thinkpool-pair 0.7.364 → 0.7.366

package/presence.mjs

@@ -1,191 +1 @@
-/* ─────────────────────────────────────────────────────────────
-   presence.mjs — a throttled wrapper for Supabase Realtime presence
-   track(), shared by the account supervisor (account.mjs) and every
-   room bridge (bridge.mjs).
-
-   The bug it fixes: supabase-js auto-rejoins a dropped channel and
-   re-fires `SUBSCRIBED`; our subscribe handlers re-`track()` presence
-   on each one. With no throttle a SINGLE drop can spiral —
-     track() → trip the per-client presence rate limit
-            → server closes the channel → auto-rejoin → SUBSCRIBED
-            → track() → trip again → … forever
-   which the server logs as `ClientPresenceRateLimitReached:
-   :client_rate_limit_exceeded`. The supervisor stays alive and keeps
-   relaying sessions, but its presence never re-sticks, so the dashboard
-   reads "No bridge connected" while sessions plainly run (the
-   2026-06-17 / -22 / -24 recurrences).
-
-   makeThrottledTrack coalesces bursts to at most one track() per
-   window: the FIRST call fires immediately (presence appears fast),
-   any further calls inside the window collapse into a single trailing
-   fire with the latest payload. At minMs=5000 that's ≤0.2 track/s —
-   far under any presence rate limit — so a reconnect storm can never
-   trip it, while the steady-state callers (a 15s tick, a token refresh)
-   are unaffected (their interval already exceeds the window).
-   ───────────────────────────────────────────────────────────── */
-
-// channel: a supabase RealtimeChannel (stable across reconnects — supabase-js
-// rejoins the same object, so channel.track stays valid). Returns a function you
-// call with the presence payload anywhere you'd have called channel.track(payload).
-// onStatus (optional): called with each track()'s server status ('ok' | 'timed out' |
-// 'error') so a caller can retain the last one for a postmortem log line. Best-effort —
-// a track that throws reports 'error' and never breaks the caller.
-export function makeThrottledTrack(channel, { minMs = 5000, onStatus = null } = {}) {
-  let last = 0
-  let timer = null
-  let pending = null
-  const fire = async () => {
-    timer = null
-    last = Date.now()
-    const payload = pending
-    pending = null
-    // Await the track so we can retain its status for the next postmortem. fire() is never
-    // awaited by callers, so this stays fire-and-forget — the await only sequences the
-    // onStatus callback; it never blocks a caller and a rejection can't escape (caught here).
-    try { const status = await channel.track(payload); onStatus?.(status ?? 'ok') }
-    catch { onStatus?.('error') /* presence track is best-effort */ }
-  }
-  return (payload) => {
-    pending = payload
-    const since = Date.now() - last
-    if (since >= minMs) {
-      if (timer) { clearTimeout(timer) }
-      fire()                                   // leading edge — presence appears immediately
-    } else if (!timer) {
-      timer = setTimeout(fire, minMs - since)  // trailing edge — coalesce the burst
-    }
-  }
-}
-
-// A service process must not wedge its entire startup behind the first Realtime
-// SUBSCRIBED callback. Settle the startup gate on success, a terminal channel state,
-// or a bounded timeout while leaving the callback attached for later auto-rejoins.
-export function subscribeWithoutStartupDeadlock(channel, onStatus, {
-  timeoutMs = 15_000,
-  setTimer = setTimeout,
-  clearTimer = clearTimeout,
-} = {}) {
-  if (!channel?.subscribe || typeof onStatus !== 'function') return Promise.resolve({ connected: false, status: 'unavailable' })
-  return new Promise((resolve) => {
-    let settled = false
-    const finish = (connected, status) => {
-      if (settled) return
-      settled = true
-      clearTimer(timer)
-      resolve({ connected, status })
-    }
-    const timer = setTimer(() => finish(false, 'STARTUP_TIMEOUT'), Math.max(1, Number(timeoutMs) || 1))
-    channel.subscribe((status) => {
-      onStatus(status)
-      if (status === 'SUBSCRIBED') finish(true, status)
-      else if (status === 'CLOSED' || status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') finish(false, status)
-    })
-  })
-}
-
-export function recoveryBackoffMs(attempt, { baseMs = 20_000, capMs = 300_000 } = {}) {
-  const n = Math.max(0, Math.floor(Number(attempt) || 0))
-  return Math.min(Math.max(1, Number(capMs) || 1), Math.max(1, Number(baseMs) || 1) * (2 ** Math.min(n, 10)))
-}
-
-// A RealtimeChannel keeps its last presenceState() locally. After CHANNEL_ERROR /
-// CLOSED that cache can still contain our own key even though the server (and every
-// dashboard subscriber) has already removed it. Treat every subscribe/error edge as
-// a new evidence generation: only a presence sync delivered in that generation may
-// certify the cached self key.
-export function reducePresenceChannelEvidence(state = {}, event, now = Date.now()) {
-  const current = {
-    subscribedAt: Number(state.subscribedAt) || 0,
-    syncSeenAt: Number(state.syncSeenAt) || 0,
-  }
-  if (event === 'sync') return { ...current, syncSeenAt: now }
-  if (event === 'SUBSCRIBED') {
-    // A reconnect loop may report SUBSCRIBED repeatedly without ever delivering
-    // presence sync. Preserve the first unsynced boundary so retries cannot keep
-    // pushing the watchdog deadline out forever.
-    if (current.subscribedAt && !current.syncSeenAt) return current
-    return { subscribedAt: now, syncSeenAt: 0 }
-  }
-  if (event === 'CLOSED' || event === 'CHANNEL_ERROR' || event === 'TIMED_OUT') {
-    // Likewise, repeated error callbacks are one failure episode until a fresh
-    // sync proves recovery.
-    if (current.subscribedAt && !current.syncSeenAt) return current
-    return { subscribedAt: now, syncSeenAt: 0 }
-  }
-  return current
-}
-
-// Recycling a websocket is useful only when plain HTTP is healthy enough to prove
-// this is a Realtime-only wedge. During a full network/Supabase outage, respawning a
-// launchd service cannot help and merely creates a restart storm.
-export function presenceRecoveryEligible({ claimHeld, lastClaimOkAt, now, maxClaimSilenceMs = 40_000 }) {
-  return !!claimHeld && Number.isFinite(lastClaimOkAt) && (now - lastClaimOkAt) < maxClaimSilenceMs
-}
-
-/* ─────────────────────────────────────────────────────────────
-   presenceSelfEchoVerdict — the pure trigger for the account
-   supervisor's presence self-echo watchdog (2026-07-08 recurrence).
-
-   The failure it catches: the supervisor is alive, its claim is held
-   (claim_bridge is a plain HTTP RPC, so it stays healthy), children
-   serve rooms — yet an anonymous probe of tpacct shows ZERO presence
-   keys. After a `realtime CLOSED` blip the channel goes zombie and
-   channel.track() lands nowhere, forever. The claim watchdog
-   (claimLoopWedged) can't see this — the claim rides HTTP, not the
-   socket. The server's presence SYNC is the only proof: if OUR OWN
-   key is absent from acct.presenceState() while we're tracking and
-   hold the claim, the track never reached the server.
-
-   Given how long our key has been missing (now - selfEchoMissingSince),
-   escalate in two stages:
-     missing < graceMs                     → 'ok'      (normal; a fresh track takes a beat to echo)
-     graceMs ≤ missing < graceMs+respawnMs → 'recycle' (force a full realtime disconnect+reconnect)
-     missing ≥ graceMs + respawnMs         → 'respawn' (recycle didn't take → exit; supervisor reruns clean)
-
-   selfEchoMissingSince is 0/null whenever our key is present OR we're
-   not tracking; the caller stamps it the first tick the key goes
-   missing and clears it the first tick it returns. Extracted + exported
-   so the watchdog's trigger is unit-testable without a live socket
-   (mirrors claimLoopWedged). Deterministic in `now` — no Date.now here.
-   ───────────────────────────────────────────────────────────── */
-export function presenceSelfEchoVerdict({ tracking, selfEchoMissingSince, now, graceMs = 60_000, respawnMs = 90_000 }) {
-  if (!tracking || !selfEchoMissingSince) return 'ok'
-  const missingMs = now - selfEchoMissingSince
-  if (missingMs >= graceMs + respawnMs) return 'respawn'
-  if (missingMs >= graceMs) return 'recycle'
-  return 'ok'
-}
-
-// Turn the supervisor's raw account-channel observation into the state consumed by
-// presenceSelfEchoVerdict. A successful SUBSCRIBED callback is enough to start a
-// bounded startup grace period even when Supabase never sends the first presence
-// sync. Without that bound, `syncSeenAt === 0` disabled the watchdog forever: the
-// HTTP claim stayed healthy while account presence and every private pair bus were
-// dead, so a genuinely live partner room was reported as offline indefinitely.
-//
-// Once a sync has been seen, the original fail-safe still applies normally: a
-// present self key clears the episode; a missing key starts at the observation tick.
-export function presenceSelfEchoObservation({
-  tracking,
-  subscribedAt,
-  syncSeenAt,
-  present,
-  missingSince,
-  now,
-  graceMs = 60_000,
-  respawnMs = 90_000,
-}) {
-  if (!tracking || !subscribedAt) return { missingSince: 0, verdict: 'ok' }
-  if (syncSeenAt && present) return { missingSince: 0, verdict: 'ok' }
-  const nextMissingSince = missingSince || (syncSeenAt ? now : subscribedAt)
-  return {
-    missingSince: nextMissingSince,
-    verdict: presenceSelfEchoVerdict({
-      tracking,
-      selfEchoMissingSince: nextMissingSince,
-      now,
-      graceMs,
-      respawnMs,
-    }),
-  }
-}
+export function makeThrottledTrack(e,{minMs:n=5e3,onStatus:t=null}={}){let r=0,s=null,c=null;const i=async()=>{s=null,r=Date.now();const n=c;c=null;try{const r=await e.track(n);t?.(r??"ok")}catch{t?.("error")}};return e=>{c=e;const t=Date.now()-r;t>=n?(s&&clearTimeout(s),i()):s||(s=setTimeout(i,n-t))}}export function subscribeWithoutStartupDeadlock(e,n,{timeoutMs:t=15e3,setTimer:r=setTimeout,clearTimer:s=clearTimeout}={}){return e?.subscribe&&"function"==typeof n?new Promise(c=>{let i=!1;const o=(e,n)=>{i||(i=!0,s(a),c({connected:e,status:n}))},a=r(()=>o(!1,"STARTUP_TIMEOUT"),Math.max(1,Number(t)||1));e.subscribe(e=>{n(e),"SUBSCRIBED"===e?o(!0,e):"CLOSED"!==e&&"CHANNEL_ERROR"!==e&&"TIMED_OUT"!==e||o(!1,e)})}):Promise.resolve({connected:!1,status:"unavailable"})}export function recoveryBackoffMs(e,{baseMs:n=2e4,capMs:t=3e5}={}){const r=Math.max(0,Math.floor(Number(e)||0));return Math.min(Math.max(1,Number(t)||1),Math.max(1,Number(n)||1)*2**Math.min(r,10))}export function reducePresenceChannelEvidence(e={},n,t=Date.now()){const r={subscribedAt:Number(e.subscribedAt)||0,syncSeenAt:Number(e.syncSeenAt)||0};return"sync"===n?{...r,syncSeenAt:t}:"SUBSCRIBED"===n||"CLOSED"===n||"CHANNEL_ERROR"===n||"TIMED_OUT"===n?r.subscribedAt&&!r.syncSeenAt?r:{subscribedAt:t,syncSeenAt:0}:r}export function presenceRecoveryEligible({claimHeld:e,lastClaimOkAt:n,now:t,maxClaimSilenceMs:r=4e4}){return!!e&&Number.isFinite(n)&&t-n<r}export function presenceSelfEchoVerdict({tracking:e,selfEchoMissingSince:n,now:t,graceMs:r=6e4,respawnMs:s=9e4}){if(!e||!n)return"ok";const c=t-n;return c>=r+s?"respawn":c>=r?"recycle":"ok"}export function presenceSelfEchoObservation({tracking:e,subscribedAt:n,syncSeenAt:t,present:r,missingSince:s,now:c,graceMs:i=6e4,respawnMs:o=9e4}){if(!e||!n)return{missingSince:0,verdict:"ok"};if(t&&r)return{missingSince:0,verdict:"ok"};const a=s||(t?c:n);return{missingSince:a,verdict:presenceSelfEchoVerdict({tracking:e,selfEchoMissingSince:a,now:c,graceMs:i,respawnMs:o})}}

package/privacy-report.mjs

@@ -1,108 +1 @@
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-
-const cleanHost = (value) => {
-  try { return new URL(value).host } catch { return null }
-}
-
-const readJson = (file, fallback) => {
-  try { return JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return fallback }
-}
-
-const displayPath = (value, home) => {
-  const resolved = path.resolve(String(value || ''))
-  return resolved === home ? '~' : resolved.startsWith(`${home}${path.sep}`) ? `~${resolved.slice(home.length)}` : resolved
-}
-
-export function buildPrivacyReport({
-  home = os.homedir(),
-  cwd = process.cwd(),
-  env = process.env,
-  exists = fs.existsSync,
-  read = readJson,
-} = {}) {
-  const configDir = path.join(home, '.thinkpool-pair')
-  const dirs = read(path.join(configDir, 'dirs.json'), {}) || {}
-  const served = read(path.join(configDir, 'served.json'), {}) || {}
-  const providers = read(path.join(configDir, 'providers.json'), []) || []
-  const legacyProvider = read(path.join(configDir, 'provider.json'), null)
-  let defaultDir = ''
-  try { defaultDir = fs.readFileSync(path.join(configDir, 'default-dir'), 'utf8').trim() } catch { /* not configured */ }
-
-  const projectDirs = new Set([cwd, defaultDir, ...Object.values(dirs), ...Object.values(served)].filter(Boolean).map((p) => displayPath(p, home)))
-  const providerHosts = new Set([
-    ...providers.map((provider) => cleanHost(provider?.baseUrl)),
-    cleanHost(legacyProvider?.baseUrl),
-  ].filter(Boolean))
-  const supabaseHost = cleanHost(env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co')
-  const webHost = cleanHost(env.TP_WEB_BASE || 'https://thinkpool.io')
-
-  const localRecords = [
-    ['Saved login', 'auth.json', exists(path.join(configDir, 'auth.json')), 'refresh token and account identity'],
-    ['Provider registry', 'providers.json', exists(path.join(configDir, 'providers.json')), 'provider endpoint, model, and API key'],
-    ['Bridge keypair', 'bridge-key.json', exists(path.join(configDir, 'bridge-key.json')), 'private key used to open browser-sealed provider keys'],
-    ['Agent picker visibility', 'agent-visibility.json', exists(path.join(configDir, 'agent-visibility.json')), 'which installed runtimes are hidden from terminal pickers'],
-    ['Room directories', 'dirs.json / served.json', exists(path.join(configDir, 'dirs.json')) || exists(path.join(configDir, 'served.json')), 'room-to-project directory mappings'],
-    ['Bridge logs', 'update.log and service logs', exists(path.join(configDir, 'update.log')), 'update and background-service diagnostics'],
-  ]
-
-  return {
-    generatedAt: new Date().toISOString(),
-    configDir: displayPath(configDir, home),
-    projectDirs: [...projectDirs].sort(),
-    localRecords,
-    outbound: [
-      [webHost, 'Thinkpool configuration, linking, version checks, and product APIs'],
-      [supabaseHost, 'authentication, room database, storage, and realtime transport'],
-      ['registry.npmjs.org', 'package installation and updates initiated with npm or npx'],
-      ...[...providerHosts].sort().map((host) => [host, 'AI provider selected on this bridge']),
-    ].filter(([host]) => host),
-    remote: [
-      ['Thinkpool cloud receives', 'account/profile data; room membership and metadata; room chat; cleaned terminal output; terminal and room events; attachments; operational request metadata'],
-      ['Thinkpool cloud does not receive as a repository', 'a crawled copy of the project directory or repository file tree'],
-      ['Readable provider key', 'stored locally by the bridge; Thinkpool relays only a browser-sealed envelope'],
-      ['AI prompts and code context', 'sent by the local coding agent to the selected AI provider; content depends on that runtime and the task'],
-    ],
-    limits: [
-      'Coding-agent runtimes and commands can contact domains beyond the bridge list above.',
-      'Thinkpool room transcripts are readable by Thinkpool infrastructure today; they are not end-to-end encrypted.',
-      'This report describes configured access. It is not a packet capture or a guarantee that a third-party agent obeys the same boundary.',
-    ],
-  }
-}
-
-export function formatPrivacyReport(report) {
-  const yn = (value) => value ? 'present' : 'not present'
-  const lines = [
-    '',
-    '  THINKPOOL PRIVACY REPORT',
-    `  generated ${report.generatedAt}`,
-    '',
-    '  LOCAL ACCESS',
-    `  Bridge configuration: ${report.configDir}`,
-    ...report.projectDirs.map((dir) => `  Project directory:     ${dir}`),
-    '',
-    '  LOCAL RECORDS',
-    ...report.localRecords.map(([label, file, present, contains]) => `  ${label}: ${yn(present)} (${file})\n    contains: ${contains}`),
-    '',
-    '  OUTBOUND DOMAINS',
-    ...report.outbound.map(([host, reason]) => `  ${host}\n    ${reason}`),
-    '',
-    '  REMOTE DATA',
-    ...report.remote.map(([label, detail]) => `  ${label}:\n    ${detail}`),
-    '',
-    '  IMPORTANT LIMITS',
-    ...report.limits.map((line) => `  - ${line}`),
-    '',
-    '  Full data map: https://thinkpool.io/data',
-    '',
-  ]
-  return lines.join('\n')
-}
-
-export function runPrivacyReport(options) {
-  const report = buildPrivacyReport(options)
-  process.stdout.write(formatPrivacyReport(report))
-  return report
-}
+import e from"node:fs";import o from"node:os";import t from"node:path";const r=e=>{try{return new URL(e).host}catch{return null}},n=(o,t)=>{try{return JSON.parse(e.readFileSync(o,"utf8"))}catch{return t}},i=(e,o)=>{const r=t.resolve(String(e||""));return r===o?"~":r.startsWith(`${o}${t.sep}`)?`~${r.slice(o.length)}`:r};export function buildPrivacyReport({home:a=o.homedir(),cwd:s=process.cwd(),env:d=process.env,exists:c=e.existsSync,read:p=n}={}){const l=t.join(a,".thinkpool-pair"),u=p(t.join(l,"dirs.json"),{})||{},m=p(t.join(l,"served.json"),{})||{},h=p(t.join(l,"providers.json"),[])||[],y=p(t.join(l,"provider.json"),null);let g="";try{g=e.readFileSync(t.join(l,"default-dir"),"utf8").trim()}catch{}const j=new Set([s,g,...Object.values(u),...Object.values(m)].filter(Boolean).map(e=>i(e,a))),v=new Set([...h.map(e=>r(e?.baseUrl)),r(y?.baseUrl)].filter(Boolean)),b=r(d.TP_SUPABASE_URL||"https://daytvtakmlixpfbbqzjd.supabase.co"),f=r(d.TP_WEB_BASE||"https://thinkpool.io"),k=[["Saved login","auth.json",c(t.join(l,"auth.json")),"refresh token and account identity"],["Provider registry","providers.json",c(t.join(l,"providers.json")),"provider endpoint, model, and API key"],["Bridge keypair","bridge-key.json",c(t.join(l,"bridge-key.json")),"private key used to open browser-sealed provider keys"],["Agent picker visibility","agent-visibility.json",c(t.join(l,"agent-visibility.json")),"which installed runtimes are hidden from terminal pickers"],["Room directories","dirs.json / served.json",c(t.join(l,"dirs.json"))||c(t.join(l,"served.json")),"room-to-project directory mappings"],["Bridge logs","update.log and service logs",c(t.join(l,"update.log")),"update and background-service diagnostics"]];return{generatedAt:(new Date).toISOString(),configDir:i(l,a),projectDirs:[...j].sort(),localRecords:k,outbound:[[f,"Thinkpool configuration, linking, version checks, and product APIs"],[b,"authentication, room database, storage, and realtime transport"],["registry.npmjs.org","package installation and updates initiated with npm or npx"],...[...v].sort().map(e=>[e,"AI provider selected on this bridge"])].filter(([e])=>e),remote:[["Thinkpool cloud receives","account/profile data; room membership and metadata; room chat; cleaned terminal output; terminal and room events; attachments; operational request metadata"],["Thinkpool cloud does not receive as a repository","a crawled copy of the project directory or repository file tree"],["Readable provider key","stored locally by the bridge; Thinkpool relays only a browser-sealed envelope"],["AI prompts and code context","sent by the local coding agent to the selected AI provider; content depends on that runtime and the task"]],limits:["Coding-agent runtimes and commands can contact domains beyond the bridge list above.","Thinkpool room transcripts are readable by Thinkpool infrastructure today; they are not end-to-end encrypted.","This report describes configured access. It is not a packet capture or a guarantee that a third-party agent obeys the same boundary."]}}export function formatPrivacyReport(e){return["","  THINKPOOL PRIVACY REPORT",`  generated ${e.generatedAt}`,"","  LOCAL ACCESS",`  Bridge configuration: ${e.configDir}`,...e.projectDirs.map(e=>`  Project directory:     ${e}`),"","  LOCAL RECORDS",...e.localRecords.map(([e,o,t,r])=>{return`  ${e}: ${n=t,n?"present":"not present"} (${o})\n    contains: ${r}`;var n}),"","  OUTBOUND DOMAINS",...e.outbound.map(([e,o])=>`  ${e}\n    ${o}`),"","  REMOTE DATA",...e.remote.map(([e,o])=>`  ${e}:\n    ${o}`),"","  IMPORTANT LIMITS",...e.limits.map(e=>`  - ${e}`),"","  Full data map: https://thinkpool.io/data",""].join("\n")}export function runPrivacyReport(e){const o=buildPrivacyReport(e);return process.stdout.write(formatPrivacyReport(o)),o}