thinkpool-pair 0.7.40 → 0.7.42

package/account.mjs

@@ -260,13 +260,20 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const tick = async () => {
     let rooms = []
     try {
-      const { data } = await sb.from('code_sessions').select('code,name,last_active_at').order('last_active_at', { ascending: false }).limit(20)
+      // Owner-only discovery (Contract C-CODE-2): a host bridges ONLY the sessions
+      // it CREATED. RLS on code_sessions returns owned OR participant rooms, so
+      // without this owner filter the supervisor auto-serves rooms you merely JOINED
+      // as a guest — spawning your machine into another owner's session that already
+      // runs its own bridge. The web watches tpacct:<session-owner>, so a
+      // participant's bridge is duplication the UI never even looks at.
+      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id').eq('owner_id', session.user.id).order('last_active_at', { ascending: false }).limit(20)
       rooms = data || []
     } catch { /* transient — keep existing children, retry next tick */ }
     const dirs = loadDirs()
     for (const r of rooms) {
       const room = r.code
       if (!room || children.has(room)) continue
+      if (r.owner_id && r.owner_id !== session.user.id) continue   // never serve a room we don't own (defense-in-depth behind the .eq above)
       const dir = dirs[room] || DEFAULT_DIR   // auto-serve unbound sessions in the launch dir
       if (!fs.existsSync(dir)) {
         if (!warned.has(room)) { warned.add(room); process.stderr.write(`\n  ◇ ${room}: bound directory is gone (${dir}) — re-bind it.\n`) }

package/bridge.mjs

@@ -164,7 +164,7 @@ if (argv[0] === 'provider') { const { runProvider } = await import('./provider.m
 // so launchd / systemd / CI / pipes are byte-for-byte unchanged.
 // Spec: docs/specs/2026-06-19-bridge-unified-launcher.md (Part 1).
 if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
-  const { runLauncher } = await import('./launcher.mjs')
+  const { runLauncher, detectState } = await import('./launcher.mjs')
   const svc = await import('./service.mjs')
   const BRIDGE = fileURLToPath(import.meta.url)
   const io = {
@@ -186,9 +186,18 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []); process.exit(0) },
     uninstallService: ({ room = null } = {}) => { svc.uninstallService(room); process.exit(0) },
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
-    setProvider: async ({ kind, base, token }) => { const { runProvider } = await import('./provider.mjs'); await runProvider(kind === 'custom' ? ['custom', '--base', base, '--token', token] : ['anthropic']); process.exit(0) },
+    // Provider config is NOT terminal — it writes provider.json and returns to the
+    // menu so you can pick a model, switch back, or do something else. (It used to
+    // process.exit(0), which dumped you to the shell mid-setup.)
+    setProvider: async ({ kind, base, token, model }) => {
+      const { runProvider } = await import('./provider.mjs')
+      const args = kind === 'custom'
+        ? ['custom', '--base', base, '--token', token, ...(model ? ['--model', model] : [])]
+        : ['anthropic']
+      await runProvider(args)
+    },
   }
-  await runLauncher({ actions, io })
+  await runLauncher({ actions, io, refresh: detectState })
   process.exit(0)
 }
 
@@ -442,7 +451,7 @@ const flushAll = () => {
     bcast('pty-out', { term: id, b64 })
   }
 }
-const flushTimer = setInterval(flushAll, 35)
+const flushTimer = setInterval(flushAll, 35); flushTimer.unref?.()  // don't keep the event loop alive past shutdown
 
 // ── mockup hand-off ────────────────────────────────────────────────────
 // render.sh (mockup-iterate) drops a manifest JSON into TP_MOCKUP_OUTBOX after
@@ -539,6 +548,11 @@ const attachedDims = () => ({
 
 function openTerm({ id, cmd, args = [], attached = false, cols, rows }) {
   if (terms.has(id)) return
+  if (terms.size >= 8) {   // cap live PTYs (matches session-store KEEP=8) — no unbounded host leak
+    process.stderr.write(`\n  ⚠ can't open "${cmd}" — terminal cap (8) reached; close one first.\n`)
+    bcast('term-exit', { id })
+    return
+  }
   if (!pty) {   // raw-PTY path needs node-pty; structured Claude never lands here
     process.stderr.write(`\n  ⚠ can't open "${cmd}" — node-pty isn't built (PTY mode disabled).\n`)
     bcast('term-exit', { id })
@@ -773,7 +787,7 @@ if (attachedCmd && process.stdin.isTTY) process.stdin.setRawMode(true)
 process.stdin.resume()
 process.stdin.on('data', d => {
   const t = attachedId && terms.get(attachedId)
-  if (t) t.term.write(d.toString('utf8'))
+  if (t) { try { t.term.write(d.toString('utf8')) } catch { /* term just exited */ } }
   else if (d.includes(3)) shutdown()   // Ctrl-C once detached/headless
 })
 // attached terminal follows the host's TTY size — but never below the
@@ -796,7 +810,7 @@ channel
     if (!payload?.data) return
     markActivity()
     const t = terms.get(payload.term) || (payload.term == null && attachedId ? terms.get(attachedId) : null)
-    if (t) t.term.write(payload.data)
+    if (t) { try { t.term.write(payload.data) } catch { /* term just exited */ } }
   })
   .on('broadcast', { event: 'resize' }, ({ payload }) => {
     // headless terms are web-sized (last writer wins); the attached term is

package/claude-session.mjs

@@ -84,8 +84,10 @@ function makeInputStream() {
   return {
     stream: gen(),
     push(content) {
+      if (ended) return false      // session ended — caller (sendTurn) can surface this
       queue.push({ type: 'user', message: { role: 'user', content } })
       if (wake) { wake(); wake = null }
+      return true
     },
     end() { ended = true; if (wake) { wake(); wake = null } },
   }
@@ -120,7 +122,7 @@ const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 
 export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission }) {
   const ac = new AbortController()
-  const input = makeInputStream()
+  let input = makeInputStream()   // `let`: auto-restart swaps in a fresh stream
   let sessionId = resume || null
   let closed = false
   let q = null            // the live Query — control requests (interrupt /
@@ -150,12 +152,39 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   let turnActive = false          // true between a sent turn and its `result`
   let lastEvtTs = Date.now()      // wall-clock of the most recent emitted event
   let stalledSent = false         // one `stalled` per stall, not a storm
+  // Auto-restart (item 1) — a transient upstream stream drop (e.g. Anthropic
+  // "Connection closed mid-response") used to leave the session half-dead:
+  // query loop gone, turnActive stuck, later sendTurns pushed into a dead
+  // stream (silent freeze). The loop now self-heals: a recoverable throw
+  // re-runs query() with resume, bounded by RESTART_MAX consecutive attempts
+  // (reset to 0 on every successful `result`). Exhaustion/non-recoverable →
+  // closed, so sendTurn stops silently queuing.
+  const RESTART_MAX = 3
+  const RECOVERABLE = /connection closed|connection reset|econnreset|etimedout|socket hang up|fetch failed|network error|socket destroyed/i
+  let restartCount = 0
+  // Force-stop a true wedge (item 3): no result, no error, just silence past
+  // FORCE_STOP_MS. Clears turnActive so between-turns updates unblock, and
+  // surfaces a recoverable error. The wedged loop is left in place (a hung
+  // native call can't be safely restarted mid-flight); if it later throws,
+  // the catch self-heals.
+  const FORCE_STOP_MS = Math.max(STALL_MS * 3, parseInt(process.env.TP_FORCE_STOP_MS, 10) || 300000)
+  let forceStopped = false
 
   const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
   const stallTimer = setInterval(() => {
-    if (turnActive && !stalledSent && Date.now() - lastEvtTs > STALL_MS) {
+    if (!turnActive) return
+    const quiet = Date.now() - lastEvtTs
+    if (quiet > FORCE_STOP_MS && !forceStopped) {
+      // True wedge — no result, no error, just silence. Unblocks between-turns
+      // updates + surfaces a recoverable error. The wedged loop is left alone.
+      forceStopped = true
+      turnActive = false
+      emit({ kind: 'error', message: `agent went silent for ${Math.round(quiet / 1000)}s — force-stopped the turn; send again to resume`, recoverable: true })
+      return
+    }
+    if (!stalledSent && quiet > STALL_MS) {
       stalledSent = true
-      emit({ kind: 'stalled', sinceMs: Date.now() - lastEvtTs })
+      emit({ kind: 'stalled', sinceMs: quiet })
     }
   }, 5000)
   stallTimer.unref?.()
@@ -317,9 +346,9 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} cross-provider tool block(s) in the transcript before resume.\n`)
   }
 
-  ;(async () => {
+  const runQuery = async () => {
     try {
-      q = query({ prompt: input.stream, options: opts })
+      q = query({ prompt: input.stream, options: { ...opts, ...(sessionId ? { resume: sessionId } : {}) } })
       for await (const m of q) {
         if (closed) break
         switch (m.type) {
@@ -388,6 +417,8 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             if (m.session_id) sessionId = m.session_id
             turnBaseOut = 0; curMsgOut = 0   // reset the live token count for the next turn
             turnActive = false               // turn settled → stall watchdog stands down
+            restartCount = 0                 // a successful turn refills the auto-restart budget
+            forceStopped = false
             emit({ kind: 'result', subtype: m.subtype, sessionId, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0 })
             // Surface a usage/context meter (chrome, not a transcript line). The
             // context window % comes from the control request; cost is cumulative.
@@ -406,9 +437,29 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
         }
       }
     } catch (e) {
-      if (!closed) emit({ kind: 'error', message: e?.message || String(e) })
+      if (closed) return
+      const msg = e?.message || String(e)
+      emit({ kind: 'error', message: msg })
+      // Auto-restart a transient upstream stream drop: re-run query() with
+      // resume so the conversation continues. Bounded by RESTART_MAX (reset on
+      // each successful result) so a persistent outage can't loop forever; a
+      // fresh input stream is needed because the throw killed the old iterator.
+      if (RECOVERABLE.test(msg) && restartCount < RESTART_MAX) {
+        restartCount++
+        turnActive = false
+        emit({ kind: 'note', text: `connection dropped — reconnecting (${restartCount}/${RESTART_MAX})` })
+        input = makeInputStream()
+        setTimeout(runQuery, Math.min(1000 * restartCount, 4000))   // 1s, 2s, 4s backoff
+        return
+      }
+      // Non-recoverable, or budget exhausted: mark done so sendTurn stops
+      // silently queuing into a dead stream. The bridge's onEvent self-heal
+      // still fires for "No conversation found" (it reopens fresh).
+      closed = true
+      turnActive = false
     }
-  })()
+  }
+  runQuery()
 
   return {
     sendTurn(text) { if (!closed) { turnActive = true; lastEvtTs = Date.now(); stalledSent = false; input.push(String(text)) } },

package/launcher.mjs

@@ -51,10 +51,14 @@ function serviceFile(room) {
 export function detectState() {
   const auth = readJson(path.join(CFG_DIR, 'auth.json'))
   const provider = readJson(path.join(CFG_DIR, 'provider.json'))
+  // provider.json is written with { provider, baseUrl, model } (see provider.mjs).
+  // Anything whose `provider` field is set and not "anthropic" is a custom endpoint.
+  const isCustom = !!provider?.provider && provider.provider !== 'anthropic'
   return {
     loggedIn: !!auth?.refresh_token,
     email: auth?.email || auth?.user?.email || null,
-    provider: provider?.kind === 'custom' ? `Custom (${provider.base || 'endpoint'})` : 'Anthropic (default)',
+    provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
+    providerModel: isCustom ? (provider.model || null) : null,
     agents: KNOWN_AGENTS.filter(a => onPath(a.cmd)),
     accountSvc: fs.existsSync(serviceFile(null)),
     cwd: process.cwd(),
@@ -68,7 +72,11 @@ const C = {
 }
 
 // io: { ask(prompt)->Promise<string>, print(s) }. actions: real | dry-run | mock.
-export async function runLauncher({ actions, io, state = detectState() }) {
+// refresh: optional () => state — re-read disk after a mutating action so the header
+// reflects the change (real bridge passes detectState; tests omit it to keep the
+// injected state stable).
+export async function runLauncher({ actions, io, state = detectState(), refresh = null }) {
+  const resync = () => { if (refresh) state = refresh() }
   const askChoice = async (prompt, options, def = 1) => {
     options.forEach((o, i) => io.print(`    ${C.cyan(String(i + 1))})  ${o.label}${o.hint ? '  ' + C.dim(o.hint) : ''}`))
     const a = await io.ask(`\n  ${prompt} ${C.dim(`[${def}]`)} ${C.cyan('▸')} `)
@@ -137,25 +145,41 @@ export async function runLauncher({ actions, io, state = detectState() }) {
     await actions.installService({ room, agentCmd: agent.cmd })
   }
 
+  const providerMenu = async () => {
+    const cur = state.provider + (state.providerModel ? `, model ${state.providerModel}` : '')
+    const p = await askChoice('\n  provider', [
+      { label: 'Anthropic (default)', hint: 'regular Claude login' },
+      { label: 'Custom endpoint', hint: 'Z.ai GLM, OpenRouter, your own proxy' },
+      { label: '← Back', hint: `current: ${cur}` },
+    ], 3)  // Enter = Back
+    if (p === 2) return
+    if (p === 0) { await actions.setProvider({ kind: 'anthropic' }); resync(); io.print('\n  ' + C.green('✓ back on regular Claude.')); return }
+    // custom — every step can be aborted with a blank line, which backs out cleanly.
+    const base = (await io.ask(`\n  Base url ${C.dim('(blank to cancel · SDK appends /v1/messages)')} ${C.cyan('▸')} `)).trim()
+    if (!base) { io.print('  ' + C.yellow('cancelled — provider unchanged')); return }
+    const token = (await io.ask(`  API token ${C.dim('(blank to cancel)')} ${C.cyan('▸')} `)).trim()
+    if (!token) { io.print('  ' + C.yellow('cancelled — provider unchanged')); return }
+    const model = (await io.ask(`  Model ${C.dim('(blank = endpoint default · e.g. glm-4.6)')} ${C.cyan('▸')} `)).trim()
+    await actions.setProvider({ kind: 'custom', base, token, model: model || undefined })
+    resync()
+    io.print(`\n  ${C.green('✓ provider set to custom.')}\n    base url: ${state.provider}\n    model:    ${state.providerModel || '(endpoint default)'}`)
+  }
+
   const settingsMenu = async () => {
-    const pick = await askChoice('\n  change', [
-      { label: 'LLM provider', hint: `current: ${state.provider}` },
-      { label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
-      { label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
-    ])
-    if (pick === 0) {
-      const p = await askChoice('\n  provider', [{ label: 'Anthropic (default)' }, { label: 'Custom endpoint', hint: 'Z.ai GLM, OpenRouter, your own proxy' }])
-      if (p === 0) await actions.setProvider({ kind: 'anthropic' })
+    for (;;) {
+      const pick = await askChoice('\n  change', [
+        { label: 'LLM provider', hint: `current: ${state.provider}` },
+        { label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
+        { label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
+        { label: '← Back to main menu', hint: '' },
+      ], 4)  // Enter = Back
+      if (pick === 3) return
+      if (pick === 0) await providerMenu()
+      else if (pick === 1) { await actions.login(); resync(); return }
       else {
-        const base = (await io.ask(`\n  Base url ${C.dim('(SDK appends /v1/messages)')} ${C.cyan('▸')} `)).trim()
-        const token = (await io.ask(`  API token ${C.cyan('▸')} `)).trim()
-        await actions.setProvider({ kind: 'custom', base, token })
+        if (state.accountSvc) await actions.uninstallService({ room: null })
+        else io.print('  ' + C.yellow('no background service installed'))
       }
-    } else if (pick === 1) {
-      await actions.login()
-    } else {
-      if (state.accountSvc) await actions.uninstallService({ room: null })
-      else io.print('  ' + C.yellow('no background service installed'))
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.40",
+  "version": "0.7.42",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {