thinkpool-pair 0.7.173 → 0.7.175

package/account.mjs

@@ -386,9 +386,21 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // ThinkPool nothing; there's no cost reason to refuse a free host.
 
   const DEFAULT_DIR = process.cwd()   // unbound sessions auto-serve here; `bind` overrides per session
+  // Ground truth for "am I the managed service": ask the service manager, not the
+  // THINKPOOL_PAIR_AUTOUPDATE env proxy. Since pinned installs became the default,
+  // the plist/unit sets AUTOUPDATE only when --auto-update was passed — the env var
+  // now means "track @latest", NOT "I'm the service". Testing the env alone made a
+  // pinned managed service (a) announce service:false → dashboard says "foreground",
+  // and (b) skip the uninstall on a dashboard Kill → launchd respawns the "killed"
+  // bridge ~2s later (the 2026-06-18 zombie-toggle, reintroduced by pinning).
+  let isManagedService = false
+  try { const svc = await import('./service.mjs'); isManagedService = svc.serviceActive(null) } catch { /* not installed */ }
+  const runsAsService = () => process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' || isManagedService
   const svcHint = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
     ? '    (auto-updating background service — survives reboot, tracks @latest)\n'
-    : '    (run hands-off + auto-updating: npx thinkpool-pair install-service)\n'
+    : isManagedService
+      ? '    (background service — survives reboot, restarts on crash, pinned to this version)\n'
+      : '    (run hands-off + auto-updating: npx thinkpool-pair install-service)\n'
   const _effDefault = loadDefaultDir() || claudeRecentProjectDir() || DEFAULT_DIR
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    New sessions auto-serve from ${_effDefault}${loadDefaultDir() ? ' (your default)' : (claudeRecentProjectDir() ? ' (your most-recent Claude Code project)' : '')}\n    (change it: npx thinkpool-pair set-default-dir <dir>  ·  one room: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
@@ -463,7 +475,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     // restart), force the process down and release the lock so a fresh bridge
     // can take over. NOT unref'd: it must keep the loop alive until it fires.
     setTimeout(() => { try { releaseSingleton() } catch { /* noop */ } process.exit(0) }, 2500)
-    if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1') {
+    if (runsAsService()) {
       try { const svc = await import('./service.mjs'); svc.uninstallService(null) } catch { /* noop */ }
     }
     process.kill(process.pid, 'SIGTERM')
@@ -493,7 +505,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // Unsupervised FOREGROUND bridge (no launchd/systemd) → re-spawn ourselves DETACHED
       // after releasing the lock, so "Restart" isn't a footgun that never comes back
       // (2026-06-25). A supervised bridge is respawned by its supervisor on exit(1).
-      if (process.env.THINKPOOL_PAIR_AUTOUPDATE !== '1') {
+      if (!runsAsService()) {
         try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
       }
       process.exit(1)
@@ -531,8 +543,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const trackPresence = makeThrottledTrack(acct, { minMs: 5000, onStatus: (s) => { lastTrackStatus = s } })
   // `service` lets the dashboard show whether this bridge is the durable installed
   // service (always-on, survives reboot) vs a foreground `npx` run that dies with its
-  // terminal. THINKPOOL_PAIR_AUTOUPDATE=1 is set ONLY by the install-service plist/unit
-  // (service.mjs), so it's the reliable proxy for "running as the managed service".
+  // terminal — runsAsService() above (service-manager ground truth, not the env proxy).
   // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), generated +
   // persisted 0600 on first read. The dashboard imports it to SEAL a provider's API
   // key so it reaches the bridge without ever crossing the wire in the clear. Computed
@@ -541,7 +552,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // to spawn against — re-read each announce so an add/remove reflects immediately.
   // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
   const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: process.env.THINKPOOL_PAIR_AUTOUPDATE === '1', providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), ts: Date.now() })
 
   // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
   // AUTH: the account channel `tpacct:<uid>` is created WITHOUT config.private:true,
@@ -583,6 +594,18 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     provReply('providers-list-res', { nonce, ok: true, providers: listProviders() })
   })
 
+  // ENABLE presence delivery + the self-echo's ground truth. supabase-js only asks
+  // the server for presence state when a presence callback is bound at join time —
+  // with no listener, presenceState() stays {} FOREVER even while our own track()
+  // lands fine. That blind spot made the 0.7.174 self-echo watchdog false-positive
+  // respawn the supervisor every ~2.5 min ("the bridge disconnects and reconnects
+  // randomly", 2026-07-09 — nine respawns in an hour, track=ok on every one).
+  // Binding sync does two jobs: turns presence delivery ON (the echo becomes real)
+  // and stamps presenceSyncSeenAt — the watchdog's fail-safe (no proven delivery →
+  // no escalation, ever). Proof: /tmp echo-proof (no listener → {}, listener → key).
+  let presenceSyncSeenAt = 0
+  acct.on('presence', { event: 'sync' }, () => { presenceSyncSeenAt = Date.now() })
+
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
@@ -1009,6 +1032,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const presenceWatch = setInterval(() => {
     if (stopping) return
     const now = Date.now()
+    // FAIL-SAFE: escalation requires PROVEN presence delivery on this channel (≥1
+    // sync ever received). An empty presenceState() without it means WE can't see —
+    // not that the track failed; respawning on that is the 0.7.174 false-positive
+    // loop. A real zombie (the bug this watchdog exists for) still escalates:
+    // delivery was proven earlier, then our key vanished from the server's state.
+    if (!presenceSyncSeenAt) { selfEchoMissingSince = 0; return }
     let present = false
     try { present = !!acct.presenceState?.()[machine] } catch { present = false }
     if (present) { selfEchoMissingSince = 0; presenceRecycledForMissing = 0; return }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.173",
+  "version": "0.7.175",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {