thinkpool-pair 0.7.364 → 0.7.366

package/acp-client.mjs

@@ -1,140 +1 @@
-// Runtime-neutral supervised ACP stdio client. Protocol framing, JSON-RPC,
-// cancellation, typed client handlers, and schemas come from the official ACP
-// SDK. ThinkPool owns only subprocess supervision and its stricter stdout rule.
-import { spawn } from 'node:child_process'
-import { Readable, Transform, Writable } from 'node:stream'
-import * as acp from '@agentclientprotocol/sdk'
-
-const closedError = (value, fallback = 'ACP process closed') => value instanceof Error
-  ? value
-  : new Error(String(value || fallback))
-
-function strictProtocolGate(onError) {
-  let buffered = ''
-  const validate = (line) => {
-    if (!line.trim()) return
-    let message
-    try { message = JSON.parse(line) } catch { throw new Error('ACP stdout contained non-JSON protocol data') }
-    if (!message || typeof message !== 'object' || Array.isArray(message)) {
-      throw new Error('ACP stdout contained invalid JSON-RPC protocol data')
-    }
-    const hasId = Object.prototype.hasOwnProperty.call(message, 'id')
-    const hasMethod = typeof message.method === 'string' && message.method.length > 0
-    const hasResult = Object.prototype.hasOwnProperty.call(message, 'result')
-    const hasError = Object.prototype.hasOwnProperty.call(message, 'error')
-    const isCall = hasMethod && !(hasResult || hasError)
-    const isResponse = hasId && !hasMethod && hasResult !== hasError
-    if (message.jsonrpc !== '2.0' || (!isCall && !isResponse)) {
-      throw new Error('ACP stdout contained invalid JSON-RPC protocol data')
-    }
-  }
-  const gate = new Transform({
-    transform(chunk, _encoding, callback) {
-      try {
-        buffered += String(chunk)
-        const lines = buffered.split('\n')
-        buffered = lines.pop() || ''
-        for (const line of lines) validate(line)
-        callback(null, chunk)
-      } catch (error) { callback(error) }
-    },
-    flush(callback) {
-      try { validate(buffered); callback(null, buffered || undefined) }
-      catch (error) { callback(error) }
-    },
-  })
-  gate.on('error', onError)
-  return gate
-}
-
-export class AcpClient {
-  constructor({ command, args = ['acp'], cwd, env = process.env, spawnImpl = spawn, onNotification, onRequest, onStderr, onClose, timeoutMs = 10_000 } = {}) {
-    this.command = command
-    this.args = args
-    this.cwd = cwd
-    this.env = env
-    this.spawnImpl = spawnImpl
-    this.onNotification = onNotification
-    this.onRequest = onRequest
-    this.onStderr = onStderr
-    this.onClose = onClose
-    this.timeoutMs = timeoutMs
-    this.child = null
-    this.connection = null
-    this.closedError = null
-    this.stderrTail = ''
-  }
-
-  get alive() { return !!this.child && !!this.connection && !this.closedError }
-
-  start() {
-    if (this.child) return
-    const child = this.spawnImpl(this.command, this.args, { cwd: this.cwd, env: this.env, stdio: ['pipe', 'pipe', 'pipe'] })
-    this.child = child
-    child.stderr?.on?.('data', (chunk) => {
-      const text = String(chunk)
-      this.stderrTail = (this.stderrTail + text).slice(-2000)
-      try { this.onStderr?.(text) } catch { /* consumer isolation */ }
-    })
-
-    const failProtocol = (error) => {
-      const failure = closedError(error, 'ACP protocol stream failed')
-      this.connection?.close(failure)
-      this._close(failure)
-      try { child.kill('SIGTERM') } catch { /* noop */ }
-    }
-    const protocolOutput = strictProtocolGate(failProtocol)
-    child.stdout.pipe(protocolOutput)
-    const stream = acp.ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(protocolOutput))
-    const app = acp.client({ name: 'thinkpool-pair' })
-      .onRequest(acp.methods.client.session.requestPermission, ({ params, requestId }) => {
-        if (!this.onRequest) throw Object.assign(new Error('Unsupported ACP client method: session/request_permission'), { code: -32601 })
-        return this.onRequest(acp.methods.client.session.requestPermission, params, requestId)
-      })
-      .onNotification(acp.methods.client.session.update, ({ params }) => {
-        try { this.onNotification?.(acp.methods.client.session.update, params) } catch { /* consumer isolation */ }
-      })
-    this.connection = app.connect(stream)
-    void this.connection.closed.then(() => {
-      if (!this.closedError) this._close(closedError(this.connection?.signal?.reason))
-    })
-
-    child.stdin?.on?.('error', (error) => this._close(error))
-    child.on('error', (error) => this._close(error))
-    child.on('close', (code, signal) => this._close(new Error(`ACP process exited ${code ?? signal ?? 'unknown'}${this.stderrTail ? `: ${this.stderrTail.trim().slice(-300)}` : ''}`)))
-  }
-
-  request(method, params = {}, timeoutMs = this.timeoutMs) {
-    if (!this.connection || this.closedError) return Promise.reject(this.closedError || new Error('ACP process is not running'))
-    const controller = new AbortController()
-    const request = this.connection.agent.request(method, params, { cancellationSignal: controller.signal })
-    if (!(timeoutMs > 0)) return request
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
-        controller.abort(new Error(`${method} timed out after ${timeoutMs}ms`))
-        reject(new Error(`${method} timed out after ${timeoutMs}ms`))
-      }, timeoutMs)
-      timer.unref?.()
-      request.then(resolve, reject).finally(() => clearTimeout(timer))
-    })
-  }
-
-  notify(method, params) {
-    if (!this.connection || this.closedError) return Promise.reject(this.closedError || new Error('ACP process is not running'))
-    return this.connection.agent.notify(method, params)
-  }
-
-  _close(error) {
-    if (this.closedError) return
-    this.closedError = closedError(error)
-    this.child = null
-    this.connection?.close(this.closedError)
-    try { this.onClose?.(this.closedError) } catch { /* consumer isolation */ }
-  }
-
-  end() {
-    const child = this.child
-    this._close(new Error('ACP client ended'))
-    if (child) { try { child.kill('SIGTERM') } catch { /* noop */ } }
-  }
-}
+import{spawn as t}from"node:child_process";import{Readable as o,Transform as e,Writable as r}from"node:stream";import*as s from"@agentclientprotocol/sdk";const n=(t,o="ACP process closed")=>t instanceof Error?t:new Error(String(t||o));export class AcpClient{constructor({command:o,args:e=["acp"],cwd:r,env:s=process.env,spawnImpl:n=t,onNotification:i,onRequest:c,onStderr:l,onClose:h,timeoutMs:a=1e4}={}){this.command=o,this.args=e,this.cwd=r,this.env=s,this.spawnImpl=n,this.onNotification=i,this.onRequest=c,this.onStderr=l,this.onClose=h,this.timeoutMs=a,this.child=null,this.connection=null,this.closedError=null,this.stderrTail=""}get alive(){return!!this.child&&!!this.connection&&!this.closedError}start(){if(this.child)return;const t=this.spawnImpl(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"]});this.child=t,t.stderr?.on?.("data",t=>{const o=String(t);this.stderrTail=(this.stderrTail+o).slice(-2e3);try{this.onStderr?.(o)}catch{}});const i=function(t){let o="";const r=t=>{if(!t.trim())return;let o;try{o=JSON.parse(t)}catch{throw new Error("ACP stdout contained non-JSON protocol data")}if(!o||"object"!=typeof o||Array.isArray(o))throw new Error("ACP stdout contained invalid JSON-RPC protocol data");const e=Object.prototype.hasOwnProperty.call(o,"id"),r="string"==typeof o.method&&o.method.length>0,s=Object.prototype.hasOwnProperty.call(o,"result"),n=Object.prototype.hasOwnProperty.call(o,"error"),i=r&&!(s||n),c=e&&!r&&s!==n;if("2.0"!==o.jsonrpc||!i&&!c)throw new Error("ACP stdout contained invalid JSON-RPC protocol data")},s=new e({transform(t,e,s){try{o+=String(t);const e=o.split("\n");o=e.pop()||"";for(const t of e)r(t);s(null,t)}catch(t){s(t)}},flush(t){try{r(o),t(null,o||void 0)}catch(o){t(o)}}});return s.on("error",t),s}(o=>{const e=n(o,"ACP protocol stream failed");this.connection?.close(e),this._close(e);try{t.kill("SIGTERM")}catch{}});t.stdout.pipe(i);const c=s.ndJsonStream(r.toWeb(t.stdin),o.toWeb(i)),l=s.client({name:"thinkpool-pair"}).onRequest(s.methods.client.session.requestPermission,({params:t,requestId:o})=>{if(!this.onRequest)throw Object.assign(new Error("Unsupported ACP client method: session/request_permission"),{code:-32601});return this.onRequest(s.methods.client.session.requestPermission,t,o)}).onNotification(s.methods.client.session.update,({params:t})=>{try{this.onNotification?.(s.methods.client.session.update,t)}catch{}});this.connection=l.connect(c),this.connection.closed.then(()=>{this.closedError||this._close(n(this.connection?.signal?.reason))}),t.stdin?.on?.("error",t=>this._close(t)),t.on("error",t=>this._close(t)),t.on("close",(t,o)=>this._close(new Error(`ACP process exited ${t??o??"unknown"}${this.stderrTail?`: ${this.stderrTail.trim().slice(-300)}`:""}`)))}request(t,o={},e=this.timeoutMs){if(!this.connection||this.closedError)return Promise.reject(this.closedError||new Error("ACP process is not running"));const r=new AbortController,s=this.connection.agent.request(t,o,{cancellationSignal:r.signal});return e>0?new Promise((o,n)=>{const i=setTimeout(()=>{r.abort(new Error(`${t} timed out after ${e}ms`)),n(new Error(`${t} timed out after ${e}ms`))},e);i.unref?.(),s.then(o,n).finally(()=>clearTimeout(i))}):s}notify(t,o){return!this.connection||this.closedError?Promise.reject(this.closedError||new Error("ACP process is not running")):this.connection.agent.notify(t,o)}_close(t){if(!this.closedError){this.closedError=n(t),this.child=null,this.connection?.close(this.closedError);try{this.onClose?.(this.closedError)}catch{}}}end(){const t=this.child;if(this._close(new Error("ACP client ended")),t)try{t.kill("SIGTERM")}catch{}}}

package/agent-detect.mjs

@@ -1,28 +1 @@
-// One installed-agent detector shared by the room bridge and account supervisor.
-// Both surfaces announce the same machine; they must not disagree about which
-// coding CLIs it can open merely because they publish on different channels.
-import fs from 'node:fs'
-import path from 'node:path'
-
-export const KNOWN_AGENT_COMMANDS = [
-  'claude', 'codex', 'thinkpool', 'gemini', 'aider', 'cursor-agent',
-  'opencode', 'copilot', 'goose', 'crush', 'qwen',
-]
-
-export function commandOnPath(command, { env = process.env, platform = process.platform, fsImpl = fs } = {}) {
-  const exts = platform === 'win32'
-    ? (env.PATHEXT || '.EXE;.CMD;.BAT;.COM').split(';')
-    : ['']
-  const delimiter = platform === 'win32' ? ';' : path.delimiter
-  for (const dir of (env.PATH || '').split(delimiter)) {
-    if (!dir) continue
-    for (const ext of exts) {
-      try { if (fsImpl.existsSync(path.join(dir, command + ext))) return true } catch { /* unreadable path entry */ }
-    }
-  }
-  return false
-}
-
-export function installedAgentCommands(options) {
-  return KNOWN_AGENT_COMMANDS.filter((command) => commandOnPath(command, options))
-}
+import o from"node:fs";import n from"node:path";export const KNOWN_AGENT_COMMANDS=["claude","codex","thinkpool","gemini","aider","cursor-agent","opencode","copilot","goose","crush","qwen"];export function commandOnPath(t,{env:e=process.env,platform:r=process.platform,fsImpl:i=o}={}){const c="win32"===r?(e.PATHEXT||".EXE;.CMD;.BAT;.COM").split(";"):[""],s="win32"===r?";":n.delimiter;for(const o of(e.PATH||"").split(s))if(o)for(const e of c)try{if(i.existsSync(n.join(o,t+e)))return!0}catch{}return!1}export function installedAgentCommands(o){return KNOWN_AGENT_COMMANDS.filter(n=>commandOnPath(n,o))}

package/agent-notify.mjs

@@ -1,142 +1 @@
-/* ─────────────────────────────────────────────────────────────
-   bridge/agent-notify.mjs — the PURE decision layer for agent push events.
-
-   The bridge is the only process that knows a turn ended or a permission
-   card went unanswered. It can't call /api/notify-code directly (that
-   endpoint is webhook-secret-gated and this is a published npm package), so
-   it writes a compact `__agent` row into code_messages and lets the existing
-   push_notify_on_code_message trigger fan it out.
-
-   Everything that DECIDES whether to write such a row lives here, with no
-   I/O, so bridge/agent-notify.test.mjs can exercise it without a room, a
-   socket, or a wall clock.
-
-   Spec: docs/specs/2026-07-09-code-notifications-rework.md (Slice 3)
-   ───────────────────────────────────────────────────────────── */
-
-// A turn shorter than this means somebody was almost certainly watching it —
-// pushing "done" 4 seconds after they hit enter is noise, not news.
-export const DEFAULT_MIN_TURN_MS = 30_000
-
-// How long a permission card may sit unanswered before we assume nobody is
-// looking at the room and push. Short enough to be useful, long enough that
-// the common case (you're right there, you click it) never fires.
-export const DEFAULT_PERM_GRACE_MS = 20_000
-
-// Push copy is a banner, not a transcript.
-export const SUMMARY_MAX = 200
-
-/* A lane is USER-FACING when a human opened it and is waiting on it.
-   - spawnedBy: a Dispatch worker lane an agent fanned out. Its owner is
-     another agent; the human never asked for it directly.
-   - flowTaskKey: a Flow slice lane. Same reasoning — the conductor collects
-     it, and a 12-lane flow would fan 12 banners at one person.
-   Both run in inherited/bypass modes almost always, so they also rarely
-   raise permission cards. The conductor lane itself (flowSessionId but no
-   flowTaskKey) IS user-facing — that's the one a human is watching. */
-export function isUserFacingLane(entry) {
-  if (!entry) return false
-  return !entry.spawnedBy && !entry.flowTaskKey
-}
-
-/* Collapse whitespace, clip, ellipsize. Never throws on non-strings. */
-export function clipSummary(text, max = SUMMARY_MAX) {
-  if (text == null) return ''
-  const s = String(text).replace(/\s+/g, ' ').trim()
-  if (s.length <= max) return s
-  return s.slice(0, max).replace(/\s+\S*$/, '').trimEnd() + '…'
-}
-
-/* Should a settled turn produce a `turn-done` event row?
-
-   No when: the lane isn't user-facing · the user pressed Stop (subtype
-   'aborted' — they know it's over, they're the one who ended it) · the turn
-   was short enough that somebody was plainly watching · we never saw the
-   turn start (startedAt null → a stray `error` event outside any turn, e.g.
-   the SDK-regression warning emitted at init).
-
-   `error` turns DO notify — with the same neutral copy as a success. Max's
-   call: "the agent stopped" is the news; the reason is in the room. */
-export function shouldNotifyTurnDone({ entry, subtype, startedAt, now, minTurnMs = DEFAULT_MIN_TURN_MS }) {
-  if (!shouldRecordTurnDone({ entry, subtype, startedAt, now })) return false
-  return (now - startedAt) >= minTurnMs
-}
-
-// Every user-facing settle is durable realtime evidence for the in-app rail.
-// The older 30s threshold remains only a PUSH eligibility rule; using it as the
-// write gate made short turns in another session invisible to the web app.
-export function shouldRecordTurnDone({ entry, subtype, startedAt, now }) {
-  if (!isUserFacingLane(entry)) return false
-  if (subtype === 'aborted') return false
-  if (!startedAt) return false
-  return Number.isFinite(now)
-}
-
-/* The one-line "what is it asking me" for a permission card.
-   AskUserQuestion cards carry `questions`; ordinary tool cards degrade to
-   `<ToolName> <first meaningful arg>`, matching the local stderr line. */
-export function permissionSummary(payload) {
-  const p = payload || {}
-  const qs = Array.isArray(p.questions) ? p.questions.map(q => q?.question).filter(Boolean) : []
-  if (qs.length) return clipSummary(qs.join(' / '))
-  if (p.risk === 'plan') return clipSummary(p.plan ? `Plan ready: ${p.plan}` : 'A plan is ready for review')
-  const i = p.input
-  const arg = i && (i.command || i.file_path || i.path || i.pattern || i.url || i.query || i.description)
-  const name = p.toolName || 'A tool'
-  return clipSummary(arg ? `${name} ${arg}` : name)
-}
-
-/* Per-session permission-card notifier.
-
-   arm(id, payload)  — a card was raised. Start the grace timer.
-   resolve(id)       — the card was answered (human click, mode-flip
-                       auto-approval, or a drain-to-deny). If its timer had
-                       already FIRED we pushed a banner, so retract it.
-   clearAll()        — turn ended / session died. Every outstanding card is
-                       dead; retract anything we announced.
-
-   Timers are injected so the unit test drives them synchronously. onFire /
-   onRetract are fire-and-forget (they end up as REST inserts); a throw in
-   either must never take the bridge down. */
-export function createPermNotifier({
-  graceMs = DEFAULT_PERM_GRACE_MS,
-  onArm = () => {},
-  onFire = () => {},
-  onRetract = () => {},
-  onResolve = () => {},
-  setTimer = setTimeout,
-  clearTimer = clearTimeout,
-} = {}) {
-  const cards = new Map()   // id → { timer, fired, payload }
-  const safe = (fn, id, payload) => { try { fn(id, payload) } catch { /* never break the turn */ } }
-
-  const settle = (id) => {
-    const rec = cards.get(id)
-    if (!rec) return
-    if (rec.timer) { try { clearTimer(rec.timer) } catch { /* noop */ } }
-    cards.delete(id)
-    if (rec.fired) safe(onRetract, id, rec.payload)
-    safe(onResolve, id, rec.payload)
-  }
-
-  return {
-    arm(id, payload) {
-      if (!id || cards.has(id)) return
-      const rec = { timer: null, fired: false, payload }
-      safe(onArm, id, payload)
-      rec.timer = setTimer(() => {
-        rec.timer = null
-        rec.fired = true
-        safe(onFire, id, payload)
-      }, graceMs)
-      // Never hold the process open on a permission timer.
-      try { rec.timer?.unref?.() } catch { /* not a node timer (test double) */ }
-      cards.set(id, rec)
-    },
-    resolve: settle,
-    clearAll() { for (const id of [...cards.keys()]) settle(id) },
-    // test/debug introspection only
-    size: () => cards.size,
-    fired: (id) => !!cards.get(id)?.fired,
-  }
-}
+export const DEFAULT_MIN_TURN_MS=3e4;export const DEFAULT_PERM_GRACE_MS=2e4;export const SUMMARY_MAX=200;export function isUserFacingLane(e){return!!e&&!e.spawnedBy&&!e.flowTaskKey}export function clipSummary(e,r=200){if(null==e)return"";const t=String(e).replace(/\s+/g," ").trim();return t.length<=r?t:t.slice(0,r).replace(/\s+\S*$/,"").trimEnd()+"…"}export function shouldNotifyTurnDone({entry:e,subtype:r,startedAt:t,now:n,minTurnMs:o=3e4}){return!!shouldRecordTurnDone({entry:e,subtype:r,startedAt:t,now:n})&&n-t>=o}export function shouldRecordTurnDone({entry:e,subtype:r,startedAt:t,now:n}){return!!isUserFacingLane(e)&&"aborted"!==r&&!!t&&Number.isFinite(n)}export function permissionSummary(e){const r=e||{},t=Array.isArray(r.questions)?r.questions.map(e=>e?.question).filter(Boolean):[];if(t.length)return clipSummary(t.join(" / "));if("plan"===r.risk)return clipSummary(r.plan?`Plan ready: ${r.plan}`:"A plan is ready for review");const n=r.input,o=n&&(n.command||n.file_path||n.path||n.pattern||n.url||n.query||n.description),i=r.toolName||"A tool";return clipSummary(o?`${i} ${o}`:i)}export function createPermNotifier({graceMs:e=2e4,onArm:r=()=>{},onFire:t=()=>{},onRetract:n=()=>{},onResolve:o=()=>{},setTimer:i=setTimeout,clearTimer:a=clearTimeout}={}){const s=new Map,u=(e,r,t)=>{try{e(r,t)}catch{}},c=e=>{const r=s.get(e);if(r){if(r.timer)try{a(r.timer)}catch{}s.delete(e),r.fired&&u(n,e,r.payload),u(o,e,r.payload)}};return{arm(n,o){if(!n||s.has(n))return;const a={timer:null,fired:!1,payload:o};u(r,n,o),a.timer=i(()=>{a.timer=null,a.fired=!0,u(t,n,o)},e);try{a.timer?.unref?.()}catch{}s.set(n,a)},resolve:c,clearAll(){for(const e of[...s.keys()])c(e)},size:()=>s.size,fired:e=>!!s.get(e)?.fired}}

package/agent-visibility.mjs

@@ -1,67 +1 @@
-// Host-local picker visibility for installed coding agents.
-//
-// Installation remains detection truth: hiding a runtime does not uninstall it
-// or prevent an explicit bridge command from opening it. This preference only
-// controls which installed runtimes the web offers in human-facing terminal
-// pickers. The file is shared by the account supervisor and its room children,
-// so one dashboard toggle applies to every room served by this bridge.
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-
-export const PICKER_AGENT_COMMANDS = ['claude', 'codex', 'thinkpool']
-
-const root = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
-const defaultFile = () => path.join(root(), 'agent-visibility.json')
-const normalize = (command) => String(command || '').toLowerCase() === 'hermes'
-  ? 'thinkpool'
-  : String(command || '').toLowerCase()
-
-export function loadHiddenAgentCommands({ file = defaultFile(), fsImpl = fs } = {}) {
-  try {
-    const saved = JSON.parse(fsImpl.readFileSync(file, 'utf8'))
-    return new Set((Array.isArray(saved?.hidden) ? saved.hidden : [])
-      .map(normalize)
-      .filter((command) => PICKER_AGENT_COMMANDS.includes(command)))
-  } catch {
-    return new Set()
-  }
-}
-
-export function agentVisibilityStates(commands, { hidden = loadHiddenAgentCommands() } = {}) {
-  const found = new Set((Array.isArray(commands) ? commands : []).map(normalize))
-  const states = PICKER_AGENT_COMMANDS
-    .filter((command) => found.has(command))
-    .map((cmd) => ({ cmd, enabled: !hidden.has(cmd) }))
-  // A corrupt or hand-edited preference must not leave the "+" action with no
-  // valid runtime. The first installed product runtime is the safe recovery.
