thinkpool-pair 0.7.102 → 0.7.104

package/bridge.mjs

@@ -1433,6 +1433,26 @@ function drainPending(s) {
   s.pending.clear()
 }
 
+// Switching a terminal to bypassPermissions must RETROACTIVELY clear the cards the
+// current turn already raised — setPermissionMode is a streaming control request that
+// only applies going forward, so without this a user who flips to bypass mid-turn keeps
+// staring at "the agent wants to run X" cards on a terminal that's supposedly hands-off
+// (the 2026-06-30 "AGENT STILL ASKING PERMISSIONS" report — incl. subagent/Explore tool
+// calls whose requestPermission was invoked before the toggle). bypass = allow-all, so
+// resolving every pending card as 'allow' is exactly what the new mode means.
+function allowPending(s) {
+  if (!s?.pending) return
+  for (const [key, p] of s.pending) {
+    // Only auto-clear ordinary tool cards. A pending PLAN approval (risk:'plan') or an
+    // AskUserQuestion (risk:'ask') is a deliberate human gate — flipping to bypass means
+    // "run tools without asking", not "auto-approve my plan / answer my question" — leave
+    // those for the human.
+    if (p?.payload?.risk === 'plan' || p?.payload?.risk === 'ask') continue
+    try { p.resolve('allow') } catch { /* noop */ }
+    s.pending.delete(key)
+  }
+}
+
 function endStructured(id) {
   if (!id) return
   const s = sessions.get(id)
@@ -1712,7 +1732,11 @@ channel
   })
   .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s) { s.mode = payload.mode; s.session.setMode(payload.mode) }  // track for persist/restore
+    if (s) {
+      s.mode = payload.mode; s.session.setMode(payload.mode)  // track for persist/restore
+      // Flipping to bypass = "stop asking, including the cards this turn already raised."
+      if (payload.mode === 'bypassPermissions') allowPending(s)
+    }
   })
   .on('broadcast', { event: 'code-close' }, ({ payload }) => {
     endStructured(payload?.id)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.102",
+  "version": "0.7.104",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -115,12 +115,25 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
     // retried on the EIO race → a final `print` so the command's exit code reports the
     // real loaded state (installService warns if it ends not-loaded).
     const lbl = label(room), dom = 'gui/$(id -u)'
+    const pr = `launchctl print ${dom}/${lbl} >/dev/null 2>&1`
     const post = [
-      `launchctl bootout ${dom}/${lbl} 2>/dev/null`,
-      `for i in $(seq 1 20); do launchctl print ${dom}/${lbl} >/dev/null 2>&1 || break; sleep 0.2; done`,
-      `launchctl enable ${dom}/${lbl}`,
-      `for i in $(seq 1 20); do launchctl bootstrap ${dom} "${file}" 2>/dev/null && break; sleep 0.3; done`,
-      `launchctl print ${dom}/${lbl} >/dev/null 2>&1`,
+      // Evict any existing instance so the REWRITTEN plist (new pinned version) is what
+      // loads. bootout is async + occasionally sticky: if the old supervised process
+      // won't leave the domain, the follow-up bootstrap throws "Bootstrap failed: 5:
+      // Input/output error" and we'd SILENTLY keep running the OLD pinned version while
+      // reporting success — the 2026-06-30 "Restart & update" stuck-on-0.7.96 bug. So:
+      // bootout, wait for it to actually leave, and if it WON'T, SIGKILL the wedged pid
+      // then bootout again (KeepAlive can't relaunch a job that's booting out).
+      `launchctl bootout ${dom}/${lbl} 2>/dev/null || true`,
+      `for i in $(seq 1 25); do ${pr} || break; sleep 0.2; done`,
+      `if ${pr}; then p=$(launchctl print ${dom}/${lbl} 2>/dev/null | sed -n 's/.*[^a-z]pid = \\([0-9][0-9]*\\).*/\\1/p' | head -1); [ -n "$p" ] && kill -9 "$p" 2>/dev/null || true; launchctl bootout ${dom}/${lbl} 2>/dev/null || true; for i in $(seq 1 25); do ${pr} || break; sleep 0.2; done; fi`,
+      // Clear a stale `disabled` override (from a prior bootout / account-storm cleanup),
+      // then load the rewritten plist from disk, retried on the EIO teardown race.
+      `launchctl enable ${dom}/${lbl} 2>/dev/null || true`,
+      `ok=0; for i in $(seq 1 25); do launchctl bootstrap ${dom} "${file}" 2>/dev/null && { ok=1; break; }; sleep 0.3; done`,
+      // Be HONEST about the outcome: if it never loaded, say so + give the exact manual
+      // recovery — never let a failed reload masquerade as a successful update.
+      `if [ "$ok" != 1 ] && ! ${pr}; then echo "  ⚠ thinkpool-pair: launchd reload FAILED — run by hand: launchctl bootout ${dom}/${lbl} ; launchctl bootstrap ${dom} \\"${file}\\"" >&2; fi`,
     ].join('; ')
     return { file, content, logDir, post: [post], note: 'Loaded as a LaunchAgent — starts at login, restarts on crash.' }
   }