thinkpool-pair 0.7.174 → 0.7.176

package/account.mjs

@@ -594,6 +594,18 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     provReply('providers-list-res', { nonce, ok: true, providers: listProviders() })
   })
 
+  // ENABLE presence delivery + the self-echo's ground truth. supabase-js only asks
+  // the server for presence state when a presence callback is bound at join time —
+  // with no listener, presenceState() stays {} FOREVER even while our own track()
+  // lands fine. That blind spot made the 0.7.174 self-echo watchdog false-positive
+  // respawn the supervisor every ~2.5 min ("the bridge disconnects and reconnects
+  // randomly", 2026-07-09 — nine respawns in an hour, track=ok on every one).
+  // Binding sync does two jobs: turns presence delivery ON (the echo becomes real)
+  // and stamps presenceSyncSeenAt — the watchdog's fail-safe (no proven delivery →
+  // no escalation, ever). Proof: /tmp echo-proof (no listener → {}, listener → key).
+  let presenceSyncSeenAt = 0
+  acct.on('presence', { event: 'sync' }, () => { presenceSyncSeenAt = Date.now() })
+
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
@@ -1020,6 +1032,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const presenceWatch = setInterval(() => {
     if (stopping) return
     const now = Date.now()
+    // FAIL-SAFE: escalation requires PROVEN presence delivery on this channel (≥1
+    // sync ever received). An empty presenceState() without it means WE can't see —
+    // not that the track failed; respawning on that is the 0.7.174 false-positive
+    // loop. A real zombie (the bug this watchdog exists for) still escalates:
+    // delivery was proven earlier, then our key vanished from the server's state.
+    if (!presenceSyncSeenAt) { selfEchoMissingSince = 0; return }
     let present = false
     try { present = !!acct.presenceState?.()[machine] } catch { present = false }
     if (present) { selfEchoMissingSince = 0; presenceRecycledForMissing = 0; return }

package/event-id.mjs

@@ -249,67 +249,13 @@ export function usageReportLine (sessionModel, logEvents) {
   return `usage · ${turns} · ${perStr}${total}${cost} · tokens + cost only (no plan/rate-limit meters)`
 }
 
-// Default hard cap for the context-carry recap (chars of transcript body, framing extra).
-export const RECAP_CAP = 20000
-
-// Context-carry recap for a lane whose SDK memory CAN'T be resumed (a cross-provider
-// switch, or a bridge-restart restore where canResume() is false). Such a lane re-opens
-// under the SAME id with the visible transcript replayed but a FRESH, blank backend — so
-// the agent starts amnesiac mid-conversation (the 2026-07-08 lane 109d22e1 "this is the
-// first message in my lane" incident). Raw SDK resume can't cross a provider (signed
-// thinking blocks + provider-specific tool_use records get rejected by a foreign backend),
-// so we carry the conversation at the TEXT layer instead: synthesize a plain-text recap
-// from the saved log — the people's turns (`you`) + the assistant's own text replies
-// (`assistant` text blocks; thinking + tool_use are dropped, they don't survive a backend
-// hop and are noise) — newest-weighted under a hard char cap, framed so the agent RESUMES
-// rather than re-greets. Pure + import-safe (unit-tested in bridge/recap.test.mjs).
-//
-// capReplayEvents lesson (rooms died once on a multi-MB replay): the char cap keeps this
-// bounded in prose form too — an unbounded recap would be the same bug wearing a text hat.
-export function buildRecapFromLog(log, cap = RECAP_CAP) {
-  if (!Array.isArray(log) || !log.length) return ''
-  const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
-  if (!budget) return ''
-  // Flatten the log to speaker-labelled turns, in order. `you` = a person in the room;
-  // `assistant` = this agent's own earlier reply (its text blocks only).
-  const turns = []
-  for (const e of log) {
-    if (!e || typeof e !== 'object') continue
-    if (e.kind === 'you') {
-      const t = String(e.text || '').trim()
-      if (t) turns.push({ who: 'PERSON', text: t })
-    } else if (e.kind === 'assistant') {
-      const t = (Array.isArray(e.blocks) ? e.blocks : [])
-        .filter((b) => b && b.type === 'text' && typeof b.text === 'string' && b.text.trim())
-        .map((b) => b.text.trim())
-        .join('\n')
-      if (t) turns.push({ who: 'YOU', text: t })
-    }
-  }
-  if (!turns.length) return ''
-  // Newest-weighted: walk from the end, keep whole turns until the char budget is spent,
-  // then restore chronological order. A single newest turn bigger than the whole budget is
-  // still kept (truncated) so the LIVE task is never dropped to the cap.
-  const kept = []
-  let used = 0
-  let omitted = false
-  for (let i = turns.length - 1; i >= 0; i--) {
-    let line = `${turns[i].who}: ${turns[i].text}`
-    if (used + line.length > budget) {
-      if (kept.length) { omitted = true; break }   // older turns exist but won't fit → note + stop
-      line = line.slice(0, budget)                  // newest turn alone overflows → clip, still include
-    }
-    kept.push(line)
-    used += line.length
-  }
-  kept.reverse()
-  const body = (omitted ? ['[…earlier messages omitted for length…]'] : []).concat(kept).join('\n\n')
-  return [
-    '[CONTEXT CARRY — you are RESUMING a live conversation after a model/provider switch]',
-    "Your session memory was reset by the switch, but this lane's conversation continued and the people already saw everything below. Do NOT re-greet, do NOT re-introduce yourself, and do NOT re-answer anything you already completed. Read the recap, then continue the work exactly where it left off. The LAST PERSON message with no completed answer below is your live task — pick it up.",
-    '',
-    '--- conversation so far (oldest → newest) ---',
-    body,
-    '--- end recap ---',
-  ].join('\n')
-}
+/* The context-carry recap moved to ./recap.mjs (ADR-0010 / S4, 2026-07-09).
+ *
+ * Why: the WEB CLIENT needs buildRecapFromLog to carry a lane's bridgeless
+ * conversation across a bridge wake, and this module imports `node:crypto` —
+ * unresolvable in a browser bundle. The pure half lives in an import-free file
+ * both sides can load; these re-exports keep every existing bridge-side import
+ * (`from './event-id.mjs'`) working untouched, including bridge/recap.test.mjs.
+ *
+ * recap.mjs must stay in bridge/package.json `files` — event-id.mjs imports it. */
+export { RECAP_CAP, buildRecapFromLog } from './recap.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.174",
+  "version": "0.7.176",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -16,6 +16,7 @@
     "turn-stall.mjs",
     "update-gate.mjs",
     "event-id.mjs",
+    "recap.mjs",
     "transcript-sanitize.mjs",
     "session-store.mjs",
     "cross-terminal.mjs",

package/recap.mjs

@@ -0,0 +1,112 @@
+/* recap.mjs — the text-layer context carry. PURE. NO IMPORTS. NO NODE BUILTINS.
+ *
+ * Extracted from event-id.mjs on 2026-07-09 (ADR-0010 / slice S4) for one reason:
+ * the WEB CLIENT needs this function now, and event-id.mjs imports `node:crypto`
+ * (for stampEvent's randomUUID default), which Vite cannot resolve for a browser
+ * bundle. Rather than write a second windower — the spec's §b instruction is
+ * literally "Do not write a second windower" — the pure half moves to its own
+ * file that both sides import.
+ *
+ *   bridge/event-id.mjs  re-exports these (every existing import keeps working)
+ *   src/pages/code/poolTurn.js  imports this file directly
+ *
+ * ⚠ KEEP THIS FILE FREE OF IMPORTS. The moment it imports `node:*`, the web build
+ * breaks. There is no lint rule for this; there is only this comment.
+ *
+ * ⚠ TARBALL: this file is imported by event-id.mjs, so it MUST appear in
+ * bridge/package.json `files`. A publish that omits it boots a bridge that
+ * crashes on `import './recap.mjs'`. (feedback_npm_tarball_completeness.)
+ */
+
+// Default hard cap for the context-carry recap (chars of transcript body, framing extra).
+export const RECAP_CAP = 20000
+
+/* Why a lane is being handed a recap instead of a resumed session. The framing text
+   differs because the LIE each one must avoid differs:
+
+   'switch' — a model/provider switch ended the SDK session. The agent's own memory is
+     gone but nothing else happened; the transcript above is entirely its own work.
+
+   'wake'  — ADR-0010 §d. The bridge was ASLEEP. The lane stayed alive and the people
+     kept talking to Pool (client-side BYOK, chat-only, no file access). So the recap
+     contains turns the agent DID NOT produce and work it DID NOT do. The framing has to
+     say that, and has to say that nothing ran on its behalf — otherwise the agent
+     assumes the plan below was already executed. That assumption is how "nothing
+     autofires" becomes a lie the agent tells itself. */
+const FRAMING = {
+  switch: {
+    header: '[CONTEXT CARRY — you are RESUMING a live conversation after a model/provider switch]',
+    body: "Your session memory was reset by the switch, but this lane's conversation continued and the people already saw everything below. Do NOT re-greet, do NOT re-introduce yourself, and do NOT re-answer anything you already completed. Read the recap, then continue the work exactly where it left off. The LAST PERSON message with no completed answer below is your live task — pick it up.",
+  },
+  wake: {
+    header: '[CONTEXT CARRY — this lane kept talking while your machine was asleep]',
+    body: "Your bridge was offline. The lane stayed open and the people in this room kept planning here with Pool — a chat-only assistant with no file access and no tools. Everything below already happened and they have all seen it. NOTHING WAS RUN ON YOUR BEHALF: no commands were executed, no files were changed, and no plan below has been carried out. Do NOT re-greet and do NOT re-answer what is already answered. Read the recap, then wait for the people to tell you what to do with it — the plan below is a plan, not an instruction you have already been given.",
+  },
+}
+
+/* Context-carry recap for a lane whose SDK memory CAN'T be resumed — a cross-provider
+   switch, a bridge-restart restore where canResume() is false, or (ADR-0010) a bridge
+   WAKE under a lane that spent the outage in Pool posture. Such a lane re-opens under the
+   SAME id with the visible transcript replayed but a FRESH, blank backend — so the agent
+   starts amnesiac mid-conversation (the 2026-07-08 lane 109d22e1 "this is the first
+   message in my lane" incident). Raw SDK resume can't cross a provider (signed thinking
+   blocks + provider-specific tool_use records get rejected by a foreign backend), so we
+   carry the conversation at the TEXT layer instead: synthesize a plain-text recap from the
+   saved log — the people's turns (`you`) + the assistant's own text replies (`assistant`
+   text blocks; thinking + tool_use are dropped, they don't survive a backend hop and are
+   noise) — newest-weighted under a hard char cap, framed so the agent RESUMES rather than
+   re-greets. Pure + import-safe (unit-tested in bridge/recap.test.mjs).
+
+   capReplayEvents lesson (rooms died once on a multi-MB replay): the char cap keeps this
+   bounded in prose form too — an unbounded recap would be the same bug wearing a text hat.
+
+   `reason` selects the framing only; the windowing is identical and the default
+   ('switch') is byte-for-byte what this function returned before the S4 extraction. */
+export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch' } = {}) {
+  if (!Array.isArray(log) || !log.length) return ''
+  const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
+  if (!budget) return ''
+  // Flatten the log to speaker-labelled turns, in order. `you` = a person in the room;
+  // `assistant` = this agent's own earlier reply (its text blocks only).
+  const turns = []
+  for (const e of log) {
+    if (!e || typeof e !== 'object') continue
+    if (e.kind === 'you') {
+      const t = String(e.text || '').trim()
+      if (t) turns.push({ who: 'PERSON', text: t })
+    } else if (e.kind === 'assistant') {
+      const t = (Array.isArray(e.blocks) ? e.blocks : [])
+        .filter((b) => b && b.type === 'text' && typeof b.text === 'string' && b.text.trim())
+        .map((b) => b.text.trim())
+        .join('\n')
+      if (t) turns.push({ who: 'YOU', text: t })
+    }
+  }
+  if (!turns.length) return ''
+  // Newest-weighted: walk from the end, keep whole turns until the char budget is spent,
+  // then restore chronological order. A single newest turn bigger than the whole budget is
+  // still kept (truncated) so the LIVE task is never dropped to the cap.
+  const kept = []
+  let used = 0
+  let omitted = false
+  for (let i = turns.length - 1; i >= 0; i--) {
+    let line = `${turns[i].who}: ${turns[i].text}`
+    if (used + line.length > budget) {
+      if (kept.length) { omitted = true; break }   // older turns exist but won't fit → note + stop
+      line = line.slice(0, budget)                  // newest turn alone overflows → clip, still include
+    }
+    kept.push(line)
+    used += line.length
+  }
+  kept.reverse()
+  const body = (omitted ? ['[…earlier messages omitted for length…]'] : []).concat(kept).join('\n\n')
+  const frame = FRAMING[reason] || FRAMING.switch
+  return [
+    frame.header,
+    frame.body,
+    '',
+    '--- conversation so far (oldest → newest) ---',
+    body,
+    '--- end recap ---',
+  ].join('\n')
+}