thinkpool-pair 0.7.278 → 0.7.279

package/codex-session.mjs

@@ -389,6 +389,12 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   let appServer = null
   let appServerThreadReady = false
   let activeTurnId = null
+  // App Server notifications are asynchronous to turn/completed. In production a
+  // stopped turn emitted its durable `aborted` boundary, then delivered a queued
+  // item/started 89ms later and a Bash result 159.9s after that. Without a native
+  // turn fence those late rows resurrected the lane after Stop. Keep a bounded set
+  // of closed native turns and accept turn-scoped traffic only for the one active id.
+  const closedAppServerTurnIds = new Set()
   const appServerItems = new Map()
   const streamedAgentItems = new Map() // item id → { cid, text }
   let steerChain = Promise.resolve()
@@ -423,6 +429,18 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   }
 
   const note = (text) => { try { onEvent?.({ kind: 'note', text }) } catch { /* noop */ } }
+
+  const closeAppServerTurn = (turnId = activeTurnId) => {
+    const id = String(turnId || '')
+    if (!id) return
+    closedAppServerTurnIds.add(id)
+    while (closedAppServerTurnIds.size > 64) closedAppServerTurnIds.delete(closedAppServerTurnIds.values().next().value)
+  }
+
+  const appServerTurnIsCurrent = (params = {}) => {
+    const turnId = String(params.turnId || '')
+    return !!turnId && !ended && !aborted && !closedAppServerTurnIds.has(turnId) && turnId === String(activeTurnId || '')
+  }
   if (requestedResume && !resumeUsable) {
     queueMicrotask(() => note('The stopped Codex turn had no resumable context; continuing in a fresh thread.'))
   }
@@ -439,9 +457,15 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
 
   function appServerNotification(method, params = {}) {
     if (method === 'turn/started' && params.turn?.id) {
-      activeTurnId = activeTurnId || params.turn.id
+      const turnId = String(params.turn.id)
+      if (ended || aborted) { closeAppServerTurn(turnId); return }
+      if (!activeTurnId) activeTurnId = turnId
       return
     }
+    // Every mapped App Server notification below is turn-scoped in the tested
+    // protocol and carries turnId. Fail closed on missing, stale, completed, or
+    // interrupted ids so a provider's buffered stdout cannot reopen a closed turn.
+    if ((method === 'turn/plan/updated' || method === 'item/agentMessage/delta' || method === 'item/started' || method === 'item/completed' || method === 'error') && !appServerTurnIsCurrent(params)) return
     if (method === 'turn/plan/updated') {
       const todos = (Array.isArray(params.plan) ? params.plan : []).map(({ step, status }) => ({
         content: step || '',
@@ -486,6 +510,13 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   }
 
   async function appServerRequest(method, params = {}) {
+    // A request racing Stop must never raise a fresh room card after the turn's
+    // durable boundary. Respond with the protocol's ordinary denial shape so the
+    // native runtime can settle without reopening any ThinkPool state.
+    if (!appServerTurnIsCurrent(params)) {
+      if (method === 'item/tool/requestUserInput') return { answers: {} }
+      return { decision: 'decline' }
+    }
     const card = codexApprovalCard(method, params, appServerItems.get(params.itemId))
     if (!card) throw new Error(`Unsupported Codex App Server request: ${method}`)
     // Missing/broken room permission plumbing denies safely. App Server expects
@@ -578,10 +609,12 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       // id. abort() already closed the room boundary; interrupt the now-known
       // native turn before waiting, and never let it continue invisibly.
       if (aborted || ended) {
+        closeAppServerTurn(activeTurnId)
         try { await appServer.interrupt({ threadId: sessionId, turnId: activeTurnId }) } catch { /* boundary is already closed */ }
         return true
       }
       const completed = await appServer.waitForTurn(activeTurnId)
+      closeAppServerTurn(completed?.turn?.id || activeTurnId)
       const status = completed?.turn?.status
       if (aborted || status === 'interrupted') {
         emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: completed?.turn?.durationMs, denials: 0, resultText: null })
@@ -596,6 +629,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       // turns only; they can safely resume this thread through the stable driver.
       appServerDisabled = true
       appServerThreadReady = false
+      closeAppServerTurn(activeTurnId)
       try { appServer?.end() } catch { /* noop */ }
       appServer = null
       if (!ended) pushMappedEvent({ type: 'turn.failed', message: `codex app-server turn failed: ${error?.message || error}` })
@@ -625,10 +659,12 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       activeTurnId = started?.turn?.id || started?.turnId
       if (!activeTurnId) throw new Error('Codex review/start returned no turn id')
       if (aborted || ended) {
+        closeAppServerTurn(activeTurnId)
         try { await appServer.interrupt({ threadId: sessionId, turnId: activeTurnId }) } catch { /* boundary is already closed */ }
         return true
       }
       const completed = await appServer.waitForTurn(activeTurnId)
+      closeAppServerTurn(completed?.turn?.id || activeTurnId)
       const status = completed?.turn?.status
       if (aborted || status === 'interrupted') {
         emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: completed?.turn?.durationMs, denials: 0, resultText: null })
@@ -640,6 +676,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     } catch (error) {
       appServerDisabled = true
       appServerThreadReady = false
+      closeAppServerTurn(activeTurnId)
       try { appServer?.end() } catch { /* noop */ }
       appServer = null
       if (!ended) pushMappedEvent({ type: 'turn.failed', message: `codex review failed: ${error?.message || error}` })
@@ -834,6 +871,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       const bootstrapOnly = turnActive && !activeTurnId && !child
       aborted = true
       queue.length = 0
+      closeAppServerTurn(activeTurnId)
       if (appServer && activeTurnId) { void appServer.interrupt({ threadId: sessionId, turnId: activeTurnId }).catch(() => {}) ; return }
       if (child) { try { child.kill('SIGTERM') } catch { /* noop */ } ; setTimeout(() => { try { child?.kill('SIGKILL') } catch { /* noop */ } }, 1500) }
       else if (bootstrapOnly) {
@@ -847,6 +885,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       ended = true
       turnActive = false
       queue.length = 0
+      closeAppServerTurn(activeTurnId)
       if (child) { try { child.kill() } catch { /* noop */ } }
       try { appServer?.end() } catch { /* noop */ }
       void mcpHttpPromise?.then((h) => h.close()).catch(() => {})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.278",
+  "version": "0.7.279",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {