thinkpool-pair 0.7.309 → 0.7.311

package/abort-turn-barrier.mjs

@@ -0,0 +1,23 @@
+// Realtime delivers code-abort and the browser's newly-flushed code-turn through
+// independent handlers. Keep that next human turn behind the runtime's real abort
+// completion so a late aborted boundary cannot close the new turn.
+
+export function queueAbortBarrier(entry, runAbort = () => entry?.session?.abort?.()) {
+  if (!entry) return Promise.resolve()
+  const prior = entry._abortBarrier || Promise.resolve()
+  let barrier
+  barrier = Promise.resolve(prior)
+    .catch(() => {})
+    .then(() => runAbort())
+    .catch(() => {})
+    .finally(() => {
+      if (entry._abortBarrier === barrier) entry._abortBarrier = null
+    })
+  entry._abortBarrier = barrier
+  return barrier
+}
+
+export async function waitForAbortBarrier(entry) {
+  const barrier = entry?._abortBarrier
+  if (barrier) await barrier
+}

package/account.mjs

@@ -13,7 +13,7 @@ import path from 'node:path'
 import fs from 'node:fs'
 import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
-import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
+import { saveAuth, loadAuth, markAuthReconnectRequired, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack, presenceSelfEchoObservation } from './presence.mjs'
 import { publicKeyB64, announceProviders, listProviders, addProvider, addProviderModel, removeProvider, unseal } from './providers.mjs'
@@ -252,16 +252,33 @@ export async function refreshAccountSession(sb, holdRefreshToken, deps = {}) {
     if (adopted) return adopted
     const rt = load()?.refresh_token || rt0
     const { data, error } = await sb.auth.refreshSession({ refresh_token: rt })
-    if (error || !data?.session) return null
+    // Preserve the server's structured Auth error. The caller must distinguish a
+    // retryable network/service failure from a refresh token that is definitively
+    // gone; collapsing both to null is what let a disconnected account keep painting
+    // as a healthy bridge until its presence JWT finally expired.
+    if (error || !data?.session) return { session: null, error: error || null }
     save(data.session)   // atomic (auth-store) — never a torn token file
     return { session: data.session, adopted: false }
   } finally { if (locked) release() }
 }
 
+// Supabase documents these as terminal session/refresh-token states. They require a
+// fresh device-code login; request timeouts, rate limits and 5xx errors remain retryable.
+export const ACCOUNT_RECONNECT_ERROR_CODES = new Set([
+  'refresh_token_not_found',
+  'refresh_token_already_used',
+  'session_not_found',
+])
+
+export function accountRefreshNeedsReconnect(error) {
+  return ACCOUNT_RECONNECT_ERROR_CODES.has(String(error?.code || ''))
+}
+
 // Exchange the stored credentials for a live session + authed client.
 export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
   const a = loadAuth()
   if (!a?.refresh_token) return null
+  if (a.reconnect_required) return { reconnectRequired: true }
   const sb = createClient(SUPABASE_URL, SUPABASE_ANON, { auth: { persistSession: false, autoRefreshToken: false } })
   // F1: skip the refresh entirely when the saved access token is still comfortably valid
   // (>5 min to expiry). Every gratuitous startup rotation is a race window — and, killed
@@ -273,7 +290,13 @@ export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
   }
   // Near-expiry / missing / invalid access token → do a serialized rotation (F3).
   const r = await refreshAccountSession(sb, a.refresh_token)
-  if (!r?.session) return null
+  if (!r?.session) {
+    if (accountRefreshNeedsReconnect(r?.error)) {
+      markAuthReconnectRequired(r.error.code)
+      return { reconnectRequired: true }
+    }
+    return null
+  }
   return { sb, session: r.session }
 }
 
@@ -289,6 +312,7 @@ export async function authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, opts =
   let delay = baseMs
   for (let n = 1; n <= maxAttempts; n++) {
     const a = await attempt(SUPABASE_URL, SUPABASE_ANON)
+    if (a?.reconnectRequired) return a
     if (a) return a
     if (!load()?.refresh_token) return null   // not linked — caller says `login`, exits 0
     if (n >= maxAttempts) break
@@ -320,10 +344,11 @@ export function claimLoopWedged({ lastClaimOkAt, now, quietMsThreshold = 40_000
 //   skewMs  — refresh this far ahead of expiry (default 90s)
 //   forceMs — fixed interval override (test hook: TP_TOKEN_REFRESH_FORCE_MS)
 //   retryMs — backoff after a transient failure (offline / rotation race)
-export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000, forceMs = 0, retryMs = 30_000, refresh = refreshAccountSession }) {
+export function scheduleTokenRefresh({ sb, session, onRefreshed, onReconnectRequired, skewMs = 90_000, forceMs = 0, retryMs = 30_000, refresh = refreshAccountSession }) {
   let timer = null
   let cur = session
   let cancelled = false
+  let reconnectRequired = false
   const arm = (delay) => {
     if (cancelled) return
     clearTimeout(timer)
@@ -343,12 +368,21 @@ export function scheduleTokenRefresh({ sb, session, onRefreshed, skewMs = 90_000
       // instead of blindly refreshing with our in-memory `cur.refresh_token` — the old
       // tick retried with a stale token it held and could lose the family to a race.
       const r = await refresh(sb, cur.refresh_token)
-      if (!r?.session) throw new Error('no session')
+      if (!r?.session) {
+        if (accountRefreshNeedsReconnect(r?.error)) {
+          if (!reconnectRequired) {
+            reconnectRequired = true
+            try { await onReconnectRequired?.(r.error) } catch { /* reporting is best-effort; retry still owns recovery */ }
+          }
+        }
+        throw r?.error || new Error('no session')
+      }
       cur = r.session
       // Hand the fresh token to the live realtime socket so the presence
       // connection stays authed across the swap (no drop, no rejoin needed).
       try { sb.realtime?.setAuth?.(cur.access_token) } catch { /* noop */ }
-      try { onRefreshed?.(cur) } catch { /* noop */ }
+      reconnectRequired = false
+      try { await onRefreshed?.(cur) } catch { /* noop */ }
       arm(nextDelay())
     } catch {
       // Transient (offline, or a refresh-token rotation race with another login).
@@ -394,6 +428,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.error('\n  ◇ Not linked to a ThinkPool account on this machine.\n    Link it:  npx thinkpool-pair login\n')
     process.exit(0)
   }
+  if (auth.reconnectRequired) {
+    releaseStartupAnchor()
+    releaseSingleton()
+    console.error('\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n')
+    process.exit(0)
+  }
   const { sb, session } = auth
   const email = session.user?.email || 'your account'
   // Current owner JWT, handed to each room-bridge child for authed web writes
@@ -548,6 +588,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // lastTrackStatus retains the most recent track()'s server verdict ('ok'|'timed out'|
   // 'error') so the presence self-echo watchdog can log WHY presence went dark.
   let lastTrackStatus = 'init'
+  let accountAuthState = 'connected'
   const trackPresence = makeThrottledTrack(acct, { minMs: 5000, onStatus: (s) => { lastTrackStatus = s } })
   // `service` lets the dashboard show whether this bridge is the durable installed
   // service (always-on, survives reboot) vs a foreground `npx` run that dies with its
@@ -560,7 +601,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // to spawn against — re-read each announce so an add/remove reflects immediately.
   // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
   const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), accountAuthState, ts: Date.now() })
+
+  // Persist account-auth truth separately from process presence. Presence will vanish
+  // when the old JWT expires; the claim row keeps the reconnect instruction visible on
+  // the dashboard until this same bridge refreshes successfully or another bridge takes
+  // over with a healthy login. Older databases simply reject this best-effort RPC.
+  const reportAccountAuthState = async (state) => {
+    try {
+      await withTimeout(sb.rpc('report_bridge_auth_state', { p_bridge_id: BRIDGE_ID, p_state: state }), 5000, 'report_bridge_auth_state')
+    } catch { /* migration not present yet, offline, or the old JWT already expired */ }
+  }
 
   // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
   // AUTH: the account channel `tpacct:<uid>` is created WITHOUT config.private:true,
@@ -647,13 +698,22 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const keepFresh = scheduleTokenRefresh({
     sb,
     session,
-    onRefreshed: (s) => {
+    onRefreshed: async (s) => {
+      accountAuthState = 'connected'
       saveAuth(s); pushPresence()
+      await reportAccountAuthState('connected')
       // Push the rotated owner token to every live child so their authed writes
       // (code-mockup) never go stale on a long session (whip L16).
       currentAccessToken = s.access_token || currentAccessToken
       for (const c of children.values()) { try { c.send({ t: 'token', accessToken: currentAccessToken }) } catch { /* child not ready */ } }
     },
+    onReconnectRequired: async (error) => {
+      accountAuthState = 'reconnect-required'
+      markAuthReconnectRequired(error?.code || 'refresh-token-invalid')
+      pushPresence()
+      await reportAccountAuthState('reconnect-required')
+      process.stderr.write('\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n')
+    },
     forceMs: parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS, 10) || 0,
   })
 

package/auth-store.mjs

@@ -19,19 +19,8 @@ const SERVED = path.join(DIR, 'served.json')
 
 function ensureDir() { try { fs.mkdirSync(DIR, { recursive: true }) } catch { /* noop */ } }
 
-export function saveAuth(session) {
-  if (!session?.refresh_token) return
+function writeAuthPayload(payload) {
   ensureDir()
-  const payload = JSON.stringify({
-    refresh_token: session.refresh_token,
-    access_token: session.access_token || null,
-    // Unix SECONDS. Lets the bridge adopt the saved access token WITHOUT a refresh while
-    // it's still comfortably valid (account.mjs F1) — every skipped rotation is one fewer
-    // race window (and one fewer chance to be killed mid-rotation and brick the login).
-    expires_at: session.expires_at || null,
-    email: session.user?.email || session.email || null,
-    savedAt: Date.now(),
-  })
   // ATOMIC write (2026-07-08): a crash/kill/kickstart mid-write must never leave a
   // truncated auth.json — an unparseable token file reads as "not linked" and bricks the
   // saved login (three bridge outages in two days, one from a restart landing mid-rotation).
@@ -43,13 +32,38 @@ export function saveAuth(session) {
   const tmp = `${AUTH}.tmp.${process.pid}.${Date.now()}`
   try {
     const fd = fs.openSync(tmp, 'w', 0o600)
-    try { fs.writeSync(fd, payload); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+    try { fs.writeSync(fd, JSON.stringify(payload)); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
     fs.renameSync(tmp, AUTH)
   } catch {
     try { fs.rmSync(tmp, { force: true }) } catch { /* noop */ }
   }
 }
+
+export function saveAuth(session) {
+  if (!session?.refresh_token) return
+  writeAuthPayload({
+    refresh_token: session.refresh_token,
+    access_token: session.access_token || null,
+    // Unix SECONDS. Lets the bridge adopt the saved access token WITHOUT a refresh while
+    // it's still comfortably valid (account.mjs F1) — every skipped rotation is one fewer
+    // race window (and one fewer chance to be killed mid-rotation and brick the login).
+    expires_at: session.expires_at || null,
+    email: session.user?.email || session.email || null,
+    savedAt: Date.now(),
+  })
+}
 export function loadAuth() { try { return JSON.parse(fs.readFileSync(AUTH, 'utf8')) } catch { return null } }
+export function markAuthReconnectRequired(errorCode = null) {
+  const current = loadAuth()
+  if (!current?.refresh_token) return false
+  writeAuthPayload({
+    ...current,
+    reconnect_required: true,
+    reconnect_error_code: errorCode || null,
+    reconnect_required_at: Date.now(),
+  })
+  return true
+}
 export function clearAuth() { try { fs.unlinkSync(AUTH) } catch { /* noop */ } }
 
 export function loadDirs() { try { return JSON.parse(fs.readFileSync(DIRS, 'utf8')) } catch { return {} } }

package/bridge.mjs

@@ -65,6 +65,7 @@ import { commandOnPath } from './agent-detect.mjs'
 import { requiresSdkAdmission, sdkSmokePassed } from './sdk-admission.mjs'
 import { hermesUserInputResponse } from './question-response.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
+import { queueAbortBarrier, waitForAbortBarrier } from './abort-turn-barrier.mjs'
 
 const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'review', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, FLOW_CODEX_CONDUCTOR_PROMPT, FLOW_CODEX_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
@@ -3996,6 +3997,12 @@ channel
   .on('broadcast', { event: 'code-turn' }, async ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
     if (!s || payload.text == null) return
+    // Stop and the browser's queue flush are separate realtime frames. Codex and
+    // Hermes need their native cancellation to settle before the flushed turn is
+    // accepted; otherwise the old aborted result can land after the new `you` line
+    // and close it. Re-check identity after the await in case the lane was closed.
+    await waitForAbortBarrier(s)
+    if (sessions.get(payload.term) !== s || !s.session) return
     markActivity()
     // B2/C: a real human turn is hop 0 with fresh cross-terminal budgets. This is
     // the loop-breaker reset point — an injected (cross-posted) turn does NOT come
@@ -4290,7 +4297,11 @@ channel
   })
   .on('broadcast', { event: 'code-abort' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s) { drainPending(s); s.session.abort(); announce() }   // settle any open permission card so the hook doesn't hang
+    if (s) {
+      drainPending(s)   // settle any open permission card so the hook doesn't hang
+      queueAbortBarrier(s).finally(() => announce())
+      announce()
+    }
   })
   .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)

package/codex-session.mjs

@@ -589,6 +589,9 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   }
 
   async function runAppServer(prompt, options = {}) {
+    // Stop can win before the queued pump enters native startup. Do not launch a
+    // fresh App Server merely to discover the accepted room turn was cancelled.
+    if (ended || aborted) return true
     if (!await ensureAppServer()) return false
     // Stop can land while the cold App Server / MCP bootstrap is still awaiting.
     // The accepted turn was already closed at the room boundary; never start it
@@ -651,6 +654,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   }
 
   async function runAppServerReview(commandText) {
+    if (ended || aborted) return true
     if (!await ensureAppServer()) return false
     if (ended || aborted) return true
     mapper.setUsageBaseline(sessionId ? readCodexThreadUsage(sessionId) : null)
@@ -869,11 +873,13 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       return true
     },
     abort() {
+      const activeChain = chain
       const bootstrapOnly = turnActive && !activeTurnId && !child
       aborted = true
       queue.length = 0
       closeAppServerTurn(activeTurnId)
-      if (appServer && activeTurnId) { void appServer.interrupt({ threadId: sessionId, turnId: activeTurnId }).catch(() => {}) ; return }
+      let interrupt = Promise.resolve()
+      if (appServer && activeTurnId) interrupt = appServer.interrupt({ threadId: sessionId, turnId: activeTurnId }).catch(() => {})
       if (child) { try { child.kill('SIGTERM') } catch { /* noop */ } ; setTimeout(() => { try { child?.kill('SIGKILL') } catch { /* noop */ } }, 1500) }
       else if (bootstrapOnly) {
         // No native turn exists to produce a boundary. Close the optimistic
@@ -881,6 +887,10 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         // aborted check discard the delayed startup.
         emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 0, durationMs: undefined, denials: 0, resultText: null })
       }
+      // `code-turn` may already be queued behind Stop in Realtime. Resolve only
+      // after the interrupted native turn's chain has fully unwound; accepting a
+      // new turn earlier lets the old finally/result close the new lifecycle.
+      return interrupt.then(() => activeChain).catch(() => activeChain).then(() => {})
     },
     end() {
       ended = true

package/hermes-session.mjs

@@ -566,7 +566,7 @@ export function startHermesSession({
       })
       return true
     },
-    abort() {
+    async abort() {
       if (!turnActive) return
       queuedTurns.length = 0
       queueDrainPending = false
@@ -582,14 +582,16 @@ export function startHermesSession({
         retireClient()
         client?.end()
         finishAbortedTurn()
+        await promptChain.catch(() => {})
         return
       }
       if (!sessionId || !client?.alive) {
         finishAbortedTurn()
+        await promptChain.catch(() => {})
         return
       }
       finishAbortedTurn()
-      void client.notify('session/cancel', { sessionId }).catch((error) => {
+      await client.notify('session/cancel', { sessionId }).catch((error) => {
         // Never display a stopped lane while the un-cancelled Hermes process
         // might still be executing. A transport failure tears down the ACP
         // process and makes the lane honestly non-resumable until restart.
@@ -597,6 +599,10 @@ export function startHermesSession({
         client?.end()
         emit({ kind: 'error', message: `Hermes cancellation delivery failed; ACP process stopped: ${error?.message || error}`, recoverable: true })
       })
+      // The ACP cancellation notification is not itself the completion edge.
+      // Wait for the active prompt promise to unwind (including the 0.18.2
+      // cancelled-response recovery) before a bridge queue flush starts anew.
+      await promptChain.catch(() => {})
     },
     end() {
       ended = true

package/launcher.mjs

@@ -75,8 +75,10 @@ export function detectState() {
   const hermesInstalled = onPath('hermes')
   const hermesReady = onPath('thinkpool') && probeHermesRuntime().available
   const accountSvc = serviceLoaded(null)
+  const reconnectRequired = !!auth?.reconnect_required
   return {
-    loggedIn: !!auth?.refresh_token,
+    loggedIn: !!auth?.refresh_token && !reconnectRequired,
+    reconnectRequired,
     email: auth?.email || auth?.user?.email || null,
     provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
     providerModel: isCustom ? (provider.model || null) : null,
@@ -106,6 +108,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     ...next,
     agents: Array.isArray(next?.agents) ? next.agents : [],
     loggedIn: !!next?.loggedIn,
+    reconnectRequired: !!next?.reconnectRequired,
     accountSvc: !!next?.accountSvc,
     serviceVersion: typeof next?.serviceVersion === 'string' && next.serviceVersion ? next.serviceVersion : null,
     platform: next?.platform || process.platform,
@@ -130,7 +133,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     io.print('')
     io.print('  ' + C.dim('┌ ') + C.bold('thinkpool-pair') + C.dim(' ' + '─'.repeat(40)))
     io.print(`  ${C.dim('│ launcher ')} ${state.version ? `v${state.version}` : 'version unavailable'}`)
-    io.print(`  ${C.dim('│ account  ')} ${state.loggedIn ? C.green((state.email || 'linked') + ' ✓') : C.yellow('not linked')}`)
+    io.print(`  ${C.dim('│ account  ')} ${state.reconnectRequired ? C.yellow('reconnect required') : state.loggedIn ? C.green((state.email || 'linked') + ' ✓') : C.yellow('not linked')}`)
     io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none ready')}`)
     io.print(`  ${C.dim('│ directory')} ${C.dim(state.cwd)}`)
     const bridgeStatus = !state.accountSvc
@@ -165,7 +168,9 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
   // logged in — offers to link on the spot, re-reads disk, and refuses to serve if still not.
   const ensureLoggedIn = async () => {
     if (state.loggedIn) return true
-    io.print('\n  ' + C.yellow('You are not linked to a ThinkPool account yet.'))
+    io.print('\n  ' + C.yellow(state.reconnectRequired
+      ? 'This bridge lost its Thinkpool account link.'
+      : 'You are not linked to a ThinkPool account yet.'))
     if (await askYesNo('  Link this device now?', true)) { await actions.login(); resync() }
     if (!state.loggedIn) { io.print('  ' + C.yellow('login needed to serve your sessions — back to menu')); return false }
     return true
@@ -230,7 +235,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     for (;;) {
       const options = [
         { key: 'provider', label: 'Provider', hint: `current: ${state.provider}` },
-        { key: 'account', label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
+        { key: 'account', label: 'Account', hint: state.reconnectRequired ? 'reconnect required' : state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
       ]
       if (state.hermesInstalled) options.push({ key: 'hermes', label: state.hermesReady ? 'Hermes profile' : 'Set up Hermes', hint: state.hermesReady ? 'isolated profile ready' : 'set up isolated profile + delegation guard' })
       options.push({ key: 'back', label: 'Back to main menu', hint: '' })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.309",
+  "version": "0.7.311",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "files": [
     "bridge.mjs",
+    "abort-turn-barrier.mjs",
     "host-memory.mjs",
     "sdk-smoke.mjs",
     "sdk-admission.mjs",