thinkpool-pair 0.7.287 → 0.7.289

package/account.mjs

@@ -437,6 +437,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const POST_BUCKET = { max: 6, windowMs: 60_000 }   // ≤6 inbound cross-room posts / partner / minute
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
+  let applyingUpdate = false
   const warned = new Set()
   const refused = new Map()   // room -> reason ('home'|'none'|'dir-gone'): owned but NOT served, announced in presence so the web shows a precise "attach this session" card instead of spinning
 
@@ -1126,10 +1127,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Restart the account bridge to apply a pending update ONLY when it's safe: every
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
-  const applyIfIdle = () => {
-    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
+  const applyIfIdle = async () => {
+    if (applyingUpdate || !isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
+    applyingUpdate = true
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
-    stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
+    try {
+      const svc = await import('./service.mjs')
+      if (svc.serviceActive(null) && svc.updateService(null) !== false) return
+    } catch { /* fall back to the legacy supervised restart below */ }
+    applyingUpdate = false
+    stop('SIGTERM')
   }
 
   // ── auto-update (account-service tier only) ───────────────────────────────

package/bridge.mjs

@@ -1009,6 +1009,7 @@ const markActivity = () => { lastActivity = Date.now() }
 // ready" chip; the restart is gated to between turns (never mid-turn, Contract #1).
 let pendingUpdate = null
 let applyRequested = false   // a user clicked "apply" in the room
+let managedUpdateRunning = false
 // A web client (not another bridge) is present — checks presence metas for a
 // non-bridge role. Gates the unattended auto-restart: when someone's watching we
 // wait for their apply click instead of restarting under them.
@@ -3466,6 +3467,36 @@ function surfaceUpdate(version) {
   announce()
 }
 
+// A pinned managed room must stage the published runtime before it restarts.
+// Exiting and trusting launchd/systemd to "pick up latest" only reloads the same
+// immutable version. This is the room-scoped counterpart to account.mjs's
+// dashboard updater and is deliberately shared by the session and dashboard UI.
+const betweenUpdateTurns = () => {
+  if (turnInFlight(sessions)) return false
+  for (const t of terms.values()) if (t.buf) return false
+  return true
+}
+
+async function applyStandaloneManagedUpdate() {
+  if (!applyRequested || !pendingUpdate || managedUpdateRunning) return false
+  if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') return false
+  if (!betweenUpdateTurns()) return false
+  managedUpdateRunning = true
+  try {
+    const svc = await import('./service.mjs')
+    if (!svc.serviceActive(room)) return false
+    const ok = svc.updateService(room) !== false
+    if (!ok) managedUpdateRunning = false
+    return ok
+  } catch (error) {
+    managedUpdateRunning = false
+    process.stderr.write(`\n  ⚠ bridge update failed: ${error?.message || error}\n`)
+    return false
+  }
+}
+
+setInterval(() => { if (applyRequested) void applyStandaloneManagedUpdate() }, 5000).unref()
+
 // After the attached CLI exits, the host's stdin stops feeding a PTY —
 // restore the cooked terminal so Ctrl-C reaches the bridge itself.
 const detachLocal = () => {
@@ -3807,8 +3838,8 @@ channel
     // inferred "working…" state (no turn → no result to clear it; the old bug).
     // Instead announce a ◆ control line both readers see. Claude /compact + any
     // other slash still flow through as a real, self-terminating turn.
-    const ctlLine = (ctlText) => {
-      const evt = { kind: 'control', text: ctlText, by: payload.by, cid: payload.cid }
+    const ctlLine = (ctlText, details = {}) => {
+      const evt = { kind: 'control', text: ctlText, by: payload.by, cid: payload.cid, ...details }
       pushLog(s, evt)
       bcast('code-event', { term: payload.term, evt })
     }
@@ -3904,7 +3935,7 @@ channel
     if (/^\/compact\s*$/.test(text)) {
       if (s.runtime === 'codex') {
         if (s.session.turnActive) {
-          ctlLine('finish or stop the current Codex turn before compacting context')
+          ctlLine('Compact after this turn ends.', { tone: 'caution' })
           return
         }
         const recap = buildRecapFromLog(s.log, RECAP_CAP, { reason: 'compact' })
@@ -4116,6 +4147,42 @@ channel
       try { process.send({ t: 'apply-update' }) } catch { /* parent gone */ }
     }
   })
+  // Authenticated + acknowledged update contract used by both the room card and
+  // the dashboard's room-scoped fallback. Unlike the legacy apply-update event,
+  // this does not depend on the bridge having discovered npm first: the web names
+  // the advertised target, the host updater independently resolves npm latest,
+  // and only a managed service is allowed to accept the operation.
+  .on('broadcast', { event: 'bridge-update' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error, state) => channel.send({
+      type: 'broadcast', event: 'bridge-update-res',
+      payload: { nonce, ok, ...(error ? { error } : {}), ...(state ? { state } : {}) },
+    })
+    if (!nonce || !(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
+    const target = typeof payload?.v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(payload.v)
+      ? payload.v : null
+    if (!target) return reply(false, 'invalid bridge version')
+
+    surfaceUpdate(target)
+    applyRequested = true
+    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+      try { process.send({ t: 'apply-update' }) } catch { return reply(false, 'account supervisor is unavailable') }
+      return reply(true, null, 'queued')
+    }
+
+    let managed = false
+    try {
+      const svc = await import('./service.mjs')
+      managed = svc.serviceActive(room)
+    } catch { /* reported as an explicit foreground refusal below */ }
+    if (!managed) {
+      applyRequested = false
+      return reply(false, 'This bridge is running in a terminal. Restart it once with npx thinkpool-pair@latest, or install the background service to enable remote updates.')
+    }
+    if (!betweenUpdateTurns()) return reply(true, null, 'queued')
+    await reply(true, null, 'applying')
+    void applyStandaloneManagedUpdate()
+  })
   // Persist + re-announce terminal renames. The web also echoes term-rename to
   // online peers directly; storing it here is what reaches a device that joins
   // LATER (or a second machine) — those only ever see the announce.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.287",
+  "version": "0.7.289",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {