thinkpool-pair 0.7.364 → 0.7.366

package/session-store.mjs

@@ -1,484 +1 @@
-/* ─────────────────────────────────────────────────────────────
-   session-store.mjs — durable scrollback for structured Claude
-   sessions, "file now" tier (no DB). Each structured session's
-   event log + its SDK sessionId are written to a per-room file on
-   the host (~/.thinkpool-pair/<ROOM>/<id>.json), debounced. On a
-   bridge restart the latest session is reloaded: the transcript
-   replays immediately, and (if recent) the SDK session resumes so
-   the live context survives too. A DB-backed tier comes later.
-   ───────────────────────────────────────────────────────────── */
-
-import os from 'node:os'
-import fs from 'node:fs'
-import path from 'node:path'
-import { SPAWN } from './cross-terminal.mjs'
-import { boundStructuredLog } from './event-bounds.mjs'
-
-// TP_PAIR_ROOT override exists for tests + sandboxes so they never touch the real
-// ~/.thinkpool-pair store. Read LIVE per call (not captured at module load) so a test
-// can point each case at a fresh tempdir after importing this module. Production leaves
-// it unset → the real home-dir store.
-const ROOT = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
-// Security (audit 2026-07-02): `room` is an external value (a session/code id)
-// used as a filesystem path segment. sessions.id is unconstrained TEXT in the
-// DB and client-generated, so a crafted id like '../../foo' would otherwise let
-// a hostile room write session files OUTSIDE ~/.thinkpool-pair. Contain EVERY
-// derived path under ROOT: resolve and refuse if the result escapes. Pair of
-// the bridge.mjs startup format check — belt + suspenders.
-const dir = (room) => {
-  const root = path.resolve(ROOT())
-  const target = path.resolve(root, room || 'default')
-  if (target !== root && !target.startsWith(root + path.sep)) {
-    throw new Error(`refused: room path escapes sandbox: ${JSON.stringify(room)}`)
-  }
-  return target
-}
-const archiveDir = (room) => path.join(dir(room), '.archive')
-// Only resume the live SDK context for recent sessions — an expired session id
-// fails ("No conversation found"); past this window we restore transcript only.
-const RESUME_MAX_AGE_MS = 12 * 60 * 60 * 1000
-// A live snapshot exists precisely so a live structured lane can survive a bridge
-// restart. Keep every lane the bridge can admit. Explicitly closed lanes move to
-// .archive/, so closed/history retention stays separate from this live set.
-export const LIVE_SESSION_MAX = SPAWN.machineMax
-
-function ensureDir(room) { fs.mkdirSync(dir(room), { recursive: true }) }
-
-// Commit a replacement through a sibling file so a restart never observes a torn
-// final record. The temp file is fsynced before the same-directory rename: readers
-// see the complete previous value or the complete replacement, never a half-write.
-// This is shared by session JSON plus the restart-critical names and PTY metadata.
-let tempSerial = 0
-let beforeAtomicRenameForTest = null
-function atomicCommit(file, contents) {
-  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.tmp.${process.pid}.${Date.now()}.${tempSerial++}`)
-  let fd = null
-  try {
-    fd = fs.openSync(tmp, 'wx', 0o600)
-    // fs.writeSync may legally write fewer bytes than requested. Never fsync and
-    // promote a partial temp file over the last good snapshot.
-    const bytes = Buffer.from(contents)
-    for (let offset = 0; offset < bytes.length;) {
-      const written = fs.writeSync(fd, bytes, offset, bytes.length - offset)
-      if (written <= 0) throw new Error(`short write while committing ${file}`)
-      offset += written
-    }
-    fs.fsyncSync(fd)
-    fs.closeSync(fd); fd = null
-    beforeAtomicRenameForTest?.({ file, tmp })
-    fs.renameSync(tmp, file)
-    return true
-  } catch (error) {
-    try { if (fd != null) fs.closeSync(fd) } catch { /* best effort */ }
-    try { fs.rmSync(tmp, { force: true }) } catch { /* best effort */ }
-    throw error
-  }
-}
-// Direct persistence tests inject a crash-equivalent immediately before rename.
-// Production never configures this hook.
-export function setAtomicCommitHookForTest(hook) {
-  beforeAtomicRenameForTest = typeof hook === 'function' ? hook : null
-}
-function persistenceError(action, file, error) {
-  console.error(`[thinkpool-pair session-store] ${action} failed for ${file}: ${error?.message || error}`)
-}
-// Move a session file into <room>/.archive/ instead of unlinking it. Archived files
-// are OUTSIDE the readdirSync(dir) path loadAll/listRecs read, so a bridge restart
-// never resurrects them — but they survive on disk for manual recovery. This is the
-// data-loss backstop: a pruned/closed terminal's transcript is always recoverable.
-// (2026-06-26: prune used to unlinkSync, permanently destroying older terminals —
-// "Blightborne" was lost this way. Named terminals are now additionally immune.)
-function archive(room, file) {
-  try {
-    fs.mkdirSync(archiveDir(room), { recursive: true })
-    const base = path.basename(file)
-    const dst = path.join(archiveDir(room), `${base}.${Date.now()}`)
-    fs.renameSync(file, dst)
-    return true
-  } catch (error) {
-    persistenceError('archive session snapshot', file, error)
-    return false
-  }
-}
-function listRecs(room) {
-  try {
-    return fs.readdirSync(dir(room)).filter((f) => f.endsWith('.json'))
-      .map((f) => {
-        const p = path.join(dir(room), f)
-        try {
-          const r = JSON.parse(fs.readFileSync(p, 'utf8'))
-          // _bt: the rec FILE's creation time — a reliable, monotonic proxy for when the
-          // terminal was first opened (overwrites on save don't change it). Used to restore
-          // tabs in stable creation order; the persisted openedAt is unreliable because a
-          // truncated log's first event ts drifts far from real creation. Load-time only.
-          try { const s = fs.statSync(p); r._bt = s.birthtimeMs || s.mtimeMs || 0 } catch { r._bt = 0 }
-          return r
-        } catch (error) {
-          // Keep the damaged file in place for recovery; never silently make a
-          // restart look like a deliberately closed lane.
-          persistenceError('parse session snapshot', p, error)
-          return null
-        }
-      })
-      .filter(Boolean)
-  } catch { return [] }
-}
-function prune(room) {
-  try {
-    const names = loadNames(room)            // { id: label } — NAMED terminals are immune
-    const namedId = (p) => { try { return JSON.parse(fs.readFileSync(p, 'utf8')).id } catch { return null } }
-    const files = fs.readdirSync(dir(room)).filter((f) => f.endsWith('.json'))
-      .map((f) => { const p = path.join(dir(room), f); let m = 0; try { m = JSON.parse(fs.readFileSync(p, 'utf8')).savedAt || 0 } catch { /* noop */ } return { p, f, m } })
-      .sort((a, b) => b.m - a.m)
-    // Only UNNAMED sessions are eligible for prune. A named terminal is deliberate
-    // user intent (a project) and must never be silently destroyed by churn.
-    const prunable = files.filter((x) => { const id = namedId(x.p); return !id || !names[id] })
-    prunable.slice(LIVE_SESSION_MAX).forEach((x) => archive(room, x.p))
-  } catch (error) { persistenceError('prune live session snapshots', dir(room), error) }
-}
-
-// ── Durable append-only event log (unbounded history; the <id>.json snapshot is
-// still capped at STRUCTURED_LOG_MAX for fast restart, this is the full archive). ──
-// One JSONL per terminal: every transcript event appended once, O(1), never rewritten.
-// Powers "load earlier history" paging without holding the whole log in memory.
-const eventsLog = (room, id) => path.join(dir(room), `${id}.events.jsonl`)
-
-// Append events to the durable log. Caller passes only the events it wants kept
-// (transcript kinds) — chrome/thinking noise is filtered upstream. Sync append keeps
-// strict on-disk order; writes are tiny so the blocking cost is negligible.
-export function appendDurableEvents(room, id, events) {
-  if (!room || !id || !Array.isArray(events) || !events.length) return
-  try {
-    ensureDir(room)
-    fs.appendFileSync(eventsLog(room, id), events.map((e) => JSON.stringify(e)).join('\n') + '\n')
-  } catch { /* noop */ }
-}
-
-// One-time seed: if the durable log doesn't exist yet (a terminal that predates this
-// feature, or a fresh restart before any new event), write the loaded snapshot as the
-// base so the retained window is immediately pageable. No-op once the file exists, so
-// reloaded events never double-append (only genuinely-new events ride pushLog → append).
-export function seedDurableEvents(room, id, events) {
-  if (!room || !id || !Array.isArray(events) || !events.length) return
-  try {
-    ensureDir(room)
-    const f = eventsLog(room, id)
-    if (fs.existsSync(f)) return
-    fs.writeFileSync(f, events.map((e) => JSON.stringify(e)).join('\n') + '\n')
-  } catch { /* noop */ }
-}
-
-// Does this bridge hold a durable archive for `id`? The capability half of the
-// history-page-request guard (a foreign bridge in a multi-bridge room has no file).
-export function hasDurableArchive(room, id) {
-  try { return !!room && !!id && fs.existsSync(eventsLog(room, id)) } catch { return false }
-}
-
-// Should THIS bridge answer a history-page-request? (pure — tested in test-history-ab.mjs)
-//
-// Two independent gates, both required:
-//  · `payloadHost` — the same targeting guard every other broadcast handler carries
-//    (term-open, file-put, code-open, flow-*): a targeted request is for ONE machine.
-//  · ownership — no client build to date STAMPS a host on this event, so targeting
-//    alone leaves an untargeted request answerable by every bridge in the room. The
-//    bridge that doesn't serve the terminal has no archive, replies
-//    `{ events: [], hasMore: false }`, and the client reads that first empty page as
-//    "no older history" — the load-earlier pill dies and recoverable history looks
-//    gone. Only the bridge that actually HOLDS the terminal may speak: a live session,
-//    or (a closed lane whose transcript is still on screen) its durable archive.
-export function servesHistoryPage({ payloadHost, bridgeName, hasSession, hasArchive }) {
-  if (payloadHost && payloadHost !== bridgeName) return false
-  return !!(hasSession || hasArchive)
-}
-
-// ── Epochs: /clear resets the per-session seq counter (bridge.mjs) but the durable
-// archive is append-only and keeps every era. So one file can hold seq 1..500 (pre-clear)
-// followed by seq 1..30 (post-clear) — colliding keys. `findIndex(e.seq >= beforeSeq)`
-// then anchors in the WRONG era and a page splices two conversations together.
-//
-// A seq that does not strictly increase over its predecessor is, by construction, a
-// counter reset: within one bridge run the counter only climbs, and a restart reseeds it
-// from maxSeq(restored log). So the last regression marks the start of the CURRENT epoch,
-// and only that epoch is pageable. Everything older is a conversation the user explicitly
-// cleared — surfacing it under colliding seqs would be wrong twice over.
-//
-// This is read-side only: it needs no migration and fixes archives already on disk
-// (every user's, right now) as well as ones written from here on.
-function epochStart(all) {
-  let start = 0, last = -Infinity
-  for (let i = 0; i < all.length; i++) {
-    const s = all[i]?.seq
-    if (typeof s !== 'number') continue
-    if (s <= last) { start = i; last = s; continue }   // counter went backwards → new era
-    last = s
-  }
-  return start
-}
-
-function readArchive(room, id) {
-  const f = eventsLog(room, id)
-  if (!fs.existsSync(f)) return null
-  const all = []
-  for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
-    if (!line) continue
-    try { all.push(JSON.parse(line)) } catch { /* skip a torn line */ }
-  }
-  return all
-}
-
-// The archive FLOOR: the lowest transcript seq durably stored for this terminal *in the
-// current epoch*. The client compares its oldest loaded seq against this — only OFFER
-// "load earlier" when there genuinely are older events in the archive (vs a fresh lane
-// whose first turn happens to land at seq > 1, or an evicted-but-unarchived gap).
-// null = no archive.
-export function readDurableOldestSeq(room, id) {
-  try {
-    const all = readArchive(room, id)
-    if (!all) return null
-    for (let i = epochStart(all); i < all.length; i++) {
-      if (all[i] && all[i].seq != null) return all[i].seq
-    }
-    return null
-  } catch { return null }
-}
-
-// Read a backward page: events with transcript seq < beforeSeq (newest `limit` of
-// them, no-seq chrome interleaved by file order preserved). Returns { events, hasMore }.
-// beforeSeq null → the newest `limit` events (the tail). hasMore = there is older still.
-// Never reads below the current epoch — see epochStart.
-export function readDurablePage(room, id, beforeSeq, limit = 200) {
-  try {
-    const all = readArchive(room, id)
-    if (!all) return { events: [], hasMore: false }
-    const from = epochStart(all)
-    let bound = all.length
-    if (beforeSeq != null) {
-      const i = all.findIndex((e, idx) => idx >= from && e && e.seq != null && e.seq >= beforeSeq)
-      if (i >= 0) bound = i
-    }
-    const start = Math.max(from, bound - limit)
-    return { events: all.slice(start, Math.max(start, bound)), hasMore: start > from }
-  } catch { return { events: [], hasMore: false } }
-}
-
-const timers = new Map()
-function write(room, id, data) {
-  const file = path.join(dir(room), `${id}.json`)
-  try {
-    ensureDir(room)
-    const log = Array.isArray(data?.log) ? boundStructuredLog(data.log) : data?.log
-    atomicCommit(file, JSON.stringify({ ...data, ...(log ? { log } : {}), id, savedAt: Date.now() }))
-    prune(room)
-    return true
-  } catch (error) {
-    persistenceError('write session snapshot', file, error)
-    return false
-  }
-}
-// Debounced — events arrive in bursts; one write per ~1.5s is plenty.
-export function saveSession(room, id, data) {
-  clearTimeout(timers.get(id))
-  timers.set(id, setTimeout(() => write(room, id, data), 1500))
-}
-export function flushSession(room, id, data) { clearTimeout(timers.get(id)); return write(room, id, data) }
-// User-initiated close: cancel any pending debounced save and move the on-disk
-// record to .archive/ so a later loadAll() (bridge restart) can't resurrect a
-// closed terminal — but the transcript stays recoverable. PTY ids never have an
-// <id>.json (they use the .pty-id dotfile), so this no-ops harmlessly for them.
-export function deleteSession(room, id) {
-  clearTimeout(timers.get(id)); timers.delete(id)
-  const p = path.join(dir(room), `${id}.json`)
-  try { return !fs.existsSync(p) || archive(room, p) }
-  catch (error) { persistenceError('archive closed session snapshot', p, error); return false }
-}
-
-// Scheduled outcomes use a separate host outbox from live session snapshots.
-// A person may close the visible terminal while its idempotent database finish
-// is retrying; keeping the intent here lets a restart complete that write without
-// loadAll() resurrecting the deliberately closed terminal.
-const scheduledOutcomesFile = (room) => path.join(dir(room), '.scheduled-outcomes')
-const safeTerminalId = (value) => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,159}$/.test(value)
-const safeRunId = (value) => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,159}$/.test(value)
-const readScheduledOutcomeMap = (room) => {
-  try {
-    const value = JSON.parse(fs.readFileSync(scheduledOutcomesFile(room), 'utf8'))
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {}
-  } catch { return {} }
-}
-// Pending entries from the original format are raw intents. Once the database
-// finish and recorded session snapshot are both durable, replace that raw entry
-// with a versioned acknowledgement tombstone before attempting deletion. The
-// tombstone is intentionally independent of the live/archived session record:
-// restart recovery can therefore identify an acknowledged exact run and retry
-// deletion only, without issuing another finish RPC or reclassifying its result.
-const scheduledOutcomeRecord = (value) => {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return null
-  if (value.v === 1 && value.state === 'acknowledged') {
-    const intent = value.intent
-    return intent && typeof intent === 'object' && !Array.isArray(intent) &&
-      safeRunId(intent.runId) && value.runId === intent.runId
-      ? { intent, acknowledged: true }
-      : null
-  }
-  return safeRunId(value.runId) ? { intent: value, acknowledged: false } : null
-}
-export function savePendingScheduledOutcome(room, terminalId, intent) {
-  if (!safeTerminalId(terminalId) || !intent || typeof intent !== 'object' || Array.isArray(intent) || !safeRunId(intent.runId)) return false
-  try {
-    ensureDir(room)
-    const pending = readScheduledOutcomeMap(room)
-    pending[terminalId] = intent
-    atomicCommit(scheduledOutcomesFile(room), JSON.stringify(pending))
-    return true
-  } catch (error) {
-    persistenceError('write scheduled outcome outbox', scheduledOutcomesFile(room), error)
-    return false
-  }
-}
-export function loadPendingScheduledOutcomes(room) {
-  return Object.entries(readScheduledOutcomeMap(room))
-    .map(([terminalId, value]) => ({ terminalId, record: scheduledOutcomeRecord(value) }))
-    .filter(({ terminalId, record }) => safeTerminalId(terminalId) && record)
-    .map(({ terminalId, record }) => ({
-      terminalId,
-      intent: record.intent,
-      ...(record.acknowledged ? { acknowledged: true } : {}),
-    }))
-    .slice(0, LIVE_SESSION_MAX)
-}
-export function loadPendingScheduledOutcome(room, terminalId) {
-  if (!safeTerminalId(terminalId)) return null
-  return scheduledOutcomeRecord(readScheduledOutcomeMap(room)[terminalId])?.intent || null
-}
-export function acknowledgePendingScheduledOutcome(room, terminalId, runId) {
-  if (!safeTerminalId(terminalId) || !safeRunId(runId)) return false
-  try {
-    const pending = readScheduledOutcomeMap(room)
-    const record = scheduledOutcomeRecord(pending[terminalId])
-    if (!record || record.intent.runId !== runId) return false
-    if (record.acknowledged) return true
-    pending[terminalId] = {
-      v: 1,
-      state: 'acknowledged',
-      runId,
-      intent: record.intent,
-    }
-    atomicCommit(scheduledOutcomesFile(room), JSON.stringify(pending))
-    return true
-  } catch (error) {
-    persistenceError('acknowledge scheduled outcome outbox', scheduledOutcomesFile(room), error)
-    return false
-  }
-}
-export function deletePendingScheduledOutcome(room, terminalId) {
-  if (!safeTerminalId(terminalId)) return false
-  try {
-    const pending = readScheduledOutcomeMap(room)
-    if (!(terminalId in pending)) return true
-    delete pending[terminalId]
-    if (Object.keys(pending).length) atomicCommit(scheduledOutcomesFile(room), JSON.stringify(pending))
-    else fs.rmSync(scheduledOutcomesFile(room), { force: true })
-    return true
-  } catch (error) {
-    persistenceError('delete scheduled outcome outbox', scheduledOutcomesFile(room), error)
-    return false
-  }
-}
-
-// A database acknowledgement is not locally committed until the corresponding
-// live-session snapshot has synchronously recorded scheduleOutcomeRecorded=true
-// AND the exact outbox is durably marked acknowledged. Keep deletion behind both
-// barriers so a restart always sees one of:
-//   1. pending outbox intent to replay idempotently;
-//   2. an acknowledged outbox tombstone to delete only; or
-//   3. a recorded session snapshot with no outbox.
-// `flushRecordedSnapshot` is intentionally injected by bridge.mjs because only
-// the live entry can produce its complete session payload.
-export function commitRecordedScheduledOutcome(room, terminalId, flushRecordedSnapshot) {
-  let snapshotRecorded = false
-  try {
-    snapshotRecorded = typeof flushRecordedSnapshot === 'function' && flushRecordedSnapshot() === true
-  } catch (error) {
-    persistenceError('record scheduled outcome in session snapshot', path.join(dir(room), `${terminalId}.json`), error)
-  }
-  if (!snapshotRecorded) return { ok: false, snapshotRecorded: false, outboxAcknowledged: false, outboxDeleted: false }
-  const intent = loadPendingScheduledOutcome(room, terminalId)
-  const outboxAcknowledged = acknowledgePendingScheduledOutcome(room, terminalId, intent?.runId)
-  if (!outboxAcknowledged) return { ok: false, snapshotRecorded: true, outboxAcknowledged: false, outboxDeleted: false }
-  const outboxDeleted = deletePendingScheduledOutcome(room, terminalId)
-  return { ok: outboxDeleted, snapshotRecorded: true, outboxAcknowledged: true, outboxDeleted }
-}
-
-// Most-recently-saved structured session for the room (drives attached restore).
-export function loadLatest(room) {
-  const recs = listRecs(room).sort((a, b) => (b.savedAt || 0) - (a.savedAt || 0))
-  return recs[0] || null
-}
-export function canResume(rec) {
-  return !!(rec && rec.sessionId && rec.savedAt && (Date.now() - rec.savedAt) < RESUME_MAX_AGE_MS)
-}
-
-// EVERY saved session for the room, oldest→newest (so tabs reappear in order).
-// Drives resume-ALL on a bridge restart — without this only the latest session
-// came back and every backgrounded terminal died on restart despite its state
-// sitting on disk. Bounded by LIVE_SESSION_MAX, exactly the admission capacity.
-export function loadAll(room) {
-  return listRecs(room).sort((a, b) => (a.savedAt || 0) - (b.savedAt || 0))
-}
-
-// Closed terminal snapshots stay recoverable under .archive/. Past-work search
-// reads only these already-bounded snapshots, never the unbounded JSONL logs.
-export function loadArchived(room, limit = 40) {
-  try {
-    return fs.readdirSync(archiveDir(room))
-      .map((name) => {
-        const file = path.join(archiveDir(room), name)
-        try {
-          const stat = fs.statSync(file)
-          if (!stat.isFile()) return null
-          const record = JSON.parse(fs.readFileSync(file, 'utf8'))
-          return record && Array.isArray(record.log) ? { ...record, _archivedAt: stat.mtimeMs || 0 } : null
-        } catch { return null }
-      })
-      .filter(Boolean)
-      .sort((a, b) => (b._archivedAt || b.savedAt || 0) - (a._archivedAt || a.savedAt || 0))
-      .slice(0, Math.max(1, Math.min(100, Number(limit) || 40)))
-  } catch {
-    return []
-  }
-}
-
-// Last PTY terminal id auto-opened for an attached command. A reconnecting
-// bridge reuses it so it re-attaches to the SAME terminal tab instead of
-// minting a fresh UUID and breeding a new dormant "Terminal N" each restart.
-// Stored as a dotfile (NOT *.json) so it never lands in listRecs/loadLatest.
-const ptyFile = (room) => path.join(dir(room), '.pty-id')
-export function loadPtyId(room) {
-  try { return fs.readFileSync(ptyFile(room), 'utf8').trim() || null } catch { return null }
-}
-export function savePtyId(room, id) {
-  const file = ptyFile(room)
-  try { ensureDir(room); atomicCommit(file, String(id)); return true }
-  catch (error) { persistenceError('write PTY id', file, error); return false }
-}
-
-// Per-room terminal display names (terminal id -> label), set via the web's
-// `term-rename` broadcast. This is what makes a rename CROSS-DEVICE + survive a
-// bridge restart: names were previously web-localStorage only + a live broadcast,
-// so a device that joined later (or a second machine) saw none of them. The bridge
-// stores them here and includes them in every announce. Stored as a single dotfile
-// (NOT *.json) so it never lands in listRecs/loadAll.
-const namesFile = (room) => path.join(dir(room), '.names')
-export function loadNames(room) {
-  const file = namesFile(room)
-  try { return JSON.parse(fs.readFileSync(file, 'utf8')) || {} }
-  catch (error) {
-    if (error?.code !== 'ENOENT') persistenceError('parse terminal names', file, error)
-    return {}
-  }
-}
-export function saveNames(room, names) {
-  const file = namesFile(room)
-  try { ensureDir(room); atomicCommit(file, JSON.stringify(names || {})); return true }
-  catch (error) { persistenceError('write terminal names', file, error); return false }
-}
+import e from"node:os";import t from"node:fs";import n from"node:path";import{SPAWN as r}from"./cross-terminal.mjs";import{boundStructuredLog as o}from"./event-bounds.mjs";const c=t=>{const r=n.resolve(process.env.TP_PAIR_ROOT||n.join(e.homedir(),".thinkpool-pair")),o=n.resolve(r,t||"default");if(o!==r&&!o.startsWith(r+n.sep))throw new Error(`refused: room path escapes sandbox: ${JSON.stringify(t)}`);return o},s=e=>n.join(c(e),".archive");export const LIVE_SESSION_MAX=r.machineMax;function i(e){t.mkdirSync(c(e),{recursive:!0})}let a=0,u=null;function l(e,r){const o=n.join(n.dirname(e),`.${n.basename(e)}.tmp.${process.pid}.${Date.now()}.${a++}`);let c=null;try{c=t.openSync(o,"wx",384);const n=Buffer.from(r);for(let r=0;r<n.length;){const o=t.writeSync(c,n,r,n.length-r);if(o<=0)throw new Error(`short write while committing ${e}`);r+=o}return t.fsyncSync(c),t.closeSync(c),c=null,u?.({file:e,tmp:o}),t.renameSync(o,e),!0}catch(e){try{null!=c&&t.closeSync(c)}catch{}try{t.rmSync(o,{force:!0})}catch{}throw e}}export function setAtomicCommitHookForTest(e){u="function"==typeof e?e:null}function d(e,t,n){console.error(`[thinkpool-pair session-store] ${e} failed for ${t}: ${n?.message||n}`)}function f(e,r){try{t.mkdirSync(s(e),{recursive:!0});const o=n.basename(r),c=n.join(s(e),`${o}.${Date.now()}`);return t.renameSync(r,c),!0}catch(e){return d("archive session snapshot",r,e),!1}}function y(e){try{return t.readdirSync(c(e)).filter(e=>e.endsWith(".json")).map(r=>{const o=n.join(c(e),r);try{const e=JSON.parse(t.readFileSync(o,"utf8"));try{const n=t.statSync(o);e._bt=n.birthtimeMs||n.mtimeMs||0}catch{e._bt=0}return e}catch(e){return d("parse session snapshot",o,e),null}}).filter(Boolean)}catch{return[]}}const h=(e,t)=>n.join(c(e),`${t}.events.jsonl`);export function appendDurableEvents(e,n,r){if(e&&n&&Array.isArray(r)&&r.length)try{i(e),t.appendFileSync(h(e,n),r.map(e=>JSON.stringify(e)).join("\n")+"\n")}catch{}}export function seedDurableEvents(e,n,r){if(e&&n&&Array.isArray(r)&&r.length)try{i(e);const o=h(e,n);if(t.existsSync(o))return;t.writeFileSync(o,r.map(e=>JSON.stringify(e)).join("\n")+"\n")}catch{}}export function hasDurableArchive(e,n){try{return!!e&&!!n&&t.existsSync(h(e,n))}catch{return!1}}export function servesHistoryPage({payloadHost:e,bridgeName:t,hasSession:n,hasArchive:r}){return!(e&&e!==t||!n&&!r)}function p(e){let t=0,n=-1/0;for(let r=0;r<e.length;r++){const o=e[r]?.seq;"number"==typeof o&&(o<=n?(t=r,n=o):n=o)}return t}function m(e,n){const r=h(e,n);if(!t.existsSync(r))return null;const o=[];for(const e of t.readFileSync(r,"utf8").split("\n"))if(e)try{o.push(JSON.parse(e))}catch{}return o}export function readDurableOldestSeq(e,t){try{const n=m(e,t);if(!n)return null;for(let e=p(n);e<n.length;e++)if(n[e]&&null!=n[e].seq)return n[e].seq;return null}catch{return null}}export function readDurablePage(e,t,n,r=200){try{const o=m(e,t);if(!o)return{events:[],hasMore:!1};const c=p(o);let s=o.length;if(null!=n){const e=o.findIndex((e,t)=>t>=c&&e&&null!=e.seq&&e.seq>=n);e>=0&&(s=e)}const i=Math.max(c,s-r);return{events:o.slice(i,Math.max(i,s)),hasMore:i>c}}catch{return{events:[],hasMore:!1}}}const S=new Map;function g(e,r,s){const a=n.join(c(e),`${r}.json`);try{i(e);const u=Array.isArray(s?.log)?o(s.log):s?.log;return l(a,JSON.stringify({...s,...u?{log:u}:{},id:r,savedAt:Date.now()})),function(e){try{const r=loadNames(e),o=e=>{try{return JSON.parse(t.readFileSync(e,"utf8")).id}catch{return null}};t.readdirSync(c(e)).filter(e=>e.endsWith(".json")).map(r=>{const o=n.join(c(e),r);let s=0;try{s=JSON.parse(t.readFileSync(o,"utf8")).savedAt||0}catch{}return{p:o,f:r,m:s}}).sort((e,t)=>t.m-e.m).filter(e=>{const t=o(e.p);return!t||!r[t]}).slice(LIVE_SESSION_MAX).forEach(t=>f(e,t.p))}catch(t){d("prune live session snapshots",c(e),t)}}(e),!0}catch(e){return d("write session snapshot",a,e),!1}}export function saveSession(e,t,n){clearTimeout(S.get(t)),S.set(t,setTimeout(()=>g(e,t,n),1500))}export function flushSession(e,t,n){return clearTimeout(S.get(t)),g(e,t,n)}export function deleteSession(e,r){clearTimeout(S.get(r)),S.delete(r);const o=n.join(c(e),`${r}.json`);try{return!t.existsSync(o)||f(e,o)}catch(e){return d("archive closed session snapshot",o,e),!1}}const x=e=>n.join(c(e),".scheduled-outcomes"),A=e=>"string"==typeof e&&/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,159}$/.test(e),v=e=>"string"==typeof e&&/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,159}$/.test(e),O=e=>{try{const n=JSON.parse(t.readFileSync(x(e),"utf8"));return n&&"object"==typeof n&&!Array.isArray(n)?n:{}}catch{return{}}},w=e=>{if(!e||"object"!=typeof e||Array.isArray(e))return null;if(1===e.v&&"acknowledged"===e.state){const t=e.intent;return t&&"object"==typeof t&&!Array.isArray(t)&&v(t.runId)&&e.runId===t.runId?{intent:t,acknowledged:!0}:null}return v(e.runId)?{intent:e,acknowledged:!1}:null};export function savePendingScheduledOutcome(e,t,n){if(!A(t)||!n||"object"!=typeof n||Array.isArray(n)||!v(n.runId))return!1;try{i(e);const r=O(e);return r[t]=n,l(x(e),JSON.stringify(r)),!0}catch(t){return d("write scheduled outcome outbox",x(e),t),!1}}export function loadPendingScheduledOutcomes(e){return Object.entries(O(e)).map(([e,t])=>({terminalId:e,record:w(t)})).filter(({terminalId:e,record:t})=>A(e)&&t).map(({terminalId:e,record:t})=>({terminalId:e,intent:t.intent,...t.acknowledged?{acknowledged:!0}:{}})).slice(0,LIVE_SESSION_MAX)}export function loadPendingScheduledOutcome(e,t){return A(t)&&w(O(e)[t])?.intent||null}export function acknowledgePendingScheduledOutcome(e,t,n){if(!A(t)||!v(n))return!1;try{const r=O(e),o=w(r[t]);return!(!o||o.intent.runId!==n||(o.acknowledged||(r[t]={v:1,state:"acknowledged",runId:n,intent:o.intent},l(x(e),JSON.stringify(r))),0))}catch(t){return d("acknowledge scheduled outcome outbox",x(e),t),!1}}export function deletePendingScheduledOutcome(e,n){if(!A(n))return!1;try{const r=O(e);return!(n in r)||(delete r[n],Object.keys(r).length?l(x(e),JSON.stringify(r)):t.rmSync(x(e),{force:!0}),!0)}catch(t){return d("delete scheduled outcome outbox",x(e),t),!1}}export function commitRecordedScheduledOutcome(e,t,r){let o=!1;try{o="function"==typeof r&&!0===r()}catch(r){d("record scheduled outcome in session snapshot",n.join(c(e),`${t}.json`),r)}if(!o)return{ok:!1,snapshotRecorded:!1,outboxAcknowledged:!1,outboxDeleted:!1};const s=loadPendingScheduledOutcome(e,t);if(!acknowledgePendingScheduledOutcome(e,t,s?.runId))return{ok:!1,snapshotRecorded:!0,outboxAcknowledged:!1,outboxDeleted:!1};const i=deletePendingScheduledOutcome(e,t);return{ok:i,snapshotRecorded:!0,outboxAcknowledged:!0,outboxDeleted:i}}export function loadLatest(e){return y(e).sort((e,t)=>(t.savedAt||0)-(e.savedAt||0))[0]||null}export function canResume(e){return!!(e&&e.sessionId&&e.savedAt&&Date.now()-e.savedAt<432e5)}export function loadAll(e){return y(e).sort((e,t)=>(e.savedAt||0)-(t.savedAt||0))}export function loadArchived(e,r=40){try{return t.readdirSync(s(e)).map(r=>{const o=n.join(s(e),r);try{const e=t.statSync(o);if(!e.isFile())return null;const n=JSON.parse(t.readFileSync(o,"utf8"));return n&&Array.isArray(n.log)?{...n,_archivedAt:e.mtimeMs||0}:null}catch{return null}}).filter(Boolean).sort((e,t)=>(t._archivedAt||t.savedAt||0)-(e._archivedAt||e.savedAt||0)).slice(0,Math.max(1,Math.min(100,Number(r)||40)))}catch{return[]}}const b=e=>n.join(c(e),".pty-id");export function loadPtyId(e){try{return t.readFileSync(b(e),"utf8").trim()||null}catch{return null}}export function savePtyId(e,t){const n=b(e);try{return i(e),l(n,String(t)),!0}catch(e){return d("write PTY id",n,e),!1}}const j=e=>n.join(c(e),".names");export function loadNames(e){const n=j(e);try{return JSON.parse(t.readFileSync(n,"utf8"))||{}}catch(e){return"ENOENT"!==e?.code&&d("parse terminal names",n,e),{}}}export function saveNames(e,t){const n=j(e);try{return i(e),l(n,JSON.stringify(t||{})),!0}catch(e){return d("write terminal names",n,e),!1}}

package/side-lane.mjs

@@ -1,63 +1 @@
-import { buildRecapFromLog } from './recap.mjs'
-
-export const SIDE_RECAP_CAP = 12_000
-
-export const SIDE_ROLE_PROMPT = `You are a ThinkPool side lane attached to a main terminal.
-Focus first on reading, searching, comparing, and answering the side task. You are a full agent and share the main terminal's working directory, so coordinate through ThinkPool Peer before changing files that another lane may be editing. Do not make edits unless a person explicitly asks for them in this side lane. Keep the investigation self-contained; the main terminal receives nothing until a person chooses Bring to main.`
-
-export const SIDE_HANDOFF_PROMPT = `Prepare a compact handoff for the main terminal now.
-Return only the handoff. Include: conclusion, strongest evidence, files changed or artifacts produced, and any unresolved question or recommended next action. Do not continue the investigation and do not address the reader conversationally.`
-
-export const SIDE_MAIN_TURN_PROMPT = `A room member chose Bring to main.
-Read the side-lane handoff below, incorporate the relevant findings into the main lane's current work, and respond now. If the handoff recommends a next step that is already authorized and in scope, take it; otherwise explain the concrete impact on the current work.`
-
-export function sideSnapshot(log) {
-  return buildRecapFromLog(Array.isArray(log) ? log : [], SIDE_RECAP_CAP, { includeCheckpoint: false })
-}
-
-export function assistantTextSince(log, afterSeq = 0) {
-  const chunks = []
-  for (const event of Array.isArray(log) ? log : []) {
-    if (event?.kind !== 'assistant') continue
-    if (Number.isFinite(afterSeq) && Number.isFinite(event.seq) && event.seq <= afterSeq) continue
-    for (const block of Array.isArray(event.blocks) ? event.blocks : []) {
-      if (block?.type === 'text' && String(block.text || '').trim()) chunks.push(String(block.text).trim())
-    }
-  }
-  return chunks.join('\n\n').trim()
-}
-
-export function sideContextBlock({ sideId, sideName, task, summary }) {
-  const label = String(sideName || 'Side lane').trim()
-  const ref = String(sideId || '').slice(0, 8)
-  const lines = [
-    `--- side-lane handoff: ${label}${ref ? ` (${ref})` : ''} ---`,
-    task ? `Task: ${String(task).trim()}` : '',
-    String(summary || '').trim(),
-    '--- end side-lane handoff ---',
-  ]
-  return lines.filter(Boolean).join('\n')
-}
-
-export function appendSideContext(contexts, context, cap = 4) {
-  if (!context) return Array.isArray(contexts) ? contexts.slice(-cap) : []
-  return [...(Array.isArray(contexts) ? contexts : []), context].slice(-cap)
-}
-
-export function sideMainTurnPrompt(contexts) {
-  const handoffs = (Array.isArray(contexts) ? contexts : []).filter(Boolean)
-  if (!handoffs.length) return ''
-  return `${SIDE_MAIN_TURN_PROMPT}\n\n${handoffs.join('\n\n')}`
-}
-
-export function dispatchSideContexts({ contexts, busy, sendTurn }) {
-  const pending = (Array.isArray(contexts) ? contexts : []).filter(Boolean).slice(-4)
-  if (!pending.length || busy || typeof sendTurn !== 'function') return { dispatched: false, pending }
-  const prompt = sideMainTurnPrompt(pending)
-  try {
-    if (sendTurn(prompt) === false) return { dispatched: false, pending }
-  } catch {
-    return { dispatched: false, pending }
-  }
-  return { dispatched: true, pending: [] }
-}
+import{buildRecapFromLog as e}from"./recap.mjs";export const SIDE_RECAP_CAP=12e3;export const SIDE_ROLE_PROMPT="You are a ThinkPool side lane attached to a main terminal.\nFocus first on reading, searching, comparing, and answering the side task. You are a full agent and share the main terminal's working directory, so coordinate through ThinkPool Peer before changing files that another lane may be editing. Do not make edits unless a person explicitly asks for them in this side lane. Keep the investigation self-contained; the main terminal receives nothing until a person chooses Bring to main.";export const SIDE_HANDOFF_PROMPT="Prepare a compact handoff for the main terminal now.\nReturn only the handoff. Include: conclusion, strongest evidence, files changed or artifacts produced, and any unresolved question or recommended next action. Do not continue the investigation and do not address the reader conversationally.";export const SIDE_MAIN_TURN_PROMPT="A room member chose Bring to main.\nRead the side-lane handoff below, incorporate the relevant findings into the main lane's current work, and respond now. If the handoff recommends a next step that is already authorized and in scope, take it; otherwise explain the concrete impact on the current work.";export function sideSnapshot(n){return e(Array.isArray(n)?n:[],12e3,{includeCheckpoint:!1})}export function assistantTextSince(e,n=0){const t=[];for(const r of Array.isArray(e)?e:[])if("assistant"===r?.kind&&!(Number.isFinite(n)&&Number.isFinite(r.seq)&&r.seq<=n))for(const e of Array.isArray(r.blocks)?r.blocks:[])"text"===e?.type&&String(e.text||"").trim()&&t.push(String(e.text).trim());return t.join("\n\n").trim()}export function sideContextBlock({sideId:e,sideName:n,task:t,summary:r}){const i=String(n||"Side lane").trim(),o=String(e||"").slice(0,8);return[`--- side-lane handoff: ${i}${o?` (${o})`:""} ---`,t?`Task: ${String(t).trim()}`:"",String(r||"").trim(),"--- end side-lane handoff ---"].filter(Boolean).join("\n")}export function appendSideContext(e,n,t=4){return n?[...Array.isArray(e)?e:[],n].slice(-t):Array.isArray(e)?e.slice(-t):[]}export function sideMainTurnPrompt(e){const n=(Array.isArray(e)?e:[]).filter(Boolean);return n.length?`${SIDE_MAIN_TURN_PROMPT}\n\n${n.join("\n\n")}`:""}export function dispatchSideContexts({contexts:e,busy:n,sendTurn:t}){const r=(Array.isArray(e)?e:[]).filter(Boolean).slice(-4);if(!r.length||n||"function"!=typeof t)return{dispatched:!1,pending:r};const i=sideMainTurnPrompt(r);try{if(!1===t(i))return{dispatched:!1,pending:r}}catch{return{dispatched:!1,pending:r}}return{dispatched:!0,pending:[]}}