thinkpool-pair 0.7.41 → 0.7.43

package/bridge.mjs

@@ -151,7 +151,9 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
 // shell export can't reach a serviced bridge — provider.json is its own source
 // of truth. Idempotent; a no-op for the default Anthropic provider. See provider.mjs.
 const { applyProviderEnv } = await import('./provider.mjs')
-applyProviderEnv()
+// Captured so the room announce can report the active LLM provider (anthropic,
+// or a custom Anthropic-compatible endpoint) to the web welcome banner.
+const PROVIDER_INFO = applyProviderEnv()
 
 if (argv[0] === 'login') { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) }
 if (argv[0] === 'bind')  { const { runBind }  = await import('./account.mjs'); runBind(argv[1], argv[2]) }
@@ -415,6 +417,14 @@ const announce = () =>
     // cwd + version: the host's working dir + thinkpool-pair version, shown in
     // the room's welcome banner. Re-sent per announce so late joiners get them.
     cwd, version: VERSION,
+    // provider: the LLM endpoint this bridge drives Claude Code through —
+    // 'anthropic' (the default, the host's regular Claude login) or 'custom'
+    // (any Anthropic-compatible base url: GLM/Z.ai, OpenRouter, a proxy). Shown
+    // in the room banner so both drivers see whose model they're on.
+    // providerBaseUrl rides along only for custom so the banner can show the
+    // host (e.g. openrouter.ai). Older web clients ignore unknown fields.
+    provider: PROVIDER_INFO.provider,
+    providerBaseUrl: PROVIDER_INFO.baseUrl || undefined,
     // pendingUpdate: a newer thinkpool-pair is out — drives the room's "update ready"
     // chip; re-sent per announce so reloads/late-joiners see it (Slice 3).
     pendingUpdate,
@@ -451,7 +461,7 @@ const flushAll = () => {
     bcast('pty-out', { term: id, b64 })
   }
 }
-const flushTimer = setInterval(flushAll, 35)
+const flushTimer = setInterval(flushAll, 35); flushTimer.unref?.()  // don't keep the event loop alive past shutdown
 
 // ── mockup hand-off ────────────────────────────────────────────────────
 // render.sh (mockup-iterate) drops a manifest JSON into TP_MOCKUP_OUTBOX after
@@ -548,6 +558,11 @@ const attachedDims = () => ({
 
 function openTerm({ id, cmd, args = [], attached = false, cols, rows }) {
   if (terms.has(id)) return
+  if (terms.size >= 8) {   // cap live PTYs (matches session-store KEEP=8) — no unbounded host leak
+    process.stderr.write(`\n  ⚠ can't open "${cmd}" — terminal cap (8) reached; close one first.\n`)
+    bcast('term-exit', { id })
+    return
+  }
   if (!pty) {   // raw-PTY path needs node-pty; structured Claude never lands here
     process.stderr.write(`\n  ⚠ can't open "${cmd}" — node-pty isn't built (PTY mode disabled).\n`)
     bcast('term-exit', { id })
@@ -697,7 +712,9 @@ function openStructured({ id, model, resume, log, commands, mode }) {
       // 'stalled' is transient turn-liveness state (would replay as a stale frozen
       // banner if persisted); 'compaction' is a real transcript milestone (the recap
       // card) and is intentionally NOT chrome, so it persists + replays.
-      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'clear' || evt.kind === 'compact' || evt.kind === 'stalled'
+      // 'suggestion' is Claude Code's predicted-next-prompt ghost text — ephemeral
+      // composer UI, broadcast to both clients but never logged/persisted/replayed.
+      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'clear' || evt.kind === 'compact' || evt.kind === 'stalled' || evt.kind === 'suggestion'
       // compact turn finished (or errored) → clear the pulsing indicator.
       // No "done" ctl line — the SDK's own output in the transcript is the
       // signal (compact summary on success, AbortError text on abort/too-small).
@@ -782,7 +799,7 @@ if (attachedCmd && process.stdin.isTTY) process.stdin.setRawMode(true)
 process.stdin.resume()
 process.stdin.on('data', d => {
   const t = attachedId && terms.get(attachedId)
-  if (t) t.term.write(d.toString('utf8'))
+  if (t) { try { t.term.write(d.toString('utf8')) } catch { /* term just exited */ } }
   else if (d.includes(3)) shutdown()   // Ctrl-C once detached/headless
 })
 // attached terminal follows the host's TTY size — but never below the
@@ -805,7 +822,7 @@ channel
     if (!payload?.data) return
     markActivity()
     const t = terms.get(payload.term) || (payload.term == null && attachedId ? terms.get(attachedId) : null)
-    if (t) t.term.write(payload.data)
+    if (t) { try { t.term.write(payload.data) } catch { /* term just exited */ } }
   })
   .on('broadcast', { event: 'resize' }, ({ payload }) => {
     // headless terms are web-sized (last writer wins); the attached term is

package/claude-session.mjs

@@ -84,8 +84,10 @@ function makeInputStream() {
   return {
     stream: gen(),
     push(content) {
+      if (ended) return false      // session ended — caller (sendTurn) can surface this
       queue.push({ type: 'user', message: { role: 'user', content } })
       if (wake) { wake(); wake = null }
+      return true
     },
     end() { ended = true; if (wake) { wake(); wake = null } },
   }
@@ -120,9 +122,17 @@ const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 
 export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission }) {
   const ac = new AbortController()
-  const input = makeInputStream()
+  let input = makeInputStream()   // `let`: auto-restart swaps in a fresh stream
   let sessionId = resume || null
   let closed = false
+  // Cold-start measurement (2026-06-21, spec 2026-06-21-code-session-deploy-stability):
+  // stamp when the open begins so we can log spawn→ready (the SDK's first `init`
+  // system message — when the terminal becomes usable). New room terminals "take a
+  // long time"; settingSources:['user','project','local'] boots every host MCP
+  // server + SessionStart hook + plugin before init. This is the A-side baseline;
+  // open a terminal with TP_MCP_STRICT=1 (below) for the B-side to isolate MCP's share.
+  const spawnT0 = Date.now()
+  let readyLogged = false
   let q = null            // the live Query — control requests (interrupt /
                           // setPermissionMode) route through it once streaming.
   // The session is CREATED in the caller's chosen mode (not hard-coded default):
@@ -150,12 +160,39 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   let turnActive = false          // true between a sent turn and its `result`
   let lastEvtTs = Date.now()      // wall-clock of the most recent emitted event
   let stalledSent = false         // one `stalled` per stall, not a storm
+  // Auto-restart (item 1) — a transient upstream stream drop (e.g. Anthropic
+  // "Connection closed mid-response") used to leave the session half-dead:
+  // query loop gone, turnActive stuck, later sendTurns pushed into a dead
+  // stream (silent freeze). The loop now self-heals: a recoverable throw
+  // re-runs query() with resume, bounded by RESTART_MAX consecutive attempts
+  // (reset to 0 on every successful `result`). Exhaustion/non-recoverable →
+  // closed, so sendTurn stops silently queuing.
+  const RESTART_MAX = 3
+  const RECOVERABLE = /connection closed|connection reset|econnreset|etimedout|socket hang up|fetch failed|network error|socket destroyed/i
+  let restartCount = 0
+  // Force-stop a true wedge (item 3): no result, no error, just silence past
+  // FORCE_STOP_MS. Clears turnActive so between-turns updates unblock, and
+  // surfaces a recoverable error. The wedged loop is left in place (a hung
+  // native call can't be safely restarted mid-flight); if it later throws,
+  // the catch self-heals.
+  const FORCE_STOP_MS = Math.max(STALL_MS * 3, parseInt(process.env.TP_FORCE_STOP_MS, 10) || 300000)
+  let forceStopped = false
 
   const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
   const stallTimer = setInterval(() => {
-    if (turnActive && !stalledSent && Date.now() - lastEvtTs > STALL_MS) {
+    if (!turnActive) return
+    const quiet = Date.now() - lastEvtTs
+    if (quiet > FORCE_STOP_MS && !forceStopped) {
+      // True wedge — no result, no error, just silence. Unblocks between-turns
+      // updates + surfaces a recoverable error. The wedged loop is left alone.
+      forceStopped = true
+      turnActive = false
+      emit({ kind: 'error', message: `agent went silent for ${Math.round(quiet / 1000)}s — force-stopped the turn; send again to resume`, recoverable: true })
+      return
+    }
+    if (!stalledSent && quiet > STALL_MS) {
       stalledSent = true
-      emit({ kind: 'stalled', sinceMs: Date.now() - lastEvtTs })
+      emit({ kind: 'stalled', sinceMs: quiet })
     }
   }, 5000)
   stallTimer.unref?.()
@@ -301,7 +338,22 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     // flow during a turn. We ignore the fine-grained stream_event partials in
     // the loop; only the coarse thinking_tokens system message is surfaced.
     includePartialMessages: true,
+    // Claude Code's own "predicted next prompt" — the SDK emits at most one
+    // `prompt_suggestion` per turn, AFTER the `result` message, suppressed on the
+    // first turn / after API errors / in plan mode, and it piggybacks the parent's
+    // prompt cache (nearly free). We surface it verbatim to the room composer as a
+    // ghost-text chip; nothing is generated on our side. The loop keeps iterating
+    // past `result`, so the post-result suggestion is received. Global off switch:
+    // CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false.
+    promptSuggestions: true,
   }
+  // Measurement lever (default OFF — no behavior change). TP_MCP_STRICT=1 makes the
+  // room session skip booting the host's filesystem-configured MCP servers
+  // (strictMcpConfig + empty mcpServers map), isolating the MCP share of cold-start
+  // in the spawn→ready log below. settingSources still loads slash commands /
+  // CLAUDE.md / agents either way — strict only governs MCP server sourcing. Flip
+  // this to the default (or curate a slim allowlist) once the numbers justify it.
+  if (process.env.TP_MCP_STRICT === '1') { opts.strictMcpConfig = true; opts.mcpServers = {} }
   if (cwd) opts.cwd = cwd
   if (model) opts.model = model
   if (resume) opts.resume = resume
@@ -317,9 +369,9 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} cross-provider tool block(s) in the transcript before resume.\n`)
   }
 
-  ;(async () => {
+  const runQuery = async () => {
     try {
-      q = query({ prompt: input.stream, options: opts })
+      q = query({ prompt: input.stream, options: { ...opts, ...(sessionId ? { resume: sessionId } : {}) } })
       for await (const m of q) {
         if (closed) break
         switch (m.type) {
@@ -343,6 +395,14 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               break
             }
             if (m.session_id) sessionId = m.session_id
+            // Cold-start timing — the init system message is when the terminal is
+            // usable, so spawn→here IS the latency the user waits on. One line per
+            // open. Compare a normal open vs one with TP_MCP_STRICT=1 to read off how
+            // many ms the host MCP servers cost. (resume opens also pay sanitizeSession.)
+            if (!readyLogged) {
+              readyLogged = true
+              process.stderr.write(`\n  ◆ session ready in ${Date.now() - spawnT0}ms — MCP ${process.env.TP_MCP_STRICT === '1' ? 'OFF' : 'on'}${resume ? ', resume' : ', fresh'}.\n`)
+            }
             // m.slash_commands (init message) — the commands this session really
             // supports: built-ins + the host's custom .claude/commands. Surfaced
             // so the room composer's autocomplete lists what ACTUALLY exists.
@@ -388,6 +448,8 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             if (m.session_id) sessionId = m.session_id
             turnBaseOut = 0; curMsgOut = 0   // reset the live token count for the next turn
             turnActive = false               // turn settled → stall watchdog stands down
+            restartCount = 0                 // a successful turn refills the auto-restart budget
+            forceStopped = false
             emit({ kind: 'result', subtype: m.subtype, sessionId, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0 })
             // Surface a usage/context meter (chrome, not a transcript line). The
             // context window % comes from the control request; cost is cumulative.
@@ -401,14 +463,40 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               emit({ kind: 'usage', costUsd: m.total_cost_usd ?? null, tokens: (u.input_tokens || 0) + (u.output_tokens || 0), ctx })
             })()
             break
+          case 'prompt_suggestion':
+            // Claude Code's own predicted next prompt (promptSuggestions opt-in).
+            // Arrives once per turn AFTER `result`; surfaced verbatim as ephemeral
+            // chrome (a ghost-text chip in the room composer), never persisted.
+            if (m.suggestion) emit({ kind: 'suggestion', text: m.suggestion })
+            break
           default:
             break
         }
       }
     } catch (e) {
-      if (!closed) emit({ kind: 'error', message: e?.message || String(e) })
+      if (closed) return
+      const msg = e?.message || String(e)
+      emit({ kind: 'error', message: msg })
+      // Auto-restart a transient upstream stream drop: re-run query() with
+      // resume so the conversation continues. Bounded by RESTART_MAX (reset on
+      // each successful result) so a persistent outage can't loop forever; a
+      // fresh input stream is needed because the throw killed the old iterator.
+      if (RECOVERABLE.test(msg) && restartCount < RESTART_MAX) {
+        restartCount++
+        turnActive = false
+        emit({ kind: 'note', text: `connection dropped — reconnecting (${restartCount}/${RESTART_MAX})` })
+        input = makeInputStream()
+        setTimeout(runQuery, Math.min(1000 * restartCount, 4000))   // 1s, 2s, 4s backoff
+        return
+      }
+      // Non-recoverable, or budget exhausted: mark done so sendTurn stops
+      // silently queuing into a dead stream. The bridge's onEvent self-heal
+      // still fires for "No conversation found" (it reopens fresh).
+      closed = true
+      turnActive = false
     }
-  })()
+  }
+  runQuery()
 
   return {
     sendTurn(text) { if (!closed) { turnActive = true; lastEvtTs = Date.now(); stalledSent = false; input.push(String(text)) } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.41",
+  "version": "0.7.43",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {