thinkpool-pair 0.7.88 → 0.7.90

package/bridge.mjs

@@ -421,6 +421,28 @@ const safeName = (n) => String(n || 'file').replace(/[^a-zA-Z0-9._-]/g, '_').sli
 const supabase = createClient(SUPABASE_URL, SUPABASE_ANON, {
   realtime: { params: { eventsPerSecond: 60 } },
 })
+
+// Owner's plan (free|plus) — gates the Ensemble dispatch ceiling (Free 3 / Plus 6).
+// Resolved from the owner token (codeAuthToken); RLS lets a user read their OWN
+// profiles row. Cached; defaults to 'free' (the safe lower ceiling) until the fetch
+// lands. Under BYOK-only the tokens are the user's, so this is feature-shaping, not a
+// COGS control — a stale/failed fetch just means a conservative ceiling, never a leak.
+let ownerPlan = 'free'
+async function refreshOwnerPlan() {
+  const tok = codeAuthToken
+  if (!tok) return
+  try {
+    const { data, error } = await supabase.auth.getUser(tok)
+    const uid = data?.user?.id
+    if (error || !uid) return
+    const r = await fetch(`${SUPABASE_URL}/rest/v1/profiles?select=plan&id=eq.${uid}`,
+      { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${tok}` } })
+    if (!r.ok) return
+    const rows = await r.json()
+    if (rows?.[0]?.plan) ownerPlan = rows[0].plan === 'plus' ? 'plus' : 'free'
+  } catch { /* DNS-flaky / offline — keep the safe default; the next token refresh retries */ }
+}
+refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken may be set from env)
 // Throttled presence track() (presence.mjs) — a reconnect storm re-fires SUBSCRIBED and
 // the handler re-track()s; without throttle that spirals into the per-client presence
 // rate limit (ClientPresenceRateLimitReached). Lazy so it binds `channel` (the chain
@@ -557,7 +579,7 @@ const announce = () =>
       // the chosen label instead of defaulting to Normal / unnamed. `spawned` (set
       // when an agent Dispatched this lane via spawn_terminal) lets the client keep
       // it OUT of the top tab strip and show it only in the Ensemble menu.
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', alive: true, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, ...(s.spawnedBy ? { spawned: true } : {}) })),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', alive: true, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}) })),
     ],
   })
 
@@ -868,9 +890,12 @@ function restoredTurnOpen(log) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, model, resume, log, commands, mode }) {
+function openStructured({ id, model, resume, log, commands, mode, spawnedBy }) {
   if (sessions.has(id)) return
-  const entry = { cmd: 'claude', kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: Array.isArray(commands) ? commands : undefined, mode }
+  // spawnedBy: set when this lane was Dispatched (spawn_terminal). Restored from the
+  // session store so the Ensemble flag survives a bridge restart (else a respin
+  // stripped it and the lane reverted to a plain tab — the t6 "no chip" bug).
+  const entry = { cmd: 'claude', kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: Array.isArray(commands) ? commands : undefined, mode, spawnedBy: spawnedBy || undefined }
   // C1 (RT-2): per-term contiguous seq counter. Seeded from the restored log's max
   // so a bridge restart resumes ABOVE every persisted seq — fresh events never reuse
   // an old seq, which is what keeps the between-turns restart dup-free (see
@@ -894,7 +919,7 @@ function openStructured({ id, model, resume, log, commands, mode }) {
   if (entry.log.length) process.stderr.write(`\n  ◆ restored ${entry.log.length} prior events (${id.slice(0, 8)})${resume ? ' + resuming live context' : ''}.\n`)
   // Persist the permission mode alongside the transcript so a bridge restart
   // restores the session in the SAME mode (a bypass room stays bypass on resume).
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, spawnedBy: entry.spawnedBy })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -987,7 +1012,14 @@ function openStructured({ id, model, resume, log, commands, mode }) {
         },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
-          const gate = spawnDecision({ hop: entry.hop || 0, spawnCount: entry.spawnCount || 0, liveCount: sessions.size + terms.size, disabled: process.env.TP_SPAWN_OFF === '1' })
+          const gate = spawnDecision({
+            hop: entry.hop || 0,
+            spawnCount: entry.spawnCount || 0,
+            spawnedLive: [...sessions.values()].filter((s) => s.spawnedBy).length,  // dispatch budget counts ONLY spawned lanes
+            totalLive: sessions.size + terms.size,                                  // machine cap counts everything
+            plan: ownerPlan,                                                        // Free 3 / Plus 6 dispatch ceiling
+            disabled: process.env.TP_SPAWN_OFF === '1',
+          })
           if (!gate.ok) return okText(gate.reason)
           entry.spawnCount = (entry.spawnCount || 0) + 1
           const newId = randomUUID()
@@ -1449,7 +1481,7 @@ channel
           // Closed sessions are unlinked by deleteSession, so a file existing on disk ==
           // a session that was live at shutdown (never an explicitly closed one).
           const all = loadAll(room)
-          if (all.length) for (const rec of all) openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode })
+          if (all.length) for (const rec of all) openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy })
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
           // (autoAgent set, no attachedCmd) the web's `?new=1` flow opens the first
           // terminal; opening one here too raced it into TWO terminals — each a
@@ -1575,7 +1607,7 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     if (m.t === 'update-available') surfaceUpdate(m.version)
     // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
     // it so our authed writes (code-mockup) never go stale on a long session (L16).
-    else if (m.t === 'token') codeAuthToken = m.accessToken || null
+    else if (m.t === 'token') { codeAuthToken = m.accessToken || null; refreshOwnerPlan() }
   })
   setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {

package/claude-session.mjs

@@ -412,7 +412,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       'RUN IT, DO NOT ASK: verify your own work before calling it done. Actually run or serve what you changed, observe that it behaves correctly, and show the evidence in the room — a screenshot of the running result, the passing test output, or the real response — rather than telling the user "this should work, go test it." If you could not verify something, say exactly what is unverified. This room follows verify-before-claiming: runtime evidence you produced, not assertion.',
       'CROSS-TERMINAL AWARENESS: this room may have other terminals open alongside yours — other agents working, or shells the people are driving. You have a READ-ONLY tool, read_terminal: call it with no arguments to list the other open terminals, or with a terminal ref/id/command to read that terminal\'s recent activity. Reach for it when your work depends on what another terminal is doing (e.g. someone says "see what the other terminal hit", or you need to coordinate with a sibling agent before acting). It only ever reads — it never changes another terminal. Identify a terminal by its NAME or its ref/id from the roster, never by an on-screen number like "Terminal 2" — those positional labels renumber when a terminal is closed, so they do not reliably point at a lane.',
       'CROSS-TERMINAL HAND-OFF: you also have post_to_terminal(terminal, text) to send a message or task to ANOTHER AGENT terminal in this room (not a plain shell). Use it sparingly and only when the people clearly want the lanes to coordinate — e.g. "tell the backend terminal the API is ready", or to hand a sibling agent a concrete task. Every post requires a person in the room to approve a card before it is delivered, and an agent that was itself reached via a cross-post cannot post onward — so do not rely on it for chit-chat or loops. Prefer read_terminal to understand a sibling before you ever post to it.',
-      'CROSS-TERMINAL SPAWN: when a person asks you to fan work out across multiple agents — research lanes, parallel sub-tasks, a swarm — open YOUR OWN fresh lanes with spawn_terminal(name?, task?, model?); do NOT dump the work into siblings that are already busy (a sibling is mid-task unless read_terminal shows it idle, and hijacking it derails their work). spawn_terminal opens a brand-new Claude lane and, if you pass `task`, hands it that task immediately; it appears as a new terminal in the room. A spawned lane INHERITS your current permission mode by default — so if you are in bypass, your lanes run autonomously with no per-action clicking; pass `mode` only to override. Raising a lane to bypass from a non-bypass lane asks the room to confirm once (everything else spawns without a prompt). Collect each lane\'s result later with read_terminal (a spawned lane cannot post back to you), and tidy up with close_terminal once you have what you need — you may only close lanes you spawned yourself. You are bounded: at most a few new lanes per turn and 8 terminals total in the room, and a lane you were spawned/cross-posted into cannot itself spawn (so no runaway). This is how you "open the terminals yourself" instead of asking a person to.',
+      'CROSS-TERMINAL SPAWN: when a person asks you to fan work out across multiple agents — research lanes, parallel sub-tasks, a swarm — open YOUR OWN fresh lanes with spawn_terminal(name?, task?, model?); do NOT dump the work into siblings that are already busy (a sibling is mid-task unless read_terminal shows it idle, and hijacking it derails their work). spawn_terminal opens a brand-new Claude lane and, if you pass `task`, hands it that task immediately; it appears as a new terminal in the room. A spawned lane INHERITS your current permission mode by default — so if you are in bypass, your lanes run autonomously with no per-action clicking; pass `mode` only to override. Raising a lane to bypass from a non-bypass lane asks the room to confirm once (everything else spawns without a prompt). Collect each lane\'s result later with read_terminal (a spawned lane cannot post back to you), and tidy up with close_terminal once you have what you need — you may only close lanes you spawned yourself. You are bounded: a few new lanes per turn, a per-plan dispatch ceiling on concurrent spawned lanes (Free 3 / Plus 6) that is separate from the human terminals so it never blocks them, an overall room machine cap, and a lane you were spawned/cross-posted into cannot itself spawn (so no runaway). This is how you "open the terminals yourself" instead of asking a person to.',
       'WRITE PLANS INTO THE CHAT: whenever you form or revise a plan — because the room is in Plan mode, or because someone asked you to plan, design, or think it through first — write the actual plan out as a normal message in the room as you develop it: the approach, the concrete steps, the files you will touch, the open questions. The room does NOT surface plan files at all, and the plan-approval card does not reliably carry the plan text, so a plan that lives only in a plan file or only inside ExitPlanMode is INVISIBLE to the people you are working with — they just see "plan ready" with no content. The chat is the canonical place your plan lives; put it there so the room can read and react to it before you proceed.',
     ].join(' '),
     // Needed for live thinking-token progress (SDKThinkingTokensMessage) to

package/cross-terminal.mjs

@@ -168,21 +168,37 @@ export const crossPostDecision = ({ hop = 0, postCount = 0, disabled = false } =
 //   • kill-switch (TP_SPAWN_OFF)
 //   • hop — a lane REACHED via cross-post/spawn (hop ≥ 1) cannot spawn onward, so
 //     a spawned agent can't recursively spawn (the loop breaker, mirrors CROSSPOST)
-//   • maxTerms — the hard live-terminal cap (matches openTerm's cap of 8); the
-//     real backstop, since spawned lanes are bounded by it regardless of turns
+//   • machineMax — overall hard cap on LIVE lanes (sessions+terms): the runaway /
+//     don't-melt-the-laptop backstop, plan-INDEPENDENT.
+//   • dispatch ceiling — a SEPARATE, plan-tiered budget counting ONLY spawned lanes
+//     (Free 3 / Plus 6). Counts spawned lanes ONLY, so they never block the human's
+//     own terminals, and the human's terminals never eat the dispatch budget. Under
+//     BYOK-only the tokens are the user's, so this is feature-shaping + machine
+//     safety, NOT a ThinkPool-COGS control.
 //   • perTurnCap — a per-turn runaway breaker (mirrors PEEK/CROSSPOST)
-// liveCount is the caller's measured sessions.size + terms.size at call time.
+// The caller measures: spawnedLive (live sessions with spawnedBy set), totalLive
+// (sessions.size + terms.size), and resolves `plan` from the room owner.
 export const SPAWN = {
-  maxHop: 1,       // human turn = hop 0; a spawned/injected lane = hop ≥ 1, which CANNOT spawn onward
-  perTurnCap: 4,   // spawn_terminal calls allowed per turn (total still capped by maxTerms)
-  maxTerms: 8,     // hard cap on live terminals in the room (matches openTerm)
+  maxHop: 1,            // human turn = hop 0; a spawned/injected lane = hop ≥ 1, CANNOT spawn onward
+  perTurnCap: 4,        // spawn_terminal calls allowed per turn
+  freeMaxSpawned: 3,    // Free plan dispatch ceiling (concurrent spawned lanes)
+  plusMaxSpawned: 6,    // Plus plan dispatch ceiling
+  machineMax: 10,       // hard cap on TOTAL live lanes (the laptop/runaway backstop)
 }
 
-export const spawnDecision = ({ hop = 0, spawnCount = 0, liveCount = 0, disabled = false } = {}, limits = SPAWN) => {
+// Plan → dispatch ceiling. Anything not 'plus' is treated as Free (the safe default).
+export const maxSpawnedFor = (plan, limits = SPAWN) => {
+  const o = { ...SPAWN, ...(limits || {}) }
+  return plan === 'plus' ? o.plusMaxSpawned : o.freeMaxSpawned
+}
+
+export const spawnDecision = ({ hop = 0, spawnCount = 0, spawnedLive = 0, totalLive = 0, plan = 'free', disabled = false } = {}, limits = SPAWN) => {
   const o = { ...SPAWN, ...(limits || {}) }
   if (disabled) return { ok: false, reason: 'Spawning terminals is disabled in this room.' }
   if (hop >= o.maxHop) return { ok: false, reason: 'Spawn limit reached — a terminal reached via cross-terminal cannot itself open further terminals; a person must open the next lane.' }
-  if (liveCount >= o.maxTerms) return { ok: false, reason: `Terminal cap (${o.maxTerms}) reached — close a terminal before opening another.` }
+  if (totalLive >= o.machineMax) return { ok: false, reason: `Room is at the machine cap (${o.machineMax} live lanes) — close one before opening another.` }
+  const cap = maxSpawnedFor(plan, o)
+  if (spawnedLive >= cap) return { ok: false, reason: `Dispatch ceiling reached (${cap} lane${cap === 1 ? '' : 's'} on the ${plan} plan)${plan !== 'plus' ? ` — Plus raises it to ${o.plusMaxSpawned}.` : '.'} Close a dispatched lane to open another.` }
   if (spawnCount >= o.perTurnCap) return { ok: false, reason: `Spawn limit reached for this turn (${o.perTurnCap}).` }
   return { ok: true }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.88",
+  "version": "0.7.90",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {