thinkpool-pair 0.7.317 → 0.7.319

package/account.mjs

@@ -15,7 +15,7 @@ import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
 import { saveAuth, loadAuth, markAuthReconnectRequired, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
-import { makeThrottledTrack, presenceSelfEchoObservation } from './presence.mjs'
+import { makeThrottledTrack, presenceRecoveryEligible, presenceSelfEchoObservation, reducePresenceChannelEvidence } from './presence.mjs'
 import { publicKeyB64, announceProviders, listProviders, addProvider, addProviderModel, removeProvider, unseal } from './providers.mjs'
 import { supervisorServes, supervisorRoomsToStop } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
@@ -23,6 +23,7 @@ import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 import { installedAgentCommands } from './agent-detect.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
 import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
+import { clearSupervisorReady, supervisorPresenceEchoed, writeSupervisorReady } from './supervisor-ready.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -410,6 +411,10 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     console.error('\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    `npx thinkpool-pair <ROOM>`.\n')
     process.exit(0)
   }
+  // We own account.lock now, so any previous readiness receipt is stale. A fresh
+  // receipt is written only after the first reconciliation tick AND a server-side
+  // presence self-echo prove that this exact supervisor finished bootstrapping.
+  clearSupervisorReady()
   const releaseStartupAnchor = createStartupAnchor()
   // F2: NEVER exit(1) on a refresh failure. The old code exited 1 here, and launchd
   // KeepAlive respawned us within seconds → refresh again → the 16× crash storm (and,
@@ -674,16 +679,35 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // and stamps presenceSyncSeenAt. acctSubscribedAt bounds the startup case where
   // SUBSCRIBED fires but the first sync never arrives: that is a broken Realtime
   // channel, not an unknowable state, once the listener was attached before join.
-  let presenceSyncSeenAt = 0
-  let acctSubscribedAt = 0
-  acct.on('presence', { event: 'sync' }, () => { presenceSyncSeenAt = Date.now() })
+  let presenceEvidence = reducePresenceChannelEvidence()
+  let initialTickDone = false
+  let readinessWritten = false
+  const publishReadiness = () => {
+    if (readinessWritten || !initialTickDone) return
+    let present = false
+    try { present = supervisorPresenceEchoed(acct.presenceState?.(), machine, BRIDGE_ID, VERSION) } catch { present = false }
+    if (!present) return
+    readinessWritten = writeSupervisorReady({ version: VERSION, bridgeId: BRIDGE_ID })
+    if (!readinessWritten) process.stderr.write('\n  ◇ Could not record local supervisor readiness; the bridge remains running but installers will not claim it was confirmed.\n')
+  }
+  acct.on('presence', { event: 'sync' }, () => {
+    presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, 'sync')
+    publishReadiness()
+  })
 
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
   await new Promise((res) => acct.subscribe((st) => {
-    if (st === 'SUBSCRIBED') { if (!acctSubscribedAt) acctSubscribedAt = Date.now(); pushPresence(); res() }
+    if (st === 'SUBSCRIBED') {
+      presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, st)
+      pushPresence(); res()
+    }
     else if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
+      // Invalidate the old generation before inspecting presenceState again. The
+      // channel retains a local self key across failures; accepting that cache is
+      // what left the managed service zombified while a fresh foreground run worked.
+      presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, st)
       // Realtime dropped (the 2026-07-08 `realtime CLOSED` blip). The socket normally
       // auto-reconnects, but nudge it so presence — and the claim heartbeat that shares
       // this client — recover instead of the loop standing by against its own stale row.
@@ -1120,6 +1144,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
 
