thinkpool-pair 0.7.51 → 0.7.53

package/bridge.mjs

@@ -136,12 +136,25 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
   const svcRoom = account ? null : arg1.toUpperCase().trim()
   const sd = argv.indexOf('--')
   const svcCmd = sd >= 0 ? argv.slice(sd + 1) : []
+  // PINNED to the installed version by default (a bad publish can't auto-roll to the
+  // always-on service); --auto-update opts into @latest tracking. (2026-06-22)
+  const autoUpdate = argv.includes('--auto-update')
   const svc = await import('./service.mjs')
-  if (argv[0] === 'install-service') svc.installService(svcRoom, svcCmd)
+  if (argv[0] === 'install-service') svc.installService(svcRoom, svcCmd, { autoUpdate })
   else svc.uninstallService(svcRoom)
   process.exit(0)
 }
 
+// Restart an installed boot-persistent service (sessions resume in place):
+// `thinkpool-pair restart-service [<ROOM>]` — no room → the account service.
+if (argv[0] === 'restart-service') {
+  const arg1 = argv[1] || ''
+  const svcRoom = (!arg1 || arg1.startsWith('-')) ? null : arg1.toUpperCase().trim()
+  const svc = await import('./service.mjs')
+  svc.restartService(svcRoom)
+  process.exit(0)
+}
+
 // Account mode (Phase 1, docs/specs/2026-06-16-account-bridge.md): one bridge per
 // ACCOUNT, not per room. `login` links this device; `bind <ROOM> <dir>` maps a
 // session to a working dir on this machine; a bare invocation discovers + serves
@@ -185,8 +198,12 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
       child.on('exit', (code) => process.exit(code == null ? 0 : code))
     }),
     serveAccountForeground: async () => { const { runAccount } = await import('./account.mjs'); await runAccount(SUPABASE_URL, SUPABASE_ANON) },
-    installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []); process.exit(0) },
-    uninstallService: ({ room = null } = {}) => { svc.uninstallService(room); process.exit(0) },
+    // install / uninstall / restart are NOT terminal — they do their work, print their
+    // notes, and RETURN so the launcher loop drops you back at the menu (the service
+    // runs in its own launchd/systemd process; this launcher isn't itself a bridge).
+    installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
+    uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
+    restartService: ({ room = null } = {}) => { svc.restartService(room) },
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
     // Provider config is NOT terminal — it writes provider.json and returns to the
     // menu so you can pick a model, switch back, or do something else. (It used to

package/launcher.mjs

@@ -123,10 +123,12 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     }
     io.print(`\n  Serving every session you host, from ${C.dim(state.cwd)}.\n`)
     const how = await askChoice('run it', [
-      { label: 'As an always-on background service', hint: 'recommended — survives reboot, auto-updates' },
+      { label: 'As an always-on background service', hint: 'recommended — survives reboot, restarts on crash' },
       { label: 'Here in this terminal (foreground)', hint: 'stops when you close it' },
+      { label: '← Back to main menu', hint: '' },
     ])
-    if (how === 0) await actions.installService({ room: null })
+    if (how === 2) return
+    if (how === 0) { await actions.installService({ room: null }); resync() }
     else await actions.serveAccountForeground()
   }
 
@@ -134,15 +136,17 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     const what = await askChoice('install for', [
       { label: 'All my sessions (account)', hint: state.loggedIn ? '' : 'needs login first' },
       { label: 'One specific room', hint: 'no login needed' },
+      { label: '← Back to main menu', hint: '' },
     ])
+    if (what === 2) return
     if (what === 0) {
       if (!state.loggedIn) { io.print('\n  ' + C.yellow('Account service needs a login first (pick “Serve all my sessions”).')); return }
-      await actions.installService({ room: null }); return
+      await actions.installService({ room: null }); resync(); return
     }
-    const room = (await io.ask(`\n  Room code ${C.cyan('▸')} `)).toUpperCase().trim()
+    const room = (await io.ask(`\n  Room code ${C.dim('(blank to go back)')} ${C.cyan('▸')} `)).toUpperCase().trim()
     if (!room) { io.print('  ' + C.yellow('no room — back to menu')); return }
     const agent = state.agents[0] || { cmd: 'claude' }
-    await actions.installService({ room, agentCmd: agent.cmd })
+    await actions.installService({ room, agentCmd: agent.cmd }); resync()
   }
 
   const providerMenu = async () => {
@@ -170,39 +174,49 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
       const pick = await askChoice('\n  change', [
         { label: 'LLM provider', hint: `current: ${state.provider}` },
         { label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
+        { label: 'Restart the background service', hint: state.accountSvc ? 'bounce it now — sessions resume' : 'none installed' },
         { label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
         { label: '← Back to main menu', hint: '' },
-      ], 4)  // Enter = Back
-      if (pick === 3) return
+      ], 5)  // Enter = Back
+      if (pick === 4) return
       if (pick === 0) await providerMenu()
       else if (pick === 1) { await actions.login(); resync(); return }
+      else if (pick === 2) {
+        if (state.accountSvc) { await actions.restartService({ room: null }); resync() }
+        else io.print('  ' + C.yellow('no background service installed'))
+      }
       else {
-        if (state.accountSvc) await actions.uninstallService({ room: null })
+        if (state.accountSvc) { await actions.uninstallService({ room: null }); resync() }
         else io.print('  ' + C.yellow('no background service installed'))
       }
     }
   }
 
   // ── menu loop ──
-  // Real actions either replace the process (pairRoom re-execs + waits; serve/install
-  // call process.exit) or run forever (account foreground), so a real "do something"
-  // choice never returns here. Dry-run/mock actions just print + return → the loop
-  // re-renders. The "press Enter" only lands on a no-op / back-out path.
+  // pairRoom re-execs + waits, and account-foreground runs forever, so those choices
+  // never return here. Everything else (install / restart / uninstall / settings /
+  // provider) does its work, prints its notes, and RETURNS — so the loop always drops
+  // you back at the menu. Submenus carry a "← Back" so you can bail at any point. The
+  // trailing "press Enter" lands on every returning path.
   for (;;) {
     header()
     io.print('  ' + C.bold('What do you want to do?') + '\n')
-    const choice = await askChoice('choose', [
-      { label: 'Pair one room now', hint: 'run here, Ctrl-C stops it' },
-      { label: 'Serve all my sessions', hint: 'account mode — needs login' },
-      { label: 'Always-on background service', hint: 'survives reboot, auto-updates' },
-      { label: 'Settings', hint: 'provider · account · remove service' },
-      { label: 'Quit', hint: '' },
-    ])
-    if (choice === 4) return  // Quit
-    if (choice === 0) await pairRoom()
-    else if (choice === 1) await serveAccount()
-    else if (choice === 2) await serviceMenu()
-    else if (choice === 3) await settingsMenu()
+    // Built per-render so the contextual "Restart" only shows once a service exists.
+    const items = [
+      { key: 'pair',    label: 'Pair one room now', hint: 'run here, Ctrl-C stops it' },
+      { key: 'serve',   label: 'Serve all my sessions', hint: 'account mode — needs login' },
+      { key: 'service', label: 'Always-on background service', hint: 'survives reboot, restarts on crash' },
+    ]
+    if (state.accountSvc) items.push({ key: 'restart', label: 'Restart the background service', hint: 'bounce it now — sessions resume' })
+    items.push({ key: 'settings', label: 'Settings', hint: 'provider · account · restart · remove service' })
+    items.push({ key: 'quit', label: 'Quit', hint: '' })
+    const pick = items[await askChoice('choose', items)]
+    if (pick.key === 'quit') return
+    if (pick.key === 'pair') await pairRoom()
+    else if (pick.key === 'serve') await serveAccount()
+    else if (pick.key === 'service') await serviceMenu()
+    else if (pick.key === 'restart') { await actions.restartService({ room: null }); resync() }
+    else if (pick.key === 'settings') await settingsMenu()
     await io.ask('\n  ' + C.dim('press Enter to return to the menu…'))
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.51",
+  "version": "0.7.53",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -28,6 +28,12 @@ const label = (room) => room ? `io.thinkpool.pair.${room.toLowerCase()}` : 'io.t
 const slug = (room) => room || 'account'
 const xml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
 
+// The version installing the service. By DEFAULT the service is pinned to this exact
+// version (not @latest) so a future bad npm publish can't auto-roll to every machine's
+// always-on bridge — that's what spread the broken 0.7.49 on 2026-06-22. Updates become
+// deliberate (re-run install-service). `--auto-update` opts back into @latest tracking.
+const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return 'latest' } })()
+
 // Resolve the real npx next to the current node, so the service stays seamless:
 // it runs `npx -y thinkpool-pair@latest …`, always picking up the newest publish
 // with no re-install. Absolute path + injected PATH so it works under launchd /
@@ -40,7 +46,7 @@ function npxPath(platform) {
 
 // Pure artifact builder — returned shape is testable without side effects.
 // room falsy → ACCOUNT service (bare `thinkpool-pair`, auto-serves all sessions).
-export function buildArtifact(platform, { room = null, cmdArgs = [] } = {}) {
+export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate = false } = {}) {
   const npx = npxPath(platform)
   const cwd = process.cwd()
   const id = slug(room)
@@ -48,10 +54,15 @@ export function buildArtifact(platform, { room = null, cmdArgs = [] } = {}) {
   const log = path.join(logDir, `${id}.log`)
   const tail = cmdArgs.length ? ['--', ...cmdArgs] : []
   const desc = room ? `bridge (${room})` : 'account bridge'
-  // OS-supervised tiers (launchd KeepAlive / systemd Restart) don't need
-  // --supervise; the latest published bridge is fetched by npx each (re)start.
-  // Account mode passes NO room arg — that's what selects the account supervisor.
-  const pkgArgs = room ? ['-y', 'thinkpool-pair@latest', room] : ['-y', 'thinkpool-pair@latest']
+  // OS-supervised tiers (launchd KeepAlive / systemd Restart) don't need --supervise.
+  // PINNED by default to `@${VERSION}` so a KeepAlive restart re-runs the SAME known-good
+  // version — a bad publish can't auto-roll here. `autoUpdate` opts into `@latest` tracking
+  // (and the in-process self-updater via THINKPOOL_PAIR_AUTOUPDATE below).
+  const verSpec = autoUpdate ? 'thinkpool-pair@latest' : `thinkpool-pair@${VERSION}`
+  const pkgArgs = room ? ['-y', verSpec, room] : ['-y', verSpec]
+  // In-process self-update (account.mjs / bridge.mjs) is gated on this env — only on when
+  // the user explicitly opted into auto-update.
+  const autoUpdateEnv = autoUpdate ? { THINKPOOL_PAIR_AUTOUPDATE: '1' } : {}
 
   if (platform === 'darwin') {
     const args = [npx, ...pkgArgs, ...tail]   // launchd KeepAlive supervises
@@ -66,7 +77,7 @@ export function buildArtifact(platform, { room = null, cmdArgs = [] } = {}) {
   <key>WorkingDirectory</key><string>${xml(cwd)}</string>
   <key>StandardOutPath</key><string>${xml(log)}</string>
   <key>StandardErrorPath</key><string>${xml(log)}</string>
-  <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(process.env.PATH || '')}</string><key>THINKPOOL_PAIR_AUTOUPDATE</key><string>1</string></dict>
+  <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(process.env.PATH || '')}</string>${autoUpdate ? '<key>THINKPOOL_PAIR_AUTOUPDATE</key><string>1</string>' : ''}</dict>
 </dict></plist>\n`
     return { file, content, logDir, post: [`launchctl unload "${file}" 2>/dev/null; launchctl load "${file}"`], note: 'Loaded as a LaunchAgent — starts at login, restarts on crash.' }
   }
@@ -84,8 +95,7 @@ Restart=always
 RestartSec=2
 WorkingDirectory=${cwd}
 Environment=PATH=${process.env.PATH || ''}
-Environment=THINKPOOL_PAIR_AUTOUPDATE=1
-StandardOutput=append:${log}
+${autoUpdate ? 'Environment=THINKPOOL_PAIR_AUTOUPDATE=1\n' : ''}StandardOutput=append:${log}
 StandardError=append:${log}
 
 [Install]
@@ -102,8 +112,8 @@ WantedBy=default.target
     const startup = path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup')
     const file = path.join(startup, `thinkpool-pair-${id}.cmd`)
     const inner = room
-      ? ['npx', '-y', 'thinkpool-pair@latest', room, '--supervise', ...tail].join(' ')
-      : ['npx', '-y', 'thinkpool-pair@latest'].join(' ')
+      ? ['npx', '-y', verSpec, room, '--supervise', ...tail].join(' ')
+      : ['npx', '-y', verSpec].join(' ')
     const content = `@echo off\r\ntitle thinkpool-pair ${id}\r\n${inner}\r\n`
     return { file, content, logDir, post: [], note: 'Installed to the Startup folder — runs at login' + (room ? ' with --supervise (auto-restart on crash).' : ' (account mode).') + ' Start it now without rebooting by double-clicking the .cmd, or run it from a terminal.' }
   }
@@ -111,8 +121,8 @@ WantedBy=default.target
   throw new Error(`unsupported platform: ${platform}`)
 }
 
-export function installService(room, cmdArgs = []) {
-  const a = buildArtifact(process.platform, { room, cmdArgs })
+export function installService(room, cmdArgs = [], { autoUpdate = false } = {}) {
+  const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate })
   fs.mkdirSync(a.logDir, { recursive: true })
   fs.mkdirSync(path.dirname(a.file), { recursive: true })
   fs.writeFileSync(a.file, a.content)
@@ -124,12 +134,43 @@ export function installService(room, cmdArgs = []) {
   // roughly every 30 min (THINKPOOL_PAIR_UPDATE_INTERVAL) and only restarts once
   // every served session is idle, so a just-published version can take a while.
   const idleSecs = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90)
-  const autoUpdate = process.platform === 'win32'
-    ? 'auto-update: a new thinkpool-pair@latest applies on the next login/restart (Windows has no in-process self-update).'
-    : `auto-update: checks npm ~every 30 min and restarts to apply a new version once sessions are idle (≥${idleSecs}s quiet; they resume in place). Not instant — to update now, restart it (re-run install-service, or 'launchctl kickstart -k gui/$(id -u)/io.thinkpool.pair.${slug(room)}' on macOS).`
+  const updateNote = autoUpdate
+    ? (process.platform === 'win32'
+        ? 'auto-update ON: a new thinkpool-pair@latest applies on the next login/restart (Windows has no in-process self-update).'
+        : `auto-update ON: checks npm ~every 30 min and restarts to apply a new @latest once sessions are idle (≥${idleSecs}s quiet; they resume in place).`)
+    : `PINNED to ${VERSION} (safe default — a bad publish can't auto-roll to this always-on bridge). To update: re-run install-service from a newer thinkpool-pair. Pass --auto-update to track @latest instead.`
   const removeArg = room ? ` ${room}` : ''
   const what = room ? `room ${room}` : 'your account (auto-serves every session)'
-  process.stderr.write(`  ◆ ${what}\n  ◆ ${a.note}\n  ◆ ${autoUpdate}\n  ◆ logs: ${path.join(a.logDir, `${slug(room)}.log`)}\n  ◆ remove with: thinkpool-pair uninstall-service${removeArg}\n\n`)
+  process.stderr.write(`  ◆ ${what}\n  ◆ ${a.note}\n  ◆ ${updateNote}\n  ◆ logs: ${path.join(a.logDir, `${slug(room)}.log`)}\n  ◆ remove with: thinkpool-pair uninstall-service${removeArg}\n\n`)
+}
+
+// Restart an already-installed boot-persistent service. launchd/systemd relaunch
+// the supervised `npx …`, so any active session resumes in place (the bridge
+// restores from disk). Use it to recover a wedged bridge, re-read provider.json,
+// or — if the service was installed with --auto-update (@latest) — pull a new
+// publish now. A PINNED service (the default) re-runs its same installed version.
+// room falsy → the ACCOUNT service. Returns true on success.
+export function restartService(room) {
+  const plat = process.platform
+  if (!isServiceInstalled(room)) {
+    process.stderr.write('  ⚠ no background service installed to restart — install one first.\n')
+    return false
+  }
+  const id = label(room)
+  try {
+    if (plat === 'darwin') execSync(`launchctl kickstart -k gui/$(id -u)/${id}`, { stdio: 'inherit' })
+    else if (plat === 'linux') execSync(`systemctl --user restart ${id}.service`, { stdio: 'inherit' })
+    else {
+      // Windows Startup .cmd has no managed daemon to kick — guide the manual path.
+      process.stderr.write('  ⚠ Windows has no managed daemon — close the running thinkpool-pair window and re-launch the Startup .cmd (or reboot) to restart.\n')
+      return false
+    }
+    process.stderr.write(`  ◆ restarted ${id} — any active session resumes in place.\n`)
+    return true
+  } catch (e) {
+    process.stderr.write(`  ⚠ restart failed: ${e.message}\n`)
+    return false
+  }
 }
 
 // Is a boot-persistent service already installed? (artifact file present.)