thinkpool-pair 0.7.34 → 0.7.35

package/account.mjs

@@ -208,7 +208,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    Auto-serving your sessions from ${DEFAULT_DIR}\n    (point one at another repo: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
-  const childIdle = new Map()  // room -> bool (last idle report; unknown = not idle)
+  const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
+  const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
   const childPeer = new Map()  // room -> bool (a web client is watching this room)
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
@@ -282,13 +283,14 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child
+      childBetween.set(room, false)
       childPeer.set(room, false)
       child.on('message', (m) => {
         if (!m) return
-        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childPeer.set(room, !!m.webPeer) }
+        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childBetween.set(room, m.between != null ? !!m.between : !!m.idle); childPeer.set(room, !!m.webPeer) }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
       })
-      child.on('exit', () => { children.delete(room); childIdle.delete(room); childPeer.delete(room) })   // re-served on the next tick
+      child.on('exit', () => { children.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room) })   // re-served on the next tick
       // If an update is already pending, tell the freshly-served child immediately so
       // its room shows the "update ready" chip without waiting for the next poll.
       if (pendingUpdate) { try { child.send({ t: 'update-available', version: pendingUpdate }) } catch { /* child not ready */ } }
@@ -317,7 +319,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
   const applyIfIdle = () => {
-    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childPeer, requested: applyRequested })) return
+    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
     stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
   }

package/bridge.mjs

@@ -650,7 +650,13 @@ function openStructured({ id, model, resume, log, commands, mode }) {
   if (entry.log.length) process.stderr.write(`\n  ◆ restored ${entry.log.length} prior events (${id.slice(0, 8)})${resume ? ' + resuming live context' : ''}.\n`)
   // Persist the permission mode alongside the transcript so a bridge restart
   // restores the session in the SAME mode (a bypass room stays bypass on resume).
-  const persist = () => saveSession(room, id, { sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode })
+  const persist = () => saveSession(room, id, sessionData())
+  // Synchronous flush of this session's record. Used on open (so a brand-new session
+  // has a file under its id BEFORE its first event — surviving a restart inside the
+  // 1.5s saveSession debounce window) and on shutdown (so events since the last
+  // debounced write aren't lost). Contract #2: restart resumes, no lost messages.
+  entry.flush = () => flushSession(room, id, sessionData())
   entry.session = startClaudeSession({
     cwd: process.cwd(), model, resume, mode,
     env: { ...process.env, TP_MOCKUP_OUTBOX: mockupOutbox },
@@ -708,6 +714,10 @@ function openStructured({ id, model, resume, log, commands, mode }) {
           : `\n  ${A.yel}● permission: ${req.toolName}${argStr(req.input)} — approve in the room.${A.rst}\n`)
     }),
   })
+  // Brand-new session (no restored log): write its record now so a restart that lands
+  // before the first debounced save still restores this id instead of dropping it (the
+  // room would otherwise show a fresh empty terminal + strand the transcript).
+  if (!entry.log.length) entry.flush()
   announce()
   if (!entry.log.length) process.stderr.write(`\n  ◆ structured Claude session (${id.slice(0, 8)}) — driven from the room.\n`)
   return entry
@@ -1002,7 +1012,11 @@ channel
         // only runs on a fresh start (guard above), so a network re-subscribe
         // with live sessions won't re-spawn them.
         if (wantStructured(startCmd)) {
-          const all = loadAll(room).filter((r) => r.log?.length || r.sessionId)
+          // Restore EVERY saved rec — a freshly opened session (persisted on open) may
+          // have an empty log + no sessionId yet and must still come back under its id.
+          // Closed sessions are unlinked by deleteSession, so a file existing on disk ==
+          // a session that was live at shutdown (never an explicitly closed one).
+          const all = loadAll(room)
           if (all.length) for (const rec of all) openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode })
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
           // (autoAgent set, no attachedCmd) the web's `?new=1` flow opens the first
@@ -1059,12 +1073,15 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   const POLL_MS = Math.max(60, parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL, 10) || 1800) * 1000
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
   // pendingUpdate is module-level now (shared with surfaceUpdate + the room chip).
-  const isIdle = () => {
+  // Between turns = safe to restart per Contract #1 (no turn in flight, no bytes
+  // mid-flush). Idle = that PLUS the quiet window — the extra conservatism only the
+  // unattended auto-apply needs; an explicit click restarts on between-turns alone.
+  const betweenTurns = () => {
     if (turnInFlight(sessions)) return false                  // a structured turn is live
-    if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
   }
+  const isIdle = () => betweenTurns() && (Date.now() - lastActivity >= IDLE_MS)
   // Newer? Compare the numeric x.y.z core; ignore prerelease tails to stay safe.
   const isNewer = (latest, cur) => {
     const core = (v) => String(v).split('-')[0].split('.').map((n) => parseInt(n, 10) || 0)
@@ -1083,11 +1100,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     } catch { return null } finally { clearTimeout(to) }
   }
   const applyIfIdle = () => {
-    if (!pendingUpdate || !isIdle()) return
-    // Slice 3: when a web client is watching, wait for their "apply" click instead
-    // of restarting under them. With nobody present (cloud VM / closed tab) the
-    // unattended fallback still auto-applies at idle so headless boxes self-heal.
-    if (!applyRequested && webPeerPresent()) return
+    if (!pendingUpdate) return
+    // Explicit "apply" → go at the next between-turns gap (the click means the user
+    // opted in; don't make them wait out the quiet window). Unattended (no click) →
+    // require the full idle window AND nobody watching, so a headless box self-heals
+    // without ever restarting under someone who's mid-session.
+    if (applyRequested) { if (!betweenTurns()) return }
+    else if (!isIdle() || webPeerPresent()) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting to update; the session resumes.\n`)
     shutdown(0, false)   // clean teardown (no farewell banner); service reruns @latest, session-store resumes
   }
@@ -1108,17 +1127,19 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   // supervisor restart re-resolves @latest. Instead we report our idle state so
   // the supervisor can pick a moment when EVERY child is idle to restart-update.
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
-  const idleNow = () => {
+  const betweenTurns = () => {
     if (turnInFlight(sessions)) return false                  // a structured turn is live
-    if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
   }
+  const idleNow = () => betweenTurns() && (Date.now() - lastActivity >= IDLE_MS)
   // The supervisor owns updates (children never self-update). It IPCs us when a newer
-  // version is out → surface the chip; we report idle + whether a web peer is present
-  // so it restarts only between turns and only when nobody is mid-click (Slice 3).
+  // version is out → surface the chip; we report `between` (safe to restart now, per
+  // Contract #1) + `idle` (the quiet window, for the unattended fallback) + whether a
+  // web peer is present, so the supervisor restarts on an explicit click between turns
+  // and otherwise waits for true idle with nobody watching (Slice 3).
   process.on('message', (m) => { if (m && m.t === 'update-available') surfaceUpdate(m.version) })
-  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
+  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but
   // nudge once if a newer version is out so a relaunch with @latest picks it up.
@@ -1164,6 +1185,10 @@ async function shutdown(code = 0, farewell = true) {
   // correct and must not hang on the (possibly dead) realtime socket. This is the
   // bug behind the watchdog/auto-update raw process.exit() paths, which skipped
   // teardown entirely and orphaned agent processes + left stale presence.
+  // Flush structured session state synchronously BEFORE ending sessions. saveSession
+  // debounces ~1.5s, so without this any events since the last write are lost on exit
+  // (Contract #2). writeFileSync, well inside the 1500ms hard-exit backstop above.
+  for (const s of sessions.values()) { try { s.flush?.() } catch { /* noop */ } }
   for (const t of terms.values()) { try { t.term.kill() } catch { /* noop */ } }
   for (const s of sessions.values()) { try { s.session.end() } catch { /* noop */ } }
   detachLocal()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.34",
+  "version": "0.7.35",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/update-gate.mjs

@@ -11,10 +11,18 @@
 // child is idle (a child reports idle=false while a turn is in flight — that's what
 // keeps Contract #1), AND either a user requested apply (clicked the chip) OR — the
 // unattended fallback — no child has a web peer present (nobody is there to click).
-export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, childPeer, requested = false }) {
+export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, childBetween, childPeer, requested = false }) {
   if (!pendingUpdate || stopping) return false
-  for (const idle of childIdle.values()) if (!idle) return false      // any busy child → wait (between-turns)
-  if (requested) return true                                          // user clicked apply + all idle → go
+  if (requested) {
+    // Explicit "apply" → restart at the next BETWEEN-TURNS gap (no turn in flight),
+    // NOT the full quiet window — in an active room that 90s of silence never comes,
+    // so the click would otherwise do nothing. Fall back to childIdle when a child
+    // doesn't report `between` (older child during the mixed-version update itself).
+    const gate = childBetween instanceof Map ? childBetween : childIdle
+    for (const ready of gate.values()) if (!ready) return false       // any busy child → wait (Contract #1)
+    return true
+  }
+  for (const idle of childIdle.values()) if (!idle) return false      // unattended: full idle window
   for (const present of childPeer.values()) if (present) return false // someone's watching, no click → wait
   return true                                                         // unattended: idle + nobody watching → auto-apply
 }