thinkpool-pair 0.7.307 → 0.7.308

package/account.mjs

@@ -28,6 +28,22 @@ const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./pack
 
 const BRIDGE = fileURLToPath(new URL('./bridge.mjs', import.meta.url))
 
+// Startup can spend several seconds waiting on the cross-process refresh lock or
+// backing off after a transient auth failure. Those sleeps are intentionally unref'd
+// once the supervisor is running, but before Realtime + the 15s tick exist they leave
+// an unresolved top-level await as Node's only work; Node 22 exits 13 with
+// "Detected unsettled top-level await". Hold one referenced timer only for bootstrap,
+// then release it as soon as the supervisor's real lifetime interval exists.
+export function createStartupAnchor({ set = setInterval, clear = clearInterval } = {}) {
+  const timer = set(() => {}, 60_000)
+  let released = false
+  return () => {
+    if (released) return
+    released = true
+    clear(timer)
+  }
+}
+
 // ── single-instance lock ────────────────────────────────────────────────────
 // Two account supervisors on one machine share ONE ~/.thinkpool-pair/auth.json
 // refresh token and race its rotation — which on 2026-06-17 deleted a live Pro
@@ -360,6 +376,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.error('\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    `npx thinkpool-pair <ROOM>`.\n')
     process.exit(0)
   }
+  const releaseStartupAnchor = createStartupAnchor()
   // F2: NEVER exit(1) on a refresh failure. The old code exited 1 here, and launchd
   // KeepAlive respawned us within seconds → refresh again → the 16× crash storm (and,
   // worse, hammering the refresh path burns rotations and can revoke the token family).
@@ -1043,6 +1060,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
 
   await tick()
   const iv = setInterval(tick, 15000)
+  releaseStartupAnchor()
   const updateTimers = []   // auto-update poll/apply timers — cleared in stop() so none fire post-exit
   let stopping = false
 

package/bridge.mjs

@@ -249,7 +249,12 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
   // always-on service); --auto-update opts into @latest tracking. (2026-06-22)
   const autoUpdate = argv.includes('--auto-update')
   const svc = await import('./service.mjs')
-  if (argv[0] === 'install-service') svc.installService(svcRoom, svcCmd, { autoUpdate })
+  if (argv[0] === 'install-service') {
+    const ok = autoUpdate
+      ? svc.installService(svcRoom, svcCmd, { autoUpdate })
+      : await svc.installAndConfirmService(svcRoom, svcCmd)
+    process.exit(ok === false ? 1 : 0)
+  }
   else svc.uninstallService(svcRoom)
   process.exit(0)
 }
@@ -350,10 +355,9 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
       child.on('exit', (code) => process.exit(code == null ? 0 : code))
     }),
     serveAccountForeground: async () => { const { runAccount } = await import('./account.mjs'); await runAccount(SUPABASE_URL, SUPABASE_ANON) },
-    // install / uninstall are NOT terminal — they do their work, print their notes,
-    // and return to the menu. A confirmed update closes the launcher instead: its
-    // in-memory package version is stale while the new service runs independently.
-    installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
+    // Confirmed installs/updates close the launcher: the service is independently
+    // running and another menu cycle can only race it. Failures return to the menu.
+    installService: ({ room = null, agentCmd } = {}) => svc.installAndConfirmService(room, agentCmd ? [agentCmd] : []),
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
     restartService: ({ room = null } = {}) => { svc.restartService(room) },
     // The menu waits for OS-level proof before claiming success. In-service web

package/launcher.mjs

@@ -277,7 +277,13 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     const pick = items[await askChoice('choose', items)]
     if (pick.key === 'quit') return
     if (pick.key === 'serve') { if (await ensureLoggedIn()) await actions.serveAccountForeground() }
-    else if (pick.key === 'service') { if (await ensureLoggedIn()) { await actions.installService({ room: null }); resync() } }
+    else if (pick.key === 'service') {
+      if (await ensureLoggedIn()) {
+        const installed = await actions.installService({ room: null })
+        if (installed === true) return
+        resync()
+      }
+    }
     else if (pick.key === 'restart') {
       const updated = await actions.restartUpdateService({ room: null })
       // The launcher process cannot update its own in-memory VERSION. Returning to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.307",
+  "version": "0.7.308",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -456,6 +456,65 @@ export function installService(room, cmdArgs = [], { autoUpdate = false, version
   return true
 }
 
+// Interactive installs must not present an armed launchd helper as a completed
+// background service. installService() intentionally returns after staging because
+// an in-service update may tear down its caller; this menu/CLI primitive waits for the
+// helper receipt AND the exact live runtime before returning success.
+export async function installAndConfirmService(room, cmdArgs = [], {
+  platform = process.platform,
+  version = VERSION,
+  staleProof = true,
+  install = installService,
+  exec = execSync,
+  snapshot = serviceRuntimeSnapshot,
+  readStatus = () => {
+    try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
+  },
+  now = Date.now,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  timeoutMs = 55000,
+  pollMs = 250,
+  stderr = process.stderr,
+} = {}) {
+  if (install(room, cmdArgs, { version, staleProof }) === false) return false
+
+  const confirmation = () => {
+    const live = snapshot(room, { platform, exec })
+    if (live?.version === version) {
+      stderr.write(`  ✓ bridge install confirmed — running v${version}.\n`)
+      return true
+    }
+    return false
+  }
+
+  // systemd's restart is synchronous. Windows cannot prove a live Startup process,
+  // so this exact-runtime confirmation is used only where a service manager exists.
+  if (platform !== 'darwin') {
+    if (platform === 'win32') return true
+    const confirmed = confirmation()
+    if (!confirmed) stderr.write(`  ⚠ install v${version} was not confirmed: the service manager cannot prove that runtime is running.\n`)
+    return confirmed
+  }
+
+  const deadline = now() + Math.max(0, Number(timeoutMs) || 0)
+  const expectedTarget = label(room)
+  for (;;) {
+    const status = readStatus()
+    if (status && typeof status === 'object' && status.target === expectedTarget && status.version === version) {
+      if (status.ok === false) {
+        stderr.write(`  ⚠ install v${version} was not confirmed: ${status.error || 'the launchd handoff failed'}.\n`)
+        return false
+      }
+      if (status.ok === true && confirmation()) return true
+    }
+    if (now() >= deadline) {
+      stderr.write(`  ⚠ install v${version} timed out waiting for launchd confirmation; no running service was proven.\n`)
+      return false
+    }
+    await sleep(Math.max(1, Number(pollMs) || 1))
+  }
+}
+
 // Restart an already-installed boot-persistent service. launchd/systemd relaunch
 // the stable runtime (or legacy auto-update npx command), so active sessions resume
 // from disk. Use it to recover a wedged bridge or re-read provider.json.