thinkpool-pair 0.7.54 → 0.7.56

package/account.mjs

@@ -186,6 +186,9 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
   const { sb, session } = auth
   const email = session.user?.email || 'your account'
+  // Current owner JWT, handed to each room-bridge child for authed web writes
+  // (code-mockup, whip L16). Refreshed below; pushed to live children on rotation.
+  let currentAccessToken = session.access_token || null
 
   // Owner-gate (Contract C-CODE-2): hosting a code session — spawning the agent and
   // burning compute on this machine — requires Pro or Enterprise. This is the layer
@@ -253,7 +256,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const keepFresh = scheduleTokenRefresh({
     sb,
     session,
-    onRefreshed: (s) => { saveAuth(s); pushPresence() },
+    onRefreshed: (s) => {
+      saveAuth(s); pushPresence()
+      // Push the rotated owner token to every live child so their authed writes
+      // (code-mockup) never go stale on a long session (whip L16).
+      currentAccessToken = s.access_token || currentAccessToken
+      for (const c of children.values()) { try { c.send({ t: 'token', accessToken: currentAccessToken }) } catch { /* child not ready */ } }
+    },
     forceMs: parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS, 10) || 0,
   })
 
@@ -287,6 +296,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // can't make a child self-exit; flag it as an account child instead.
       const env = { ...process.env, THINKPOOL_PAIR_ACCOUNT_CHILD: '1' }
       delete env.THINKPOOL_PAIR_AUTOUPDATE
+      // Hand the child the owner JWT for authed web writes (code-mockup, L16).
+      if (currentAccessToken) env.TP_ACCESS_TOKEN = currentAccessToken
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child

package/bridge.mjs

@@ -47,6 +47,14 @@ const SUPABASE_URL  = process.env.TP_SUPABASE_URL  || 'https://daytvtakmlixpfbbq
 const WEB_BASE      = process.env.TP_WEB_BASE      || 'https://thinkpool.io'
 const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
 
+// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).
+// The room-bridge is anon by design; the account supervisor (account.mjs) owns the
+// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes
+// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a
+// directly-started bridge with no account login — those writes go unattributed,
+// never owner-spoofed (the server treats a missing/!owner token accordingly).
+let codeAuthToken = process.env.TP_ACCESS_TOKEN || null
+
 // Per-terminal rolling scrollback (raw chars). Replayed to joining clients.
 // Kept comfortably under realtime payload limits once base64'd.
 const SCROLLBACK_MAX = 120_000
@@ -518,9 +526,14 @@ const handleManifest = async (box, file, term) => {
   const readTxt = (p) => { try { return p && fs.readFileSync(p, 'utf8') } catch { return null } }
   const cid = randomUUID()
   try {
+    const mockupHeaders = { 'Content-Type': 'application/json' }
+    // Authenticate as the owner so the server can attribute the persisted row to a
+    // verified user instead of trusting "knows the code" (whip L16). Omitted when
+    // we have no token (direct bridge, no login) → server persists it unattributed.
+    if (codeAuthToken) mockupHeaders.Authorization = `Bearer ${codeAuthToken}`
     const res = await fetch(`${WEB_BASE}/api/code-mockup`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: mockupHeaders,
       body: JSON.stringify({
         code: room, slug: m.slug, title: m.title, cid, ts: m.ts, term,
         desktopPng: readB64(m.desktop), mobilePng: readB64(m.mobile), html: readTxt(m.html),
@@ -1206,7 +1219,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   // Contract #1) + `idle` (the quiet window, for the unattended fallback) + whether a
   // web peer is present, so the supervisor restarts on an explicit click between turns
   // and otherwise waits for true idle with nobody watching (Slice 3).
-  process.on('message', (m) => { if (m && m.t === 'update-available') surfaceUpdate(m.version) })
+  process.on('message', (m) => {
+    if (!m) return
+    if (m.t === 'update-available') surfaceUpdate(m.version)
+    // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
+    // it so our authed writes (code-mockup) never go stale on a long session (L16).
+    else if (m.t === 'token') codeAuthToken = m.accessToken || null
+  })
   setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but

package/claude-session.mjs

@@ -177,6 +177,16 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // the catch self-heals.
   const FORCE_STOP_MS = Math.max(STALL_MS * 3, parseInt(process.env.TP_FORCE_STOP_MS, 10) || 300000)
   let forceStopped = false
+  // ── Haiku suggestion fallback ──
+  // Claude Code's own `prompt_suggestion` rarely fires in /code — the binary suppresses it
+  // per-turn (cache_cold when a turn's tokens > 10k, rate_limit when throttled, first turn).
+  // When it doesn't arrive shortly after `result`, we generate one ourselves with a cheap
+  // one-shot Haiku call on the SAME subscription auth (no API key), fed ONLY the last
+  // assistant reply (suggestions are short: "proceed" / "go with A") — fast + ~free.
+  let sawSuggestion = false       // did Claude's own prompt_suggestion fire this turn?
+  let lastAssistantText = ''      // most recent assistant prose — the only context the fallback needs
+  let sugTimer = null             // pending fallback timer
+  const SUGGEST_FALLBACK_MS = Math.max(1200, parseInt(process.env.TP_SUGGEST_FALLBACK_MS, 10) || 2500)
 
   const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
   const stallTimer = setInterval(() => {
@@ -362,16 +372,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // Anthropic flips on/off during rollout — so the ghost-text chip silently died
   // mid-day with NO change on our side. CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION is the
   // documented override. opts.env REPLACES the child env, so spread the inherited one.
-  opts.env = { ...(env || process.env), CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION: 'true' }
-  // …but the env override only flips the FEATURE GATE. The SDK forwards
-  // `promptSuggestions` solely into the control-init payload — it NEVER adds the
-  // `--prompt-suggestions` CLI flag the binary actually requires to generate a
-  // suggestion per turn (verified live: the spawned `claude` argv never carried it,
-  // and only `rate_limit_event` ever reached the bridge — no prompt_suggestion). Force
-  // it via extraArgs, which the SDK appends to argv as `--prompt-suggestions true`.
-  // Safe in SDK stream-json mode: the sibling `--include-partial-messages` flag carries
-  // the identical "requires --print/stream-json" rule and already runs here. (2026-06-22)
-  opts.extraArgs = { ...(opts.extraArgs || {}), 'prompt-suggestions': 'true' }
+  opts.env = { ...(env || process.env), CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION: '1' }
 
   // Before the SDK replays this transcript, heal any cross-provider tool blocks
   // it left behind (e.g. a room that ran on Z.ai GLM, now back on anthropic).
@@ -383,6 +384,44 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} cross-provider tool block(s) in the transcript before resume.\n`)
   }
 
+  // One-shot Haiku fallback suggestion. Runs on the SAME subscription auth as the room
+  // (opts.env carries the OAuth — no API key needed), but as a BARE model call: no
+  // settingSources, no MCP, no tools — so it's a fast cold call, not a full session boot.
+  // Fed only `lastAssistantText` (trimmed). Never blocks a turn; any failure is silent.
+  const haikuSuggest = async () => {
+    const seed = (lastAssistantText || '').trim().slice(-1500)
+    if (!seed || closed) return
+    const ac2 = new AbortController()
+    const t = setTimeout(() => { try { ac2.abort() } catch { /* noop */ } }, 8000)
+    try {
+      const hq = query({
+        prompt: `You are predicting the user's NEXT chat message in a live coding session, to prefill their composer. Given the assistant's latest reply below, output the single most likely next user message — short and natural (often just "proceed", "go with option A", "yes do that", or a brief follow-up). One line, <=12 words, imperative, no preamble, no quotes, no markdown.\n\nAssistant's latest reply:\n"""\n${seed}\n"""\n\nNext user message:`,
+        options: {
+          model: 'claude-haiku-4-5',
+          ...(cwd ? { cwd } : {}),
+          env: opts.env,
+          maxTurns: 1,
+          permissionMode: 'bypassPermissions',
+          settingSources: [],          // no CLAUDE.md / commands / agents — raw call
+          strictMcpConfig: true,
+          mcpServers: {},              // no MCP servers — fast cold start
+          abortController: ac2,
+        },
+      })
+      let out = ''
+      for await (const mm of hq) {
+        if (mm.type === 'assistant') for (const b of (mm.message?.content || [])) if (b.type === 'text') out += b.text
+        if (mm.type === 'result') break
+      }
+      out = out.trim().split('\n')[0].replace(/^["'`]+|["'`]+$/g, '').trim().slice(0, 140)
+      if (out && !sawSuggestion && !closed && !/^(sure|of course|certainly|let me know|i can help|happy to)\b/i.test(out)) {
+        emit({ kind: 'suggestion', text: out, source: 'haiku' })
+        process.stderr.write(`  ◆ [suggestion] haiku fallback: ${JSON.stringify(out)}\n`)
+      }
+    } catch { /* fallback failed (rate limit / abort / model error) — silent */ }
+    finally { clearTimeout(t) }
+  }
+
   const runQuery = async () => {
     try {
       q = query({ prompt: input.stream, options: { ...opts, ...(sessionId ? { resume: sessionId } : {}) } })
@@ -430,6 +469,8 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             // parentToolUseId: non-null when this assistant message comes from a
             // sub-agent (Task tool) — the universal nesting spine. Thread it so the
             // room can group sub-agent activity under its parent Task card.
+            // Capture the latest assistant prose — the only context the Haiku fallback needs.
+            { const txt = (m.message?.content || []).filter((b) => b?.type === 'text').map((b) => b.text).join('\n').trim(); if (txt) lastAssistantText = txt }
             emit({ kind: 'assistant', blocks: simplifyBlocks(m.message?.content), parentToolUseId: m.parent_tool_use_id || null })
             break
           case 'user':
@@ -465,6 +506,10 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             restartCount = 0                 // a successful turn refills the auto-restart budget
             forceStopped = false
             emit({ kind: 'result', subtype: m.subtype, sessionId, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0 })
+            // Arm the Haiku fallback: if Claude's own prompt_suggestion doesn't arrive within
+            // the window, generate one from the last assistant reply. (Skip aborted turns.)
+            if (sugTimer) clearTimeout(sugTimer)
+            if (m.subtype !== 'aborted') sugTimer = setTimeout(() => { sugTimer = null; if (!sawSuggestion && !closed) haikuSuggest() }, SUGGEST_FALLBACK_MS)
             // Surface a usage/context meter (chrome, not a transcript line). The
             // context window % comes from the control request; cost is cumulative.
             ;(async () => {
@@ -481,7 +526,8 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             // Claude Code's own predicted next prompt (promptSuggestions opt-in).
             // Arrives once per turn AFTER `result`; surfaced verbatim as ephemeral
             // chrome (a ghost-text chip in the room composer), never persisted.
-            if (m.suggestion) emit({ kind: 'suggestion', text: m.suggestion })
+            if (sugTimer) { clearTimeout(sugTimer); sugTimer = null }   // built-in won — cancel the Haiku fallback
+            if (m.suggestion) { sawSuggestion = true; emit({ kind: 'suggestion', text: m.suggestion }) }
             break
           default:
             break
@@ -513,7 +559,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   runQuery()
 
   return {
-    sendTurn(text) { if (!closed) { turnActive = true; lastEvtTs = Date.now(); stalledSent = false; input.push(String(text)) } },
+    sendTurn(text) { if (!closed) { turnActive = true; sawSuggestion = false; if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; input.push(String(text)) } },
     // Set the permission mode — Claude Code's ⇧⇥ cycle. setPermissionMode is a
     // streaming control request (drives plan-mode behaviour SDK-side); the local
     // `mode` drives our PreToolUse auto-approve policy. Echo so the room syncs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.54",
+  "version": "0.7.56",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {