thinkpool-pair 0.7.290 → 0.7.292

package/bridge.mjs

@@ -120,6 +120,7 @@ import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, ImageEventQueue, imageQueueConfig, uploadCodeImage as uploadCodeImageRequest, usageReportLine, codexUsageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
+import { createLatestReplayPump, requestedReplayIds } from './replay-transport.mjs'
 import { classifyCodeEvent, unknownCodeEventNotice } from './code-event-contract.mjs'
 import { fetchPairControlDeliveryAuthority } from './pair-control-authority.mjs'
 import { SIDE_HANDOFF_PROMPT, SIDE_ROLE_PROMPT, appendSideContext, assistantTextSince, sideContextBlock, sideSnapshot } from './side-lane.mjs'
@@ -251,7 +252,9 @@ if (argv[0] === 'restart-service') {
   const arg1 = argv[1] || ''
   const svcRoom = (!arg1 || arg1.startsWith('-')) ? null : arg1.toUpperCase().trim()
   const svc = await import('./service.mjs')
-  const ok = argv.includes('--current') ? svc.restartService(svcRoom) : svc.updateService(svcRoom)
+  const ok = argv.includes('--current')
+    ? svc.restartService(svcRoom)
+    : await svc.updateAndConfirmService(svcRoom)
   process.exit(ok ? 0 : 1)
 }
 
@@ -345,8 +348,12 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
     restartService: ({ room = null } = {}) => { svc.restartService(room) },
-    // Menu and CLI share the same registry-resolve → repin → reload implementation.
-    restartUpdateService: ({ room = null } = {}) => { svc.updateService(room) },
+    // The menu waits for OS-level proof before claiming success. In-service web
+    // updates keep using updateService(), whose non-blocking handoff is required
+    // because replacing the service tears down its own process tree.
+    restartUpdateService: async ({ room = null } = {}) => process.platform === 'win32'
+      ? svc.updateService(room)
+      : svc.updateAndConfirmService(room),
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
     // Provider config is NOT terminal — it writes provider.json and returns to the
     // menu so you can pick a model, switch back, or do something else. (It used to
@@ -574,6 +581,7 @@ if (process.stdin.isTTY && !headless && process.env.THINKPOOL_PAIR_AUTOUPDATE !=
 }
 const name = process.env.TP_NAME || os.userInfo().username || 'host'
 const BRIDGE_ID = (randomUUID?.().slice(0,8)) || 'bridgexx'
+const BRIDGE_STARTED_AT = Date.now()
 // host: this machine's short label — os.hostname() with any DNS/domain suffix
 // stripped and capped ~24 chars. A /code room can be served by different bridges
 // over time (Max's Mac vs Conrad's Linux box); the client uses this to show WHICH
@@ -957,6 +965,13 @@ function beginStructuredTurn(entry, now = Date.now()) {
   return true
 }
 
+function advanceStructuredTurn(entry, now = Date.now()) {
+  entry._turnRev = (Number(entry._turnRev) || 0) + 1
+  entry._turnStart = now
+  entry._busyAnn = true
+  return true
+}
+
 function stampStructuredTurn(entry, event) {
   if (event && event.turnRev == null && Number(entry?._turnRev) > 0) event.turnRev = entry._turnRev
   return event
@@ -1064,17 +1079,21 @@ const defendFrame = (event, payload) => {
   return p
 }
 
-const bcast = (event, payload, ch = channel) => {
+const bcastAwait = async (event, payload, ch = channel) => {
   if (event === 'pty-out' || event === 'code-event') lastActivity = Date.now()
   payload = defendFrame(event, payload)
   try {
     if (ch.channelAdapter?.canPush?.() ?? true) {
-      ch.send({ type: 'broadcast', event, payload })
+      return await ch.send({ type: 'broadcast', event, payload })
     } else {
-      ch.httpSend(event, payload).catch(() => { /* offline — replay covers it */ })
+      return await ch.httpSend(event, payload)
     }
-  } catch { /* noop */ }
+  } catch { return null /* offline — replay covers it */ }
 }
+const bcast = (event, payload, ch = channel) => { void bcastAwait(event, payload, ch) }
+const replayPump = createLatestReplayPump({
+  send: ({ event, payload }) => bcastAwait(event, payload),
+})
 
 // Per-room terminal display names (id -> label), set by the web's `term-rename`.
 // Persisted on the host so a rename is cross-device + survives a bridge restart;
@@ -1093,7 +1112,7 @@ const announce = () => {
   const provNames = providerNameMap()
   const rev = ++announceRev
   return bcast('bridge', {
-    v: 2, name, bridge_id: BRIDGE_ID, rev, repo: repoLabel, branch: readBranch(),
+    v: 2, name, bridge_id: BRIDGE_ID, started_at: BRIDGE_STARTED_AT, rev, repo: repoLabel, branch: readBranch(),
     // sdkWarn: the auto-pulled agent SDK failed its boot compatibility smoke test —
     // surfaced so the room can show a banner (turns may misbehave; pin a good SDK).
     ...(sdkStatus.ok === false ? { sdkWarn: `${sdkStatus.version}: ${sdkStatus.reason}` } : {}),
@@ -2876,6 +2895,20 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     // per-machine default (provider.mjs/applyProviderEnv). null for built-in/unknown → the
     // default Claude env is left exactly as-is (unchanged path).
     env: { ...process.env, ...buildConductorEnv({ flowSessionId, mode }), ...(resolveProviderEnv(provider) || {}), TP_MOCKUP_OUTBOX: mockupOutbox },
+    onTurnStart: (options = {}) => {
+      // Hermes promotes /queue items internally, without a second code-turn.
+      // Advance the lifecycle before its first output and publish the deferred
+      // human line under the new turn revision, keeping all viewers converged.
+      if (entry._busyAnn === true) advanceStructuredTurn(entry)
+      else beginStructuredTurn(entry)
+      const queuedEcho = options._thinkpoolQueuedEcho
+      if (queuedEcho) {
+        const evt = { kind: 'you', ...queuedEcho }
+        pushLog(entry, evt)
+        bcast('code-event', { term: id, evt })
+      }
+      announce()
+    },
     onEvent: (evt) => {
       if (!classifyCodeEvent(evt).known) {
         // Never archive or replay an unknown provider payload as a known fact. Do
@@ -2933,7 +2966,9 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // replay-union dedupes ONLY by cid, and SDK events carry none — without an
       // id, an event that arrives both live AND in a reconnect replay renders
       // twice (the 2026-06-19 duplicate-message bug). See event-id.mjs.
-      const busyChanged = syncStructuredTurn(entry)
+      const continuesQueued = runtime === 'hermes' && (evt.kind === 'result' || evt.kind === 'error') && (entry.session?.queuedDepth || 0) > 0
+      if (continuesQueued) evt.continuesQueued = true
+      const busyChanged = continuesQueued ? false : syncStructuredTurn(entry)
       stampStructuredTurn(entry, evt)
       stampEvent(evt)
       const stalledChanged = evt.kind === 'stalled' ? !entry.stalled : !!entry.stalled
@@ -3651,14 +3686,17 @@ channel
     // Flush pending bytes first so the replay is complete up to "now"; both
     // ride the same ordered socket, so the client sees replay-then-live.
     flushAll()
-    for (const [id, t] of terms) {
+    const to = payload?.to ?? null
+    const requestId = String(payload?.requestId || randomUUID?.() || `${Date.now()}`)
+    const frames = []
+    for (const [id, t] of requestedReplayIds(terms, payload?.terms, payload?.priority)) {
       if (!t.scrollback) continue
       // Cap scrollback too — a huge PTY buffer would blow the same frame limit.
       const sb = t.scrollback.length > 100000 ? t.scrollback.slice(-100000) : t.scrollback
-      bcast('pty-replay', {
-        to: payload?.to ?? null, term: id,
+      frames.push({ event: 'pty-replay', payload: {
+        to, term: id, requestId,
         b64: Buffer.from(sb, 'utf8').toString('base64'),
-      })
+      } })
     }
     // Structured sessions replay their event log (reader rebuilds from it).
     // C1 (RT-2): send only the tail past the client's per-term cursor (seqHi) when
@@ -3669,14 +3707,13 @@ channel
     // cursor) still gets the full log.
     // Hydrate the viewed lane first. Other terminals still warm in the background,
     // but cannot queue ahead of the transcript the person is waiting to see.
-    const replaySessions = [...sessions.entries()].sort(([a], [b]) =>
-      a === payload?.priority ? -1 : b === payload?.priority ? 1 : 0)
+    const replaySessions = requestedReplayIds(sessions, payload?.terms, payload?.priority)
     for (const [id, s] of replaySessions) {
       // An explicit empty replay is an acknowledgement, not data. It lets mixed
       // clients clear their loading cover even if they missed the announce's
       // hasTranscript:false state.
       if (!s.log.length) {
-        bcast('code-replay', { to: payload?.to ?? null, term: id, events: [], empty: true })
+        frames.push({ event: 'code-replay', payload: { to, term: id, requestId, chunkIndex: 0, chunkCount: 1, events: [], empty: true } })
         continue
       }
       const from = Number(payload?.cursors?.[id]) || 0
@@ -3716,10 +3753,14 @@ channel
       // trimmedBefore rides the FIRST (oldest) chunk only — the later chunks are contiguous
       // with it, so a stamp there would read as a second, phantom gap. Same rule as
       // lastUsage above and hasMore on history-page below.
-      let firstChunk = true
-      for (const events of chunks) {
-        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}), ...(firstChunk && trimmedBefore != null ? { trimmedBefore } : {}), ...(firstChunk && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}) })
-        firstChunk = false
+      for (let chunkIndex = 0; chunkIndex < chunks.length; chunkIndex++) {
+        const events = chunks[chunkIndex]
+        frames.push({ event: 'code-replay', payload: {
+          to, term: id, requestId, chunkIndex, chunkCount: chunks.length, events,
+          ...(ahead ? { reset: true } : {}),
+          ...(chunkIndex === 0 && trimmedBefore != null ? { trimmedBefore } : {}),
+          ...(chunkIndex === 0 && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}),
+        } })
       }
     }
     // Re-send any still-pending permission/question cards. They ride a one-shot
@@ -3728,10 +3769,15 @@ channel
     // (unanswered) tool row — the AskUserQuestion "vanished on reconnect" bug. Only
     // truly-unresolved cards remain in `pending` (resolved ones are deleted), and
     // the client dedupes code-perm-req by id, so this can't resurrect an answered one.
-    for (const [, s] of sessions) {
-      for (const [, p] of s.pending) bcast('code-perm-req', p.payload)
-    }
-    announce()
+    // One awaited frame per event-loop turn. A newer request from this viewer
+    // replaces every unsent frame from the older one, so visibility/online races
+    // cannot multiply a cold replay into several concurrent megabyte bursts.
+    replayPump.enqueue(to || '*', frames, async () => {
+      for (const [, s] of sessions) {
+        for (const [, p] of s.pending) await bcastAwait('code-perm-req', p.payload)
+      }
+      announce()
+    })
   })
   // "Load earlier history": serve an OLDER page from the durable JSONL archive (the
   // events the in-memory 2000-cap evicted). beforeSeq anchors the page at the client's
@@ -3750,11 +3796,12 @@ channel
     if (!servesHistoryPage({ payloadHost: payload?.host, bridgeName: name, hasSession: sessions.has(id), hasArchive: hasDurableArchive(room, id) })) return
     const { events, hasMore } = readDurablePage(room, id, Number(payload?.beforeSeq) || null, 200)
     const to = payload?.to ?? null
-    if (!events.length) { bcast('history-page', { to, term: id, events: [], hasMore: false }); return }
+    const requestId = String(payload?.requestId || randomUUID?.() || `${Date.now()}`)
+    if (!events.length) { bcast('history-page', { to, term: id, requestId, chunkIndex: 0, chunkCount: 1, events: [], hasMore: false }); return }
     const chunks = chunkReplayEvents(events.map((e) => boundEventForBroadcast(e)))
     // hasMore rides only the FIRST (oldest) chunk so the client sets the floor flag once
     // from the true page boundary; later chunks are just more of the same page.
-    chunks.forEach((evs, i) => bcast('history-page', { to, term: id, events: evs, hasMore: i === 0 ? hasMore : true }))
+    chunks.forEach((evs, i) => bcast('history-page', { to, term: id, requestId, chunkIndex: i, chunkCount: chunks.length, events: evs, hasMore: i === 0 ? hasMore : true }))
   })
   .on('broadcast', { event: 'file-put' }, ({ payload }) => {
     if (!payload?.id || !payload?.url) return
@@ -4030,13 +4077,24 @@ channel
     const nativeImages = s.runtime === 'codex' || s.runtime === 'hermes'
       ? await waitForNativeImages(payload.files, { updir: UPDIR })
       : []
+    const deferHermesQueueEcho = s.runtime === 'hermes' && s.session.turnActive && /^\s*\/queue\s+/i.test(text)
+    const turnOptions = {
+      ...(nativeImages.length ? { images: nativeImages } : {}),
+      ...(deferHermesQueueEcho && !payload.silent ? { _thinkpoolQueuedEcho: {
+        text: payload.body != null ? String(payload.body) : text,
+        cid: payload.cid,
+        by: payload.by,
+        ...(Array.isArray(payload.files) && payload.files.length ? { files: payload.files } : {}),
+        ...(Array.isArray(payload.pastes) && payload.pastes.length ? { pastes: payload.pastes } : {}),
+      } } : {}),
+    }
     // Sample the runtime before dispatch so a missed prior falling edge cannot
     // make this genuinely new turn inherit the previous turn's revision.
     syncStructuredTurn(s)
-    const accepted = s.session.sendTurn(sendText, nativeImages.length ? { images: nativeImages } : undefined)
+    const accepted = s.session.sendTurn(sendText, Object.keys(turnOptions).length ? turnOptions : undefined)
     if (accepted === false) syncStructuredTurn(s)
     else beginStructuredTurn(s)
-    echoYou()
+    if (!deferHermesQueueEcho || accepted === false) echoYou()
     if (accepted === false) {
       // A runtime that did not accept a turn must still close the optimistic
       // user-line lifecycle. Without this boundary the client truthfully shows
@@ -4312,7 +4370,7 @@ channel
   .subscribe(async status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
-      trackPresence({ name, role: 'bridge', bridge_id: BRIDGE_ID })
+      trackPresence({ name, role: 'bridge', bridge_id: BRIDGE_ID, started_at: BRIDGE_STARTED_AT })
       const startCmd = attachedCmd || autoAgent   // autoAgent: account-mode auto-open (headless)
       if (startCmd && !terms.size && !sessions.size) {
         // Claude + structured mode → Agent SDK session; everything else → PTY.

package/hermes-session.mjs

@@ -68,7 +68,7 @@ export function startHermesSession({
   command = HERMES_COMMAND, args = ['acp'], clientFactory = createAcpClient,
   mcpHttpFactory = startCodexMcpHttp, lazy = false, hermesRole = null,
   crossPostGate = null, didSpawnTarget = null, crossRoomPostGate = null, effort = 'high',
-  admitStart = null,
+  admitStart = null, onTurnStart = null,
 } = {}) {
   let activeCwd = cwd
   const requestedModel = model || null
@@ -503,6 +503,7 @@ export function startHermesSession({
         const next = queuedTurns.shift()
         const turnId = ++activeTurnId
         turnActive = true
+        try { onTurnStart?.(next.options || {}) } catch { /* observer cannot break the FIFO */ }
         try { await runPrompt(next.text, next.options, { steering: false, turnId, promptIndex: next.promptIndex, forceFull: next.forceFull }) }
         catch (error) { turnActive = false; emit({ kind: 'error', message: `Hermes queued turn failed: ${error?.message || error}`, recoverable: true }) }
       }
@@ -514,6 +515,7 @@ export function startHermesSession({
   return {
     get sessionId() { return sessionId },
     get turnActive() { return turnActive },
+    get queuedDepth() { return queuedTurns.length },
     get canSteer() { return !!client?.alive },
     get started() { return started },
     get models() { return [] },

package/launcher.mjs

@@ -16,7 +16,7 @@ import path from 'node:path'
 import { execSync } from 'node:child_process'
 import { detectProvider, fetchModels, ANTHROPIC_COMPATIBLE, gatewayHint } from './byok-detect.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
-import { darwinServiceRunning } from './service.mjs'
+import { darwinServiceRunning, serviceRuntimeVersion } from './service.mjs'
 
 const HOME = os.homedir()
 const CFG_DIR = path.join(HOME, '.thinkpool-pair')
@@ -28,16 +28,8 @@ const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./pack
 
 export const KNOWN_AGENTS = [
   { label: 'Claude Code', cmd: 'claude', resume: ['--continue'] },
-  { label: 'Codex CLI',   cmd: 'codex' },
-  { label: 'Hermes Agent', cmd: 'thinkpool' },
-  { label: 'Gemini CLI',  cmd: 'gemini' },
-  { label: 'Aider',       cmd: 'aider' },
-  { label: 'Cursor CLI',  cmd: 'cursor-agent' },
-  { label: 'opencode',    cmd: 'opencode' },
-  { label: 'Copilot CLI', cmd: 'copilot' },
-  { label: 'Goose',       cmd: 'goose' },
-  { label: 'Crush',       cmd: 'crush' },
-  { label: 'Qwen Code',   cmd: 'qwen' },
+  { label: 'Codex',       cmd: 'codex' },
+  { label: 'Hermes',      cmd: 'thinkpool' },
 ]
 
 function onPath(c) {
@@ -82,6 +74,7 @@ export function detectState() {
   const isCustom = !!provider?.provider && provider.provider !== 'anthropic'
   const hermesInstalled = onPath('hermes')
   const hermesReady = onPath('thinkpool') && probeHermesRuntime().available
+  const accountSvc = serviceLoaded(null)
   return {
     loggedIn: !!auth?.refresh_token,
     email: auth?.email || auth?.user?.email || null,
@@ -90,7 +83,9 @@ export function detectState() {
     agents: KNOWN_AGENTS.filter(a => onPath(a.cmd) && (a.cmd !== 'thinkpool' || hermesReady)),
     hermesInstalled,
     hermesReady,
-    accountSvc: serviceLoaded(null),
+    accountSvc,
+    serviceVersion: accountSvc ? serviceRuntimeVersion(null) : null,
+    platform: process.platform,
     cwd: process.cwd(),
     version: VERSION,
   }
@@ -107,7 +102,19 @@ const C = {
 // reflects the change (real bridge passes detectState; tests omit it to keep the
 // injected state stable).
 export async function runLauncher({ actions, io, state = detectState(), refresh = null }) {
-  const resync = () => { if (refresh) state = refresh() }
+  const normalizeState = (next) => ({
+    ...next,
+    agents: Array.isArray(next?.agents) ? next.agents : [],
+    loggedIn: !!next?.loggedIn,
+    accountSvc: !!next?.accountSvc,
+    serviceVersion: typeof next?.serviceVersion === 'string' && next.serviceVersion ? next.serviceVersion : null,
+    platform: next?.platform || process.platform,
+    provider: next?.provider || 'Anthropic (default)',
+    cwd: next?.cwd || process.cwd(),
+    version: next?.version || VERSION,
+  })
+  state = normalizeState(state)
+  const resync = () => { if (refresh) state = normalizeState(refresh()) }
   const askChoice = async (prompt, options, def = 1) => {
     options.forEach((o, i) => io.print(`    ${C.cyan(String(i + 1))})  ${o.label}${o.hint ? '  ' + C.dim(o.hint) : ''}`))
     const a = await io.ask(`\n  ${prompt} ${C.dim(`[${def}]`)} ${C.cyan('▸')} `)
@@ -121,12 +128,17 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
 
   const header = () => {
     io.print('')
-    io.print('  ' + C.dim('┌ ') + C.bold('thinkpool-pair') + (state.version ? C.dim(` v${state.version}`) : '') + C.dim(' ' + '─'.repeat(state.version ? 40 - (` v${state.version}`).length : 40)))
+    io.print('  ' + C.dim('┌ ') + C.bold('thinkpool-pair') + C.dim(' ' + '─'.repeat(40)))
+    io.print(`  ${C.dim('│ launcher ')} ${state.version ? `v${state.version}` : 'version unavailable'}`)
     io.print(`  ${C.dim('│ account  ')} ${state.loggedIn ? C.green((state.email || 'linked') + ' ✓') : C.yellow('not linked')}`)
-    io.print(`  ${C.dim('│ provider ')} ${state.provider}`)
-    io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none on PATH')}`)
+    io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none ready')}`)
     io.print(`  ${C.dim('│ directory')} ${C.dim(state.cwd)}`)
-    io.print(`  ${C.dim('│ service  ')} ${state.accountSvc ? C.green('account service installed') : 'none'}`)
+    const bridgeStatus = !state.accountSvc
+      ? 'not installed'
+      : state.platform === 'win32'
+        ? C.green('startup entry installed')
+        : C.green(`running${state.serviceVersion ? ` v${state.serviceVersion}` : ' (version unavailable)'}`)
+    io.print(`  ${C.dim('│ bridge   ')} ${bridgeStatus}`)
     io.print('  ' + C.dim('└' + '─'.repeat(54)) + '\n')
   }
 
@@ -135,7 +147,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
   const pairRoom = async () => {
     const room = (await io.ask(`\n  Room code ${C.dim('(from /code in the web app)')} ${C.cyan('▸')} `)).toUpperCase().trim()
     if (!room) { io.print('  ' + C.yellow('no room — back to menu')); return }
-    if (!state.agents.length) { io.print('\n  ' + C.yellow('No coding-agent CLI on your PATH (claude / codex / gemini / aider …).')); return }
+    if (!state.agents.length) { io.print('\n  ' + C.yellow('No supported agent runtime is ready (Claude Code, Codex, or Hermes).')); return }
     let agent = state.agents[0]
     if (state.agents.length > 1) { io.print('\n  Share which agent?'); agent = state.agents[await askChoice('agent', state.agents.map(a => ({ label: a.label })))] }
     io.print('\n  Run mode?')
@@ -217,30 +229,20 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
   const settingsMenu = async () => {
     for (;;) {
       const options = [
-        { key: 'provider', label: 'LLM provider', hint: `current: ${state.provider}` },
+        { key: 'provider', label: 'Provider', hint: `current: ${state.provider}` },
         { key: 'account', label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
-        { key: 'restart', label: 'Restart & update the bridge', hint: state.accountSvc ? 'pull the newest published version, then restart — sessions resume' : 'none installed' },
-        { key: 'remove', label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
       ]
-      if (state.hermesInstalled) options.push({ key: 'hermes', label: 'Hermes Agent', hint: state.hermesReady ? 'isolated profile ready' : 'set up isolated profile + delegation guard' })
-      options.push({ key: 'back', label: '← Back to main menu', hint: '' })
+      if (state.hermesInstalled) options.push({ key: 'hermes', label: state.hermesReady ? 'Hermes profile' : 'Set up Hermes', hint: state.hermesReady ? 'isolated profile ready' : 'set up isolated profile + delegation guard' })
+      options.push({ key: 'back', label: 'Back to main menu', hint: '' })
       const picked = options[await askChoice('\n  change', options, options.length)]
       if (picked.key === 'back') return
       if (picked.key === 'provider') await providerMenu()
       else if (picked.key === 'account') { await actions.login(); resync(); return }
-      else if (picked.key === 'restart') {
-        if (state.accountSvc) { await actions.restartUpdateService({ room: null }); resync() }
-        else io.print('  ' + C.yellow('no background service installed'))
-      }
-      else if (picked.key === 'remove') {
-        if (state.accountSvc) { await actions.uninstallService({ room: null }); resync() }
-        else io.print('  ' + C.yellow('no background service installed'))
-      }
       else if (picked.key === 'hermes') {
         const setup = await askChoice('\n  Hermes profile', [
           { label: 'Clone active profile', hint: 'copies provider/config explicitly; fresh ThinkPool session history' },
           { label: 'Create clean profile', hint: 'no copied credentials or bundled skills; configure provider afterward' },
-          { label: '← Back', hint: '' },
+          { label: 'Back', hint: '' },
         ], 3)
         if (setup !== 2) { await actions.setupHermes({ mode: setup === 0 ? 'clone' : 'clean' }); resync() }
       }
@@ -261,14 +263,16 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     // Slots 1+2 swap on whether the always-on service is already installed.
     const items = state.accountSvc
       ? [
-          { key: 'restart',   label: 'Restart & update the bridge', hint: 'pull the newest version + restart — sessions resume' },
+          state.platform === 'win32'
+            ? { key: 'restart', label: 'Update startup entry', hint: 'installs the latest version; relaunch the bridge window to apply' }
+            : { key: 'restart', label: 'Restart & update bridge', hint: 'install the latest published version; sessions resume' },
           { key: 'uninstall', label: 'Remove background service', hint: 'stop serving your sessions on this device' },
         ]
       : [
           { key: 'serve',   label: 'Serve all my sessions', hint: 'runs here, Ctrl-C stops it' },
           { key: 'service', label: 'Always-on background service', hint: 'recommended — survives reboot, restarts on crash' },
         ]
-    items.push({ key: 'settings', label: 'Settings', hint: 'provider · account · restart · remove service' })
+    items.push({ key: 'settings', label: 'Settings', hint: `provider · account${state.hermesInstalled ? ' · Hermes profile' : ''}` })
     items.push({ key: 'quit', label: 'Quit', hint: '' })
     const pick = items[await askChoice('choose', items)]
     if (pick.key === 'quit') return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.290",
+  "version": "0.7.292",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -49,6 +49,7 @@
     "pair-control-authority.mjs",
     "event-id.mjs",
     "event-bounds.mjs",
+    "replay-transport.mjs",
     "plan-meters.mjs",
     "recap.mjs",
     "transcript-sanitize.mjs",

package/replay-transport.mjs

@@ -0,0 +1,64 @@
+// Replay transport policy. Reconnects are allowed to supersede older work for
+// the same viewer, and frames are deliberately paced so live events and Stop /
+// permission traffic are not trapped behind a multi-megabyte replay burst.
+
+export function requestedReplayIds(entries, terms, priority) {
+  const requested = Array.isArray(terms) ? new Set(terms.filter(Boolean)) : null
+  return [...entries]
+    .filter(([id]) => !requested || requested.has(id))
+    .sort(([a], [b]) => a === priority ? -1 : b === priority ? 1 : 0)
+}
+
+const defaultYield = () => new Promise((resolve) => setTimeout(resolve, 0))
+
+export function createLatestReplayPump({ send, yieldTurn = defaultYield } = {}) {
+  if (typeof send !== 'function') throw new TypeError('replay pump requires send(frame)')
+  const viewers = new Map()
+
+  const run = async (viewer, state) => {
+    if (state.running) return
+    state.running = true
+    try {
+      while (state.frames.length) {
+        const generation = state.generation
+        const frame = state.frames.shift()
+        await send(frame)
+        await yieldTurn()
+        // enqueue() replaces the remaining frames. The send already in flight is
+        // allowed to finish; nothing older can start after the replacement.
+        if (generation !== state.generation) continue
+      }
+      const done = state.onDone
+      state.onDone = null
+      if (done) await done()
+    } finally {
+      state.running = false
+      if (state.frames.length) void run(viewer, state)
+      else if (viewers.get(viewer) === state) viewers.delete(viewer)
+    }
+  }
+
+  return {
+    enqueue(viewer, frames, onDone = null) {
+      const key = String(viewer || '*')
+      const state = viewers.get(key) || { generation: 0, frames: [], onDone: null, running: false }
+      state.generation += 1
+      state.frames = Array.isArray(frames) ? [...frames] : []
+      state.onDone = typeof onDone === 'function' ? onDone : null
+      viewers.set(key, state)
+      void run(key, state)
+      return state.generation
+    },
+    cancel(viewer) {
+      const state = viewers.get(String(viewer || '*'))
+      if (!state) return false
+      state.generation += 1
+      state.frames = []
+      state.onDone = null
+      return true
+    },
+    pending(viewer) {
+      return viewers.get(String(viewer || '*'))?.frames.length || 0
+    },
+  }
+}

package/service.mjs

@@ -217,7 +217,7 @@ StandardError=append:${log}
 [Install]
 WantedBy=default.target
 `
-    return { file, content, logDir, post: ['systemctl --user daemon-reload', `systemctl --user enable --now ${label(room)}.service`], note: 'Enabled as a systemd --user service. Run `loginctl enable-linger $USER` once to keep it running after logout.' }
+    return { file, content, logDir, post: ['systemctl --user daemon-reload', `systemctl --user enable ${label(room)}.service`, `systemctl --user restart ${label(room)}.service`], note: 'Enabled as a systemd --user service. Run `loginctl enable-linger $USER` once to keep it running after logout.' }
   }
 
   if (platform === 'win32') {
@@ -242,8 +242,40 @@ WantedBy=default.target
 // Parse both legacy npx commands (`thinkpool-pair@<ver>`) and stable runtime commands
 // (`.../runtimes/<ver>/...`).
 export function parseRunningPairVersions(out) {
-  const versions = String(out).match(/(?:thinkpool-pair@|runtimes\/)(\d+\.\d+\.\d+)/g) || []
-  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+/)?.[0]).filter(Boolean))
+  const versions = String(out).match(/(?:thinkpool-pair@|runtimes[\\/])(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/g) || []
+  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0]).filter(Boolean))
+}
+
+// Return a version only when the OS service manager proves that THIS service is
+// both live and configured to execute one unambiguous pair runtime. This is
+// deliberately stricter than isServiceInstalled(): a plist/unit on disk, or a
+// process list that happens to contain thinkpool-pair, is not update evidence.
+// Windows' Startup-folder tier has no service-manager identity to query, so an
+// exact running version cannot be attributed safely and is therefore unproven.
+export function serviceRuntimeSnapshot(room, { platform = process.platform, exec = execSync } = {}) {
+  const exactVersion = (output) => {
+    const versions = parseRunningPairVersions(output)
+    return versions.size === 1 ? [...versions][0] : null
+  }
+  const id = label(room)
+  try {
+    if (platform === 'darwin') {
+      const out = exec(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], shell: '/bin/bash' })
+      const pid = String(out).match(/(^|\n)[ \t]*pid = (\d+)[ \t]*($|\n)/)?.[2]
+      return darwinServiceRunning(out) ? { version: exactVersion(out), pid: pid || null } : null
+    }
+    if (platform === 'linux') {
+      const out = exec(`systemctl --user show ${id}.service --property=ActiveState --property=MainPID --property=ExecStart`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      const pid = String(out).match(/^MainPID=([1-9]\d*)$/m)?.[1]
+      if (!/^ActiveState=active$/m.test(String(out)) || !pid) return null
+      return { version: exactVersion(out), pid }
+    }
+  } catch { /* service manager could not prove a live runtime */ }
+  return null
+}
+
+export function serviceRuntimeVersion(room, options) {
+  return serviceRuntimeSnapshot(room, options)?.version || null
 }
 
 // A macOS update can be invoked FROM a ThinkPool Code room hosted by the very account
@@ -282,7 +314,7 @@ export function buildDarwinReloadHandoff({ targetLabel, targetFile, stagedFile,
     'launchctl enable "$dom/$target" 2>/dev/null || true',
     'for i in $(seq 1 30); do launchctl bootstrap "$dom" "$target_file" 2>/dev/null && break; sleep 0.3; done',
     'for i in $(seq 1 60); do if launchctl print "$dom/$target" 2>/dev/null | grep -F -- "$expected" >/dev/null && launchctl print "$dom/$target" 2>/dev/null | grep -F "state = running" >/dev/null; then ok=1; break; fi; sleep 0.5; done',
-    `if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: true, version: String(version) })}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then launchctl bootout "$dom/$target" 2>/dev/null || true; for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done; cp "$backup_file" "$target_file"; launchctl enable "$dom/$target" 2>/dev/null || true; for i in $(seq 1 30); do if launchctl bootstrap "$dom" "$target_file" 2>/dev/null; then rollback=1; break; fi; sleep 0.3; done; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), error: 'new runtime not confirmed; previous service restored', rolledBack: true })}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), error: 'new runtime not confirmed and rollback failed', rolledBack: false })}' > "$tmp"; fi; fi`,
+    `if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: true, version: String(version), target: String(targetLabel) })}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then launchctl bootout "$dom/$target" 2>/dev/null || true; for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done; cp "$backup_file" "$target_file"; launchctl enable "$dom/$target" 2>/dev/null || true; for i in $(seq 1 30); do if launchctl bootstrap "$dom" "$target_file" 2>/dev/null; then rollback=1; break; fi; sleep 0.3; done; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed; previous service restored', rolledBack: true })}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed and rollback failed', rolledBack: false })}' > "$tmp"; fi; fi`,
     'mv "$tmp" "$status"',
     'rm -f "$staged_file" "$backup_file" "$helper_file"',
     'launchctl bootout "$dom/$helper" >/dev/null 2>&1 || true',
@@ -472,21 +504,109 @@ export function updateService(room, { exec = execSync, install = installService,
   return install(room, [], { version: target, staleProof: true }) !== false
 }
 
+// Menu/CLI-only update path. updateService intentionally returns as soon as it has
+// safely staged an update: on macOS it must do that so an independent launchd helper
+// can replace the service without killing its caller mid-transaction. Consumers that
+// need to say "updated" rather than "staged" must use this primitive instead.
+//
+// All dependencies are injectable so this contract can be tested without a service,
+// a clock, or npm. The default timeout exceeds the launchd handoff's bounded reload
+// and verification loops, but is still finite.
+export async function updateAndConfirmService(room, {
+  platform = process.platform,
+  exec = execSync,
+  update = updateService,
+  install = installService,
+  active = isServiceInstalled,
+  snapshot = serviceRuntimeSnapshot,
+  readStatus = () => {
+    try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
+  },
+  now = Date.now,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  timeoutMs = 55000,
+  pollMs = 250,
+  stderr = process.stderr,
+} = {}) {
+  const before = snapshot(room, { platform, exec })
+  let target = null
+  const captureTarget = (...args) => {
+    const result = exec(...args)
+    const resolved = String(result).trim()
+    if (/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(resolved)) target = resolved
+    return result
+  }
+  const staged = update(room, { exec: captureTarget, install, active }) !== false
+  if (!staged || !target) {
+    stderr.write('  ⚠ update was not confirmed: staging the published runtime failed; the existing service was left unchanged.\n')
+    return false
+  }
+
+  const confirmation = () => {
+    const live = snapshot(room, { platform, exec })
+    const versionChanged = !!before && before.version !== target
+    const processChanged = !!before?.pid && !!live?.pid && before.pid !== live.pid
+    if (live?.version === target && (versionChanged || processChanged)) {
+      stderr.write(`  ✓ bridge restart confirmed — running v${target}.\n`)
+      return { ok: true, live }
+    }
+    return { ok: false, live }
+  }
+  const printUnconfirmed = ({ live } = {}) => {
+    if (live?.version && live.version !== target) stderr.write(`  ⚠ update v${target} was not confirmed: live service is still v${live.version}.\n`)
+    else if (live?.version === target) stderr.write(`  ⚠ update v${target} was not confirmed: the service process did not restart.\n`)
+    else stderr.write(`  ⚠ update v${target} was not confirmed: the service manager cannot prove the new runtime is running.\n`)
+  }
+
+  // systemd's restart is synchronous. The Windows Startup-folder tier has no
+  // authoritative live-service identity, so callers use updateService directly
+  // and label it as a next-launch update rather than a completed restart.
+  if (platform !== 'darwin') {
+    const proof = confirmation()
+    if (!proof.ok) printUnconfirmed(proof)
+    return proof.ok
+  }
+
+  const deadline = now() + Math.max(0, Number(timeoutMs) || 0)
+  const expectedTarget = label(room)
+  let lastProof = null
+  for (;;) {
+    const status = readStatus()
+    if (status && typeof status === 'object' && status.target === expectedTarget) {
+      if (status.ok === false && status.version === target) {
+        stderr.write(`  ⚠ update v${target} was not confirmed: ${status.error || 'the launchd handoff failed'}.\n`)
+        return false
+      }
+      if (status.ok === true && status.version === target) {
+        lastProof = confirmation()
+        if (lastProof.ok) return true
+      }
+    }
+    if (now() >= deadline) {
+      if (lastProof) printUnconfirmed(lastProof)
+      else stderr.write(`  ⚠ update v${target} timed out waiting for launchd confirmation; the service may have rolled back.\n`)
+      return false
+    }
+    await sleep(Math.max(1, Number(pollMs) || 1))
+  }
+}
+
 // Ground truth: is the OS service manager ACTUALLY running our service right now?
 // A leftover plist/unit on disk does NOT mean it's loaded — `launchctl load` can
 // silently no-op (the 2026-06-26 "says installed but it's off" bug), and a unit can
 // be left disabled. Ask the manager, don't trust file presence. room falsy → account.
-export function serviceActive(room) {
-  const plat = process.platform
+export function serviceActive(room, { platform = process.platform, exec = execSync } = {}) {
+  const plat = platform
   const id = label(room)
   try {
     if (plat === 'darwin') {
-      const out = execSync(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      const out = exec(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
       return darwinServiceRunning(out)
     }
-    if (plat === 'linux')  { execSync(`systemctl --user is-active --quiet ${id}.service`); return true }
-    // Windows has no managed daemon — the Startup-folder script's presence is the only proxy.
-    return fs.existsSync(buildArtifact(plat, { room }).file)
+    if (plat === 'linux')  { exec(`systemctl --user is-active --quiet ${id}.service`); return true }
+    // A Startup entry is install evidence, never proof that its console process
+    // is alive. Windows has no per-user manager we can query authoritatively.
+    return false
   } catch { return false }
 }
 
@@ -495,6 +615,9 @@ export function serviceActive(room) {
 // service. Reflects launchd/systemd reality, not just file existence (so a plist that
 // failed to load reads as not-installed → the menu re-offers install, which self-heals).
 export function isServiceInstalled(room) {
+  if (process.platform === 'win32') {
+    try { return fs.existsSync(buildArtifact('win32', { room }).file) } catch { return false }
+  }
   return serviceActive(room)
 }