thinkpool-pair 0.7.307 → 0.7.309

package/account.mjs

@@ -28,6 +28,22 @@ const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./pack
 
 const BRIDGE = fileURLToPath(new URL('./bridge.mjs', import.meta.url))
 
+// Startup can spend several seconds waiting on the cross-process refresh lock or
+// backing off after a transient auth failure. Those sleeps are intentionally unref'd
+// once the supervisor is running, but before Realtime + the 15s tick exist they leave
+// an unresolved top-level await as Node's only work; Node 22 exits 13 with
+// "Detected unsettled top-level await". Hold one referenced timer only for bootstrap,
+// then release it as soon as the supervisor's real lifetime interval exists.
+export function createStartupAnchor({ set = setInterval, clear = clearInterval } = {}) {
+  const timer = set(() => {}, 60_000)
+  let released = false
+  return () => {
+    if (released) return
+    released = true
+    clear(timer)
+  }
+}
+
 // ── single-instance lock ────────────────────────────────────────────────────
 // Two account supervisors on one machine share ONE ~/.thinkpool-pair/auth.json
 // refresh token and race its rotation — which on 2026-06-17 deleted a live Pro
@@ -360,6 +376,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.error('\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    `npx thinkpool-pair <ROOM>`.\n')
     process.exit(0)
   }
+  const releaseStartupAnchor = createStartupAnchor()
   // F2: NEVER exit(1) on a refresh failure. The old code exited 1 here, and launchd
   // KeepAlive respawned us within seconds → refresh again → the 16× crash storm (and,
   // worse, hammering the refresh path burns rotations and can revoke the token family).
@@ -1043,6 +1060,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
 
   await tick()
   const iv = setInterval(tick, 15000)
+  releaseStartupAnchor()
   const updateTimers = []   // auto-update poll/apply timers — cleared in stop() so none fire post-exit
   let stopping = false
 

package/bridge.mjs

@@ -249,7 +249,12 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
   // always-on service); --auto-update opts into @latest tracking. (2026-06-22)
   const autoUpdate = argv.includes('--auto-update')
   const svc = await import('./service.mjs')
-  if (argv[0] === 'install-service') svc.installService(svcRoom, svcCmd, { autoUpdate })
+  if (argv[0] === 'install-service') {
+    const ok = autoUpdate
+      ? svc.installService(svcRoom, svcCmd, { autoUpdate })
+      : await svc.installAndConfirmService(svcRoom, svcCmd)
+    process.exit(ok === false ? 1 : 0)
+  }
   else svc.uninstallService(svcRoom)
   process.exit(0)
 }
@@ -350,10 +355,9 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
       child.on('exit', (code) => process.exit(code == null ? 0 : code))
     }),
     serveAccountForeground: async () => { const { runAccount } = await import('./account.mjs'); await runAccount(SUPABASE_URL, SUPABASE_ANON) },
-    // install / uninstall are NOT terminal — they do their work, print their notes,
-    // and return to the menu. A confirmed update closes the launcher instead: its
-    // in-memory package version is stale while the new service runs independently.
-    installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
+    // Confirmed installs/updates close the launcher: the service is independently
+    // running and another menu cycle can only race it. Failures return to the menu.
+    installService: ({ room = null, agentCmd } = {}) => svc.installAndConfirmService(room, agentCmd ? [agentCmd] : []),
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
     restartService: ({ room = null } = {}) => { svc.restartService(room) },
     // The menu waits for OS-level proof before claiming success. In-service web

package/launcher.mjs

@@ -277,7 +277,13 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     const pick = items[await askChoice('choose', items)]
     if (pick.key === 'quit') return
     if (pick.key === 'serve') { if (await ensureLoggedIn()) await actions.serveAccountForeground() }
-    else if (pick.key === 'service') { if (await ensureLoggedIn()) { await actions.installService({ room: null }); resync() } }
+    else if (pick.key === 'service') {
+      if (await ensureLoggedIn()) {
+        const installed = await actions.installService({ room: null })
+        if (installed === true) return
+        resync()
+      }
+    }
     else if (pick.key === 'restart') {
       const updated = await actions.restartUpdateService({ room: null })
       // The launcher process cannot update its own in-memory VERSION. Returning to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.307",
+  "version": "0.7.309",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/reap-terminal.mjs

@@ -36,21 +36,28 @@ export async function reapTerminalRow ({ id, token, supabaseUrl, anonKey, shutti
   if (!token)       return { reaped: false, reason: 'anon' }
   if (!id)          return { reaped: false, reason: 'no-id' }
   try {
-    // Mirror of the client reap: DELETE code_terminals WHERE id = <terminal id>. The
-    // terminal id IS the code_terminals PK (client/bridge-minted uuid). RLS scopes the
-    // delete to this bridge's sessions, so id alone is sufficient + idempotent (a fast
-    // client tab may have reaped first — 204 / 0 rows is fine).
-    const response = await fetchImpl(`${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}`, {
-      method: 'DELETE',
-      headers: { apikey: anonKey, Authorization: `Bearer ${token}` },
+    // A terminal at the 50k transcript cap cannot archive + cascade-delete inside
+    // the authenticated role's ordinary 8s statement timeout. The member-authorized
+    // RPC scopes a longer timeout to this one cleanup operation; a raw REST DELETE
+    // timed out and left the row as a cross-device dormant ghost (8TMX546Q).
+    const response = await fetchImpl(`${supabaseUrl}/rest/v1/rpc/delete_code_terminal`, {
+      method: 'POST',
+      headers: {
+        apikey: anonKey,
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ p_terminal: id }),
     })
     // fetch resolves for HTTP failures. A 401/500 did not reap the row and must
     // stay visible to the fire-and-forget caller as a failed best-effort cleanup.
     if (!response?.ok) {
+      let detail = ''
+      try { detail = String(await response.text()).slice(0, 240) } catch { /* no body */ }
       return fail({
         reaped: false,
         reason: 'error',
-        error: `HTTP ${response?.status ?? 'unknown'}${response?.statusText ? ` ${response.statusText}` : ''}`,
+        error: `HTTP ${response?.status ?? 'unknown'}${response?.statusText ? ` ${response.statusText}` : ''}${detail ? `: ${detail}` : ''}`,
         status: response?.status,
       })
     }

package/service.mjs

@@ -456,6 +456,65 @@ export function installService(room, cmdArgs = [], { autoUpdate = false, version
   return true
 }
 
+// Interactive installs must not present an armed launchd helper as a completed
+// background service. installService() intentionally returns after staging because
+// an in-service update may tear down its caller; this menu/CLI primitive waits for the
+// helper receipt AND the exact live runtime before returning success.
+export async function installAndConfirmService(room, cmdArgs = [], {
+  platform = process.platform,
+  version = VERSION,
+  staleProof = true,
+  install = installService,
+  exec = execSync,
+  snapshot = serviceRuntimeSnapshot,
+  readStatus = () => {
+    try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
+  },
+  now = Date.now,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  timeoutMs = 55000,
+  pollMs = 250,
+  stderr = process.stderr,
+} = {}) {
+  if (install(room, cmdArgs, { version, staleProof }) === false) return false
+
+  const confirmation = () => {
+    const live = snapshot(room, { platform, exec })
+    if (live?.version === version) {
+      stderr.write(`  ✓ bridge install confirmed — running v${version}.\n`)
+      return true
+    }
+    return false
+  }
+
+  // systemd's restart is synchronous. Windows cannot prove a live Startup process,
+  // so this exact-runtime confirmation is used only where a service manager exists.
+  if (platform !== 'darwin') {
+    if (platform === 'win32') return true
+    const confirmed = confirmation()
+    if (!confirmed) stderr.write(`  ⚠ install v${version} was not confirmed: the service manager cannot prove that runtime is running.\n`)
+    return confirmed
+  }
+
+  const deadline = now() + Math.max(0, Number(timeoutMs) || 0)
+  const expectedTarget = label(room)
+  for (;;) {
+    const status = readStatus()
+    if (status && typeof status === 'object' && status.target === expectedTarget && status.version === version) {
+      if (status.ok === false) {
+        stderr.write(`  ⚠ install v${version} was not confirmed: ${status.error || 'the launchd handoff failed'}.\n`)
+        return false
+      }
+      if (status.ok === true && confirmation()) return true
+    }
+    if (now() >= deadline) {
+      stderr.write(`  ⚠ install v${version} timed out waiting for launchd confirmation; no running service was proven.\n`)
+      return false
+    }
+    await sleep(Math.max(1, Number(pollMs) || 1))
+  }
+}
+
 // Restart an already-installed boot-persistent service. launchd/systemd relaunch
 // the stable runtime (or legacy auto-update npx command), so active sessions resume
 // from disk. Use it to recover a wedged bridge or re-read provider.json.

package/terminal-row-reconcile.mjs

@@ -1,3 +1,5 @@
+import { reapTerminalRow } from './reap-terminal.mjs'
+
 /* Reconcile durable terminal rows after a bridge has restored its on-disk roster.
 
    A clean close is reaped by reap-terminal.mjs. This module closes the other
@@ -48,13 +50,16 @@ export async function reconcileTerminalRows ({
 
     const reaped = []
     for (const id of stale) {
-      const del = await fetchImpl(
-        `${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}` +
-        `&host_id=eq.${encodeURIComponent(hostId)}`,
-        { method: 'DELETE', headers: { apikey: anonKey, Authorization: `Bearer ${token}` } },
-      )
-      if (!del?.ok) {
-        return fail({ reason: 'error', error: `delete HTTP ${del?.status ?? 'unknown'}`, status: del?.status, reaped })
+      const deletion = await reapTerminalRow({
+        id, token, supabaseUrl, anonKey, fetchImpl,
+      })
+      if (!deletion.reaped) {
+        return fail({
+          reason: 'error',
+          error: `delete ${deletion.error || deletion.reason}`,
+          status: deletion.status,
+          reaped,
+        })
       }
       reaped.push(id)
     }