thinkpool-pair 0.7.295 → 0.7.297

package/account.mjs

@@ -501,47 +501,27 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // we do NOT uninstall the service. A plain foreground bridge has no supervisor, so it
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
   // don't subscribe to this event, so the dashboard button is a harmless no-op there.
-  acct.on('broadcast', { event: 'restart' }, () => {
-    restarting = true
-    // The dashboard "Restart bridge" button ALSO updates to the newest published version
-    // (Max, 2026-07-03). Use service.mjs's authoritative registry → immutable runtime →
-    // one-shot reload transaction directly. Spawning `npx install-service` here used a
-    // disposable cache that legacy services could delete underneath the updater. The
-    // service primitive arms an independent launchd handoff before this process is booted
-    // out, so the reload survives us without a second package execution tree.
-    // The reload IS the bounce; sessions resume from disk on the new version. Best-effort:
-    // if there's no service or npm is unreachable, we fall through to the plain bounce, so
-    // the button is never dead — and even a failed update degrades to today's behaviour.
-    const plainBounce = (delay) => setTimeout(() => {
-      try { releaseSingleton() } catch { /* noop */ }
-      // Unsupervised FOREGROUND bridge (no launchd/systemd) → re-spawn ourselves DETACHED
-      // after releasing the lock, so "Restart" isn't a footgun that never comes back
-      // (2026-06-25). A supervised bridge is respawned by its supervisor on exit(1).
-      if (!runsAsService()) {
-        try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
-      }
-      process.exit(1)
-    }, delay)
+  let restartPreparationRunning = false
+  acct.on('broadcast', { event: 'restart' }, ({ payload } = {}) => {
+    // A dashboard restart is an EXPLICIT apply request, but it is not permission
+    // to interrupt a live turn or a pending human decision. Stage the immutable
+    // runtime while work continues; applyIfIdle() owns the only destructive edge.
+    applyRequested = true
+    if (restartPreparationRunning || applyingUpdate) return
+    restartPreparationRunning = true
     ;(async () => {
-      let updating = false
       try {
         const svc = await import('./service.mjs')
-        if (svc.serviceActive(null)) {
-          updating = svc.updateService(null) !== false
-        }
-      } catch { /* no service / spawn failed → plain bounce below */ }
-      process.stderr.write(updating
-        ? '\n  ◇ update + restart requested from the dashboard — pulling the newest bridge and reloading; sessions resume.\n'
-        : '\n  ◇ restart requested from the dashboard — bouncing bridge (sessions resume).\n')
-      if (updating) {
-        // The updater's bootout replaces us (single clean bounce). Long backstop: if the
-        // update never lands (npm down / install failed), bounce the current version so the
-        // button isn't dead — the updater normally boots us out well before this fires.
-        plainBounce(60000)
-        return
+        const staged = svc.serviceActive(null) ? svc.stageServiceUpdate(null) : null
+        // The dashboard's advertised version is only a fallback marker. The host
+        // independently resolves and verifies npm above before applying a service.
+        pendingUpdate = staged || (typeof payload?.version === 'string' ? payload.version : VERSION) || 'restart'
+      } catch {
+        pendingUpdate = (typeof payload?.version === 'string' ? payload.version : VERSION) || 'restart'
+      } finally {
+        restartPreparationRunning = false
       }
-      plainBounce(2500)
-      process.kill(process.pid, 'SIGTERM')
+      void applyIfIdle()
     })()
   })
   // Throttled so a realtime reconnect storm can't machine-gun track() into the
@@ -907,7 +887,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           console.log(`child_ready sup=${SUP_ID} room=${room} pid=${child.pid}`)
           pushPresence()
         }
-        else if (m.t === 'idle') { childIdle.set(room, !!m.idle); childBetween.set(room, m.between != null ? !!m.between : !!m.idle); childPeer.set(room, !!m.webPeer) }
+        else if (m.t === 'idle') {
+          childIdle.set(room, !!m.idle)
+          childBetween.set(room, m.between != null ? !!m.between : !!m.idle)
+          childPeer.set(room, !!m.webPeer)
+          void applyIfIdle()
+        }
+        else if (m.t === 'busy') { childIdle.set(room, false); childBetween.set(room, false) }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
         // ── Thinkpool Ensemble cross-ROOM routing ──────────────────────────────
         // `room` here is the room that sent the message (this closure is per-child).
@@ -1134,15 +1120,19 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Restart the account bridge to apply a pending update ONLY when it's safe: every
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
-  const applyIfIdle = async () => {
+  async function applyIfIdle() {
     if (applyingUpdate || !isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
     applyingUpdate = true
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
     try {
       const svc = await import('./service.mjs')
-      if (svc.serviceActive(null) && svc.updateService(null) !== false) return
+      if (svc.serviceActive(null) && svc.applyStagedServiceUpdate(null, pendingUpdate) !== false) return
     } catch { /* fall back to the legacy supervised restart below */ }
     applyingUpdate = false
+    restarting = true
+    if (!runsAsService()) {
+      try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
+    }
     stop('SIGTERM')
   }
 
