thinkpool-pair 0.7.192 → 0.7.194

package/bridge.mjs

@@ -32,7 +32,7 @@ import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
 import readline from 'node:readline'
-import { spawn, execSync, execFileSync } from 'node:child_process'
+import { spawn, execFileSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
@@ -232,8 +232,9 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
 if (argv[0] === 'restart-service') {
   const arg1 = argv[1] || ''
   const svcRoom = (!arg1 || arg1.startsWith('-')) ? null : arg1.toUpperCase().trim()
-  const svc = await import('./service.mjs'); svc.restartService(svcRoom)
-  process.exit(0)
+  const svc = await import('./service.mjs')
+  const ok = argv.includes('--current') ? svc.restartService(svcRoom) : svc.updateService(svcRoom)
+  process.exit(ok ? 0 : 1)
 }
 
 // Account mode (Phase 1, docs/specs/2026-06-16-account-bridge.md): one bridge per
@@ -270,7 +271,6 @@ if (argv[0] === 'provider') { const { runProvider } = await import('./provider.m
 if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
   const { runLauncher, detectState } = await import('./launcher.mjs')
   const svc = await import('./service.mjs')
-  const PKG_VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return 'latest' } })()
   const BRIDGE = fileURLToPath(import.meta.url)
   const io = {
     print: (s) => process.stderr.write(s + '\n'),
@@ -294,28 +294,8 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
     restartService: ({ room = null } = {}) => { svc.restartService(room) },
-    // "Restart & update the bridge" — resolve the NEWEST PUBLISHED version from npm and
-    // re-pin the OS service to it (stale-proof: the rewritten launch wipes the npx cache
-    // each start so it can't re-serve an old build). We must NOT trust PKG_VERSION here:
-    // npx can run a STALE cached launcher, so this very menu may be an old version — that's
-    // the bug that left the bridge stuck on 0.7.75. `npm view` hits the registry live, so it
-    // updates correctly even from a stale launcher. Pinned to the resolved number — no auto-roll.
-    restartUpdateService: ({ room = null } = {}) => {
-      let target = null
-      try { target = execSync('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() } catch { /* offline / no npm */ }
-      if (!/^\d+\.\d+\.\d+/.test(target || '')) {
-        // Can't reach npm to learn the newest version — DON'T silently re-pin this
-        // launcher's PKG_VERSION (npx may have run a stale cached launcher, so it could
-        // be OLDER than what's installed). Just RESTART the current pinned service (no
-        // version change) and say so honestly — never call a same-version restart an
-        // "update".
-        process.stderr.write(`\n  ⚠ couldn't reach npm to check for a newer version — restarting the current version, NO update applied. Try again when online.\n`)
-        svc.restartService(room)
-        return
-      }
-      process.stderr.write(`\n  ◆ updating the background service to v${target} (newest published) and restarting…\n`)
-      svc.installService(room, [], { version: target, staleProof: true })   // rewrites plist/unit at resolved version + reloads = update + restart
-    },
+    // Menu and CLI share the same registry-resolve → repin → reload implementation.
+    restartUpdateService: ({ room = null } = {}) => { svc.updateService(room) },
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
     // Provider config is NOT terminal — it writes provider.json and returns to the
     // menu so you can pick a model, switch back, or do something else. (It used to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.192",
+  "version": "0.7.194",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -43,7 +43,12 @@ const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`
 // which is what left Max's account bridge stuck on 0.7.75 while @latest was 0.7.78.
 // `home` is the platform-correct, runtime-expanded home token ("$HOME" on darwin under
 // /bin/bash; "$$HOME" inside a systemd unit so systemd emits a literal $HOME to bash).
-const cacheWipe = (home) => `rm -rf ${home}/.npm/_npx/*/node_modules/thinkpool-pair 2>/dev/null`
+// npx caches the temporary execution project as a unit. Removing only the package can
+// leave its generated .bin/package-lock metadata behind, producing the contradictory
+// state where `npm view` sees a version but `npx` reports ETARGET or no executable.
+// The whole _npx directory is disposable; clear its children so the next launch is a
+// genuinely clean install.
+const cacheWipe = (home) => `rm -rf ${home}/.npm/_npx/* 2>/dev/null`
 
 // The version installing the service. By DEFAULT the service is pinned to this exact
 // version (not @latest) so a future bad npm publish can't auto-roll to every machine's
@@ -61,9 +66,30 @@ function npxPath(platform) {
   try { fs.accessSync(cand); return cand } catch { return platform === 'win32' ? 'npx.cmd' : 'npx' }
 }
 
+function npmPath(platform = process.platform) {
+  const bin = path.dirname(process.execPath)
+  const cand = path.join(bin, platform === 'win32' ? 'npm.cmd' : 'npm')
+  try { fs.accessSync(cand); return cand } catch { return platform === 'win32' ? 'npm.cmd' : 'npm' }
+}
+
+// Persistent services never execute through npx. Provision an immutable, versioned
+// runtime from the tarball URL (which bypasses stale npm packument metadata), then point
+// launchd/systemd directly at its bridge.mjs with the current Node binary.
+export function provisionRuntime(version, { exec = execSync } = {}) {
+  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(version))) throw new Error(`invalid runtime version: ${version}`)
+  const dir = path.join(os.homedir(), '.thinkpool-pair', 'runtimes', String(version))
+  const entry = path.join(dir, 'node_modules', 'thinkpool-pair', 'bridge.mjs')
+  if (fs.existsSync(entry)) return entry
+  fs.mkdirSync(dir, { recursive: true })
+  const tarball = `https://registry.npmjs.org/thinkpool-pair/-/thinkpool-pair-${version}.tgz`
+  exec(`${shq(npmPath())} install --prefix ${shq(dir)} ${shq(tarball)} --prefer-online --no-audit --no-fund`, { stdio: 'inherit', shell: '/bin/bash' })
+  if (!fs.existsSync(entry)) throw new Error(`runtime install completed without ${entry}`)
+  return entry
+}
+
 // Pure artifact builder — returned shape is testable without side effects.
 // room falsy → ACCOUNT service (bare `thinkpool-pair`, auto-serves all sessions).
-export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate = false, version = VERSION, staleProof = false } = {}) {
+export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate = false, version = VERSION, staleProof = false, runtimeEntry = null } = {}) {
   const npx = npxPath(platform)
   const cwd = process.cwd()
   const id = slug(room)
@@ -83,7 +109,7 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   // 0.7.87). `--prefer-online` forces npx to REVALIDATE the packument against the
   // registry every resolve, so `@latest` always means the true latest. Only needed for
   // the @latest (autoUpdate) tier — a pinned exact version is immutable, no staleness.
-  const onlineFlag = autoUpdate ? ['--prefer-online'] : []
+  const onlineFlag = (autoUpdate || staleProof) ? ['--prefer-online'] : []
   const pkgArgs = room ? ['-y', ...onlineFlag, verSpec, room] : ['-y', ...onlineFlag, verSpec]
   // In-process self-update (account.mjs / bridge.mjs) is gated on this env — only on when
   // the user explicitly opted into auto-update.
@@ -92,7 +118,9 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   if (platform === 'darwin') {
     // launchd KeepAlive supervises. staleProof → wrap in a cache-wiping /bin/bash launch so
     // every (re)start re-fetches the pinned version fresh (deliberate-update path).
-    const args = staleProof
+    const args = runtimeEntry
+      ? [process.execPath, runtimeEntry, ...(room ? [room] : []), ...tail]
+      : staleProof
       ? ['/bin/bash', '-lc', `${cacheWipe('"$HOME"')}; exec ${[npx, ...pkgArgs, ...tail].map(shq).join(' ')}`]
       : [npx, ...pkgArgs, ...tail]
     const file = path.join(os.homedir(), 'Library', 'LaunchAgents', `${label(room)}.plist`)
@@ -148,11 +176,15 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   }
 
   if (platform === 'linux') {
-    const args = [npx, ...pkgArgs, ...tail]   // systemd Restart=always supervises
+    const args = runtimeEntry
+      ? [process.execPath, runtimeEntry, ...(room ? [room] : []), ...tail]
+      : [npx, ...pkgArgs, ...tail]   // systemd Restart=always supervises
     const file = path.join(os.homedir(), '.config', 'systemd', 'user', `${label(room)}.service`)
     // staleProof → cache-wiping /bin/bash launch (same intent as darwin). `$$HOME` so systemd
     // emits a literal $HOME to bash rather than expanding it itself (empty + warning).
-    const execStart = staleProof
+    const execStart = runtimeEntry
+      ? args.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(' ')
+      : staleProof
       ? `/bin/bash -lc "${cacheWipe('$$HOME')}; exec ${[npx, ...pkgArgs, ...tail].join(' ')}"`
       : args.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(' ')
     const content = `[Unit]
@@ -187,7 +219,9 @@ WantedBy=default.target
     // so it gets login-persistence only — no in-process crash-restart on Windows.
     const startup = path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup')
     const file = path.join(startup, `thinkpool-pair-${id}.cmd`)
-    const inner = room
+    const inner = runtimeEntry
+      ? [process.execPath, runtimeEntry, ...(room ? [room, '--supervise'] : []), ...tail].map((s) => `"${s}"`).join(' ')
+      : room
       ? ['npx', '-y', ...onlineFlag, verSpec, room, '--supervise', ...tail].join(' ')
       : ['npx', '-y', ...onlineFlag, verSpec].join(' ')
     const content = `@echo off\r\ntitle thinkpool-pair ${id}\r\n${inner}\r\n`
@@ -294,7 +328,14 @@ export function sweepExistingServices(keepLabel, platform = process.platform) {
 // pinned version is fetched fresh on every (re)start. buildArtifact keeps staleProof=false
 // so its unit tests assert the pure pinned shape.
 export function installService(room, cmdArgs = [], { autoUpdate = false, version = VERSION, staleProof = true } = {}) {
-  const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate, version, staleProof })
+  // Pinned services get a stable local runtime. The legacy @latest opt-in keeps its
+  // existing npx behavior until it resolves a concrete version through updateService.
+  let runtimeEntry = null
+  if (!autoUpdate) {
+    try { runtimeEntry = provisionRuntime(version) }
+    catch (e) { process.stderr.write(`  ⚠ runtime install failed; service left unchanged: ${e.message}\n`); return false }
+  }
+  const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate, version, staleProof, runtimeEntry })
   // F4: clear every OTHER pre-existing pair service first, so only the one we install remains
   // (the "two account services live" storm trigger). Our own label is bootout+bootstrapped
   // by a.post below, so keep it.
@@ -318,10 +359,11 @@ export function installService(room, cmdArgs = [], { autoUpdate = false, version
     ? (process.platform === 'win32'
         ? 'auto-update ON: a new thinkpool-pair@latest applies on the next login/restart (Windows has no in-process self-update).'
         : `auto-update ON: checks npm ~every 30 min and restarts to apply a new @latest once sessions are idle (≥${idleSecs}s quiet; they resume in place).`)
-    : `PINNED to ${version}${staleProof ? ' (stale-proof: every restart re-fetches it fresh, never a stale npx cache)' : ''} (safe default — a bad publish can't auto-roll to this always-on bridge). To update: use "Restart & update the bridge" (or re-run install-service from a newer thinkpool-pair). Pass --auto-update to track @latest instead.`
+    : `PINNED to ${version} (stable local runtime; restarts do not depend on npx or the network). To update: use "Restart & update the bridge" (or re-run install-service from a newer thinkpool-pair). Pass --auto-update to track @latest instead.`
   const removeArg = room ? ` ${room}` : ''
   const what = room ? `room ${room}` : 'your account (auto-serves every session)'
   process.stderr.write(`  ◆ ${what}\n  ◆ ${a.note}\n  ◆ ${updateNote}\n  ◆ logs: ${path.join(a.logDir, `${slug(room)}.log`)}\n  ◆ remove with: thinkpool-pair uninstall-service${removeArg}\n\n`)
+  return true
 }
 
 // Restart an already-installed boot-persistent service. launchd/systemd relaunch
@@ -353,6 +395,27 @@ export function restartService(room) {
   }
 }
 
+// One authoritative update path for both the interactive menu and `restart-service`.
+// Resolve the registry version first, then rewrite + reload the service pinned to that
+// exact build. If npm is unavailable, fail without pretending an old-version restart
+// was an update.
+export function updateService(room, { exec = execSync, install = installService, active = isServiceInstalled } = {}) {
+  if (!active(room)) {
+    process.stderr.write('  ⚠ no background service installed to update — install one first.\n')
+    return false
+  }
+  let target = ''
+  try {
+    target = String(exec('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })).trim()
+  } catch { /* reported below */ }
+  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(target)) {
+    process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n")
+    return false
+  }
+  process.stderr.write(`\n  ◆ updating the background service to v${target} and restarting…\n`)
+  return install(room, [], { version: target, staleProof: true }) !== false
+}
+
 // Ground truth: is the OS service manager ACTUALLY running our service right now?
 // A leftover plist/unit on disk does NOT mean it's loaded — `launchctl load` can
 // silently no-op (the 2026-06-26 "says installed but it's off" bug), and a unit can