-  if (states.length > 0 && !states.some((agent) => agent.enabled)) states[0].enabled = true
-  return states
-}
-
-export function setAgentPickerVisibility(command, enabled, {
-  installed = [],
-  file = defaultFile(),
-  fsImpl = fs,
-} = {}) {
-  const cmd = normalize(command)
-  if (!PICKER_AGENT_COMMANDS.includes(cmd)) return { ok: false, error: 'unknown agent runtime' }
-  const states = agentVisibilityStates(installed, { hidden: loadHiddenAgentCommands({ file, fsImpl }) })
-  if (!states.some((agent) => agent.cmd === cmd)) return { ok: false, error: 'agent runtime is not installed' }
-  if (!enabled && states.filter((agent) => agent.enabled).length <= 1) {
-    return { ok: false, error: 'keep at least one agent in the terminal picker' }
-  }
-
-  const hidden = new Set(states.filter((agent) => !agent.enabled).map((agent) => agent.cmd))
-  if (enabled) hidden.delete(cmd)
-  else hidden.add(cmd)
-
-  try {
-    fsImpl.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 })
-    fsImpl.writeFileSync(file, JSON.stringify({ hidden: [...hidden] }, null, 2), { mode: 0o600 })
-    try { fsImpl.chmodSync(file, 0o600) } catch { /* best-effort hardening */ }
-  } catch {
-    return { ok: false, error: 'could not save agent visibility' }
-  }
-  return { ok: true, agents: agentVisibilityStates(installed, { hidden }) }
-}
+import e from"node:fs";import n from"node:os";import t from"node:path";export const PICKER_AGENT_COMMANDS=["claude","codex","thinkpool"];const i=()=>t.join(process.env.TP_PAIR_ROOT||t.join(n.homedir(),".thinkpool-pair"),"agent-visibility.json"),r=e=>"hermes"===String(e||"").toLowerCase()?"thinkpool":String(e||"").toLowerCase();export function loadHiddenAgentCommands({file:n=i(),fsImpl:t=e}={}){try{const e=JSON.parse(t.readFileSync(n,"utf8"));return new Set((Array.isArray(e?.hidden)?e.hidden:[]).map(r).filter(e=>PICKER_AGENT_COMMANDS.includes(e)))}catch{return new Set}}export function agentVisibilityStates(e,{hidden:n=loadHiddenAgentCommands()}={}){const t=new Set((Array.isArray(e)?e:[]).map(r)),i=PICKER_AGENT_COMMANDS.filter(e=>t.has(e)).map(e=>({cmd:e,enabled:!n.has(e)}));return i.length>0&&!i.some(e=>e.enabled)&&(i[0].enabled=!0),i}export function setAgentPickerVisibility(n,o,{installed:d=[],file:a=i(),fsImpl:s=e}={}){const l=r(n);if(!PICKER_AGENT_COMMANDS.includes(l))return{ok:!1,error:"unknown agent runtime"};const m=agentVisibilityStates(d,{hidden:loadHiddenAgentCommands({file:a,fsImpl:s})});if(!m.some(e=>e.cmd===l))return{ok:!1,error:"agent runtime is not installed"};if(!o&&m.filter(e=>e.enabled).length<=1)return{ok:!1,error:"keep at least one agent in the terminal picker"};const c=new Set(m.filter(e=>!e.enabled).map(e=>e.cmd));o?c.delete(l):c.add(l);try{s.mkdirSync(t.dirname(a),{recursive:!0,mode:448}),s.writeFileSync(a,JSON.stringify({hidden:[...c]},null,2),{mode:384});try{s.chmodSync(a,384)}catch{}}catch{return{ok:!1,error:"could not save agent visibility"}}return{ok:!0,agents:agentVisibilityStates(d,{hidden:c})}}

package/auth-store.mjs

@@ -1,120 +1 @@
-/* auth-store.mjs — account-mode credentials + per-session directory map for the
-   ThinkPool bridge. Files live under ~/.thinkpool-pair/ (chmod 600 for the token).
-   - auth.json: the linked account's Supabase refresh token (rotated on each use).
-   - dirs.json: per-MACHINE map of room code → absolute working directory, so one
-     account bridge can run each session's terminals in its own repo.
-   Phase 1 of the account-bridge spec (docs/specs/2026-06-16-account-bridge.md). */
-import os from 'node:os'
-import fs from 'node:fs'
-import path from 'node:path'
-
-const DIR  = path.join(os.homedir(), '.thinkpool-pair')
-const AUTH = path.join(DIR, 'auth.json')
-const DIRS = path.join(DIR, 'dirs.json')
-// served.json: per-room memory of the last real (non-home) directory a room was
-// auto-served from. Distinct from dirs.json (explicit binds): this is learned, so a
-// supervisor relaunched from $HOME still resumes each room in the repo it last ran in
-// instead of falling back to the home folder (FVIHV1DE, 2026-06-30).
-const SERVED = path.join(DIR, 'served.json')
-
-function ensureDir() { try { fs.mkdirSync(DIR, { recursive: true }) } catch { /* noop */ } }
-
-function writeAuthPayload(payload) {
-  ensureDir()
-  // ATOMIC write (2026-07-08): a crash/kill/kickstart mid-write must never leave a
-  // truncated auth.json — an unparseable token file reads as "not linked" and bricks the
-  // saved login (three bridge outages in two days, one from a restart landing mid-rotation).
-  // Write a sibling temp file, fsync it to disk, then rename OVER auth.json — rename is
-  // atomic on one filesystem, so any concurrent reader sees the whole old file or the whole
-  // new one, never a half-written token. This does NOT undo Supabase's server-side rotation
-  // (that invalidates the old token the instant refreshSession returns) — the frequency of
-  // rotation is cut by F1/F3 in account.mjs; this guarantees the file itself is never torn.
-  const tmp = `${AUTH}.tmp.${process.pid}.${Date.now()}`
-  try {
-    const fd = fs.openSync(tmp, 'w', 0o600)
-    try { fs.writeSync(fd, JSON.stringify(payload)); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
-    fs.renameSync(tmp, AUTH)
-  } catch {
-    try { fs.rmSync(tmp, { force: true }) } catch { /* noop */ }
-  }
-}
-
-export function saveAuth(session) {
-  if (!session?.refresh_token) return
-  writeAuthPayload({
-    refresh_token: session.refresh_token,
-    access_token: session.access_token || null,
-    // Unix SECONDS. Lets the bridge adopt the saved access token WITHOUT a refresh while
-    // it's still comfortably valid (account.mjs F1) — every skipped rotation is one fewer
-    // race window (and one fewer chance to be killed mid-rotation and brick the login).
-    expires_at: session.expires_at || null,
-    email: session.user?.email || session.email || null,
-    savedAt: Date.now(),
-  })
-}
-export function loadAuth() { try { return JSON.parse(fs.readFileSync(AUTH, 'utf8')) } catch { return null } }
-export function markAuthReconnectRequired(errorCode = null) {
-  const current = loadAuth()
-  if (!current?.refresh_token) return false
-  writeAuthPayload({
-    ...current,
-    reconnect_required: true,
-    reconnect_error_code: errorCode || null,
-    reconnect_required_at: Date.now(),
-  })
-  return true
-}
-export function clearAuth() { try { fs.unlinkSync(AUTH) } catch { /* noop */ } }
-
-export function loadDirs() { try { return JSON.parse(fs.readFileSync(DIRS, 'utf8')) } catch { return {} } }
-export function bindDir(room, dir) {
-  const d = loadDirs(); d[room] = dir
-  ensureDir()
-  try { fs.writeFileSync(DIRS, JSON.stringify(d, null, 2)) } catch { /* noop */ }
-  return d
-}
-export function unbindDir(room) {
-  const d = loadDirs(); delete d[room]
-  try { fs.writeFileSync(DIRS, JSON.stringify(d, null, 2)) } catch { /* noop */ }
-  return d
-}
-
-// Learned per-room serve directory (see SERVED note above). loadServed feeds the
-// dir-resolution precedence; rememberServed records the dir a room was just served
-// from so a later relaunch-from-home resumes it there rather than in $HOME.
-export function loadServed() { try { return JSON.parse(fs.readFileSync(SERVED, 'utf8')) } catch { return {} } }
-export function rememberServed(room, dir) {
-  const d = loadServed(); if (!room || !dir || d[room] === dir) return d
-  d[room] = dir
-  ensureDir()
-  try { fs.writeFileSync(SERVED, JSON.stringify(d, null, 2)) } catch { /* noop */ }
-  return d
-}
-
-// Account-wide DEFAULT serve directory: new/unbound rooms auto-serve HERE instead of
-// being refused from $HOME. Set once (CLI `set-default-dir <dir>`, or the web attach
-// card). One dir for the common "I mostly work in one repo" case; per-room binds still
-// override it. Stored as a plain path in ~/.thinkpool-pair/default-dir.
-const DEFAULTDIR = path.join(DIR, 'default-dir')
-export function loadDefaultDir() { try { const d = fs.readFileSync(DEFAULTDIR, 'utf8').trim(); return d || null } catch { return null } }
-export function saveDefaultDir(dir) { ensureDir(); try { fs.writeFileSync(DEFAULTDIR, String(dir || '')) } catch { /* noop */ } return dir }
-export function clearDefaultDir() { try { fs.unlinkSync(DEFAULTDIR) } catch { /* noop */ } }
-
-// Zero-config default: Claude Code tracks every project directory you've worked in
-// (~/.claude.json `projects`, with per-project session history under
-// ~/.claude/projects/<path-with-slashes-as-dashes>). The MOST-RECENTLY-used real project
-// dir is where you actually code — a great default for a new/unbound room, no setup. Skips
-// $HOME, tmp, and worktree paths; ranks by the session-dir mtime (encode path forward only,
-// never decode — the dash encoding is lossy for paths containing '-').
-export function claudeRecentProjectDir() {
-  try {
-    const home = os.homedir()
-    const conf = JSON.parse(fs.readFileSync(path.join(home, '.claude.json'), 'utf8'))
-    const projRoot = path.join(home, '.claude', 'projects')
-    const best = Object.keys(conf.projects || {})
-      .filter((p) => p && p !== home && !p.startsWith('/private/tmp') && !p.startsWith('/tmp') && !p.includes('/.claude/') && fs.existsSync(p))
-      .map((p) => { let mt = 0; try { mt = fs.statSync(path.join(projRoot, p.replace(/\//g, '-'))).mtimeMs } catch { /* no session dir */ } return { p, mt } })
-      .sort((a, b) => b.mt - a.mt)[0]
-    return best?.p || null
-  } catch { return null }
-}
+import t from"node:os";import e from"node:fs";import r from"node:path";const n=r.join(t.homedir(),".thinkpool-pair"),c=r.join(n,"auth.json"),o=r.join(n,"dirs.json"),i=r.join(n,"served.json");function u(){try{e.mkdirSync(n,{recursive:!0})}catch{}}function a(t){u();const r=`${c}.tmp.${process.pid}.${Date.now()}`;try{const n=e.openSync(r,"w",384);try{e.writeSync(n,JSON.stringify(t)),e.fsyncSync(n)}finally{e.closeSync(n)}e.renameSync(r,c)}catch{try{e.rmSync(r,{force:!0})}catch{}}}export function saveAuth(t){t?.refresh_token&&a({refresh_token:t.refresh_token,access_token:t.access_token||null,expires_at:t.expires_at||null,email:t.user?.email||t.email||null,savedAt:Date.now()})}export function loadAuth(){try{return JSON.parse(e.readFileSync(c,"utf8"))}catch{return null}}export function markAuthReconnectRequired(t=null){const e=loadAuth();return!!e?.refresh_token&&(a({...e,reconnect_required:!0,reconnect_error_code:t||null,reconnect_required_at:Date.now()}),!0)}export function clearAuth(){try{e.unlinkSync(c)}catch{}}export function loadDirs(){try{return JSON.parse(e.readFileSync(o,"utf8"))}catch{return{}}}export function bindDir(t,r){const n=loadDirs();n[t]=r,u();try{e.writeFileSync(o,JSON.stringify(n,null,2))}catch{}return n}export function unbindDir(t){const r=loadDirs();delete r[t];try{e.writeFileSync(o,JSON.stringify(r,null,2))}catch{}return r}export function loadServed(){try{return JSON.parse(e.readFileSync(i,"utf8"))}catch{return{}}}export function rememberServed(t,r){const n=loadServed();if(!t||!r||n[t]===r)return n;n[t]=r,u();try{e.writeFileSync(i,JSON.stringify(n,null,2))}catch{}return n}const l=r.join(n,"default-dir");export function loadDefaultDir(){try{return e.readFileSync(l,"utf8").trim()||null}catch{return null}}export function saveDefaultDir(t){u();try{e.writeFileSync(l,String(t||""))}catch{}return t}export function clearDefaultDir(){try{e.unlinkSync(l)}catch{}}export function claudeRecentProjectDir(){try{const n=t.homedir(),c=JSON.parse(e.readFileSync(r.join(n,".claude.json"),"utf8")),o=r.join(n,".claude","projects"),i=Object.keys(c.projects||{}).filter(t=>t&&t!==n&&!t.startsWith("/private/tmp")&&!t.startsWith("/tmp")&&!t.includes("/.claude/")&&e.existsSync(t)).map(t=>{let n=0;try{n=e.statSync(r.join(o,t.replace(/\//g,"-"))).mtimeMs}catch{}return{p:t,mt:n}}).sort((t,e)=>e.mt-t.mt)[0];return i?.p||null}catch{return null}}