thinkpool-pair 0.7.146 → 0.7.148

package/account.mjs

@@ -308,28 +308,49 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
   // don't subscribe to this event, so the dashboard button is a harmless no-op there.
   acct.on('broadcast', { event: 'restart' }, () => {
-    const supervised = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
-    process.stderr.write('\n  ◇ restart requested from the dashboard — bouncing bridge (sessions resume).\n')
     restarting = true
-    setTimeout(() => {
+    // The dashboard "Restart bridge" button ALSO updates to the newest published version
+    // (Max, 2026-07-03). If an OS service manages this bridge, spawn a DETACHED updater
+    // that re-pins the service to @latest and reloads it (install-service resolves the
+    // newest version → rewrites the plist/unit → bootout+bootstrap). Detached → its own
+    // session, so it SURVIVES this process being booted out (the reload kills us); it
+    // inherits our env, whose PATH carries nvm's bin, so npx/node resolve — a bare launchd
+    // PATH would NOT (the 2026-07-03 gotcha that made a manual updater silently no-op).
+    // The reload IS the bounce; sessions resume from disk on the new version. Best-effort:
+    // if there's no service or npm is unreachable, we fall through to the plain bounce, so
+    // the button is never dead — and even a failed update degrades to today's behaviour.
+    const plainBounce = (delay) => setTimeout(() => {
       try { releaseSingleton() } catch { /* noop */ }
-      // A SUPERVISED bridge (launchd KeepAlive / systemd Restart=always / the
-      // bridge.mjs --supervise wrapper) is respawned by its supervisor on exit, so a
-      // bare exit(1) bounces cleanly. A plain FOREGROUND bridge has NO supervisor —
-      // there exit = death and the dashboard "Restart" becomes a footgun (2026-06-25:
-      // Max's manual `npx thinkpool-pair` died on Restart and never came back). So when
-      // unsupervised, re-spawn ourselves DETACHED *after* releasing the machine lock
-      // (the child's acquireSingleton() then sees no live owner and takes it). The child
-      // has no TTY → bridge.mjs routes a bare invocation straight to account mode. Gated
-      // on `supervised` so we never double-spawn (supervisor + self) into two bridges.
-      if (!supervised) {
-        try {
-          spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref()
-        } catch { /* respawn failed → exit anyway, no worse than the old behaviour */ }
+      // Unsupervised FOREGROUND bridge (no launchd/systemd) → re-spawn ourselves DETACHED
+      // after releasing the lock, so "Restart" isn't a footgun that never comes back
+      // (2026-06-25). A supervised bridge is respawned by its supervisor on exit(1).
+      if (process.env.THINKPOOL_PAIR_AUTOUPDATE !== '1') {
+        try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
       }
       process.exit(1)
-    }, 2500)
-    process.kill(process.pid, 'SIGTERM')
+    }, delay)
+    ;(async () => {
+      let updating = false
+      try {
+        const svc = await import('./service.mjs')
+        if (svc.serviceActive(null)) {
+          spawn('npx', ['-y', 'thinkpool-pair@latest', 'install-service'], { detached: true, stdio: 'ignore', env: process.env }).unref()
+          updating = true
+        }
+      } catch { /* no service / spawn failed → plain bounce below */ }
+      process.stderr.write(updating
+        ? '\n  ◇ update + restart requested from the dashboard — pulling the newest bridge and reloading; sessions resume.\n'
+        : '\n  ◇ restart requested from the dashboard — bouncing bridge (sessions resume).\n')
+      if (updating) {
+        // The updater's bootout replaces us (single clean bounce). Long backstop: if the
+        // update never lands (npm down / install failed), bounce the current version so the
+        // button isn't dead — the updater normally boots us out well before this fires.
+        plainBounce(60000)
+        return
+      }
+      plainBounce(2500)
+      process.kill(process.pid, 'SIGTERM')
+    })()
   })
   // Throttled so a realtime reconnect storm can't machine-gun track() into the
   // per-client presence rate limit (ClientPresenceRateLimitReached → channel closed

package/bridge.mjs

@@ -534,7 +534,7 @@ function readBranch() {
 // announced `updir` without waiting on this round-trip. Spec:
 // docs/specs/2026-06-11-code-file-drop.md
 const UPDIR = path.join(os.tmpdir(), 'thinkpool-pair', room)
-const FILE_MAX_BYTES = 10 * 1024 * 1024
+const FILE_MAX_BYTES = 25 * 1024 * 1024   // must match web FILE_MB + bucket file_size_limit (25 MB) — see src/pages/code/code-constants.js
 const safeName = (n) => String(n || 'file').replace(/[^a-zA-Z0-9._-]/g, '_').slice(-80)
 
 const supabase = createClient(SUPABASE_URL, SUPABASE_ANON, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.146",
+  "version": "0.7.148",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {