thinkpool-pair 0.7.364 → 0.7.366

package/account.mjs

@@ -1,1437 +1 @@
-/* account.mjs — account-mode bridge (Phase 1).
-   One `npx thinkpool-pair` per ACCOUNT instead of per room:
-     login   — link this device to your ThinkPool account (realtime handoff).
-     bind    — map a room code → a working directory on THIS machine.
-     account — discover your code sessions and serve each one (a headless child
-               bridge per room, run in its bound directory). Reuses the proven
-               single-room bridge verbatim; the supervisor only adds discovery.
-   Spec: docs/specs/2026-06-16-account-bridge.md */
-import { spawn } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import { randomUUID } from 'node:crypto'
-import path from 'node:path'
-import fs from 'node:fs'
-import { createClient } from '@supabase/supabase-js'
-import os from 'node:os'
-import { saveAuth, loadAuth, markAuthReconnectRequired, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
-import { isSafeToRestart } from './update-gate.mjs'
-import { makeThrottledTrack, presenceRecoveryEligible, presenceSelfEchoObservation, recoveryBackoffMs, reducePresenceChannelEvidence, subscribeWithoutStartupDeadlock } from './presence.mjs'
-import { publicKeyB64, announceProviders, listProviders, addProvider, addProviderModel, removeProvider, unseal } from './providers.mjs'
-import { supervisorServes, supervisorRoomsToStop } from './serve-consent.mjs'
-import { resolveServeDir } from './serve-dir.mjs'
-import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
-import { installedAgentCommands } from './agent-detect.mjs'
-import { agentVisibilityStates, setAgentPickerVisibility } from './agent-visibility.mjs'
-import { hostMemoryAdmission } from './host-memory.mjs'
-import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
-import { clearSupervisorReady, supervisorPresenceEchoed, writeSupervisorReady } from './supervisor-ready.mjs'
-import { PAIR_CLI, pairCli } from './command-guidance.mjs'
-import { syncRealtimeAuth } from './design-edit.mjs'
-
-const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
-
-const BRIDGE = fileURLToPath(new URL('./bridge.mjs', import.meta.url))
-
-// Startup can spend several seconds waiting on the cross-process refresh lock or
-// backing off after a transient auth failure. Those sleeps are intentionally unref'd
-// once the supervisor is running, but before Realtime + the 15s tick exist they leave
-// an unresolved top-level await as Node's only work; Node 22 exits 13 with
-// "Detected unsettled top-level await". Hold one referenced timer only for bootstrap,
-// then release it as soon as the supervisor's real lifetime interval exists.
-export function createStartupAnchor({ set = setInterval, clear = clearInterval } = {}) {
-  const timer = set(() => {}, 60_000)
-  let released = false
-  return () => {
-    if (released) return
-    released = true
-    clear(timer)
-  }
-}
-
-// ── single-instance lock ────────────────────────────────────────────────────
-// Two account supervisors on one machine share ONE ~/.thinkpool-pair/auth.json
-// refresh token and race its rotation — which on 2026-06-17 deleted a live Pro
-// login mid-session. The account supervisor is single-instance by nature; this
-// pidfile lock refuses a second one. Acquired BEFORE auth so two can't both hit
-// the refresh path. Exported for the test harness.
-const LOCK = path.join(os.homedir(), '.thinkpool-pair', 'account.lock')
-
-// True if `pid` is a live process (EPERM = exists but not ours; ESRCH = gone).
-function pidAlive(pid) {
-  if (!pid || pid === process.pid) return false
-  try { process.kill(pid, 0); return true } catch (e) { return e.code === 'EPERM' }
-}
-
-// Returns true only if we demonstrably hold the lock. A stale lock (holder dead /
-// garbage / ours) is taken over. Filesystem errors fail CLOSED: serving without a
-// lock can start a second bridge, and duplicate bridges can race terminal reconcile
-// and delete room history. A temporarily unmanageable lock is safer than that.
-export function acquireSingleton(lockPath = LOCK) {
-  try { fs.mkdirSync(path.dirname(lockPath), { recursive: true }) } catch { return false }
-  for (let i = 0; i < 3; i++) {
-    try {
-      const fd = fs.openSync(lockPath, 'wx')        // atomic create-exclusive
-      fs.writeSync(fd, String(process.pid)); fs.closeSync(fd)
-      return true
-    } catch (e) {
-      if (e.code !== 'EEXIST') return false          // cannot prove ownership → refuse to serve
-      let pid = 0
-      try { pid = parseInt(fs.readFileSync(lockPath, 'utf8').trim(), 10) || 0 } catch { return false }
-      if (pidAlive(pid)) return false                // a live supervisor owns it → refuse
-      try { fs.rmSync(lockPath, { force: true }) } catch { return false }  // stale but unmanageable
-    }
-  }
-  return false
-}
-
-// Release only if WE own it (don't unlink a lock another instance took over).
-export function releaseSingleton(lockPath = LOCK) {
-  try { if ((parseInt(fs.readFileSync(lockPath, 'utf8').trim(), 10) || 0) === process.pid) fs.rmSync(lockPath, { force: true }) } catch { /* noop */ }
-}
-
-// ── machine-wide single-bridge lock ─────────────────────────────────────────
-// The SAME pidfile is now the machine-wide "one live bridge" lock, not just the
-// account-supervisor guard: a standalone `npx thinkpool-pair <ROOM>` takes it too
-// (see bridge.mjs, post-`--supervise`). Two bridges serving one room race its
-// terminal reconcile, which reaps + CASCADE-deletes terminal history (the XE3IQ
-// "flat search" loss, 2026-06-25). Account mode and standalone room mode share
-// this lock; an account-spawned room child skips it because its parent
-// supervisor already holds it. Wrappers so bridge.mjs need not know the path.
-export function acquireMachineLock(lockPath = LOCK) { return acquireSingleton(lockPath) }
-export function releaseMachineLock(lockPath = LOCK) { return releaseSingleton(lockPath) }
-
-// A served bridge process must hold the machine lock UNLESS it's a room child the
-// account supervisor spawned (THINKPOOL_PAIR_ACCOUNT_CHILD=1) — the parent holds
-// it, and a child fighting its parent for the lock would refuse itself and break
-// account mode. Pure (env in) so the policy is unit-testable.
-export function shouldHoldMachineLock(env = process.env) {
-  return env.THINKPOOL_PAIR_ACCOUNT_CHILD !== '1'
-}
-
-// ── login: OAuth-style DEVICE-CODE flow (hardened) ──────────────────────────
-// The bridge asks Postgres (start_device_code) for a secret device_code + a short
-// human user_code, prints the user_code + URL, then POLLS claim_device_code with
-// the secret until the signed-in web has approved (approve_device_code stores the
-// browser's session). The session is delivered only over authenticated TLS RPCs
-// + a single-use secret — never broadcast on a public channel.
-export async function runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) {
-  const sb = createClient(SUPABASE_URL, SUPABASE_ANON, { auth: { persistSession: false } })
-  const { data, error } = await sb.rpc('start_device_code')
-  const row = Array.isArray(data) ? data[0] : data
-  if (error || !row?.device_code) { process.stderr.write(`\n  ✗ couldn't start login: ${error?.message || 'no response'}\n`); process.exit(1) }
-  const { device_code, user_code } = row
-  const url = `${WEB_BASE}/code/link?c=${encodeURIComponent(user_code)}`
-  process.stderr.write(`\n  ◆ Link this device to your ThinkPool account.\n    Open (signed in) and approve:\n\n    ${url}\n\n    code:  ${user_code}\n\n  Waiting…\n`)
-  const started = Date.now()
-  const poll = async () => {
-    if (Date.now() - started > 5 * 60 * 1000) { process.stderr.write(`\n  ◇ link timed out — run \`${pairCli('login')}\` again.\n`); process.exit(1) }
-    try {
-      // A discarded `error` costs one tick — the loop retries in a second, and a
-      // permanent failure still lands on the "link timed out" branch above rather than
-      // hanging. Nothing is persisted here, so nothing can be silently lost.
-      // fail-open-ok: read-only poll; a lost tick retries, and permanent failure times out loudly
-      const { data: r } = await sb.rpc('claim_device_code', { p_device_code: device_code })
-      if (r?.status === 'approved' && r.session?.refresh_token) {
-        saveAuth(r.session)
-        process.stderr.write(`\n  ◆ linked as ${r.session.email || 'your account'}. You can close the browser tab.\n    Now run:  ${PAIR_CLI}\n`)
-        process.exit(0)
-      }
-      if (r?.status === 'expired' || r?.status === 'not_found') { process.stderr.write(`\n  ◇ link expired — run \`${pairCli('login')}\` again.\n`); process.exit(1) }
-    } catch { /* transient — keep polling */ }
-    setTimeout(poll, 3000)
-  }
-  poll()
-  await new Promise(() => {})
-}
-
-// A promise that resolves after ms, never keeping the loop alive on its own.
-const sleep = (ms) => new Promise((r) => { const t = setTimeout(r, ms); t.unref?.() })
-
-// Reject a promise if it doesn't settle within ms — so a wedged realtime socket can't
-// freeze a Supabase call (and the tick that awaits it) forever (the 2026-07-08 wedge:
-// a tick hung on a half-open socket, the re-entrancy guard stuck true, the claim
-// heartbeat stopped, and the bridge stood by against its own 564s-stale row).
-export function withTimeout(promise, ms, label = 'op') {
-  return new Promise((resolve, reject) => {
-    const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms); t.unref?.()
-    Promise.resolve(promise).then((v) => { clearTimeout(t); resolve(v) }, (e) => { clearTimeout(t); reject(e) })
-  })
-}
-
-// Decode a JWT's `exp` (unix seconds) WITHOUT verifying — used only to decide whether the
-// saved access token is fresh enough to skip a refresh. 0 on any parse failure (→ refresh).
-function jwtExpSeconds(token) {
-  try {
-    const seg = String(token).split('.')[1]
-    const json = Buffer.from(seg.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8')
-    const exp = JSON.parse(json)?.exp
-    return typeof exp === 'number' ? exp : 0
-  } catch { return 0 }
-}
-
-// F1 predicate (pure, testable): is the saved access token still worth adopting WITHOUT a
-// refresh? True iff we have an access token whose expiry (from the persisted expires_at, or
-// decoded from the JWT) is more than marginSec ahead of now. Skipping the refresh here is
-// one fewer rotation → one fewer race window / mid-rotation brick.
-export function savedTokenStillValid(saved, nowSec = Math.floor(Date.now() / 1000), marginSec = 300) {
-  if (!saved?.access_token) return false
-  const expSec = saved.expires_at || jwtExpSeconds(saved.access_token)
-  return !!expSec && (expSec - nowSec) > marginSec
-}
-
-// ── cross-process refresh serialization (F3) ────────────────────────────────
-// Two bridges refreshing ONE refresh token outside Supabase's short reuse window makes
-// Supabase revoke the entire token FAMILY — every future refresh then fails permanently
-// until a fresh login. A short-lived lock file serializes the actual network refresh
-// across processes; a lock older than staleMs is stale (holder crashed mid-refresh) and
-// is taken over. fs errors fail-OPEN (return true) — a lock we can't manage must never
-// block a genuine refresh. Exported for the test harness.
-const REFRESH_LOCK = path.join(os.homedir(), '.thinkpool-pair', 'refresh.lock')
-export function acquireRefreshLock(lockPath = REFRESH_LOCK, staleMs = 30_000) {
-  try { fs.mkdirSync(path.dirname(lockPath), { recursive: true }) } catch { /* noop */ }
-  for (let i = 0; i < 2; i++) {
-    try {
-      const fd = fs.openSync(lockPath, 'wx')   // atomic create-exclusive
-      fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() })); fs.closeSync(fd)
-      return true
-    } catch (e) {
-      if (e.code !== 'EEXIST') return true       // unmanageable → fail open
-      let age = Infinity
-      try { age = Date.now() - (JSON.parse(fs.readFileSync(lockPath, 'utf8'))?.at || 0) } catch { age = Infinity }
-      if (age < staleMs) return false            // a live refresh holds it → back off
-      try { fs.rmSync(lockPath, { force: true }) } catch { return true }   // stale → drop + retry
-    }
-  }
-  return false
-}
-export function releaseRefreshLock(lockPath = REFRESH_LOCK) { try { fs.rmSync(lockPath, { force: true }) } catch { /* noop */ } }
-
-// Build an authed session from a saved {access_token, refresh_token} WITHOUT rotating the
-// refresh token. setSession validates the access token (getUser — no rotation) when it is
-// still valid; callers only ever adopt a FRESH token, so it never falls through to a refresh.
-async function adoptSavedSession(sb, saved) {
-  if (!saved?.access_token || !saved?.refresh_token) return null
-  try {
-    const { data, error } = await sb.auth.setSession({ access_token: saved.access_token, refresh_token: saved.refresh_token })
-    if (error || !data?.session) return null
-    return data.session
-  } catch { return null }
-}
-
-// One refresh, serialized across processes + adopting a sibling's rotation (F3). Steps:
-//   • auth.json already holds a DIFFERENT refresh token than the one we carry → a sibling
-//     (or a re-mint) rotated: ADOPT the disk pair instead of refreshing again.
-//   • else take the refresh lock; if a sibling holds it, wait briefly and adopt THEIR
-//     rotated result rather than racing a second rotation (which revokes the family).
-//   • under the lock, re-read disk once more, then refreshSession → saveAuth.
-// Deps are injectable for the test harness. Returns { session, adopted } or null.
-export async function refreshAccountSession(sb, holdRefreshToken, deps = {}) {
-  const { load = loadAuth, save = saveAuth, acquire = acquireRefreshLock, release = releaseRefreshLock, wait = sleep } = deps
-  const adoptIfRotated = async (rt) => {
-    const d = load()
-    if (d?.refresh_token && rt && d.refresh_token !== rt) {
-      const s = await adoptSavedSession(sb, d)
-      if (s) return { session: s, adopted: true }
-    }
-    return null
-  }
-  let adopted = await adoptIfRotated(holdRefreshToken)
-  if (adopted) return adopted
-  const rt0 = load()?.refresh_token || holdRefreshToken
-  if (!rt0) return null
-  let locked = acquire()
-  if (!locked) {
-    // A sibling is mid-refresh. Wait for it to finish and adopt its rotated pair rather
-    // than firing a competing rotation (the family-revoke race).
-    for (let i = 0; i < 20; i++) {
-      await wait(250)
-      adopted = await adoptIfRotated(rt0)
-      if (adopted) return adopted
-      if (acquire()) { locked = true; break }
-    }
-    if (!locked) return null   // couldn't get the lock or adopt — caller retries later
-  }
-  try {
-    adopted = await adoptIfRotated(rt0)   // re-check under the lock (sibling may have just finished)
-    if (adopted) return adopted
-    const rt = load()?.refresh_token || rt0
-    const { data, error } = await sb.auth.refreshSession({ refresh_token: rt })
-    // Preserve the server's structured Auth error. The caller must distinguish a
-    // retryable network/service failure from a refresh token that is definitively
-    // gone; collapsing both to null is what let a disconnected account keep painting
-    // as a healthy bridge until its presence JWT finally expired.
-    if (error || !data?.session) return { session: null, error: error || null }
-    save(data.session)   // atomic (auth-store) — never a torn token file
-    return { session: data.session, adopted: false }
-  } finally { if (locked) release() }
-}
-
-// Supabase documents these as terminal session/refresh-token states. They require a
-// fresh device-code login; request timeouts, rate limits and 5xx errors remain retryable.
-export const ACCOUNT_RECONNECT_ERROR_CODES = new Set([
-  'refresh_token_not_found',
-  'refresh_token_already_used',
-  'session_not_found',
-])
-
-export function accountRefreshNeedsReconnect(error) {
-  return ACCOUNT_RECONNECT_ERROR_CODES.has(String(error?.code || ''))
-}
-
-// Exchange the stored credentials for a live session + authed client.
-export async function authedClient(SUPABASE_URL, SUPABASE_ANON) {
-  const a = loadAuth()
-  if (!a?.refresh_token) return null
-  if (a.reconnect_required) return { reconnectRequired: true }
-  const sb = createClient(SUPABASE_URL, SUPABASE_ANON, { auth: { persistSession: false, autoRefreshToken: false } })
-  // F1: skip the refresh entirely when the saved access token is still comfortably valid
-  // (>5 min to expiry). Every gratuitous startup rotation is a race window — and, killed
-  // mid-rotation, a login-brick. Adopt the saved pair; scheduleTokenRefresh rotates near
-  // expiry as it already does.
-  if (savedTokenStillValid(a)) {
-    const s = await adoptSavedSession(sb, a)
-    if (s) return { sb, session: s }
-  }
-  // Near-expiry / missing / invalid access token → do a serialized rotation (F3).
-  const r = await refreshAccountSession(sb, a.refresh_token)
-  if (!r?.session) {
-    if (accountRefreshNeedsReconnect(r?.error)) {
-      markAuthReconnectRequired(r.error.code)
-      return { reconnectRequired: true }
-    }
-    return null
-  }
-  return { sb, session: r.session }
-}
-
-// F2: startup refresh can fail transiently (offline, a sibling mid-rotation, a wedged
-// socket). Retry IN-PROCESS with backoff — NEVER exit(1), because launchd KeepAlive would
-// respawn us within seconds and each respawn hammers the refresh path (the 16× crash
-// storm). authedClient re-reads auth.json every attempt, so a re-mint or a sibling's
-// rotation is picked up on the next try. Returns null ONLY when there is no saved login
-// at all (genuinely not linked) — the caller then stands down CLEANLY (exit 0, no respawn).
-// Deps injectable for the test harness.
-export async function authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, opts = {}) {
-  const { attempt = authedClient, load = loadAuth, wait = sleep, onRetry = null, maxAttempts = Infinity, baseMs = 15_000, capMs = 300_000 } = opts
-  let delay = baseMs
-  for (let n = 1; n <= maxAttempts; n++) {
-    const a = await attempt(SUPABASE_URL, SUPABASE_ANON)
-    if (a?.reconnectRequired) return a
-    if (a) return a
-    if (!load()?.refresh_token) return null   // not linked — caller says `login`, exits 0
-    if (n >= maxAttempts) break
-    onRetry?.(delay, n)
-    await wait(delay)
-    delay = Math.min(delay * 2, capMs)
-  }
-  return null
-}
-
-// Pure predicate (2026-07-08): the claim/heartbeat loop is "wedged" when no successful
-// claim has landed in ≥ quietMsThreshold (default 40s = ~2 missed 15s ticks). Extracted so
-// the watchdog's trigger is unit-testable without a live socket.
-export function claimLoopWedged({ lastClaimOkAt, now, quietMsThreshold = 40_000 }) {
-  return (now - lastClaimOkAt) >= quietMsThreshold
-}
-
-// ── keep the account JWT fresh (presence keepalive) ─────────────────────────
-// The account supervisor authenticates its realtime PRESENCE connection with the
-// account access token. Supabase Realtime enforces the JWT `exp` (~1h): once it
-// lapses the server deauths the socket, presence vanishes, and the dashboard
-// flips to "No bridge connected" — while sessions keep running, because the room
-// children are SEPARATE anon-keyed processes. The supervisor used to refresh the
-// token exactly once at startup (autoRefreshToken:false), so presence silently
-// died ~1h in and never came back until a restart. This refreshes BEFORE expiry,
-// pushes the new token to the realtime socket (setAuth) so it never drops, and
-// re-announces presence. onRefreshed persists the rotated refresh token + re-tracks.
-// Returns { cancel } and exposes _tick for the deterministic test harness.
-//   skewMs  — refresh this far ahead of expiry (default 90s)
-//   forceMs — fixed interval override (test hook: TP_TOKEN_REFRESH_FORCE_MS)
-//   retryMs — backoff after a transient failure (offline / rotation race)
-export function scheduleTokenRefresh({ sb, session, onRefreshed, onReconnectRequired, skewMs = 90_000, forceMs = 0, retryMs = 30_000, refresh = refreshAccountSession }) {
-  let timer = null
-  let cur = session
-  let cancelled = false
-  let reconnectRequired = false
-  const arm = (delay) => {
-    if (cancelled) return
-    clearTimeout(timer)
-    timer = setTimeout(tick, Math.max(1_000, delay))
-    if (timer?.unref) timer.unref()
-  }
-  // expires_at is unix SECONDS; fall back to a 1h horizon if absent.
-  const nextDelay = () => {
-    if (forceMs) return forceMs
-    const expMs = cur?.expires_at ? cur.expires_at * 1000 : Date.now() + 3600_000
-    return Math.max(30_000, expMs - Date.now() - skewMs)
-  }
-  async function tick() {
-    if (cancelled) return
-    try {
-      // Serialized refresh (F3): re-reads auth.json and adopts a sibling's rotated pair
-      // instead of blindly refreshing with our in-memory `cur.refresh_token` — the old
-      // tick retried with a stale token it held and could lose the family to a race.
-      const r = await refresh(sb, cur.refresh_token)
-      if (!r?.session) {
-        if (accountRefreshNeedsReconnect(r?.error)) {
-          if (!reconnectRequired) {
-            reconnectRequired = true
-            try { await onReconnectRequired?.(r.error) } catch { /* reporting is best-effort; retry still owns recovery */ }
-          }
-        }
-        throw r?.error || new Error('no session')
-      }
-      cur = r.session
-      // Hand the fresh token to the live realtime socket so the presence
-      // connection stays authed across the swap (no drop, no rejoin needed).
-      try { sb.realtime?.setAuth?.(cur.access_token) } catch { /* noop */ }
-      reconnectRequired = false
-      try { await onRefreshed?.(cur) } catch { /* noop */ }
-      arm(nextDelay())
-    } catch {
-      // Transient (offline, or a refresh-token rotation race with another login).
-      // Retry soon; NEVER crash the bridge and NEVER clearAuth (see runAccount).
-      arm(retryMs)
-    }
-  }
-  arm(nextDelay())
-  return { cancel: () => { cancelled = true; clearTimeout(timer) }, _tick: tick }
-}
-
-export function runBind(room, dir) {
-  const r = (room || '').toUpperCase().trim()
-  if (!r) { console.error(`usage: ${pairCli('bind', '<ROOM>', '<directory>')}`); process.exit(1) }
-  const abs = path.resolve(dir || '.')
-  if (!fs.existsSync(abs) || !fs.statSync(abs).isDirectory()) { console.error(`✗ not a directory: ${abs}`); process.exit(1) }
-  bindDir(r, abs)
-  console.error(`✓ bound ${r} → ${abs}\n  Run \`${PAIR_CLI}\` (or restart it) to serve this session.`)
-  process.exit(0)
-}
-
-// ── account supervisor: a headless child bridge per bound room, in its dir ──
-export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
-  if (!acquireSingleton()) {
-    console.error(`\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    \`${pairCli('<ROOM>')}\`.\n`)
-    process.exit(0)
-  }
-  // We own account.lock now, so any previous readiness receipt is stale. A fresh
-  // receipt is written only after the first reconciliation tick AND a server-side
-  // presence self-echo prove that this exact supervisor finished bootstrapping.
-  clearSupervisorReady()
-  const releaseStartupAnchor = createStartupAnchor()
-  // F2: NEVER exit(1) on a refresh failure. The old code exited 1 here, and launchd
-  // KeepAlive respawned us within seconds → refresh again → the 16× crash storm (and,
-  // worse, hammering the refresh path burns rotations and can revoke the token family).
-  // Instead retry IN-PROCESS with backoff, re-reading auth.json each time so a headless
-  // re-mint or a sibling's rotation is picked up without a restart. Do NOT delete
-  // auth.json — a transient failure must never wipe a still-valid login (2026-06-17).
-  const auth = await authedClientWithRetry(SUPABASE_URL, SUPABASE_ANON, {
-    onRetry: (delay) => process.stderr.write(`\n  ◇ Couldn't refresh your account session yet (offline, or another bridge is mid-rotation) — retrying in ${Math.round(delay / 1000)}s. Saved login left in place.\n`),
-  })
-  if (!auth) {
-    releaseSingleton()
-    // Reached ONLY when there is no saved login at all (not linked). Stand down CLEANLY
-    // with exit 0: launchd KeepAlive has SuccessfulExit=false, so exit 0 is NOT respawned
-    // — no crash storm for the "never logged in" case. The user links with `login`.
-    console.error(`\n  ◇ Not linked to a ThinkPool account on this machine.\n    Link it:  ${pairCli('login')}\n`)
-    process.exit(0)
-  }
-  if (auth.reconnectRequired) {
-    releaseStartupAnchor()
-    releaseSingleton()
-    console.error('\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n')
-    process.exit(0)
-  }
-  const { sb, session } = auth
-  const email = session.user?.email || 'your account'
-  // Current owner JWT, handed to each room-bridge child for authed web writes
-  // (code-mockup, whip L16). Refreshed below; pushed to live children on rotation.
-  let currentAccessToken = session.access_token || null
-
-  // No plan-refusal here (Contract C-CODE-2′, spec 2026-06-25-code-free-launch).
-  // /code is now a metered free tier, not Pro-only: a free account can legitimately
-  // own sessions (within its monthly quota, or during the launch window). The cost
-  // brake moved to session CREATION — start_code_session enforces the quota/window
-  // server-side, so a row exists iff the owner was entitled to create it. The bridge
-  // therefore serves whatever sessions the account legitimately owns (owner-only
-  // discovery below, line ~349, still bounds it to the account's OWN rooms). Inference
-  // runs on this machine's own Claude login regardless of plan, so hosting costs
-  // ThinkPool nothing; there's no cost reason to refuse a free host.
-
-  const DEFAULT_DIR = process.cwd()   // unbound sessions auto-serve here; `bind` overrides per session
-  // Ground truth for "am I the managed service": ask the service manager, not the
-  // THINKPOOL_PAIR_AUTOUPDATE env proxy. Since pinned installs became the default,
-  // the plist/unit sets AUTOUPDATE only when --auto-update was passed — the env var
-  // now means "track @latest", NOT "I'm the service". Testing the env alone made a
-  // pinned managed service (a) announce service:false → dashboard says "foreground",
-  // and (b) skip the uninstall on a dashboard Kill → launchd respawns the "killed"
-  // bridge ~2s later (the 2026-06-18 zombie-toggle, reintroduced by pinning).
-  let isManagedService = false
-  try { const svc = await import('./service.mjs'); isManagedService = svc.serviceActive(null) } catch { /* not installed */ }
-  const runsAsService = () => process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' || isManagedService
-  const svcHint = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
-    ? '    (auto-updating background service — survives reboot, tracks @latest)\n'
-    : isManagedService
-      ? '    (background service — survives reboot, restarts on crash, pinned to this version)\n'
-      : `    (run hands-off + auto-updating: ${pairCli('install-service')})\n`
-  const _effDefault = loadDefaultDir() || claudeRecentProjectDir() || DEFAULT_DIR
-  process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    New sessions auto-serve from ${_effDefault}${loadDefaultDir() ? ' (your default)' : (claudeRecentProjectDir() ? ' (your most-recent Claude Code project)' : '')}\n    (change it: ${pairCli('set-default-dir', '<dir>')}  ·  one room: ${pairCli('bind', '<code>', '<dir>')})\n${svcHint}`)
-
-  const children = new Map()   // room -> child process
-  const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
-  const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
-  const childPeer = new Map()  // room -> bool (a web client is watching this room)
-  const readyRooms = new Set() // child subscribed + restored + announced usable room state
-  // Thinkpool Ensemble cross-ROOM router (Tier 1): the supervisor is the only process
-  // that knows every room on this machine, so it routes a child's read_session into the
-  // target room's child and relays the reply back. roomNames feeds list_sessions; pairPending
-  // maps an in-flight peek's reqId → the room that asked, so the target's reply finds its way home.
-  const roomNames = new Map()  // room -> display name (for list_sessions)
-  // pairPending: reqId -> { reply, askerRoom }. `reply(m)` delivers a target child's
-  // pair-*-res back to its origin — a local asker child (Tier 1/local Tier 3) OR the
-  // pair bus (a partner's request, Tier 2/3). askerRoom (or null for bus origin) lets
-  // a dead-room cleanup drop only its own in-flight entries.
-  const pairPending = new Map()
-  // ── Tier 2/3 cross-MACHINE pair bus ─────────────────────────────────────────
-  // The supervisor is the IPC↔bus bridge: it joins one per-pair Supabase channel
-  // (tppair:<pairKey>, RLS-gated to the two real partners) per distinct partner, and
-  // relays peek/post requests between a local room child and the partner's supervisor.
-  // Spec: docs/specs/2026-06-30-cross-room-pair-bus.md
-  const roomPartner = new Map()   // room -> the OTHER participant's uid (the pair partner), for 2-person rooms
-  const pairChannels = new Map()  // partnerUid -> { channel, key, status } (one bus per distinct partner)
-  const postBucket = new Map()    // partnerUid -> { count, resetAt } inbound cross-room-post rate limit (runaway-cost backstop)
-  const POST_BUCKET = { max: 6, windowMs: 60_000 }   // ≤6 inbound cross-room posts / partner / minute
-  let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
-  let pendingUpdate = null     // newest published version once the poll sees it
-  let applyingUpdate = false
-  const restartProbes = new Map() // nonce -> { pending rooms, ok, timer, resolve }
-  const warned = new Set()
-  const refused = new Map()   // room -> reason ('home'|'none'|'dir-gone'): owned but NOT served, announced in presence so the web shows a precise "attach this session" card instead of spinning
-
-  // Account presence — so the web dashboard can show "● Bridge active" for this
-  // account without per-room probing. We TRACK this machine (name + served room
-  // codes + version) on a per-account channel; the dashboard subscribes read-only.
-  const machine = os.hostname().replace(/\.local$/, '')
-
-  // ── supervisor logging (cascade brg-instrument, supervisor-log lane) ─────────
-  const SUP_ID = (randomUUID?.() || '').slice(0, 8)
-  let lastClaimHeld = null // track state changes for claim_tick logging
-  console.log(`◇ supervisor boot sup=${SUP_ID} host=${machine} pid=${process.pid} npx=${VERSION || 'dev'}`)
-
-  if (!await syncRealtimeAuth(sb, currentAccessToken, SUPABASE_ANON)) {
-    process.stderr.write('\n  ⚠ realtime auth could not be initialized; private bridge control is unavailable.\n')
-  }
-  const acct = sb.channel(`tpacct:${session.user.id}`, { config: { presence: { key: machine }, broadcast: { self: false } } })
-  const acctControl = sb.channel(`tpacct-control:${session.user.id}`, { config: { private: true, broadcast: { self: false } } })
-  // One id per account-bridge PROCESS. The dashboard keeps its restart indicator
-  // up until this value changes, so stale presence + fresh claim heartbeats can
-  // never impersonate a completed restart.
-  const BRIDGE_ID = randomUUID()
-  let restarting = false   // set by the "restart" broadcast → stop() exits non-zero so a supervisor respawns us
-  // Account-control handlers are registered before the discovery loop is
-  // initialized. Route early requests through a harmless placeholder, then
-  // replace it once `tick` exists; this avoids a temporal-dead-zone crash during
-  // supervisor bootstrap while still letting a live web room request discovery.
-  let requestDiscoveryTick = () => {}
-  // Web "attach this session" card → bind an unbound/new room to a local dir (and
-  // optionally set it as the account default) so it serves WITHOUT a terminal command.
-  // Rides the private, owner-gated control topic; the dir must exist on THIS machine.
-  acctControl.on('broadcast', { event: 'bind-room' }, ({ payload }) => {
-    const code = String(payload?.code || '').toUpperCase().trim()
-    let dir = String(payload?.dir || '').trim()
-    if (dir.startsWith('~')) dir = path.join(os.homedir(), dir.slice(1))
-    if (!code || !dir) return
-    if (!fs.existsSync(dir)) { process.stderr.write(`\n  ◇ bind ${code}: directory not found (${dir}) — ignored.\n`); return }
-    bindDir(code, dir)
-    if (payload?.setDefault) { saveDefaultDir(dir); process.stderr.write(`\n  ◆ default project dir set → ${dir}\n`) }
-    process.stderr.write(`\n  ◆ ${code} bound → ${dir} (from the web). Serving…\n`)
-    requestDiscoveryTick()
-  })
-  // A newly-created web room already knows its owner and has an authenticated,
-  // owner-private account-control channel. Nudge discovery immediately instead
-  // of waiting for the supervisor's 15-second reconciliation interval. `tick`
-  // still re-queries owner-owned active rooms, so the browser cannot make this
-  // host serve an arbitrary code.
-  acctControl.on('broadcast', { event: 'serve-room' }, ({ payload }) => {
-    const code = String(payload?.code || '').toUpperCase().trim()
-    if (!/^[A-Z0-9]{4,12}$/.test(code)) return
-    requestDiscoveryTick()
-  })
-  // Dashboard "Disconnect" → broadcast shutdown → clean exit (presence leaves, bar flips live).
-  // If we're the auto-restarting background service (launchd KeepAlive / systemd
-  // Restart=always sets AUTOUPDATE=1), a bare exit would be respawned ~2s later —
-  // so the toggle would appear to do nothing (presence leaves, then rejoins).
-  // Uninstall the account service FIRST so the supervisor won't restart us, then
-  // stop. Mirrors the per-room session-deleted guard in bridge.mjs.
-  acctControl.on('broadcast', { event: 'shutdown' }, async () => {
-    process.stderr.write('\n  ◇ disconnect requested from the dashboard — stopping bridge.\n')
-    // Hard-exit backstop, armed FIRST — independent of the SIGTERM round-trip,
-    // the realtime socket, and every await below. If the graceful stop() wedges
-    // (2026-06-18: a dashboard disconnect left this supervisor ALIVE holding
-    // account.lock with no presence + service removed — a zombie that showed
-    // "No bridge connected" on /code yet blocked any `npx thinkpool-pair`
-    // restart), force the process down and release the lock so a fresh bridge
-    // can take over. NOT unref'd: it must keep the loop alive until it fires.
-    setTimeout(() => { try { releaseSingleton() } catch { /* noop */ } process.exit(0) }, 2500)
-    if (runsAsService()) {
-      try { const svc = await import('./service.mjs'); svc.uninstallService(null) } catch { /* noop */ }
-    }
-    process.kill(process.pid, 'SIGTERM')
-  })
-  // Dashboard "Restart" → broadcast restart → graceful stop with a NON-ZERO exit so
-  // EVERY supervisor respawns us: launchd KeepAlive / systemd Restart=always respawn
-  // regardless of exit code, and the bridge.mjs --supervise wrapper (room tier)
-  // respawns on non-zero but treats 0 as a clean stop. Children persist + resume
-  // their sessions (session-store), so the bounce is invisible in-room. Unlike shutdown
-  // we do NOT uninstall the service. A plain foreground bridge has no supervisor, so it
-  // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
-  // don't subscribe to this event, so the dashboard button is a harmless no-op there.
-  let restartPreparationRunning = false
-  acctControl.on('broadcast', { event: 'restart' }, async ({ payload } = {}) => {
-    const nonce = payload?.nonce
-    const reply = async (ok, error) => {
-      try { await acctControl.send({ type: 'broadcast', event: 'restart-status', payload: { nonce, ok, error } }) } catch { /* channel down */ }
-    }
-    // A dashboard restart is an EXPLICIT apply request, but it is not permission
-    // to interrupt a live turn or a pending human decision. Stage the immutable
-    // runtime while work continues; applyIfIdle() owns the only destructive edge.
-    if (restartPreparationRunning || applyingUpdate) {
-      await reply(false, 'a bridge update is already being prepared')
-      return
-    }
-    restartPreparationRunning = true
-    try {
-      const svc = await import('./service.mjs')
-      const managed = svc.serviceActive(null)
-      const staged = managed ? svc.stageServiceUpdate(null) : null
-      if (managed && !staged) {
-        await reply(false, 'the published runtime could not be staged; the existing bridge was left running')
-        return
-      }
-      // The dashboard's advertised version is only a fallback marker for a
-      // foreground supervisor. Managed hosts independently resolve and verify npm.
-      pendingUpdate = staged || (typeof payload?.version === 'string' ? payload.version : VERSION) || 'restart'
-      applyRequested = true
-      await reply(true)
-    } catch (error) {
-      await reply(false, `restart preparation failed: ${error?.message || error}`)
-      return
-    } finally {
-      restartPreparationRunning = false
-    }
-    void applyIfIdle()
-  })
-  // Throttled so a realtime reconnect storm can't machine-gun track() into the
-  // per-client presence rate limit (ClientPresenceRateLimitReached → channel closed
-  // → dashboard reads "no bridge" while sessions run; 2026-06-17/-22/-24). The 15s
-  // tick + token-refresh callers are unaffected (their interval exceeds the window).
-  // lastTrackStatus retains the most recent track()'s server verdict ('ok'|'timed out'|
-  // 'error') so the presence self-echo watchdog can log WHY presence went dark.
-  let lastTrackStatus = 'init'
-  let accountAuthState = 'connected'
-  const trackPresence = makeThrottledTrack(acct, { minMs: 5000, onStatus: (s) => { lastTrackStatus = s } })
-  // `service` lets the dashboard show whether this bridge is the durable installed
-  // service (always-on, survives reboot) vs a foreground `npx` run that dies with its
-  // terminal — runsAsService() above (service-manager ground truth, not the env proxy).
-  // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), generated +
-  // persisted 0600 on first read. The dashboard imports it to SEAL a provider's API
-  // key so it reaches the bridge without ever crossing the wire in the clear. Computed
-  // ONCE (the keypair is stable across restarts). `providers` is the name-only registry
-  // (id+name+model, NEVER the key or baseUrl) so the dashboard can list what's available
-  // to spawn against — re-read each announce so an add/remove reflects immediately.
-  // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
-  const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: agentVisibilityStates(installedAgentCommands()), accountAuthState, ts: Date.now() })
-
-  // Persist account-auth truth separately from process presence. Presence will vanish
-  // when the old JWT expires; the claim row keeps the reconnect instruction visible on
-  // the dashboard until this same bridge refreshes successfully or another bridge takes
-  // over with a healthy login. Older databases simply reject this best-effort RPC.
-  const reportAccountAuthState = async (state) => {
-    try {
-      await withTimeout(sb.rpc('report_bridge_auth_state', { p_bridge_id: BRIDGE_ID, p_state: state }), 5000, 'report_bridge_auth_state')
-    } catch { /* migration not present yet, offline, or the old JWT already expired */ }
-  }
-
-  // ── Provider registry — the multi-BYOK wire contract (slice 1). ─────────────
-  // The private tpacct-control:<uid> join/send policy binds the sender to this
-  // exact owner. Credentials stay in the Realtime handshake, never the payload.
-  const provReply = (event, payload) => { try { acctControl.send({ type: 'broadcast', event, payload }) } catch { /* channel down */ } }
-  // provider-add {sealed, nonce} → decrypt, validate, append, re-announce.
-  acctControl.on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    let fields
-    // Decrypt failures answer ok:false WITHOUT logging the ciphertext or plaintext
-    // (security invariant d) — a bare boolean, never the sealed blob or the key.
-    try { fields = unseal(payload?.sealed) } catch { return provReply('provider-add-res', { nonce, ok: false, error: 'could not decrypt the sealed payload' }) }
-    const r = addProvider(fields)
-    if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
-    provReply('provider-add-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
-  })
-  // provider-add-model {id, model, name?, nonce} → clone the source row's
-  // baseUrl + key HOST-SIDE onto a new model, re-announce. Deliberately carries NO
-  // `sealed` envelope: the key never leaves the bridge for this op, so there is
-  // nothing to decrypt. Owner-authed exactly like its siblings.
-  acctControl.on('broadcast', { event: 'provider-add-model' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    const r = addProviderModel({ id: payload?.id, model: payload?.model, name: payload?.name })
-    if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ model added to an existing provider (${String(payload?.model || '').slice(0, 40)}) — re-announced.\n`) }
-    provReply('provider-add-model-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
-  })
-  // provider-remove {id, nonce} → remove (built-in refuses), re-announce.
-  acctControl.on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    const r = removeProvider(payload?.id)
-    if (r.ok) { pushPresence(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
-    provReply('provider-remove-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error })
-  })
-  // providers-list-req {nonce} → the masked list (keyHint = last 4 chars only).
-  acctControl.on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    provReply('providers-list-res', { nonce, ok: true, providers: listProviders() })
-  })
-  // agent-visibility-set {cmd, enabled, nonce} changes only the web picker.
-  // The runtime stays installed and explicit runtime requests keep working.
-  acctControl.on('broadcast', { event: 'agent-visibility-set' }, async ({ payload }) => {
-    const nonce = payload?.nonce
-    const installed = installedAgentCommands()
-    const r = setAgentPickerVisibility(payload?.cmd, payload?.enabled === true, { installed })
-    if (r.ok) {
-      pushPresence()
-      for (const child of children.values()) {
-        try { child.send({ t: 'agent-visibility-changed' }) } catch { /* child may be exiting */ }
-      }
-      process.stderr.write(`\n  ◆ terminal picker agents updated — ${r.agents.filter((agent) => agent.enabled).map((agent) => agent.cmd).join(', ')} visible.\n`)
-    }
-    provReply('agent-visibility-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, agents: r.ok ? r.agents : undefined })
-  })
-
-  // ENABLE presence delivery + the self-echo's ground truth. supabase-js only asks
-  // the server for presence state when a presence callback is bound at join time —
-  // with no listener, presenceState() stays {} FOREVER even while our own track()
-  // lands fine. That blind spot made the 0.7.174 self-echo watchdog false-positive
-  // respawn the supervisor every ~2.5 min ("the bridge disconnects and reconnects
-  // randomly", 2026-07-09 — nine respawns in an hour, track=ok on every one).
-  // Binding sync does two jobs: turns presence delivery ON (the echo becomes real)
-  // and stamps presenceSyncSeenAt. acctSubscribedAt bounds the startup case where
-  // SUBSCRIBED fires but the first sync never arrives: that is a broken Realtime
-  // channel, not an unknowable state, once the listener was attached before join.
-  let presenceEvidence = reducePresenceChannelEvidence()
-  let initialTickDone = false
-  let readinessWritten = false
-  const publishReadiness = () => {
-    if (readinessWritten || !initialTickDone) return
-    let present = false
-    try { present = supervisorPresenceEchoed(acct.presenceState?.(), machine, BRIDGE_ID, VERSION) } catch { present = false }
-    if (!present) return
-    readinessWritten = writeSupervisorReady({ version: VERSION, bridgeId: BRIDGE_ID })
-    if (!readinessWritten) process.stderr.write('\n  ◇ Could not record local supervisor readiness; the bridge remains running but installers will not claim it was confirmed.\n')
-  }
-  acct.on('presence', { event: 'sync' }, () => {
-    presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, 'sync')
-    publishReadiness()
-  })
-
-  // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
-  // (network blip, or a token swap mid-flight) rejoins the channel and must
-  // re-announce, or the dashboard would read "no bridge" until the next restart.
-  const initialAccountRealtime = await subscribeWithoutStartupDeadlock(acct, (st) => {
-    if (st === 'SUBSCRIBED') {
-      presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, st)
-      pushPresence()
-    }
-    else if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
-      // Invalidate the old generation before inspecting presenceState again. The
-      // channel retains a local self key across failures; accepting that cache is
-      // what left the managed service zombified while a fresh foreground run worked.
-      presenceEvidence = reducePresenceChannelEvidence(presenceEvidence, st)
-      // Realtime dropped (the 2026-07-08 `realtime CLOSED` blip). The socket normally
-      // auto-reconnects, but nudge it so presence — and the claim heartbeat that shares
-      // this client — recover instead of the loop standing by against its own stale row.
-      // The callback stays wired for the channel's life, so later rejoins re-fire it.
-      try { sb.realtime?.connect?.() } catch { /* noop */ }
-    }
-  })
-  if (!initialAccountRealtime.connected) {
-    process.stderr.write(`\n  ◇ account realtime not ready at startup (${initialAccountRealtime.status}) — staying alive and recovering in process.\n`)
-  }
-  const initialAccountControl = await subscribeWithoutStartupDeadlock(acctControl, (st) => {
-    if (st === 'CLOSED' || st === 'CHANNEL_ERROR' || st === 'TIMED_OUT') {
-      process.stderr.write(`\n  ⚠ private account control ${st}; host-changing dashboard actions are unavailable until Realtime reconnects.\n`)
-    }
-  })
-  if (!initialAccountControl.connected) {
-    process.stderr.write(`\n  ◇ private account control not ready at startup (${initialAccountControl.status}) — presence remains available.\n`)
-  }
-
-  // Keep the account JWT fresh so the presence socket never gets deauthed at
-  // expiry (the 2026-06-17 "No bridge connected while sessions run" bug). On each
-  // refresh: persist the rotated refresh token + re-announce presence.
-  const keepFresh = scheduleTokenRefresh({
-    sb,
-    session,
-    onRefreshed: async (s) => {
-      accountAuthState = 'connected'
-      saveAuth(s); pushPresence()
-      await reportAccountAuthState('connected')
-      // Push the rotated owner token to every live child so their authed writes
-      // (code-mockup) never go stale on a long session (whip L16).
-      currentAccessToken = s.access_token || currentAccessToken
-      for (const c of children.values()) { try { c.send({ t: 'token', accessToken: currentAccessToken }) } catch { /* child not ready */ } }
-    },
-    onReconnectRequired: async (error) => {
-      accountAuthState = 'reconnect-required'
-      markAuthReconnectRequired(error?.code || 'refresh-token-invalid')
-      pushPresence()
-      await reportAccountAuthState('reconnect-required')
-      process.stderr.write('\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n')
-    },
-    forceMs: parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS, 10) || 0,
-  })
-
-  // ── cross-machine single active bridge (INV-2) ──────────────────────────────
-  // account.lock guards THIS Mac; this claim guards the ACCOUNT across Macs. We
-  // serve rooms ONLY while we hold the claim. A non-holder stands by (stays alive
-  // for launchd KeepAlive, serves nothing) and takes over only when the holder's
-  // heartbeat goes stale — so two launchd bridges never flap respawning. Two Macs
-  // both serving one account is the cross-machine half of the terminal-reconcile
-  // reap that lost room XE3IQ's history.
-  // Spec: docs/specs/2026-06-25-single-bridge-durable-history.md (INV-2)
-  let claimHeld = false
-  let claimFencing = 0
-  let standbyHost = null
-  // Wall-clock of the last SUCCESSFUL claim RPC. The heartbeat watchdog (below) uses it to
-  // detect a wedged loop and self-heal — the 2026-07-08 outage stood by against its OWN
-  // 564s-stale row because the tick had frozen and the heartbeat simply stopped.
-  let lastClaimOkAt = Date.now()
-  // Presence self-echo watchdog state (2026-07-08 recurrence). claim_bridge rides HTTP and
-  // stays healthy, so claimLoopWedged is blind to a zombie realtime channel where track()
-  // lands nowhere. The server's presence SYNC echoing OUR OWN `machine` key back into
-  // acct.presenceState() is the only proof a track() actually reached the server.
-  let selfEchoMissingSince = 0        // wall-clock we first saw our own key missing (0 = present/ok)
-  let presenceRecycledForMissing = 0  // de-dupe: the missing-since value we already forced a recycle for
-  const refreshClaim = async () => {
-    try {
-      // Time-box the RPC: a half-open realtime socket must not freeze the heartbeat (and
-      // the tick that awaits it) forever. On timeout we throw → keep the prior held state.
-      const { data } = await withTimeout(sb.rpc('claim_bridge', { p_bridge_id: BRIDGE_ID, p_hostname: machine }), 10_000, 'claim_bridge')
-      lastClaimOkAt = Date.now()
-      const c = Array.isArray(data) ? data[0] : data
-      const held = !!c?.held
-      const host = c?.holder_host || '?'
-      if (held && !claimHeld) process.stderr.write(`\n  ◆ holding this account — serving your sessions (single active bridge).\n`)
-      else if (!held && claimHeld) process.stderr.write(`\n  ◇ another device (${host}) took over this account — standing by.\n`)
-      else if (!held && standbyHost !== host) process.stderr.write(`\n  ◇ another device (${host}) is serving this account — standing by.\n    (this Mac takes over automatically if that device goes offline.)\n`)
-      claimHeld = held
-      claimFencing = held && Number.isSafeInteger(Number(c?.fencing)) && Number(c.fencing) > 0 ? Number(c.fencing) : 0
-      standbyHost = held ? null : host
-
-      // ── supervisor claim_tick logging (cascade brg-instrument) ─────────────────
-      if (lastClaimHeld !== held) {
-        console.log(`claim_tick sup=${SUP_ID} held=${held} holder=${held ? machine : host}`)
-        lastClaimHeld = held
-      }
-
-      return held
-    } catch {
-      // Transient claim error: keep serving if we already hold; never START
-      // serving on an unknown claim (that's the double-serve we're preventing).
-      return claimHeld
-    }
-  }
-
-  // ── pair-bus plumbing (function declarations hoist, so order here is free) ──
-  const pairBus = createPairBusBroker({ channels: pairChannels, randomId: randomUUID })
-  const resolveBus = (payload) => pairBus.resolve(payload)
-  const busRequestFirst = (event, payload, timeoutMs) => pairBus.requestFirst(event, payload, timeoutMs)
-  const busRequestCollect = (event, payload, windowMs) => pairBus.requestCollect(event, payload, windowMs)
-  const authorizedPairRooms = async (sourceRoom) => {
-    try {
-      const listed = await withTimeout(sb.rpc('list_pair_rooms', { p_code: sourceRoom }), 2500, 'paired-room roster')
-      if (listed?.error || !Array.isArray(listed?.data)) return { verified: false, rooms: [] }
-      return { verified: true, rooms: listed.data }
-    } catch { return { verified: false, rooms: [] } }
-  }
-  // Inbound cross-room-post rate limit, per partner (a partner's agent posting into
-  // MY rooms spends MY tokens — the runaway-cost backstop, on top of the per-turn cap).
-  const allowInboundPost = (partnerUid) => {
-    const now = Date.now()
-    let b = postBucket.get(partnerUid)
-    if (!b || now >= b.resetAt) { b = { count: 0, resetAt: now + POST_BUCKET.windowMs }; postBucket.set(partnerUid, b) }
-    if (b.count >= POST_BUCKET.max) return false
-    b.count++; return true
-  }
-
-  // ── bus REQUEST handlers (a partner's supervisor → me). partnerUid is bound per
-  // channel, so a request arriving on partner P's bus is trusted as from P (the
-  // channel is RLS-gated to {me, P}); I only ever answer for rooms I serve AND share
-  // with P (roomPartner === P) — defense in depth behind the channel firewall.
-  const onPeerListReq = (partnerUid, ch, payload) => {
-    // EN-M4 — the kill-switch must gate the ANSWERING side too. TP_CROSSROOM_OFF on THIS
-    // device means "no cross-session reach here", which has to include refusing to EXPOSE
-    // this device's rooms to a peer — otherwise a partner still reads in while you've opted
-    // out. (TP_PAIRBUS_OFF already disables the bus entirely.)
-    if (process.env.TP_PAIRBUS_OFF === '1' || process.env.TP_CROSSROOM_OFF === '1') return
-    const rooms = [...children.keys()].filter((r) => roomPartner.get(r) === partnerUid).map((r) => ({ code: r, name: roomNames.get(r) || null, host: machine }))
-    try { ch.send({ type: 'broadcast', event: 'peer-list-res', payload: { nonce: payload?.nonce, rooms } }) } catch { /* channel down */ }
-  }
-  const onPeerPeekReq = (partnerUid, ch, payload) => {
-    const reply = (extra) => { try { ch.send({ type: 'broadcast', event: 'peer-peek-res', payload: { nonce: payload?.nonce, ...extra } }) } catch { /* channel down */ } }
-    if (process.env.TP_PAIRBUS_OFF === '1' || process.env.TP_CROSSROOM_OFF === '1') return reply({ error: 'Cross-session reach is off on this device.' })
-    const target = String(payload?.targetRoom || '').toUpperCase().trim()
-    const tc = children.get(target)
-    if (!tc || roomPartner.get(target) !== partnerUid) return reply({ error: `Room ${target} is not a room this device shares with you.` })
-    const reqId = randomUUID()
-    pairPending.set(reqId, { reply: (mm) => reply({ text: mm.text, error: mm.error }), askerRoom: null })
-    try { tc.send({ t: 'pair-peek-local', reqId, terminal: payload.terminal, lines: payload.lines }) }
-    catch { pairPending.delete(reqId); reply({ error: `Could not reach room ${target}.` }) }
-  }
-  const onPeerPostReq = (partnerUid, ch, payload) => {
-    const reply = (extra) => { try { ch.send({ type: 'broadcast', event: 'peer-post-res', payload: { nonce: payload?.nonce, ...extra } }) } catch { /* channel down */ } }
-    if (process.env.TP_PAIRBUS_OFF === '1') return reply({ error: 'Cross-room posting is off on this device.' })
-    if (!allowInboundPost(partnerUid)) return reply({ error: 'Too many cross-room posts to this device right now — try again shortly.' })
-    const target = String(payload?.targetRoom || '').toUpperCase().trim()
-    const tc = children.get(target)
-    if (!tc || roomPartner.get(target) !== partnerUid) return reply({ error: `Room ${target} is not a room this device shares with you.` })
-    const reqId = randomUUID()
-    pairPending.set(reqId, { reply: (mm) => reply({ ok: mm.ok, ref: mm.ref, error: mm.error }), askerRoom: null })
-    try { tc.send({ t: 'pair-post-local', reqId, fromRoom: payload.fromRoom, fromHost: payload.fromHost, fromTerminalName: payload.fromTerminalName, text: payload.text, terminal: payload.terminal }) }
-    catch { pairPending.delete(reqId); reply({ error: `Could not reach room ${target}.` }) }
-  }
-  // Join the per-pair bus for `partnerUid` (idempotent). The channel is PRIVATE so
-  // Realtime Authorization (RLS on realtime.messages, migration 20260630120000) gates
-  // both join and broadcast to the two real partners — a stranger never joins.
-  const subscribePairBus = (partnerUid, key) => {
-    if (!partnerUid || pairChannels.has(partnerUid)) return
-    const topic = pairTopic(key); if (!topic) return
-    const ch = sb.channel(topic, { config: { private: true, broadcast: { self: false } } })
-    const entry = { channel: ch, key, status: PAIR_BUS_STATUS.JOINING }
-    ch.on('broadcast', { event: 'peer-list-req' }, ({ payload }) => onPeerListReq(partnerUid, ch, payload))
-      .on('broadcast', { event: 'peer-list-res' }, ({ payload }) => resolveBus(payload))
-      .on('broadcast', { event: 'peer-peek-req' }, ({ payload }) => onPeerPeekReq(partnerUid, ch, payload))
-      .on('broadcast', { event: 'peer-peek-res' }, ({ payload }) => resolveBus(payload))
-      .on('broadcast', { event: 'peer-post-req' }, ({ payload }) => onPeerPostReq(partnerUid, ch, payload))
-      .on('broadcast', { event: 'peer-post-res' }, ({ payload }) => resolveBus(payload))
-      .subscribe((status) => {
-        entry.status = pairBusStatusFromRealtime(status)
-        if (status === 'SUBSCRIBED') process.stderr.write(`\n  ◆ pair bus subscribed — cross-machine Ensemble reach with your partner.\n`)
-        else if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') process.stderr.write(`\n  ◇ pair bus ${status.toLowerCase().replace('_', ' ')} — partner sessions are offline until it reconnects.\n`)
-      })
-    pairChannels.set(partnerUid, entry)
-  }
-  // Forward a local child's cross-room request to the bus (Tier 2 peek / Tier 3 post)
-  // when the target room is NOT served on this machine. Used inside the child handler.
-  const busPeek = (targetRoom, terminal, lines) => busRequestFirst('peer-peek-req', { targetRoom, terminal, lines }, CROSSROOM_BUS.busTimeoutMs)
-  const busPost = (targetRoom, terminal, text, fromRoom, fromTerminalName) => busRequestFirst('peer-post-req', { targetRoom, terminal, text, fromRoom, fromHost: machine, fromTerminalName }, 180_000)
-
-  // Re-entrancy guard: bind-room fires tick() AND a 15s interval fires tick(); tick
-  // awaits a code_sessions query before children.set(), so two overlapping runs can
-  // both see children.has(room) false and DOUBLE-SPAWN a 2nd bridge for one room
-  // (two bridges per room = the CASCADE-delete / ghost-terminal hazard). Serialize.
-  // SELF-HEALING guard (2026-07-08): a plain boolean stuck `true` was the wedge — a tick
-  // that hung on a half-open socket never ran its `finally`, so `ticking` stayed true and
-  // every later tick returned early forever (heartbeat dead, own row goes 564s stale). Use
-  // a start-timestamp instead: a prior run older than 60s is presumed wedged and we proceed
-  // anyway (the timed-out awaits inside now guarantee it eventually unwinds).
-  let tickingSince = 0
-  const tick = async () => {
-    const now = Date.now()
-    if (tickingSince && now - tickingSince < 60_000) return   // a genuine in-flight tick
-    tickingSince = now
-    try { await tickBody() } finally { if (tickingSince === now) tickingSince = 0 }
-  }
-  requestDiscoveryTick = () => { void tick().catch(() => {}) }
-  // Expose for the watchdog to force-unwedge the guard after a reconnect.
-  const clearTickGuard = () => { tickingSince = 0 }
-  const tickBody = async () => {
-    // Hold the account claim before serving anything (cross-machine guard). When
-    // standing by, make sure we're serving nothing and wait for the next tick.
-    if (!(await refreshClaim())) {
-      if (children.size) for (const [, ch] of children) { try { ch.kill('SIGTERM') } catch { /* noop */ } }
-      pushPresence()
-      return
-    }
-    let rooms = []
-    let discoverySucceeded = false
-    const me = session.user.id
-    try {
-      // Discovery (Contract C-CODE-2, owner-only since 2026-07-06): a host bridges ONLY
-      // the sessions it OWNS. RLS returns owned OR participant rooms; the owner filter
-      // keeps rooms you merely JOINED as a guest out of auto-serve — your machine never
-      // spawns into another owner's session (cross-person serving removed; pairing is
-      // read-only peer peek, not hosting). The web watches tpacct:<session-owner>.
-      const { data, error } = await sb.from('code_sessions')
-        .select('code,name,last_active_at,owner_id,participants,closed_at')
-        .eq('owner_id', me)
-        .is('closed_at', null)
-        .order('last_active_at', { ascending: false })
-        .limit(20)
-      if (error) throw error
-      rooms = data || []
-      discoverySucceeded = true
-      // Prune refused entries for rooms we can no longer serve — owned OR granted (only
-      // on a SUCCESSFUL fetch, so a transient query error never wipes the set).
-      const servableCodes = new Set(rooms.map((r) => r.code))
-      for (const c of [...refused.keys()]) if (!servableCodes.has(c)) refused.delete(c)
-    } catch { /* transient — keep existing children, retry next tick */ }
-    // The realtime shutdown broadcast is an acceleration, never the lifecycle
-    // authority. Reconcile every successful discovery read so a bridge that missed
-    // `session-deleted` still stops after its room is closed, deleted, or transferred.
-    if (discoverySucceeded) {
-      for (const room of supervisorRoomsToStop({ rooms, childRooms: children.keys(), myUid: me })) {
-        const child = children.get(room)
-        if (!child) continue
-        console.log(`child_retire sup=${SUP_ID} room=${room} pid=${child.pid || '?'} reason=not-active-owned`)
-        try { child.kill('SIGTERM') } catch { /* child exit reconciliation retries next tick */ }
-      }
-    }
-    const dirs = loadDirs()
-    const served = loadServed()
-    for (const r of rooms) {
-      const room = r.code
-      if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
-      // Defense-in-depth behind the owner-only query above: serve iff we OWN the room.
-      if (!supervisorServes({ ownerId: r.owner_id, myUid: me, closedAt: r.closed_at })) continue
-      // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
-      // to auto-serve an unbound room from $HOME — that strips the agent's resume context
-      // (cwd-keyed SDK sessions) and shows your home folder as the repo (FVIHV1DE).
-      // Default-dir precedence for an unbound room: explicit user default > Claude Code's
-      // most-recent project dir (zero-config — where you actually code) > launch cwd ($HOME,
-      // which then gets refused). So a new session auto-attaches to your active repo with no setup.
-      const choice = resolveServeDir({ bound: dirs[room], remembered: served[room], defaultDir: loadDefaultDir() || claudeRecentProjectDir() || DEFAULT_DIR, home: os.homedir() })
-      if (choice.refuse) {
-        refused.set(room, choice.reason)
-        if (!warned.has(room)) {
-          warned.add(room)
-          const why = choice.reason === 'home'
-            ? `no project directory set — refusing to serve it from your home folder (${choice.dir}); the agent would lose its session context and the room would show "${path.basename(choice.dir)}" as the repo.`
-            : 'no directory to serve it from.'
-          process.stderr.write(`\n  ◇ ${room}: ${why}\n    Bind it to its repo:  ${pairCli('bind', room, '<repo-dir>')}\n`)
-        }
-        continue
-      }
-      const dir = choice.dir
-      if (!fs.existsSync(dir)) {
-        refused.set(room, 'dir-gone')
-        if (!warned.has(room)) { warned.add(room); process.stderr.write(`\n  ◇ ${room}: bound directory is gone (${dir}) — re-bind it.\n`) }
-        continue
-      }
-      warned.delete(room)
-      refused.delete(room)   // about to serve → clear any prior refusal
-      // Learn this room → dir so a later relaunch from $HOME resumes it HERE (the real
-      // repo) instead of the home-dir fallback. Only the auto path is remembered; an
-      // explicit bind already persists in dirs.json.
-      if (choice.fromDefault) rememberServed(room, dir)
-      roomNames.set(room, r.name || null)   // feed list_sessions (cross-room roster)
-      process.stderr.write(`\n  ◆ serving ${room}${r.name ? ` "${r.name}"` : ''}  →  ${dir}${dirs[room] ? '' : ' (default)'}\n`)
-      // Children NEVER self-update (only the supervisor restart re-resolves
-      // @latest); they report idle to us over IPC so we can restart at a moment
-      // when every session is quiet. Strip AUTOUPDATE so an inherited service env
-      // can't make a child self-exit; flag it as an account child instead.
-      const env = { ...process.env, THINKPOOL_PAIR_ACCOUNT_CHILD: '1', TP_ACCOUNT_BRIDGE_ID: BRIDGE_ID, TP_ACCOUNT_BRIDGE_FENCING: String(claimFencing) }
-      delete env.THINKPOOL_PAIR_AUTOUPDATE
-      // Hand the child the owner JWT for authed web writes (code-mockup, L16).
-      if (currentAccessToken) env.TP_ACCESS_TOKEN = currentAccessToken
-
-      // ── supervisor child_spawn logging (cascade brg-instrument) ─────────────────
-      const alreadyHad = children.has(room)
-      const memory = hostMemoryAdmission(`spawn the room bridge for ${room}`)
-      if (!memory.ok) {
-        if (!warned.has(`memory:${room}`)) {
-          warned.add(`memory:${room}`)
-          process.stderr.write(`\n  ◇ ${room}: ${memory.reason}\n`)
-        }
-        refused.set(room, 'host-memory')
-        continue
-      }
-      warned.delete(`memory:${room}`)
-      const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
-      console.log(`child_spawn sup=${SUP_ID} room=${room} pid=${child.pid} dir=${dir} had_prior=${alreadyHad}`)
-
-      children.set(room, child)
-      readyRooms.delete(room)
-      childIdle.set(room, false)   // unknown until it reports → never restart a fresh child
-      childBetween.set(room, false)
-      childPeer.set(room, false)
-      child.on('message', (m) => {
-        if (!m) return
-        if (m.t === 'room-ready') {
-          readyRooms.add(room)
-          console.log(`child_ready sup=${SUP_ID} room=${room} pid=${child.pid}`)
-          pushPresence()
-        }
-        else if (m.t === 'idle') {
-          childIdle.set(room, !!m.idle)
-          childBetween.set(room, m.between != null ? !!m.between : !!m.idle)
-          childPeer.set(room, !!m.webPeer)
-          void applyIfIdle()
-        }
-        else if (m.t === 'busy') { childIdle.set(room, false); childBetween.set(room, false) }
-        else if (m.t === 'restart-probe-result') {
-          const probe = restartProbes.get(m.nonce)
-          if (!probe || !probe.pending.has(room) || children.get(room) !== child) return
-          probe.pending.delete(room)
-          probe.ok = probe.ok && m.between === true
-          childBetween.set(room, m.between === true)
-          if (!probe.pending.size) {
-            clearTimeout(probe.timer)
-            restartProbes.delete(m.nonce)
-            probe.resolve(probe.ok)
-          }
-        }
-        else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
-        // ── Thinkpool Ensemble cross-ROOM routing ──────────────────────────────
-        // `room` here is the room that sent the message (this closure is per-child).
-        // A target room may be LOCAL (another child on this machine — Tier 1 peek /
-        // local Tier 3 post) or REMOTE (the partner's machine, over the pair bus —
-        // Tier 2 peek / cross-machine Tier 3 post). list merges both.
-        else if (m.t === 'pair-list-req') {
-          ;(async () => {
-            if (process.env.TP_CROSSROOM_OFF === '1') { try { child.send({ t: 'pair-list-res', reqId: m.reqId, rooms: [], error: 'Cross-session reach is turned off on this bridge.' }) } catch { /* child gone */ } return }
-            const local = [...children.keys()].filter((r) => r !== room).map((r) => ({ code: r, name: roomNames.get(r) || null }))
-            let authorized = []; let replies = []
-            if (process.env.TP_PAIRBUS_OFF !== '1') {
-              const result = await Promise.all([
-                authorizedPairRooms(room),
-                pairChannels.size ? busRequestCollect('peer-list-req', {}, 1200) : Promise.resolve([]),
-              ])
-              authorized = result[0].rooms; replies = result[1]
-            }
-            const remote = mergePairRoomRoster({ authorized, replies, myUid: session.user.id, localCodes: children.keys() })
-            try { child.send({ t: 'pair-list-res', reqId: m.reqId, rooms: [...local, ...remote] }) } catch { /* child gone */ }
-          })()
-        }
-        else if (m.t === 'pair-peek-req') {
-          ;(async () => {
-            const reply = (extra) => { try { child.send({ t: 'pair-peek-res', reqId: m.reqId, ...extra }) } catch { /* child gone */ } }
-            if (process.env.TP_CROSSROOM_OFF === '1') return reply({ error: 'Cross-session reach is turned off on this bridge.' })
-            const target = String(m.targetRoom || '').toUpperCase().trim()
-            if (!target || target === room) return reply({ error: `${target || 'That'} is not another of your active sessions.` })
-            const tc = children.get(target)
-            if (tc) {   // LOCAL target — forward to that child; route its reply home
-              const reqId = randomUUID()
-              pairPending.set(reqId, { reply: (mm) => reply({ text: mm.text, error: mm.error }), askerRoom: room })
-              try { tc.send({ t: 'pair-peek-local', reqId, terminal: m.terminal, lines: m.lines }) }
-              catch { pairPending.delete(reqId); reply({ error: `Could not reach session ${target}.` }) }
-              return
-            }
-            // REMOTE target — ask the pair bus(es).
-            if (process.env.TP_PAIRBUS_OFF === '1') return reply({ error: 'Cross-session reach is turned off on this bridge.' })
-            const [authorized, live] = await Promise.all([
-              authorizedPairRooms(room),
-              pairChannels.size ? busRequestCollect('peer-list-req', {}, 800) : Promise.resolve([]),
-            ])
-            if (authorized.verified && !authorized.rooms.some((r) => r?.code === target && r?.owner_id !== session.user.id)) return reply({ error: `Room ${target} is not shared with this pair.` })
-            if (!pairChannels.size) return reply({ error: authorized.verified ? `Room ${target} is paired with you, but its host bridge is offline.` : `Session ${target} is not running on this machine, and no pair bus is open to reach it.` })
-            if (!live.some((p) => p?.rooms?.some((r) => r?.code === target))) return reply({ error: `Room ${target} is paired with you, but its host bridge is offline.` })
-            const res = await busPeek(target, m.terminal, m.lines)
-            if (!res) return reply({ error: `Room ${target} did not respond — it may be offline, or not shared with you.` })
-            reply({ text: res.text, error: res.error })
-          })()
-        }
-        else if (m.t === 'pair-post-req') {   // Tier 3 cross-room post (sender card already approved)
-          ;(async () => {
-            const reply = (extra) => { try { child.send({ t: 'pair-post-res', reqId: m.reqId, ...extra }) } catch { /* child gone */ } }
-            if (process.env.TP_PAIRBUS_OFF === '1') return reply({ error: 'Cross-room posting is turned off on this bridge.' })
-            const target = String(m.targetRoom || '').toUpperCase().trim()
-            if (!target || target === room) return reply({ error: `${target || 'That'} is not another of your sessions.` })
-            const tc = children.get(target)
-            if (tc) {   // LOCAL target — the target child raises its own receipt card
-              const reqId = randomUUID()
-              pairPending.set(reqId, { reply: (mm) => reply({ ok: mm.ok, ref: mm.ref, error: mm.error }), askerRoom: room })
-              try { tc.send({ t: 'pair-post-local', reqId, fromRoom: room, fromHost: machine, fromTerminalName: m.fromTerminalName, text: m.text, terminal: m.terminal }) }
-              catch { pairPending.delete(reqId); reply({ error: `Could not reach session ${target}.` }) }
-              return
-            }
-            // REMOTE target — prove the partner's bridge is currently answering
-            // before starting a 180s human-approval wait. The DB-backed roster may
-            // legitimately list an offline paired room; reachability comes from the bus.
-            const [authorized, live] = await Promise.all([
-              authorizedPairRooms(room),
-              pairChannels.size ? busRequestCollect('peer-list-req', {}, 1200) : Promise.resolve([]),
-            ])
-            if (authorized.verified && !authorized.rooms.some((r) => r?.code === target && r?.owner_id !== session.user.id)) return reply({ error: `Room ${target} is not shared with this pair.` })
-            if (!pairChannels.size) return reply({ error: authorized.verified ? `Room ${target} is paired with you, but its host bridge is offline.` : `Room ${target} is not on this machine, and no pair bus is open to reach it.` })
-            if (!live.some((p) => p?.rooms?.some((r) => r?.code === target))) return reply({ error: `Room ${target} is paired with you, but its host bridge is offline — no recipient approval card can be raised yet.` })
-            const res = await busPost(target, m.terminal, m.text, room, m.fromTerminalName)
-            if (!res) return reply({ error: `Room ${target} did not respond to the hand-off in time.` })
-            reply({ ok: res.ok, ref: res.ref, error: res.error })
-          })()
-        }
-        else if (m.t === 'pair-peek-res' || m.t === 'pair-post-res') {
-          // A target child answered — deliver via the stored reply fn (to a local
-          // asker child, or back onto the pair bus for a partner's request).
-          const w = pairPending.get(m.reqId)
-          if (!w) return
-          pairPending.delete(m.reqId)
-          try { w.reply(m) } catch { /* reply path gone */ }
-        }
-      })
-      const dropRoom = (code) => {
-        // ── supervisor child_exit logging (cascade brg-instrument) ─────────────────
-        console.log(`child_exit sup=${SUP_ID} room=${room} pid=${child?.pid || '?'} code=${code || '?'}`)
-
-        children.delete(room); readyRooms.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room); roomNames.delete(room); roomPartner.delete(room)   // re-served on the next tick
-        // Fail any in-flight cross-room peeks/posts this dead room had ASKED (bus-origin
-        // entries have askerRoom null and just time out on their own).
-        for (const [reqId, w] of pairPending) { if (w?.askerRoom === room) pairPending.delete(reqId) }
-      }
-      child.on('exit', (code) => dropRoom(code))
-      // A spawn that never starts (execPath/cwd vanished between the existsSync check and
-      // spawn) emits 'error', NOT 'exit'. Without this handler the stale children-map entry
-      // would block re-serving forever AND an unhandled 'error' would crash the supervisor.
-      child.on('error', (e) => {
-        dropRoom()
-        try { process.stderr.write(`\n  ◇ ${room}: failed to launch its bridge (${e?.message || e}) — retrying next tick.\n`) } catch { /* noop */ }
-      })
-      // If an update is already pending, tell the freshly-served child immediately so
-      // its room shows the "update ready" chip without waiting for the next poll.
-      if (pendingUpdate) { try { child.send({ t: 'update-available', version: pendingUpdate }) } catch { /* child not ready */ } }
-    }
-    // ── reconcile pair buses (Tier 2/3) — derive each served 2-person room's partner
-    // and join that pair's bus. One channel per DISTINCT partner (many shared rooms →
-    // one bus). roomPartner feeds the bus handlers' "is this room shared with P" check.
-    if (process.env.TP_PAIRBUS_OFF !== '1') {
-      for (const r of rooms) {
-        if (!r?.code || !children.has(r.code)) continue   // only rooms we actually serve
-        const parts = Array.isArray(r.participants) ? r.participants : []
-        const partner = parts.length === 2 ? parts.find((p) => p && p !== session.user.id) : null
-        if (!partner) { roomPartner.delete(r.code); continue }
-        roomPartner.set(r.code, partner)
-        const key = pairKeyFor(session.user.id, partner)
-        if (key) subscribePairBus(partner, key)
-      }
-    }
-    pushPresence()
-  }
-
-  await tick()
-  const iv = setInterval(tick, 15000)
-  initialTickDone = true
-  publishReadiness()
-  releaseStartupAnchor()
-  const updateTimers = []   // auto-update poll/apply timers — cleared in stop() so none fire post-exit
-  let stopping = false
-
-  // ── claim/heartbeat watchdog (2026-07-08) ──────────────────────────────────
-  // The 15s tick carries the claim heartbeat. If anything inside a tick wedged (a half-open
-  // realtime socket), the heartbeat stopped, our own claim row went stale, and — because a
-  // same-host holder is never displaced by itself — the bridge stood by FOREVER against its
-  // own ghost (the 564s-stale-own-hostname outage). This timer runs on its OWN interval so a
-  // wedged tick can't starve it: when the claim has been quiet ≥2 ticks it nudges realtime
-  // to reconnect, force-clears the re-entrancy guard, and re-issues the heartbeat directly
-  // (claim_bridge is a plain HTTP RPC — it recovers even while the socket is still flapping).
-  let claimRecoveryAttempt = 0
-  let claimRecoveryNextAt = 0
-  let claimRecoveryInFlight = false
-  const heartbeatWatch = setInterval(async () => {
-    if (stopping) return
-    const now = Date.now()
-    if (!claimLoopWedged({ lastClaimOkAt, now })) {
-      claimRecoveryAttempt = 0; claimRecoveryNextAt = 0
-      return
-    }
-    if (claimRecoveryInFlight || now < claimRecoveryNextAt) return
-    claimRecoveryInFlight = true
-    const waitMs = recoveryBackoffMs(claimRecoveryAttempt)
-    claimRecoveryNextAt = now + waitMs
-    claimRecoveryAttempt += 1
-    console.log(`claim_watchdog sup=${SUP_ID} quiet_ms=${now - lastClaimOkAt} attempt=${claimRecoveryAttempt} next_ms=${waitMs} — reconnecting realtime + re-claiming`)
-    try { sb.realtime?.connect?.() } catch { /* noop */ }
-    clearTickGuard()   // unwedge the guard so the next scheduled tick can run
-    try { await refreshClaim(); pushPresence() } catch { /* the backed-off attempt retries */ }
-    finally { claimRecoveryInFlight = false }
-  }, 20_000)
-  heartbeatWatch.unref?.()
-
-  // ── presence self-echo watchdog (2026-07-08) ───────────────────────────────
-  // The claim heartbeat rides claim_bridge (plain HTTP) so it recovers even while the
-  // realtime socket is a zombie — which is exactly why claimLoopWedged can't see the case
-  // where the socket went CLOSED-then-half-open and channel.track() lands nowhere FOREVER,
-  // leaving the dashboard on "No bridge connected" while children serve rooms. The server's
-  // presence SYNC is the only proof: if our own `machine` key is absent from
-  // acct.presenceState() while we hold the claim, the track never reached the server. Runs on
-  // its OWN interval (like the claim watchdog) so a wedged tick can't starve it. Two-stage
-  // escalation via the pure predicate:
-  //   ≥~60s missing → recycle the realtime socket (full disconnect+connect — the connect()-only
-  //                   nudge already in the subscribe/CLOSED handlers provably didn't recover it)
-  //   ≥~90s more    → exit(1); launchd KeepAlive / systemd reruns clean, children persist and
-  //                   resume from the session-store (the same invisible bounce the dashboard
-  //                   Restart button already relies on). Guarded: never while stopping, only
-  //                   while claimHeld (a standby bridge doesn't track).
-  const presenceWatch = setInterval(() => {
-    if (stopping) return
-    const now = Date.now()
-    const recoveryEligible = presenceRecoveryEligible({ claimHeld, lastClaimOkAt, now })
-    let present = false
-    try { present = !!acct.presenceState?.()[machine] } catch { present = false }
-    const observation = presenceSelfEchoObservation({
-      // A fresh HTTP claim distinguishes a Realtime-only zombie from a full
-      // connectivity outage. In the latter case, wait in-process; a respawn cannot
-      // restore the network and launchd would otherwise loop indefinitely.
-      tracking: recoveryEligible,
-      subscribedAt: Math.max(presenceEvidence.subscribedAt, lastClaimOkAt),
-      syncSeenAt: presenceEvidence.syncSeenAt,
-      present,
-      missingSince: selfEchoMissingSince,
-      now,
-    })
-    selfEchoMissingSince = observation.missingSince
-    if (!selfEchoMissingSince) { presenceRecycledForMissing = 0; return }
-    const verdict = observation.verdict
-    if (verdict === 'recycle') {
-      if (presenceRecycledForMissing === selfEchoMissingSince) return   // already recycled this episode — wait out the respawn window
-      presenceRecycledForMissing = selfEchoMissingSince
-      console.log(`presence_watchdog sup=${SUP_ID} action=recycle missing_ms=${now - selfEchoMissingSince} track=${lastTrackStatus} — full realtime disconnect+reconnect`)
-      try { sb.realtime?.disconnect?.() } catch { /* noop */ }
-      try { sb.realtime?.connect?.() } catch { /* noop */ }
-      try { pushPresence() } catch { /* re-announced on the next SUBSCRIBED too */ }
-    } else if (verdict === 'respawn') {
-      console.log(`presence_watchdog sup=${SUP_ID} action=respawn missing_ms=${now - selfEchoMissingSince} track=${lastTrackStatus} — recycle failed, exiting for a clean supervisor respawn`)
-      process.exit(1)
-    }
-  }, 15_000)
-  presenceWatch.unref?.()
-  // restart-vs-stop is the ONLY difference in exit code: a web "restart" sets this so
-  // we exit non-zero (every supervisor respawns); a normal stop/shutdown exits 0.
-  const stop = (sig) => {
-    if (stopping) return; stopping = true
-    const code = restarting ? 1 : 0
-
-    // ── supervisor stand-down logging (cascade brg-instrument) ─────────────────
-    console.log(`supervisor_stop sup=${SUP_ID} reason=${sig || 'unknown'} restarting=${restarting} children=${children.size}`)
-    clearInterval(iv)
-    clearInterval(heartbeatWatch)
-    clearInterval(presenceWatch)
-    for (const t of updateTimers) { try { clearInterval(t) } catch { /* noop */ } }   // clearInterval clears Timeouts too
-    keepFresh.cancel()
-    clearSupervisorReady({ pid: process.pid })
-    releaseSingleton()
-    for (const c of children.values()) { try { c.kill(sig || 'SIGTERM') } catch { /* noop */ } }
-    pairBus.close()
-    for (const { channel } of pairChannels.values()) { try { sb.removeChannel(channel) } catch { /* noop */ } }   // tear down pair buses (Tier 2/3)
-    // Flush the presence LEAVE before exiting so the dashboard flips to
-    // "not connected" in realtime (don't fire-and-forget the untrack).
-    //
-    // Shutdown teardown; the process is already exiting. A lost `release_bridge` leaves
-    // the claim to expire on its own TTL — degraded (the dashboard shows "connected"
-    // until it lapses), never lost data. No caller remains to surface an error to, and a
-    // throw here would skip process.exit.
-    // fail-open-ok: exit-path teardown; a lost release_bridge expires on its own TTL
-    ;(async () => { try { if (claimHeld) await sb.rpc('release_bridge', { p_bridge_id: BRIDGE_ID }) } catch { /* noop */ } try { await acct.untrack() } catch { /* noop */ } try { await sb.removeChannel(acctControl) } catch { /* noop */ } try { await sb.removeChannel(acct) } catch { /* noop */ } process.exit(code) })()
-    setTimeout(() => process.exit(code), 1500)   // hard backstop if the flush hangs
-  }
-  for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => stop(sig))
-
-  // ── Slice 3 apply-gate (function scope so the child-IPC handler can call it) ──
-  // Restart the account bridge to apply a pending update ONLY when it's safe: every
-  // child idle (between turns) AND either a user clicked apply OR nobody's watching
-  // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
-  function confirmChildrenBetweenTurns(timeoutMs = 2500) {
-    const targets = [...children.entries()]
-    if (!targets.length) return Promise.resolve(true)
-    const nonce = randomUUID()
-    return new Promise((resolve) => {
-      const probe = { pending: new Set(targets.map(([room]) => room)), ok: true, resolve, timer: null }
-      probe.timer = setTimeout(() => {
-        restartProbes.delete(nonce)
-        resolve(false)
-      }, timeoutMs)
-      probe.timer.unref?.()
-      restartProbes.set(nonce, probe)
-      for (const [room, child] of targets) {
-        try { child.send({ t: 'restart-probe', nonce }) }
-        catch {
-          probe.pending.delete(room)
-          probe.ok = false
-        }
-      }
-      if (!probe.pending.size) {
-        clearTimeout(probe.timer)
-        restartProbes.delete(nonce)
-        resolve(probe.ok)
-      }
-    })
-  }
-
-  async function applyIfIdle() {
-    if (applyingUpdate || !isSafeToRestart({ pendingUpdate, stopping, childIdle, childBetween, childPeer, requested: applyRequested })) return
-    applyingUpdate = true
-    // The 5s heartbeat is a dashboard signal, not an atomic restart barrier. Re-read
-    // every child at the destructive edge so a turn that began after the last sample
-    // vetoes the update instead of becoming an interrupted recovery.
-    if (!await confirmChildrenBetweenTurns()) {
-      applyingUpdate = false
-      process.stderr.write('\n  ◆ bridge update still queued — an agent became active before the restart boundary.\n')
-      return
-    }
-    process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
-    try {
-      const svc = await import('./service.mjs')
-      if (svc.serviceActive(null) && svc.applyStagedServiceUpdate(null, pendingUpdate) !== false) return
-    } catch { /* fall back to the legacy supervised restart below */ }
-    applyingUpdate = false
-    restarting = true
-    if (!runsAsService()) {
-      try { spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref() } catch { /* noop */ }
-    }
-    stop('SIGTERM')
-  }
-
-  // ── auto-update (account-service tier only) ───────────────────────────────
-  // launchd (KeepAlive) / systemd (Restart=always) re-run `npx -y
-  // thinkpool-pair@latest` (no room) on every restart, so a clean exit here
-  // pulls the newest publish — and because the new supervisor re-spawns children
-  // from the newly-resolved bridge, the room children get the new version too
-  // (they can't self-update; only this restart propagates it). Gated to
-  // THINKPOOL_PAIR_AUTOUPDATE=1 (set by the account service installer). We wait
-  // for EVERY child to report idle so no one's mid-keystroke when we cycle; each
-  // child persists + resumes its session, so the restart is invisible in-room.
-  //   THINKPOOL_PAIR_UPDATE_INTERVAL  registry poll seconds (default 1800)
-  //   THINKPOOL_PAIR_UPDATE_IDLE      child idle seconds before a restart (default 90)
-  if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
-    const POLL_MS = Math.max(60, parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL, 10) || 1800) * 1000
-    // Strictly-newer x.y.z core; ignore prerelease tails (never downgrade/churn).
-    const isNewer = (latest, cur) => {
-      const core = (v) => String(v).split('-')[0].split('.').map((n) => parseInt(n, 10) || 0)
-      const a = core(latest), b = core(cur)
-      for (let i = 0; i < 3; i++) { if ((a[i] || 0) > (b[i] || 0)) return true; if ((a[i] || 0) < (b[i] || 0)) return false }
-      return false
-    }
-    const fetchLatest = async () => {
-      const ctrl = new AbortController()
-      const to = setTimeout(() => ctrl.abort(), 8000)
-      try {
-        const r = await fetch('https://registry.npmjs.org/thinkpool-pair/latest', { signal: ctrl.signal, headers: { accept: 'application/json' } })
-        if (!r.ok) return null
-        const j = await r.json()
-        return typeof j?.version === 'string' ? j.version : null
-      } catch { return null } finally { clearTimeout(to) }
-    }
-    const check = async () => {
-      const latest = await fetchLatest()
-      if (latest && isNewer(latest, VERSION)) {
-        if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — "update ready" surfaced to each room; applies between turns.\n`)
-        // Provision while children continue running. applyIfIdle performs the
-        // final safety check only after this slow network/install work is done.
-        try {
-          const svc = await import('./service.mjs')
-          svc.provisionRuntime(latest)
-        } catch (error) {
-          process.stderr.write(`\n  ⚠ bridge ${latest} could not be staged yet: ${error?.message || error}\n`)
-          return
-        }
-        pendingUpdate = latest
-        // Tell every served child so its room shows the chip (children never self-update;
-        // only this supervisor restart re-resolves @latest). Slice 3 nudge.
-        for (const c of children.values()) { try { c.send({ t: 'update-available', version: latest }) } catch { /* child not ready */ } }
-        applyIfIdle()   // unattended fallback fires here when no room has a web peer
-      }
-    }
-    updateTimers.push(setInterval(check, POLL_MS).unref())
-    updateTimers.push(setInterval(applyIfIdle, 15000).unref())
-    updateTimers.push(setTimeout(check, 60000).unref())
-  }
-
-  await new Promise(() => {})
-}
+import{spawn as e}from"node:child_process";import{fileURLToPath as r}from"node:url";import{randomUUID as t}from"node:crypto";import o from"node:path";import n from"node:fs";import{createClient as s}from"@supabase/supabase-js";import i from"node:os";import{saveAuth as a,loadAuth as c,markAuthReconnectRequired as d,loadDirs as l,bindDir as p,loadServed as u,rememberServed as m,loadDefaultDir as f,saveDefaultDir as h,claudeRecentProjectDir as y}from"./auth-store.mjs";import{isSafeToRestart as v}from"./update-gate.mjs";import{makeThrottledTrack as g,presenceRecoveryEligible as w,presenceSelfEchoObservation as _,recoveryBackoffMs as b,reducePresenceChannelEvidence as k,subscribeWithoutStartupDeadlock as $}from"./presence.mjs";import{publicKeyB64 as R,announceProviders as S,listProviders as T,addProvider as I,addProviderModel as O,removeProvider as x,unseal as C}from"./providers.mjs";import{supervisorServes as A,supervisorRoomsToStop as P}from"./serve-consent.mjs";import{resolveServeDir as N}from"./serve-dir.mjs";import{pairKeyFor as E,pairTopic as q,CROSSROOM_BUS as M}from"./cross-terminal.mjs";import{installedAgentCommands as U}from"./agent-detect.mjs";import{agentVisibilityStates as D,setAgentPickerVisibility as j}from"./agent-visibility.mjs";import{hostMemoryAdmission as F}from"./host-memory.mjs";import{createPairBusBroker as L,mergePairRoomRoster as H,pairBusStatusFromRealtime as B,PAIR_BUS_STATUS as G}from"./pair-bus.mjs";import{clearSupervisorReady as z,supervisorPresenceEchoed as K,writeSupervisorReady as W}from"./supervisor-ready.mjs";import{PAIR_CLI as J,pairCli as V}from"./command-guidance.mjs";import{syncRealtimeAuth as X}from"./design-edit.mjs";const Y=(()=>{try{return JSON.parse(n.readFileSync(new URL("./package.json",import.meta.url),"utf8")).version}catch{return null}})(),Z=r(new URL("./bridge.mjs",import.meta.url));export function createStartupAnchor({set:e=setInterval,clear:r=clearInterval}={}){const t=e(()=>{},6e4);let o=!1;return()=>{o||(o=!0,r(t))}}const Q=o.join(i.homedir(),".thinkpool-pair","account.lock");function ee(e){if(!e||e===process.pid)return!1;try{return process.kill(e,0),!0}catch(e){return"EPERM"===e.code}}export function acquireSingleton(e=Q){try{n.mkdirSync(o.dirname(e),{recursive:!0})}catch{return!1}for(let r=0;r<3;r++)try{const r=n.openSync(e,"wx");return n.writeSync(r,String(process.pid)),n.closeSync(r),!0}catch(r){if("EEXIST"!==r.code)return!1;let t=0;try{t=parseInt(n.readFileSync(e,"utf8").trim(),10)||0}catch{return!1}if(ee(t))return!1;try{n.rmSync(e,{force:!0})}catch{return!1}}return!1}export function releaseSingleton(e=Q){try{(parseInt(n.readFileSync(e,"utf8").trim(),10)||0)===process.pid&&n.rmSync(e,{force:!0})}catch{}}export function acquireMachineLock(e=Q){return acquireSingleton(e)}export function releaseMachineLock(e=Q){return releaseSingleton(e)}export function shouldHoldMachineLock(e=process.env){return"1"!==e.THINKPOOL_PAIR_ACCOUNT_CHILD}export async function runLogin(e,r,t){const o=s(e,r,{auth:{persistSession:!1}}),{data:n,error:i}=await o.rpc("start_device_code"),c=Array.isArray(n)?n[0]:n;!i&&c?.device_code||(process.stderr.write(`\n  ✗ couldn't start login: ${i?.message||"no response"}\n`),process.exit(1));const{device_code:d,user_code:l}=c,p=`${t}/code/link?c=${encodeURIComponent(l)}`;process.stderr.write(`\n  ◆ Link this device to your ThinkPool account.\n    Open (signed in) and approve:\n\n    ${p}\n\n    code:  ${l}\n\n  Waiting…\n`);const u=Date.now(),m=async()=>{Date.now()-u>3e5&&(process.stderr.write(`\n  ◇ link timed out — run \`${V("login")}\` again.\n`),process.exit(1));try{const{data:e}=await o.rpc("claim_device_code",{p_device_code:d});"approved"===e?.status&&e.session?.refresh_token&&(a(e.session),process.stderr.write(`\n  ◆ linked as ${e.session.email||"your account"}. You can close the browser tab.\n    Now run:  ${J}\n`),process.exit(0)),"expired"!==e?.status&&"not_found"!==e?.status||(process.stderr.write(`\n  ◇ link expired — run \`${V("login")}\` again.\n`),process.exit(1))}catch{}setTimeout(m,3e3)};m(),await new Promise(()=>{})}const re=e=>new Promise(r=>{const t=setTimeout(r,e);t.unref?.()});export function withTimeout(e,r,t="op"){return new Promise((o,n)=>{const s=setTimeout(()=>n(new Error(`${t} timed out after ${r}ms`)),r);s.unref?.(),Promise.resolve(e).then(e=>{clearTimeout(s),o(e)},e=>{clearTimeout(s),n(e)})})}export function savedTokenStillValid(e,r=Math.floor(Date.now()/1e3),t=300){if(!e?.access_token)return!1;const o=e.expires_at||function(e){try{const r=String(e).split(".")[1],t=Buffer.from(r.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf8"),o=JSON.parse(t)?.exp;return"number"==typeof o?o:0}catch{return 0}}(e.access_token);return!!o&&o-r>t}const te=o.join(i.homedir(),".thinkpool-pair","refresh.lock");export function acquireRefreshLock(e=te,r=3e4){try{n.mkdirSync(o.dirname(e),{recursive:!0})}catch{}for(let t=0;t<2;t++)try{const r=n.openSync(e,"wx");return n.writeSync(r,JSON.stringify({pid:process.pid,at:Date.now()})),n.closeSync(r),!0}catch(t){if("EEXIST"!==t.code)return!0;let o=1/0;try{o=Date.now()-(JSON.parse(n.readFileSync(e,"utf8"))?.at||0)}catch{o=1/0}if(o<r)return!1;try{n.rmSync(e,{force:!0})}catch{return!0}}return!1}export function releaseRefreshLock(e=te){try{n.rmSync(e,{force:!0})}catch{}}async function oe(e,r){if(!r?.access_token||!r?.refresh_token)return null;try{const{data:t,error:o}=await e.auth.setSession({access_token:r.access_token,refresh_token:r.refresh_token});return o||!t?.session?null:t.session}catch{return null}}export async function refreshAccountSession(e,r,t={}){const{load:o=c,save:n=a,acquire:s=acquireRefreshLock,release:i=releaseRefreshLock,wait:d=re}=t,l=async r=>{const t=o();if(t?.refresh_token&&r&&t.refresh_token!==r){const r=await oe(e,t);if(r)return{session:r,adopted:!0}}return null};let p=await l(r);if(p)return p;const u=o()?.refresh_token||r;if(!u)return null;let m=s();if(!m){for(let e=0;e<20;e++){if(await d(250),p=await l(u),p)return p;if(s()){m=!0;break}}if(!m)return null}try{if(p=await l(u),p)return p;const r=o()?.refresh_token||u,{data:t,error:s}=await e.auth.refreshSession({refresh_token:r});return s||!t?.session?{session:null,error:s||null}:(n(t.session),{session:t.session,adopted:!1})}finally{m&&i()}}export const ACCOUNT_RECONNECT_ERROR_CODES=new Set(["refresh_token_not_found","refresh_token_already_used","session_not_found"]);export function accountRefreshNeedsReconnect(e){return ACCOUNT_RECONNECT_ERROR_CODES.has(String(e?.code||""))}export async function authedClient(e,r){const t=c();if(!t?.refresh_token)return null;if(t.reconnect_required)return{reconnectRequired:!0};const o=s(e,r,{auth:{persistSession:!1,autoRefreshToken:!1}});if(savedTokenStillValid(t)){const e=await oe(o,t);if(e)return{sb:o,session:e}}const n=await refreshAccountSession(o,t.refresh_token);return n?.session?{sb:o,session:n.session}:accountRefreshNeedsReconnect(n?.error)?(d(n.error.code),{reconnectRequired:!0}):null}export async function authedClientWithRetry(e,r,t={}){const{attempt:o=authedClient,load:n=c,wait:s=re,onRetry:i=null,maxAttempts:a=1/0,baseMs:d=15e3,capMs:l=3e5}=t;let p=d;for(let t=1;t<=a;t++){const c=await o(e,r);if(c?.reconnectRequired)return c;if(c)return c;if(!n()?.refresh_token)return null;if(t>=a)break;i?.(p,t),await s(p),p=Math.min(2*p,l)}return null}export function claimLoopWedged({lastClaimOkAt:e,now:r,quietMsThreshold:t=4e4}){return r-e>=t}export function scheduleTokenRefresh({sb:e,session:r,onRefreshed:t,onReconnectRequired:o,skewMs:n=9e4,forceMs:s=0,retryMs:i=3e4,refresh:a=refreshAccountSession}){let c=null,d=r,l=!1,p=!1;const u=e=>{l||(clearTimeout(c),c=setTimeout(f,Math.max(1e3,e)),c?.unref&&c.unref())},m=()=>{if(s)return s;const e=d?.expires_at?1e3*d.expires_at:Date.now()+36e5;return Math.max(3e4,e-Date.now()-n)};async function f(){if(!l)try{const r=await a(e,d.refresh_token);if(!r?.session){if(accountRefreshNeedsReconnect(r?.error)&&!p){p=!0;try{await(o?.(r.error))}catch{}}throw r?.error||new Error("no session")}d=r.session;try{e.realtime?.setAuth?.(d.access_token)}catch{}p=!1;try{await(t?.(d))}catch{}u(m())}catch{u(i)}}return u(m()),{cancel:()=>{l=!0,clearTimeout(c)},_tick:f}}export function runBind(e,r){const t=(e||"").toUpperCase().trim();t||(console.error(`usage: ${V("bind","<ROOM>","<directory>")}`),process.exit(1));const s=o.resolve(r||".");n.existsSync(s)&&n.statSync(s).isDirectory()||(console.error(`✗ not a directory: ${s}`),process.exit(1)),p(t,s),console.error(`✓ bound ${t} → ${s}\n  Run \`${J}\` (or restart it) to serve this session.`),process.exit(0)}export async function runAccount(r,s){acquireSingleton()||(console.error(`\n  ◇ An account bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Not starting a second — two would race\n    your saved login. Stop the other one first, or share a single room with\n    \`${V("<ROOM>")}\`.\n`),process.exit(0)),z();const c=createStartupAnchor(),J=await authedClientWithRetry(r,s,{onRetry:e=>process.stderr.write(`\n  ◇ Couldn't refresh your account session yet (offline, or another bridge is mid-rotation) — retrying in ${Math.round(e/1e3)}s. Saved login left in place.\n`)});J||(releaseSingleton(),console.error(`\n  ◇ Not linked to a ThinkPool account on this machine.\n    Link it:  ${V("login")}\n`),process.exit(0)),J.reconnectRequired&&(c(),releaseSingleton(),console.error("\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n"),process.exit(0));const{sb:Q,session:ee}=J,re=ee.user?.email||"your account";let te=ee.access_token||null;const oe=process.cwd();let ne=!1;try{const e=await import("./service.mjs");ne=e.serviceActive(null)}catch{}const se=()=>"1"===process.env.THINKPOOL_PAIR_AUTOUPDATE||ne,ie="1"===process.env.THINKPOOL_PAIR_AUTOUPDATE?"    (auto-updating background service — survives reboot, tracks @latest)\n":ne?"    (background service — survives reboot, restarts on crash, pinned to this version)\n":`    (run hands-off + auto-updating: ${V("install-service")})\n`,ae=f()||y()||oe;process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${re}\n    New sessions auto-serve from ${ae}${f()?" (your default)":y()?" (your most-recent Claude Code project)":""}\n    (change it: ${V("set-default-dir","<dir>")}  ·  one room: ${V("bind","<code>","<dir>")})\n${ie}`);const ce=new Map,de=new Map,le=new Map,pe=new Map,ue=new Set,me=new Map,fe=new Map,he=new Map,ye=new Map,ve=new Map;let ge=!1,we=null,_e=!1;const be=new Map,ke=new Set,$e=new Map,Re=i.hostname().replace(/\.local$/,""),Se=(t?.()||"").slice(0,8);let Te=null;console.log(`◇ supervisor boot sup=${Se} host=${Re} pid=${process.pid} npx=${Y||"dev"}`),await X(Q,te,s)||process.stderr.write("\n  ⚠ realtime auth could not be initialized; private bridge control is unavailable.\n");const Ie=Q.channel(`tpacct:${ee.user.id}`,{config:{presence:{key:Re},broadcast:{self:!1}}}),Oe=Q.channel(`tpacct-control:${ee.user.id}`,{config:{private:!0,broadcast:{self:!1}}}),xe=t();let Ce=!1,Ae=()=>{};Oe.on("broadcast",{event:"bind-room"},({payload:e})=>{const r=String(e?.code||"").toUpperCase().trim();let t=String(e?.dir||"").trim();t.startsWith("~")&&(t=o.join(i.homedir(),t.slice(1))),r&&t&&(n.existsSync(t)?(p(r,t),e?.setDefault&&(h(t),process.stderr.write(`\n  ◆ default project dir set → ${t}\n`)),process.stderr.write(`\n  ◆ ${r} bound → ${t} (from the web). Serving…\n`),Ae()):process.stderr.write(`\n  ◇ bind ${r}: directory not found (${t}) — ignored.\n`))}),Oe.on("broadcast",{event:"serve-room"},({payload:e})=>{const r=String(e?.code||"").toUpperCase().trim();/^[A-Z0-9]{4,12}$/.test(r)&&Ae()}),Oe.on("broadcast",{event:"shutdown"},async()=>{if(process.stderr.write("\n  ◇ disconnect requested from the dashboard — stopping bridge.\n"),setTimeout(()=>{try{releaseSingleton()}catch{}process.exit(0)},2500),se())try{(await import("./service.mjs")).uninstallService(null)}catch{}process.kill(process.pid,"SIGTERM")});let Pe=!1;Oe.on("broadcast",{event:"restart"},async({payload:e}={})=>{const r=e?.nonce,t=async(e,t)=>{try{await Oe.send({type:"broadcast",event:"restart-status",payload:{nonce:r,ok:e,error:t}})}catch{}};if(Pe||_e)await t(!1,"a bridge update is already being prepared");else{Pe=!0;try{const r=await import("./service.mjs"),o=r.serviceActive(null),n=o?r.stageServiceUpdate(null):null;if(o&&!n)return void await t(!1,"the published runtime could not be staged; the existing bridge was left running");we=n||("string"==typeof e?.version?e.version:Y)||"restart",ge=!0,await t(!0)}catch(e){return void await t(!1,`restart preparation failed: ${e?.message||e}`)}finally{Pe=!1}gr()}});let Ne="init",Ee="connected";const qe=g(Ie,{minMs:5e3,onStatus:e=>{Ne=e}}),Me=R(),Ue=()=>qe({name:Re,bridgeId:xe,version:Y,rooms:[...ce.keys()],readyRooms:[...ue],refused:[...$e].map(([e,r])=>({code:e,reason:r})),service:se(),providerPubKey:Me,providers:S(),agents:D(U()),accountAuthState:Ee,ts:Date.now()}),De=async e=>{try{await withTimeout(Q.rpc("report_bridge_auth_state",{p_bridge_id:xe,p_state:e}),5e3,"report_bridge_auth_state")}catch{}},je=(e,r)=>{try{Oe.send({type:"broadcast",event:e,payload:r})}catch{}};Oe.on("broadcast",{event:"provider-add"},async({payload:e})=>{const r=e?.nonce;let t;try{t=C(e?.sealed)}catch{return je("provider-add-res",{nonce:r,ok:!1,error:"could not decrypt the sealed payload"})}const o=I(t);o.ok&&(Ue(),process.stderr.write(`\n  ◆ provider added (${String(t?.name||"").slice(0,40)}) — re-announced.\n`)),je("provider-add-res",{nonce:r,ok:o.ok,error:o.ok?void 0:o.error,id:o.ok?o.id:void 0})}),Oe.on("broadcast",{event:"provider-add-model"},async({payload:e})=>{const r=e?.nonce,t=O({id:e?.id,model:e?.model,name:e?.name});t.ok&&(Ue(),process.stderr.write(`\n  ◆ model added to an existing provider (${String(e?.model||"").slice(0,40)}) — re-announced.\n`)),je("provider-add-model-res",{nonce:r,ok:t.ok,error:t.ok?void 0:t.error,id:t.ok?t.id:void 0})}),Oe.on("broadcast",{event:"provider-remove"},async({payload:e})=>{const r=e?.nonce,t=x(e?.id);t.ok&&(Ue(),process.stderr.write("\n  ◆ provider removed — re-announced.\n")),je("provider-remove-res",{nonce:r,ok:t.ok,error:t.ok?void 0:t.error})}),Oe.on("broadcast",{event:"providers-list-req"},async({payload:e})=>{const r=e?.nonce;je("providers-list-res",{nonce:r,ok:!0,providers:T()})}),Oe.on("broadcast",{event:"agent-visibility-set"},async({payload:e})=>{const r=e?.nonce,t=U(),o=j(e?.cmd,!0===e?.enabled,{installed:t});if(o.ok){Ue();for(const e of ce.values())try{e.send({t:"agent-visibility-changed"})}catch{}process.stderr.write(`\n  ◆ terminal picker agents updated — ${o.agents.filter(e=>e.enabled).map(e=>e.cmd).join(", ")} visible.\n`)}je("agent-visibility-res",{nonce:r,ok:o.ok,error:o.ok?void 0:o.error,agents:o.ok?o.agents:void 0})});let Fe=k(),Le=!1,He=!1;const Be=()=>{if(He||!Le)return;let e=!1;try{e=K(Ie.presenceState?.(),Re,xe,Y)}catch{e=!1}e&&(He=W({version:Y,bridgeId:xe}),He||process.stderr.write("\n  ◇ Could not record local supervisor readiness; the bridge remains running but installers will not claim it was confirmed.\n"))};Ie.on("presence",{event:"sync"},()=>{Fe=k(Fe,"sync"),Be()});const Ge=await $(Ie,e=>{if("SUBSCRIBED"===e)Fe=k(Fe,e),Ue();else if("CLOSED"===e||"CHANNEL_ERROR"===e||"TIMED_OUT"===e){Fe=k(Fe,e);try{Q.realtime?.connect?.()}catch{}}});Ge.connected||process.stderr.write(`\n  ◇ account realtime not ready at startup (${Ge.status}) — staying alive and recovering in process.\n`);const ze=await $(Oe,e=>{"CLOSED"!==e&&"CHANNEL_ERROR"!==e&&"TIMED_OUT"!==e||process.stderr.write(`\n  ⚠ private account control ${e}; host-changing dashboard actions are unavailable until Realtime reconnects.\n`)});ze.connected||process.stderr.write(`\n  ◇ private account control not ready at startup (${ze.status}) — presence remains available.\n`);const Ke=scheduleTokenRefresh({sb:Q,session:ee,onRefreshed:async e=>{Ee="connected",a(e),Ue(),await De("connected"),te=e.access_token||te;for(const e of ce.values())try{e.send({t:"token",accessToken:te})}catch{}},onReconnectRequired:async e=>{Ee="reconnect-required",d(e?.code||"refresh-token-invalid"),Ue(),await De("reconnect-required"),process.stderr.write("\n  ◇ This bridge lost its Thinkpool account link.\n    Reconnect it:  npx thinkpool-pair@latest login\n")},forceMs:parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS,10)||0});let We=!1,Je=0,Ve=null,Xe=Date.now(),Ye=0,Ze=0;const Qe=async()=>{try{const{data:e}=await withTimeout(Q.rpc("claim_bridge",{p_bridge_id:xe,p_hostname:Re}),1e4,"claim_bridge");Xe=Date.now();const r=Array.isArray(e)?e[0]:e,t=!!r?.held,o=r?.holder_host||"?";return t&&!We?process.stderr.write("\n  ◆ holding this account — serving your sessions (single active bridge).\n"):!t&&We?process.stderr.write(`\n  ◇ another device (${o}) took over this account — standing by.\n`):t||Ve===o||process.stderr.write(`\n  ◇ another device (${o}) is serving this account — standing by.\n    (this Mac takes over automatically if that device goes offline.)\n`),We=t,Je=t&&Number.isSafeInteger(Number(r?.fencing))&&Number(r.fencing)>0?Number(r.fencing):0,Ve=t?null:o,Te!==t&&(console.log(`claim_tick sup=${Se} held=${t} holder=${t?Re:o}`),Te=t),t}catch{return We}},er=L({channels:ye,randomId:t}),rr=e=>er.resolve(e),tr=(e,r,t)=>er.requestFirst(e,r,t),or=(e,r,t)=>er.requestCollect(e,r,t),nr=async e=>{try{const r=await withTimeout(Q.rpc("list_pair_rooms",{p_code:e}),2500,"paired-room roster");return r?.error||!Array.isArray(r?.data)?{verified:!1,rooms:[]}:{verified:!0,rooms:r.data}}catch{return{verified:!1,rooms:[]}}},sr=(e,r)=>{if(!e||ye.has(e))return;const o=q(r);if(!o)return;const n=Q.channel(o,{config:{private:!0,broadcast:{self:!1}}}),s={channel:n,key:r,status:G.JOINING};n.on("broadcast",{event:"peer-list-req"},({payload:r})=>((e,r,t)=>{if("1"===process.env.TP_PAIRBUS_OFF||"1"===process.env.TP_CROSSROOM_OFF)return;const o=[...ce.keys()].filter(r=>he.get(r)===e).map(e=>({code:e,name:me.get(e)||null,host:Re}));try{r.send({type:"broadcast",event:"peer-list-res",payload:{nonce:t?.nonce,rooms:o}})}catch{}})(e,n,r)).on("broadcast",{event:"peer-list-res"},({payload:e})=>rr(e)).on("broadcast",{event:"peer-peek-req"},({payload:r})=>((e,r,o)=>{const n=e=>{try{r.send({type:"broadcast",event:"peer-peek-res",payload:{nonce:o?.nonce,...e}})}catch{}};if("1"===process.env.TP_PAIRBUS_OFF||"1"===process.env.TP_CROSSROOM_OFF)return n({error:"Cross-session reach is off on this device."});const s=String(o?.targetRoom||"").toUpperCase().trim(),i=ce.get(s);if(!i||he.get(s)!==e)return n({error:`Room ${s} is not a room this device shares with you.`});const a=t();fe.set(a,{reply:e=>n({text:e.text,error:e.error}),askerRoom:null});try{i.send({t:"pair-peek-local",reqId:a,terminal:o.terminal,lines:o.lines})}catch{fe.delete(a),n({error:`Could not reach room ${s}.`})}})(e,n,r)).on("broadcast",{event:"peer-peek-res"},({payload:e})=>rr(e)).on("broadcast",{event:"peer-post-req"},({payload:r})=>((e,r,o)=>{const n=e=>{try{r.send({type:"broadcast",event:"peer-post-res",payload:{nonce:o?.nonce,...e}})}catch{}};if("1"===process.env.TP_PAIRBUS_OFF)return n({error:"Cross-room posting is off on this device."});if(!(e=>{const r=Date.now();let t=ve.get(e);return(!t||r>=t.resetAt)&&(t={count:0,resetAt:r+6e4},ve.set(e,t)),!(t.count>=6||(t.count++,0))})(e))return n({error:"Too many cross-room posts to this device right now — try again shortly."});const s=String(o?.targetRoom||"").toUpperCase().trim(),i=ce.get(s);if(!i||he.get(s)!==e)return n({error:`Room ${s} is not a room this device shares with you.`});const a=t();fe.set(a,{reply:e=>n({ok:e.ok,ref:e.ref,error:e.error}),askerRoom:null});try{i.send({t:"pair-post-local",reqId:a,fromRoom:o.fromRoom,fromHost:o.fromHost,fromTerminalName:o.fromTerminalName,text:o.text,terminal:o.terminal})}catch{fe.delete(a),n({error:`Could not reach room ${s}.`})}})(e,n,r)).on("broadcast",{event:"peer-post-res"},({payload:e})=>rr(e)).subscribe(e=>{s.status=B(e),"SUBSCRIBED"===e?process.stderr.write("\n  ◆ pair bus subscribed — cross-machine Ensemble reach with your partner.\n"):"CHANNEL_ERROR"!==e&&"TIMED_OUT"!==e||process.stderr.write(`\n  ◇ pair bus ${e.toLowerCase().replace("_"," ")} — partner sessions are offline until it reconnects.\n`)}),ye.set(e,s)};let ir=0;const ar=async()=>{const e=Date.now();if(!(ir&&e-ir<6e4)){ir=e;try{await cr()}finally{ir===e&&(ir=0)}}};Ae=()=>{ar().catch(()=>{})};const cr=async()=>{if(!await Qe()){if(ce.size)for(const[,e]of ce)try{e.kill("SIGTERM")}catch{}return void Ue()}let r=[],s=!1;const a=ee.user.id;try{const{data:e,error:t}=await Q.from("code_sessions").select("code,name,last_active_at,owner_id,participants,closed_at").eq("owner_id",a).is("closed_at",null).order("last_active_at",{ascending:!1}).limit(20);if(t)throw t;r=e||[],s=!0;const o=new Set(r.map(e=>e.code));for(const e of[...$e.keys()])o.has(e)||$e.delete(e)}catch{}if(s)for(const e of P({rooms:r,childRooms:ce.keys(),myUid:a})){const r=ce.get(e);if(r){console.log(`child_retire sup=${Se} room=${e} pid=${r.pid||"?"} reason=not-active-owned`);try{r.kill("SIGTERM")}catch{}}}const c=l(),d=u();for(const s of r){const r=s.code;if(!r||ce.has(r)){r&&$e.delete(r);continue}if(!A({ownerId:s.owner_id,myUid:a,closedAt:s.closed_at}))continue;const l=N({bound:c[r],remembered:d[r],defaultDir:f()||y()||oe,home:i.homedir()});if(l.refuse){if($e.set(r,l.reason),!ke.has(r)){ke.add(r);const e="home"===l.reason?`no project directory set — refusing to serve it from your home folder (${l.dir}); the agent would lose its session context and the room would show "${o.basename(l.dir)}" as the repo.`:"no directory to serve it from.";process.stderr.write(`\n  ◇ ${r}: ${e}\n    Bind it to its repo:  ${V("bind",r,"<repo-dir>")}\n`)}continue}const p=l.dir;if(!n.existsSync(p)){$e.set(r,"dir-gone"),ke.has(r)||(ke.add(r),process.stderr.write(`\n  ◇ ${r}: bound directory is gone (${p}) — re-bind it.\n`));continue}ke.delete(r),$e.delete(r),l.fromDefault&&m(r,p),me.set(r,s.name||null),process.stderr.write(`\n  ◆ serving ${r}${s.name?` "${s.name}"`:""}  →  ${p}${c[r]?"":" (default)"}\n`);const u={...process.env,THINKPOOL_PAIR_ACCOUNT_CHILD:"1",TP_ACCOUNT_BRIDGE_ID:xe,TP_ACCOUNT_BRIDGE_FENCING:String(Je)};delete u.THINKPOOL_PAIR_AUTOUPDATE,te&&(u.TP_ACCESS_TOKEN=te);const h=ce.has(r),v=F(`spawn the room bridge for ${r}`);if(!v.ok){ke.has(`memory:${r}`)||(ke.add(`memory:${r}`),process.stderr.write(`\n  ◇ ${r}: ${v.reason}\n`)),$e.set(r,"host-memory");continue}ke.delete(`memory:${r}`);const g=e(process.execPath,[Z,r,"--headless","--auto=claude"],{cwd:p,stdio:["inherit","inherit","inherit","ipc"],env:u});console.log(`child_spawn sup=${Se} room=${r} pid=${g.pid} dir=${p} had_prior=${h}`),ce.set(r,g),ue.delete(r),de.set(r,!1),le.set(r,!1),pe.set(r,!1),g.on("message",e=>{if(e)if("room-ready"===e.t)ue.add(r),console.log(`child_ready sup=${Se} room=${r} pid=${g.pid}`),Ue();else if("idle"===e.t)de.set(r,!!e.idle),le.set(r,null!=e.between?!!e.between:!!e.idle),pe.set(r,!!e.webPeer),gr();else if("busy"===e.t)de.set(r,!1),le.set(r,!1);else if("restart-probe-result"===e.t){const t=be.get(e.nonce);if(!t||!t.pending.has(r)||ce.get(r)!==g)return;t.pending.delete(r),t.ok=t.ok&&!0===e.between,le.set(r,!0===e.between),t.pending.size||(clearTimeout(t.timer),be.delete(e.nonce),t.resolve(t.ok))}else if("apply-update"===e.t)ge=!0,gr();else if("pair-list-req"===e.t)(async()=>{if("1"===process.env.TP_CROSSROOM_OFF){try{g.send({t:"pair-list-res",reqId:e.reqId,rooms:[],error:"Cross-session reach is turned off on this bridge."})}catch{}return}const t=[...ce.keys()].filter(e=>e!==r).map(e=>({code:e,name:me.get(e)||null}));let o=[],n=[];if("1"!==process.env.TP_PAIRBUS_OFF){const e=await Promise.all([nr(r),ye.size?or("peer-list-req",{},1200):Promise.resolve([])]);o=e[0].rooms,n=e[1]}const s=H({authorized:o,replies:n,myUid:ee.user.id,localCodes:ce.keys()});try{g.send({t:"pair-list-res",reqId:e.reqId,rooms:[...t,...s]})}catch{}})();else if("pair-peek-req"===e.t)(async()=>{const o=r=>{try{g.send({t:"pair-peek-res",reqId:e.reqId,...r})}catch{}};if("1"===process.env.TP_CROSSROOM_OFF)return o({error:"Cross-session reach is turned off on this bridge."});const n=String(e.targetRoom||"").toUpperCase().trim();if(!n||n===r)return o({error:`${n||"That"} is not another of your active sessions.`});const s=ce.get(n);if(s){const i=t();fe.set(i,{reply:e=>o({text:e.text,error:e.error}),askerRoom:r});try{s.send({t:"pair-peek-local",reqId:i,terminal:e.terminal,lines:e.lines})}catch{fe.delete(i),o({error:`Could not reach session ${n}.`})}return}if("1"===process.env.TP_PAIRBUS_OFF)return o({error:"Cross-session reach is turned off on this bridge."});const[i,a]=await Promise.all([nr(r),ye.size?or("peer-list-req",{},800):Promise.resolve([])]);if(i.verified&&!i.rooms.some(e=>e?.code===n&&e?.owner_id!==ee.user.id))return o({error:`Room ${n} is not shared with this pair.`});if(!ye.size)return o({error:i.verified?`Room ${n} is paired with you, but its host bridge is offline.`:`Session ${n} is not running on this machine, and no pair bus is open to reach it.`});if(!a.some(e=>e?.rooms?.some(e=>e?.code===n)))return o({error:`Room ${n} is paired with you, but its host bridge is offline.`});const c=await(d=n,l=e.terminal,p=e.lines,tr("peer-peek-req",{targetRoom:d,terminal:l,lines:p},M.busTimeoutMs));var d,l,p;if(!c)return o({error:`Room ${n} did not respond — it may be offline, or not shared with you.`});o({text:c.text,error:c.error})})();else if("pair-post-req"===e.t)(async()=>{const o=r=>{try{g.send({t:"pair-post-res",reqId:e.reqId,...r})}catch{}};if("1"===process.env.TP_PAIRBUS_OFF)return o({error:"Cross-room posting is turned off on this bridge."});const n=String(e.targetRoom||"").toUpperCase().trim();if(!n||n===r)return o({error:`${n||"That"} is not another of your sessions.`});const s=ce.get(n);if(s){const i=t();fe.set(i,{reply:e=>o({ok:e.ok,ref:e.ref,error:e.error}),askerRoom:r});try{s.send({t:"pair-post-local",reqId:i,fromRoom:r,fromHost:Re,fromTerminalName:e.fromTerminalName,text:e.text,terminal:e.terminal})}catch{fe.delete(i),o({error:`Could not reach session ${n}.`})}return}const[i,a]=await Promise.all([nr(r),ye.size?or("peer-list-req",{},1200):Promise.resolve([])]);if(i.verified&&!i.rooms.some(e=>e?.code===n&&e?.owner_id!==ee.user.id))return o({error:`Room ${n} is not shared with this pair.`});if(!ye.size)return o({error:i.verified?`Room ${n} is paired with you, but its host bridge is offline.`:`Room ${n} is not on this machine, and no pair bus is open to reach it.`});if(!a.some(e=>e?.rooms?.some(e=>e?.code===n)))return o({error:`Room ${n} is paired with you, but its host bridge is offline — no recipient approval card can be raised yet.`});const c=await(d=n,l=e.terminal,p=e.text,u=r,m=e.fromTerminalName,tr("peer-post-req",{targetRoom:d,terminal:l,text:p,fromRoom:u,fromHost:Re,fromTerminalName:m},18e4));var d,l,p,u,m;if(!c)return o({error:`Room ${n} did not respond to the hand-off in time.`});o({ok:c.ok,ref:c.ref,error:c.error})})();else if("pair-peek-res"===e.t||"pair-post-res"===e.t){const r=fe.get(e.reqId);if(!r)return;fe.delete(e.reqId);try{r.reply(e)}catch{}}});const w=e=>{console.log(`child_exit sup=${Se} room=${r} pid=${g?.pid||"?"} code=${e||"?"}`),ce.delete(r),ue.delete(r),de.delete(r),le.delete(r),pe.delete(r),me.delete(r),he.delete(r);for(const[e,t]of fe)t?.askerRoom===r&&fe.delete(e)};if(g.on("exit",e=>w(e)),g.on("error",e=>{w();try{process.stderr.write(`\n  ◇ ${r}: failed to launch its bridge (${e?.message||e}) — retrying next tick.\n`)}catch{}}),we)try{g.send({t:"update-available",version:we})}catch{}}if("1"!==process.env.TP_PAIRBUS_OFF)for(const e of r){if(!e?.code||!ce.has(e.code))continue;const r=Array.isArray(e.participants)?e.participants:[],t=2===r.length?r.find(e=>e&&e!==ee.user.id):null;if(!t){he.delete(e.code);continue}he.set(e.code,t);const o=E(ee.user.id,t);o&&sr(t,o)}Ue()};await ar();const dr=setInterval(ar,15e3);Le=!0,Be(),c();const lr=[];let pr=!1,ur=0,mr=0,fr=!1;const hr=setInterval(async()=>{if(pr)return;const e=Date.now();if(!claimLoopWedged({lastClaimOkAt:Xe,now:e}))return ur=0,void(mr=0);if(fr||e<mr)return;fr=!0;const r=b(ur);mr=e+r,ur+=1,console.log(`claim_watchdog sup=${Se} quiet_ms=${e-Xe} attempt=${ur} next_ms=${r} — reconnecting realtime + re-claiming`);try{Q.realtime?.connect?.()}catch{}ir=0;try{await Qe(),Ue()}catch{}finally{fr=!1}},2e4);hr.unref?.();const yr=setInterval(()=>{if(pr)return;const e=Date.now(),r=w({claimHeld:We,lastClaimOkAt:Xe,now:e});let t=!1;try{t=!!Ie.presenceState?.()[Re]}catch{t=!1}const o=_({tracking:r,subscribedAt:Math.max(Fe.subscribedAt,Xe),syncSeenAt:Fe.syncSeenAt,present:t,missingSince:Ye,now:e});if(Ye=o.missingSince,!Ye)return void(Ze=0);const n=o.verdict;if("recycle"===n){if(Ze===Ye)return;Ze=Ye,console.log(`presence_watchdog sup=${Se} action=recycle missing_ms=${e-Ye} track=${Ne} — full realtime disconnect+reconnect`);try{Q.realtime?.disconnect?.()}catch{}try{Q.realtime?.connect?.()}catch{}try{Ue()}catch{}}else"respawn"===n&&(console.log(`presence_watchdog sup=${Se} action=respawn missing_ms=${e-Ye} track=${Ne} — recycle failed, exiting for a clean supervisor respawn`),process.exit(1))},15e3);yr.unref?.();const vr=e=>{if(pr)return;pr=!0;const r=Ce?1:0;console.log(`supervisor_stop sup=${Se} reason=${e||"unknown"} restarting=${Ce} children=${ce.size}`),clearInterval(dr),clearInterval(hr),clearInterval(yr);for(const e of lr)try{clearInterval(e)}catch{}Ke.cancel(),z({pid:process.pid}),releaseSingleton();for(const r of ce.values())try{r.kill(e||"SIGTERM")}catch{}er.close();for(const{channel:e}of ye.values())try{Q.removeChannel(e)}catch{}(async()=>{try{We&&await Q.rpc("release_bridge",{p_bridge_id:xe})}catch{}try{await Ie.untrack()}catch{}try{await Q.removeChannel(Oe)}catch{}try{await Q.removeChannel(Ie)}catch{}process.exit(r)})(),setTimeout(()=>process.exit(r),1500)};for(const e of["SIGINT","SIGTERM","SIGHUP"])process.on(e,()=>vr(e));async function gr(){if(!_e&&v({pendingUpdate:we,stopping:pr,childIdle:de,childBetween:le,childPeer:pe,requested:ge})){if(_e=!0,!await function(e=2500){const r=[...ce.entries()];if(!r.length)return Promise.resolve(!0);const o=t();return new Promise(t=>{const n={pending:new Set(r.map(([e])=>e)),ok:!0,resolve:t,timer:null};n.timer=setTimeout(()=>{be.delete(o),t(!1)},e),n.timer.unref?.(),be.set(o,n);for(const[e,t]of r)try{t.send({t:"restart-probe",nonce:o})}catch{n.pending.delete(e),n.ok=!1}n.pending.size||(clearTimeout(n.timer),be.delete(o),t(n.ok))})}())return _e=!1,void process.stderr.write("\n  ◆ bridge update still queued — an agent became active before the restart boundary.\n");process.stderr.write(`\n  ◆ thinkpool-pair ${we} ready (running ${Y}) — restarting account bridge to update; sessions resume.\n`);try{const e=await import("./service.mjs");if(e.serviceActive(null)&&!1!==e.applyStagedServiceUpdate(null,we))return}catch{}if(_e=!1,Ce=!0,!se())try{e(process.execPath,[process.argv[1]],{detached:!0,stdio:"ignore",env:process.env}).unref()}catch{}vr("SIGTERM")}}if("1"===process.env.THINKPOOL_PAIR_AUTOUPDATE&&Y){const e=1e3*Math.max(60,parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL,10)||1800),r=(e,r)=>{const t=e=>String(e).split("-")[0].split(".").map(e=>parseInt(e,10)||0),o=t(e),n=t(r);for(let e=0;e<3;e++){if((o[e]||0)>(n[e]||0))return!0;if((o[e]||0)<(n[e]||0))return!1}return!1},t=async()=>{const e=new AbortController,r=setTimeout(()=>e.abort(),8e3);try{const r=await fetch("https://registry.npmjs.org/thinkpool-pair/latest",{signal:e.signal,headers:{accept:"application/json"}});if(!r.ok)return null;const t=await r.json();return"string"==typeof t?.version?t.version:null}catch{return null}finally{clearTimeout(r)}},o=async()=>{const e=await t();if(e&&r(e,Y)){we||process.stderr.write(`\n  ◆ thinkpool-pair ${e} published — "update ready" surfaced to each room; applies between turns.\n`);try{(await import("./service.mjs")).provisionRuntime(e)}catch(r){return void process.stderr.write(`\n  ⚠ bridge ${e} could not be staged yet: ${r?.message||r}\n`)}we=e;for(const r of ce.values())try{r.send({t:"update-available",version:e})}catch{}gr()}};lr.push(setInterval(o,e).unref()),lr.push(setInterval(gr,15e3).unref()),lr.push(setTimeout(o,6e4).unref())}await new Promise(()=>{})}