thinkpool-pair 0.7.119 → 0.7.120

package/account.mjs

@@ -489,7 +489,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const busPeek = (targetRoom, terminal, lines) => busRequestFirst('peer-peek-req', { targetRoom, terminal, lines }, CROSSROOM_BUS.busTimeoutMs)
   const busPost = (targetRoom, terminal, text, fromRoom) => busRequestFirst('peer-post-req', { targetRoom, terminal, text, fromRoom, fromHost: machine }, 180_000)
 
+  // Re-entrancy guard: bind-room fires tick() AND a 15s interval fires tick(); tick
+  // awaits a code_sessions query before children.set(), so two overlapping runs can
+  // both see children.has(room) false and DOUBLE-SPAWN a 2nd bridge for one room
+  // (two bridges per room = the CASCADE-delete / ghost-terminal hazard). Serialize.
+  let ticking = false
   const tick = async () => {
+    if (ticking) return
+    ticking = true
+    try { await tickBody() } finally { ticking = false }
+  }
+  const tickBody = async () => {
     // Hold the account claim before serving anything (cross-machine guard). When
     // standing by, make sure we're serving nothing and wait for the next tick.
     if (!(await refreshClaim())) {

package/bridge.mjs

@@ -274,12 +274,17 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     restartUpdateService: ({ room = null } = {}) => {
       let target = null
       try { target = execSync('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() } catch { /* offline / no npm */ }
-      if (!target) {
-        target = PKG_VERSION
-        process.stderr.write(`\n  ⚠ couldn't reach npm to resolve the newest version — re-pinning this launcher's v${PKG_VERSION} (stale-proof) and restarting…\n`)
-      } else {
-        process.stderr.write(`\n  ◆ updating the background service to v${target} (newest published) and restarting…\n`)
+      if (!/^\d+\.\d+\.\d+/.test(target || '')) {
+        // Can't reach npm to learn the newest version — DON'T silently re-pin this
+        // launcher's PKG_VERSION (npx may have run a stale cached launcher, so it could
+        // be OLDER than what's installed). Just RESTART the current pinned service (no
+        // version change) and say so honestly — never call a same-version restart an
+        // "update".
+        process.stderr.write(`\n  ⚠ couldn't reach npm to check for a newer version — restarting the current version, NO update applied. Try again when online.\n`)
+        svc.restartService(room)
+        return
       }
+      process.stderr.write(`\n  ◆ updating the background service to v${target} (newest published) and restarting…\n`)
       svc.installService(room, [], { version: target, staleProof: true })   // rewrites plist/unit at resolved version + reloads = update + restart
     },
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
@@ -1806,6 +1811,10 @@ function endStructured(id) {
 function cleanupFlowLanes(flowId, graceMs = 4000) {
   if (!flowId) return
   const marker = `flow:${flowId}`
+  // Drop this flow's budget ledger — else the map grows unbounded over the bridge's
+  // life AND a re-run reusing the flowId reads a stale spend already at the cap, so
+  // canDispatch refuses the fresh wave (the "flow won't start again" bug).
+  flowBudgets.delete(flowId)
   setTimeout(() => {
     for (const [sid, e] of [...sessions]) {
       if (e.flowSessionId === flowId || e.spawnedBy === marker) {
@@ -2610,7 +2619,11 @@ process.on('uncaughtException', (err) => {
   try { process.stderr.write(`\n  ⚠ uncaughtException: ${err?.stack || err}\n  ◆ shutting down cleanly for a fresh respawn.\n`) } catch { /* noop */ }
   shutdown(1)
 })
+// A stray unhandledRejection is NOT fatal — this long-running process has many
+// fire-and-forget promises (best-effort fetches, supabase awaits) and one that
+// wasn't .catch()'d must not tear down EVERY room + force a resume-storm. Log it
+// loudly and keep serving; a rejection that truly wedges a session surfaces
+// through the stall watchdog or a synchronous throw (→ uncaughtException above).
 process.on('unhandledRejection', (reason) => {
-  try { process.stderr.write(`\n  ⚠ unhandledRejection: ${reason?.stack || reason}\n  ◆ shutting down cleanly for a fresh respawn.\n`) } catch { /* noop */ }
-  shutdown(1)
+  try { process.stderr.write(`\n  ⚠ unhandledRejection (non-fatal, continuing): ${reason?.stack || reason}\n`) } catch { /* noop */ }
 })

package/claude-session.mjs

@@ -193,6 +193,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   const RESTART_MAX = 3
   const RECOVERABLE = /connection closed|connection reset|econnreset|etimedout|socket hang up|fetch failed|network error|socket destroyed/i
   let restartCount = 0
+  let restartTimer = null   // the pending auto-restart backoff — cancelled by end()
   // Force-stop a true wedge (item 3): no result, no error, just silence past
   // FORCE_STOP_MS. Clears turnActive so between-turns updates unblock, and
   // surfaces a recoverable error. The wedged loop is left in place (a hung
@@ -733,7 +734,9 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             if (interrupting && (m.subtype === 'aborted' || m.subtype === 'error_during_execution')) { turnActive = false; break }
             turnBaseOut = 0; curMsgOut = 0   // reset the live token count for the next turn
             turnActive = false               // turn settled → stall watchdog stands down
-            restartCount = 0                 // a successful turn refills the auto-restart budget
+            if (m.subtype === 'success') restartCount = 0   // ONLY a real success refills the
+            // auto-restart budget — else a flapping connection that lands one aborted turn
+            // between drops refills every cycle and loops far past RESTART_MAX.
             forceStopped = false
             emit({ kind: 'result', subtype: m.subtype, sessionId, model: curModel, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0 })
             // Arm the Haiku fallback: if Claude's own prompt_suggestion doesn't arrive within
@@ -775,8 +778,15 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
         restartCount++
         turnActive = false
         emit({ kind: 'note', text: `connection dropped — reconnecting (${restartCount}/${RESTART_MAX})` })
+        // End the OLD input stream before swapping — else its generator leaks
+        // (suspended forever) and a turn pushed into it after the throw is silently
+        // lost (push returns false on an ended stream, so sendTurn can surface it).
+        const oldInput = input
         input = makeInputStream()
-        setTimeout(runQuery, Math.min(1000 * restartCount, 4000))   // 1s, 2s, 4s backoff
+        try { oldInput.end() } catch { /* noop */ }
+        // Track the timer so end() can cancel it, and re-check `closed` at fire time
+        // so a session torn down during the backoff doesn't spawn a zombie SDK child.
+        restartTimer = setTimeout(() => { restartTimer = null; if (!closed) runQuery() }, Math.min(1000 * restartCount, 4000))   // 1s, 2s, 4s backoff
         return
       }
       // Non-recoverable, or budget exhausted: mark done so sendTurn stops
@@ -839,7 +849,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       // SDK already surfaced one for the interrupt. (restored from 0.7.49)
       if (turnActive) { turnActive = false; emit({ kind: 'result', subtype: 'aborted', sessionId }) }
     },
-    end() { closed = true; clearInterval(stallTimer); clearTimeout(interruptTimer); input.end(); try { ac.abort() } catch { /* noop */ } },
+    end() { closed = true; clearInterval(stallTimer); clearTimeout(interruptTimer); clearTimeout(restartTimer); if (sugTimer) clearTimeout(sugTimer); input.end(); try { ac.abort() } catch { /* noop */ } },
     get sessionId() { return sessionId },
     get mode() { return mode },
     get turnActive() { return turnActive },   // a turn is in flight (gates between-turns update restart — Slice 3 Contract #1)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.119",
+  "version": "0.7.120",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -24,7 +24,16 @@ import { execSync } from 'node:child_process'
 
 // Service identity. Account mode has no room → a single stable id so there's
 // exactly one account service per machine (a second install replaces it).
-const label = (room) => room ? `io.thinkpool.pair.${room.toLowerCase()}` : 'io.thinkpool.pair.account'
+// Room codes flow UNESCAPED into launchctl/systemd shell strings + plist paths, so
+// this is the security chokepoint: reject anything that isn't a plain alnum code
+// before it can inject shell (`A;rm -rf ~`) or corrupt the service label. Every
+// room-interpolating path (buildArtifact, restart/uninstall/serviceActive) calls
+// label(), so one guard here covers them all.
+const ROOM_CODE_RE = /^[A-Za-z0-9]{2,16}$/
+const label = (room) => {
+  if (room && !ROOM_CODE_RE.test(room)) throw new Error(`invalid room code: ${JSON.stringify(room)} (expected 2–16 alphanumerics)`)
+  return room ? `io.thinkpool.pair.${room.toLowerCase()}` : 'io.thinkpool.pair.account'
+}
 const slug = (room) => room || 'account'
 const xml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
 const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`