thinkpool-pair 0.7.36 → 0.7.39

package/account.mjs

@@ -260,13 +260,20 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const tick = async () => {
     let rooms = []
     try {
-      const { data } = await sb.from('code_sessions').select('code,name,last_active_at').order('last_active_at', { ascending: false }).limit(20)
+      // Owner-only discovery (Contract C-CODE-2): a host bridges ONLY the sessions
+      // it CREATED. RLS on code_sessions returns owned OR participant rooms, so
+      // without this owner filter the supervisor auto-serves rooms you merely JOINED
+      // as a guest — spawning your machine into another owner's session that already
+      // runs its own bridge. The web watches tpacct:<session-owner>, so a
+      // participant's bridge is duplication the UI never even looks at.
+      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id').eq('owner_id', session.user.id).order('last_active_at', { ascending: false }).limit(20)
       rooms = data || []
     } catch { /* transient — keep existing children, retry next tick */ }
     const dirs = loadDirs()
     for (const r of rooms) {
       const room = r.code
       if (!room || children.has(room)) continue
+      if (r.owner_id && r.owner_id !== session.user.id) continue   // never serve a room we don't own (defense-in-depth behind the .eq above)
       const dir = dirs[room] || DEFAULT_DIR   // auto-serve unbound sessions in the launch dir
       if (!fs.existsSync(dir)) {
         if (!warned.has(room)) { warned.add(room); process.stderr.write(`\n  ◇ ${room}: bound directory is gone (${dir}) — re-bind it.\n`) }

package/bridge.mjs

@@ -151,7 +151,9 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
 // shell export can't reach a serviced bridge — provider.json is its own source
 // of truth. Idempotent; a no-op for the default Anthropic provider. See provider.mjs.
 const { applyProviderEnv } = await import('./provider.mjs')
-applyProviderEnv()
+// Captured so the room announce can report the active LLM provider (anthropic,
+// or a custom Anthropic-compatible endpoint) to the web welcome banner.
+const PROVIDER_INFO = applyProviderEnv()
 
 if (argv[0] === 'login') { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) }
 if (argv[0] === 'bind')  { const { runBind }  = await import('./account.mjs'); runBind(argv[1], argv[2]) }
@@ -415,6 +417,14 @@ const announce = () =>
     // cwd + version: the host's working dir + thinkpool-pair version, shown in
     // the room's welcome banner. Re-sent per announce so late joiners get them.
     cwd, version: VERSION,
+    // provider: the LLM endpoint this bridge drives Claude Code through —
+    // 'anthropic' (the default, the host's regular Claude login) or 'custom'
+    // (any Anthropic-compatible base url: GLM/Z.ai, OpenRouter, a proxy). Shown
+    // in the room banner so both drivers see whose model they're on.
+    // providerBaseUrl rides along only for custom so the banner can show the
+    // host (e.g. openrouter.ai). Older web clients ignore unknown fields.
+    provider: PROVIDER_INFO.provider,
+    providerBaseUrl: PROVIDER_INFO.baseUrl || undefined,
     // pendingUpdate: a newer thinkpool-pair is out — drives the room's "update ready"
     // chip; re-sent per announce so reloads/late-joiners see it (Slice 3).
     pendingUpdate,

package/claude-session.mjs

@@ -123,6 +123,14 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   const input = makeInputStream()
   let sessionId = resume || null
   let closed = false
+  // Cold-start measurement (2026-06-21, spec 2026-06-21-code-session-deploy-stability):
+  // stamp when the open begins so we can log spawn→ready (the SDK's first `init`
+  // system message — when the terminal becomes usable). New room terminals "take a
+  // long time"; settingSources:['user','project','local'] boots every host MCP
+  // server + SessionStart hook + plugin before init. This is the A-side baseline;
+  // open a terminal with TP_MCP_STRICT=1 (below) for the B-side to isolate MCP's share.
+  const spawnT0 = Date.now()
+  let readyLogged = false
   let q = null            // the live Query — control requests (interrupt /
                           // setPermissionMode) route through it once streaming.
   // The session is CREATED in the caller's chosen mode (not hard-coded default):
@@ -302,6 +310,13 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     // the loop; only the coarse thinking_tokens system message is surfaced.
     includePartialMessages: true,
   }
+  // Measurement lever (default OFF — no behavior change). TP_MCP_STRICT=1 makes the
+  // room session skip booting the host's filesystem-configured MCP servers
+  // (strictMcpConfig + empty mcpServers map), isolating the MCP share of cold-start
+  // in the spawn→ready log below. settingSources still loads slash commands /
+  // CLAUDE.md / agents either way — strict only governs MCP server sourcing. Flip
+  // this to the default (or curate a slim allowlist) once the numbers justify it.
+  if (process.env.TP_MCP_STRICT === '1') { opts.strictMcpConfig = true; opts.mcpServers = {} }
   if (cwd) opts.cwd = cwd
   if (model) opts.model = model
   if (resume) opts.resume = resume
@@ -343,6 +358,14 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               break
             }
             if (m.session_id) sessionId = m.session_id
+            // Cold-start timing — the init system message is when the terminal is
+            // usable, so spawn→here IS the latency the user waits on. One line per
+            // open. Compare a normal open vs one with TP_MCP_STRICT=1 to read off how
+            // many ms the host MCP servers cost. (resume opens also pay sanitizeSession.)
+            if (!readyLogged) {
+              readyLogged = true
+              process.stderr.write(`\n  ◆ session ready in ${Date.now() - spawnT0}ms — MCP ${process.env.TP_MCP_STRICT === '1' ? 'OFF' : 'on'}${resume ? ', resume' : ', fresh'}.\n`)
+            }
             // m.slash_commands (init message) — the commands this session really
             // supports: built-ins + the host's custom .claude/commands. Surfaced
             // so the room composer's autocomplete lists what ACTUALLY exists.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.36",
+  "version": "0.7.39",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {