thinkpool-pair 0.7.364 → 0.7.366

package/supabase-key.mjs

@@ -1,176 +1 @@
-/* supabase-key.mjs — resolve the bridge's client-safe Supabase key at RUNTIME.
-
-   THE PROBLEM THIS SOLVES (docs/specs/2026-07-10-supabase-key-migration.md §5.1)
-
-   `bridge.mjs` used to carry the legacy anon key as a string literal:
-
-       const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGci…'
-
-   and 224 published `thinkpool-pair` versions shipped with it. The comment above
-   it said "safe to embed" — true about CONFIDENTIALITY (the web bundle ships the
-   same value), silent about LIFECYCLE. Disable that key in the Supabase dashboard
-   and every installed bridge, on every user's laptop, dies at the same instant —
-   and no server-side change repairs it, because Vercel env vars do not reach a
-   program running on someone else's machine. It is the one failure in the repo
-   our deploy pipeline cannot fix.
-
-   THE FIX. The key becomes a value the SERVER controls. The bridge asks
-   thinkpool.io for it at boot, caches it on disk, and keeps the literal only as
-   a last resort. A rotation then repairs itself for bridges that never update.
-
-   RESOLUTION ORDER — each step exists for a reason:
-
-     1 env        TP_SUPABASE_ANON — the operator's explicit override. Always wins.
-     2 cache      A fresh (< TTL) on-disk record. Keeps boot fast and works offline.
-     3 network    GET {WEB_BASE}/api/config. The rotation-repair path.
-     4 stale      An expired cache beats the literal: it is strictly newer.
-     5 baked      The legacy literal. First-ever boot with no network. Never fails.
-
-   TWO INVARIANTS, both tested in supabase-key.test.mjs:
-
-     · A service-shaped key is NEVER adopted, from any source. The network is an
-       input we do not control; a compromised or misconfigured config surface
-       must not be able to hand a user's laptop an RLS-bypassing client.
-     · No key material is ever logged. We log the SOURCE and the SHAPE. (C16.) */
-
-import os from 'node:os'
-import fs from 'node:fs'
-import path from 'node:path'
-import { classifyKey, isClientSafeKey } from './key-shape.mjs'
-
-export { classifyKey, isClientSafeKey }
-
-/* The legacy anon key. Public by design (the web bundle ships it), but now a
-   FALLBACK rather than the source of truth. Do not add new readers. */
-export const BAKED_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
-
-export const DEFAULT_SUPABASE_URL = 'https://daytvtakmlixpfbbqzjd.supabase.co'
-export const DEFAULT_WEB_BASE = 'https://thinkpool.io'
-
-const CACHE_FILE = path.join(os.homedir(), '.thinkpool-pair', 'supabase-key.json')
-const CACHE_TTL_MS = 6 * 60 * 60 * 1000 // 6h — a rotation reaches a rebooting bridge same-day
-const FETCH_TIMEOUT_MS = 2000            // boot latency budget; the literal is right there
-
-// ── the on-disk cache ──────────────────────────────────────────────────────
-// Sits beside auth.json / dirs.json / served.json in ~/.thinkpool-pair.
-// Contains no secret (a publishable key), so no chmod dance — unlike auth.json.
-export function readCacheFile() {
-  try {
-    const rec = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf8'))
-    if (!rec || typeof rec.key !== 'string' || typeof rec.url !== 'string') return null
-    return { key: rec.key, url: rec.url, at: Number(rec.at) || 0 }
-  } catch { return null }
-}
-
-export function writeCacheFile(rec) {
-  // Atomic, for the same reason auth-store.mjs is: a kill mid-write must never
-  // leave a truncated file that reads as "no cache" — or worse, as half a key.
-  try {
-    fs.mkdirSync(path.dirname(CACHE_FILE), { recursive: true })
-    const tmp = `${CACHE_FILE}.${process.pid}.tmp`
-    fs.writeFileSync(tmp, JSON.stringify(rec))
-    fs.renameSync(tmp, CACHE_FILE)
-  } catch { /* a cache we cannot write is a cache we do without */ }
-}
-
-// ── the network step ───────────────────────────────────────────────────────
-// Returns a validated client-safe key, or null. NEVER throws: a bridge must
-// boot on a train. Never logs the value.
