thinkpool-pair 0.7.172 → 0.7.174

package/account.mjs

@@ -15,7 +15,7 @@ import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
 import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
-import { makeThrottledTrack } from './presence.mjs'
+import { makeThrottledTrack, presenceSelfEchoVerdict } from './presence.mjs'
 import { publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
 import { supervisorServes } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
@@ -386,9 +386,21 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // ThinkPool nothing; there's no cost reason to refuse a free host.
 
   const DEFAULT_DIR = process.cwd()   // unbound sessions auto-serve here; `bind` overrides per session
+  // Ground truth for "am I the managed service": ask the service manager, not the
+  // THINKPOOL_PAIR_AUTOUPDATE env proxy. Since pinned installs became the default,
+  // the plist/unit sets AUTOUPDATE only when --auto-update was passed — the env var
+  // now means "track @latest", NOT "I'm the service". Testing the env alone made a
+  // pinned managed service (a) announce service:false → dashboard says "foreground",
+  // and (b) skip the uninstall on a dashboard Kill → launchd respawns the "killed"
+  // bridge ~2s later (the 2026-06-18 zombie-toggle, reintroduced by pinning).
+  let isManagedService = false
+  try { const svc = await import('./service.mjs'); isManagedService = svc.serviceActive(null) } catch { /* not installed */ }
+  const runsAsService = () => process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' || isManagedService
   const svcHint = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
     ? '    (auto-updating background service — survives reboot, tracks @latest)\n'
-    : '    (run hands-off + auto-updating: npx thinkpool-pair install-service)\n'
+    : isManagedService
+      ? '    (background service — survives reboot, restarts on crash, pinned to this version)\n'
+      : '    (run hands-off + auto-updating: npx thinkpool-pair install-service)\n'
   const _effDefault = loadDefaultDir() || claudeRecentProjectDir() || DEFAULT_DIR
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    New sessions auto-serve from ${_effDefault}${loadDefaultDir() ? ' (your default)' : (claudeRecentProjectDir() ? ' (your most-recent Claude Code project)' : '')}\n    (change it: npx thinkpool-pair set-default-dir <dir>  ·  one room: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
@@ -463,7 +475,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     // restart), force the process down and release the lock so a fresh bridge
     // can take over. NOT unref'd: it must keep the loop alive until it fires.
     setTimeout(() => { try { releaseSingleton() } catch { /* noop */ } process.exit(0) }, 2500)
-    if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1') {
+    if (runsAsService()) {
       try { const svc = await import('./service.mjs'); svc.uninstallService(null) } catch { /* noop */ }
     }
     process.kill(process.pid, 'SIGTERM')
@@ -493,7 +505,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // Unsupervised FOREGROUND bridge (no launchd/systemd) → re-spawn ourselves DETACHED
       // after releasing the lock, so "Restart" isn't a footgun that never comes back
       // (2026-06-25). A supervised bridge is respawned by its supervisor on exit(1).
-      if (process.env.THINKPOOL_PAIR_AUTOUPDATE !== '1') {
+      if (!runsAsService()) {
         try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
       }
       process.exit(1)
@@ -525,11 +537,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // per-client presence rate limit (ClientPresenceRateLimitReached → channel closed
   // → dashboard reads "no bridge" while sessions run; 2026-06-17/-22/-24). The 15s
   // tick + token-refresh callers are unaffected (their interval exceeds the window).
-  const trackPresence = makeThrottledTrack(acct, { minMs: 5000 })
+  // lastTrackStatus retains the most recent track()'s server verdict ('ok'|'timed out'|
+  // 'error') so the presence self-echo watchdog can log WHY presence went dark.
+  let lastTrackStatus = 'init'
+  const trackPresence = makeThrottledTrack(acct, { minMs: 5000, onStatus: (s) => { lastTrackStatus = s } })
   // `service` lets the dashboard show whether this bridge is the durable installed
   // service (always-on, survives reboot) vs a foreground `npx` run that dies with its
-  // terminal. THINKPOOL_PAIR_AUTOUPDATE=1 is set ONLY by the install-service plist/unit
-  // (service.mjs), so it's the reliable proxy for "running as the managed service".
+  // terminal — runsAsService() above (service-manager ground truth, not the env proxy).
   // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), generated +
   // persisted 0600 on first read. The dashboard imports it to SEAL a provider's API
   // key so it reaches the bridge without ever crossing the wire in the clear. Computed
@@ -538,7 +552,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // to spawn against — re-read each announce so an add/remove reflects immediately.
   // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
   const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: process.env.THINKPOOL_PAIR_AUTOUPDATE === '1', providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), ts: Date.now() })
 
   // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
   // AUTH: the account channel `tpacct:<uid>` is created WITHOUT config.private:true,
@@ -625,6 +639,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // detect a wedged loop and self-heal — the 2026-07-08 outage stood by against its OWN
   // 564s-stale row because the tick had frozen and the heartbeat simply stopped.
   let lastClaimOkAt = Date.now()
+  // Presence self-echo watchdog state (2026-07-08 recurrence). claim_bridge rides HTTP and
+  // stays healthy, so claimLoopWedged is blind to a zombie realtime channel where track()
+  // lands nowhere. The server's presence SYNC echoing OUR OWN `machine` key back into
+  // acct.presenceState() is the only proof a track() actually reached the server.
+  let selfEchoMissingSince = 0        // wall-clock we first saw our own key missing (0 = present/ok)
+  let presenceRecycledForMissing = 0  // de-dupe: the missing-since value we already forced a recycle for
   const refreshClaim = async () => {
     try {
       // Time-box the RPC: a half-open realtime socket must not freeze the heartbeat (and
@@ -981,6 +1001,44 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     try { await refreshClaim(); pushPresence() } catch { /* the next tick retries */ }
   }, 20_000)
   heartbeatWatch.unref?.()
+
+  // ── presence self-echo watchdog (2026-07-08) ───────────────────────────────
+  // The claim heartbeat rides claim_bridge (plain HTTP) so it recovers even while the
+  // realtime socket is a zombie — which is exactly why claimLoopWedged can't see the case
+  // where the socket went CLOSED-then-half-open and channel.track() lands nowhere FOREVER,
+  // leaving the dashboard on "No bridge connected" while children serve rooms. The server's
+  // presence SYNC is the only proof: if our own `machine` key is absent from
+  // acct.presenceState() while we hold the claim, the track never reached the server. Runs on
+  // its OWN interval (like the claim watchdog) so a wedged tick can't starve it. Two-stage
+  // escalation via the pure predicate:
+  //   ≥~60s missing → recycle the realtime socket (full disconnect+connect — the connect()-only
+  //                   nudge already in the subscribe/CLOSED handlers provably didn't recover it)
+  //   ≥~90s more    → exit(1); launchd KeepAlive / systemd reruns clean, children persist and
+  //                   resume from the session-store (the same invisible bounce the dashboard
+  //                   Restart button already relies on). Guarded: never while stopping, only
+  //                   while claimHeld (a standby bridge doesn't track).
+  const presenceWatch = setInterval(() => {
+    if (stopping) return
+    const now = Date.now()
+    let present = false
+    try { present = !!acct.presenceState?.()[machine] } catch { present = false }
+    if (present) { selfEchoMissingSince = 0; presenceRecycledForMissing = 0; return }
+    if (!claimHeld) { selfEchoMissingSince = 0; return }   // a standby bridge doesn't announce — never escalate
+    if (!selfEchoMissingSince) selfEchoMissingSince = now
+    const verdict = presenceSelfEchoVerdict({ tracking: claimHeld, selfEchoMissingSince, now })
+    if (verdict === 'recycle') {
+      if (presenceRecycledForMissing === selfEchoMissingSince) return   // already recycled this episode — wait out the respawn window
+      presenceRecycledForMissing = selfEchoMissingSince
+      console.log(`presence_watchdog sup=${SUP_ID} action=recycle missing_ms=${now - selfEchoMissingSince} track=${lastTrackStatus} — full realtime disconnect+reconnect`)
+      try { sb.realtime?.disconnect?.() } catch { /* noop */ }
+      try { sb.realtime?.connect?.() } catch { /* noop */ }
+      try { pushPresence() } catch { /* re-announced on the next SUBSCRIBED too */ }
+    } else if (verdict === 'respawn') {
+      console.log(`presence_watchdog sup=${SUP_ID} action=respawn missing_ms=${now - selfEchoMissingSince} track=${lastTrackStatus} — recycle failed, exiting for a clean supervisor respawn`)
+      process.exit(1)
+    }
+  }, 15_000)
+  presenceWatch.unref?.()
   // restart-vs-stop is the ONLY difference in exit code: a web "restart" sets this so
   // we exit non-zero (every supervisor respawns); a normal stop/shutdown exits 0.
   const stop = (sig) => {
@@ -991,6 +1049,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.log(`supervisor_stop sup=${SUP_ID} reason=${sig || 'unknown'} restarting=${restarting} children=${children.size}`)
     clearInterval(iv)
     clearInterval(heartbeatWatch)
+    clearInterval(presenceWatch)
     for (const t of updateTimers) { try { clearInterval(t) } catch { /* noop */ } }   // clearInterval clears Timeouts too
     keepFresh.cancel()
     releaseSingleton()

