPABASE_ANON)) {
+    process.stderr.write('\n  ⚠ realtime auth could not be initialized; private bridge control is unavailable.\n')
+  }
   const acct = sb.channel(`tpacct:${session.user.id}`, { config: { presence: { key: machine }, broadcast: { self: false } } })
+  const acctControl = sb.channel(`tpacct-control:${session.user.id}`, { config: { private: true, broadcast: { self: false } } })
   // One id per account-bridge PROCESS. The dashboard keeps its restart indicator
   // up until this value changes, so stale presence + fresh claim heartbeats can
   // never impersonate a completed restart.
@@ -523,8 +528,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let restarting = false   // set by the "restart" broadcast → stop() exits non-zero so a supervisor respawns us
   // Web "attach this session" card → bind an unbound/new room to a local dir (and
   // optionally set it as the account default) so it serves WITHOUT a terminal command.
-  // Rides tpacct (keyed to the owner's uid); the dir must exist on THIS machine.
-  acct.on('broadcast', { event: 'bind-room' }, ({ payload }) => {
+  // Rides the private, owner-gated control topic; the dir must exist on THIS machine.
+  acctControl.on('broadcast', { event: 'bind-room' }, ({ payload }) => {
     const code = String(payload?.code || '').toUpperCase().trim()
     let dir = String(payload?.dir || '').trim()
     if (dir.startsWith('~')) dir = path.join(os.homedir(), dir.slice(1))
@@ -541,7 +546,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // so the toggle would appear to do nothing (presence leaves, then rejoins).
   // Uninstall the account service FIRST so the supervisor won't restart us, then
   // stop. Mirrors the per-room session-deleted guard in bridge.mjs.
-  acct.on('broadcast', { event: 'shutdown' }, async () => {
+  acctControl.on('broadcast', { event: 'shutdown' }, async () => {
     process.stderr.write('\n  ◇ disconnect requested from the dashboard — stopping bridge.\n')
     // Hard-exit backstop, armed FIRST — independent of the SIGTERM round-trip,
     // the realtime socket, and every await below. If the graceful stop() wedges
@@ -565,14 +570,10 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
   // don't subscribe to this event, so the dashboard button is a harmless no-op there.
   let restartPreparationRunning = false
-  acct.on('broadcast', { event: 'restart' }, async ({ payload } = {}) => {
+  acctControl.on('broadcast', { event: 'restart' }, async ({ payload } = {}) => {
     const nonce = payload?.nonce
     const reply = async (ok, error) => {
-      try { await acct.send({ type: 'broadcast', event: 'restart-status', payload: { nonce, ok, error } }) } catch { /* channel down */ }
-    }
-    if (!(await isOwner(payload?.jwt))) {
-      await reply(false, 'unauthorized')
-      return
+      try { await acctControl.send({ type: 'broadcast', event: 'restart-status', payload: { nonce, ok, error } }) } catch { /* channel down */ }
     }
     // A dashboard restart is an EXPLICIT apply request, but it is not permission
     // to interrupt a live turn or a pending human decision. Stage the immutable
@@ -636,22 +637,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
 
   // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
-  // AUTH: the account channel `tpacct:<uid>` is created WITHOUT config.private:true,
-  // so it is a PUBLIC realtime channel — NOT RLS-gated (the existing shutdown/restart
-  // handlers ride the same public channel; accepted for those, NOT for key management).
-  // Every provider event therefore carries the sender's `jwt` (session access token);
-  // we verify getUser(jwt).id === the owner uid before ANY registry mutation or read.
-  // Only the owner manages their own keys on their own machine — a partner is refused.
-  const OWNER_UID = session.user.id
-  const isOwner = async (jwt) => {
-    if (!jwt || typeof jwt !== 'string') return false
-    try { const { data } = await sb.auth.getUser(jwt); return !!data?.user && data.user.id === OWNER_UID } catch { return false }
-  }
-  const provReply = (event, payload) => { try { acct.send({ type: 'broadcast', event, payload }) } catch { /* channel down */ } }
-  // provider-add {sealed, nonce, jwt} → decrypt, validate, append, re-announce.
-  acct.on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
+  // The private tpacct-control:<uid> join/send policy binds the sender to this
+  // exact owner. Credentials stay in the Realtime handshake, never the payload.
+  const provReply = (event, payload) => { try { acctControl.send({ type: 'broadcast', event, payload }) } catch { /* channel down */ } }
+  // provider-add {sealed, nonce} → decrypt, validate, append, re-announce.
+  acctControl.on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('provider-add-res', { nonce, ok: false, error: 'unauthorized' })
     let fields
     // Decrypt failures answer ok:false WITHOUT logging the ciphertext or plaintext
     // (security invariant d) — a bare boolean, never the sealed blob or the key.
@@ -660,29 +651,26 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
     provReply('provider-add-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
   })
-  // provider-add-model {id, model, name?, nonce, jwt} → clone the source row's
+  // provider-add-model {id, model, name?, nonce} → clone the source row's
   // baseUrl + key HOST-SIDE onto a new model, re-announce. Deliberately carries NO
   // `sealed` envelope: the key never leaves the bridge for this op, so there is
   // nothing to decrypt. Owner-authed exactly like its siblings.
-  acct.on('broadcast', { event: 'provider-add-model' }, async ({ payload }) => {
+  acctControl.on('broadcast', { event: 'provider-add-model' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('provider-add-model-res', { nonce, ok: false, error: 'unauthorized' })
     const r = addProviderModel({ id: payload?.id, model: payload?.model, name: payload?.name })
     if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ model added to an existing provider (${String(payload?.model || '').slice(0, 40)}) — re-announced.\n`) }
     provReply('provider-add-model-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
   })
-  // provider-remove {id, nonce, jwt} → remove (built-in refuses), re-announce.
-  acct.on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
+  // provider-remove {id, nonce} → remove (built-in refuses), re-announce.
+  acctControl.on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('provider-remove-res', { nonce, ok: false, error: 'unauthorized' })
     const r = removeProvider(payload?.id)
     if (r.ok) { pushPresence(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
     provReply('provider-remove-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error })
   })
-  // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
-  acct.on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
+  // providers-list-req {nonce} → the masked list (keyHint = last 4 chars only).
+  acctControl.on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    if (!(await isOwner(payload?.jwt))) return provReply('providers-list-res', { nonce, ok: false, error: 'unauthorized', providers: [] })
     provReply('providers-list-res', { nonce, ok: true, providers: listProviders() })
   })
 
@@ -735,6 +723,14 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   if (!initialAccountRealtime.connected) {
     process.stderr.write(`\n  ◇ account realtime not ready at startup (${initialAccountRealtime.status}) — staying alive and recovering in process.\n`)
   }
+  const initialAccountControl = await subscribeWithoutStartupDeadlock(acctControl, (st) => {
+    if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
+      process.stderr.write(`\n  ⚠ private account control ${st}; host-changing dashboard actions are unavailable until Realtime reconnects.\n`)
+    }
+  })
+  if (!initialAccountControl.connected) {
+    process.stderr.write(`\n  ◇ private account control not ready at startup (${initialAccountControl.status}) — presence remains available.\n`)
+  }
 
   // Keep the account JWT fresh so the presence socket never gets deauthed at
   // expiry (the 2026-06-17 "No bridge connected while sessions run" bug). On each
@@ -1275,7 +1271,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     // until it lapses), never lost data. No caller remains to surface an error to, and a
     // throw here would skip process.exit.
     // fail-open-ok: exit-path teardown; a lost release_bridge expires on its own TTL
-    ;(async () => { try { if (claimHeld) await sb.rpc('release_bridge', { p_bridge_id: BRIDGE_ID }) } catch { /* noop */ } try { await acct.untrack() } catch { /* noop */ } try { await sb.removeChannel(acct) } catch { /* noop */ } process.exit(code) })()
+    ;(async () => { try { if (claimHeld) await sb.rpc('release_bridge', { p_bridge_id: BRIDGE_ID }) } catch { /* noop */ } try { await acct.untrack() } catch { /* noop */ } try { await sb.removeChannel(acctControl) } catch { /* noop */ } try { await sb.removeChannel(acct) } catch { /* noop */ } process.exit(code) })()
     setTimeout(() => process.exit(code), 1500)   // hard backstop if the flush hangs
   }
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => stop(sig))

package/bridge.mjs

@@ -47,7 +47,7 @@ import { createPermNotifier, shouldNotifyTurnDone, shouldRecordTurnDone, permiss
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
 import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
@@ -764,30 +764,6 @@ function reconcileTerminalRows() {
     if (reaped.length) process.stderr.write(`\n  ◆ removed ${reaped.length} stale terminal row${reaped.length === 1 ? '' : 's'} after restore.\n`)
   })
 }
-// Auth: is the sender a PARTICIPANT of THIS room (owner OR granted OR joined)? Room mode
-// serves the room, so RLS returns participants; we confirm the jwt's user is one of them.
-// Pattern (per #218/#219): getUser + uid → REST existence check on code_sessions
-// (code=room, participants cs.{uid}) — NOT byte comparison of the jwt against codeAuthToken
-// (that bug already happened once tonight: a freshly-refreshed jwt has a new signature/iat/jti
-// per the grant cycle, so a byte compare rejects the legitimate sender). Hoisted to module
-// scope so provider-switch + providers-list-req share the ONE implementation. Returns false
-// for anon / missing / invalid jwt without throwing. Fails closed on any fetch error.
-const isRoomParticipant = async (jwt) => {
-  if (!jwt || typeof jwt !== 'string') return false
-  try {
-    const { data } = await supabase.auth.getUser(jwt)
-    if (!data?.user) return false
-    const uid = data.user.id
-    // Query with the CALLER's jwt (not the bridge host's codeAuthToken) so RLS scopes
-    // the read to what THIS user may see, and require an actual matching row — `r.ok`
-    // alone is true for an empty [] result, which let ANY authenticated user pass.
-    // participants is a uuid[]; PostgREST array-contains is cs.{uid} (braces required).
-    const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.%7B${encodeURIComponent(uid)}%7D&select=code`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${jwt}` } })
-    if (!r.ok) return false
-    const rows = await r.json().catch(() => [])
-    return Array.isArray(rows) && rows.length > 0
-  } catch { return false }
-}
 // ── Room-serve owner consent (Contract C-CODE-3, owner-only since 2026-07-06) ──
 // A room is served by its OWNER's bridge ONLY — no cross-person grantee path
 // (removed 2026-07-06; see docs/specs/2026-07-06-remove-cross-person-serve.md).
@@ -983,6 +959,12 @@ const designChannel = supabase.channel(`tpdesign:${room}`, {
   config: { private: true, broadcast: { self: false } },
 })
 
+// Host-changing room commands are isolated from the public collaboration topic.
+// Realtime RLS admits current room members and authenticates every send/receive.
+const controlChannel = supabase.channel(`tpcontrol:${room}`, {
+  config: { private: true, broadcast: { self: false } },
+})
+
 // ── terminal registry ──────────────────────────────────────────────
 // id → { term (pty), cmd, attached, scrollback, buf }
 const terms = new Map()
@@ -3884,6 +3866,85 @@ process.stdout.on('resize', () => {
 let realtimeHealthy = false
 let brokenSince = Date.now()
 
+// ── Private room control plane ──────────────────────────────────────────────
+// Authentication and membership are enforced by realtime.messages RLS when
+// tpcontrol:<room> joins and broadcasts. Access tokens never enter payloads.
+controlChannel
+  .on('broadcast', { event: 'apply-update' }, () => {
+    if (!pendingUpdate) return
+    applyRequested = true
+    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+      try { process.send({ t: 'apply-update' }) } catch { /* parent gone */ }
+    }
+  })
+  .on('broadcast', { event: 'bridge-update' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error, state) => controlChannel.send({
+      type: 'broadcast', event: 'bridge-update-res',
+      payload: { nonce, ok, ...(error ? { error } : {}), ...(state ? { state } : {}) },
+    })
+    if (!nonce) return reply(false, 'invalid request')
+    const target = typeof payload?.v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(payload.v)
+      ? payload.v : null
+    if (!target) return reply(false, 'invalid bridge version')
+
+    surfaceUpdate(target)
+    applyRequested = true
+    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+      try { process.send({ t: 'apply-update' }) } catch { return reply(false, 'account supervisor is unavailable') }
+      return reply(true, null, 'queued')
+    }
+
+    let managed = false
+    try {
+      const svc = await import('./service.mjs')
+      managed = svc.serviceActive(room)
+    } catch { /* reported as an explicit foreground refusal below */ }
+    if (!managed) {
+      applyRequested = false
+      return reply(false, 'This bridge is running in a terminal. Restart it once with npx thinkpool-pair@latest, or install the background service to enable remote updates.')
+    }
+    if (!betweenUpdateTurns()) return reply(true, null, 'queued')
+    await reply(true, null, 'applying')
+    void applyStandaloneManagedUpdate()
+  })
+  .on('broadcast', { event: 'providers-list-req' }, ({ payload }) => {
+    controlChannel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce: payload?.nonce, ok: true, providers: listProviders() } })
+  })
+  .on('broadcast', { event: 'provider-switch' }, ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error, restarted) => controlChannel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}), ...(restarted === undefined ? {} : { restarted }) } })
+    const term = payload?.term
+    const s = term ? sessions.get(term) : null
+    if (!s) return reply(false, 'no such live lane')
+    const v = validateProviderSwitch({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      registeredIds: listProviders().map((p) => p.id),
+    })
+    if (!v.ok) return reply(false, v.error)
+    const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
+    const plan = providerSwitchPlan({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      sameEnv: sameProviderEnv(s.provider, target),
+      targetModel: providerModel(target),
+    })
+    if (plan.action === 'noop') return reply(true, undefined, false)
+    if (plan.action === 'in-place' && switchModelInPlace(term, target)) {
+      process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched model → ${providerModel(target)} (same key, context kept).\n`)
+      announce()
+      return reply(true, undefined, false)
+    }
+    const done = respawnStructured(term, target)
+    if (!done) return reply(false, 'no such live lane')
+    process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
+    reply(true, undefined, true)
+  })
+  .subscribe((status) => {
+    if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT' || status === 'CLOSED') process.stderr.write(`\n  ⚠ private bridge control ${status} (tpcontrol:${room}).\n`)
+  })
+
 channel
   .on('broadcast', { event: 'pty-in' }, ({ payload }) => {
     if (!payload?.data) return
@@ -4532,54 +4593,6 @@ channel
   .on('broadcast', { event: 'code-close' }, ({ payload }) => {
     endStructured(payload?.id)
   })
-  // Slice 3 — the user clicked "apply" on the update chip. Mark it requested; the
-  // actual restart is gated to between turns. Account-child: forward to the
-  // supervisor (it owns the restart, applied only when every child is idle).
-  // Standalone service tier: its applyIfIdle loop lands it at the next idle. Either
-  // way it never interrupts a turn (Contract #1).
-  .on('broadcast', { event: 'apply-update' }, () => {
-    if (!pendingUpdate) return
-    applyRequested = true
-    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
-      try { process.send({ t: 'apply-update' }) } catch { /* parent gone */ }
-    }
-  })
-  // Authenticated + acknowledged update contract used by both the room card and
-  // the dashboard's room-scoped fallback. Unlike the legacy apply-update event,
-  // this does not depend on the bridge having discovered npm first: the web names
-  // the advertised target, the host updater independently resolves npm latest,
-  // and only a managed service is allowed to accept the operation.
-  .on('broadcast', { event: 'bridge-update' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    const reply = (ok, error, state) => channel.send({
-      type: 'broadcast', event: 'bridge-update-res',
-      payload: { nonce, ok, ...(error ? { error } : {}), ...(state ? { state } : {}) },
-    })
-    if (!nonce || !(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
-    const target = typeof payload?.v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(payload.v)
-      ? payload.v : null
-    if (!target) return reply(false, 'invalid bridge version')
-
-    surfaceUpdate(target)
-    applyRequested = true
-    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
-      try { process.send({ t: 'apply-update' }) } catch { return reply(false, 'account supervisor is unavailable') }
-      return reply(true, null, 'queued')
-    }
-
-    let managed = false
-    try {
-      const svc = await import('./service.mjs')
-      managed = svc.serviceActive(room)
-    } catch { /* reported as an explicit foreground refusal below */ }
-    if (!managed) {
-      applyRequested = false
-      return reply(false, 'This bridge is running in a terminal. Restart it once with npx thinkpool-pair@latest, or install the background service to enable remote updates.')
-    }
-    if (!betweenUpdateTurns()) return reply(true, null, 'queued')
-    await reply(true, null, 'applying')
-    void applyStandaloneManagedUpdate()
-  })
   // Persist + re-announce terminal renames. The web also echoes term-rename to
   // online peers directly; storing it here is what reaches a device that joins
   // LATER (or a second machine) — those only ever see the announce.
@@ -4593,111 +4606,6 @@ channel
     announce()
   })
   .on('broadcast', { event: 'who' }, announce)
-  // ── Provider registry — the multi-BYOK wire contract (room mode). ─────────────
-  // AUTH: room mode serves a room the user may not own (post-#208 grant). We verify
-  // the sender is a participant of THIS room before ANY operation. List is open to
-  // any participant; add/remove mutate the HOST's registry, so gate to the BRIDGE
-  // HOST's own uid (the authed login). Anon is refused for all three.
-  .on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    // Auth: must be the bridge host (the authed login running this bridge)
-    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
-    try {
-      const { data } = await supabase.auth.getUser(payload?.jwt)
-      if (!data?.user || data.user.id !== myServeUid) {
-        return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-      }
-    } catch {
-      return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-    }
-    let fields
-    try { fields = unseal(payload?.sealed) } catch { return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'could not decrypt the sealed payload' } }) }
-    const r = addProvider(fields)
-    if (r.ok) { announce(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
-    channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined } })
-  })
-  // provider-remove {id, nonce, jwt} → remove, re-announce.
-  .on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    // Auth: must be the bridge host (the authed login running this bridge)
-    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
-    try {
-      const { data } = await supabase.auth.getUser(payload?.jwt)
-      if (!data?.user || data.user.id !== myServeUid) {
-        return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-      }
-    } catch {
-      return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
-    }
-    const r = removeProvider(payload?.id)
-    if (r.ok) { announce(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
-    channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error } })
-  })
-  // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
-  // Auth via the shared isRoomParticipant (hoisted; same pattern as provider-switch).
-  .on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    if (!(await isRoomParticipant(payload?.jwt))) return channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: false, error: 'unauthorized', providers: [] } })
-    channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: true, providers: listProviders() } })
-  })
-  // ── Per-lane provider SWITCH (multi-BYOK slice 2). Switch a LIVE structured lane to a
-  // different LLM provider by restarting that lane's agent process under the SAME terminal
-  // id with the new provider's env. Visible transcript persists; the agent's conversational
-  // memory resets (cross-backend, no SDK resume) — accepted UX the UI warns about. Same-
-  // provider model changes keep using the EXISTING /model path (in-process setModel); the UI
-  // only sends provider-switch when the provider ACTUALLY changes.
-  //   provider-switch  {term, provider, nonce, jwt}  → bridge validates + respawns
-  //   provider-switch-res {nonce, ok, error?}        ← reply (NEVER key material)
-  // Auth: participant check via supabase.auth.getUser (isRoomParticipant) — NOT byte
-  // comparison of the jwt (a refreshed jwt has a new signature/iat/jti). Anon refused.
-  // After the respawn the lane's next announce reflects its new provider (additive {id,name}
-  // projection the client already renders from #219). Spec: docs/specs/2026-07-05-provider-switch.md.
-  .on('broadcast', { event: 'provider-switch' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    // `restarted` (0.7.179+): did the agent lose its context? false for a same-key model
-    // change, true for a real provider change. Older clients ignore the extra field.
-    const reply = (ok, error, restarted) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}), ...(restarted === undefined ? {} : { restarted }) } })
-    // AUTH first — anon / non-participant / bad jwt → ok:false 'unauthorized'. No lane
-    // state is touched for a rejected sender (fail closed before any lookup).
-    if (!(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
-    const term = payload?.term
-    const s = term ? sessions.get(term) : null
-    // The target must be a LIVE structured session this bridge serves.
-    if (!s) return reply(false, 'no such live lane')
-    // VALIDATE — pure: missing / unknown provider, or a no-op same-provider switch.
-    const v = validateProviderSwitch({
-      provider: payload?.provider,
-      currentProvider: s.provider,
-      registeredIds: listProviders().map((p) => p.id),
-    })
-    if (!v.ok) return reply(false, v.error)
-    const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
-
-    // The three-way choice is pure + unit-tested (switch-provider.mjs). Two registry rows
-    // on ONE endpoint + key (Max's glm-4.6 and glm-5.2 on the same z.ai account) are the
-    // same provider asked for a different model: the child's env is identical, so tearing
-    // the agent down and recapping it is pure loss. Only a different endpoint/key earns a
-    // respawn. An in-place attempt that fails (lane raced closed, setModel threw) falls
-    // back to the respawn rather than leaving the lane on a stale model.
-    const plan = providerSwitchPlan({
-      provider: payload?.provider,
-      currentProvider: s.provider,
-      sameEnv: sameProviderEnv(s.provider, target),
-      targetModel: providerModel(target),
-    })
-    if (plan.action === 'noop') return reply(true, undefined, false)   // idempotent (UI guarantees a change)
-
-    if (plan.action === 'in-place' && switchModelInPlace(term, target)) {
-      process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched model → ${providerModel(target)} (same key, context kept).\n`)
-      announce()
-      return reply(true, undefined, false)
-    }
-
-    const done = respawnStructured(term, target)
-    if (!done) return reply(false, 'no such live lane')   // raced closed between the lookup + respawn
-    process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
-    reply(true, undefined, true)
-  })
   .subscribe(async status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
@@ -5395,6 +5303,7 @@ async function shutdown(code = 0, farewell = true) {
   // process teardown). Close it too so shutdown is symmetric.
   try { await supabase.removeChannel(flowChannel) } catch { /* noop */ }
   try { await supabase.removeChannel(designChannel) } catch { /* noop */ }
+  try { await supabase.removeChannel(controlChannel) } catch { /* noop */ }
   setTimeout(() => process.exit(code), 250)   // grace for the leave/close frames to flush
 }
 process.on('SIGINT', () => shutdown(0))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.326",
+  "version": "0.7.328",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/terminal-name.mjs

@@ -7,7 +7,8 @@ const SKIP = new Set([
   'do', 'much', 'better', 'really', 'need', 'want', 'your', 'their', 'its',
   'also', 'all', 'away', 'before', 'cause', 'does', 'dont', "don't", 'fully', 'has',
   'have', 'now', 'occasionally', 'return', 'second', 'so', 'sometimes', 'still',
-  'than', 'then', 'there', 'whenever', 'why', 'working',
+  'than', 'then', 'there', 'what', 'when', 'where', 'which', 'who', 'whenever',
+  'why', 'working',
 ])
 
 const GENERIC = /^(?:new )?(?:agent |coding )?(?:terminal|task|lane|session|work)$/i
@@ -16,6 +17,8 @@ const ANY_HEADING = /^(?:#{1,6}\s+|(?:context|background|constraints?|inputs?|ou
 const NOISE = /^(?:context|background|for reference|here(?:'s| is)|note|current(?:ly)?|example|environment|room now|constraints?|acceptance|success criteria)\b/i
 const EXPLANATION = /^(?:because|cause|since|so that|this is because)\b/i
 const CONSTRAINT = /^(?:users? can still|keep|must|never|should|without)\b/i
+const INFORMATION_REQUEST = /^(?:which|what|who|where|when|why|how)\b/i
+const NEGATIVE_PREFERENCE = /^(?:(?:i|we)\s+)?(?:do not|don't|dont|would not|wouldn't|won't|wont)\s+(?:(?:want|wanna|need)(?:\s+to)?|use|include|choose)\b|^(?:(?:i|we)\s+)?(?:want|wanna|need)(?:\s+to)?\s+avoid\b/i
 const ISSUE = /\b(?:broken|buggy|crash(?:es|ed|ing)?|duplicate|error|fail(?:s|ed|ing|ure)?|flash(?:es|ed|ing)?|missing|no animation|not working|out of (?:scrollable )?view|stuck|wrong)\b/i
 const REQUEST = /^(?:please\s+)?(?:can|could|would|will)\s+(?:we|you)\b|^(?:please\s+)?(?:how about|let's|let us|we need to|i want you to)\b/i
 const SECRET = /(?<![\p{L}\p{N}])(?:sk-(?:proj-)?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|xox[baprs]-[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|glpat-[a-z0-9_-]{8,}|npm_[a-z0-9]{24,}|(?:sk|rk)_(?:live|test)_[a-z0-9]{8,}|whsec_[a-z0-9]{8,}|AIza[a-z0-9_-]{8,}|AKIA[A-Z0-9]{12,}|bearer\s+[a-z0-9._-]{8,}|eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}\.[a-z0-9_-]{8,})(?![\p{L}\p{N}])/giu
@@ -125,12 +128,14 @@ const bestIntentClause = (text) => {
     const action = bestAction(clause)
     let score = action?.score || 0
     if (REQUEST.test(clause)) score += 18
+    if (INFORMATION_REQUEST.test(clause)) score += 36
     if (ISSUE.test(clause)) score += /\b(?:crash|fail|flash|stuck|wrong)\w*\b/i.test(clause) ? 36 : 26
     if (words.length >= 3 && words.length <= 24) score += 10
     else if (words.length > 40) score -= 14
     if (NOISE.test(clause)) score -= 30
     if (EXPLANATION.test(clause)) score -= 34
     if (CONSTRAINT.test(clause)) score -= 45
+    if (NEGATIVE_PREFERENCE.test(clause)) score -= 70
     score += Math.round((i / Math.max(1, clauses.length - 1)) * 4)
     if (!best || score > best.score) best = { clause, score }
   }
@@ -163,7 +168,7 @@ export function cleanTerminalName(value) {
 
 const titleWord = (word) => {
   const lower = word.toLowerCase()
-  if (lower === 'thinkpool') return 'ThinkPool'
+  if (lower === 'thinkpool' || lower === 'thinkpool.io') return 'ThinkPool'
   if (lower === 'serverside') return 'Server-Side'
   if (/^(?:api|ci|css|db|html|llm|mcp|npm|sdk|ui|ux)$/i.test(word)) return lower.toUpperCase()
   if (/^[A-Z\d+#.-]{2,}$/.test(word) || /\d/.test(word)) return word
@@ -194,6 +199,9 @@ const taskTitle = (value) => {
     .replace(/^\s*(?:how about|i (?:do not|don't) know|i guess|i want you to|we need to|your task is to|let(?:'s| us))\s+/i, '')
     .trim()
   if (!body) return null
+  if (NEGATIVE_PREFERENCE.test(body)) return null
+  const informationRequest = INFORMATION_REQUEST.test(body)
+  if (informationRequest) body = body.replace(/^\s*(?:which|what)\s+/i, '').trim()
   const signalText = body
   body = body
     .replace(/\s*,?\s+(?:so (?:that|you|we|it)\b|because\b|cause\b|if you know what i mean\b)[\s\S]*$/i, '')
@@ -205,7 +213,6 @@ const taskTitle = (value) => {
   let verb = issue ? 'Fix' : action?.title
   if (!verb && /\bclos(?:e|es|ed|ing)\b/i.test(body)) verb = 'Close'
   if (!verb && /\bopen(?:s|ed|ing)?\b/i.test(body)) verb = 'Open'
-  if (!verb) verb = 'Work On'
 
   if (/\bautomatic(?:ally)?\b[\s\S]{0,24}\bnam(?:e|ing)\b/i.test(signalText) && /\bterminals?\b/i.test(signalText)) {
     if (/\bcontext\b[\s\S]{0,24}\broom\b|\broom\b[\s\S]{0,24}\bcontext\b/i.test(signalText)) return 'Auto-Name Terminals From Room Context'
@@ -226,9 +233,13 @@ const taskTitle = (value) => {
   }
   let object = contentWords(objectText)
   if (!object.length) object = contentWords(body)
+  if (informationRequest) {
+    const available = object.findIndex((word) => /^available$/i.test(word))
+    if (available > 0) object = [object[available], ...object.slice(0, available), ...object.slice(available + 1)]
+  }
   const picked = [...domain, ...object].filter((word, index, all) => all.findIndex((other) => other.toLowerCase() === word.toLowerCase()) === index).slice(0, 4)
   if (!picked.length) return null
-  return cleanTerminalName([verb, ...picked.map(titleWord)].join(' '))
+  return cleanTerminalName([verb, ...picked.map(titleWord)].filter(Boolean).join(' '))
 }
 
 export function fallbackTerminalName(text) {