   await tick()
   const iv = setInterval(tick, 15000)
+  initialTickDone = true
+  publishReadiness()
   releaseStartupAnchor()
   const updateTimers = []   // auto-update poll/apply timers — cleared in stop() so none fire post-exit
   let stopping = false
@@ -1160,12 +1186,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const presenceWatch = setInterval(() => {
     if (stopping) return
     const now = Date.now()
+    const recoveryEligible = presenceRecoveryEligible({ claimHeld, lastClaimOkAt, now })
     let present = false
     try { present = !!acct.presenceState?.()[machine] } catch { present = false }
     const observation = presenceSelfEchoObservation({
-      tracking: claimHeld,
-      subscribedAt: acctSubscribedAt,
-      syncSeenAt: presenceSyncSeenAt,
+      // A fresh HTTP claim distinguishes a Realtime-only zombie from a full
+      // connectivity outage. In the latter case, wait in-process; a respawn cannot
+      // restore the network and launchd would otherwise loop indefinitely.
+      tracking: recoveryEligible,
+      subscribedAt: Math.max(presenceEvidence.subscribedAt, lastClaimOkAt),
+      syncSeenAt: presenceEvidence.syncSeenAt,
       present,
       missingSince: selfEchoMissingSince,
       now,
@@ -1199,6 +1229,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     clearInterval(presenceWatch)
     for (const t of updateTimers) { try { clearInterval(t) } catch { /* noop */ } }   // clearInterval clears Timeouts too
     keepFresh.cancel()
+    clearSupervisorReady({ pid: process.pid })
     releaseSingleton()
     for (const c of children.values()) { try { c.kill(sig || 'SIGTERM') } catch { /* noop */ } }
     pairBus.close()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.317",
+  "version": "0.7.319",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -89,6 +89,7 @@
     "terminal-row-reconcile.mjs",
     "switch-provider.mjs",
     "service.mjs",
+    "supervisor-ready.mjs",
     "presence.mjs",
     "account.mjs",
     "auth-store.mjs",

package/presence.mjs

@@ -57,6 +57,40 @@ export function makeThrottledTrack(channel, { minMs = 5000, onStatus = null } =
   }
 }
 
+// A RealtimeChannel keeps its last presenceState() locally. After CHANNEL_ERROR /
+// CLOSED that cache can still contain our own key even though the server (and every
+// dashboard subscriber) has already removed it. Treat every subscribe/error edge as
+// a new evidence generation: only a presence sync delivered in that generation may
+// certify the cached self key.
+export function reducePresenceChannelEvidence(state = {}, event, now = Date.now()) {
+  const current = {
+    subscribedAt: Number(state.subscribedAt) || 0,
+    syncSeenAt: Number(state.syncSeenAt) || 0,
+  }
+  if (event === 'sync') return { ...current, syncSeenAt: now }
+  if (event === 'SUBSCRIBED') {
+    // A reconnect loop may report SUBSCRIBED repeatedly without ever delivering
+    // presence sync. Preserve the first unsynced boundary so retries cannot keep
+    // pushing the watchdog deadline out forever.
+    if (current.subscribedAt && !current.syncSeenAt) return current
+    return { subscribedAt: now, syncSeenAt: 0 }
+  }
+  if (event === 'CLOSED' || event === 'CHANNEL_ERROR' || event === 'TIMED_OUT') {
+    // Likewise, repeated error callbacks are one failure episode until a fresh
+    // sync proves recovery.
+    if (current.subscribedAt && !current.syncSeenAt) return current
+    return { subscribedAt: now, syncSeenAt: 0 }
+  }
+  return current
+}
+
+// Recycling a websocket is useful only when plain HTTP is healthy enough to prove
+// this is a Realtime-only wedge. During a full network/Supabase outage, respawning a
+// launchd service cannot help and merely creates a restart storm.
+export function presenceRecoveryEligible({ claimHeld, lastClaimOkAt, now, maxClaimSilenceMs = 40_000 }) {
+  return !!claimHeld && Number.isFinite(lastClaimOkAt) && (now - lastClaimOkAt) < maxClaimSilenceMs
+}
+
 /* ─────────────────────────────────────────────────────────────
    presenceSelfEchoVerdict — the pure trigger for the account
    supervisor's presence self-echo watchdog (2026-07-08 recurrence).

package/service.mjs

@@ -23,6 +23,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { execSync } from 'node:child_process'
 import { hostMemoryAdmission } from './host-memory.mjs'
+import { readSupervisorReady, supervisorReadyMatches } from './supervisor-ready.mjs'
 
 // Service identity. Account mode has no room → a single stable id so there's
 // exactly one account service per machine (a second install replaces it).
@@ -306,6 +307,8 @@ export function buildDarwinReloadHandoff({ targetLabel, targetFile, stagedFile,
     `status=${shq(statusFile)}`,
     'tmp="$status.tmp.$$"',
     'ok=0',
+    'live_pid=""',
+    'stable=0',
     'had_previous=0',
     'if [ -f "$target_file" ]; then cp "$target_file" "$backup_file" && had_previous=1; fi',
     'launchctl bootout "$dom/$target" 2>/dev/null || true',
@@ -313,7 +316,7 @@ export function buildDarwinReloadHandoff({ targetLabel, targetFile, stagedFile,
     'cp "$staged_file" "$target_file"',
     'launchctl enable "$dom/$target" 2>/dev/null || true',
     'for i in $(seq 1 30); do launchctl bootstrap "$dom" "$target_file" 2>/dev/null && break; sleep 0.3; done',
-    'for i in $(seq 1 60); do if launchctl print "$dom/$target" 2>/dev/null | grep -F -- "$expected" >/dev/null && launchctl print "$dom/$target" 2>/dev/null | grep -F "state = running" >/dev/null; then ok=1; break; fi; sleep 0.5; done',
+    'for i in $(seq 1 60); do snapshot="$(launchctl print "$dom/$target" 2>/dev/null || true)"; pid="$(printf "%s\\n" "$snapshot" | sed -n "s/^[[:space:]]*pid = \\([0-9][0-9]*\\)[[:space:]]*$/\\1/p" | head -1)"; if [ -n "$pid" ] && printf "%s\\n" "$snapshot" | grep -F -- "$expected" >/dev/null && printf "%s\\n" "$snapshot" | grep -F "state = running" >/dev/null; then if [ "$pid" = "$live_pid" ]; then stable=$((stable+1)); else live_pid="$pid"; stable=1; fi; if [ "$stable" -ge 5 ]; then ok=1; break; fi; else live_pid=""; stable=0; fi; sleep 0.5; done',
     `if [ "$ok" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: true, version: String(version), target: String(targetLabel) })}' > "$tmp"; else rollback=0; if [ "$had_previous" = 1 ]; then launchctl bootout "$dom/$target" 2>/dev/null || true; for i in $(seq 1 40); do launchctl print "$dom/$target" >/dev/null 2>&1 || break; sleep 0.2; done; cp "$backup_file" "$target_file"; launchctl enable "$dom/$target" 2>/dev/null || true; for i in $(seq 1 30); do if launchctl bootstrap "$dom" "$target_file" 2>/dev/null; then rollback=1; break; fi; sleep 0.3; done; fi; if [ "$rollback" = 1 ]; then printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed; previous service restored', rolledBack: true })}' > "$tmp"; else printf '%s\\n' '${JSON.stringify({ ok: false, version: String(version), target: String(targetLabel), error: 'new runtime not confirmed and rollback failed', rolledBack: false })}' > "$tmp"; fi; fi`,
     'mv "$tmp" "$status"',
     'rm -f "$staged_file" "$backup_file" "$helper_file"',
@@ -332,6 +335,53 @@ export function buildDarwinReloadHandoff({ targetLabel, targetFile, stagedFile,
   return { helperLabel, helperFile, backupFile, statusFile, logFile, script, content }
 }
 
+const accountLockFile = () => path.join(os.homedir(), '.thinkpool-pair', 'account.lock')
+const processAlive = (pid) => {
+  try { process.kill(pid, 0); return true } catch (error) { return error?.code === 'EPERM' }
+}
+
+// A first background install can race a foreground/orphaned ThinkPool bridge that
+// still owns account.lock. The launchd child then exits 0, satisfying a momentary
+// `state = running` probe while KeepAlive correctly declines to restart it. Retire
+// only a PID whose command is demonstrably a packaged ThinkPool bridge; fail closed
+// on PID reuse or an unrelated process.
+export async function retireUnmanagedBridgeLock({
+  lockFile = accountLockFile(),
+  readLock = () => fs.readFileSync(lockFile, 'utf8'),
+  removeLock = () => fs.rmSync(lockFile, { force: true }),
+  commandForPid = (pid) => String(execSync(`ps -p ${pid} -o command=`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })),
+  alive = processAlive,
+  signal = (pid, sig) => process.kill(pid, sig),
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  waitMs = 2500,
+  pollMs = 100,
+  stderr = process.stderr,
+} = {}) {
+  let pid = 0
+  try { pid = parseInt(String(readLock()).trim(), 10) || 0 } catch { return true }
+  const removeIfSameAndDead = () => {
+    if (alive(pid)) return false
+    try { if ((parseInt(String(readLock()).trim(), 10) || 0) === pid) removeLock() } catch { /* already gone */ }
+    return true
+  }
+  if (!pid || pid === process.pid || removeIfSameAndDead()) return true
+  let command = ''
+  try { command = commandForPid(pid) } catch { return removeIfSameAndDead() }
+  const packagedBridge = /(?:node_modules[\\/]thinkpool-pair|\.npm[\\/]_npx|\.thinkpool-pair[\\/]runtimes)[\\/][^\n]*bridge\.mjs(?:\s|$)/.test(command)
+  if (!packagedBridge) {
+    stderr.write(`  ⚠ account.lock belongs to PID ${pid}, but it is not a verified thinkpool-pair bridge; refusing to signal an unrelated process.\n`)
+    return false
+  }
+  stderr.write(`  ◆ stopping previous thinkpool-pair bridge (PID ${pid}) before installing the background service…\n`)
+  try { signal(pid, 'SIGTERM') } catch { if (removeIfSameAndDead()) return true }
+  const polls = Math.max(1, Math.ceil(Math.max(0, Number(waitMs) || 0) / Math.max(1, Number(pollMs) || 1)))
+  for (let i = 0; i < polls; i++) { if (removeIfSameAndDead()) return true; await sleep(Math.max(1, Number(pollMs) || 1)) }
+  try { signal(pid, 'SIGKILL') } catch { /* checked below */ }
+  for (let i = 0; i < 5; i++) { if (removeIfSameAndDead()) return true; await sleep(Math.max(1, Number(pollMs) || 1)) }
+  stderr.write(`  ⚠ previous thinkpool-pair bridge PID ${pid} did not stop; background install aborted to avoid two competing bridges.\n`)
+  return false
+}
+
 function startDarwinReloadHandoff(a, version) {
   const stagedFile = path.join(a.logDir, `service-update-${process.pid}-${Date.now()}.plist`)
   const h = buildDarwinReloadHandoff({ targetLabel: labelFromFile(a.file), targetFile: a.file, stagedFile, expectedRuntime: a.expectedRuntime, version })
@@ -467,6 +517,8 @@ export async function installAndConfirmService(room, cmdArgs = [], {
   install = installService,
   exec = execSync,
   snapshot = serviceRuntimeSnapshot,
+  prepareAccountHandoff = retireUnmanagedBridgeLock,
+  readReady = () => readSupervisorReady(),
   readStatus = () => {
     try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
   },
@@ -476,11 +528,20 @@ export async function installAndConfirmService(room, cmdArgs = [], {
   pollMs = 250,
   stderr = process.stderr,
 } = {}) {
+  const before = snapshot(room, { platform, exec })
+  if (!room && platform !== 'win32' && !before) {
+    if (!(await prepareAccountHandoff())) {
+      stderr.write('  ⚠ background install aborted: the previous bridge could not be handed off safely.\n')
+      return false
+    }
+  }
+  const confirmationStartedAt = now()
   if (install(room, cmdArgs, { version, staleProof }) === false) return false
 