-async function fetchConfigKey({ webBase, supabaseUrl, fetchImpl, timeoutMs, log }) {
-  const ac = new AbortController()
-  const timer = setTimeout(() => ac.abort(), timeoutMs)
-  try {
-    const r = await fetchImpl(`${webBase}/api/config`, {
-      signal: ac.signal,
-      headers: { accept: 'application/json' },
-    })
-    if (!r || !r.ok) { log(`config: HTTP ${r?.status ?? '?'} — keeping current key`); return null }
-
-    // Until this endpoint is deployed, the SPA catch-all answers /api/config with
-    // 200 + index.html. That must read as "no config", not as a network outage —
-    // every bridge in the wild takes this path on the day before the deploy.
-    let body
-    try { body = await r.json() }
-    catch { log('config: response was not JSON (endpoint not deployed?) — keeping current key'); return null }
-
-    const key = body?.supabaseAnonKey
-
-    // The served key must be for OUR project. A config surface pointing at a
-    // different Supabase project would authenticate against the wrong database.
-    if (body?.supabaseUrl && body.supabaseUrl !== supabaseUrl) {
-      log('config: served a key for a different project — refused')
-      return null
-    }
-    // The invariant. A service-shaped key from the network is never adopted.
-    if (!isClientSafeKey(key)) {
-      log(`config: served a ${classifyKey(key)} key — refused`)
-      return null
-    }
-    return key
-  } catch (e) {
-    log(`config: unreachable (${e.name === 'AbortError' ? 'timeout' : 'network'}) — keeping current key`)
-    return null
-  } finally { clearTimeout(timer) }
-}
-
-// ── the resolver ───────────────────────────────────────────────────────────
-/**
- * @returns {Promise<{key: string, source: 'env'|'cache'|'network'|'stale-cache'|'baked'}>}
- * @throws if TP_SUPABASE_ANON is set to something that is not client-safe.
- */
-export async function resolveAnonKey(opts = {}) {
-  const {
-    env = process.env,
-    supabaseUrl = env.TP_SUPABASE_URL || DEFAULT_SUPABASE_URL,
-    webBase = env.TP_WEB_BASE || DEFAULT_WEB_BASE,
-    fetchImpl = globalThis.fetch,
-    readCache = readCacheFile,
-    writeCache = writeCacheFile,
-    now = Date.now,
-    ttlMs = CACHE_TTL_MS,
-    timeoutMs = FETCH_TIMEOUT_MS,
-    log = () => {},
-  } = opts
-
-  // 1 · env — the operator said so. But an operator who exports a SECRET key
-  //     here would silently run an RLS-bypassing bridge, so this one throws
-  //     rather than falling through: a wrong explicit answer is worse than none.
-  const fromEnv = String(env.TP_SUPABASE_ANON || '').trim()
-  if (fromEnv) {
-    if (!isClientSafeKey(fromEnv)) {
-      throw new Error(
-        `TP_SUPABASE_ANON is not a client-safe key (looks like: ${classifyKey(fromEnv)}). ` +
-        'Use the project\'s publishable/anon key — never a secret or service_role key.',
-      )
-    }
-    log('key: source=env')
-    return { key: fromEnv, source: 'env' }
-  }
-
-  const cached = readCache()
-  const cacheUsable = !!cached && cached.url === supabaseUrl && isClientSafeKey(cached.key)
-
-  // 2 · a fresh cache — skip the network entirely
-  if (cacheUsable && (now() - cached.at) < ttlMs) {
-    log('key: source=cache')
-    return { key: cached.key, source: 'cache' }
-  }
-
-  // 3 · the network — the whole point of this module
-  const fetched = await fetchConfigKey({ webBase, supabaseUrl, fetchImpl, timeoutMs, log })
-  if (fetched) {
-    writeCache({ key: fetched, url: supabaseUrl, at: now() })
-    log(`key: source=network shape=${classifyKey(fetched)}`)
-    return { key: fetched, source: 'network' }
-  }
-
-  // 4 · a stale cache still beats the literal — it is strictly more recent
-  if (cacheUsable) {
-    log('key: source=stale-cache')
-    return { key: cached.key, source: 'stale-cache' }
-  }
-
-  // 5 · the literal. Offline first boot. Always works, until the day it doesn't.
-  log('key: source=baked')
-  return { key: BAKED_ANON_KEY, source: 'baked' }
-}
+import e from"node:os";import r from"node:fs";import t from"node:path";import{classifyKey as o,isClientSafeKey as n}from"./key-shape.mjs";export{o as classifyKey,n as isClientSafeKey};export const BAKED_ANON_KEY="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo";export const DEFAULT_SUPABASE_URL="https://daytvtakmlixpfbbqzjd.supabase.co";export const DEFAULT_WEB_BASE="https://thinkpool.io";const s=t.join(e.homedir(),".thinkpool-pair","supabase-key.json"),a=216e5,c=2e3;export function readCacheFile(){try{const e=JSON.parse(r.readFileSync(s,"utf8"));return e&&"string"==typeof e.key&&"string"==typeof e.url?{key:e.key,url:e.url,at:Number(e.at)||0}:null}catch{return null}}export function writeCacheFile(e){try{r.mkdirSync(t.dirname(s),{recursive:!0});const o=`${s}.${process.pid}.tmp`;r.writeFileSync(o,JSON.stringify(e)),r.renameSync(o,s)}catch{}}export async function resolveAnonKey(e={}){const{env:r=process.env,supabaseUrl:t=r.TP_SUPABASE_URL||DEFAULT_SUPABASE_URL,webBase:s=r.TP_WEB_BASE||DEFAULT_WEB_BASE,fetchImpl:i=globalThis.fetch,readCache:l=readCacheFile,writeCache:u=writeCacheFile,now:p=Date.now,ttlMs:y=a,timeoutMs:k=c,log:h=()=>{}}=e,m=String(r.TP_SUPABASE_ANON||"").trim();if(m){if(!n(m))throw new Error(`TP_SUPABASE_ANON is not a client-safe key (looks like: ${o(m)}). Use the project's publishable/anon key — never a secret or service_role key.`);return h("key: source=env"),{key:m,source:"env"}}const f=l(),A=!!f&&f.url===t&&n(f.key);if(A&&p()-f.at<y)return h("key: source=cache"),{key:f.key,source:"cache"};const b=await async function({webBase:e,supabaseUrl:r,fetchImpl:t,timeoutMs:s,log:a}){const c=new AbortController,i=setTimeout(()=>c.abort(),s);try{const s=await t(`${e}/api/config`,{signal:c.signal,headers:{accept:"application/json"}});if(!s||!s.ok)return a(`config: HTTP ${s?.status??"?"} — keeping current key`),null;let i;try{i=await s.json()}catch{return a("config: response was not JSON (endpoint not deployed?) — keeping current key"),null}const l=i?.supabaseAnonKey;return i?.supabaseUrl&&i.supabaseUrl!==r?(a("config: served a key for a different project — refused"),null):n(l)?l:(a(`config: served a ${o(l)} key — refused`),null)}catch(e){return a(`config: unreachable (${"AbortError"===e.name?"timeout":"network"}) — keeping current key`),null}finally{clearTimeout(i)}}({webBase:s,supabaseUrl:t,fetchImpl:i,timeoutMs:k,log:h});return b?(u({key:b,url:t,at:p()}),h(`key: source=network shape=${o(b)}`),{key:b,source:"network"}):A?(h("key: source=stale-cache"),{key:f.key,source:"stale-cache"}):(h("key: source=baked"),{key:BAKED_ANON_KEY,source:"baked"})}

package/supervisor-ready.mjs

@@ -1,57 +1 @@
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-
-export const ACCOUNT_READY_FILE = path.join(os.homedir(), '.thinkpool-pair', 'account-ready.json')
-
-export function readSupervisorReady(file = ACCOUNT_READY_FILE, { fsMod = fs } = {}) {
-  try {
-    const value = JSON.parse(fsMod.readFileSync(file, 'utf8'))
-    if (!value || typeof value !== 'object') return null
-    return value
-  } catch { return null }
-}
-
-export function supervisorReadyMatches(receipt, live, version, { notBefore = 0 } = {}) {
-  return !!receipt && !!live?.pid &&
-    String(receipt.pid) === String(live.pid) &&
-    receipt.version === version &&
-    typeof receipt.bridgeId === 'string' && receipt.bridgeId.length > 0 &&
-    Number.isFinite(receipt.readyAt) && receipt.readyAt >= notBefore
-}
-
-// Supabase presence is keyed by hostname, so the key can outlive a crashed
-// process briefly. Require the unique process bridgeId inside the echoed metas;
-// hostname existence alone can certify the previous supervisor's stale presence.
-export function supervisorPresenceEchoed(state, machine, bridgeId, version) {
-  if (!state || typeof state !== 'object' || typeof machine !== 'string' || !machine || typeof bridgeId !== 'string' || !bridgeId) return false
-  const metas = Array.isArray(state[machine]) ? state[machine] : []
-  return metas.some((meta) => meta?.bridgeId === bridgeId && meta?.version === version)
-}
-
-export function writeSupervisorReady({ pid = process.pid, version, bridgeId, readyAt = Date.now() }, file = ACCOUNT_READY_FILE, { fsMod = fs } = {}) {
-  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0 || typeof version !== 'string' || !version || typeof bridgeId !== 'string' || !bridgeId) return false
-  const tmp = `${file}.tmp.${process.pid}.${Date.now()}`
-  try {
-    fsMod.mkdirSync(path.dirname(file), { recursive: true })
-    fsMod.writeFileSync(tmp, `${JSON.stringify({ pid: Number(pid), version, bridgeId, readyAt })}\n`, { mode: 0o600 })
-    fsMod.renameSync(tmp, file)
-    return true
-  } catch {
-    try { fsMod.rmSync(tmp, { force: true }) } catch { /* noop */ }
-    return false
-  }
-}
-
-// Remove an owned receipt on shutdown. With no pid, clear stale startup evidence
-// after this process has acquired the singleton lock and therefore owns account mode.
-export function clearSupervisorReady({ pid = null, file = ACCOUNT_READY_FILE, fsMod = fs } = {}) {
-  try {
-    if (pid !== null) {
-      const receipt = readSupervisorReady(file, { fsMod })
-      if (!receipt || String(receipt.pid) !== String(pid)) return false
-    }
-    fsMod.rmSync(file, { force: true })
-    return true
-  } catch { return false }
-}
+import r from"node:fs";import e from"node:os";import t from"node:path";export const ACCOUNT_READY_FILE=t.join(e.homedir(),".thinkpool-pair","account-ready.json");export function readSupervisorReady(e=ACCOUNT_READY_FILE,{fsMod:t=r}={}){try{const r=JSON.parse(t.readFileSync(e,"utf8"));return r&&"object"==typeof r?r:null}catch{return null}}export function supervisorReadyMatches(r,e,t,{notBefore:n=0}={}){return!!r&&!!e?.pid&&String(r.pid)===String(e.pid)&&r.version===t&&"string"==typeof r.bridgeId&&r.bridgeId.length>0&&Number.isFinite(r.readyAt)&&r.readyAt>=n}export function supervisorPresenceEchoed(r,e,t,n){return!!(r&&"object"==typeof r&&"string"==typeof e&&e&&"string"==typeof t&&t)&&(Array.isArray(r[e])?r[e]:[]).some(r=>r?.bridgeId===t&&r?.version===n)}export function writeSupervisorReady({pid:e=process.pid,version:n,bridgeId:o,readyAt:i=Date.now()},d=ACCOUNT_READY_FILE,{fsMod:s=r}={}){if(!Number.isInteger(Number(e))||Number(e)<=0||"string"!=typeof n||!n||"string"!=typeof o||!o)return!1;const p=`${d}.tmp.${process.pid}.${Date.now()}`;try{return s.mkdirSync(t.dirname(d),{recursive:!0}),s.writeFileSync(p,`${JSON.stringify({pid:Number(e),version:n,bridgeId:o,readyAt:i})}\n`,{mode:384}),s.renameSync(p,d),!0}catch{try{s.rmSync(p,{force:!0})}catch{}return!1}}export function clearSupervisorReady({pid:e=null,file:t=ACCOUNT_READY_FILE,fsMod:n=r}={}){try{if(null!==e){const r=readSupervisorReady(t,{fsMod:n});if(!r||String(r.pid)!==String(e))return!1}return n.rmSync(t,{force:!0}),!0}catch{return!1}}

package/switch-provider.mjs

@@ -1,84 +1 @@
-/* ─────────────────────────────────────────────────────────────
-   switch-provider.mjs — validation for the per-lane provider-switch
-   wire request (`provider-switch` on the room channel).
-
-   The bridge handler (bridge.mjs) owns AUTH (supabase.getUser + room
-   participation) and the actual RESPAWN (teardown-without-reap +
-   reopen under the same terminal id with the new provider env). This
-   module owns the decidable part — pure, no bridge state, no supabase —
-   so the validation branches are unit-testable in isolation:
-
-     V1  missing provider id            → ok:false error:'missing provider'
-     V2  unknown id (not registered)    → ok:false error:'unknown provider'
-     V3  valid + actually changes       → ok:true  noop:false
-     V4  valid but same as current      → ok:true  noop:true  (UI guarantees a
-                                          change, but we stay correct + idempotent
-                                          if it ever sends a no-op)
-
-   The built-in Anthropic path is internally `provider: null` (omitted on
-   the announce), but the wire sends the literal `'anthropic'`. Both mean
-   the default Claude env, so `null` ↔ `'anthropic'` is a SAME-provider
-   (no-op) switch. resolveProviderEnv (providers.mjs) treats them the same.
-
-   Spec: docs/specs/2026-07-05-provider-switch.md (wire contract LOCKED;
-   this module must NOT change the request/reply field names or shapes).
-   ───────────────────────────────────────────────────────────── */
-
-export const BUILTIN_PROVIDER = 'anthropic'
-
-/**
- * Normalize a provider id so the built-in default (`null`, undefined, or the
- * literal 'anthropic') collapses to a single canonical value. Used by the
- * no-op check: switching a lane whose current provider is null (the default
- * path) to 'anthropic' is NOT a real change.
- * @param {string|null|undefined} p
- * @returns {string}
- */
-export function effectiveProvider(p) {
-  return (!p || p === BUILTIN_PROVIDER) ? BUILTIN_PROVIDER : String(p)
-}
-
-/**
- * Validate a provider-switch request's provider field.
- *
- * @param {{provider: string, currentProvider?: string|null, registeredIds?: string[]}} input
- * @returns {{ok: true, noop: boolean} | {ok: false, error: string}}
- */
-export function validateProviderSwitch({ provider, currentProvider, registeredIds }) {
-  const id = String(provider ?? '').trim()
-  if (!id) return { ok: false, error: 'missing provider' }
-
-  const known = id === BUILTIN_PROVIDER ||
-    (Array.isArray(registeredIds) && registeredIds.includes(id))
-  if (!known) return { ok: false, error: 'unknown provider' }
-
-  const noop = effectiveProvider(id) === effectiveProvider(currentProvider)
-  return { ok: true, noop }
-}
-
-/**
- * WHAT KIND of switch is this? The pure half of the provider-switch handler, so the
- * three-way choice is testable without booting a bridge (Max, 2026-07-09).
- *
- *   'noop'     — same provider; nothing to do.
- *   'in-place' — a different registry row on the SAME endpoint + key (two models on
- *                one z.ai account). Only ANTHROPIC_MODEL differs, so the live session
- *                just setModel()s and KEEPS ITS CONTEXT. Requires a model to switch to.
- *   'respawn'  — a genuinely different endpoint or key. Fresh agent, transcript kept,
- *                recap carried. This is the only case that costs the user their context.
- *
- * `sameEnv` is supplied by the caller (providers.mjs `sameProviderEnv`) rather than
- * imported, so this module stays free of registry/disk state — the whole point of it.
- * A same-env target with NO configured model falls back to 'respawn': openStructured
- * would then seed the model from the target's env, which an in-place setModel cannot do.
- *
- * @param {{provider:string, currentProvider?:string|null, sameEnv:boolean, targetModel?:string|null}} input
- * @returns {{action:'noop'|'in-place'|'respawn', restarted:boolean}}
- */
-export function providerSwitchPlan({ provider, currentProvider, sameEnv, targetModel }) {
-  if (effectiveProvider(provider) === effectiveProvider(currentProvider)) {
-    return { action: 'noop', restarted: false }
-  }
-  if (sameEnv && targetModel) return { action: 'in-place', restarted: false }
-  return { action: 'respawn', restarted: true }
-}
+export const BUILTIN_PROVIDER="anthropic";export function effectiveProvider(r){return r&&"anthropic"!==r?String(r):"anthropic"}export function validateProviderSwitch({provider:r,currentProvider:e,registeredIds:t}){const i=String(r??"").trim();return i?"anthropic"===i||Array.isArray(t)&&t.includes(i)?{ok:!0,noop:effectiveProvider(i)===effectiveProvider(e)}:{ok:!1,error:"unknown provider"}:{ok:!1,error:"missing provider"}}export function providerSwitchPlan({provider:r,currentProvider:e,sameEnv:t,targetModel:i}){return effectiveProvider(r)===effectiveProvider(e)?{action:"noop",restarted:!1}:t&&i?{action:"in-place",restarted:!1}:{action:"respawn",restarted:!0}}