thinkpool-pair 0.7.294 → 0.7.296

package/bridge.mjs

@@ -39,6 +39,7 @@ import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { serveDecision, fetchServeRow, refusalMessage, gateFailAction } from './serve-consent.mjs'
 import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
+import { reconcileTerminalRows as _reconcileTerminalRows } from './terminal-row-reconcile.mjs'
 import { cancelDurableDispatchPermissions, cancelDurablePermissions } from './dispatch-permission-cleanup.mjs'
 // Slice 3 — the pure decision layer for agent push events (turn-done / needs-input).
 // Unit-tested in bridge/agent-notify.test.mjs; everything with I/O stays here.
@@ -46,7 +47,7 @@ import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummar
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
 import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
@@ -348,9 +349,9 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
       child.on('exit', (code) => process.exit(code == null ? 0 : code))
     }),
     serveAccountForeground: async () => { const { runAccount } = await import('./account.mjs'); await runAccount(SUPABASE_URL, SUPABASE_ANON) },
-    // install / uninstall / restart are NOT terminal — they do their work, print their
-    // notes, and RETURN so the launcher loop drops you back at the menu (the service
-    // runs in its own launchd/systemd process; this launcher isn't itself a bridge).
+    // install / uninstall are NOT terminal — they do their work, print their notes,
+    // and return to the menu. A confirmed update closes the launcher instead: its
+    // in-memory package version is stale while the new service runs independently.
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
     restartService: ({ room = null } = {}) => { svc.restartService(room) },
@@ -595,6 +596,7 @@ const BRIDGE_STARTED_AT = Date.now()
 // box. Distinct from `name` (the driver's username). Announced additively —
 // top-level only (one bridge per announce); older clients ignore the unknown key.
 const host = (os.hostname() || 'host').split('.')[0].slice(0, 24)
+const hostId = bridgeHostId()
 
 // Repo awareness — the room shows which project this machine is sharing.
 // Cheap reads, no subprocess: directory name + .git/HEAD.
@@ -718,6 +720,20 @@ function reapTerminalRow(id) {
     onFailure: ({ error, status }) => process.stderr.write(`\n  ⚠ terminal row reap failed (${String(id).slice(0, 8)}${status ? `, HTTP ${status}` : ''}): ${error || 'unknown error'}\n`),
   })
 }
+
+// Crash/abort counterpart to the clean-close reap above. Called only after the
+// subscribed bridge has restored every on-disk session into `terms`/`sessions`.
+// The stable host filter is load-bearing: another machine's dormant lanes are
+// durable product state, while this machine's missing rows are stale ghosts.
+function reconcileTerminalRows() {
+  return _reconcileTerminalRows({
+    room, hostId, liveIds: [...terms.keys(), ...sessions.keys()], token: codeAuthToken,
+    supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown,
+    onFailure: ({ error, status }) => process.stderr.write(`\n  ⚠ terminal row reconcile failed${status ? ` (HTTP ${status})` : ''}: ${error || 'unknown error'}\n`),
+  }).then(({ reaped }) => {
+    if (reaped.length) process.stderr.write(`\n  ◆ removed ${reaped.length} stale terminal row${reaped.length === 1 ? '' : 's'} after restore.\n`)
+  })
+}
 // Auth: is the sender a PARTICIPANT of THIS room (owner OR granted OR joined)? Room mode
 // serves the room, so RLS returns participants; we confirm the jwt's user is one of them.
 // Pattern (per #218/#219): getUser + uid → REST existence check on code_sessions
@@ -1130,9 +1146,9 @@ const announce = () => {
     cwd, version: VERSION, promptBundle: THINKPOOL_PROMPT_BUNDLE,
     // host: short machine label (see const `host`) so the room shows which box
     // currently serves it + attributes dormant terminals to their home machine.
-    // Additive top-level field; consumed by src/pages/code/room.jsx onAnnounce in
-    // a later lane. Older clients ignore it.
-    host,
+    // Additive top-level fields consumed by src/pages/code/room.jsx onAnnounce.
+    // Older clients ignore them.
+    host, hostId,
     // uid: the authed user id whose bridge is serving this room (owner or grantee).
     // Additive field (older clients ignore it). A grantee bridge watches peer `bridge`
     // announces for uid === owner_id to know the owner's bridge reclaimed the room and
@@ -4460,6 +4476,7 @@ channel
         }
       }
       await announce()
+      void reconcileTerminalRows()
       // Account presence must distinguish a spawned child from a usable room.
       // Signal only after realtime subscribed, durable sessions restored, and the
       // first authoritative roster was announced. The dashboard keeps the bridge

package/launcher.mjs

@@ -278,7 +278,16 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     if (pick.key === 'quit') return
     if (pick.key === 'serve') { if (await ensureLoggedIn()) await actions.serveAccountForeground() }
     else if (pick.key === 'service') { if (await ensureLoggedIn()) { await actions.installService({ room: null }); resync() } }
-    else if (pick.key === 'restart') { await actions.restartUpdateService({ room: null }); resync() }
+    else if (pick.key === 'restart') {
+      const updated = await actions.restartUpdateService({ room: null })
+      // The launcher process cannot update its own in-memory VERSION. Returning to
+      // the menu after a successful service update therefore showed the old launcher
+      // version beside the new managed-service version and ended on a misleading
+      // "press Enter" pause. The service is already independently running, so close
+      // this stale installer process once the OS-level update is confirmed.
+      if (updated === true) return
+      resync()
+    }
     else if (pick.key === 'uninstall') { await actions.uninstallService({ room: null }); resync() }
     else if (pick.key === 'settings') await settingsMenu()
     await io.ask('\n  ' + C.dim('press Enter to return to the menu…'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.294",
+  "version": "0.7.296",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -83,6 +83,7 @@
     "serve-dir.mjs",
     "serve-consent.mjs",
     "reap-terminal.mjs",
+    "terminal-row-reconcile.mjs",
     "switch-provider.mjs",
     "service.mjs",
     "presence.mjs",

package/providers.mjs

@@ -100,6 +100,14 @@ export function ensureKeypair() {
 /** SPKI base64 public key for the announce (`providerPubKey`). */
 export function publicKeyB64() { return ensureKeypair().publicKeyB64 }
 
+// Stable, public machine identity for terminal ownership. `host` is a display
+// label and can be "localhost" on multiple computers; this fingerprint is tied
+// to the bridge's existing keypair without exposing private material. Accepting
+// an explicit public key keeps the identity primitive directly testable.
+export function bridgeHostId(pubKey = publicKeyB64()) {
+  return crypto.createHash('sha256').update(pubKey).digest('hex').slice(0, 32)
+}
+
 // ── seal / unseal (hybrid RSA-OAEP + AES-256-GCM) ───────────────────────
 // seal() is here so the UNIT can drive both ends node-side; the real seal
 // happens in the browser dashboard via WebCrypto against the same envelope.

package/terminal-row-reconcile.mjs

@@ -0,0 +1,65 @@
+/* Reconcile durable terminal rows after a bridge has restored its on-disk roster.
+
+   A clean close is reaped by reap-terminal.mjs. This module closes the other
+   lifecycle boundary: a crash/abort can remove the live session file without a
+   clean-close event, leaving a permanent dormant DB row. A stable public host id
+   makes the bridge authoritative only for its own rows; foreign/null-host rows are
+   deliberately preserved for handover and mixed-version compatibility. */
+
+const outcome = (extra = {}) => ({ reaped: [], ...extra })
+
+export async function reconcileTerminalRows ({
+  room,
+  hostId,
+  liveIds = [],
+  token,
+  supabaseUrl,
+  anonKey,
+  shuttingDown = false,
+  fetchImpl = fetch,
+  onFailure,
+} = {}) {
+  if (shuttingDown) return outcome({ reason: 'shutdown' })
+  if (!token) return outcome({ reason: 'anon' })
+  if (!room) return outcome({ reason: 'no-room' })
+  if (!hostId) return outcome({ reason: 'no-host-id' })
+
+  const fail = (result) => {
+    try { onFailure?.(result) } catch { /* observability cannot break restore */ }
+    return outcome(result)
+  }
+
+  try {
+    const query = `${supabaseUrl}/rest/v1/code_terminals?select=id,host_id` +
+      `&session_code=eq.${encodeURIComponent(room)}` +
+      `&host_id=eq.${encodeURIComponent(hostId)}`
+    const response = await fetchImpl(query, {
+      headers: { apikey: anonKey, Authorization: `Bearer ${token}` },
+    })
+    if (!response?.ok) {
+      return fail({ reason: 'error', error: `list HTTP ${response?.status ?? 'unknown'}`, status: response?.status })
+    }
+
+    const rows = await response.json()
+    const live = new Set(liveIds || [])
+    const stale = (Array.isArray(rows) ? rows : [])
+      .filter((row) => row?.id && row.host_id === hostId && !live.has(row.id))
+      .map((row) => row.id)
+
+    const reaped = []
+    for (const id of stale) {
+      const del = await fetchImpl(
+        `${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}` +
+        `&host_id=eq.${encodeURIComponent(hostId)}`,
+        { method: 'DELETE', headers: { apikey: anonKey, Authorization: `Bearer ${token}` } },
+      )
+      if (!del?.ok) {
+        return fail({ reason: 'error', error: `delete HTTP ${del?.status ?? 'unknown'}`, status: del?.status, reaped })
+      }
+      reaped.push(id)
+    }
+    return { reason: 'ok', reaped }
+  } catch (error) {
+    return fail({ reason: 'error', error: error?.message || String(error) })
+  }
+}