thinkpool-pair 0.7.27 → 0.7.28

package/bridge.mjs

@@ -37,6 +37,7 @@ import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { startClaudeSession } from './claude-session.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames } from './session-store.mjs'
+import { stampEvent } from './event-id.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
 // Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.
@@ -588,11 +589,13 @@ function openStructured({ id, model, resume, log, commands, mode }) {
         openStructured({ id, model, log: entry.log, commands: entry.commands, mode: entry.mode })
         return
       }
-      // Stamp a wall-clock ts on every transcript event so the web client can
-      // sort agent turns chronologically against room chat/whispers on reload
-      // (the client merges the replayed log with persisted human lines). Used
-      // for ordering only — agent timestamps are never displayed.
-      if (typeof evt.ts !== 'number') evt.ts = Date.now()
+      // Stamp a wall-clock ts AND a stable cid on every transcript event before
+      // it's logged + broadcast. ts: lets the web client sort agent turns
+      // chronologically against room chat/whispers on reload. cid: the room's
+      // replay-union dedupes ONLY by cid, and SDK events carry none — without an
+      // id, an event that arrives both live AND in a reconnect replay renders
+      // twice (the 2026-06-19 duplicate-message bug). See event-id.mjs.
+      stampEvent(evt)
       // The init system event carries the session's slash command list. Stash it
       // on the entry so the ANNOUNCE can hand it to clients that connect/reload
       // AFTER init (the one-time code-event would miss them), then re-announce.
@@ -637,10 +640,22 @@ function openStructured({ id, model, resume, log, commands, mode }) {
 // from memory, delete its on-disk record (so a restart can't resurrect it), and tell
 // every client it's gone. Idempotent + id-scoped — no-ops for ids that aren't a
 // structured session, so it's safe to call from the PTY-oriented term-close path too.
+// Resolve any unanswered permission resolvers to 'deny' and clear them. A card
+// that's never answered (both clients gone, tab closed, or an abort) otherwise
+// leaves the SDK's PreToolUse hook (claude-session.mjs) awaiting our promise
+// forever — the structured turn freezes mid-flight. 'deny' is the fail-safe the
+// hook already degrades to, so draining to deny is always safe.
+function drainPending(s) {
+  if (!s?.pending) return
+  for (const [, p] of s.pending) { try { p.resolve('deny') } catch { /* noop */ } }
+  s.pending.clear()
+}
+
 function endStructured(id) {
   if (!id) return
   const s = sessions.get(id)
   if (s) {
+    drainPending(s)
     try { s.session?.end() } catch { /* noop */ }
     try { s.mockupWatcher?.close() } catch { /* noop */ }
     sessions.delete(id)
@@ -843,7 +858,7 @@ channel
   })
   .on('broadcast', { event: 'code-abort' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s) s.session.abort()
+    if (s) { drainPending(s); s.session.abort() }   // settle any open permission card so the hook doesn't hang
   })
   .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
@@ -916,7 +931,7 @@ channel
 setInterval(() => {
   if (!realtimeHealthy && brokenSince && Date.now() - brokenSince > 60000) {
     process.stderr.write('\n  ⚠ realtime wedged >60s — exiting for a clean restart.\n')
-    process.exit(1)
+    shutdown(1)   // reap PTYs + attempt presence-leave (was a raw exit → orphaned children)
   }
 }, 15000).unref()
 
@@ -960,7 +975,7 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   const applyIfIdle = () => {
     if (!pendingUpdate || !isIdle()) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting to update; the session resumes.\n`)
-    process.exit(0)   // service restarts with @latest; session-store resumes
+    shutdown(0, false)   // clean teardown (no farewell banner); service reruns @latest, session-store resumes
   }
   const check = async () => {
     const latest = await fetchLatest()
@@ -1010,24 +1025,47 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   }, 60000).unref()
 }
 
-async function shutdown() {
+// code: process exit code. farewell: print the "[ shared session ended ]" banner
+// (suppressed for an auto-update restart, which is meant to be invisible in-room).
+async function shutdown(code = 0, farewell = true) {
   if (shuttingDown) return
   shuttingDown = true
+  // Hard exit backstop, armed FIRST and independent of every await below — a wedged
+  // realtime socket (the watchdog path) or a hung untrack must NEVER leave the
+  // process alive with orphaned PTY children + stale "live" presence.
+  setTimeout(() => process.exit(code), 1500)
   clearInterval(flushTimer)
-  try {
-    const bye = Buffer.from('\r\n[ shared session ended ]\r\n', 'utf8').toString('base64')
-    for (const id of terms.keys()) bcast('pty-out', { term: id, b64: bye })
-  } catch { /* noop */ }
-  // Leave presence EXPLICITLY before exiting so the web room flips to dormant
-  // immediately. Previously we removeChannel()'d and process.exit()'d on the next
-  // line — the leave frame never flushed, so the web only noticed via the realtime
-  // heartbeat timeout (tens of seconds later) and looked stuck "live".
-  try { await channel.untrack() } catch { /* noop */ }
-  try { await supabase.removeChannel(channel) } catch { /* noop */ }
+  if (farewell) {
+    try {
+      const bye = Buffer.from('\r\n[ shared session ended ]\r\n', 'utf8').toString('base64')
+      for (const id of terms.keys()) bcast('pty-out', { term: id, b64: bye })
+    } catch { /* noop */ }
+  }
+  // Reap children FIRST — killing PTYs / ending SDK sessions is unconditionally
+  // correct and must not hang on the (possibly dead) realtime socket. This is the
+  // bug behind the watchdog/auto-update raw process.exit() paths, which skipped
+  // teardown entirely and orphaned agent processes + left stale presence.
   for (const t of terms.values()) { try { t.term.kill() } catch { /* noop */ } }
   for (const s of sessions.values()) { try { s.session.end() } catch { /* noop */ } }
   detachLocal()
-  setTimeout(() => process.exit(0), 250)   // small grace for the leave/close frames to flush over the socket
+  // Best-effort presence leave so the room flips to dormant immediately (when the
+  // socket is alive; on a wedge it won't flush and the hard backstop above wins).
+  try { await channel.untrack() } catch { /* noop */ }
+  try { await supabase.removeChannel(channel) } catch { /* noop */ }
+  setTimeout(() => process.exit(code), 250)   // grace for the leave/close frames to flush
 }
-process.on('SIGINT', shutdown)
-process.on('SIGTERM', shutdown)
+process.on('SIGINT', () => shutdown(0))
+process.on('SIGTERM', () => shutdown(0))
+// A throw escaping any async callback (an onEvent consumer, a JSON-serialize on a
+// circular payload, a node-pty native error) would otherwise terminate the process
+// with PTYs orphaned and presence stuck "live" (Node terminates on both since v15).
+// Route both through shutdown() so children are reaped + presence left, then the
+// supervisor / launchd / systemd respawns a clean process.
+process.on('uncaughtException', (err) => {
+  try { process.stderr.write(`\n  ⚠ uncaughtException: ${err?.stack || err}\n  ◆ shutting down cleanly for a fresh respawn.\n`) } catch { /* noop */ }
+  shutdown(1)
+})
+process.on('unhandledRejection', (reason) => {
+  try { process.stderr.write(`\n  ⚠ unhandledRejection: ${reason?.stack || reason}\n  ◆ shutting down cleanly for a fresh respawn.\n`) } catch { /* noop */ }
+  shutdown(1)
+})

package/event-id.mjs

@@ -0,0 +1,29 @@
+import { randomUUID } from 'node:crypto'
+
+/* event-id.mjs — stamp a structured event with a stable identity + timestamp
+   BEFORE it is logged + broadcast.
+
+   WHY (the duplicate-message bug, 2026-06-19): structured transcript events
+   (assistant / tool_result / thinking / result) carry NO id from the Claude
+   Agent SDK. The web room's replay-union (src/pages/code/room.jsx, the
+   `code-replay` handler) dedupes ONLY by `cid`: an event with a cid is merged
+   once; an event WITHOUT a cid is appended unconditionally. So an id-less event
+   that arrives both LIVE (`code-event`) and again in a reconnect REPLAY
+   (`code-replay`, which re-sends the whole rolling log) is rendered TWICE.
+   On mobile a background/foreground or network blip routinely triggers that
+   replay — which is exactly when the duplicates appeared.
+
+   Fix at the source: give every structured event a stable `cid` here, once, so
+   the live copy and every replayed copy share an id and the room's existing
+   cid-union collapses them. Idempotent — never overwrites a cid the client
+   already set (chat / whisper / pool / propose carry their own).
+
+   Kept as its own import-safe module so it can be unit-tested
+   (bridge/test-structured-cid.mjs); bridge.mjs runs the bridge on import and
+   cannot be imported by a test. */
+export function stampEvent(evt, gen = randomUUID) {
+  if (!evt || typeof evt !== 'object') return evt
+  if (typeof evt.ts !== 'number') evt.ts = Date.now()
+  if (!evt.cid) evt.cid = gen()
+  return evt
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.27",
+  "version": "0.7.28",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -9,6 +9,7 @@
   "files": [
     "bridge.mjs",
     "claude-session.mjs",
+    "event-id.mjs",
     "transcript-sanitize.mjs",
     "session-store.mjs",
     "service.mjs",