thinkpool-pair 0.7.32 → 0.7.33

package/account.mjs

@@ -208,7 +208,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    Auto-serving your sessions from ${DEFAULT_DIR}\n    (point one at another repo: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
-  const childIdle = new Map()  // room -> bool (last idle report; unknown = not idle)
+  const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
+  const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
   const childPeer = new Map()  // room -> bool (a web client is watching this room)
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
@@ -282,13 +283,14 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child
+      childBetween.set(room, false)
       childPeer.set(room, false)
       child.on('message', (m) => {
         if (!m) return
-        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childPeer.set(room, !!m.webPeer) }
+        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childBetween.set(room, m.between != null ? !!m.between : !!m.idle); childPeer.set(room, !!m.webPeer) }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
       })
-      child.on('exit', () => { children.delete(room); childIdle.delete(room); childPeer.delete(room) })   // re-served on the next tick
+      child.on('exit', () => { children.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room) })   // re-served on the next tick
       // If an update is already pending, tell the freshly-served child immediately so
       // its room shows the "update ready" chip without waiting for the next poll.
       if (pendingUpdate) { try { child.send({ t: 'update-available', version: pendingUpdate }) } catch { /* child not ready */ } }
@@ -317,7 +319,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
   const applyIfIdle = () => {
-    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childPeer, requested: applyRequested })) return
+    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
     stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
   }

package/bridge.mjs

@@ -1059,12 +1059,15 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   const POLL_MS = Math.max(60, parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL, 10) || 1800) * 1000
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
   // pendingUpdate is module-level now (shared with surfaceUpdate + the room chip).
-  const isIdle = () => {
+  // Between turns = safe to restart per Contract #1 (no turn in flight, no bytes
+  // mid-flush). Idle = that PLUS the quiet window — the extra conservatism only the
+  // unattended auto-apply needs; an explicit click restarts on between-turns alone.
+  const betweenTurns = () => {
     if (turnInFlight(sessions)) return false                  // a structured turn is live
-    if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
   }
+  const isIdle = () => betweenTurns() && (Date.now() - lastActivity >= IDLE_MS)
   // Newer? Compare the numeric x.y.z core; ignore prerelease tails to stay safe.
   const isNewer = (latest, cur) => {
     const core = (v) => String(v).split('-')[0].split('.').map((n) => parseInt(n, 10) || 0)
@@ -1083,11 +1086,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     } catch { return null } finally { clearTimeout(to) }
   }
   const applyIfIdle = () => {
-    if (!pendingUpdate || !isIdle()) return
-    // Slice 3: when a web client is watching, wait for their "apply" click instead
-    // of restarting under them. With nobody present (cloud VM / closed tab) the
-    // unattended fallback still auto-applies at idle so headless boxes self-heal.
-    if (!applyRequested && webPeerPresent()) return
+    if (!pendingUpdate) return
+    // Explicit "apply" → go at the next between-turns gap (the click means the user
+    // opted in; don't make them wait out the quiet window). Unattended (no click) →
+    // require the full idle window AND nobody watching, so a headless box self-heals
+    // without ever restarting under someone who's mid-session.
+    if (applyRequested) { if (!betweenTurns()) return }
+    else if (!isIdle() || webPeerPresent()) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting to update; the session resumes.\n`)
     shutdown(0, false)   // clean teardown (no farewell banner); service reruns @latest, session-store resumes
   }
@@ -1108,17 +1113,19 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   // supervisor restart re-resolves @latest. Instead we report our idle state so
   // the supervisor can pick a moment when EVERY child is idle to restart-update.
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
-  const idleNow = () => {
+  const betweenTurns = () => {
     if (turnInFlight(sessions)) return false                  // a structured turn is live
-    if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
   }
+  const idleNow = () => betweenTurns() && (Date.now() - lastActivity >= IDLE_MS)
   // The supervisor owns updates (children never self-update). It IPCs us when a newer
-  // version is out → surface the chip; we report idle + whether a web peer is present
-  // so it restarts only between turns and only when nobody is mid-click (Slice 3).
+  // version is out → surface the chip; we report `between` (safe to restart now, per
+  // Contract #1) + `idle` (the quiet window, for the unattended fallback) + whether a
+  // web peer is present, so the supervisor restarts on an explicit click between turns
+  // and otherwise waits for true idle with nobody watching (Slice 3).
   process.on('message', (m) => { if (m && m.t === 'update-available') surfaceUpdate(m.version) })
-  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
+  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but
   // nudge once if a newer version is out so a relaunch with @latest picks it up.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.32",
+  "version": "0.7.33",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/update-gate.mjs

@@ -11,10 +11,18 @@
 // child is idle (a child reports idle=false while a turn is in flight — that's what
 // keeps Contract #1), AND either a user requested apply (clicked the chip) OR — the
 // unattended fallback — no child has a web peer present (nobody is there to click).
-export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, childPeer, requested = false }) {
+export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, childBetween, childPeer, requested = false }) {
   if (!pendingUpdate || stopping) return false
-  for (const idle of childIdle.values()) if (!idle) return false      // any busy child → wait (between-turns)
-  if (requested) return true                                          // user clicked apply + all idle → go
+  if (requested) {
+    // Explicit "apply" → restart at the next BETWEEN-TURNS gap (no turn in flight),
+    // NOT the full quiet window — in an active room that 90s of silence never comes,
+    // so the click would otherwise do nothing. Fall back to childIdle when a child
+    // doesn't report `between` (older child during the mixed-version update itself).
+    const gate = childBetween instanceof Map ? childBetween : childIdle
+    for (const ready of gate.values()) if (!ready) return false       // any busy child → wait (Contract #1)
+    return true
+  }
+  for (const idle of childIdle.values()) if (!idle) return false      // unattended: full idle window
   for (const present of childPeer.values()) if (present) return false // someone's watching, no click → wait
   return true                                                         // unattended: idle + nobody watching → auto-apply
 }