thinkpool-pair 0.7.300 → 0.7.302

package/account.mjs

@@ -17,7 +17,7 @@ import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, load
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack, presenceSelfEchoVerdict } from './presence.mjs'
 import { publicKeyB64, announceProviders, listProviders, addProvider, addProviderModel, removeProvider, unseal } from './providers.mjs'
-import { supervisorServes } from './serve-consent.mjs'
+import { supervisorServes, supervisorRoomsToStop } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 import { installedAgentCommands } from './agent-detect.mjs'
@@ -798,6 +798,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       return
     }
     let rooms = []
+    let discoverySucceeded = false
     const me = session.user.id
     try {
       // Discovery (Contract C-CODE-2, owner-only since 2026-07-06): a host bridges ONLY
@@ -805,20 +806,38 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // keeps rooms you merely JOINED as a guest out of auto-serve — your machine never
       // spawns into another owner's session (cross-person serving removed; pairing is
       // read-only peer peek, not hosting). The web watches tpacct:<session-owner>.
-      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,participants').eq('owner_id', me).order('last_active_at', { ascending: false }).limit(20)
+      const { data, error } = await sb.from('code_sessions')
+        .select('code,name,last_active_at,owner_id,participants,closed_at')
+        .eq('owner_id', me)
+        .is('closed_at', null)
+        .order('last_active_at', { ascending: false })
+        .limit(20)
+      if (error) throw error
       rooms = data || []
+      discoverySucceeded = true
       // Prune refused entries for rooms we can no longer serve — owned OR granted (only
       // on a SUCCESSFUL fetch, so a transient query error never wipes the set).
       const servableCodes = new Set(rooms.map((r) => r.code))
       for (const c of [...refused.keys()]) if (!servableCodes.has(c)) refused.delete(c)
     } catch { /* transient — keep existing children, retry next tick */ }
+    // The realtime shutdown broadcast is an acceleration, never the lifecycle
+    // authority. Reconcile every successful discovery read so a bridge that missed
+    // `session-deleted` still stops after its room is closed, deleted, or transferred.
+    if (discoverySucceeded) {
+      for (const room of supervisorRoomsToStop({ rooms, childRooms: children.keys(), myUid: me })) {
+        const child = children.get(room)
+        if (!child) continue
+        console.log(`child_retire sup=${SUP_ID} room=${room} pid=${child.pid || '?'} reason=not-active-owned`)
+        try { child.kill('SIGTERM') } catch { /* child exit reconciliation retries next tick */ }
+      }
+    }
     const dirs = loadDirs()
     const served = loadServed()
     for (const r of rooms) {
       const room = r.code
       if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
       // Defense-in-depth behind the owner-only query above: serve iff we OWN the room.
-      if (!supervisorServes({ ownerId: r.owner_id, myUid: me })) continue
+      if (!supervisorServes({ ownerId: r.owner_id, myUid: me, closedAt: r.closed_at })) continue
       // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
       // to auto-serve an unbound room from $HOME — that strips the agent's resume context
       // (cwd-keyed SDK sessions) and shows your home folder as the repo (FVIHV1DE).

package/codex-session.mjs

@@ -577,14 +577,13 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       appServerThreadReady = true
       pushMappedEvent({ type: 'thread.started', thread_id: sessionId })
       return true
-    } catch (error) {
+    } catch {
       // Fallback is safe only here: no turn/start request has been accepted, so
       // there is no possibility of running the same prompt twice.
       appServerDisabled = true
       try { appServer?.end() } catch { /* noop */ }
       appServer = null
       appServerThreadReady = false
-      note(`Codex App Server unavailable; using codex exec: ${error?.message || error}`)
       return false
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.300",
+  "version": "0.7.302",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/serve-consent.mjs

@@ -38,9 +38,29 @@ export function serveDecision ({ ownerId, myUid }) {
 // defense-in-depth per-row check behind the supervisor's owner-only `.eq(owner_id, me)`
 // query — a broad RLS row (owned OR merely participant) must still resolve to OWNED
 // before a child is spawned. Contract C-CODE-2 (owner-only).
-export function supervisorServes ({ ownerId, myUid }) {
+export function supervisorServes ({ ownerId, myUid, closedAt = null }) {
   if (!myUid) return false
-  return ownerId === myUid
+  return ownerId === myUid && !closedAt
+}
+
+// supervisorRoomsToStop — reconcile the long-lived child map after a SUCCESSFUL
+// discovery read. Closing, deleting, or transferring a room removes it from the
+// active-owned result set; any existing child for that room must be retired even
+// when the best-effort `session-deleted` realtime broadcast was missed.
+//
+// This stays pure so a transient discovery failure can be handled by the caller:
+// account.mjs invokes it only after Supabase returned without an error. On a failed
+// fetch the existing children stay alive and the next tick retries.
+export function supervisorRoomsToStop ({ rooms, childRooms, myUid }) {
+  const activeOwned = new Set((rooms || [])
+    .filter((room) => supervisorServes({
+      ownerId: room?.owner_id,
+      myUid,
+      closedAt: room?.closed_at,
+    }))
+    .map((room) => room.code)
+    .filter(Boolean))
+  return [...(childRooms || [])].filter((code) => !activeOwned.has(code))
 }
 
 // fetchServeRow — read the room's owner with whatever identity the bridge holds