thinkpool-pair 0.7.286 → 0.7.288

package/account.mjs

@@ -437,6 +437,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const POST_BUCKET = { max: 6, windowMs: 60_000 }   // ≤6 inbound cross-room posts / partner / minute
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
+  let applyingUpdate = false
   const warned = new Set()
   const refused = new Map()   // room -> reason ('home'|'none'|'dir-gone'): owned but NOT served, announced in presence so the web shows a precise "attach this session" card instead of spinning
 
@@ -1126,10 +1127,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Restart the account bridge to apply a pending update ONLY when it's safe: every
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
-  const applyIfIdle = () => {
-    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
+  const applyIfIdle = async () => {
+    if (applyingUpdate || !isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
+    applyingUpdate = true
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
-    stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
+    try {
+      const svc = await import('./service.mjs')
+      if (svc.serviceActive(null) && svc.updateService(null) !== false) return
+    } catch { /* fall back to the legacy supervised restart below */ }
+    applyingUpdate = false
+    stop('SIGTERM')
   }
 
   // ── auto-update (account-service tier only) ───────────────────────────────

package/bridge.mjs

@@ -114,6 +114,7 @@ const flowRedispatch = new Map()
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
+import { createStandalonePairResponder, standalonePairIdentity } from './direct-pair-room.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { turnInFlight } from './update-gate.mjs'
@@ -1008,6 +1009,7 @@ const markActivity = () => { lastActivity = Date.now() }
 // ready" chip; the restart is gated to between turns (never mid-turn, Contract #1).
 let pendingUpdate = null
 let applyRequested = false   // a user clicked "apply" in the room
+let managedUpdateRunning = false
 // A web client (not another bridge) is present — checks presence metas for a
 // non-bridge role. Gates the unattended auto-restart: when someone's watching we
 // wait for their apply click instead of restarting under them.
@@ -1186,6 +1188,7 @@ const announce = () => {
 // Spec: docs/specs/2026-06-30-cross-room-ensemble.md
 const IS_ACCOUNT_CHILD = !!(process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1')
 const pairWaiters = new Map()   // reqId -> { resolve, timer } for our OUTBOUND requests
+let standalonePairChannel = null // standalone owner bridge's direct paired-session responder
 // Send a cross-room request to the supervisor and resolve with its reply ({ rooms }
 // or { text } / { error }). Fails soft (never throws into the tool handler): a
 // standalone bridge (no supervisor) or a disabled/timed-out request returns { error }.
@@ -1267,6 +1270,51 @@ async function receiveCrossRoomPost({ fromRoom, fromHost, fromTerminalName, text
   return { ok: true, ref: String(targetId).slice(0, 8) }
 }
 
+// A room can be legitimately live without the account supervisor: `npx
+// thinkpool-pair <ROOM>` and room-specific services run bridge.mjs directly. The
+// old Tier-2 route listened only in account.mjs, so those rooms appeared live in
+// the dashboard (`tpcode:<room>`) but falsely offline to list/read/post_session.
+// Join the SAME private, RLS-gated pair bus here when this process is standalone
+// and owns a real two-person room. The target bridge then answers for this room
+// directly and reuses receiveCrossRoomPost(), including the mandatory red receipt
+// card. Account children skip this path to avoid duplicate replies/cards.
+async function startStandalonePairResponder () {
+  if (IS_ACCOUNT_CHILD || process.env.TP_PAIRBUS_OFF === '1' || process.env.TP_CROSSROOM_OFF === '1') return
+  if (!codeAuthToken || !myServeUid) return
+  let row = null
+  try {
+    const url = `${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&select=code,name,owner_id,participants`
+    const res = await fetch(url, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } })
+    if (!res.ok) return
+    const rows = await res.json().catch(() => [])
+    row = Array.isArray(rows) ? rows[0] : null
+  } catch { return }
+  const identity = standalonePairIdentity({ row, myUid: myServeUid })
+  if (!identity?.topic) return
+
+  const responder = createStandalonePairResponder({
+    room,
+    roomName: row?.name || null,
+    host: os.hostname().replace(/\.local$/, ''),
+    formatPeek: (payload) => formatPeek({ selfId: null, sessions, terms, names: termNames, terminal: payload.terminal, lines: payload.lines }),
+    receivePost: (payload) => receiveCrossRoomPost(payload),
+  })
+  const ch = supabase.channel(identity.topic, { config: { private: true, broadcast: { self: false } } })
+  const reply = async (event, payload) => {
+    if (!payload) return
+    try { await ch.send({ type: 'broadcast', event, payload }) } catch { /* bus reconnect handles the next request */ }
+  }
+  ch.on('broadcast', { event: 'peer-list-req' }, ({ payload }) => { void reply('peer-list-res', responder.list(payload)) })
+    .on('broadcast', { event: 'peer-peek-req' }, ({ payload }) => { const out = responder.peek(payload); if (out) void reply('peer-peek-res', out) })
+    .on('broadcast', { event: 'peer-post-req' }, ({ payload }) => { void responder.post(payload).then((out) => { if (out) return reply('peer-post-res', out) }) })
+    .subscribe((status) => {
+      if (status === 'SUBSCRIBED') process.stderr.write(`\n  ◆ standalone pair bus subscribed — this live room can receive approval-gated cross-session tasks.\n`)
+      else if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') process.stderr.write(`\n  ◇ standalone pair bus ${status.toLowerCase().replace('_', ' ')} — cross-session reach will retry with realtime.\n`)
+    })
+  standalonePairChannel = ch
+}
+void startStandalonePairResponder()
+
 if (IS_ACCOUNT_CHILD) {
   // A SECOND message listener (Node allows many) dedicated to pair traffic — leaves
   // the account-child idle/token listener (bottom of file) untouched.
@@ -3419,6 +3467,36 @@ function surfaceUpdate(version) {
   announce()
 }
 
+// A pinned managed room must stage the published runtime before it restarts.
+// Exiting and trusting launchd/systemd to "pick up latest" only reloads the same
+// immutable version. This is the room-scoped counterpart to account.mjs's
+// dashboard updater and is deliberately shared by the session and dashboard UI.
+const betweenUpdateTurns = () => {
+  if (turnInFlight(sessions)) return false
+  for (const t of terms.values()) if (t.buf) return false
+  return true
+}
+
+async function applyStandaloneManagedUpdate() {
+  if (!applyRequested || !pendingUpdate || managedUpdateRunning) return false
+  if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') return false
+  if (!betweenUpdateTurns()) return false
+  managedUpdateRunning = true
+  try {
+    const svc = await import('./service.mjs')
+    if (!svc.serviceActive(room)) return false
+    const ok = svc.updateService(room) !== false
+    if (!ok) managedUpdateRunning = false
+    return ok
+  } catch (error) {
+    managedUpdateRunning = false
+    process.stderr.write(`\n  ⚠ bridge update failed: ${error?.message || error}\n`)
+    return false
+  }
+}
+
+setInterval(() => { if (applyRequested) void applyStandaloneManagedUpdate() }, 5000).unref()
+
 // After the attached CLI exits, the host's stdin stops feeding a PTY —
 // restore the cooked terminal so Ctrl-C reaches the bridge itself.
 const detachLocal = () => {
@@ -4069,6 +4147,42 @@ channel
       try { process.send({ t: 'apply-update' }) } catch { /* parent gone */ }
     }
   })
+  // Authenticated + acknowledged update contract used by both the room card and
+  // the dashboard's room-scoped fallback. Unlike the legacy apply-update event,
+  // this does not depend on the bridge having discovered npm first: the web names
+  // the advertised target, the host updater independently resolves npm latest,
+  // and only a managed service is allowed to accept the operation.
+  .on('broadcast', { event: 'bridge-update' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error, state) => channel.send({
+      type: 'broadcast', event: 'bridge-update-res',
+      payload: { nonce, ok, ...(error ? { error } : {}), ...(state ? { state } : {}) },
+    })
+    if (!nonce || !(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
+    const target = typeof payload?.v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(payload.v)
+      ? payload.v : null
+    if (!target) return reply(false, 'invalid bridge version')
+
+    surfaceUpdate(target)
+    applyRequested = true
+    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+      try { process.send({ t: 'apply-update' }) } catch { return reply(false, 'account supervisor is unavailable') }
+      return reply(true, null, 'queued')
+    }
+
+    let managed = false
+    try {
+      const svc = await import('./service.mjs')
+      managed = svc.serviceActive(room)
+    } catch { /* reported as an explicit foreground refusal below */ }
+    if (!managed) {
+      applyRequested = false
+      return reply(false, 'This bridge is running in a terminal. Restart it once with npx thinkpool-pair@latest, or install the background service to enable remote updates.')
+    }
+    if (!betweenUpdateTurns()) return reply(true, null, 'queued')
+    await reply(true, null, 'applying')
+    void applyStandaloneManagedUpdate()
+  })
   // Persist + re-announce terminal renames. The web also echoes term-rename to
   // online peers directly; storing it here is what reaches a device that joins
   // LATER (or a second machine) — those only ever see the announce.
@@ -4833,6 +4947,7 @@ async function shutdown(code = 0, farewell = true) {
   // socket is alive; on a wedge it won't flush and the hard backstop above wins).
   try { await channel.untrack() } catch { /* noop */ }
   try { await supabase.removeChannel(channel) } catch { /* noop */ }
+  try { if (standalonePairChannel) await supabase.removeChannel(standalonePairChannel) } catch { /* noop */ }
   // BRG-2 (audit 2026-07-02): shutdown removed only the room channel, leaking the flow
   // topic (no presence to untrack, but the subscription + socket join outlived the
   // process teardown). Close it too so shutdown is symmetric.

package/claude-session.mjs

@@ -720,7 +720,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       'CROSS-TERMINAL HAND-OFF: you also have post_to_terminal(terminal, text) to send a message or task to ANOTHER AGENT terminal in this room (not a plain shell). Use it sparingly and only when the people clearly want the lanes to coordinate — e.g. "tell the backend terminal the API is ready", or to hand a sibling agent a concrete task. Every post requires a person in the room to approve a card before it is delivered, and an agent that was itself reached via a cross-post cannot post onward — so do not rely on it for chit-chat or loops. Prefer read_terminal to understand a sibling before you ever post to it.',
       'TERMINAL CREATION CONTRACT: conductors and workers use different tools. When a person explicitly asks to open, launch, start, or spawn a separate Cascade/conductor terminal, use open_main_terminal(name?, task?, model?) — it creates an independent MAIN terminal with no Ensemble owner. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for bounded WORKER SUB-TERMINALS when your authoritative role permits delegation. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers are always autonomous in bypassPermissions and never ask the room for an approval card; the bridge still enforces room caps, hop limits, the kill-switch, and isolated linked worktrees. Collect each worker with read_terminal and close_terminal immediately after using its result. Main conductors are independent terminals, keep their requested permission mode, and are not owned/closed through Ensemble.',
       'CROSS-SESSION AWARENESS: the Ensemble reaches across your SESSIONS, not just the terminals in this room. list_sessions() lists your OTHER ThinkPool Code rooms — both your own rooms running on this machine AND your partner\'s rooms in the same pair, reachable over the per-pair bus (a room on the partner\'s machine shows its host). read_session(session, terminal?) reads recent activity inside one (omit `terminal` to list that room\'s terminals, or pass a ref/name to read that lane). Both are READ-ONLY — they never change another session, and they reach ONLY your own rooms and rooms you share with your partner, never a stranger\'s. Reach for them when work spans rooms — "what\'s the other project up to", "pick up where the other session left off", or to check a long-running task elsewhere before you act here.',
-      'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. All of this works only under the ThinkPool account bridge; a standalone room sees just its own terminals.',
+      'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. Outbound list/read/post tools need the ThinkPool account bridge; a standalone owner room can still receive a paired hand-off directly and will always raise its own approval card before delivery.',
       'SUBAGENT POLICY: in this room, a main conductor delegates worker slices through visible spawn_terminal Ensemble lanes. A requested separate conductor is created with open_main_terminal, never Ensemble. Worker, leaf, Side, and managed Flow lanes do their assigned work directly. Do NOT reach for built-in Task/Agent subagents: an in-process subagent is invisible to the room, cannot be peered at or steered, and its work is lost to the Ensemble.',
       'RESEARCH LANE: you have a `research` tool that runs a REAL multi-source web search + adversarial verification and returns each claim marked HELD or REJECTED with citations. Reach for it when the people would genuinely benefit from looking something external up or settling a question of current fact — pricing, "is X still maintained / deprecated", "is that benchmark real", a debate over facts you are not sure of. Do NOT run it unprompted or for things you already know: first OFFER in plain language ("want me to spawn a research lane on that and check it?"), and only call `research(question)` once they agree — it spends real budget (plan-gated Free 5 / Plus 100 runs a month) and takes ~a minute. When it returns, present the held/rejected findings clearly and invite both people to weigh the sources, flagging any held claim that rests on a source they might not trust — that shared scrutiny is the point.',
       'PEER FIRST: other lanes may be working in the same repo as you, right now. Before starting substantive work — and before any code edit that could overlap another lane — check what the room is doing: the ROOM NOW snapshot appended to your latest turn, or read_terminal for detail; list_sessions/read_session when the question spans your other rooms. If a sibling is touching the same files or branch, coordinate (read its lane, or raise it in chat) instead of colliding.',

package/direct-pair-room.mjs

@@ -0,0 +1,57 @@
+import { pairKeyFor, pairTopic } from './cross-terminal.mjs'
+
+// A standalone room bridge is already the authoritative process for its room. It
+// must be reachable over the pair bus even when the account-level supervisor is
+// not running. Keep the identity and request handling in a small tested module so
+// the standalone path preserves the same pair-only and bounded-post invariants as
+// account.mjs.
+
+export function standalonePairIdentity ({ row, myUid } = {}) {
+  const participants = Array.isArray(row?.participants) ? row.participants.map(String) : []
+  const me = String(myUid || '')
+  if (!me || String(row?.owner_id || '') !== me || participants.length !== 2 || !participants.includes(me)) return null
+  const partnerUid = participants.find((uid) => uid !== me)
+  const key = pairKeyFor(me, partnerUid)
+  if (!partnerUid || !key) return null
+  return { partnerUid, key, topic: pairTopic(key) }
+}
+
+export function createStandalonePairResponder ({
+  room,
+  roomName = null,
+  host = null,
+  formatPeek,
+  receivePost,
+  now = () => Date.now(),
+  postLimit = 6,
+  postWindowMs = 60_000,
+} = {}) {
+  if (!room || typeof formatPeek !== 'function' || typeof receivePost !== 'function') {
+    throw new TypeError('room, formatPeek, and receivePost are required')
+  }
+  let bucket = { count: 0, resetAt: 0 }
+
+  const isTarget = (payload) => String(payload?.targetRoom || '').toUpperCase().trim() === room
+  const allowPost = () => {
+    const t = now()
+    if (t >= bucket.resetAt) bucket = { count: 0, resetAt: t + postWindowMs }
+    if (bucket.count >= postLimit) return false
+    bucket.count += 1
+    return true
+  }
+
+  return Object.freeze({
+    list: (payload) => ({ nonce: payload?.nonce, rooms: [{ code: room, name: roomName, host }] }),
+    peek: (payload) => {
+      if (!isTarget(payload)) return null
+      try { return { nonce: payload?.nonce, text: formatPeek(payload) } }
+      catch { return { nonce: payload?.nonce, error: 'Could not read that session.' } }
+    },
+    post: async (payload) => {
+      if (!isTarget(payload)) return null
+      if (!allowPost()) return { nonce: payload?.nonce, error: 'Too many cross-room posts to this device right now — try again shortly.' }
+      try { return { nonce: payload?.nonce, ...(await receivePost(payload)) } }
+      catch { return { nonce: payload?.nonce, error: `Could not deliver to room ${room}.` } }
+    },
+  })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.286",
+  "version": "0.7.288",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -56,6 +56,7 @@
     "side-lane.mjs",
     "cross-terminal.mjs",
     "pair-bus.mjs",
+    "direct-pair-room.mjs",
     "lane-lifecycle.mjs",
     "interrupted-resume.mjs",
     "dispatch-lease.mjs",