thinkpool-pair 0.7.153 → 0.7.154

package/bridge.mjs

@@ -81,7 +81,7 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
+import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, loadSummary, saveSummary } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'
@@ -1593,16 +1593,20 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
+          const now = Date.now()
           const gate = spawnDecision({
             hop: entry.hop || 0,
-            spawnCount: entry.spawnCount || 0,
+            spawnTimes: entry.spawnTimes || [],                                     // sliding-window burst breaker (replenishes on wall-clock, not on a human turn)
+            now,
             spawnedLive: [...sessions.values()].filter((s) => s.spawnedBy).length,  // dispatch budget counts ONLY spawned lanes
             totalLive: sessions.size + terms.size,                                  // machine cap counts everything
             plan: ownerPlan,                                                        // Free 3 / Plus 6 dispatch ceiling
             disabled: process.env.TP_SPAWN_OFF === '1',
           })
           if (!gate.ok) return okText(gate.reason)
-          entry.spawnCount = (entry.spawnCount || 0) + 1
+          // Record this spawn, pruning timestamps that have already left the window
+          // (identical predicate to recentSpawnCount) so the array can't grow unbounded.
+          entry.spawnTimes = [...(entry.spawnTimes || []).filter((t) => Number.isFinite(t) && t > now - SPAWN.windowMs), now]
           const newId = randomUUID()
           const newRef = String(newId).slice(0, 8)
           const fromRef = String(id).slice(0, 8)
@@ -1623,7 +1627,7 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
           if (args?.task) {
             // One hop deep: the spawned lane cannot spawn/post onward until a person
             // speaks to it (code-turn resets hop to 0). Mirrors the Tier C injection.
-            ne.hop = 1; ne.peekCount = 0; ne.postCount = 0; ne.spawnCount = 0
+            ne.hop = 1; ne.peekCount = 0; ne.postCount = 0; ne.spawnTimes = []
             const msg = `[Task from terminal ${fromRef}'s agent — relayed via ThinkPool cross-terminal; you are a fresh lane it opened for you]\n${args.task}`
             const evt = { kind: 'you', text: msg, by: `terminal ${fromRef} (agent)`, crosspost: true }
             stampEvent(evt); pushLog(ne, evt); bcast('code-event', { term: newId, evt })
@@ -2266,7 +2270,7 @@ channel
     s.postCount = 0
     s.pairPeekCount = 0   // cross-room read budget resets with the in-room ones (Tier 1)
     s.crossRoomPostCount = 0   // Tier 3 cross-room post budget resets on a real human turn
-    s.spawnCount = 0   // EN-M3 — spawn budget MUST reset too, else turn 2+ can never spawn a lane
+    s.spawnTimes = []  // EN-M3 — a real human turn clears the spawn burst window instantly (the window also self-replenishes on wall-clock for UNATTENDED cascades that never reach this handler)
     s.hop = 0
     s.roomHop = 0   // a human turn is room-hop 0 — clears any injected cross-room hop depth
     const text = String(payload.text)

package/cross-terminal.mjs

@@ -227,15 +227,25 @@ export const crossPostNeedsCard = ({ mode = 'default', spawnedByMe = false } = {
 //     own terminals, and the human's terminals never eat the dispatch budget. Under
 //     BYOK-only the tokens are the user's, so this is feature-shaping + machine
 //     safety, NOT a ThinkPool-COGS control.
-//   • perTurnCap — a per-turn runaway breaker (mirrors PEEK/CROSSPOST)
+//   • burst window — a SLIDING-window runaway breaker: ≤ perWindowCap spawns per
+//     rolling windowMs. Replaces the old per-HUMAN-turn cap, which starved an
+//     UNATTENDED conductor: agent turns woken by Monitor/task notifications never
+//     traverse the 'code-turn' handler that reset the per-turn counter, so a cascade
+//     that spent its 4 spawns could NEVER spawn again until a person typed. The
+//     window replenishes on wall-clock alone — no turn boundary required — while a
+//     real human turn still clears it instantly (the reset point is unchanged).
 // The caller measures: spawnedLive (live sessions with spawnedBy set), totalLive
-// (sessions.size + terms.size), and resolves `plan` from the room owner.
+// (sessions.size + terms.size), resolves `plan` from the room owner, and passes the
+// lane's recent spawn timestamps (`spawnTimes`) plus the current clock (`now`) — so
+// this stays a PURE function (no Date.now inside; the clock is injected, like
+// spawnCount was before).
 export const SPAWN = {
-  maxHop: 1,            // human turn = hop 0; a spawned/injected lane = hop ≥ 1, CANNOT spawn onward
-  perTurnCap: 4,        // spawn_terminal calls allowed per turn
-  freeMaxSpawned: 3,    // Free plan dispatch ceiling (concurrent spawned lanes)
-  plusMaxSpawned: 6,    // Plus plan dispatch ceiling
-  machineMax: 10,       // hard cap on TOTAL live lanes (the laptop/runaway backstop)
+  maxHop: 1,               // human turn = hop 0; a spawned/injected lane = hop ≥ 1, CANNOT spawn onward
+  perWindowCap: 4,         // spawn_terminal calls allowed per rolling window (burst breaker)
+  windowMs: 10 * 60 * 1000, // sliding window over which perWindowCap applies (10 min)
+  freeMaxSpawned: 3,       // Free plan dispatch ceiling (concurrent spawned lanes)
+  plusMaxSpawned: 6,       // Plus plan dispatch ceiling
+  machineMax: 10,          // hard cap on TOTAL live lanes (the laptop/runaway backstop)
 }
 
 // Plan → dispatch ceiling. Anything not 'plus' is treated as Free (the safe default).
@@ -244,14 +254,24 @@ export const maxSpawnedFor = (plan, limits = SPAWN) => {
   return plan === 'plus' ? o.plusMaxSpawned : o.freeMaxSpawned
 }
 
-export const spawnDecision = ({ hop = 0, spawnCount = 0, spawnedLive = 0, totalLive = 0, plan = 'free', disabled = false } = {}, limits = SPAWN) => {
+// Count spawn timestamps still inside the sliding window ending at `now`. Timestamps
+// strictly older than `now - windowMs` have replenished (fallen out of the window).
+// Non-finite entries are ignored defensively. Exported so the bridge can prune its
+// stored spawnTimes with the identical predicate (no unbounded growth).
+export const recentSpawnCount = (spawnTimes, now, windowMs = SPAWN.windowMs) =>
+  (Array.isArray(spawnTimes) ? spawnTimes : []).filter((t) => Number.isFinite(t) && t > now - windowMs).length
+
+export const spawnDecision = ({ hop = 0, spawnTimes = [], now = 0, spawnedLive = 0, totalLive = 0, plan = 'free', disabled = false } = {}, limits = SPAWN) => {
   const o = { ...SPAWN, ...(limits || {}) }
   if (disabled) return { ok: false, reason: 'Spawning terminals is disabled in this room.' }
   if (hop >= o.maxHop) return { ok: false, reason: 'Spawn limit reached — a terminal reached via cross-terminal cannot itself open further terminals; a person must open the next lane.' }
   if (totalLive >= o.machineMax) return { ok: false, reason: `Room is at the machine cap (${o.machineMax} live lanes) — close one before opening another.` }
   const cap = maxSpawnedFor(plan, o)
   if (spawnedLive >= cap) return { ok: false, reason: `Dispatch ceiling reached (${cap} lane${cap === 1 ? '' : 's'} on the ${plan} plan)${plan !== 'plus' ? ` — Plus raises it to ${o.plusMaxSpawned}.` : '.'} Close a dispatched lane to open another.` }
-  if (spawnCount >= o.perTurnCap) return { ok: false, reason: `Spawn limit reached for this turn (${o.perTurnCap}).` }
+  if (recentSpawnCount(spawnTimes, now, o.windowMs) >= o.perWindowCap) {
+    const mins = Math.round(o.windowMs / 60000)
+    return { ok: false, reason: `Spawn burst limit reached (${o.perWindowCap} in ${mins} min) — this replenishes as the window slides forward, or instantly when a person types into this lane.` }
+  }
   return { ok: true }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.153",
+  "version": "0.7.154",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {