thinkpool-pair 0.7.15 → 0.7.17

package/account.mjs

@@ -13,12 +13,52 @@ import path from 'node:path'
 import fs from 'node:fs'
 import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
-import { saveAuth, loadAuth, clearAuth, loadDirs, bindDir } from './auth-store.mjs'
+import { saveAuth, loadAuth, loadDirs, bindDir } from './auth-store.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
 const BRIDGE = fileURLToPath(new URL('./bridge.mjs', import.meta.url))
 
+// ── single-instance lock ────────────────────────────────────────────────────
+// Two account supervisors on one machine share ONE ~/.thinkpool-pair/auth.json
+// refresh token and race its rotation — which on 2026-06-17 deleted a live Pro
+// login mid-session. The account supervisor is single-instance by nature; this
+// pidfile lock refuses a second one. Acquired BEFORE auth so two can't both hit
+// the refresh path. Exported for the test harness.
+const LOCK = path.join(os.homedir(), '.thinkpool-pair', 'account.lock')
+
+// True if `pid` is a live process (EPERM = exists but not ours; ESRCH = gone).
+function pidAlive(pid) {
+  if (!pid || pid === process.pid) return false
+  try { process.kill(pid, 0); return true } catch (e) { return e.code === 'EPERM' }
+}
+
+// Returns true if we now hold the lock, false if another LIVE supervisor holds it.
+// A stale lock (holder dead / garbage / ours) is taken over. fs errors fail-OPEN
+// (return true) — a lock we can't manage must never block the real bridge.
+export function acquireSingleton(lockPath = LOCK) {
+  try { fs.mkdirSync(path.dirname(lockPath), { recursive: true }) } catch { /* noop */ }
+  for (let i = 0; i < 3; i++) {
+    try {
+      const fd = fs.openSync(lockPath, 'wx')        // atomic create-exclusive
+      fs.writeSync(fd, String(process.pid)); fs.closeSync(fd)
+      return true
+    } catch (e) {
+      if (e.code !== 'EEXIST') return true           // can't create for another reason → fail open
+      let pid = 0
+      try { pid = parseInt(fs.readFileSync(lockPath, 'utf8').trim(), 10) || 0 } catch { /* unreadable */ }
+      if (pidAlive(pid)) return false                // a live supervisor owns it → refuse
+      try { fs.rmSync(lockPath, { force: true }) } catch { return true }   // stale → drop + retry
+    }
+  }
+  return true
+}
+
+// Release only if WE own it (don't unlink a lock another instance took over).
+export function releaseSingleton(lockPath = LOCK) {
+  try { if ((parseInt(fs.readFileSync(lockPath, 'utf8').trim(), 10) || 0) === process.pid) fs.rmSync(lockPath, { force: true }) } catch { /* noop */ }
+}
+
 // ── login: OAuth-style DEVICE-CODE flow (hardened) ──────────────────────────
 // The bridge asks Postgres (start_device_code) for a secret device_code + a short
 // human user_code, prints the user_code + URL, then POLLS claim_device_code with
@@ -76,10 +116,20 @@ export function runBind(room, dir) {
 
 // ── account supervisor: a headless child bridge per bound room, in its dir ──
 export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
+  if (!acquireSingleton()) {
+    console.error('\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    `npx thinkpool-pair <ROOM>`.\n')
+    process.exit(0)
+  }
   const auth = await authedClient(SUPABASE_URL, SUPABASE_ANON)
   if (!auth) {
-    clearAuth()
-    console.error('\n  Not linked (or the link expired). Run:\n\n    npx thinkpool-pair login\n')
+    releaseSingleton()
+    // Do NOT delete auth.json here. A refresh can fail transiently (offline) or
+    // lose a refresh-token rotation race with another bridge sharing this login —
+    // wiping the file on that destroys a still-valid login. Leave it: only an
+    // explicit `login` should ever replace the token (saveAuth overwrites it).
+    // (2026-06-17: a second account supervisor raced the token and the old
+    // clearAuth() here deleted a live Pro login mid-session.)
+    console.error('\n  ◇ Couldn\'t refresh your account session (offline, or another bridge\n    may be using this login). Your saved login was left in place.\n    If this keeps happening, re-link:  npx thinkpool-pair login\n')
     process.exit(1)
   }
   const { sb, session } = auth
@@ -156,6 +206,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const stop = (sig) => {
     if (stopping) return; stopping = true
     clearInterval(iv)
+    releaseSingleton()
     for (const c of children.values()) { try { c.kill(sig || 'SIGTERM') } catch { /* noop */ } }
     // Flush the presence LEAVE before exiting so the dashboard flips to
     // "not connected" in realtime (don't fire-and-forget the untrack).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.15",
+  "version": "0.7.17",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {