thinkpool-pair 0.7.14 → 0.7.16

package/account.mjs

@@ -13,7 +13,7 @@ import path from 'node:path'
 import fs from 'node:fs'
 import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
-import { saveAuth, loadAuth, clearAuth, loadDirs, bindDir } from './auth-store.mjs'
+import { saveAuth, loadAuth, loadDirs, bindDir } from './auth-store.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -78,8 +78,13 @@ export function runBind(room, dir) {
 export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const auth = await authedClient(SUPABASE_URL, SUPABASE_ANON)
   if (!auth) {
-    clearAuth()
-    console.error('\n  Not linked (or the link expired). Run:\n\n    npx thinkpool-pair login\n')
+    // Do NOT delete auth.json here. A refresh can fail transiently (offline) or
+    // lose a refresh-token rotation race with another bridge sharing this login —
+    // wiping the file on that destroys a still-valid login. Leave it: only an
+    // explicit `login` should ever replace the token (saveAuth overwrites it).
+    // (2026-06-17: a second account supervisor raced the token and the old
+    // clearAuth() here deleted a live Pro login mid-session.)
+    console.error('\n  ◇ Couldn\'t refresh your account session (offline, or another bridge\n    may be using this login). Your saved login was left in place.\n    If this keeps happening, re-link:  npx thinkpool-pair login\n')
     process.exit(1)
   }
   const { sb, session } = auth
@@ -100,9 +105,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
 
   const DEFAULT_DIR = process.cwd()   // unbound sessions auto-serve here; `bind` overrides per session
-  process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    Auto-serving your sessions from ${DEFAULT_DIR}\n    (point one at another repo: npx thinkpool-pair bind <code> <dir>)\n`)
+  const svcHint = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
+    ? '    (auto-updating background service — survives reboot, tracks @latest)\n'
+    : '    (run hands-off + auto-updating: npx thinkpool-pair install-service)\n'
+  process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    Auto-serving your sessions from ${DEFAULT_DIR}\n    (point one at another repo: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
+  const childIdle = new Map()  // room -> bool (last idle report; unknown = not idle)
   const warned = new Set()
 
   // Account presence — so the web dashboard can show "● Bridge active" for this
@@ -132,9 +141,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       }
       warned.delete(room)
       process.stderr.write(`\n  ◆ serving ${room}${r.name ? ` "${r.name}"` : ''}  →  ${dir}${dirs[room] ? '' : ' (default)'}\n`)
-      const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: 'inherit' })
+      // Children NEVER self-update (only the supervisor restart re-resolves
+      // @latest); they report idle to us over IPC so we can restart at a moment
+      // when every session is quiet. Strip AUTOUPDATE so an inherited service env
+      // can't make a child self-exit; flag it as an account child instead.
+      const env = { ...process.env, THINKPOOL_PAIR_ACCOUNT_CHILD: '1' }
+      delete env.THINKPOOL_PAIR_AUTOUPDATE
+      const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
-      child.on('exit', () => { children.delete(room) })   // re-served on the next tick
+      child.on('message', (m) => { if (m && m.t === 'idle') childIdle.set(room, !!m.idle) })
+      child.on('exit', () => { children.delete(room); childIdle.delete(room) })   // re-served on the next tick
     }
     pushPresence()
   }
@@ -152,5 +168,58 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     setTimeout(() => process.exit(0), 1500)   // hard backstop if the flush hangs
   }
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => stop(sig))
+
+  // ── auto-update (account-service tier only) ───────────────────────────────
+  // launchd (KeepAlive) / systemd (Restart=always) re-run `npx -y
+  // thinkpool-pair@latest` (no room) on every restart, so a clean exit here
+  // pulls the newest publish — and because the new supervisor re-spawns children
+  // from the newly-resolved bridge, the room children get the new version too
+  // (they can't self-update; only this restart propagates it). Gated to
+  // THINKPOOL_PAIR_AUTOUPDATE=1 (set by the account service installer). We wait
+  // for EVERY child to report idle so no one's mid-keystroke when we cycle; each
+  // child persists + resumes its session, so the restart is invisible in-room.
+  //   THINKPOOL_PAIR_UPDATE_INTERVAL  registry poll seconds (default 1800)
+  //   THINKPOOL_PAIR_UPDATE_IDLE      child idle seconds before a restart (default 90)
+  if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
+    const POLL_MS = Math.max(60, parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL, 10) || 1800) * 1000
+    let pendingUpdate = null
+    // Strictly-newer x.y.z core; ignore prerelease tails (never downgrade/churn).
+    const isNewer = (latest, cur) => {
+      const core = (v) => String(v).split('-')[0].split('.').map((n) => parseInt(n, 10) || 0)
+      const a = core(latest), b = core(cur)
+      for (let i = 0; i < 3; i++) { if ((a[i] || 0) > (b[i] || 0)) return true; if ((a[i] || 0) < (b[i] || 0)) return false }
+      return false
+    }
+    const fetchLatest = async () => {
+      const ctrl = new AbortController()
+      const to = setTimeout(() => ctrl.abort(), 8000)
+      try {
+        const r = await fetch('https://registry.npmjs.org/thinkpool-pair/latest', { signal: ctrl.signal, headers: { accept: 'application/json' } })
+        if (!r.ok) return null
+        const j = await r.json()
+        return typeof j?.version === 'string' ? j.version : null
+      } catch { return null } finally { clearTimeout(to) }
+    }
+    // Idle iff every served child has reported idle. No children → trivially idle.
+    // Unknown (no report yet) counts as NOT idle, so we never cycle a fresh child.
+    const allIdle = () => { for (const room of children.keys()) if (!childIdle.get(room)) return false; return true }
+    const applyIfIdle = () => {
+      if (!pendingUpdate || stopping || !allIdle()) return
+      process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
+      stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
+    }
+    const check = async () => {
+      const latest = await fetchLatest()
+      if (latest && isNewer(latest, VERSION)) {
+        if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — will restart at the next idle moment (all sessions quiet).\n`)
+        pendingUpdate = latest
+        applyIfIdle()
+      }
+    }
+    setInterval(check, POLL_MS).unref()
+    setInterval(applyIfIdle, 15000).unref()
+    setTimeout(check, 60000).unref()
+  }
+
   await new Promise(() => {})
 }

package/bridge.mjs

@@ -125,8 +125,12 @@ const argv = process.argv.slice(2)
 // Boot-persistent service install (cross-platform: launchd / systemd / Windows
 // Startup). Subcommand form: `thinkpool-pair install-service <ROOM> [-- <cmd>]`.
 if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
-  const svcRoom = (argv[1] || '').toUpperCase().trim()
-  if (!svcRoom || svcRoom.startsWith('-')) { console.error('usage: thinkpool-pair install-service <ROOM> [-- <command…>]'); process.exit(1) }
+  // `install-service <ROOM>` → supervise one room. `install-service` (no room,
+  // or only flags / a leading `--`) → supervise the ACCOUNT bridge, which serves
+  // every session you're in. room=null is the account-mode signal into service.mjs.
+  const arg1 = argv[1] || ''
+  const account = !arg1 || arg1.startsWith('-')
+  const svcRoom = account ? null : arg1.toUpperCase().trim()
   const sd = argv.indexOf('--')
   const svcCmd = sd >= 0 ? argv.slice(sd + 1) : []
   const svc = await import('./service.mjs')
@@ -873,6 +877,18 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   setInterval(check, POLL_MS).unref()        // poll the registry
   setInterval(applyIfIdle, 15000).unref()    // once pending, land it as soon as idle
   setTimeout(check, 60000).unref()           // first check after the session settles
+} else if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+  // Account-child tier: the account supervisor spawned us over IPC. We do NOT
+  // self-restart (AUTOUPDATE is unset for children on purpose) — only the
+  // supervisor restart re-resolves @latest. Instead we report our idle state so
+  // the supervisor can pick a moment when EVERY child is idle to restart-update.
+  const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
+  const idleNow = () => {
+    if (Date.now() - lastActivity < IDLE_MS) return false
+    for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
+    return true
+  }
+  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but
   // nudge once if a newer version is out so a relaunch with @latest picks it up.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.14",
+  "version": "0.7.16",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -7,6 +7,14 @@
      • Windows → Startup-folder .cmd running --supervise
    `--supervise` (in bridge.mjs) is the cross-platform crash-restart
    baseline that needs no install; this adds boot persistence.
+
+   Two service shapes, one builder:
+     • room    — `install-service <ROOM>` → supervises one room bridge.
+     • account — `install-service` (no room) → supervises the ACCOUNT
+                 supervisor (`npx thinkpool-pair`, bare), which serves
+                 every session you're in. Pass room=null for this.
+   Both launch `thinkpool-pair@latest`, so a restart pulls the newest
+   publish; auto-update self-restart lives in bridge.mjs / account.mjs.
    ───────────────────────────────────────────────────────────── */
 
 import os from 'node:os'
@@ -14,7 +22,10 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { execSync } from 'node:child_process'
 
-const label = (room) => `io.thinkpool.pair.${room.toLowerCase()}`
+// Service identity. Account mode has no room → a single stable id so there's
+// exactly one account service per machine (a second install replaces it).
+const label = (room) => room ? `io.thinkpool.pair.${room.toLowerCase()}` : 'io.thinkpool.pair.account'
+const slug = (room) => room || 'account'
 const xml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
 
 // Resolve the real npx next to the current node, so the service stays seamless:
@@ -28,15 +39,19 @@ function npxPath(platform) {
 }
 
 // Pure artifact builder — returned shape is testable without side effects.
-export function buildArtifact(platform, { room, cmdArgs = [] }) {
+// room falsy → ACCOUNT service (bare `thinkpool-pair`, auto-serves all sessions).
+export function buildArtifact(platform, { room = null, cmdArgs = [] } = {}) {
   const npx = npxPath(platform)
   const cwd = process.cwd()
+  const id = slug(room)
   const logDir = path.join(os.homedir(), '.thinkpool-pair')
-  const log = path.join(logDir, `${room}.log`)
+  const log = path.join(logDir, `${id}.log`)
   const tail = cmdArgs.length ? ['--', ...cmdArgs] : []
+  const desc = room ? `bridge (${room})` : 'account bridge'
   // OS-supervised tiers (launchd KeepAlive / systemd Restart) don't need
   // --supervise; the latest published bridge is fetched by npx each (re)start.
-  const pkgArgs = ['-y', 'thinkpool-pair@latest', room]
+  // Account mode passes NO room arg — that's what selects the account supervisor.
+  const pkgArgs = room ? ['-y', 'thinkpool-pair@latest', room] : ['-y', 'thinkpool-pair@latest']
 
   if (platform === 'darwin') {
     const args = [npx, ...pkgArgs, ...tail]   // launchd KeepAlive supervises
@@ -60,7 +75,7 @@ export function buildArtifact(platform, { room, cmdArgs = [] }) {
     const args = [npx, ...pkgArgs, ...tail]   // systemd Restart=always supervises
     const file = path.join(os.homedir(), '.config', 'systemd', 'user', `${label(room)}.service`)
     const content = `[Unit]
-Description=ThinkPool Code bridge (${room})
+Description=ThinkPool Code ${desc}
 After=network-online.target
 
 [Service]
@@ -82,12 +97,15 @@ WantedBy=default.target
   if (platform === 'win32') {
     // No native per-user daemon without extra tooling — a Startup-folder script
     // running --supervise gives login-persistence + crash-restart, dependency-free.
+    // Account mode ignores --supervise (the account supervisor takes over argv),
+    // so it gets login-persistence only — no in-process crash-restart on Windows.
     const startup = path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup')
-    const file = path.join(startup, `thinkpool-pair-${room}.cmd`)
-    // Startup folder isn't a supervisor → keep --supervise for crash-restart.
-    const inner = ['npx', '-y', 'thinkpool-pair@latest', room, '--supervise', ...tail].join(' ')
-    const content = `@echo off\r\ntitle thinkpool-pair ${room}\r\n${inner}\r\n`
-    return { file, content, logDir, post: [], note: 'Installed to the Startup folder — runs at login with --supervise (auto-restart on crash). Start it now without rebooting by double-clicking the .cmd, or run it from a terminal.' }
+    const file = path.join(startup, `thinkpool-pair-${id}.cmd`)
+    const inner = room
+      ? ['npx', '-y', 'thinkpool-pair@latest', room, '--supervise', ...tail].join(' ')
+      : ['npx', '-y', 'thinkpool-pair@latest'].join(' ')
+    const content = `@echo off\r\ntitle thinkpool-pair ${id}\r\n${inner}\r\n`
+    return { file, content, logDir, post: [], note: 'Installed to the Startup folder — runs at login' + (room ? ' with --supervise (auto-restart on crash).' : ' (account mode).') + ' Start it now without rebooting by double-clicking the .cmd, or run it from a terminal.' }
   }
 
   throw new Error(`unsupported platform: ${platform}`)
@@ -104,13 +122,15 @@ export function installService(room, cmdArgs = []) {
   }
   const autoUpdate = process.platform === 'win32'
     ? 'tracks thinkpool-pair@latest — new versions apply on next login/restart.'
-    : 'tracks thinkpool-pair@latest — checks for new versions and self-restarts at the next idle moment (session resumes), no re-install.'
-  process.stderr.write(`  ◆ ${a.note}\n  ◆ ${autoUpdate}\n  ◆ logs: ${path.join(a.logDir, `${room}.log`)}\n  ◆ remove with: thinkpool-pair uninstall-service ${room}\n\n`)
+    : 'tracks thinkpool-pair@latest — checks for new versions and self-restarts at the next idle moment (sessions resume), no re-install.'
+  const removeArg = room ? ` ${room}` : ''
+  const what = room ? `room ${room}` : 'your account (auto-serves every session)'
+  process.stderr.write(`  ◆ ${what}\n  ◆ ${a.note}\n  ◆ ${autoUpdate}\n  ◆ logs: ${path.join(a.logDir, `${slug(room)}.log`)}\n  ◆ remove with: thinkpool-pair uninstall-service${removeArg}\n\n`)
 }
 
-// Is a boot-persistent service already installed for this room? (artifact file
-// present.) Lets the main `npx thinkpool-pair <room>` run skip the offer + avoid
-// starting a second bridge that would race the service on the same room.
+// Is a boot-persistent service already installed? (artifact file present.)
+// room falsy → checks the ACCOUNT service. Lets the main run skip the offer +
+// avoid starting a second bridge that would race the service.
 export function isServiceInstalled(room) {
   try { return fs.existsSync(buildArtifact(process.platform, { room }).file) } catch { return false }
 }