thinkpool-pair 0.7.291 → 0.7.292

package/bridge.mjs

@@ -252,7 +252,9 @@ if (argv[0] === 'restart-service') {
   const arg1 = argv[1] || ''
   const svcRoom = (!arg1 || arg1.startsWith('-')) ? null : arg1.toUpperCase().trim()
   const svc = await import('./service.mjs')
-  const ok = argv.includes('--current') ? svc.restartService(svcRoom) : svc.updateService(svcRoom)
+  const ok = argv.includes('--current')
+    ? svc.restartService(svcRoom)
+    : await svc.updateAndConfirmService(svcRoom)
   process.exit(ok ? 0 : 1)
 }
 
@@ -346,8 +348,12 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
     restartService: ({ room = null } = {}) => { svc.restartService(room) },
-    // Menu and CLI share the same registry-resolve → repin → reload implementation.
-    restartUpdateService: ({ room = null } = {}) => { svc.updateService(room) },
+    // The menu waits for OS-level proof before claiming success. In-service web
+    // updates keep using updateService(), whose non-blocking handoff is required
+    // because replacing the service tears down its own process tree.
+    restartUpdateService: async ({ room = null } = {}) => process.platform === 'win32'
+      ? svc.updateService(room)
+      : svc.updateAndConfirmService(room),
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
     // Provider config is NOT terminal — it writes provider.json and returns to the
     // menu so you can pick a model, switch back, or do something else. (It used to

package/launcher.mjs

@@ -16,7 +16,7 @@ import path from 'node:path'
 import { execSync } from 'node:child_process'
 import { detectProvider, fetchModels, ANTHROPIC_COMPATIBLE, gatewayHint } from './byok-detect.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
-import { darwinServiceRunning } from './service.mjs'
+import { darwinServiceRunning, serviceRuntimeVersion } from './service.mjs'
 
 const HOME = os.homedir()
 const CFG_DIR = path.join(HOME, '.thinkpool-pair')
@@ -28,16 +28,8 @@ const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./pack
 
 export const KNOWN_AGENTS = [
   { label: 'Claude Code', cmd: 'claude', resume: ['--continue'] },
-  { label: 'Codex CLI',   cmd: 'codex' },
-  { label: 'Hermes Agent', cmd: 'thinkpool' },
-  { label: 'Gemini CLI',  cmd: 'gemini' },
-  { label: 'Aider',       cmd: 'aider' },
-  { label: 'Cursor CLI',  cmd: 'cursor-agent' },
-  { label: 'opencode',    cmd: 'opencode' },
-  { label: 'Copilot CLI', cmd: 'copilot' },
-  { label: 'Goose',       cmd: 'goose' },
-  { label: 'Crush',       cmd: 'crush' },
-  { label: 'Qwen Code',   cmd: 'qwen' },
+  { label: 'Codex',       cmd: 'codex' },
+  { label: 'Hermes',      cmd: 'thinkpool' },
 ]
 
 function onPath(c) {
@@ -82,6 +74,7 @@ export function detectState() {
   const isCustom = !!provider?.provider && provider.provider !== 'anthropic'
   const hermesInstalled = onPath('hermes')
   const hermesReady = onPath('thinkpool') && probeHermesRuntime().available
+  const accountSvc = serviceLoaded(null)
   return {
     loggedIn: !!auth?.refresh_token,
     email: auth?.email || auth?.user?.email || null,
@@ -90,7 +83,9 @@ export function detectState() {
     agents: KNOWN_AGENTS.filter(a => onPath(a.cmd) && (a.cmd !== 'thinkpool' || hermesReady)),
     hermesInstalled,
     hermesReady,
-    accountSvc: serviceLoaded(null),
+    accountSvc,
+    serviceVersion: accountSvc ? serviceRuntimeVersion(null) : null,
+    platform: process.platform,
     cwd: process.cwd(),
     version: VERSION,
   }
@@ -107,7 +102,19 @@ const C = {
 // reflects the change (real bridge passes detectState; tests omit it to keep the
 // injected state stable).
 export async function runLauncher({ actions, io, state = detectState(), refresh = null }) {
-  const resync = () => { if (refresh) state = refresh() }
+  const normalizeState = (next) => ({
+    ...next,
+    agents: Array.isArray(next?.agents) ? next.agents : [],
+    loggedIn: !!next?.loggedIn,
+    accountSvc: !!next?.accountSvc,
+    serviceVersion: typeof next?.serviceVersion === 'string' && next.serviceVersion ? next.serviceVersion : null,
+    platform: next?.platform || process.platform,
+    provider: next?.provider || 'Anthropic (default)',
+    cwd: next?.cwd || process.cwd(),
+    version: next?.version || VERSION,
+  })
+  state = normalizeState(state)
+  const resync = () => { if (refresh) state = normalizeState(refresh()) }
   const askChoice = async (prompt, options, def = 1) => {
     options.forEach((o, i) => io.print(`    ${C.cyan(String(i + 1))})  ${o.label}${o.hint ? '  ' + C.dim(o.hint) : ''}`))
     const a = await io.ask(`\n  ${prompt} ${C.dim(`[${def}]`)} ${C.cyan('▸')} `)
@@ -121,12 +128,17 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
 
   const header = () => {
     io.print('')
-    io.print('  ' + C.dim('┌ ') + C.bold('thinkpool-pair') + (state.version ? C.dim(` v${state.version}`) : '') + C.dim(' ' + '─'.repeat(state.version ? 40 - (` v${state.version}`).length : 40)))
+    io.print('  ' + C.dim('┌ ') + C.bold('thinkpool-pair') + C.dim(' ' + '─'.repeat(40)))
+    io.print(`  ${C.dim('│ launcher ')} ${state.version ? `v${state.version}` : 'version unavailable'}`)
     io.print(`  ${C.dim('│ account  ')} ${state.loggedIn ? C.green((state.email || 'linked') + ' ✓') : C.yellow('not linked')}`)
-    io.print(`  ${C.dim('│ provider ')} ${state.provider}`)
-    io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none on PATH')}`)
+    io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none ready')}`)
     io.print(`  ${C.dim('│ directory')} ${C.dim(state.cwd)}`)
-    io.print(`  ${C.dim('│ service  ')} ${state.accountSvc ? C.green('account service installed') : 'none'}`)
+    const bridgeStatus = !state.accountSvc
+      ? 'not installed'
+      : state.platform === 'win32'
+        ? C.green('startup entry installed')
+        : C.green(`running${state.serviceVersion ? ` v${state.serviceVersion}` : ' (version unavailable)'}`)
+    io.print(`  ${C.dim('│ bridge   ')} ${bridgeStatus}`)
     io.print('  ' + C.dim('└' + '─'.repeat(54)) + '\n')
   }
 
@@ -135,7 +147,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
   const pairRoom = async () => {
     const room = (await io.ask(`\n  Room code ${C.dim('(from /code in the web app)')} ${C.cyan('▸')} `)).toUpperCase().trim()
     if (!room) { io.print('  ' + C.yellow('no room — back to menu')); return }
-    if (!state.agents.length) { io.print('\n  ' + C.yellow('No coding-agent CLI on your PATH (claude / codex / gemini / aider …).')); return }
+    if (!state.agents.length) { io.print('\n  ' + C.yellow('No supported agent runtime is ready (Claude Code, Codex, or Hermes).')); return }
     let agent = state.agents[0]
     if (state.agents.length > 1) { io.print('\n  Share which agent?'); agent = state.agents[await askChoice('agent', state.agents.map(a => ({ label: a.label })))] }
     io.print('\n  Run mode?')
@@ -217,30 +229,20 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
   const settingsMenu = async () => {
     for (;;) {
       const options = [
-        { key: 'provider', label: 'LLM provider', hint: `current: ${state.provider}` },
+        { key: 'provider', label: 'Provider', hint: `current: ${state.provider}` },
         { key: 'account', label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
-        { key: 'restart', label: 'Restart & update the bridge', hint: state.accountSvc ? 'pull the newest published version, then restart — sessions resume' : 'none installed' },
-        { key: 'remove', label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
       ]
-      if (state.hermesInstalled) options.push({ key: 'hermes', label: 'Hermes Agent', hint: state.hermesReady ? 'isolated profile ready' : 'set up isolated profile + delegation guard' })
-      options.push({ key: 'back', label: '← Back to main menu', hint: '' })
+      if (state.hermesInstalled) options.push({ key: 'hermes', label: state.hermesReady ? 'Hermes profile' : 'Set up Hermes', hint: state.hermesReady ? 'isolated profile ready' : 'set up isolated profile + delegation guard' })
+      options.push({ key: 'back', label: 'Back to main menu', hint: '' })
       const picked = options[await askChoice('\n  change', options, options.length)]
       if (picked.key === 'back') return
       if (picked.key === 'provider') await providerMenu()
       else if (picked.key === 'account') { await actions.login(); resync(); return }
-      else if (picked.key === 'restart') {
-        if (state.accountSvc) { await actions.restartUpdateService({ room: null }); resync() }
-        else io.print('  ' + C.yellow('no background service installed'))
-      }
-      else if (picked.key === 'remove') {
-        if (state.accountSvc) { await actions.uninstallService({ room: null }); resync() }
-        else io.print('  ' + C.yellow('no background service installed'))
-      }
       else if (picked.key === 'hermes') {
         const setup = await askChoice('\n  Hermes profile', [
           { label: 'Clone active profile', hint: 'copies provider/config explicitly; fresh ThinkPool session history' },
           { label: 'Create clean profile', hint: 'no copied credentials or bundled skills; configure provider afterward' },
-          { label: '← Back', hint: '' },
+          { label: 'Back', hint: '' },
         ], 3)
         if (setup !== 2) { await actions.setupHermes({ mode: setup === 0 ? 'clone' : 'clean' }); resync() }
       }
@@ -261,14 +263,16 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     // Slots 1+2 swap on whether the always-on service is already installed.
     const items = state.accountSvc
       ? [
-          { key: 'restart',   label: 'Restart & update the bridge', hint: 'pull the newest version + restart — sessions resume' },
+          state.platform === 'win32'
+            ? { key: 'restart', label: 'Update startup entry', hint: 'installs the latest version; relaunch the bridge window to apply' }
+            : { key: 'restart', label: 'Restart & update bridge', hint: 'install the latest published version; sessions resume' },
           { key: 'uninstall', label: 'Remove background service', hint: 'stop serving your sessions on this device' },
         ]
       : [
           { key: 'serve',   label: 'Serve all my sessions', hint: 'runs here, Ctrl-C stops it' },
           { key: 'service', label: 'Always-on background service', hint: 'recommended — survives reboot, restarts on crash' },
         ]
-    items.push({ key: 'settings', label: 'Settings', hint: 'provider · account · restart · remove service' })
+    items.push({ key: 'settings', label: 'Settings', hint: `provider · account${state.hermesInstalled ? ' · Hermes profile' : ''}` })
     items.push({ key: 'quit', label: 'Quit', hint: '' })
     const pick = items[await askChoice('choose', items)]
     if (pick.key === 'quit') return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.291",
+  "version": "0.7.292",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -217,7 +217,7 @@ StandardError=append:${log}
 [Install]
 WantedBy=default.target
 `
-    return { file, content, logDir, post: ['systemctl --user daemon-reload', `systemctl --user enable --now ${label(room)}.service`], note: 'Enabled as a systemd --user service. Run `loginctl enable-linger $USER` once to keep it running after logout.' }
+    return { file, content, logDir, post: ['systemctl --user daemon-reload', `systemctl --user enable ${label(room)}.service`, `systemctl --user restart ${label(room)}.service`], note: 'Enabled as a systemd --user service. Run `loginctl enable-linger $USER` once to keep it running after logout.' }
   }
 
   if (platform === 'win32') {
@@ -242,8 +242,40 @@ WantedBy=default.target
 // Parse both legacy npx commands (`thinkpool-pair@<ver>`) and stable runtime commands
 // (`.../runtimes/<ver>/...`).
 export function parseRunningPairVersions(out) {
-  const versions = String(out).match(/(?:thinkpool-pair@|runtimes\/)(\d+\.\d+\.\d+)/g) || []
-  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+/)?.[0]).filter(Boolean))
+  const versions = String(out).match(/(?:thinkpool-pair@|runtimes[\\/])(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/g) || []
+  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0]).filter(Boolean))
+}
+
+// Return a version only when the OS service manager proves that THIS service is
+// both live and configured to execute one unambiguous pair runtime. This is
+// deliberately stricter than isServiceInstalled(): a plist/unit on disk, or a
+// process list that happens to contain thinkpool-pair, is not update evidence.
+// Windows' Startup-folder tier has no service-manager identity to query, so an
+// exact running version cannot be attributed safely and is therefore unproven.
+export function serviceRuntimeSnapshot(room, { platform = process.platform, exec = execSync } = {}) {
+  const exactVersion = (output) => {
+    const versions = parseRunningPairVersions(output)
+    return versions.size === 1 ? [...versions][0] : null
+  }
+  const id = label(room)
+  try {
+    if (platform === 'darwin') {
+      const out = exec(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], shell: '/bin/bash' })
+      const pid = String(out).match(/(^|\n)[ \t]*pid = (\d+)[ \t]*($|\n)/)?.[2]
+      return darwinServiceRunning(out) ? { version: exactVersion(out), pid: pid || null } : null
+    }
+    if (platform === 'linux') {
+      const out = exec(`systemctl --user show ${id}.service --property=ActiveState --property=MainPID --property=ExecStart`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      const pid = String(out).match(/^MainPID=([1-9]\d*)$/m)?.[1]
+      if (!/^ActiveState=active$/m.test(String(out)) || !pid) return null
+      return { version: exactVersion(out), pid }
+    }
+  } catch { /* service manager could not prove a live runtime */ }
+  return null
+}
+
+export function serviceRuntimeVersion(room, options) {
+  return serviceRuntimeSnapshot(room, options)?.version || null
 }
 
 // A macOS update can be invoked FROM a ThinkPool Code room hosted by the very account
@@ -282,7 +314,7 @@ export function buildDarwinReloadHandoff({ targetLabel, targetFile, stagedFile,
     'launchctl enable "$dom/$target" 2>/dev/null || true',
     'for i in $(seq 1 30); do launchctl bootstrap "$dom" "$target_file" 2>/dev/null && break; sleep 0.3; done',
     'for i in $(seq 1 60); do if launchctl print "$dom/$target" 2>/dev/null | grep -F -- "$expected" >/dev/null && launchctl print "$dom/$target" 2>/dev/null | grep -F "state = running" >/dev/null; then ok=1; break; fi; sleep 0.5; done',
-    `if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: true, version: String(version) })}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then launchctl bootout "$dom/$target" 2>/dev/null || true; for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done; cp "$backup_file" "$target_file"; launchctl enable "$dom/$target" 2>/dev/null || true; for i in $(seq 1 30); do if launchctl bootstrap "$dom" "$target_file" 2>/dev/null; then rollback=1; break; fi; sleep 0.3; done; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), error: 'new runtime not confirmed; previous service restored', rolledBack: true })}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), error: 'new runtime not confirmed and rollback failed', rolledBack: false })}' > "$tmp"; fi; fi`,
+    `if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: true, version: String(version), target: String(targetLabel) })}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then launchctl bootout "$dom/$target" 2>/dev/null || true; for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done; cp "$backup_file" "$target_file"; launchctl enable "$dom/$target" 2>/dev/null || true; for i in $(seq 1 30); do if launchctl bootstrap "$dom" "$target_file" 2>/dev/null; then rollback=1; break; fi; sleep 0.3; done; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed; previous service restored', rolledBack: true })}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed and rollback failed', rolledBack: false })}' > "$tmp"; fi; fi`,
     'mv "$tmp" "$status"',
     'rm -f "$staged_file" "$backup_file" "$helper_file"',
     'launchctl bootout "$dom/$helper" >/dev/null 2>&1 || true',
@@ -472,21 +504,109 @@ export function updateService(room, { exec = execSync, install = installService,
   return install(room, [], { version: target, staleProof: true }) !== false
 }
 
+// Menu/CLI-only update path. updateService intentionally returns as soon as it has
+// safely staged an update: on macOS it must do that so an independent launchd helper
+// can replace the service without killing its caller mid-transaction. Consumers that
+// need to say "updated" rather than "staged" must use this primitive instead.
+//
+// All dependencies are injectable so this contract can be tested without a service,
+// a clock, or npm. The default timeout exceeds the launchd handoff's bounded reload
+// and verification loops, but is still finite.
+export async function updateAndConfirmService(room, {
+  platform = process.platform,
+  exec = execSync,
+  update = updateService,
+  install = installService,
+  active = isServiceInstalled,
+  snapshot = serviceRuntimeSnapshot,
+  readStatus = () => {
+    try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
+  },
+  now = Date.now,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  timeoutMs = 55000,
+  pollMs = 250,
+  stderr = process.stderr,
+} = {}) {
+  const before = snapshot(room, { platform, exec })
+  let target = null
+  const captureTarget = (...args) => {
+    const result = exec(...args)
+    const resolved = String(result).trim()
+    if (/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(resolved)) target = resolved
+    return result
+  }
+  const staged = update(room, { exec: captureTarget, install, active }) !== false
+  if (!staged || !target) {
+    stderr.write('  ⚠ update was not confirmed: staging the published runtime failed; the existing service was left unchanged.\n')
+    return false
+  }
+
+  const confirmation = () => {
+    const live = snapshot(room, { platform, exec })
+    const versionChanged = !!before && before.version !== target
+    const processChanged = !!before?.pid && !!live?.pid && before.pid !== live.pid
+    if (live?.version === target && (versionChanged || processChanged)) {
+      stderr.write(`  ✓ bridge restart confirmed — running v${target}.\n`)
+      return { ok: true, live }
+    }
+    return { ok: false, live }
+  }
+  const printUnconfirmed = ({ live } = {}) => {
+    if (live?.version && live.version !== target) stderr.write(`  ⚠ update v${target} was not confirmed: live service is still v${live.version}.\n`)
+    else if (live?.version === target) stderr.write(`  ⚠ update v${target} was not confirmed: the service process did not restart.\n`)
+    else stderr.write(`  ⚠ update v${target} was not confirmed: the service manager cannot prove the new runtime is running.\n`)
+  }
+
+  // systemd's restart is synchronous. The Windows Startup-folder tier has no
+  // authoritative live-service identity, so callers use updateService directly
+  // and label it as a next-launch update rather than a completed restart.
+  if (platform !== 'darwin') {
+    const proof = confirmation()
+    if (!proof.ok) printUnconfirmed(proof)
+    return proof.ok
+  }
+
+  const deadline = now() + Math.max(0, Number(timeoutMs) || 0)
+  const expectedTarget = label(room)
+  let lastProof = null
+  for (;;) {
+    const status = readStatus()
+    if (status && typeof status === 'object' && status.target === expectedTarget) {
+      if (status.ok === false && status.version === target) {
+        stderr.write(`  ⚠ update v${target} was not confirmed: ${status.error || 'the launchd handoff failed'}.\n`)
+        return false
+      }
+      if (status.ok === true && status.version === target) {
+        lastProof = confirmation()
+        if (lastProof.ok) return true
+      }
+    }
+    if (now() >= deadline) {
+      if (lastProof) printUnconfirmed(lastProof)
+      else stderr.write(`  ⚠ update v${target} timed out waiting for launchd confirmation; the service may have rolled back.\n`)
+      return false
+    }
+    await sleep(Math.max(1, Number(pollMs) || 1))
+  }
+}
+
 // Ground truth: is the OS service manager ACTUALLY running our service right now?
 // A leftover plist/unit on disk does NOT mean it's loaded — `launchctl load` can
 // silently no-op (the 2026-06-26 "says installed but it's off" bug), and a unit can
 // be left disabled. Ask the manager, don't trust file presence. room falsy → account.
-export function serviceActive(room) {
-  const plat = process.platform
+export function serviceActive(room, { platform = process.platform, exec = execSync } = {}) {
+  const plat = platform
   const id = label(room)
   try {
     if (plat === 'darwin') {
-      const out = execSync(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      const out = exec(`launchctl print gui/$(id -u)/${id}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
       return darwinServiceRunning(out)
     }
-    if (plat === 'linux')  { execSync(`systemctl --user is-active --quiet ${id}.service`); return true }
-    // Windows has no managed daemon — the Startup-folder script's presence is the only proxy.
-    return fs.existsSync(buildArtifact(plat, { room }).file)
+    if (plat === 'linux')  { exec(`systemctl --user is-active --quiet ${id}.service`); return true }
+    // A Startup entry is install evidence, never proof that its console process
+    // is alive. Windows has no per-user manager we can query authoritatively.
+    return false
   } catch { return false }
 }
 
@@ -495,6 +615,9 @@ export function serviceActive(room) {
 // service. Reflects launchd/systemd reality, not just file existence (so a plist that
 // failed to load reads as not-installed → the menu re-offers install, which self-heals).
 export function isServiceInstalled(room) {
+  if (process.platform === 'win32') {
+    try { return fs.existsSync(buildArtifact('win32', { room }).file) } catch { return false }
+  }
   return serviceActive(room)
 }