thinkpool-pair 0.7.364 → 0.7.366

package/model-prices.mjs

@@ -1,113 +1 @@
-// Public model-price resolver for the bridge's usage ledger.
-// Runtime model catalogs tell us what ran, but not what a provider bills for
-// it. LiteLLM maintains a public catalog; cache its validated data locally and
-// persist the resolved rate beside each turn. A failed refresh never blocks a
-// turn or drops token accounting.
-
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-
-const CATALOG_URL = 'https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json'
-const CACHE_TTL_MS = 24 * 60 * 60 * 1000
-const CACHE_MAX_BYTES = 4 * 1024 * 1024
-const cachePath = () => process.env.TP_MODEL_PRICE_CACHE || path.join(process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair'), 'model-prices.json')
-
-// First-party runtimes remain priced while offline or before the catalog loads.
-const FALLBACKS = Object.freeze({
-  'gpt-5.6-sol': { input: 5, cached: 0.5, output: 30 },
-  'gpt-5.6-terra': { input: 2.5, cached: 0.25, output: 15 },
-  'gpt-5.6-luna': { input: 1, cached: 0.1, output: 6 },
-  'gpt-5.4': { input: 2.5, cached: 0.25, output: 15 },
-  'gpt-5.4-mini': { input: 0.75, cached: 0.075, output: 4.5 },
-  'gpt-5.4-nano': { input: 0.2, cached: 0.02, output: 1.25 },
-  'claude-opus-4-8': { input: 5, cached: 0.5, output: 25 },
-  'claude-fable-5': { input: 10, cached: 1, output: 50 },
-  'claude-sonnet-5': { input: 2, cached: 0.2, output: 10 },
-  'claude-haiku-4-5': { input: 1, cached: 0.1, output: 5 },
-  'glm-5.2': { input: 1.4, cached: 0.26, output: 4.4 },
-  'glm-4.6': { input: 0.6, cached: 0.11, output: 2.2 },
-})
-
-function cleanRate(raw) {
-  // Catalog rates are per token; normalize at the persistence boundary so a
-  // decimal like 0.0000001 does not become 0.09999999999999999 in Settings.
-  const perMillion = (value) => Math.round(Number(value) * 1_000_000 * 1_000_000) / 1_000_000
-  const input = perMillion(raw?.input_cost_per_token)
-  const output = perMillion(raw?.output_cost_per_token)
-  const cached = perMillion(raw?.cache_read_input_token_cost ?? raw?.cache_read_input_tokens_cost)
-  if (!Number.isFinite(input) || input < 0 || !Number.isFinite(output) || output < 0) return null
-  return { input, output, cached: Number.isFinite(cached) && cached >= 0 ? cached : null }
-}
-
-export function modelPriceKeys(model) {
-  const raw = String(model || '').trim()
-  if (!raw) return []
-  const withoutMarker = raw.replace(/\[[^\]]+\]/g, '')
-  const withoutPrefix = withoutMarker.replace(/^[^:/]+:/, '')
-  const tail = withoutPrefix.includes('/') ? withoutPrefix.slice(withoutPrefix.lastIndexOf('/') + 1) : withoutPrefix
-  return [...new Set([raw, withoutMarker, withoutPrefix, tail].filter(Boolean))]
-}
-
-function readCache() {
-  try {
-    const file = cachePath()
-    if ((Number(fs.statSync(file).size) || 0) > CACHE_MAX_BYTES) return null
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'))
-    return parsed?.models && typeof parsed.models === 'object' ? parsed : null
-  } catch { return null }
-}
-
-function writeCache(models) {
-  try {
-    const file = cachePath()
-    fs.mkdirSync(path.dirname(file), { recursive: true })
-    fs.writeFileSync(file, JSON.stringify({ fetchedAt: Date.now(), models }), { mode: 0o600 })
-  } catch { /* cache is opportunistic */ }
-}
-
-export function rateFromCatalog(model, models) {
-  for (const key of modelPriceKeys(model)) {
-    const rate = cleanRate(models?.[key])
-    if (rate) return rate
-  }
-  for (const key of modelPriceKeys(model)) {
-    const fallback = FALLBACKS[key.toLowerCase()]
-    if (fallback) return fallback
-  }
-  return null
-}
-
-export function createModelPriceResolver({ fetchImpl = globalThis.fetch } = {}) {
-  let cached = readCache()
-  let refresh = null
-  const refreshCatalog = async () => {
-    if (refresh) return refresh
-    refresh = (async () => {
-      let timer
-      try {
-        const controller = new AbortController()
-        timer = setTimeout(() => controller.abort(), 4_000)
-        const response = await fetchImpl(CATALOG_URL, { signal: controller.signal })
-        if (!response?.ok) return cached?.models || null
-        const models = await response.json()
-        if (!models || typeof models !== 'object') return cached?.models || null
-        cached = { fetchedAt: Date.now(), models }
-        writeCache(models)
-        return models
-      } catch { return cached?.models || null }
-      finally { clearTimeout(timer); refresh = null }
-    })()
-    return refresh
-  }
-  return async (model) => {
-    const current = rateFromCatalog(model, cached?.models)
-    if (current) return { ...current, source: cached?.models ? 'litellm-cache' : 'bridge-fallback' }
-    const stale = !cached || (Date.now() - Number(cached.fetchedAt || 0)) > CACHE_TTL_MS
-    const models = stale ? await refreshCatalog() : cached?.models
-    const rate = rateFromCatalog(model, models)
-    return rate ? { ...rate, source: models ? 'litellm' : 'bridge-fallback' } : null
-  }
-}
-
-export const priceForModel = createModelPriceResolver()
+import e from"node:fs";import t from"node:os";import o from"node:path";const n=()=>process.env.TP_MODEL_PRICE_CACHE||o.join(process.env.TP_PAIR_ROOT||o.join(t.homedir(),".thinkpool-pair"),"model-prices.json"),c=Object.freeze({"gpt-5.6-sol":{input:5,cached:.5,output:30},"gpt-5.6-terra":{input:2.5,cached:.25,output:15},"gpt-5.6-luna":{input:1,cached:.1,output:6},"gpt-5.4":{input:2.5,cached:.25,output:15},"gpt-5.4-mini":{input:.75,cached:.075,output:4.5},"gpt-5.4-nano":{input:.2,cached:.02,output:1.25},"claude-opus-4-8":{input:5,cached:.5,output:25},"claude-fable-5":{input:10,cached:1,output:50},"claude-sonnet-5":{input:2,cached:.2,output:10},"claude-haiku-4-5":{input:1,cached:.1,output:5},"glm-5.2":{input:1.4,cached:.26,output:4.4},"glm-4.6":{input:.6,cached:.11,output:2.2}});function r(e){const t=e=>Math.round(1e6*Number(e)*1e6)/1e6,o=t(e?.input_cost_per_token),n=t(e?.output_cost_per_token),c=t(e?.cache_read_input_token_cost??e?.cache_read_input_tokens_cost);return!Number.isFinite(o)||o<0||!Number.isFinite(n)||n<0?null:{input:o,output:n,cached:Number.isFinite(c)&&c>=0?c:null}}export function modelPriceKeys(e){const t=String(e||"").trim();if(!t)return[];const o=t.replace(/\[[^\]]+\]/g,""),n=o.replace(/^[^:/]+:/,""),c=n.includes("/")?n.slice(n.lastIndexOf("/")+1):n;return[...new Set([t,o,n,c].filter(Boolean))]}export function rateFromCatalog(e,t){for(const o of modelPriceKeys(e)){const e=r(t?.[o]);if(e)return e}for(const t of modelPriceKeys(e)){const e=c[t.toLowerCase()];if(e)return e}return null}export function createModelPriceResolver({fetchImpl:t=globalThis.fetch}={}){let c=function(){try{const t=n();if((Number(e.statSync(t).size)||0)>4194304)return null;const o=JSON.parse(e.readFileSync(t,"utf8"));return o?.models&&"object"==typeof o.models?o:null}catch{return null}}(),r=null;return async u=>{const l=rateFromCatalog(u,c?.models);if(l)return{...l,source:c?.models?"litellm-cache":"bridge-fallback"};const i=!c||Date.now()-Number(c.fetchedAt||0)>864e5?await(async()=>r||(r=(async()=>{let u;try{const r=new AbortController;u=setTimeout(()=>r.abort(),4e3);const l=await t("https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json",{signal:r.signal});if(!l?.ok)return c?.models||null;const i=await l.json();return i&&"object"==typeof i?(c={fetchedAt:Date.now(),models:i},function(t){try{const c=n();e.mkdirSync(o.dirname(c),{recursive:!0}),e.writeFileSync(c,JSON.stringify({fetchedAt:Date.now(),models:t}),{mode:384})}catch{}}(i),i):c?.models||null}catch{return c?.models||null}finally{clearTimeout(u),r=null}})(),r))():c?.models,a=rateFromCatalog(u,i);return a?{...a,source:i?"litellm":"bridge-fallback"}:null}}export const priceForModel=createModelPriceResolver();

package/package.json

@@ -1,12 +1,14 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.364",
+  "version": "0.7.366",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
+  "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
     "thinkpool-pair": "bridge.mjs"
   },
   "files": [
+    "LICENSE",
     "bridge.mjs",
     "bridge-service.sh",
     "command-guidance.mjs",
@@ -15,7 +17,6 @@
     "keep-awake.mjs",
     "sdk-smoke.mjs",
     "sdk-admission.mjs",
-    "sdk-admission.mjs",
     "launcher.mjs",
     "privacy-report.mjs",
     "agent-visibility.mjs",
@@ -122,10 +123,13 @@
     "providers.mjs",
     "provider-resilience.mjs",
     "model-prices.mjs",
-    "README.md"
+    "README.md",
+    "publish-guard.mjs",
+    "publish-manifest.json"
   ],
   "scripts": {
-    "release": "./publish.sh"
+    "prepack": "node publish-guard.mjs",
+    "prepublishOnly": "node publish-guard.mjs"
   },
   "engines": {
     "node": ">=18"
@@ -141,5 +145,10 @@
   },
   "optionalDependencies": {
     "node-pty": "^1.2.0-beta.13"
+  },
+  "thinkpoolArtifact": {
+    "format": 1,
+    "kind": "minified",
+    "manifest": "publish-manifest.json"
   }
 }

package/pair-bus.mjs

@@ -1,98 +1 @@
-// Deterministic request broker for the cross-machine pair bus.
-//
-// Supabase channel.send() is asynchronous and a channel is not usable until its
-// subscription callback reports SUBSCRIBED. Keeping those facts in one tested
-// primitive prevents a joining/dead channel from impersonating a reachable peer
-// and prevents a fast reply from arriving before its waiter exists.
-
-export const PAIR_BUS_STATUS = Object.freeze({
-  JOINING: 'joining',
-  SUBSCRIBED: 'subscribed',
-  ERROR: 'error',
-  CLOSED: 'closed',
-})
-
-export const pairBusStatusFromRealtime = (status) => {
-  if (status === 'SUBSCRIBED') return PAIR_BUS_STATUS.SUBSCRIBED
-  if (status === 'CLOSED') return PAIR_BUS_STATUS.CLOSED
-  if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') return PAIR_BUS_STATUS.ERROR
-  return PAIR_BUS_STATUS.JOINING
-}
-
-export const subscribedPairChannels = (channels) =>
-  [...(channels?.values?.() || [])].filter((entry) =>
-    entry?.status === PAIR_BUS_STATUS.SUBSCRIBED && entry?.channel?.send)
-
-export async function sendPairBroadcast (channels, event, payload) {
-  const results = await Promise.all(subscribedPairChannels(channels).map(async ({ channel }) => {
-    try { return (await channel.send({ type: 'broadcast', event, payload })) === 'ok' }
-    catch { return false }
-  }))
-  return results.filter(Boolean).length
-}
-
-export function createPairBusBroker ({ channels, randomId, setTimer = setTimeout, clearTimer = clearTimeout } = {}) {
-  if (!channels?.values || typeof randomId !== 'function') throw new TypeError('channels and randomId are required')
-  const waiters = new Map()
-
-  const resolve = (payload) => {
-    if (!payload?.nonce) return false
-    const waiter = waiters.get(payload.nonce)
-    if (!waiter) return false
-    if (waiter.mode === 'collect') { waiter.acc.push(payload); return true }
-    clearTimer(waiter.timer); waiters.delete(payload.nonce); waiter.finish(payload)
-    return true
-  }
-
-  const requestFirst = (event, payload = {}, timeoutMs) => new Promise((finish) => {
-    const nonce = randomId()
-    const timer = setTimer(() => { waiters.delete(nonce); finish(null) }, timeoutMs)
-    timer?.unref?.()
-    waiters.set(nonce, { mode: 'first', finish, timer })
-    void sendPairBroadcast(channels, event, { ...payload, nonce }).then((sent) => {
-      if (sent || !waiters.has(nonce)) return
-      clearTimer(timer); waiters.delete(nonce); finish(null)
-    })
-  })
-
-  const requestCollect = (event, payload = {}, windowMs) => new Promise((finish) => {
-    const nonce = randomId()
-    const acc = []
-    const timer = setTimer(() => { waiters.delete(nonce); finish(acc) }, windowMs)
-    timer?.unref?.()
-    waiters.set(nonce, { mode: 'collect', acc, finish, timer })
-    void sendPairBroadcast(channels, event, { ...payload, nonce }).then((sent) => {
-      if (sent || !waiters.has(nonce)) return
-      clearTimer(timer); waiters.delete(nonce); finish(acc)
-    })
-  })
-
-  const close = () => {
-    for (const [nonce, waiter] of waiters) {
-      clearTimer(waiter.timer)
-      waiter.finish(waiter.mode === 'collect' ? waiter.acc : null)
-      waiters.delete(nonce)
-    }
-  }
-
-  return Object.freeze({ resolve, requestFirst, requestCollect, close, pendingCount: () => waiters.size })
-}
-
-// The database is the authorization/discovery source; bus replies are the live
-// reachability source. Paired rooms remain visible while their host bridge is
-// offline and become online only when that host actually answers on the bus.
-export function mergePairRoomRoster ({ authorized = [], replies = [], myUid, localCodes = [] } = {}) {
-  const local = new Set(localCodes)
-  const rooms = new Map()
-  for (const row of authorized) {
-    if (!row?.code || row.owner_id === myUid || local.has(row.code)) continue
-    rooms.set(row.code, { code: row.code, name: row.name || null, online: false })
-  }
-  for (const reply of replies) {
-    for (const row of Array.isArray(reply?.rooms) ? reply.rooms : []) {
-      if (!row?.code || local.has(row.code)) continue
-      rooms.set(row.code, { code: row.code, name: row.name || rooms.get(row.code)?.name || null, host: row.host || null, online: true })
-    }
-  }
-  return [...rooms.values()]
-}
+export const PAIR_BUS_STATUS=Object.freeze({JOINING:"joining",SUBSCRIBED:"subscribed",ERROR:"error",CLOSED:"closed"});export const pairBusStatusFromRealtime=e=>"SUBSCRIBED"===e?PAIR_BUS_STATUS.SUBSCRIBED:"CLOSED"===e?PAIR_BUS_STATUS.CLOSED:"CHANNEL_ERROR"===e||"TIMED_OUT"===e?PAIR_BUS_STATUS.ERROR:PAIR_BUS_STATUS.JOINING;export const subscribedPairChannels=e=>[...e?.values?.()||[]].filter(e=>e?.status===PAIR_BUS_STATUS.SUBSCRIBED&&e?.channel?.send);export async function sendPairBroadcast(e,n,o){return(await Promise.all(subscribedPairChannels(e).map(async({channel:e})=>{try{return"ok"===await e.send({type:"broadcast",event:n,payload:o})}catch{return!1}}))).filter(Boolean).length}export function createPairBusBroker({channels:e,randomId:n,setTimer:o=setTimeout,clearTimer:r=clearTimeout}={}){if(!e?.values||"function"!=typeof n)throw new TypeError("channels and randomId are required");const t=new Map;return Object.freeze({resolve:e=>{if(!e?.nonce)return!1;const n=t.get(e.nonce);return!!n&&("collect"===n.mode?(n.acc.push(e),!0):(r(n.timer),t.delete(e.nonce),n.finish(e),!0))},requestFirst:(s,c={},a)=>new Promise(i=>{const l=n(),d=o(()=>{t.delete(l),i(null)},a);d?.unref?.(),t.set(l,{mode:"first",finish:i,timer:d}),sendPairBroadcast(e,s,{...c,nonce:l}).then(e=>{!e&&t.has(l)&&(r(d),t.delete(l),i(null))})}),requestCollect:(s,c={},a)=>new Promise(i=>{const l=n(),d=[],u=o(()=>{t.delete(l),i(d)},a);u?.unref?.(),t.set(l,{mode:"collect",acc:d,finish:i,timer:u}),sendPairBroadcast(e,s,{...c,nonce:l}).then(e=>{!e&&t.has(l)&&(r(u),t.delete(l),i(d))})}),close:()=>{for(const[e,n]of t)r(n.timer),n.finish("collect"===n.mode?n.acc:null),t.delete(e)},pendingCount:()=>t.size})}export function mergePairRoomRoster({authorized:e=[],replies:n=[],myUid:o,localCodes:r=[]}={}){const t=new Set(r),s=new Map;for(const n of e)n?.code&&n.owner_id!==o&&!t.has(n.code)&&s.set(n.code,{code:n.code,name:n.name||null,online:!1});for(const e of n)for(const n of Array.isArray(e?.rooms)?e.rooms:[])n?.code&&!t.has(n.code)&&s.set(n.code,{code:n.code,name:n.name||s.get(n.code)?.name||null,host:n.host||null,online:!0});return[...s.values()]}

package/pair-control-authority.mjs

@@ -1,89 +1 @@
-// Durable authority check for the bridge's public `code-perm` transport.
-// Realtime is only a wake-up hint: the owner-authenticated REST reads below
-// must reproduce the resolved item and its unique delivery-attempt record before
-// a local pending action is allowed to move.
-
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-const SAFE_KEY = /^[A-Za-z0-9][A-Za-z0-9._:@-]{7,159}$/
-const FINAL_STATUS = new Set(['resolved', 'denied'])
-
-const denied = (code) => Object.freeze({ ok: false, code })
-
-export function verifyPairControlDeliveryAuthority ({ item, attempts, payload, roomCode, bridgeId } = {}) {
-  if (!item || !payload || !UUID.test(String(payload.controlItemId || '')) ||
-      !SAFE_KEY.test(String(payload.attemptKey || '')) ||
-      !Number.isSafeInteger(payload.controlVersion) || payload.controlVersion < 1) {
-    return denied('invalid_delivery_hint')
-  }
-  const context = item.request_context
-  const resolution = item.resolution_payload
-  if (item.id !== payload.controlItemId || item.session_code !== String(roomCode || '').toUpperCase() ||
-      item.item_kind !== 'approval' || !['approval', 'dispatch'].includes(item.action_kind) ||
-      item.resolution_policy !== 'either_member' || item.required_actor_id != null ||
-      !FINAL_STATUS.has(item.status) || Number(item.version) !== payload.controlVersion ||
-      item.bridge_authority_id !== bridgeId || item.local_authority_id !== payload.term ||
-      !context || context.permission_id !== payload.id || context.terminal_ref !== payload.term ||
-      !resolution || resolution.decision !== payload.decision || !item.resolved_by) {
-    return denied('authority_mismatch')
-  }
-  if ((item.status === 'resolved' && !['approved', 'answered'].includes(item.resolution_code)) ||
-      (item.status === 'denied' && item.resolution_code !== 'rejected')) {
-    return denied('resolution_mismatch')
-  }
-  const matching = Array.isArray(attempts) ? attempts.filter((event) =>
-    event?.actor_id === item.resolved_by && Number(event.item_version) === Number(item.version) &&
-    event.correlation_key === payload.attemptKey && event.payload?.data?.transport === 'code-perm') : []
-  if (matching.length !== 1) return denied('delivery_attempt_unverified')
-  const durableResponder = resolution.responder
-  const responder = durableResponder && durableResponder.id === item.resolved_by
-    ? {
-        id: item.resolved_by,
-        name: typeof durableResponder.name === 'string' && durableResponder.name.trim()
-          ? durableResponder.name.trim().slice(0, 120)
-          : null,
-      }
-    : { id: item.resolved_by, name: null }
-  return Object.freeze({
-    ok: true,
-    code: 'durable_delivery_authorized',
-    decision: resolution.decision,
-    // App Server input is recovered from the durable resolution only. The public
-    // broadcast intentionally remains a wake-up hint and cannot supply answers.
-    answers: resolution.answers && typeof resolution.answers === 'object' ? resolution.answers : {},
-    responder: Object.freeze(responder),
-    itemId: item.id,
-    version: Number(item.version),
-    attemptKey: payload.attemptKey,
-  })
-}
-
-export async function fetchPairControlDeliveryAuthority ({
-  fetchImpl = globalThis.fetch, supabaseUrl, anonKey, token, roomCode, bridgeId, payload,
-} = {}) {
-  if (typeof fetchImpl !== 'function' || !supabaseUrl || !anonKey || !token || !roomCode || !bridgeId ||
-      !UUID.test(String(payload?.controlItemId || '')) || !SAFE_KEY.test(String(payload?.attemptKey || ''))) {
-    return denied('authority_unavailable')
-  }
-  const headers = { apikey: anonKey, Authorization: `Bearer ${token}` }
-  const itemUrl = new URL('/rest/v1/code_pair_control_items', supabaseUrl)
-  itemUrl.searchParams.set('id', `eq.${payload.controlItemId}`)
-  itemUrl.searchParams.set('session_code', `eq.${String(roomCode).toUpperCase()}`)
-  itemUrl.searchParams.set('select', 'id,session_code,item_kind,action_kind,resolution_policy,required_actor_id,status,version,resolution_code,resolution_payload,resolved_by,bridge_authority_id,local_authority_id,request_context')
-  const eventUrl = new URL('/rest/v1/code_pair_control_events', supabaseUrl)
-  eventUrl.searchParams.set('item_id', `eq.${payload.controlItemId}`)
-  eventUrl.searchParams.set('event_type', 'eq.delivery_attempted')
-  eventUrl.searchParams.set('correlation_key', `eq.${payload.attemptKey}`)
-  eventUrl.searchParams.set('select', 'actor_id,item_version,correlation_key,payload')
-  eventUrl.searchParams.set('limit', '2')
-  try {
-    const [itemResponse, eventResponse] = await Promise.all([
-      fetchImpl(itemUrl, { headers }), fetchImpl(eventUrl, { headers }),
-    ])
-    if (!itemResponse.ok || !eventResponse.ok) return denied('authority_read_failed')
-    const [items, attempts] = await Promise.all([itemResponse.json(), eventResponse.json()])
-    if (!Array.isArray(items) || items.length !== 1 || !Array.isArray(attempts)) return denied('authority_read_invalid')
-    return verifyPairControlDeliveryAuthority({ item: items[0], attempts, payload, roomCode, bridgeId })
-  } catch {
-    return denied('authority_read_failed')
-  }
-}
+const e=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,t=/^[A-Za-z0-9][A-Za-z0-9._:@-]{7,159}$/,r=new Set(["resolved","denied"]),o=e=>Object.freeze({ok:!1,code:e});export function verifyPairControlDeliveryAuthority({item:i,attempts:a,payload:s,roomCode:n,bridgeId:d}={}){if(!i||!s||!e.test(String(s.controlItemId||""))||!t.test(String(s.attemptKey||""))||!Number.isSafeInteger(s.controlVersion)||s.controlVersion<1)return o("invalid_delivery_hint");const l=i.request_context,c=i.resolution_payload;if(!(i.id===s.controlItemId&&i.session_code===String(n||"").toUpperCase()&&"approval"===i.item_kind&&["approval","dispatch"].includes(i.action_kind)&&"either_member"===i.resolution_policy&&null==i.required_actor_id&&r.has(i.status)&&Number(i.version)===s.controlVersion&&i.bridge_authority_id===d&&i.local_authority_id===s.term&&l&&l.permission_id===s.id&&l.terminal_ref===s.term&&c&&c.decision===s.decision&&i.resolved_by))return o("authority_mismatch");if("resolved"===i.status&&!["approved","answered"].includes(i.resolution_code)||"denied"===i.status&&"rejected"!==i.resolution_code)return o("resolution_mismatch");if(1!==(Array.isArray(a)?a.filter(e=>e?.actor_id===i.resolved_by&&Number(e.item_version)===Number(i.version)&&e.correlation_key===s.attemptKey&&"code-perm"===e.payload?.data?.transport):[]).length)return o("delivery_attempt_unverified");const _=c.responder,m=_&&_.id===i.resolved_by?{id:i.resolved_by,name:"string"==typeof _.name&&_.name.trim()?_.name.trim().slice(0,120):null}:{id:i.resolved_by,name:null};return Object.freeze({ok:!0,code:"durable_delivery_authorized",decision:c.decision,answers:c.answers&&"object"==typeof c.answers?c.answers:{},responder:Object.freeze(m),itemId:i.id,version:Number(i.version),attemptKey:s.attemptKey})}export async function fetchPairControlDeliveryAuthority({fetchImpl:r=globalThis.fetch,supabaseUrl:i,anonKey:a,token:s,roomCode:n,bridgeId:d,payload:l}={}){if(!("function"==typeof r&&i&&a&&s&&n&&d&&e.test(String(l?.controlItemId||""))&&t.test(String(l?.attemptKey||""))))return o("authority_unavailable");const c={apikey:a,Authorization:`Bearer ${s}`},_=new URL("/rest/v1/code_pair_control_items",i);_.searchParams.set("id",`eq.${l.controlItemId}`),_.searchParams.set("session_code",`eq.${String(n).toUpperCase()}`),_.searchParams.set("select","id,session_code,item_kind,action_kind,resolution_policy,required_actor_id,status,version,resolution_code,resolution_payload,resolved_by,bridge_authority_id,local_authority_id,request_context");const m=new URL("/rest/v1/code_pair_control_events",i);m.searchParams.set("item_id",`eq.${l.controlItemId}`),m.searchParams.set("event_type","eq.delivery_attempted"),m.searchParams.set("correlation_key",`eq.${l.attemptKey}`),m.searchParams.set("select","actor_id,item_version,correlation_key,payload"),m.searchParams.set("limit","2");try{const[e,t]=await Promise.all([r(_,{headers:c}),r(m,{headers:c})]);if(!e.ok||!t.ok)return o("authority_read_failed");const[i,a]=await Promise.all([e.json(),t.json()]);return Array.isArray(i)&&1===i.length&&Array.isArray(a)?verifyPairControlDeliveryAuthority({item:i[0],attempts:a,payload:l,roomCode:n,bridgeId:d}):o("authority_read_invalid")}catch{return o("authority_read_failed")}}

package/past-work-search.mjs

@@ -1,105 +1 @@
-const MAX_QUERY = 160
-const MAX_RESULTS = 8
-const MAX_RECORDS = 48
-const MAX_EVENTS = 800
-const MAX_EXCERPT = 260
-const SECRET_VALUE = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|npm_[a-z0-9]{24,}|bearer\s+[a-z0-9._-]{8,}|(?:api[_-]?key|access[_-]?token|auth(?:orization)?|token|secret)\s*[=:]\s*\S+)/i
-const PRIVATE_WORDS = /(?:system\s+prompt|hidden\s+reasoning|chain[ -]of[ -]thought|\bpassword\b|private[_ -]?key|\.env\b)/i
-const HOST_PATH = /(?:^|[\s=("'`])(?:~\/|\/(?:Users|home|var|tmp|private|workspace)\/|[A-Za-z]:\\|\\\\)[^\s)"'`]*/i
-
-function textContent(content) {
-  if (typeof content === 'string') return content
-  if (!Array.isArray(content)) return ''
-  return content.map((item) => typeof item === 'string' ? item : item?.text || '').join(' ')
-}
-
-function safeExcerpt(value) {
-  if (typeof value !== 'string') return null
-  const line = value.replace(/\s+/g, ' ').trim()
-  if (!line || SECRET_VALUE.test(line) || PRIVATE_WORDS.test(line) || HOST_PATH.test(line)) return null
-  return line.slice(0, MAX_EXCERPT)
-}
-
-function eventCandidates(event) {
-  if (!event || typeof event !== 'object') return []
-  if (event.kind === 'flow-review-receipt') {
-    const scope = event.scope
-    return [
-      `Flow ${event.outcome || 'review'}: ${event.taskKey || ''}`,
-      ...(event.checks || []).map((line) => `Check: ${line}`),
-      ...(event.reasons || []).map((line) => `Finding: ${line}`),
-      ...((scope?.changed || []).map((line) => `Edited: ${line}`)),
-      ...((scope?.unexpected || []).map((line) => `Unexpected: ${line}`)),
-    ]
-  }
-  if (event.kind === 'assistant') {
-    const out = []
-    for (const block of event.blocks || []) {
-      if (block?.type === 'text') out.push(block.text)
-      if (block?.type === 'tool_use') {
-        const name = String(block.name || '')
-        if (/^(?:bash|exec_command|command_execution)$/i.test(name)) {
-          const command = block.input?.command ?? block.input?.cmd
-          if (command) out.push(`Command: ${command}`)
-        }
-      }
-    }
-    return out
-  }
-  if (event.kind === 'you') return [event.text]
-  if (event.kind === 'tool_result') return [`Result: ${textContent(event.content)}`]
-  if (event.kind === 'result') return [event.resultText]
-  return []
-}
-
-function queryParts(query) {
-  const text = String(query || '').replace(/\s+/g, ' ').trim()
-  if (text.length < 2 || text.length > MAX_QUERY) throw new TypeError(`past-work query must contain 2-${MAX_QUERY} characters`)
-  if (SECRET_VALUE.test(text) || PRIVATE_WORDS.test(text) || HOST_PATH.test(text)) return null
-  return { text, lower: text.toLowerCase(), tokens: text.toLowerCase().split(/[^a-z0-9._/-]+/).filter((token) => token.length > 1) }
-}
-
-export function searchPastWork(records, query, { room, limit = MAX_RESULTS } = {}) {
-  const parsed = queryParts(query)
-  if (!parsed) return []
-  const boundedLimit = Math.max(1, Math.min(MAX_RESULTS, Number(limit) || MAX_RESULTS))
-  const results = []
-  for (const record of (Array.isArray(records) ? records : []).slice(0, MAX_RECORDS)) {
-    const terminal = safeExcerpt(record?.name) || 'Unnamed terminal'
-    const events = Array.isArray(record?.log) ? record.log.slice(-MAX_EVENTS) : []
-    for (const event of events) {
-      for (const raw of eventCandidates(event)) {
-        const excerpt = safeExcerpt(raw)
-        if (!excerpt) continue
-        const lower = excerpt.toLowerCase()
-        const tokenHits = parsed.tokens.filter((token) => lower.includes(token)).length
-        if (!lower.includes(parsed.lower) && (!parsed.tokens.length || tokenHits !== parsed.tokens.length)) continue
-        results.push({
-          room: String(room || '').trim() || 'current',
-          terminal,
-          terminalId: String(record?.id || '').slice(0, 80),
-          ts: Number(event?.ts) || Number(record?.savedAt) || 0,
-          seq: Number.isFinite(Number(event?.seq)) ? Number(event.seq) : null,
-          excerpt,
-          score: (lower.includes(parsed.lower) ? 10 : 0) + tokenHits + (excerpt.startsWith('Command:') ? 0 : 1),
-        })
-      }
-    }
-  }
-  return results
-    .sort((a, b) => b.score - a.score || b.ts - a.ts)
-    .slice(0, boundedLimit)
-    .map(({ score, ...result }) => result)
-}
-
-export function formatPastWorkSearch(results, query) {
-  const safeQuery = safeExcerpt(String(query || '').trim())
-  if (!results.length) return safeQuery
-    ? `No cited past work matched “${safeQuery}” in this room.`
-    : 'No cited past work matched that privacy-filtered query in this room.'
-  return results.map((result, index) => {
-    const date = result.ts ? new Date(result.ts).toISOString().slice(0, 10) : 'date unavailable'
-    const event = result.seq == null ? 'saved transcript' : `event ${result.seq}`
-    return `${index + 1}. ${result.excerpt}\n   [Room ${result.room} · ${result.terminal} · ${date} · ${event}]`
-  }).join('\n')
-}
+const t=/(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|npm_[a-z0-9]{24,}|bearer\s+[a-z0-9._-]{8,}|(?:api[_-]?key|access[_-]?token|auth(?:orization)?|token|secret)\s*[=:]\s*\S+)/i,e=/(?:system\s+prompt|hidden\s+reasoning|chain[ -]of[ -]thought|\bpassword\b|private[_ -]?key|\.env\b)/i,r=/(?:^|[\s=("'`])(?:~\/|\/(?:Users|home|var|tmp|private|workspace)\/|[A-Za-z]:\\|\\\\)[^\s)"'`]*/i;function n(n){if("string"!=typeof n)return null;const s=n.replace(/\s+/g," ").trim();return!s||t.test(s)||e.test(s)||r.test(s)?null:s.slice(0,260)}function s(t){if(!t||"object"!=typeof t)return[];if("flow-review-receipt"===t.kind){const e=t.scope;return[`Flow ${t.outcome||"review"}: ${t.taskKey||""}`,...(t.checks||[]).map(t=>`Check: ${t}`),...(t.reasons||[]).map(t=>`Finding: ${t}`),...(e?.changed||[]).map(t=>`Edited: ${t}`),...(e?.unexpected||[]).map(t=>`Unexpected: ${t}`)]}if("assistant"===t.kind){const e=[];for(const r of t.blocks||[])if("text"===r?.type&&e.push(r.text),"tool_use"===r?.type){const t=String(r.name||"");if(/^(?:bash|exec_command|command_execution)$/i.test(t)){const t=r.input?.command??r.input?.cmd;t&&e.push(`Command: ${t}`)}}return e}return"you"===t.kind?[t.text]:"tool_result"===t.kind?[`Result: ${e=t.content,"string"==typeof e?e:Array.isArray(e)?e.map(t=>"string"==typeof t?t:t?.text||"").join(" "):""}`]:"result"===t.kind?[t.resultText]:[];var e}export function searchPastWork(o,i,{room:a,limit:c=8}={}){const l=function(n){const s=String(n||"").replace(/\s+/g," ").trim();if(s.length<2||s.length>160)throw new TypeError("past-work query must contain 2-160 characters");return t.test(s)||e.test(s)||r.test(s)?null:{text:s,lower:s.toLowerCase(),tokens:s.toLowerCase().split(/[^a-z0-9._/-]+/).filter(t=>t.length>1)}}(i);if(!l)return[];const m=Math.max(1,Math.min(8,Number(c)||8)),u=[];for(const t of(Array.isArray(o)?o:[]).slice(0,48)){const e=n(t?.name)||"Unnamed terminal",r=Array.isArray(t?.log)?t.log.slice(-800):[];for(const o of r)for(const r of s(o)){const s=n(r);if(!s)continue;const i=s.toLowerCase(),c=l.tokens.filter(t=>i.includes(t)).length;(i.includes(l.lower)||l.tokens.length&&c===l.tokens.length)&&u.push({room:String(a||"").trim()||"current",terminal:e,terminalId:String(t?.id||"").slice(0,80),ts:Number(o?.ts)||Number(t?.savedAt)||0,seq:Number.isFinite(Number(o?.seq))?Number(o.seq):null,excerpt:s,score:(i.includes(l.lower)?10:0)+c+(s.startsWith("Command:")?0:1)})}}return u.sort((t,e)=>e.score-t.score||e.ts-t.ts).slice(0,m).map(({score:t,...e})=>e)}export function formatPastWorkSearch(t,e){const r=n(String(e||"").trim());return t.length?t.map((t,e)=>{const r=t.ts?new Date(t.ts).toISOString().slice(0,10):"date unavailable",n=null==t.seq?"saved transcript":`event ${t.seq}`;return`${e+1}. ${t.excerpt}\n   [Room ${t.room} · ${t.terminal} · ${r} · ${n}]`}).join("\n"):r?`No cited past work matched “${r}” in this room.`:"No cited past work matched that privacy-filtered query in this room."}

package/plan-meters.mjs

@@ -1,144 +1 @@
-/* Plan / rate-limit meters for the /usage report.
- *
- * WHERE THE NUMBERS COME FROM. `GET https://api.anthropic.com/api/oauth/usage`
- * with the Claude Code OAuth access token — the SAME endpoint the CLI's own /usage
- * screen reads. So the percentages and, critically, the RESET TIMES are the
- * server's, not ours. We never infer a 5-hour block boundary from transcript
- * timestamps (the ccusage approach): an inferred reset is a number that looks
- * authoritative and is wrong, which is exactly the bug this module exists to avoid.
- *
- * READ-ONLY, AND DELIBERATELY SO. We read the access token and we never refresh it.
- * Refreshing rotates the refresh token; two processes rotating against one credential
- * store is how the bridge's login died before (memory: thinkpool_bridge_login_headless_recovery).
- * An expired token therefore degrades to "plan meters unavailable" rather than
- * quietly re-authenticating behind the user's back.
- *
- * DEGRADE HONESTLY. Every failure — no token, non-Claude provider, network error,
- * 401, shape change, a reset timestamp in the past — returns null, and the caller
- * prints "plan meters unavailable". A stale or invented meter is worse than no meter.
- */
-
-import { execFileSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-const USAGE_URL = 'https://api.anthropic.com/api/oauth/usage'
-const CACHE_MS = 45_000
-const FETCH_TIMEOUT_MS = 4_000
-
-// ── token ────────────────────────────────────────────────────────────────────
-// macOS keeps Claude Code's credentials in the login keychain; Linux writes
-// ~/.claude/.credentials.json. Same JSON shape either way: { claudeAiOauth: { accessToken } }.
-// Any failure here is a normal, expected state (BYOK lane, API-key auth, logged out).
-export function readOAuthToken (deps = {}) {
-  const {
-    platform = process.platform,
-    env = process.env,
-    exec = execFileSync,
-    read = readFileSync,
-    home = homedir()
-  } = deps
-  if (env.THINKPOOL_OAUTH_TOKEN) return env.THINKPOOL_OAUTH_TOKEN // test/override seam
-  let raw = null
-  try {
-    if (platform === 'darwin') {
-      raw = exec('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'],
-        { encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'] })
-    } else {
-      raw = read(join(home, '.claude', '.credentials.json'), 'utf8')
-    }
-    const tok = JSON.parse(raw)?.claudeAiOauth?.accessToken
-    return (typeof tok === 'string' && tok.startsWith('sk-ant-oat')) ? tok : null
-  } catch { return null }
-}
-
-// ── fetch ────────────────────────────────────────────────────────────────────
-export async function fetchPlanUsage (token, fetchImpl = globalThis.fetch) {
-  if (!token) return null
-  const ac = new AbortController()
-  const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS)
-  try {
-    const res = await fetchImpl(USAGE_URL, {
-      method: 'GET',
-      headers: { authorization: `Bearer ${token}`, 'anthropic-beta': 'oauth-2025-04-20' },
-      signal: ac.signal
-    })
-    if (!res.ok) return null // 401 (expired) / 403 / 5xx → unavailable, never a guess
-    return await res.json()
-  } catch { return null } finally { clearTimeout(timer) }
-}
-
-// ── format (pure) ────────────────────────────────────────────────────────────
-const DAYS = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat']
-
-// A reset renders in LOCAL time. Beyond ~20h out (the weekly meter) a bare HH:MM is
-// ambiguous, so it carries a weekday. Returns null for an unparseable timestamp OR one
-// already in the past — a past reset means the payload is stale, and printing "resets
-// 10:10" when 10:10 has been and gone is precisely the lie we refuse to tell.
-export function fmtReset (iso, now) {
-  const t = new Date(iso).getTime()
-  if (!Number.isFinite(t) || t <= now.getTime()) return null
-  // ROUND to the nearest minute, don't floor. The endpoint stamps `resets_at` with
-  // sub-second jitter around the true boundary — two calls seconds apart returned
-  // 10:10:00.355Z and 10:09:59.873Z for the same reset. Flooring renders those as
-  // 12:10 and 12:09, so the meter visibly flickers a minute back and forth on a
-  // surface whose whole job is to be the trustworthy number. Observed 2026-07-10.
-  const d = new Date(Math.round(t / 60000) * 60000)
-  const hhmm = `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`
-  return (t - now.getTime()) > 20 * 3600 * 1000 ? `${DAYS[d.getDay()]} ${hhmm}` : hhmm
-}
-
-const fmtIn = (ms) => {
-  const m = Math.max(0, Math.round(ms / 60000))
-  return m >= 60 ? `${Math.floor(m / 60)}h${String(m % 60).padStart(2, '0')}m` : `${m}m`
-}
-
-// Render one block ("5h" / "week") or null if it can't be stated truthfully.
-function block (label, node, now, withRelative) {
-  const pct = node && typeof node.utilization === 'number' ? Math.round(node.utilization) : null
-  if (pct == null) return null
-  const at = fmtReset(node.resets_at, now)
-  if (!at) return `${label}: ${pct}%` // percent is still true even if the reset isn't usable
-  const rel = withRelative ? ` (${fmtIn(new Date(node.resets_at).getTime() - now.getTime())})` : ''
-  return `${label}: ${pct}% · resets ${at}${rel}`
-}
-
-// json → "plan · 5h: 10% · resets 12:10 (1h04m) · week: 26% · resets Tue 11:00"
-// Returns null when nothing truthful can be said, so the caller prints the honest
-// "plan meters unavailable" instead of a half-line.
-export function formatPlanMeters (json, now = new Date()) {
-  if (!json || typeof json !== 'object') return null
-  const parts = [block('5h', json.five_hour, now, true), block('week', json.seven_day, now, false)]
-  // A scoped weekly cap (e.g. a per-model ceiling) only matters while it's the binding
-  // one — surface it, named, so a lane that's about to hit a model-specific wall sees it.
-  const scoped = Array.isArray(json.limits)
-    ? json.limits.find((l) => l && l.is_active && l.kind === 'weekly_scoped' && typeof l.percent === 'number')
-    : null
-  if (scoped) {
-    const name = scoped.scope?.model?.display_name
-    parts.push(`${name ? `week ${name}` : 'week scoped'}: ${Math.round(scoped.percent)}%`)
-  }
-  const live = parts.filter(Boolean)
-  return live.length ? `plan · ${live.join(' · ')}` : null
-}
-
-// ── cached entry point ───────────────────────────────────────────────────────
-let cache = { at: 0, line: null }
-
-// The ONE line bridge.mjs appends under the token/cost line. Cached ~45s so a user
-// spamming /usage doesn't hammer the endpoint. Never throws.
-export async function planMeterLine (deps = {}) {
-  const { now = () => Date.now(), clock = () => new Date(), token = readOAuthToken, fetchUsage = fetchPlanUsage } = deps
-  const t = now()
-  if (cache.line !== null && (t - cache.at) < CACHE_MS) return cache.line
-  let line = 'plan meters unavailable'
-  try {
-    const json = await fetchUsage(token())
-    line = formatPlanMeters(json, clock()) || 'plan meters unavailable'
-  } catch { /* stays unavailable */ }
-  cache = { at: t, line }
-  return line
-}
-
-export function _resetCache () { cache = { at: 0, line: null } } // test seam
+import{execFileSync as e}from"node:child_process";import{readFileSync as t}from"node:fs";import{homedir as n}from"node:os";import{join as r}from"node:path";export function readOAuthToken(a={}){const{platform:o=process.platform,env:i=process.env,exec:l=e,read:s=t,home:u=n()}=a;if(i.THINKPOOL_OAUTH_TOKEN)return i.THINKPOOL_OAUTH_TOKEN;let c=null;try{c="darwin"===o?l("security",["find-generic-password","-s","Claude Code-credentials","-w"],{encoding:"utf8",timeout:3e3,stdio:["ignore","pipe","ignore"]}):s(r(u,".claude",".credentials.json"),"utf8");const e=JSON.parse(c)?.claudeAiOauth?.accessToken;return"string"==typeof e&&e.startsWith("sk-ant-oat")?e:null}catch{return null}}export async function fetchPlanUsage(e,t=globalThis.fetch){if(!e)return null;const n=new AbortController,r=setTimeout(()=>n.abort(),4e3);try{const r=await t("https://api.anthropic.com/api/oauth/usage",{method:"GET",headers:{authorization:`Bearer ${e}`,"anthropic-beta":"oauth-2025-04-20"},signal:n.signal});return r.ok?await r.json():null}catch{return null}finally{clearTimeout(r)}}const a=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];export function fmtReset(e,t){const n=new Date(e).getTime();if(!Number.isFinite(n)||n<=t.getTime())return null;const r=new Date(6e4*Math.round(n/6e4)),o=`${String(r.getHours()).padStart(2,"0")}:${String(r.getMinutes()).padStart(2,"0")}`;return n-t.getTime()>72e6?`${a[r.getDay()]} ${o}`:o}function o(e,t,n,r){const a=t&&"number"==typeof t.utilization?Math.round(t.utilization):null;if(null==a)return null;const o=fmtReset(t.resets_at,n);return o?`${e}: ${a}% · resets ${o}${r?` (${(e=>{const t=Math.max(0,Math.round(e/6e4));return t>=60?`${Math.floor(t/60)}h${String(t%60).padStart(2,"0")}m`:`${t}m`})(new Date(t.resets_at).getTime()-n.getTime())})`:""}`:`${e}: ${a}%`}export function formatPlanMeters(e,t=new Date){if(!e||"object"!=typeof e)return null;const n=[o("5h",e.five_hour,t,!0),o("week",e.seven_day,t,!1)],r=Array.isArray(e.limits)?e.limits.find(e=>e&&e.is_active&&"weekly_scoped"===e.kind&&"number"==typeof e.percent):null;if(r){const e=r.scope?.model?.display_name;n.push(`${e?`week ${e}`:"week scoped"}: ${Math.round(r.percent)}%`)}const a=n.filter(Boolean);return a.length?`plan · ${a.join(" · ")}`:null}let i={at:0,line:null};export async function planMeterLine(e={}){const{now:t=()=>Date.now(),clock:n=()=>new Date,token:r=readOAuthToken,fetchUsage:a=fetchPlanUsage}=e,o=t();if(null!==i.line&&o-i.at<45e3)return i.line;let l="plan meters unavailable";try{l=formatPlanMeters(await a(r()),n())||"plan meters unavailable"}catch{}return i={at:o,line:l},l}export function _resetCache(){i={at:0,line:null}}