thinkpool-pair 0.7.341 → 0.7.343

package/account.mjs

@@ -21,6 +21,7 @@ import { supervisorServes, supervisorRoomsToStop } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 import { installedAgentCommands } from './agent-detect.mjs'
+import { agentVisibilityStates, setAgentPickerVisibility } from './agent-visibility.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
 import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
 import { clearSupervisorReady, supervisorPresenceEchoed, writeSupervisorReady } from './supervisor-ready.mjs'
@@ -639,7 +640,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // to spawn against — re-read each announce so an add/remove reflects immediately.
   // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
   const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), accountAuthState, ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: agentVisibilityStates(installedAgentCommands()), accountAuthState, ts: Date.now() })
 
   // Persist account-auth truth separately from process presence. Presence will vanish
   // when the old JWT expires; the claim row keeps the reconnect instruction visible on
@@ -688,6 +689,21 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     const nonce = payload?.nonce
     provReply('providers-list-res', { nonce, ok: true, providers: listProviders() })
   })
+  // agent-visibility-set {cmd, enabled, nonce} changes only the web picker.
+  // The runtime stays installed and explicit runtime requests keep working.
+  acctControl.on('broadcast', { event: 'agent-visibility-set' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const installed = installedAgentCommands()
+    const r = setAgentPickerVisibility(payload?.cmd, payload?.enabled === true, { installed })
+    if (r.ok) {
+      pushPresence()
+      for (const child of children.values()) {
+        try { child.send({ t: 'agent-visibility-changed' }) } catch { /* child may be exiting */ }
+      }
+      process.stderr.write(`\n  ◆ terminal picker agents updated — ${r.agents.filter((agent) => agent.enabled).map((agent) => agent.cmd).join(', ')} visible.\n`)
+    }
+    provReply('agent-visibility-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, agents: r.ok ? r.agents : undefined })
+  })
 
   // ENABLE presence delivery + the self-echo's ground truth. supabase-js only asks
   // the server for presence state when a presence callback is bound at join time —

package/agent-visibility.mjs

@@ -0,0 +1,67 @@
+// Host-local picker visibility for installed coding agents.
+//
+// Installation remains detection truth: hiding a runtime does not uninstall it
+// or prevent an explicit bridge command from opening it. This preference only
+// controls which installed runtimes the web offers in human-facing terminal
+// pickers. The file is shared by the account supervisor and its room children,
+// so one dashboard toggle applies to every room served by this bridge.
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+export const PICKER_AGENT_COMMANDS = ['claude', 'codex', 'thinkpool']
+
+const root = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
+const defaultFile = () => path.join(root(), 'agent-visibility.json')
+const normalize = (command) => String(command || '').toLowerCase() === 'hermes'
+  ? 'thinkpool'
+  : String(command || '').toLowerCase()
+
+export function loadHiddenAgentCommands({ file = defaultFile(), fsImpl = fs } = {}) {
+  try {
+    const saved = JSON.parse(fsImpl.readFileSync(file, 'utf8'))
+    return new Set((Array.isArray(saved?.hidden) ? saved.hidden : [])
+      .map(normalize)
+      .filter((command) => PICKER_AGENT_COMMANDS.includes(command)))
+  } catch {
+    return new Set()
+  }
+}
+
+export function agentVisibilityStates(commands, { hidden = loadHiddenAgentCommands() } = {}) {
+  const found = new Set((Array.isArray(commands) ? commands : []).map(normalize))
+  const states = PICKER_AGENT_COMMANDS
+    .filter((command) => found.has(command))
+    .map((cmd) => ({ cmd, enabled: !hidden.has(cmd) }))
+  // A corrupt or hand-edited preference must not leave the "+" action with no
+  // valid runtime. The first installed product runtime is the safe recovery.
+  if (states.length > 0 && !states.some((agent) => agent.enabled)) states[0].enabled = true
+  return states
+}
+
+export function setAgentPickerVisibility(command, enabled, {
+  installed = [],
+  file = defaultFile(),
+  fsImpl = fs,
+} = {}) {
+  const cmd = normalize(command)
+  if (!PICKER_AGENT_COMMANDS.includes(cmd)) return { ok: false, error: 'unknown agent runtime' }
+  const states = agentVisibilityStates(installed, { hidden: loadHiddenAgentCommands({ file, fsImpl }) })
+  if (!states.some((agent) => agent.cmd === cmd)) return { ok: false, error: 'agent runtime is not installed' }
+  if (!enabled && states.filter((agent) => agent.enabled).length <= 1) {
+    return { ok: false, error: 'keep at least one agent in the terminal picker' }
+  }
+
+  const hidden = new Set(states.filter((agent) => !agent.enabled).map((agent) => agent.cmd))
+  if (enabled) hidden.delete(cmd)
+  else hidden.add(cmd)
+
+  try {
+    fsImpl.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 })
+    fsImpl.writeFileSync(file, JSON.stringify({ hidden: [...hidden] }, null, 2), { mode: 0o600 })
+    try { fsImpl.chmodSync(file, 0o600) } catch { /* best-effort hardening */ }
+  } catch {
+    return { ok: false, error: 'could not save agent visibility' }
+  }
+  return { ok: true, agents: agentVisibilityStates(installed, { hidden }) }
+}

package/bridge.mjs

@@ -64,6 +64,7 @@ import { hermesRequiredMcpTools, hermesRoleFor } from './hermes-policy.mjs'
 import { canonicalRoomFilePath, waitForNativeImages } from './codex-images.mjs'
 import { createManagedLaneWorktree, removeManagedLaneWorktree } from './lane-worktree.mjs'
 import { commandOnPath } from './agent-detect.mjs'
+import { agentVisibilityStates } from './agent-visibility.mjs'
 import { requiresSdkAdmission, sdkSmokePassed } from './sdk-admission.mjs'
 import { hermesUserInputResponse } from './question-response.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
@@ -1282,6 +1283,15 @@ const replayPump = createLatestReplayPump({
 // every announce carries them so a late-joining or second device sees them too.
 const termNames = loadNames(room)
 const manualNameTouched = new Set()
+const acknowledgeTermOpen = (id, kind, entry = null) => {
+  bcast('term-opened', {
+    id,
+    kind,
+    sideParent: entry?.sideParent || undefined,
+    sideTask: entry?.sideTask || undefined,
+    name: termNames[id] || undefined,
+  })
+}
 const autoNameAttempts = new Set()
 const autoNames = new Map()
 // The SDK's supported-model LIST (value/displayName/description), captured from
@@ -1295,6 +1305,7 @@ const announce = () => {
   // (name-only, NEVER key/baseUrl) so a cross-device viewer can badge a lane opened
   // on a custom provider without the owner's account-channel registry.
   const provNames = providerNameMap()
+  const pickerState = new Map(agentVisibilityStates(installedAgents.map((agent) => agent.cmd)).map((agent) => [agent.cmd, agent.enabled]))
   const rev = ++announceRev
   return bcastAwait('bridge', {
     v: 2, name, bridge_id: BRIDGE_ID, started_at: BRIDGE_STARTED_AT, rev, repo: repoLabel, branch: readBranch(),
@@ -1353,7 +1364,7 @@ const announce = () => {
     agents: installedAgents.map(a => {
       let canResume = false
       if (a.resume) { try { canResume = a.resume.probe() } catch { /* stays false */ } }
-      return { label: a.label, cmd: a.cmd, canResume }
+      return { label: a.label, cmd: a.cmd, canResume, enabled: pickerState.get(a.cmd) !== false }
     }),
     // cols/rows: the PTY's one true size — web viewers render this grid and
     // scale it to their own page instead of voting to reflow it.
@@ -1724,7 +1735,6 @@ function pumpDesign(term) {
   }
   const active = { ...next, resultOk: false, proof: null, timer: null }
   designActive.set(term, active)
-  designStatus({ previewId: next.record.previewId, requestId: next.request.cid, state: 'applying' })
   // Complete room-visible instructions, without host paths or locator packets.
   const visible = {
     kind: 'you',
@@ -1745,6 +1755,10 @@ function pumpDesign(term) {
   } catch { accepted = false }
   if (accepted) beginStructuredTurn(lane)
   stampEvent(visible); pushLog(lane, visible); bcast('code-event', { term, evt: visible })
+  // Browser clients use this as the positive dispatch acknowledgment. Keep it
+  // after the accepted turn and its visible prompt so "applying" never navigates
+  // a submitter away from an actionable Design failure.
+  if (accepted) designStatus({ previewId: next.record.previewId, requestId: next.request.cid, state: 'applying' })
   if (!accepted) {
     syncStructuredTurn(lane)
     const failed = { kind: 'error', message: 'The producing lane could not start the edit.', recoverable: true }
@@ -4109,6 +4123,13 @@ channel
     // Multi-bridge rooms: a targeted open is for ONE machine. Untargeted
     // opens (older web) are taken by whoever hears them — the solo case.
     if (payload.host && payload.host !== name) return
+    // A client retries an open when the first broadcast or this acknowledgement is
+    // lost. PTY creation was already idempotent, but acknowledge the existing lane
+    // explicitly so the watchdog can settle without waiting for a full roster.
+    if (terms.has(payload.id)) {
+      acknowledgeTermOpen(payload.id, 'pty', terms.get(payload.id))
+      return
+    }
     // resume is a FLAG, never argv: the channel must not pass arbitrary
     // args even though the room is shell-trust by design. The args come
     // from our own KNOWN_AGENTS table, probe-gated so `--continue` with
@@ -4119,6 +4140,15 @@ channel
       if (agent?.resume) { try { if (agent.resume.probe()) args = [...agent.resume.args] } catch { /* fresh */ } }
     }
     if (wantStructured(payload.cmd)) {
+      // The open id is the idempotency key for the ENTIRE operation, including a
+      // side lane's initial task. openStructured() already no-ops for an existing
+      // runtime, but the old handler continued below and published side-started +
+      // dispatched the task again. A retry must only replay the acceptance ack.
+      const existing = sessions.get(payload.id)
+      if (existing) {
+        acknowledgeTermOpen(payload.id, 'structured', existing)
+        return
+      }
       // model: the web passes the model to open on — a NEW terminal inherits the
       // previous terminal's model (and the first uses the provider default). Falls
       // through to the SDK default when absent. Stamped on the entry so the announce
@@ -4177,13 +4207,17 @@ channel
           return
         }
         child.flush?.(); parent.flush?.(); announce()
+        acknowledgeTermOpen(payload.id, 'structured', child)
         process.stderr.write(`\n  ◆ ${by} opened side lane ${String(payload.id).slice(0, 8)} under ${String(sideParent).slice(0, 8)}.\n`)
         return
       }
+      const opened = sessions.get(payload.id)
+      if (opened) acknowledgeTermOpen(payload.id, 'structured', opened)
       process.stderr.write(`\n  ◆ web opened a structured "${payload.cmd}" session (${payload.mode || 'default'}${payload.model ? `, model ${payload.model}` : ''}).\n`)
       return
     }
     openTerm({ id: payload.id, cmd: payload.cmd, args })
+    if (terms.has(payload.id)) acknowledgeTermOpen(payload.id, 'pty', terms.get(payload.id))
     process.stderr.write(`\n  ◆ web opened a "${payload.cmd}"${args.length ? ' (continue)' : ''} terminal (headless).\n`)
   })
   .on('broadcast', { event: 'term-close' }, ({ payload }) => {
@@ -5376,6 +5410,7 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   process.on('message', (m) => {
     if (!m) return
     if (m.t === 'update-available') surfaceUpdate(m.version)
+    else if (m.t === 'agent-visibility-changed') void announce()
     // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
     // it so our authed writes (code-mockup) never go stale on a long session (L16).
     else if (m.t === 'token') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.341",
+  "version": "0.7.343",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "sdk-admission.mjs",
     "launcher.mjs",
     "privacy-report.mjs",
+    "agent-visibility.mjs",
     "byok-detect.mjs",
     "context-windows.mjs",
     "claude-session.mjs",

package/privacy-report.mjs

@@ -42,6 +42,7 @@ export function buildPrivacyReport({
     ['Saved login', 'auth.json', exists(path.join(configDir, 'auth.json')), 'refresh token and account identity'],
     ['Provider registry', 'providers.json', exists(path.join(configDir, 'providers.json')), 'provider endpoint, model, and API key'],
     ['Bridge keypair', 'bridge-key.json', exists(path.join(configDir, 'bridge-key.json')), 'private key used to open browser-sealed provider keys'],
+    ['Agent picker visibility', 'agent-visibility.json', exists(path.join(configDir, 'agent-visibility.json')), 'which installed runtimes are hidden from terminal pickers'],
     ['Room directories', 'dirs.json / served.json', exists(path.join(configDir, 'dirs.json')) || exists(path.join(configDir, 'served.json')), 'room-to-project directory mappings'],
     ['Bridge logs', 'update.log and service logs', exists(path.join(configDir, 'update.log')), 'update and background-service diagnostics'],
   ]
@@ -105,4 +106,3 @@ export function runPrivacyReport(options) {
   process.stdout.write(formatPrivacyReport(report))
   return report
 }
-