thinkpool-pair 0.7.344 → 0.7.346

package/bridge.mjs

@@ -55,7 +55,7 @@ import { readCodexDefaultModel, readCodexModels, codexConfigForMode, codexThread
 import { codexAccountUsageLine, codexCreditsReportLine, codexLimitReportLine } from './codex-commands.mjs'
 import { withMcpSessionFactory } from './codex-mcp-http.mjs'
 import { startStructuredSession } from './runtime-session.mjs'
-import { fallbackTerminalName } from './terminal-name.mjs'
+import { cleanTerminalName, fallbackTerminalName, modelTerminalNameInput } from './terminal-name.mjs'
 import { defaultStructuredMode, normalizeStructuredEffort, shouldDeferStructuredRuntime, structuredModeForSlice, structuredModeLocked, structuredModesForLane, structuredRuntimeForCommand, structuredRuntimeMetadata, structuredRuntimeSupportsMode } from './runtime-registry.mjs'
 import { commandCatalogForRuntime, commandHelpLine, reconcileCommandCatalog } from './command-catalog.mjs'
 import { gitDiffReport } from './git-diff-report.mjs'
@@ -1479,8 +1479,40 @@ const applyAutoTerminalName = (id, candidate) => {
   return true
 }
 
-// First real task only. Naming is deterministic and entirely local: no provider
-// receives the task, and every runtime follows the same zero-token path.
+const requestManagedTerminalName = async (id, task, retry = true) => {
+  if (!codeAuthToken || !id || !task) return
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), 4500)
+  try {
+    const response = await fetch(`${WEB_BASE}/api/code-terminal-name`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${codeAuthToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ code: room, terminalId: id, task }),
+      signal: controller.signal,
+    })
+    clearTimeout(timeout)
+    const data = await response.json().catch(() => ({}))
+    // Bridge-created lanes can receive their task before the browser has
+    // inserted the terminal row. Retry that non-billable race once; every
+    // provider failure simply keeps the already-visible local fallback.
+    if (retry && response.status === 404 && data?.code === 'terminal_pending') {
+      const timer = setTimeout(() => { void requestManagedTerminalName(id, task, false) }, 1500)
+      timer.unref?.()
+      return
+    }
+    if (!response.ok) return
+    const candidate = cleanTerminalName(data?.name)
+    if (candidate) applyAutoTerminalName(id, candidate)
+  } catch {
+    clearTimeout(timeout)
+  }
+}
+
+// First real task only. The zero-token local name appears immediately; a
+// managed tiny model may improve it later without delaying the agent turn.
 const autoNameTerminal = (id, text) => {
   const entry = sessions.get(id)
   if (!entry || termNames[id] || manualNameTouched.has(id) || autoNameAttempts.has(id)) return
@@ -1489,6 +1521,8 @@ const autoNameTerminal = (id, text) => {
   if (!fallback) return
   autoNameAttempts.add(id)
   applyAutoTerminalName(id, fallback)
+  const task = modelTerminalNameInput(text)
+  if (task) void requestManagedTerminalName(id, task)
 }
 
 // (cross-person grantee yield removed 2026-07-06 — owner-only serving now; the owner's

package/codex-mcp-http.mjs

@@ -26,19 +26,24 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
   // Keep exactly one active child session per lane. A new initialize atomically
   // retires the old server+transport before receiving its own isolated instance.
   let active = null
+  let handoffChain = Promise.resolve()
 
-  const retireActive = async () => {
+  const retireActive = () => {
     const current = active
     active = null
-    if (!current) return
-    await Promise.allSettled([
+    if (!current) return Promise.resolve()
+    // Detach first, then clean up in the background. In production an App
+    // Server MCP transport remained stuck in close while its watchdog fallback
+    // was already waiting to initialize `codex exec`; awaiting this cleanup
+    // consumed the replacement client's entire 30-second handshake budget.
+    return Promise.allSettled([
       current.instance.close(),
       current.transport.close(),
     ])
   }
 
   const beginSession = async () => {
-    await retireActive()
+    void retireActive()
     const next = createSessionServer()
     const instance = next?.instance
     if (!instance?.connect) throw new TypeError('Codex MCP session factory did not return an SDK MCP server instance')
@@ -48,6 +53,12 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
     return active
   }
 
+  const serializeHandoff = (task) => {
+    const run = handoffChain.then(task, task)
+    handoffChain = run.catch(() => {})
+    return run
+  }
+
   const server = http.createServer(async (req, res) => {
     if (req.url !== secretPath) {
       res.writeHead(404).end('not found')
@@ -61,7 +72,14 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
           res.writeHead(400).end('missing session')
           return
         }
-        target = await beginSession()
+        // Serialize replacement initialize requests through their response
+        // boundary. This removes the window where two simultaneous children
+        // both observe no active session and orphan each other's transport.
+        await serializeHandoff(async () => {
+          target = await beginSession()
+          await target.transport.handleRequest(req, res)
+        })
+        return
       } else if (!target?.transport?.sessionId || sessionId !== target.transport.sessionId) {
         res.writeHead(404).end('session not found')
         return
@@ -88,11 +106,24 @@ export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {})
   let closed = false
   return {
     url,
+    async handoff() {
+      if (closed) return
+      await serializeHandoff(async () => { void retireActive() })
+    },
     async close() {
       if (closed) return
       closed = true
+      const closing = retireActive()
+      // A retired SDK server may itself be wedged. Closing the loopback listener
+      // must not keep the bridge process alive indefinitely on shutdown.
       await Promise.allSettled([
-        retireActive(),
+        Promise.race([
+          closing,
+          new Promise((resolve) => {
+            const timer = setTimeout(resolve, 1000)
+            timer.unref?.()
+          }),
+        ]),
         new Promise((resolve) => server.close(resolve)),
       ])
     },

package/codex-session.mjs

@@ -303,6 +303,19 @@ export function buildCodexExecArgs({ sessionId, model, effort, sandbox, approval
   return args
 }
 
+// `codex exec` can fail before it has created or resumed a native turn when a
+// required MCP client loses the App Server -> exec handoff race. Retrying is
+// safe only when stderr proves session initialization failed AND the JSONL
+// stream contains no turn/item activity. A silent process or a generic exit is
+// delivery-uncertain and must never replay the person's prompt automatically.
+export function codexExecFailedBeforeTurn({ stderr = '', eventTypes = [] } = {}) {
+  const types = Array.isArray(eventTypes) ? eventTypes.map((type) => String(type || '')) : []
+  if (types.some((type) => type && type !== 'thread.started')) return false
+  const message = String(stderr || '')
+  return /timed out handshaking with MCP server/i.test(message)
+    || (/thread\/resume failed/i.test(message) && /failed to initialize session/i.test(message))
+}
+
 const CODEX_DESTRUCTIVE = /\brm\s+\S|\brmdir\s+\S|\bgit\s+(push\s+(-f|--force)|reset\s+--hard|clean\s+-[a-z]*f)|\bdrop\s+(table|database)\b|\b(mkfs|dd)\b|\bsudo\b|>\s*\/dev\/|\bchmod\s+-R|\bchown\s+-R|\bkillall\b|\btruncate\b/i
 
 export function codexApprovalCard(method, params = {}, item = null) {
@@ -423,6 +436,10 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
   let stallRetried = false
   let stallRetryRequested = false
   let stallGiveupRequested = false
+  // True only while the current logical attempt is still in bridge-owned
+  // bootstrap. It flips before writing a turn/start request or spawning exec.
+  // Absence of provider output is not proof that a prompt was not delivered.
+  let stallReplaySafe = true
   let awaitingUser = 0
   let stallTimer = null
   let activeModel = model || null
@@ -489,6 +506,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     stalledSent = false
     stallRetryRequested = false
     stallGiveupRequested = false
+    stallReplaySafe = true
     if (!retry) stallRetried = false
   }
 
@@ -742,6 +760,17 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     })
     if (action === 'none') return
 
+    // Do not emit the generic "retrying the turn" copy when native delivery is
+    // already uncertain; that would promise the exact unsafe action we refuse.
+    if (action === 'retry' && !stallReplaySafe) {
+      stallGiveupRequested = true
+      stallRetryRequested = false
+      emitRaw({ kind: 'error', recoverable: true, message: 'Codex stopped responding after the turn began. The transport was stopped, but the prompt was not replayed automatically.' })
+      emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: undefined, denials: 0, resultText: null })
+      stopStalledTransport({ force: true })
+      return
+    }
+
     const event = stallEvent(action, quietMs)
     if (event) emitRaw(event)
     if (action === 'status') {
@@ -782,6 +811,9 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     mapper.setUsageBaseline(sessionId ? readCodexThreadUsage(sessionId) : null)
     turnActive = true
     try {
+      // startTurn writes the prompt-bearing RPC. From this edge onward delivery
+      // is at least uncertain, even if the response or first event never lands.
+      stallReplaySafe = false
       activeTurnId = await appServer.startTurn({
         threadId: sessionId,
         input: prompt,
@@ -850,6 +882,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     mapper.setUsageBaseline(sessionId ? readCodexThreadUsage(sessionId) : null)
     turnActive = true
     try {
+      stallReplaySafe = false
       const started = await appServer.startReview({ threadId: sessionId, target: codexReviewTarget(commandText) })
       activeTurnId = started?.turn?.id || started?.turnId
       if (!activeTurnId) throw new Error('Codex review/start returned no turn id')
@@ -903,6 +936,11 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     let peer
     try { peer = await ensureMcpHttp() }
     catch (e) { note(`Thinkpool peer tools unavailable: ${e?.message || e}`) }
+    // Detach any App Server-owned MCP session before exec initializes its own.
+    // Cleanup of the old transport is deliberately asynchronous so a wedged
+    // close cannot consume Codex's 30-second required-MCP handshake window.
+    try { await peer?.handoff?.() }
+    catch (e) { note(`Thinkpool peer handoff failed: ${e?.message || e}`) }
     const args = buildCodexExecArgs({
       sessionId: turnNo === 0 ? null : sessionId,
       model: activeModel,
@@ -928,15 +966,18 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       if (stdinFd != null) opts.stdio = [stdinFd, 'pipe', 'pipe']
 
       turnActive = true
+      stallReplaySafe = false
       child = spawnImpl('codex', args, opts)
       if (stdinFd != null) { try { fs.closeSync(stdinFd) } catch { /* child owns its duplicated fd */ } }
 
+      const nativeEventTypes = []
       const rl = readline.createInterface({ input: child.stdout, crlfDelay: Infinity })
       rl.on('line', (line) => {
         if (!line.trim()) return
         let ev
         try { ev = JSON.parse(line) } catch { return /* non-JSON progress line */
         }
+        nativeEventTypes.push(ev.type)
         if (ev.type === 'thread.started' && ev.thread_id) sessionId = sessionId || ev.thread_id
         if (ev.type === 'turn.completed' || ev.type === 'turn.failed') {
           sawTerminalResult = true
@@ -955,22 +996,30 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         settled = true
         child = null
         turnActive = false
-        if ((stallRetryRequested || stallGiveupRequested) && !sawTerminalResult && !aborted) {
+        const failureMessage = `codex exec exited ${code}${stderrTail ? ': ' + stderrTail.trim().slice(-300) : ''}`
+        const preTurnInitFailure = code !== 0 && code != null && !sawTerminalResult && codexExecFailedBeforeTurn({
+          stderr: stderrTail,
+          eventTypes: nativeEventTypes,
+        })
+        if (preTurnInitFailure && !aborted && !stallGiveupRequested) {
+          resolve({ preTurnInitFailure: true, message: failureMessage })
+          return
+        } else if ((stallRetryRequested || stallGiveupRequested) && !sawTerminalResult && !aborted) {
           // Watchdog interruption: pump either replays once or has already
           // published the terminal giveup boundary.
         } else if (aborted && !sawTerminalResult) {
           emitTurnBoundary({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: undefined, denials: 0, resultText: null })
         } else if (!aborted && !sawTerminalResult && code !== 0 && code != null) {
-          emitTurnBoundary({ kind: 'error', message: `codex exec exited ${code}${stderrTail ? ': ' + stderrTail.trim().slice(-300) : ''}`, recoverable: true })
+          emitTurnBoundary({ kind: 'error', message: failureMessage, recoverable: true })
         }
-        resolve()
+        resolve({ preTurnInitFailure: false })
       }
       child.on('error', (e) => {
         if (settled) return
         settled = true
         child = null
         if (!stallRetryRequested && !stallGiveupRequested) emitTurnBoundary({ kind: 'error', message: `codex failed to start: ${e.message}`, recoverable: true })
-        resolve()
+        resolve({ preTurnInitFailure: false })
       })
       child.on('close', finish)
     })
@@ -999,6 +1048,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       })
       const review = /^\s*\/review(?:\s|$)/i.test(String(next.text || ''))
       let retryAttempt = false
+      let execInitRetryUsed = false
       while (!ended && !aborted && !stallGiveupRequested) {
         const usedAppServer = review
           ? await runAppServerReview(next.text)
@@ -1017,7 +1067,16 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
               armTurnLiveness({ retry: true })
               emitRaw({ kind: 'note', text: 'retrying the stalled turn on a fresh connection' })
             }
-            await runExec(prompt, next.options)
+            const outcome = await runExec(prompt, next.options)
+            if (outcome?.preTurnInitFailure) {
+              if (!execInitRetryUsed && !ended && !aborted && !stallGiveupRequested) {
+                execInitRetryUsed = true
+                armTurnLiveness({ retry: true })
+                emitRaw({ kind: 'note', text: 'Codex initialization failed before the turn started; retrying once with a fresh ThinkPool connection.' })
+                continue
+              }
+              emitTurnBoundary({ kind: 'error', message: outcome.message, recoverable: true })
+            }
           }
         }
         if (stallRetryRequested && !retryAttempt && !stallGiveupRequested && !ended && !aborted) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.344",
+  "version": "0.7.346",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {

package/terminal-name.mjs

@@ -315,3 +315,29 @@ export function fallbackTerminalName(text) {
     .slice(0, 1600)
   return taskTitle(body)
 }
+
+const MODEL_INPUT_MAX_BYTES = 1600
+
+const truncateUtf8 = (value, maxBytes = MODEL_INPUT_MAX_BYTES) => {
+  let result = ''
+  let bytes = 0
+  for (const char of String(value || '')) {
+    const size = Buffer.byteLength(char, 'utf8')
+    if (bytes + size > maxBytes) break
+    result += char
+    bytes += size
+  }
+  return result.trim()
+}
+
+// The managed namer never receives the raw room prompt. Reuse the local
+// extractor's authoritative-task selection, secret redaction, and host-reference
+// stripping, then add a byte ceiling so multilingual text stays cost-bounded.
+export function modelTerminalNameInput(text) {
+  const body = withoutHostReferences(withoutSecrets(extractTerminalTask(text) || ''))
+    .replace(/[`*_>#()[\]{}]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+  if (!body || containsSecret(body)) return null
+  return truncateUtf8(body)
+}