package/launcher.mjs

@@ -119,6 +119,8 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     io.print('  ' + C.dim('└' + '─'.repeat(54)) + '\n')
   }
 
+  // KEPT for the `npx thinkpool-pair <ROOM>` argv path (bridge.mjs) — no longer a main-menu
+  // item (single-session serve was retired), but the helper stays so nothing else breaks.
   const pairRoom = async () => {
     const room = (await io.ask(`\n  Room code ${C.dim('(from /code in the web app)')} ${C.cyan('▸')} `)).toUpperCase().trim()
     if (!room) { io.print('  ' + C.yellow('no room — back to menu')); return }
@@ -135,39 +137,15 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     await actions.pairRoom({ room, agentCmd: agent.cmd, resumeArgs: cont ? agent.resume : [], headless })
   }
 
-  const serveAccount = async () => {
-    if (!state.loggedIn) {
-      io.print('\n  ' + C.yellow('You are not linked to a ThinkPool account yet.'))
-      if (await askYesNo('  Link this device now?', true)) await actions.login()
-      return
-    }
-    io.print(`\n  Serving every session you host, from ${C.dim(state.cwd)}.\n`)
-    const how = await askChoice('run it', [
-      { label: 'As an always-on background service', hint: 'recommended — survives reboot, restarts on crash' },
-      { label: 'Here in this terminal (foreground)', hint: 'stops when you close it' },
-      { label: '← Back to main menu', hint: '' },
-    ])
-    if (how === 2) return
-    if (how === 1) { await actions.serveAccountForeground(); return }
-    // how === 0 — always-on durable OS service (launchd / systemd / Windows Startup).
-    await actions.installService({ room: null }); resync()
-  }
-
-  const serviceMenu = async () => {
-    const what = await askChoice('install for', [
-      { label: 'All my sessions (account)', hint: state.loggedIn ? '' : 'needs login first' },
-      { label: 'One specific room', hint: 'no login needed' },
-      { label: '← Back to main menu', hint: '' },
-    ])
-    if (what === 2) return
-    if (what === 0) {
-      if (!state.loggedIn) { io.print('\n  ' + C.yellow('Account service needs a login first (pick “Serve all my sessions”).')); return }
-      await actions.installService({ room: null }); resync(); return
-    }
-    const room = (await io.ask(`\n  Room code ${C.dim('(blank to go back)')} ${C.cyan('▸')} `)).toUpperCase().trim()
-    if (!room) { io.print('  ' + C.yellow('no room — back to menu')); return }
-    const agent = state.agents[0] || { cmd: 'claude' }
-    await actions.installService({ room, agentCmd: agent.cmd }); resync()
+  // Login gate shared by both "serve" paths (foreground + install service). Both serve
+  // EVERY hosted session, so both require an account link first. Returns true only once
+  // logged in — offers to link on the spot, re-reads disk, and refuses to serve if still not.
+  const ensureLoggedIn = async () => {
+    if (state.loggedIn) return true
+    io.print('\n  ' + C.yellow('You are not linked to a ThinkPool account yet.'))
+    if (await askYesNo('  Link this device now?', true)) { await actions.login(); resync() }
+    if (!state.loggedIn) { io.print('  ' + C.yellow('login needed to serve your sessions — back to menu')); return false }
+    return true
   }
 
   const providerMenu = async () => {
@@ -249,29 +227,34 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
   }
 
   // ── menu loop ──
-  // pairRoom re-execs + waits, and account-foreground runs forever, so those choices
-  // never return here. Everything else (install / restart / uninstall / settings /
-  // provider) does its work, prints its notes, and RETURNS — so the loop always drops
-  // you back at the menu. Submenus carry a "← Back" so you can bail at any point. The
-  // trailing "press Enter" lands on every returning path.
+  // account-foreground runs forever, so that choice never returns here. Everything else
+  // (install / restart / uninstall / settings / provider) does its work, prints its notes,
+  // and RETURNS — so the loop always drops you back at the menu. The trailing "press Enter"
+  // lands on every returning path. Slots 1+2 are the ONLY two things this device does:
+  // before a service exists → the two ways to start serving all your sessions; once the
+  // service exists → maintain it (update/restart or remove). No single-room / per-room
+  // serve is offered anymore (that was `npx thinkpool-pair <ROOM>`, still on the argv path).
   for (;;) {
     header()
     io.print('  ' + C.bold('What do you want to do?') + '\n')
-    // Built per-render so the contextual "Restart" only shows once a service exists.
-    const items = [
-      { key: 'pair',    label: 'Pair one room now', hint: 'run here, Ctrl-C stops it' },
-      { key: 'serve',   label: 'Serve all my sessions', hint: 'account mode — needs login' },
-      { key: 'service', label: 'Always-on background service', hint: 'survives reboot, restarts on crash' },
-    ]
-    if (state.accountSvc) items.push({ key: 'restart', label: 'Restart & update the bridge', hint: 'pull the newest version + restart — sessions resume' })
+    // Slots 1+2 swap on whether the always-on service is already installed.
+    const items = state.accountSvc
+      ? [
+          { key: 'restart',   label: 'Restart & update the bridge', hint: 'pull the newest version + restart — sessions resume' },
+          { key: 'uninstall', label: 'Remove background service', hint: 'stop serving your sessions on this device' },
+        ]
+      : [
+          { key: 'serve',   label: 'Serve all my sessions', hint: 'runs here, Ctrl-C stops it' },
+          { key: 'service', label: 'Always-on background service', hint: 'recommended — survives reboot, restarts on crash' },
+        ]
     items.push({ key: 'settings', label: 'Settings', hint: 'provider · account · restart · remove service' })
     items.push({ key: 'quit', label: 'Quit', hint: '' })
     const pick = items[await askChoice('choose', items)]
     if (pick.key === 'quit') return
-    if (pick.key === 'pair') await pairRoom()
-    else if (pick.key === 'serve') await serveAccount()
-    else if (pick.key === 'service') await serviceMenu()
+    if (pick.key === 'serve') { if (await ensureLoggedIn()) await actions.serveAccountForeground() }
+    else if (pick.key === 'service') { if (await ensureLoggedIn()) { await actions.installService({ room: null }); resync() } }
     else if (pick.key === 'restart') { await actions.restartUpdateService({ room: null }); resync() }
+    else if (pick.key === 'uninstall') { await actions.uninstallService({ room: null }); resync() }
     else if (pick.key === 'settings') await settingsMenu()
     await io.ask('\n  ' + C.dim('press Enter to return to the menu…'))
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.172",
+  "version": "0.7.174",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/presence.mjs

@@ -27,16 +27,23 @@
 // channel: a supabase RealtimeChannel (stable across reconnects — supabase-js
 // rejoins the same object, so channel.track stays valid). Returns a function you
 // call with the presence payload anywhere you'd have called channel.track(payload).
-export function makeThrottledTrack(channel, { minMs = 5000 } = {}) {
+// onStatus (optional): called with each track()'s server status ('ok' | 'timed out' |
+// 'error') so a caller can retain the last one for a postmortem log line. Best-effort —
+// a track that throws reports 'error' and never breaks the caller.
+export function makeThrottledTrack(channel, { minMs = 5000, onStatus = null } = {}) {
   let last = 0
   let timer = null
   let pending = null
-  const fire = () => {
+  const fire = async () => {
     timer = null
     last = Date.now()
     const payload = pending
     pending = null
-    try { channel.track(payload) } catch { /* presence track is best-effort */ }
+    // Await the track so we can retain its status for the next postmortem. fire() is never
+    // awaited by callers, so this stays fire-and-forget — the await only sequences the
+    // onStatus callback; it never blocks a caller and a rejection can't escape (caught here).
+    try { const status = await channel.track(payload); onStatus?.(status ?? 'ok') }
+    catch { onStatus?.('error') /* presence track is best-effort */ }
   }
   return (payload) => {
     pending = payload
@@ -49,3 +56,37 @@ export function makeThrottledTrack(channel, { minMs = 5000 } = {}) {
     }
   }
 }
+
+/* ─────────────────────────────────────────────────────────────
+   presenceSelfEchoVerdict — the pure trigger for the account
+   supervisor's presence self-echo watchdog (2026-07-08 recurrence).
+
+   The failure it catches: the supervisor is alive, its claim is held
+   (claim_bridge is a plain HTTP RPC, so it stays healthy), children
+   serve rooms — yet an anonymous probe of tpacct shows ZERO presence
+   keys. After a `realtime CLOSED` blip the channel goes zombie and
+   channel.track() lands nowhere, forever. The claim watchdog
+   (claimLoopWedged) can't see this — the claim rides HTTP, not the
+   socket. The server's presence SYNC is the only proof: if OUR OWN
+   key is absent from acct.presenceState() while we're tracking and
+   hold the claim, the track never reached the server.
+
+   Given how long our key has been missing (now - selfEchoMissingSince),
+   escalate in two stages:
+     missing < graceMs                     → 'ok'      (normal; a fresh track takes a beat to echo)
+     graceMs ≤ missing < graceMs+respawnMs → 'recycle' (force a full realtime disconnect+reconnect)
+     missing ≥ graceMs + respawnMs         → 'respawn' (recycle didn't take → exit; supervisor reruns clean)
+
+   selfEchoMissingSince is 0/null whenever our key is present OR we're
+   not tracking; the caller stamps it the first tick the key goes
+   missing and clears it the first tick it returns. Extracted + exported
+   so the watchdog's trigger is unit-testable without a live socket
+   (mirrors claimLoopWedged). Deterministic in `now` — no Date.now here.
+   ───────────────────────────────────────────────────────────── */
+export function presenceSelfEchoVerdict({ tracking, selfEchoMissingSince, now, graceMs = 60_000, respawnMs = 90_000 }) {
+  if (!tracking || !selfEchoMissingSince) return 'ok'
+  const missingMs = now - selfEchoMissingSince
+  if (missingMs >= graceMs + respawnMs) return 'respawn'
+  if (missingMs >= graceMs) return 'recycle'
+  return 'ok'
+}