   const confirmation = () => {
     const live = snapshot(room, { platform, exec })
-    if (live?.version === version) {
+    const ready = !!room || platform !== 'darwin' || supervisorReadyMatches(readReady(), live, version, { notBefore: confirmationStartedAt })
+    if (live?.version === version && ready) {
       stderr.write(`  ✓ bridge install confirmed — running v${version}.\n`)
       return true
     }
@@ -508,7 +569,7 @@ export async function installAndConfirmService(room, cmdArgs = [], {
       if (status.ok === true && confirmation()) return true
     }
     if (now() >= deadline) {
-      stderr.write(`  ⚠ install v${version} timed out waiting for launchd confirmation; no running service was proven.\n`)
+      stderr.write(`  ⚠ install v${version} timed out waiting for supervisor readiness; no connected account bridge was proven.\n`)
       return false
     }
     await sleep(Math.max(1, Number(pollMs) || 1))
@@ -609,6 +670,7 @@ export async function updateAndConfirmService(room, {
   install = installService,
   active = isServiceInstalled,
   snapshot = serviceRuntimeSnapshot,
+  readReady = () => readSupervisorReady(),
   readStatus = () => {
     try { return JSON.parse(fs.readFileSync(path.join(os.homedir(), '.thinkpool-pair', 'update-status.json'), 'utf8')) } catch { return null }
   },
@@ -619,6 +681,7 @@ export async function updateAndConfirmService(room, {
   stderr = process.stderr,
 } = {}) {
   const before = snapshot(room, { platform, exec })
+  const confirmationStartedAt = now()
   let target = null
   const captureTarget = (...args) => {
     const result = exec(...args)
@@ -636,7 +699,8 @@ export async function updateAndConfirmService(room, {
     const live = snapshot(room, { platform, exec })
     const versionChanged = !!before && before.version !== target
     const processChanged = !!before?.pid && !!live?.pid && before.pid !== live.pid
-    if (live?.version === target && (versionChanged || processChanged)) {
+    const ready = !!room || platform !== 'darwin' || supervisorReadyMatches(readReady(), live, target, { notBefore: confirmationStartedAt })
+    if (live?.version === target && (versionChanged || processChanged) && ready) {
       stderr.write(`  ✓ bridge restart confirmed — running v${target}.\n`)
       return { ok: true, live }
     }

package/supervisor-ready.mjs

@@ -0,0 +1,57 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+export const ACCOUNT_READY_FILE = path.join(os.homedir(), '.thinkpool-pair', 'account-ready.json')
+
+export function readSupervisorReady(file = ACCOUNT_READY_FILE, { fsMod = fs } = {}) {
+  try {
+    const value = JSON.parse(fsMod.readFileSync(file, 'utf8'))
+    if (!value || typeof value !== 'object') return null
+    return value
+  } catch { return null }
+}
+
+export function supervisorReadyMatches(receipt, live, version, { notBefore = 0 } = {}) {
+  return !!receipt && !!live?.pid &&
+    String(receipt.pid) === String(live.pid) &&
+    receipt.version === version &&
+    typeof receipt.bridgeId === 'string' && receipt.bridgeId.length > 0 &&
+    Number.isFinite(receipt.readyAt) && receipt.readyAt >= notBefore
+}
+
+// Supabase presence is keyed by hostname, so the key can outlive a crashed
+// process briefly. Require the unique process bridgeId inside the echoed metas;
+// hostname existence alone can certify the previous supervisor's stale presence.
+export function supervisorPresenceEchoed(state, machine, bridgeId, version) {
+  if (!state || typeof state !== 'object' || typeof machine !== 'string' || !machine || typeof bridgeId !== 'string' || !bridgeId) return false
+  const metas = Array.isArray(state[machine]) ? state[machine] : []
+  return metas.some((meta) => meta?.bridgeId === bridgeId && meta?.version === version)
+}
+
+export function writeSupervisorReady({ pid = process.pid, version, bridgeId, readyAt = Date.now() }, file = ACCOUNT_READY_FILE, { fsMod = fs } = {}) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0 || typeof version !== 'string' || !version || typeof bridgeId !== 'string' || !bridgeId) return false
+  const tmp = `${file}.tmp.${process.pid}.${Date.now()}`
+  try {
+    fsMod.mkdirSync(path.dirname(file), { recursive: true })
+    fsMod.writeFileSync(tmp, `${JSON.stringify({ pid: Number(pid), version, bridgeId, readyAt })}\n`, { mode: 0o600 })
+    fsMod.renameSync(tmp, file)
+    return true
+  } catch {
+    try { fsMod.rmSync(tmp, { force: true }) } catch { /* noop */ }
+    return false
+  }
+}
+
+// Remove an owned receipt on shutdown. With no pid, clear stale startup evidence
+// after this process has acquired the singleton lock and therefore owns account mode.
+export function clearSupervisorReady({ pid = null, file = ACCOUNT_READY_FILE, fsMod = fs } = {}) {
+  try {
+    if (pid !== null) {
+      const receipt = readSupervisorReady(file, { fsMod })
+      if (!receipt || String(receipt.pid) !== String(pid)) return false
+    }
+    fsMod.rmSync(file, { force: true })
+    return true
+  } catch { return false }
+}