thinkpool-pair 0.7.55 → 0.7.56

package/account.mjs

@@ -186,6 +186,9 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
   const { sb, session } = auth
   const email = session.user?.email || 'your account'
+  // Current owner JWT, handed to each room-bridge child for authed web writes
+  // (code-mockup, whip L16). Refreshed below; pushed to live children on rotation.
+  let currentAccessToken = session.access_token || null
 
   // Owner-gate (Contract C-CODE-2): hosting a code session — spawning the agent and
   // burning compute on this machine — requires Pro or Enterprise. This is the layer
@@ -253,7 +256,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const keepFresh = scheduleTokenRefresh({
     sb,
     session,
-    onRefreshed: (s) => { saveAuth(s); pushPresence() },
+    onRefreshed: (s) => {
+      saveAuth(s); pushPresence()
+      // Push the rotated owner token to every live child so their authed writes
+      // (code-mockup) never go stale on a long session (whip L16).
+      currentAccessToken = s.access_token || currentAccessToken
+      for (const c of children.values()) { try { c.send({ t: 'token', accessToken: currentAccessToken }) } catch { /* child not ready */ } }
+    },
     forceMs: parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS, 10) || 0,
   })
 
@@ -287,6 +296,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // can't make a child self-exit; flag it as an account child instead.
       const env = { ...process.env, THINKPOOL_PAIR_ACCOUNT_CHILD: '1' }
       delete env.THINKPOOL_PAIR_AUTOUPDATE
+      // Hand the child the owner JWT for authed web writes (code-mockup, L16).
+      if (currentAccessToken) env.TP_ACCESS_TOKEN = currentAccessToken
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child

package/bridge.mjs

@@ -47,6 +47,14 @@ const SUPABASE_URL  = process.env.TP_SUPABASE_URL  || 'https://daytvtakmlixpfbbq
 const WEB_BASE      = process.env.TP_WEB_BASE      || 'https://thinkpool.io'
 const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
 
+// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).
+// The room-bridge is anon by design; the account supervisor (account.mjs) owns the
+// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes
+// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a
+// directly-started bridge with no account login — those writes go unattributed,
+// never owner-spoofed (the server treats a missing/!owner token accordingly).
+let codeAuthToken = process.env.TP_ACCESS_TOKEN || null
+
 // Per-terminal rolling scrollback (raw chars). Replayed to joining clients.
 // Kept comfortably under realtime payload limits once base64'd.
 const SCROLLBACK_MAX = 120_000
@@ -518,9 +526,14 @@ const handleManifest = async (box, file, term) => {
   const readTxt = (p) => { try { return p && fs.readFileSync(p, 'utf8') } catch { return null } }
   const cid = randomUUID()
   try {
+    const mockupHeaders = { 'Content-Type': 'application/json' }
+    // Authenticate as the owner so the server can attribute the persisted row to a
+    // verified user instead of trusting "knows the code" (whip L16). Omitted when
+    // we have no token (direct bridge, no login) → server persists it unattributed.
+    if (codeAuthToken) mockupHeaders.Authorization = `Bearer ${codeAuthToken}`
     const res = await fetch(`${WEB_BASE}/api/code-mockup`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: mockupHeaders,
       body: JSON.stringify({
         code: room, slug: m.slug, title: m.title, cid, ts: m.ts, term,
         desktopPng: readB64(m.desktop), mobilePng: readB64(m.mobile), html: readTxt(m.html),
@@ -1206,7 +1219,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   // Contract #1) + `idle` (the quiet window, for the unattended fallback) + whether a
   // web peer is present, so the supervisor restarts on an explicit click between turns
   // and otherwise waits for true idle with nobody watching (Slice 3).
-  process.on('message', (m) => { if (m && m.t === 'update-available') surfaceUpdate(m.version) })
+  process.on('message', (m) => {
+    if (!m) return
+    if (m.t === 'update-available') surfaceUpdate(m.version)
+    // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
+    // it so our authed writes (code-mockup) never go stale on a long session (L16).
+    else if (m.t === 'token') codeAuthToken = m.accessToken || null
+  })
   setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.55",
+  "version": "0.7.56",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {