thinkpool-pair 0.7.298 → 0.7.300

package/agent-notify.mjs

@@ -58,11 +58,18 @@ export function clipSummary(text, max = SUMMARY_MAX) {
    `error` turns DO notify — with the same neutral copy as a success. Max's
    call: "the agent stopped" is the news; the reason is in the room. */
 export function shouldNotifyTurnDone({ entry, subtype, startedAt, now, minTurnMs = DEFAULT_MIN_TURN_MS }) {
+  if (!shouldRecordTurnDone({ entry, subtype, startedAt, now })) return false
+  return (now - startedAt) >= minTurnMs
+}
+
+// Every user-facing settle is durable realtime evidence for the in-app rail.
+// The older 30s threshold remains only a PUSH eligibility rule; using it as the
+// write gate made short turns in another session invisible to the web app.
+export function shouldRecordTurnDone({ entry, subtype, startedAt, now }) {
   if (!isUserFacingLane(entry)) return false
   if (subtype === 'aborted') return false
   if (!startedAt) return false
-  if (!Number.isFinite(now)) return false
-  return (now - startedAt) >= minTurnMs
+  return Number.isFinite(now)
 }
 
 /* The one-line "what is it asking me" for a permission card.
@@ -93,8 +100,10 @@ export function permissionSummary(payload) {
    either must never take the bridge down. */
 export function createPermNotifier({
   graceMs = DEFAULT_PERM_GRACE_MS,
+  onArm = () => {},
   onFire = () => {},
   onRetract = () => {},
+  onResolve = () => {},
   setTimer = setTimeout,
   clearTimer = clearTimeout,
 } = {}) {
@@ -107,12 +116,14 @@ export function createPermNotifier({
     if (rec.timer) { try { clearTimer(rec.timer) } catch { /* noop */ } }
     cards.delete(id)
     if (rec.fired) safe(onRetract, id, rec.payload)
+    safe(onResolve, id, rec.payload)
   }
 
   return {
     arm(id, payload) {
       if (!id || cards.has(id)) return
       const rec = { timer: null, fired: false, payload }
+      safe(onArm, id, payload)
       rec.timer = setTimer(() => {
         rec.timer = null
         rec.fired = true

package/bridge.mjs

@@ -43,7 +43,7 @@ import { reconcileTerminalRows as _reconcileTerminalRows } from './terminal-row-
 import { cancelDurableDispatchPermissions, cancelDurablePermissions } from './dispatch-permission-cleanup.mjs'
 // Slice 3 — the pure decision layer for agent push events (turn-done / needs-input).
 // Unit-tested in bridge/agent-notify.test.mjs; everything with I/O stays here.
-import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummary, isUserFacingLane, DEFAULT_MIN_TURN_MS } from './agent-notify.mjs'
+import { createPermNotifier, shouldNotifyTurnDone, shouldRecordTurnDone, permissionSummary, clipSummary, isUserFacingLane, DEFAULT_MIN_TURN_MS } from './agent-notify.mjs'
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
@@ -114,7 +114,7 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
+import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneBusyOf, laneStatusOf, settleLaneBusy, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
 import { createStandalonePairResponder, standalonePairIdentity } from './direct-pair-room.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
@@ -1212,7 +1212,7 @@ const announce = () => {
       // laneStatusOf: authoritative busy/idle + last-action timestamp/age +
       // STUCK/BLOCKED alert. The bridge owns the turn and permission state, so
       // every roster consumer reads one status instead of reconstructing it.
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, ...laneStatusOf(s), turnRev: Number(s._turnRev) || 0, ...(s.session?.turnActive && s._turnStart ? { turnStartedAt: s._turnStart } : {}), hasTranscript: s.log.length > 0, commands: s.commands, mode: s.mode || undefined, effort: s.effort || undefined, name: termNames[id] || undefined, model: s.model || undefined, capabilities: { ...structuredRuntimeMetadata(s.runtime || 'claude'), modes: structuredModesForLane(s.runtime || 'claude', s) }, ...(s.runtime === 'codex' ? { approvalPolicy: codexConfigForMode(s.mode).approvalPolicy, models: s.models || [], canSteer: s.session?.canSteer ?? false } : s.runtime === 'hermes' ? { models: s.models || [], canSteer: s.session?.canSteer ?? false } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.sideParent ? { sideParent: s.sideParent, sideTask: s.sideTask || undefined, sideHandback: !!s.sideHandback } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, ...laneStatusOf(s), turnRev: Number(s._turnRev) || 0, ...(laneBusyOf(s) && s._turnStart ? { turnStartedAt: s._turnStart } : {}), hasTranscript: s.log.length > 0, commands: s.commands, mode: s.mode || undefined, effort: s.effort || undefined, name: termNames[id] || undefined, model: s.model || undefined, capabilities: { ...structuredRuntimeMetadata(s.runtime || 'claude'), modes: structuredModesForLane(s.runtime || 'claude', s) }, ...(s.runtime === 'codex' ? { approvalPolicy: codexConfigForMode(s.mode).approvalPolicy, models: s.models || [], canSteer: s.session?.canSteer ?? false } : s.runtime === 'hermes' ? { models: s.models || [], canSteer: s.session?.canSteer ?? false } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.sideParent ? { sideParent: s.sideParent, sideTask: s.sideTask || undefined, sideHandback: !!s.sideHandback } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
         // provider: the registered LLM-provider this lane runs on, NAME-ONLY {id,name}
         // (NEVER the key or baseUrl). Additive; older clients ignore it. Omitted for the
         // built-in/default Claude path (no badge). Makes the lane's provider badge +
@@ -1972,8 +1972,12 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // "<lane> — needs you: <what>"; answering it anywhere retracts the banner
   // everywhere. Worker/flow lanes are excluded at arm() time (isUserFacingLane).
   entry.permNotifier = createPermNotifier({
-    onFire:    (_cardId, summary) => persistAgentEvent({ kind: 'needs-input',    term: id, termName: termNames[id] || null, summary }),
-    onRetract: (_cardId)          => persistAgentEvent({ kind: 'needs-resolved', term: id, termName: termNames[id] || null }),
+    // The in-app rail gets the card immediately. OS push keeps the 20s grace:
+    // the later push-eligible row shares permissionId, so the browser dedupes it
+    // while the server may still fan out a banner to unattended devices.
+    onArm:     (cardId, summary) => persistAgentEvent({ kind: 'needs-input', term: id, termName: termNames[id] || null, model: entry.model || null, permissionId: cardId, summary, pushEligible: false }),
+    onFire:    (cardId, summary) => persistAgentEvent({ kind: 'needs-input', term: id, termName: termNames[id] || null, model: entry.model || null, permissionId: cardId, summary, pushEligible: true }),
+    onResolve: (cardId)          => persistAgentEvent({ kind: 'needs-resolved', term: id, termName: termNames[id] || null, model: entry.model || null, permissionId: cardId }),
   })
   // C1 (RT-2): per-term contiguous seq counter. Seeded from the restored log's max
   // so a bridge restart resumes ABOVE every persisted seq — fresh events never reuse
@@ -3013,7 +3017,16 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // twice (the 2026-06-19 duplicate-message bug). See event-id.mjs.
       const continuesQueued = runtime === 'hermes' && (evt.kind === 'result' || evt.kind === 'error') && (entry.session?.queuedDepth || 0) > 0
       if (continuesQueued) evt.continuesQueued = true
-      const busyChanged = continuesQueued ? false : syncStructuredTurn(entry)
+      // A result transcript boundary is the bridge's definitive falling edge.
+      // Do not re-read a runtime's mutable turnActive getter here: some adapters
+      // finish clearing it after delivering the result, which previously left the
+      // last broadcast busy until a tab click/refocus triggered another announce.
+      // `error` is not universally terminal (a runtime may recover and continue),
+      // so error-only paths keep using the runtime edge below.
+      // A queued Hermes turn is one continuous busy interval, so it settles only
+      // after the final queued boundary.
+      const terminalBoundary = !continuesQueued && evt.kind === 'result'
+      const busyChanged = terminalBoundary ? settleLaneBusy(entry) : syncStructuredTurn(entry)
       stampStructuredTurn(entry, evt)
       stampEvent(evt)
       const stalledChanged = evt.kind === 'stalled' ? !entry.stalled : !!entry.stalled
@@ -3239,13 +3252,18 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         const stalePermissionIds = [...entry.pending.keys()]
         drainPending(entry)
         for (const pendingId of stalePermissionIds) bcast('code-perm', { term: id, id: pendingId, decision: 'deny', name: 'agent' })
-        if (shouldNotifyTurnDone({ entry, subtype: evt.subtype, startedAt, now: Date.now(), minTurnMs: MIN_TURN_MS })) {
+        const settledAt = Date.now()
+        if (shouldRecordTurnDone({ entry, subtype: evt.subtype, startedAt, now: settledAt })) {
           persistAgentEvent({
             kind: 'turn-done',
             term: id,
             termName: termNames[id] || null,
+            model: entry.model || null,
             summary: clipSummary(evt.kind === 'result' ? evt.resultText : evt.message),
             subtype: evt.subtype || (evt.kind === 'error' ? 'error' : null),
+            // Push remains conservative; the in-app rail is allowed to surface
+            // every unseen settle because exact watched terminals are suppressed.
+            pushEligible: shouldNotifyTurnDone({ entry, subtype: evt.subtype, startedAt, now: settledAt, minTurnMs: MIN_TURN_MS }),
           })
         }
       }
@@ -3931,7 +3949,7 @@ channel
       // Display the clean body (web sends `body` when the agent `text` carries host
       // file paths) + the uploaded attachments, so the partner shows the image — not
       // a raw /var path. The agent already got the full `text` via sendTurn above.
-      const evt = { kind: 'you', text: payload.body != null ? String(payload.body) : text, cid: payload.cid, by: payload.by, ...(Array.isArray(payload.files) && payload.files.length ? { files: payload.files } : {}), ...(Array.isArray(payload.pastes) && payload.pastes.length ? { pastes: payload.pastes } : {}) }
+      const evt = { kind: 'you', text: payload.body != null ? String(payload.body) : text, cid: payload.cid, by: payload.by, ...(payload.authorId ? { authorId: payload.authorId } : {}), ...(Array.isArray(payload.files) && payload.files.length ? { files: payload.files } : {}), ...(Array.isArray(payload.pastes) && payload.pastes.length ? { pastes: payload.pastes } : {}) }
       pushLog(s, evt)
       bcast('code-event', { term: payload.term, evt })
     }

package/cross-terminal.mjs

@@ -51,6 +51,23 @@ const recentFailureCount = (log, limits = LANE_STATUS) => {
   return failures
 }
 
+// Structured runtimes expose a mutable `turnActive` getter, but the bridge owns
+// the roster edges. A terminal result can reach the bridge before a runtime has
+// finished clearing that getter; reading it back here used to re-open a finished
+// lane until the next WHO/refocus announcement. Once the bridge has observed an
+// edge, its latch is authoritative until beginStructuredTurn/syncStructuredTurn
+// records the next one. `busy` remains the explicit override for wire fixtures
+// and raw terminals.
+export const laneBusyOf = (entry = {}) => typeof entry?.busy === 'boolean'
+  ? entry.busy
+  : (typeof entry?._busyAnn === 'boolean' ? entry._busyAnn : (entry?.session?.turnActive ?? false))
+
+export const settleLaneBusy = (entry) => {
+  if (!entry || entry._busyAnn === false) return false
+  entry._busyAnn = false
+  return true
+}
+
 export const laneStatusOf = (entry = {}, now = Date.now(), limits = LANE_STATUS) => {
   const baseLog = Array.isArray(entry?.log) ? entry.log : []
   const log = baseLog.slice(-limits.failureWindow)
@@ -62,7 +79,7 @@ export const laneStatusOf = (entry = {}, now = Date.now(), limits = LANE_STATUS)
   }
   const lastActionAt = Number.isFinite(entry?.lastActionAt) ? entry.lastActionAt : (lastLogAt ?? null)
   const lastActionAgeMs = lastActionAt == null ? null : Math.max(0, now - lastActionAt)
-  const busy = typeof entry?.busy === 'boolean' ? entry.busy : (entry?.session?.turnActive ?? false)
+  const busy = laneBusyOf(entry)
   const pendingCount = entry?.pending instanceof Map
     ? entry.pending.size
     : Math.max(0, Number(entry?.pendingCount) || 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.298",
+  "version": "0.7.300",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 9,
+  "bundleVersion": 10,
   "contracts": [
     {
       "id": "room-coordination",
@@ -88,13 +88,13 @@
     },
     {
       "id": "visual-proof",
-      "version": 1,
+      "version": 2,
       "routes": [
         {
           "id": "visual-proof",
           "tools": ["preview_start", "preview_capture", "preview_inspect", "preview_stop"],
           "trigger": "\\b(ui|ux|visual|design|frontend|html|css|page|route|mockup|screenshot|responsive|desktop|mobile|preview)\\b",
-          "prompt": "For built visual work, run the build, use preview_start, preview_capture at desktop and mobile, preview_inspect when rendered state matters, and preview_stop when finished. Surface PNG evidence only when no interactive source-backed Design card is displayed."
+          "prompt": "For built visual work, run the build, use preview_start, preview_capture at desktop and mobile, preview_inspect when rendered state matters, and preview_stop when finished. preview_capture uses a fresh isolated browser, so authenticated app routes require an authenticated visual harness; if a room route resolves to the signed-out invitation, the capture is rejected and no mockup card is created. Surface PNG evidence only when no interactive source-backed Design card is displayed."
         }
       ],
       "impact": [

package/viewport.mjs

@@ -64,6 +64,12 @@ export function safeSlug(value = 'viewport') {
     .slice(0, 56) || 'viewport'
 }
 
+export function isSignedOutRoomPreview(route, snapshot) {
+  const parsed = new URL(normalizeRoute(route), 'http://127.0.0.1')
+  if (!parsed.searchParams.get('r')) return false
+  return /\bid\s*=\s*["']invitation-room-title["']/i.test(String(snapshot || ''))
+}
+
 export function findBrowserExecutable({ env = process.env, platform = process.platform, exists = fs.existsSync } = {}) {
   const candidates = [
     env.TP_BROWSER_PATH,
@@ -425,6 +431,17 @@ export class ViewportManager {
     if (names.some((name) => !DEFAULT_VIEWPORTS[name])) throw new Error('viewports must be "both", "desktop", or "mobile".')
     await fsp.mkdir(this.outbox, { recursive: true })
     const slug = `${safeSlug(title)}-${Date.now().toString(36)}`
+    // A preview browser is deliberately isolated and cannot inherit the room
+    // member's Supabase session. Catch the production failure mode where an
+    // agent requests /?r=ROOM expecting Code, but actually renders the public
+    // invitation landing and publishes it under an unrelated feature title.
+    // Validate before writing screenshots or a manifest so no misleading card
+    // can enter the room.
+    const snapshotViewport = names.includes('desktop') ? DEFAULT_VIEWPORTS.desktop : DEFAULT_VIEWPORTS[names[0]]
+    const snapshot = await this.browser.snapshot({ url, viewport: snapshotViewport, waitMs })
+    if (isSignedOutRoomPreview(normalizedRoute, snapshot)) {
+      throw new Error('Preview resolved to the signed-out room invitation instead of the authenticated Code room. preview_capture uses a fresh isolated browser and cannot inherit a person\'s login. Use an authenticated visual harness or signed-in browser evidence; no mockup card was created.')
+    }
     const captures = {}
     for (const name of names) {
       const result = await this.browser.capture({ url, viewport: DEFAULT_VIEWPORTS[name], fullPage, waitMs })
@@ -432,8 +449,6 @@ export class ViewportManager {
       await fsp.writeFile(file, result.png)
       captures[name] = { ...result, file }
     }
-    const snapshotViewport = names.includes('desktop') ? DEFAULT_VIEWPORTS.desktop : DEFAULT_VIEWPORTS[names[0]]
-    const snapshot = await this.browser.snapshot({ url, viewport: snapshotViewport, waitMs })
     const snapshotPath = path.join(this.outbox, `${slug}--source.html`)
     await fsp.writeFile(snapshotPath, snapshot)
     const workspace = await fsp.realpath(this.workspaceRoot)
@@ -487,7 +502,7 @@ export function createViewportTools({ tool, z, manager }) {
     ),
     tool(
       'preview_capture',
-      'Capture this lane preview at exact desktop (1440×900) and mobile (390×844) CSS viewports. Defaults to both and full-page. Returns the PNGs to your vision context and also surfaces a mockup card in the ThinkPool room.',
+      'Capture this lane preview in a fresh isolated browser at exact desktop (1440×900) and mobile (390×844) CSS viewports. Defaults to both and full-page. Authenticated app routes require an authenticated visual harness; a room route that resolves to the signed-out invitation is rejected. Successful captures return PNGs to your vision context and surface a mockup card in the ThinkPool room.',
       {
         path: z.string().max(500).optional().describe('route within the preview, e.g. / or /settings; never a full URL'),
         viewports: z.enum(['both', 'desktop', 'mobile']).optional(),