@@ -1180,6 +1170,15 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       const latest = await fetchLatest()
       if (latest && isNewer(latest, VERSION)) {
         if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — "update ready" surfaced to each room; applies between turns.\n`)
+        // Provision while children continue running. applyIfIdle performs the
+        // final safety check only after this slow network/install work is done.
+        try {
+          const svc = await import('./service.mjs')
+          svc.provisionRuntime(latest)
+        } catch (error) {
+          process.stderr.write(`\n  ⚠ bridge ${latest} could not be staged yet: ${error?.message || error}\n`)
+          return
+        }
         pendingUpdate = latest
         // Tell every served child so its room shows the chip (children never self-update;
         // only this supervisor restart re-resolves @latest). Slice 3 nudge.

package/bridge.mjs

@@ -39,6 +39,7 @@ import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { serveDecision, fetchServeRow, refusalMessage, gateFailAction } from './serve-consent.mjs'
 import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
+import { reconcileTerminalRows as _reconcileTerminalRows } from './terminal-row-reconcile.mjs'
 import { cancelDurableDispatchPermissions, cancelDurablePermissions } from './dispatch-permission-cleanup.mjs'
 // Slice 3 — the pure decision layer for agent push events (turn-done / needs-input).
 // Unit-tested in bridge/agent-notify.test.mjs; everything with I/O stays here.
@@ -46,7 +47,7 @@ import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummar
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
 import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
@@ -595,6 +596,7 @@ const BRIDGE_STARTED_AT = Date.now()
 // box. Distinct from `name` (the driver's username). Announced additively —
 // top-level only (one bridge per announce); older clients ignore the unknown key.
 const host = (os.hostname() || 'host').split('.')[0].slice(0, 24)
+const hostId = bridgeHostId()
 
 // Repo awareness — the room shows which project this machine is sharing.
 // Cheap reads, no subprocess: directory name + .git/HEAD.
@@ -718,6 +720,20 @@ function reapTerminalRow(id) {
     onFailure: ({ error, status }) => process.stderr.write(`\n  ⚠ terminal row reap failed (${String(id).slice(0, 8)}${status ? `, HTTP ${status}` : ''}): ${error || 'unknown error'}\n`),
   })
 }
+
+// Crash/abort counterpart to the clean-close reap above. Called only after the
+// subscribed bridge has restored every on-disk session into `terms`/`sessions`.
+// The stable host filter is load-bearing: another machine's dormant lanes are
+// durable product state, while this machine's missing rows are stale ghosts.
+function reconcileTerminalRows() {
+  return _reconcileTerminalRows({
+    room, hostId, liveIds: [...terms.keys(), ...sessions.keys()], token: codeAuthToken,
+    supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown,
+    onFailure: ({ error, status }) => process.stderr.write(`\n  ⚠ terminal row reconcile failed${status ? ` (HTTP ${status})` : ''}: ${error || 'unknown error'}\n`),
+  }).then(({ reaped }) => {
+    if (reaped.length) process.stderr.write(`\n  ◆ removed ${reaped.length} stale terminal row${reaped.length === 1 ? '' : 's'} after restore.\n`)
+  })
+}
 // Auth: is the sender a PARTICIPANT of THIS room (owner OR granted OR joined)? Room mode
 // serves the room, so RLS returns participants; we confirm the jwt's user is one of them.
 // Pattern (per #218/#219): getUser + uid → REST existence check on code_sessions
@@ -1022,7 +1038,14 @@ const warmComplete = (e) => {
 // output or a human driving). Read by the auto-update poll so an update restart
 // only happens when idle, never mid-turn.
 let lastActivity = Date.now()
-const markActivity = () => { lastActivity = Date.now() }
+const markActivity = () => {
+  lastActivity = Date.now()
+  // Do not wait for the 5s idle heartbeat to retract a stale between-turn
+  // report. A dashboard update may be staged concurrently with this input.
+  if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+    try { process.send({ t: 'busy' }) } catch { /* parent is already leaving */ }
+  }
+}
 
 // ── Slice 3: update-ready nudge state ──────────────────────────────
 // The newest published version once the update poll (service tier) or the account
@@ -1130,9 +1153,9 @@ const announce = () => {
     cwd, version: VERSION, promptBundle: THINKPOOL_PROMPT_BUNDLE,
     // host: short machine label (see const `host`) so the room shows which box
     // currently serves it + attributes dormant terminals to their home machine.
-    // Additive top-level field; consumed by src/pages/code/room.jsx onAnnounce in
-    // a later lane. Older clients ignore it.
-    host,
+    // Additive top-level fields consumed by src/pages/code/room.jsx onAnnounce.
+    // Older clients ignore them.
+    host, hostId,
     // uid: the authed user id whose bridge is serving this room (owner or grantee).
     // Additive field (older clients ignore it). A grantee bridge watches peer `bridge`
     // announces for uid === owner_id to know the owner's bridge reclaimed the room and
@@ -4460,6 +4483,7 @@ channel
         }
       }
       await announce()
+      void reconcileTerminalRows()
       // Account presence must distinguish a spawned child from a usable room.
       // Signal only after realtime subscribed, durable sessions restored, and the
       // first authoritative roster was announced. The dashboard keeps the bridge

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.295",
+  "version": "0.7.297",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -83,6 +83,7 @@
     "serve-dir.mjs",
     "serve-consent.mjs",
     "reap-terminal.mjs",
+    "terminal-row-reconcile.mjs",
     "switch-provider.mjs",
     "service.mjs",
     "presence.mjs",

package/providers.mjs

@@ -100,6 +100,14 @@ export function ensureKeypair() {
 /** SPKI base64 public key for the announce (`providerPubKey`). */
 export function publicKeyB64() { return ensureKeypair().publicKeyB64 }
 
+// Stable, public machine identity for terminal ownership. `host` is a display
+// label and can be "localhost" on multiple computers; this fingerprint is tied
+// to the bridge's existing keypair without exposing private material. Accepting
+// an explicit public key keeps the identity primitive directly testable.
+export function bridgeHostId(pubKey = publicKeyB64()) {
+  return crypto.createHash('sha256').update(pubKey).digest('hex').slice(0, 32)
+}
+
 // ── seal / unseal (hybrid RSA-OAEP + AES-256-GCM) ───────────────────────
 // seal() is here so the UNIT can drive both ends node-side; the real seal
 // happens in the browser dashboard via WebCrypto against the same envelope.

package/service.mjs

@@ -487,16 +487,47 @@ export function restartService(room) {
 // Resolve the registry version first, then rewrite + reload the service pinned to that
 // exact build. If npm is unavailable, fail without pretending an old-version restart
 // was an update.
+function publishedServiceVersion(exec = execSync) {
+  let target = ''
+  try {
+    target = String(exec('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })).trim()
+  } catch { /* reported by caller */ }
+  return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(target) ? target : null
+}
+
+// Download and verify the immutable runtime WITHOUT replacing the live service.
+// The account supervisor can do this while rooms are busy, then re-check its
+// between-turn contract immediately before the now-fast service-manager reload.
+export function stageServiceUpdate(room, { exec = execSync, active = isServiceInstalled, provision = provisionRuntime } = {}) {
+  if (!active(room)) {
+    process.stderr.write('  ⚠ no background service installed to update — install one first.\n')
+    return null
+  }
+  const target = publishedServiceVersion(exec)
+  if (!target) {
+    process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n")
+    return null
+  }
+  process.stderr.write(`\n  ◆ preparing bridge v${target} in the background; active sessions keep running…\n`)
+  try { provision(target); return target } catch (error) {
+    process.stderr.write(`  ⚠ couldn't stage bridge v${target}: ${error?.message || error}\n`)
+    return null
+  }
+}
+
+export function applyStagedServiceUpdate(room, target, { install = installService, active = isServiceInstalled } = {}) {
+  if (!active(room) || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(target || ''))) return false
+  process.stderr.write(`\n  ◆ updating the background service to v${target} and restarting…\n`)
+  return install(room, [], { version: target, staleProof: true }) !== false
+}
+
 export function updateService(room, { exec = execSync, install = installService, active = isServiceInstalled } = {}) {
   if (!active(room)) {
     process.stderr.write('  ⚠ no background service installed to update — install one first.\n')
     return false
   }
-  let target = ''
-  try {
-    target = String(exec('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })).trim()
-  } catch { /* reported below */ }
-  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(target)) {
+  const target = publishedServiceVersion(exec)
+  if (!target) {
     process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n")
     return false
   }

package/terminal-row-reconcile.mjs

@@ -0,0 +1,65 @@
+/* Reconcile durable terminal rows after a bridge has restored its on-disk roster.
+
+   A clean close is reaped by reap-terminal.mjs. This module closes the other
+   lifecycle boundary: a crash/abort can remove the live session file without a
+   clean-close event, leaving a permanent dormant DB row. A stable public host id
+   makes the bridge authoritative only for its own rows; foreign/null-host rows are
+   deliberately preserved for handover and mixed-version compatibility. */
+
+const outcome = (extra = {}) => ({ reaped: [], ...extra })
+
+export async function reconcileTerminalRows ({
+  room,
+  hostId,
+  liveIds = [],
+  token,
+  supabaseUrl,
+  anonKey,
+  shuttingDown = false,
+  fetchImpl = fetch,
+  onFailure,
+} = {}) {
+  if (shuttingDown) return outcome({ reason: 'shutdown' })
+  if (!token) return outcome({ reason: 'anon' })
+  if (!room) return outcome({ reason: 'no-room' })
+  if (!hostId) return outcome({ reason: 'no-host-id' })
+
+  const fail = (result) => {
+    try { onFailure?.(result) } catch { /* observability cannot break restore */ }
+    return outcome(result)
+  }
+
+  try {
+    const query = `${supabaseUrl}/rest/v1/code_terminals?select=id,host_id` +
+      `&session_code=eq.${encodeURIComponent(room)}` +
+      `&host_id=eq.${encodeURIComponent(hostId)}`
+    const response = await fetchImpl(query, {
+      headers: { apikey: anonKey, Authorization: `Bearer ${token}` },
+    })
+    if (!response?.ok) {
+      return fail({ reason: 'error', error: `list HTTP ${response?.status ?? 'unknown'}`, status: response?.status })
+    }
+
+    const rows = await response.json()
+    const live = new Set(liveIds || [])
+    const stale = (Array.isArray(rows) ? rows : [])
+      .filter((row) => row?.id && row.host_id === hostId && !live.has(row.id))
+      .map((row) => row.id)
+
+    const reaped = []
+    for (const id of stale) {
+      const del = await fetchImpl(
+        `${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}` +
+        `&host_id=eq.${encodeURIComponent(hostId)}`,
+        { method: 'DELETE', headers: { apikey: anonKey, Authorization: `Bearer ${token}` } },
+      )
+      if (!del?.ok) {
+        return fail({ reason: 'error', error: `delete HTTP ${del?.status ?? 'unknown'}`, status: del?.status, reaped })
+      }
+      reaped.push(id)
+    }
+    return { reason: 'ok', reaped }
+  } catch (error) {
+    return fail({ reason: 'error', error: error?.message || String(error) })
+  }
+}

package/update-gate.mjs

@@ -33,7 +33,10 @@ export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, ch
 export function turnInFlight(sessions) {
   for (const s of (sessions?.values?.() || [])) {
     const ta = s && (typeof s.session?.turnActive === 'boolean' ? s.session.turnActive : s.turnActive)
-    if (ta) return true
+    // A permission / question resolver is process-local. Restarting while one is
+    // pending destroys the only promise the eventual durable decision can wake,
+    // even when the runtime has temporarily reported turnActive=false.
+    if (ta || Number(s?.pending?.size || 0) > 0) return true
   }
   return false
 }