thinkpool-pair 0.7.62 → 0.7.64

package/account.mjs

@@ -61,6 +61,25 @@ export function releaseSingleton(lockPath = LOCK) {
   try { if ((parseInt(fs.readFileSync(lockPath, 'utf8').trim(), 10) || 0) === process.pid) fs.rmSync(lockPath, { force: true }) } catch { /* noop */ }
 }
 
+// ── machine-wide single-bridge lock ─────────────────────────────────────────
+// The SAME pidfile is now the machine-wide "one live bridge" lock, not just the
+// account-supervisor guard: a standalone `npx thinkpool-pair <ROOM>` takes it too
+// (see bridge.mjs, post-`--supervise`). Two bridges serving one room race its
+// terminal reconcile, which reaps + CASCADE-deletes terminal history (the XE3IQ
+// "flat search" loss, 2026-06-25). Account mode and standalone room mode share
+// this lock; an account-spawned room child skips it because its parent
+// supervisor already holds it. Wrappers so bridge.mjs need not know the path.
+export function acquireMachineLock(lockPath = LOCK) { return acquireSingleton(lockPath) }
+export function releaseMachineLock(lockPath = LOCK) { return releaseSingleton(lockPath) }
+
+// A served bridge process must hold the machine lock UNLESS it's a room child the
+// account supervisor spawned (THINKPOOL_PAIR_ACCOUNT_CHILD=1) — the parent holds
+// it, and a child fighting its parent for the lock would refuse itself and break
+// account mode. Pure (env in) so the policy is unit-testable.
+export function shouldHoldMachineLock(env = process.env) {
+  return env.THINKPOOL_PAIR_ACCOUNT_CHILD !== '1'
+}
+
 // ── login: OAuth-style DEVICE-CODE flow (hardened) ──────────────────────────
 // The bridge asks Postgres (start_device_code) for a secret device_code + a short
 // human user_code, prints the user_code + URL, then POLLS claim_device_code with
@@ -191,19 +210,15 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // (code-mockup, whip L16). Refreshed below; pushed to live children on rotation.
   let currentAccessToken = session.access_token || null
 
-  // Owner-gate (Contract C-CODE-2): hosting a code session — spawning the agent and
-  // burning compute on this machine — requires Pro or Enterprise. This is the layer
-  // with teeth on cost; the start_code_session RPC gates the web create flow, this
-  // stops a crafted-row bypass from ever serving. Invited partners don't run a bridge.
-  let plan = 'free'
-  try {
-    const { data } = await sb.from('profiles').select('plan').eq('id', session.user.id).single()
-    plan = data?.plan || 'free'
-  } catch { /* transient read — fall through to the gate, fail closed */ }
-  if (plan !== 'pro' && plan !== 'enterprise') {
-    process.stderr.write(`\n  ◇ ThinkPool Code requires a Pro or Enterprise plan to host a session.\n    Your account (${email}) is on the ${plan} plan.\n    Upgrade:  https://thinkpool.io/pro\n\n    (Anyone you invite can still join and steer a Pro host's session for free.)\n`)
-    process.exit(1)
-  }
+  // No plan-refusal here (Contract C-CODE-2′, spec 2026-06-25-code-free-launch).
+  // /code is now a metered free tier, not Pro-only: a free account can legitimately
+  // own sessions (within its monthly quota, or during the launch window). The cost
+  // brake moved to session CREATION — start_code_session enforces the quota/window
+  // server-side, so a row exists iff the owner was entitled to create it. The bridge
+  // therefore serves whatever sessions the account legitimately owns (owner-only
+  // discovery below, line ~349, still bounds it to the account's OWN rooms). Inference
+  // runs on this machine's own Claude login regardless of plan, so hosting costs
+  // ThinkPool nothing; there's no cost reason to refuse a free host.
 
   const DEFAULT_DIR = process.cwd()   // unbound sessions auto-serve here; `bind` overrides per session
   const svcHint = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
@@ -287,7 +302,44 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     forceMs: parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS, 10) || 0,
   })
 
+  // ── cross-machine single active bridge (INV-2) ──────────────────────────────
+  // account.lock guards THIS Mac; this claim guards the ACCOUNT across Macs. We
+  // serve rooms ONLY while we hold the claim. A non-holder stands by (stays alive
+  // for launchd KeepAlive, serves nothing) and takes over only when the holder's
+  // heartbeat goes stale — so two launchd bridges never flap respawning. Two Macs
+  // both serving one account is the cross-machine half of the terminal-reconcile
+  // reap that lost room XE3IQ's history.
+  // Spec: docs/specs/2026-06-25-single-bridge-durable-history.md (INV-2)
+  const BRIDGE_ID = randomUUID()
+  let claimHeld = false
+  let standbyHost = null
+  const refreshClaim = async () => {
+    try {
+      const { data } = await sb.rpc('claim_bridge', { p_bridge_id: BRIDGE_ID, p_hostname: machine })
+      const c = Array.isArray(data) ? data[0] : data
+      const held = !!c?.held
+      const host = c?.holder_host || '?'
+      if (held && !claimHeld) process.stderr.write(`\n  ◆ holding this account — serving your sessions (single active bridge).\n`)
+      else if (!held && claimHeld) process.stderr.write(`\n  ◇ another device (${host}) took over this account — standing by.\n`)
+      else if (!held && standbyHost !== host) process.stderr.write(`\n  ◇ another device (${host}) is serving this account — standing by.\n    (this Mac takes over automatically if that device goes offline.)\n`)
+      claimHeld = held
+      standbyHost = held ? null : host
+      return held
+    } catch {
+      // Transient claim error: keep serving if we already hold; never START
+      // serving on an unknown claim (that's the double-serve we're preventing).
+      return claimHeld
+    }
+  }
+
   const tick = async () => {
+    // Hold the account claim before serving anything (cross-machine guard). When
+    // standing by, make sure we're serving nothing and wait for the next tick.
+    if (!(await refreshClaim())) {
+      if (children.size) for (const [, ch] of children) { try { ch.kill('SIGTERM') } catch { /* noop */ } }
+      pushPresence()
+      return
+    }
     let rooms = []
     try {
       // Owner-only discovery (Contract C-CODE-2): a host bridges ONLY the sessions
@@ -351,7 +403,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     for (const c of children.values()) { try { c.kill(sig || 'SIGTERM') } catch { /* noop */ } }
     // Flush the presence LEAVE before exiting so the dashboard flips to
     // "not connected" in realtime (don't fire-and-forget the untrack).
-    ;(async () => { try { await acct.untrack() } catch { /* noop */ } try { await sb.removeChannel(acct) } catch { /* noop */ } process.exit(code) })()
+    ;(async () => { try { if (claimHeld) await sb.rpc('release_bridge', { p_bridge_id: BRIDGE_ID }) } catch { /* noop */ } try { await acct.untrack() } catch { /* noop */ } try { await sb.removeChannel(acct) } catch { /* noop */ } process.exit(code) })()
     setTimeout(() => process.exit(code), 1500)   // hard backstop if the flush hangs
   }
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => stop(sig))

package/bridge.mjs

@@ -269,6 +269,25 @@ if (_superOwn.includes('--supervise') || _superOwn.includes('--keep-alive')) {
   await new Promise(() => {})   // block forever; the child IS the bridge
 }
 
+// ── machine-wide single-bridge lock ─────────────────────────────────────────
+// Reached only by the ACTUAL serving process: a direct run, the supervised child
+// (the `--supervise` wrapper above blocks forever at line ~269 and never gets
+// here), or an account-spawned room child. Only one live bridge per machine —
+// a second standalone bridge serving the same rooms races their terminal
+// reconcile, which reaps + CASCADE-deletes terminal history (the XE3IQ "flat
+// search" loss, 2026-06-25). Account children skip the lock (parent holds it).
+// Acquiring HERE — not in the supervisor wrapper — keeps a respawn able to
+// re-acquire and stops the wrapper fighting its own child.
+// Spec: docs/specs/2026-06-25-single-bridge-durable-history.md
+{
+  const { acquireMachineLock, releaseMachineLock, shouldHoldMachineLock } = await import('./account.mjs')
+  if (shouldHoldMachineLock(process.env) && !acquireMachineLock()) {
+    console.error('\n  ◇ A thinkpool-pair bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Only one can be active, and the running\n    one already serves every room you are in — use it, or stop it first.\n    (If you are certain none is running, delete that stale lock file.)\n')
+    process.exit(1)
+  }
+  if (shouldHoldMachineLock(process.env)) process.on('exit', () => { try { releaseMachineLock() } catch { /* noop */ } })
+}
+
 const headless = argv.includes('--headless')
 // Account-mode children pass --auto=<agent> so a served session opens a live
 // terminal automatically (headless, no TTY/picker) instead of an empty room.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.62",
+  "version": "0.7.64",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {