thinkpool-pair 0.7.34 → 0.7.36

package/account.mjs

@@ -208,7 +208,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    Auto-serving your sessions from ${DEFAULT_DIR}\n    (point one at another repo: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
-  const childIdle = new Map()  // room -> bool (last idle report; unknown = not idle)
+  const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
+  const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
   const childPeer = new Map()  // room -> bool (a web client is watching this room)
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
@@ -282,13 +283,14 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child
+      childBetween.set(room, false)
       childPeer.set(room, false)
       child.on('message', (m) => {
         if (!m) return
-        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childPeer.set(room, !!m.webPeer) }
+        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childBetween.set(room, m.between != null ? !!m.between : !!m.idle); childPeer.set(room, !!m.webPeer) }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
       })
-      child.on('exit', () => { children.delete(room); childIdle.delete(room); childPeer.delete(room) })   // re-served on the next tick
+      child.on('exit', () => { children.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room) })   // re-served on the next tick
       // If an update is already pending, tell the freshly-served child immediately so
       // its room shows the "update ready" chip without waiting for the next poll.
       if (pendingUpdate) { try { child.send({ t: 'update-available', version: pendingUpdate }) } catch { /* child not ready */ } }
@@ -317,7 +319,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
   const applyIfIdle = () => {
-    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childPeer, requested: applyRequested })) return
+    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
     stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
   }

package/bridge.mjs

@@ -164,7 +164,7 @@ if (argv[0] === 'provider') { const { runProvider } = await import('./provider.m
 // so launchd / systemd / CI / pipes are byte-for-byte unchanged.
 // Spec: docs/specs/2026-06-19-bridge-unified-launcher.md (Part 1).
 if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
-  const { runLauncher } = await import('./launcher.mjs')
+  const { runLauncher, detectState } = await import('./launcher.mjs')
   const svc = await import('./service.mjs')
   const BRIDGE = fileURLToPath(import.meta.url)
   const io = {
@@ -186,9 +186,18 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []); process.exit(0) },
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room); process.exit(0) },
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
-    setProvider: async ({ kind, base, token }) => { const { runProvider } = await import('./provider.mjs'); await runProvider(kind === 'custom' ? ['custom', '--base', base, '--token', token] : ['anthropic']); process.exit(0) },
+    // Provider config is NOT terminal — it writes provider.json and returns to the
+    // menu so you can pick a model, switch back, or do something else. (It used to
+    // process.exit(0), which dumped you to the shell mid-setup.)
+    setProvider: async ({ kind, base, token, model }) => {
+      const { runProvider } = await import('./provider.mjs')
+      const args = kind === 'custom'
+        ? ['custom', '--base', base, '--token', token, ...(model ? ['--model', model] : [])]
+        : ['anthropic']
+      await runProvider(args)
+    },
   }
-  await runLauncher({ actions, io })
+  await runLauncher({ actions, io, refresh: detectState })
   process.exit(0)
 }
 
