thinkpool-pair 0.7.343 → 0.7.344

package/account.mjs

@@ -504,6 +504,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
   let applyingUpdate = false
+  const restartProbes = new Map() // nonce -> { pending rooms, ok, timer, resolve }
   const warned = new Set()
   const refused = new Map()   // room -> reason ('home'|'none'|'dir-gone'): owned but NOT served, announced in presence so the web shows a precise "attach this session" card instead of spinning
 
@@ -1064,6 +1065,18 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           void applyIfIdle()
         }
         else if (m.t === 'busy') { childIdle.set(room, false); childBetween.set(room, false) }
+        else if (m.t === 'restart-probe-result') {
+          const probe = restartProbes.get(m.nonce)
+          if (!probe || !probe.pending.has(room) || children.get(room) !== child) return
+          probe.pending.delete(room)
+          probe.ok = probe.ok && m.between === true
+          childBetween.set(room, m.between === true)
+          if (!probe.pending.size) {
+            clearTimeout(probe.timer)
+            restartProbes.delete(m.nonce)
+            probe.resolve(probe.ok)
+          }
+        }
         else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
         // ── Thinkpool Ensemble cross-ROOM routing ──────────────────────────────
         // `room` here is the room that sent the message (this closure is per-child).
@@ -1312,9 +1325,44 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // Restart the account bridge to apply a pending update ONLY when it's safe: every
   // child idle (between turns) AND either a user clicked apply OR nobody's watching
   // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
+  function confirmChildrenBetweenTurns(timeoutMs = 2500) {
+    const targets = [...children.entries()]
+    if (!targets.length) return Promise.resolve(true)
+    const nonce = randomUUID()
+    return new Promise((resolve) => {
+      const probe = { pending: new Set(targets.map(([room]) => room)), ok: true, resolve, timer: null }
+      probe.timer = setTimeout(() => {
+        restartProbes.delete(nonce)
+        resolve(false)
+      }, timeoutMs)
+      probe.timer.unref?.()
+      restartProbes.set(nonce, probe)
+      for (const [room, child] of targets) {
+        try { child.send({ t: 'restart-probe', nonce }) }
+        catch {
+          probe.pending.delete(room)
+          probe.ok = false
+        }
+      }
+      if (!probe.pending.size) {
+        clearTimeout(probe.timer)
+        restartProbes.delete(nonce)
+        resolve(probe.ok)
+      }
+    })
+  }
+
   async function applyIfIdle() {
     if (applyingUpdate || !isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
     applyingUpdate = true
+    // The 5s heartbeat is a dashboard signal, not an atomic restart barrier. Re-read
+    // every child at the destructive edge so a turn that began after the last sample
+    // vetoes the update instead of becoming an interrupted recovery.
+    if (!await confirmChildrenBetweenTurns()) {
+      applyingUpdate = false
+      process.stderr.write('\n  ◆ bridge update still queued — an agent became active before the restart boundary.\n')
+      return
+    }
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
     try {
       const svc = await import('./service.mjs')

package/bridge.mjs

@@ -108,6 +108,7 @@ import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from
 // Spec: docs/specs/2026-06-30-flow-build-s4-clean-redispatch.md
 import { prepareRedispatch, redispatchKey } from './flow-redispatch.mjs'
 import { sanitizeSession } from './transcript-sanitize.mjs'
+import { boundStructuredLog, STRUCTURED_LOG_BYTE_CAP } from './event-bounds.mjs'
 import { executeFlowRevert } from './flow-host-revert.mjs'
 // ACCEPTED LIMITATION — this registry is in-memory only. A bridge restart in the window between
 // a flow-revert kill and the next dispatch wave loses the pending resume record, so the task
@@ -742,6 +743,33 @@ function readBranch() {
 const UPDIR = path.join(os.tmpdir(), 'thinkpool-pair', room)
 const FILE_MAX_BYTES = 25 * 1024 * 1024   // must match web FILE_MB + bucket file_size_limit (25 MB) — see src/pages/code/code-constants.js
 const safeName = (n) => String(n || 'file').replace(/[^a-zA-Z0-9._-]/g, '_').slice(-80)
+const roomAttachmentStorageUrl = (storagePath) => {
+  const value = String(storagePath || '')
+  const prefix = `code/${room}/`
+  if (!value.startsWith(prefix) || value.includes('..') || value.split('/').some((part) => !part)) return null
+  return `${SUPABASE_URL}/storage/v1/object/authenticated/session-attachments/${value.split('/').map(encodeURIComponent).join('/')}`
+}
+const fetchRoomAttachment = async (payload) => {
+  const authenticated = codeAuthToken && roomAttachmentStorageUrl(payload?.path)
+  const candidates = [
+    { url: payload?.url, headers: undefined },
+    ...(authenticated ? [{ url: authenticated, headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } }] : []),
+  ].filter((candidate) => candidate.url)
+  let lastError = new Error('no attachment source')
+  for (let attempt = 0; attempt < 3; attempt++) {
+    for (const candidate of candidates) {
+      try {
+        const response = await fetch(candidate.url, { headers: candidate.headers })
+        if (!response.ok) throw new Error(`HTTP ${response.status}`)
+        return Buffer.from(await response.arrayBuffer())
+      } catch (error) {
+        lastError = error
+      }
+    }
+    if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, 250 * (attempt + 1)))
+  }
+  throw lastError
+}
 
 const supabase = createClient(SUPABASE_URL, SUPABASE_ANON, {
   realtime: { params: { eventsPerSecond: 60 } },
@@ -2129,12 +2157,11 @@ function pushLog(entry, evt) {
   // filters out (system/thinking_tokens/effort) ride the log seq-less so they don't
   // hole the client's applied sequence. See event-id.mjs NO_SEQ_KINDS.
   if (entry.seq && seqable(evt)) evt.seq = entry.seq.next()
-  entry.log.push(evt)
   // Durable, UNBOUNDED archive (powers "load earlier history"): append the transcript
-  // event before the in-memory cap evicts it. Only seqable kinds — chrome/thinking noise
-  // is skipped. entry.id/entry.room are stamped in openStructured; a PTY entry (no id)
-  // is a no-op. This is the single place every new event passes through, so nothing is
-  // missed and reloaded events (which don't ride pushLog) never double-append.
+  // event in full before the bounded replay copy enters memory. Only seqable kinds —
+  // chrome/thinking noise is skipped. entry.id/entry.room are stamped in
+  // openStructured; a PTY entry (no id) is a no-op. This is the single place every new
+  // event passes through, so nothing is missed and reloaded events never double-append.
   if (entry.id && seqable(evt)) {
     appendDurableEvents(entry.room, entry.id, [evt])
     // First archived event sets the floor for a fresh lane (no seed ran). Lets the
@@ -2142,7 +2169,17 @@ function pushLog(entry, evt) {
     // above this floor — a new lane's first turn at seq>1 is NOT older-history.
     if (entry.archiveOldestSeq == null) entry.archiveOldestSeq = evt.seq
   }
-  if (entry.log.length > STRUCTURED_LOG_MAX) entry.log.shift()
+  // The rolling replay log is also the restart snapshot. Keep it browser-sized here,
+  // not only at broadcast time: otherwise one giant tool result is copied into every
+  // debounced snapshot and turns a bridge restart into tens of MB of synchronous JSON
+  // parsing/writing. The complete event remains in the append-only JSONL archive above.
+  const replayEvent = boundEventForBroadcast(evt)
+  entry.log.push(replayEvent)
+  entry.logBytes = (entry.logBytes || 0) + JSON.stringify(replayEvent).length + 1
+  while (entry.log.length > STRUCTURED_LOG_MAX || (entry.log.length > 1 && entry.logBytes > STRUCTURED_LOG_BYTE_CAP)) {
+    const removed = entry.log.shift()
+    entry.logBytes -= JSON.stringify(removed).length + 1
+  }
   return evt
 }
 
@@ -2230,7 +2267,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     ? spawnDepth
     : (sideParent || (spawnedBy && !String(spawnedBy).startsWith('flow:')) ? 1 : 0)
   const initialHop = Number.isInteger(hop) && hop >= 0 ? hop : structuralDepth
-  const entry = { cmd: runtime, runtime, kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: commandCatalogForRuntime(runtime, commands), mode, effort, models: runtime === 'codex' ? codexModels : runtime === 'hermes' ? (Array.isArray(models) && models.length ? models : hostHermesModels) : undefined,
+  const restoredRawLog = Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : []
+  const restoredLog = boundStructuredLog(restoredRawLog)
+  const restoredOffset = restoredRawLog.length - restoredLog.length
+  const entry = { cmd: runtime, runtime, kind: 'structured', log: restoredLog, pending: new Map(), session: null, recovered: false, commands: commandCatalogForRuntime(runtime, commands), mode, effort, models: runtime === 'codex' ? codexModels : runtime === 'hermes' ? (Array.isArray(models) && models.length ? models : hostHermesModels) : undefined,
     // model: truthful active-model label — now the SAME `laneModel` the SDK is given, so the
     // chip cannot disagree with the wire. When this lane runs on a custom (non-anthropic)
     // registered provider the SDK id is impersonated (see the onEvent guard below), so
@@ -2255,7 +2295,12 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     // Stable creation order — persisted so a bridge restart restores tabs in the SAME
     // order (not readdir/filesystem order). Legacy recs (no openedAt) derive it from the
     // first transcript event ts, so even the first post-fix restart is ordered right.
-    openedAt: openedAt || (Array.isArray(log) ? (log.find((e) => e?.ts)?.ts || 0) : 0) || Date.now() }
+    openedAt: openedAt || (Array.isArray(log) ? (log.find((e) => e?.ts)?.ts || 0) : 0) || Date.now(),
+    // A legacy bridge may have persisted raw multi-megabyte events. The restored
+    // in-memory copy is already bounded; rewrite that compact form only after the
+    // room has announced ready so migration cannot extend the loading screen.
+    snapshotNeedsCompaction: restoredOffset > 0 || restoredLog.some((event, index) => event !== restoredRawLog[index + restoredOffset]),
+    logBytes: restoredLog.reduce((bytes, event) => bytes + JSON.stringify(event).length + 1, 0) }
   entry._turnRev = entry.log.reduce((max, event) => Math.max(max, Number(event?.turnRev) || 0), 0)
   const restoredBoundary = [...entry.log].reverse().find((event) => event?.kind === 'result' && Number(event?.turnRev) > 0)
   entry._settledTurnRev = Number(restoredBoundary?.turnRev) || null
@@ -4356,9 +4401,7 @@ channel
       try {
         const fp = canonicalRoomFilePath(payload, { updir: UPDIR })
         if (!fp) throw new Error('invalid attachment metadata')
-        const r = await fetch(payload.url)
-        if (!r.ok) throw new Error(`HTTP ${r.status}`)
-        const buf = Buffer.from(await r.arrayBuffer())
+        const buf = await fetchRoomAttachment(payload)
         if (buf.length > FILE_MAX_BYTES) throw new Error('file too large')
         fs.mkdirSync(UPDIR, { recursive: true })
         fs.writeFileSync(fp, buf)
@@ -4533,7 +4576,7 @@ channel
       // two conversations. Drop the cached floor with it: the next pushLog re-seeds
       // archiveOldestSeq from the FIRST post-clear event (the new epoch's floor), instead
       // of leaving a stale pre-clear floor to mis-aim trimmedBeforeSeq's phantom-pill guard.
-      s.log = []; s.seq = makeSeqCounter(0); s.archiveOldestSeq = null
+      s.log = []; s.logBytes = 0; s.seq = makeSeqCounter(0); s.archiveOldestSeq = null
       bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
       flushSession(room, payload.term, { sessionId: s.session?.sessionId || null, log: [] })
       ctlLine('context cleared. You can continue with these answers in mind.')
@@ -4798,6 +4841,7 @@ channel
       realtimeHealthy = true; brokenSince = 0
       trackPresence({ name, role: 'bridge', bridge_id: BRIDGE_ID, started_at: BRIDGE_STARTED_AT })
       const startCmd = attachedCmd || autoAgent   // autoAgent: account-mode auto-open (headless)
+      const interruptedRecoveries = []
       if (startCmd && !terms.size && !sessions.size) {
         // Claude + structured mode → Agent SDK session; everything else → PTY.
         // On restart, restore EVERY saved structured session for this room (not
@@ -4851,9 +4895,8 @@ channel
             // Every interrupted role resumes exactly once. Flow lanes do not have a
             // startup redispatch path; excluding them here stranded conductors/builders.
             if (re && wasInterrupted) {
-              const recovery = recoverInterruptedTurn(re, { resumable, recap: recoveryRecap })
-              if (recovery === 'sent') process.stderr.write(`\n  ◆ auto-resumed interrupted Codex turn (${rec.id.slice(0, 8)}) — sent continue.\n`)
-              else if (recovery === 'recap-sent') process.stderr.write(`\n  ◆ resumed interrupted Codex turn (${rec.id.slice(0, 8)}) with a fresh context recap.\n`)
+              re.pendingInterruptedRecovery = { resumable, recap: recoveryRecap }
+              interruptedRecoveries.push(re)
             }
           }
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
@@ -4888,6 +4931,31 @@ channel
       if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
         try { process.send({ t: 'room-ready', room, bridgeId: BRIDGE_ID }) } catch { /* supervisor exited */ }
       }
+      // The room is usable before any runtime processes cold-boot. Stagger interrupted
+      // resumes so several Codex/Claude MCP handshakes cannot stampede the same host and
+      // starve the loopback MCP server. A person speaking during the delay cancels that
+      // lane's stale auto-continue via supersedeInterruptedResume().
+      interruptedRecoveries.forEach((entry, index) => {
+        const timer = setTimeout(() => {
+          const pending = entry.pendingInterruptedRecovery
+          entry.pendingInterruptedRecovery = null
+          if (!pending || sessions.get(entry.id) !== entry) return
+          const recovery = recoverInterruptedTurn(entry, pending)
+          if (recovery === 'sent') process.stderr.write(`\n  ◆ auto-resumed interrupted Codex turn (${entry.id.slice(0, 8)}) — sent continue.\n`)
+          else if (recovery === 'recap-sent') process.stderr.write(`\n  ◆ resumed interrupted Codex turn (${entry.id.slice(0, 8)}) with a fresh context recap.\n`)
+        }, 1000 + index * 5000)
+        timer.unref?.()
+      })
+      // Compact legacy oversized snapshots after readiness. Each entry already holds the
+      // bounded form, so this writes the small replacement without keeping the dashboard
+      // or room bootstrap behind fsyncs.
+      setImmediate(() => {
+        for (const entry of sessions.values()) {
+          if (!entry.snapshotNeedsCompaction) continue
+          entry.snapshotNeedsCompaction = false
+          try { entry.flush?.() } catch { /* keep the prior recoverable snapshot */ }
+        }
+      })
       process.stderr.write(headless
         ? `\n  ◆ thinkpool — relaying room ${room} (headless). Open terminals from the web UI.\n\n`
         : `\n  ◆ thinkpool — sharing "${attachedCmd}"${continuing ? ' (continuing your latest session)' : ''} into room ${room}.  Open the web UI and you're both in.\n\n`)
@@ -5411,6 +5479,9 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     if (!m) return
     if (m.t === 'update-available') surfaceUpdate(m.version)
     else if (m.t === 'agent-visibility-changed') void announce()
+    else if (m.t === 'restart-probe') {
+      try { process.send({ t: 'restart-probe-result', nonce: m.nonce, between: betweenTurns() }) } catch { /* parent is leaving */ }
+    }
     // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
     // it so our authed writes (code-mockup) never go stale on a long session (L16).
     else if (m.t === 'token') {

package/event-bounds.mjs

@@ -4,6 +4,9 @@
    replay frame or tx: seed row into a multi-megabyte hydration dependency. */
 
 export const STRUCTURED_EVENT_CAP = 80000
+// 14 × the 150KB replay-frame budget: the largest complete rolling window the
+// transport can deliver without trimming. Older events remain in the JSONL archive.
+export const STRUCTURED_LOG_BYTE_CAP = 2100000
 
 const sizeOf = (value) => {
   try { return JSON.stringify(value).length } catch { return Infinity }
@@ -94,3 +97,21 @@ export function boundStructuredEvent(event, cap = STRUCTURED_EVENT_CAP) {
   identity._notice = 'Large tool payload truncated for fast transcript hydration'
   return identity
 }
+
+export function boundStructuredLog(events, {
+  eventCap = STRUCTURED_EVENT_CAP,
+  byteCap = STRUCTURED_LOG_BYTE_CAP,
+  countCap = 2000,
+} = {}) {
+  if (!Array.isArray(events) || !events.length) return []
+  const bounded = events.slice(-countCap).map((event) => boundStructuredEvent(event, eventCap))
+  let bytes = 0
+  let start = bounded.length
+  while (start > 0) {
+    const size = sizeOf(bounded[start - 1]) + 1
+    if (start < bounded.length && bytes + size > byteCap) break
+    bytes += size
+    start--
+  }
+  return start === 0 ? bounded : bounded.slice(start)
+}

package/interrupted-resume.mjs

@@ -86,7 +86,10 @@ export function recoverMissingResumeOnce(entry, { message, recap = '', reopen }
 // cold Claude/Codex runtime can trigger its init event and enqueue a stale second
 // `continue` behind the person's actual request.
 export function supersedeInterruptedResume(entry) {
-  if (!entry?.pendingAutoResume) return false
+  if (!entry) return false
+  const queued = !!entry.pendingInterruptedRecovery
+  entry.pendingInterruptedRecovery = null
+  if (!entry.pendingAutoResume) return queued
   entry.pendingAutoResume = false
   return true
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.343",
+  "version": "0.7.344",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {

package/session-store.mjs

@@ -12,6 +12,7 @@ import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
 import { SPAWN } from './cross-terminal.mjs'
+import { boundStructuredLog } from './event-bounds.mjs'
 
 // TP_PAIR_ROOT override exists for tests + sandboxes so they never touch the real
 // ~/.thinkpool-pair store. Read LIVE per call (not captured at module load) so a test
@@ -265,7 +266,8 @@ function write(room, id, data) {
   const file = path.join(dir(room), `${id}.json`)
   try {
     ensureDir(room)
-    atomicCommit(file, JSON.stringify({ ...data, id, savedAt: Date.now() }))
+    const log = Array.isArray(data?.log) ? boundStructuredLog(data.log) : data?.log
+    atomicCommit(file, JSON.stringify({ ...data, ...(log ? { log } : {}), id, savedAt: Date.now() }))
     prune(room)
     return true
   } catch (error) {