thinkpool-pair 0.7.318 → 0.7.319

package/account.mjs

@@ -15,7 +15,7 @@ import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
 import { saveAuth, loadAuth, markAuthReconnectRequired, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
-import { makeThrottledTrack, presenceSelfEchoObservation } from './presence.mjs'
+import { makeThrottledTrack, presenceRecoveryEligible, presenceSelfEchoObservation, reducePresenceChannelEvidence } from './presence.mjs'
 import { publicKeyB64, announceProviders, listProviders, addProvider, addProviderModel, removeProvider, unseal } from './providers.mjs'
 import { supervisorServes, supervisorRoomsToStop } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
@@ -679,8 +679,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // and stamps presenceSyncSeenAt. acctSubscribedAt bounds the startup case where
   // SUBSCRIBED fires but the first sync never arrives: that is a broken Realtime
   // channel, not an unknowable state, once the listener was attached before join.
-  let presenceSyncSeenAt = 0
-  let acctSubscribedAt = 0
+  let presenceEvidence = reducePresenceChannelEvidence()
   let initialTickDone = false
   let readinessWritten = false
   const publishReadiness = () => {
@@ -691,14 +690,24 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     readinessWritten = writeSupervisorReady({ version: VERSION, bridgeId: BRIDGE_ID })
     if (!readinessWritten) process.stderr.write('\n  ◇ Could not record local supervisor readiness; the bridge remains running but installers will not claim it was confirmed.\n')
   }
-  acct.on('presence', { event: 'sync' }, () => { presenceSyncSeenAt = Date.now(); publishReadiness() })
+  acct.on('presence', { event: 'sync' }, () => {
+    presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, 'sync')
+    publishReadiness()
+  })
 
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
   await new Promise((res) => acct.subscribe((st) => {
-    if (st === 'SUBSCRIBED') { if (!acctSubscribedAt) acctSubscribedAt = Date.now(); pushPresence(); res() }
+    if (st === 'SUBSCRIBED') {
+      presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, st)
+      pushPresence(); res()
+    }
     else if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
+      // Invalidate the old generation before inspecting presenceState again. The
+      // channel retains a local self key across failures; accepting that cache is
+      // what left the managed service zombified while a fresh foreground run worked.
+      presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, st)
       // Realtime dropped (the 2026-07-08 `realtime CLOSED` blip). The socket normally
       // auto-reconnects, but nudge it so presence — and the claim heartbeat that shares
       // this client — recover instead of the loop standing by against its own stale row.
@@ -1177,12 +1186,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const presenceWatch = setInterval(() => {
     if (stopping) return
     const now = Date.now()
+    const recoveryEligible = presenceRecoveryEligible({ claimHeld, lastClaimOkAt, now })
     let present = false
     try { present = !!acct.presenceState?.()[machine] } catch { present = false }
     const observation = presenceSelfEchoObservation({
-      tracking: claimHeld,
-      subscribedAt: acctSubscribedAt,
-      syncSeenAt: presenceSyncSeenAt,
+      // A fresh HTTP claim distinguishes a Realtime-only zombie from a full
+      // connectivity outage. In the latter case, wait in-process; a respawn cannot
+      // restore the network and launchd would otherwise loop indefinitely.
+      tracking: recoveryEligible,
+      subscribedAt: Math.max(presenceEvidence.subscribedAt, lastClaimOkAt),
+      syncSeenAt: presenceEvidence.syncSeenAt,
       present,
       missingSince: selfEchoMissingSince,
       now,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.318",
+  "version": "0.7.319",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/presence.mjs

@@ -57,6 +57,40 @@ export function makeThrottledTrack(channel, { minMs = 5000, onStatus = null } =
   }
 }
 
+// A RealtimeChannel keeps its last presenceState() locally. After CHANNEL_ERROR /
+// CLOSED that cache can still contain our own key even though the server (and every
+// dashboard subscriber) has already removed it. Treat every subscribe/error edge as
+// a new evidence generation: only a presence sync delivered in that generation may
+// certify the cached self key.
+export function reducePresenceChannelEvidence(state = {}, event, now = Date.now()) {
+  const current = {
+    subscribedAt: Number(state.subscribedAt) || 0,
+    syncSeenAt: Number(state.syncSeenAt) || 0,
+  }
+  if (event === 'sync') return { ...current, syncSeenAt: now }
+  if (event === 'SUBSCRIBED') {
+    // A reconnect loop may report SUBSCRIBED repeatedly without ever delivering
+    // presence sync. Preserve the first unsynced boundary so retries cannot keep
+    // pushing the watchdog deadline out forever.
+    if (current.subscribedAt && !current.syncSeenAt) return current
+    return { subscribedAt: now, syncSeenAt: 0 }
+  }
+  if (event === 'CLOSED' || event === 'CHANNEL_ERROR' || event === 'TIMED_OUT') {
+    // Likewise, repeated error callbacks are one failure episode until a fresh
+    // sync proves recovery.
+    if (current.subscribedAt && !current.syncSeenAt) return current
+    return { subscribedAt: now, syncSeenAt: 0 }
+  }
+  return current
+}
+
+// Recycling a websocket is useful only when plain HTTP is healthy enough to prove
+// this is a Realtime-only wedge. During a full network/Supabase outage, respawning a
+// launchd service cannot help and merely creates a restart storm.
+export function presenceRecoveryEligible({ claimHeld, lastClaimOkAt, now, maxClaimSilenceMs = 40_000 }) {
+  return !!claimHeld && Number.isFinite(lastClaimOkAt) && (now - lastClaimOkAt) < maxClaimSilenceMs
+}
+
 /* ─────────────────────────────────────────────────────────────
    presenceSelfEchoVerdict — the pure trigger for the account
    supervisor's presence self-echo watchdog (2026-07-08 recurrence).