thinkpool-pair 0.7.296 → 0.7.298

package/account.mjs

@@ -501,47 +501,27 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // we do NOT uninstall the service. A plain foreground bridge has no supervisor, so it
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
   // don't subscribe to this event, so the dashboard button is a harmless no-op there.
-  acct.on('broadcast', { event: 'restart' }, () => {
-    restarting = true
-    // The dashboard "Restart bridge" button ALSO updates to the newest published version
-    // (Max, 2026-07-03). Use service.mjs's authoritative registry → immutable runtime →
-    // one-shot reload transaction directly. Spawning `npx install-service` here used a
-    // disposable cache that legacy services could delete underneath the updater. The
-    // service primitive arms an independent launchd handoff before this process is booted
-    // out, so the reload survives us without a second package execution tree.
-    // The reload IS the bounce; sessions resume from disk on the new version. Best-effort:
-    // if there's no service or npm is unreachable, we fall through to the plain bounce, so
-    // the button is never dead — and even a failed update degrades to today's behaviour.
-    const plainBounce = (delay) => setTimeout(() => {
-      try { releaseSingleton() } catch { /* noop */ }
-      // Unsupervised FOREGROUND bridge (no launchd/systemd) → re-spawn ourselves DETACHED
-      // after releasing the lock, so "Restart" isn't a footgun that never comes back
-      // (2026-06-25). A supervised bridge is respawned by its supervisor on exit(1).
-      if (!runsAsService()) {
-        try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
-      }
-      process.exit(1)
-    }, delay)
+  let restartPreparationRunning = false
+  acct.on('broadcast', { event: 'restart' }, ({ payload } = {}) => {
+    // A dashboard restart is an EXPLICIT apply request, but it is not permission
+    // to interrupt a live turn or a pending human decision. Stage the immutable
+    // runtime while work continues; applyIfIdle() owns the only destructive edge.
+    applyRequested = true
+    if (restartPreparationRunning || applyingUpdate) return
+    restartPreparationRunning = true
     ;(async () => {
-      let updating = false
       try {
         const svc = await import('./service.mjs')
-        if (svc.serviceActive(null)) {
-          updating = svc.updateService(null) !== false
-        }
-      } catch { /* no service / spawn failed → plain bounce below */ }
-      process.stderr.write(updating
-        ? '\n  ◇ update + restart requested from the dashboard — pulling the newest bridge and reloading; sessions resume.\n'
-        : '\n  ◇ restart requested from the dashboard — bouncing bridge (sessions resume).\n')
-      if (updating) {
-        // The updater's bootout replaces us (single clean bounce). Long backstop: if the
-        // update never lands (npm down / install failed), bounce the current version so the
-        // button isn't dead — the updater normally boots us out well before this fires.
-        plainBounce(60000)
-        return
+        const staged = svc.serviceActive(null) ? svc.stageServiceUpdate(null) : null
+        // The dashboard's advertised version is only a fallback marker. The host
+        // independently resolves and verifies npm above before applying a service.
+        pendingUpdate = staged || (typeof payload?.version === 'string' ? payload.version : VERSION) || 'restart'
+      } catch {
+        pendingUpdate = (typeof payload?.version === 'string' ? payload.version : VERSION) || 'restart'
+      } finally {
+        restartPreparationRunning = false
       }
-      plainBounce(2500)
-      process.kill(process.pid, 'SIGTERM')
+      void applyIfIdle()
     })()
   })
   // Throttled so a realtime reconnect storm can't machine-gun track() into the
@@ -907,7 +887,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           console.log(`child_ready sup=${SUP_ID} room=${room} pid=${child.pid}`)
           pushPresence()
         }
-        else if (m.t === 'idle') { childIdle.set(room, !!m.idle); childBetween.set(room, m.between != null ? !!m.between : !!m.idle); childPeer.set(room, !!m.webPeer) }
+        else if (m.t === 'idle') {
+          childIdle.set(room, !!m.idle)
+          childBetween.set(room, m.between != null ? !!m.between : !!m.idle)
+          childPeer.set(room, !!m.webPeer)
+          void applyIfIdle()
+        }
+        else if (m.t === 'busy') { childIdle.set(room, false); childBetween.set(room, false) }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
         // ── Thinkpool Ensemble cross-ROOM routing ──────────────────────────────
         // `room` here is the room that sent the message (this closure is per-child).
@@ -1134,15 +1120,19 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Restart the account bridge to apply a pending update ONLY when it's safe: every
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
-  const applyIfIdle = async () => {
+  async function applyIfIdle() {
     if (applyingUpdate || !isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
     applyingUpdate = true
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
     try {
       const svc = await import('./service.mjs')
-      if (svc.serviceActive(null) && svc.updateService(null) !== false) return
+      if (svc.serviceActive(null) && svc.applyStagedServiceUpdate(null, pendingUpdate) !== false) return
     } catch { /* fall back to the legacy supervised restart below */ }
     applyingUpdate = false
+    restarting = true
+    if (!runsAsService()) {
+      try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
+    }
     stop('SIGTERM')
   }
 
@@ -1180,6 +1170,15 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       const latest = await fetchLatest()
       if (latest && isNewer(latest, VERSION)) {
         if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — "update ready" surfaced to each room; applies between turns.\n`)
+        // Provision while children continue running. applyIfIdle performs the
+        // final safety check only after this slow network/install work is done.
+        try {
+          const svc = await import('./service.mjs')
+          svc.provisionRuntime(latest)
+        } catch (error) {
+          process.stderr.write(`\n  ⚠ bridge ${latest} could not be staged yet: ${error?.message || error}\n`)
+          return
+        }
         pendingUpdate = latest
         // Tell every served child so its room shows the chip (children never self-update;
         // only this supervisor restart re-resolves @latest). Slice 3 nudge.

package/bridge.mjs

@@ -1038,7 +1038,14 @@ const warmComplete = (e) => {
 // output or a human driving). Read by the auto-update poll so an update restart
 // only happens when idle, never mid-turn.
 let lastActivity = Date.now()
-const markActivity = () => { lastActivity = Date.now() }
+const markActivity = () => {
+  lastActivity = Date.now()
+  // Do not wait for the 5s idle heartbeat to retract a stale between-turn
+  // report. A dashboard update may be staged concurrently with this input.
+  if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+    try { process.send({ t: 'busy' }) } catch { /* parent is already leaving */ }
+  }
+}
 
 // ── Slice 3: update-ready nudge state ──────────────────────────────
 // The newest published version once the update poll (service tier) or the account
@@ -1490,9 +1497,25 @@ function pumpDesign(term) {
     by: next.by,
     design: true,
   }
+  // Design bypasses the ordinary `code-turn` handler, so it must perform the
+  // same lifecycle handshake itself. Open the revision BEFORE logging the human
+  // line: its stamped `turnRev` lets every room client reconcile stale
+  // `busy:false` immediately, without waiting several seconds for first model
+  // output. A rejected dispatch gets a real terminal boundary below.
+  syncStructuredTurn(lane)
+  let accepted = false
+  try {
+    accepted = lane.session.sendTurn(designPrompt({ record: next.record, request: next.request, by: next.by, restore: !!next.restoreRecord, priorRecord: next.restoreRecord })) !== false
+  } catch { accepted = false }
+  if (accepted) beginStructuredTurn(lane)
   stampEvent(visible); pushLog(lane, visible); bcast('code-event', { term, evt: visible })
-  try { lane.session.sendTurn(designPrompt({ record: next.record, request: next.request, by: next.by, restore: !!next.restoreRecord, priorRecord: next.restoreRecord })) }
-  catch { finishDesign(term, 'failed', { message: 'The producing lane could not start the edit.' }) }
+  if (!accepted) {
+    syncStructuredTurn(lane)
+    const failed = { kind: 'error', message: 'The producing lane could not start the edit.', recoverable: true }
+    pushLog(lane, failed); bcast('code-event', { term, evt: failed })
+    finishDesign(term, 'failed', { message: 'The producing lane could not start the edit.' })
+  }
+  announce()
 }
 // Push one manifest file into the room, attributed to `term`. The owner is
 // resolved by the WATCHER, not guessed here — each session/terminal writes to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.296",
+  "version": "0.7.298",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -487,16 +487,47 @@ export function restartService(room) {
 // Resolve the registry version first, then rewrite + reload the service pinned to that
 // exact build. If npm is unavailable, fail without pretending an old-version restart
 // was an update.
+function publishedServiceVersion(exec = execSync) {
+  let target = ''
+  try {
+    target = String(exec('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })).trim()
+  } catch { /* reported by caller */ }
+  return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(target) ? target : null
+}
+
+// Download and verify the immutable runtime WITHOUT replacing the live service.
+// The account supervisor can do this while rooms are busy, then re-check its
+// between-turn contract immediately before the now-fast service-manager reload.
+export function stageServiceUpdate(room, { exec = execSync, active = isServiceInstalled, provision = provisionRuntime } = {}) {
+  if (!active(room)) {
+    process.stderr.write('  ⚠ no background service installed to update — install one first.\n')
+    return null
+  }
+  const target = publishedServiceVersion(exec)
+  if (!target) {
+    process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n")
+    return null
+  }
+  process.stderr.write(`\n  ◆ preparing bridge v${target} in the background; active sessions keep running…\n`)
+  try { provision(target); return target } catch (error) {
+    process.stderr.write(`  ⚠ couldn't stage bridge v${target}: ${error?.message || error}\n`)
+    return null
+  }
+}
+
+export function applyStagedServiceUpdate(room, target, { install = installService, active = isServiceInstalled } = {}) {
+  if (!active(room) || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(target || ''))) return false
+  process.stderr.write(`\n  ◆ updating the background service to v${target} and restarting…\n`)
+  return install(room, [], { version: target, staleProof: true }) !== false
+}
+
 export function updateService(room, { exec = execSync, install = installService, active = isServiceInstalled } = {}) {
   if (!active(room)) {
     process.stderr.write('  ⚠ no background service installed to update — install one first.\n')
     return false
   }
-  let target = ''
-  try {
-    target = String(exec('npm view thinkpool-pair version', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })).trim()
-  } catch { /* reported below */ }
-  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(target)) {
+  const target = publishedServiceVersion(exec)
+  if (!target) {
     process.stderr.write("  ⚠ couldn't reach npm or resolve the published version — bridge left unchanged; NO update or restart was applied.\n")
     return false
   }

package/update-gate.mjs

@@ -33,7 +33,10 @@ export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, ch
 export function turnInFlight(sessions) {
   for (const s of (sessions?.values?.() || [])) {
     const ta = s && (typeof s.session?.turnActive === 'boolean' ? s.session.turnActive : s.turnActive)
-    if (ta) return true
+    // A permission / question resolver is process-local. Restarting while one is
+    // pending destroys the only promise the eventual durable decision can wake,
+    // even when the runtime has temporarily reported turnActive=false.
+    if (ta || Number(s?.pending?.size || 0) > 0) return true
   }
   return false
 }