@@ -650,7 +659,13 @@ function openStructured({ id, model, resume, log, commands, mode }) {
   if (entry.log.length) process.stderr.write(`\n  ◆ restored ${entry.log.length} prior events (${id.slice(0, 8)})${resume ? ' + resuming live context' : ''}.\n`)
   // Persist the permission mode alongside the transcript so a bridge restart
   // restores the session in the SAME mode (a bypass room stays bypass on resume).
-  const persist = () => saveSession(room, id, { sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode })
+  const persist = () => saveSession(room, id, sessionData())
+  // Synchronous flush of this session's record. Used on open (so a brand-new session
+  // has a file under its id BEFORE its first event — surviving a restart inside the
+  // 1.5s saveSession debounce window) and on shutdown (so events since the last
+  // debounced write aren't lost). Contract #2: restart resumes, no lost messages.
+  entry.flush = () => flushSession(room, id, sessionData())
   entry.session = startClaudeSession({
     cwd: process.cwd(), model, resume, mode,
     env: { ...process.env, TP_MOCKUP_OUTBOX: mockupOutbox },
@@ -708,6 +723,10 @@ function openStructured({ id, model, resume, log, commands, mode }) {
           : `\n  ${A.yel}● permission: ${req.toolName}${argStr(req.input)} — approve in the room.${A.rst}\n`)
     }),
   })
+  // Brand-new session (no restored log): write its record now so a restart that lands
+  // before the first debounced save still restores this id instead of dropping it (the
+  // room would otherwise show a fresh empty terminal + strand the transcript).
+  if (!entry.log.length) entry.flush()
   announce()
   if (!entry.log.length) process.stderr.write(`\n  ◆ structured Claude session (${id.slice(0, 8)}) — driven from the room.\n`)
   return entry
@@ -1002,7 +1021,11 @@ channel
         // only runs on a fresh start (guard above), so a network re-subscribe
         // with live sessions won't re-spawn them.
         if (wantStructured(startCmd)) {
-          const all = loadAll(room).filter((r) => r.log?.length || r.sessionId)
+          // Restore EVERY saved rec — a freshly opened session (persisted on open) may
+          // have an empty log + no sessionId yet and must still come back under its id.
+          // Closed sessions are unlinked by deleteSession, so a file existing on disk ==
+          // a session that was live at shutdown (never an explicitly closed one).
+          const all = loadAll(room)
           if (all.length) for (const rec of all) openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode })
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
           // (autoAgent set, no attachedCmd) the web's `?new=1` flow opens the first
@@ -1059,12 +1082,15 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   const POLL_MS = Math.max(60, parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL, 10) || 1800) * 1000
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
   // pendingUpdate is module-level now (shared with surfaceUpdate + the room chip).
-  const isIdle = () => {
+  // Between turns = safe to restart per Contract #1 (no turn in flight, no bytes
+  // mid-flush). Idle = that PLUS the quiet window — the extra conservatism only the
+  // unattended auto-apply needs; an explicit click restarts on between-turns alone.
+  const betweenTurns = () => {
     if (turnInFlight(sessions)) return false                  // a structured turn is live
-    if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
   }
+  const isIdle = () => betweenTurns() && (Date.now() - lastActivity >= IDLE_MS)
   // Newer? Compare the numeric x.y.z core; ignore prerelease tails to stay safe.
   const isNewer = (latest, cur) => {
     const core = (v) => String(v).split('-')[0].split('.').map((n) => parseInt(n, 10) || 0)
@@ -1083,11 +1109,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     } catch { return null } finally { clearTimeout(to) }
   }
   const applyIfIdle = () => {
-    if (!pendingUpdate || !isIdle()) return
-    // Slice 3: when a web client is watching, wait for their "apply" click instead
-    // of restarting under them. With nobody present (cloud VM / closed tab) the
-    // unattended fallback still auto-applies at idle so headless boxes self-heal.
-    if (!applyRequested && webPeerPresent()) return
+    if (!pendingUpdate) return
+    // Explicit "apply" → go at the next between-turns gap (the click means the user
+    // opted in; don't make them wait out the quiet window). Unattended (no click) →
+    // require the full idle window AND nobody watching, so a headless box self-heals
+    // without ever restarting under someone who's mid-session.
+    if (applyRequested) { if (!betweenTurns()) return }
+    else if (!isIdle() || webPeerPresent()) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting to update; the session resumes.\n`)
     shutdown(0, false)   // clean teardown (no farewell banner); service reruns @latest, session-store resumes
   }
@@ -1108,17 +1136,19 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   // supervisor restart re-resolves @latest. Instead we report our idle state so
   // the supervisor can pick a moment when EVERY child is idle to restart-update.
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
-  const idleNow = () => {
+  const betweenTurns = () => {
     if (turnInFlight(sessions)) return false                  // a structured turn is live
-    if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
   }
+  const idleNow = () => betweenTurns() && (Date.now() - lastActivity >= IDLE_MS)
   // The supervisor owns updates (children never self-update). It IPCs us when a newer
-  // version is out → surface the chip; we report idle + whether a web peer is present
-  // so it restarts only between turns and only when nobody is mid-click (Slice 3).
+  // version is out → surface the chip; we report `between` (safe to restart now, per
+  // Contract #1) + `idle` (the quiet window, for the unattended fallback) + whether a
+  // web peer is present, so the supervisor restarts on an explicit click between turns
+  // and otherwise waits for true idle with nobody watching (Slice 3).
   process.on('message', (m) => { if (m && m.t === 'update-available') surfaceUpdate(m.version) })
-  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
+  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but
   // nudge once if a newer version is out so a relaunch with @latest picks it up.
@@ -1164,6 +1194,10 @@ async function shutdown(code = 0, farewell = true) {
   // correct and must not hang on the (possibly dead) realtime socket. This is the
   // bug behind the watchdog/auto-update raw process.exit() paths, which skipped
   // teardown entirely and orphaned agent processes + left stale presence.
+  // Flush structured session state synchronously BEFORE ending sessions. saveSession
+  // debounces ~1.5s, so without this any events since the last write are lost on exit
+  // (Contract #2). writeFileSync, well inside the 1500ms hard-exit backstop above.
+  for (const s of sessions.values()) { try { s.flush?.() } catch { /* noop */ } }
   for (const t of terms.values()) { try { t.term.kill() } catch { /* noop */ } }
   for (const s of sessions.values()) { try { s.session.end() } catch { /* noop */ } }
   detachLocal()

package/launcher.mjs

@@ -51,10 +51,14 @@ function serviceFile(room) {
 export function detectState() {
   const auth = readJson(path.join(CFG_DIR, 'auth.json'))
   const provider = readJson(path.join(CFG_DIR, 'provider.json'))
+  // provider.json is written with { provider, baseUrl, model } (see provider.mjs).
+  // Anything whose `provider` field is set and not "anthropic" is a custom endpoint.
+  const isCustom = !!provider?.provider && provider.provider !== 'anthropic'
   return {
     loggedIn: !!auth?.refresh_token,
     email: auth?.email || auth?.user?.email || null,
-    provider: provider?.kind === 'custom' ? `Custom (${provider.base || 'endpoint'})` : 'Anthropic (default)',
+    provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
+    providerModel: isCustom ? (provider.model || null) : null,
     agents: KNOWN_AGENTS.filter(a => onPath(a.cmd)),
     accountSvc: fs.existsSync(serviceFile(null)),
     cwd: process.cwd(),
@@ -68,7 +72,11 @@ const C = {
 }
 
 // io: { ask(prompt)->Promise<string>, print(s) }. actions: real | dry-run | mock.
-export async function runLauncher({ actions, io, state = detectState() }) {
+// refresh: optional () => state — re-read disk after a mutating action so the header
+// reflects the change (real bridge passes detectState; tests omit it to keep the
+// injected state stable).
+export async function runLauncher({ actions, io, state = detectState(), refresh = null }) {
+  const resync = () => { if (refresh) state = refresh() }
   const askChoice = async (prompt, options, def = 1) => {
     options.forEach((o, i) => io.print(`    ${C.cyan(String(i + 1))})  ${o.label}${o.hint ? '  ' + C.dim(o.hint) : ''}`))
     const a = await io.ask(`\n  ${prompt} ${C.dim(`[${def}]`)} ${C.cyan('▸')} `)
@@ -137,25 +145,41 @@ export async function runLauncher({ actions, io, state = detectState() }) {
     await actions.installService({ room, agentCmd: agent.cmd })
   }
 
+  const providerMenu = async () => {
+    const cur = state.provider + (state.providerModel ? `, model ${state.providerModel}` : '')
+    const p = await askChoice('\n  provider', [
+      { label: 'Anthropic (default)', hint: 'regular Claude login' },
+      { label: 'Custom endpoint', hint: 'Z.ai GLM, OpenRouter, your own proxy' },
+      { label: '← Back', hint: `current: ${cur}` },
+    ], 3)  // Enter = Back
+    if (p === 2) return
+    if (p === 0) { await actions.setProvider({ kind: 'anthropic' }); resync(); io.print('\n  ' + C.green('✓ back on regular Claude.')); return }
+    // custom — every step can be aborted with a blank line, which backs out cleanly.
+    const base = (await io.ask(`\n  Base url ${C.dim('(blank to cancel · SDK appends /v1/messages)')} ${C.cyan('▸')} `)).trim()
+    if (!base) { io.print('  ' + C.yellow('cancelled — provider unchanged')); return }
+    const token = (await io.ask(`  API token ${C.dim('(blank to cancel)')} ${C.cyan('▸')} `)).trim()
+    if (!token) { io.print('  ' + C.yellow('cancelled — provider unchanged')); return }
+    const model = (await io.ask(`  Model ${C.dim('(blank = endpoint default · e.g. glm-4.6)')} ${C.cyan('▸')} `)).trim()
+    await actions.setProvider({ kind: 'custom', base, token, model: model || undefined })
+    resync()
+    io.print(`\n  ${C.green('✓ provider set to custom.')}\n    base url: ${state.provider}\n    model:    ${state.providerModel || '(endpoint default)'}`)
+  }
+
   const settingsMenu = async () => {
-    const pick = await askChoice('\n  change', [
-      { label: 'LLM provider', hint: `current: ${state.provider}` },
-      { label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
-      { label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
-    ])
-    if (pick === 0) {
-      const p = await askChoice('\n  provider', [{ label: 'Anthropic (default)' }, { label: 'Custom endpoint', hint: 'Z.ai GLM, OpenRouter, your own proxy' }])
-      if (p === 0) await actions.setProvider({ kind: 'anthropic' })
+    for (;;) {
+      const pick = await askChoice('\n  change', [
+        { label: 'LLM provider', hint: `current: ${state.provider}` },
+        { label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
+        { label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
+        { label: '← Back to main menu', hint: '' },
+      ], 4)  // Enter = Back
+      if (pick === 3) return
+      if (pick === 0) await providerMenu()
+      else if (pick === 1) { await actions.login(); resync(); return }
       else {
-        const base = (await io.ask(`\n  Base url ${C.dim('(SDK appends /v1/messages)')} ${C.cyan('▸')} `)).trim()
-        const token = (await io.ask(`  API token ${C.cyan('▸')} `)).trim()
-        await actions.setProvider({ kind: 'custom', base, token })
+        if (state.accountSvc) await actions.uninstallService({ room: null })
+        else io.print('  ' + C.yellow('no background service installed'))
       }
-    } else if (pick === 1) {
-      await actions.login()
-    } else {
-      if (state.accountSvc) await actions.uninstallService({ room: null })
-      else io.print('  ' + C.yellow('no background service installed'))
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.34",
+  "version": "0.7.36",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/update-gate.mjs

@@ -11,10 +11,18 @@
 // child is idle (a child reports idle=false while a turn is in flight — that's what
 // keeps Contract #1), AND either a user requested apply (clicked the chip) OR — the
 // unattended fallback — no child has a web peer present (nobody is there to click).
-export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, childPeer, requested = false }) {
+export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, childBetween, childPeer, requested = false }) {
   if (!pendingUpdate || stopping) return false
-  for (const idle of childIdle.values()) if (!idle) return false      // any busy child → wait (between-turns)
-  if (requested) return true                                          // user clicked apply + all idle → go
+  if (requested) {
+    // Explicit "apply" → restart at the next BETWEEN-TURNS gap (no turn in flight),
+    // NOT the full quiet window — in an active room that 90s of silence never comes,
+    // so the click would otherwise do nothing. Fall back to childIdle when a child
+    // doesn't report `between` (older child during the mixed-version update itself).
+    const gate = childBetween instanceof Map ? childBetween : childIdle
+    for (const ready of gate.values()) if (!ready) return false       // any busy child → wait (Contract #1)
+    return true
+  }
+  for (const idle of childIdle.values()) if (!idle) return false      // unattended: full idle window
   for (const present of childPeer.values()) if (present) return false // someone's watching, no click → wait
   return true                                                         // unattended: idle + nobody watching → auto-apply
 }