thinkpool-pair 0.7.55 → 0.7.57

package/account.mjs

@@ -186,6 +186,9 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
   const { sb, session } = auth
   const email = session.user?.email || 'your account'
+  // Current owner JWT, handed to each room-bridge child for authed web writes
+  // (code-mockup, whip L16). Refreshed below; pushed to live children on rotation.
+  let currentAccessToken = session.access_token || null
 
   // Owner-gate (Contract C-CODE-2): hosting a code session — spawning the agent and
   // burning compute on this machine — requires Pro or Enterprise. This is the layer
@@ -253,7 +256,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const keepFresh = scheduleTokenRefresh({
     sb,
     session,
-    onRefreshed: (s) => { saveAuth(s); pushPresence() },
+    onRefreshed: (s) => {
+      saveAuth(s); pushPresence()
+      // Push the rotated owner token to every live child so their authed writes
+      // (code-mockup) never go stale on a long session (whip L16).
+      currentAccessToken = s.access_token || currentAccessToken
+      for (const c of children.values()) { try { c.send({ t: 'token', accessToken: currentAccessToken }) } catch { /* child not ready */ } }
+    },
     forceMs: parseInt(process.env.TP_TOKEN_REFRESH_FORCE_MS, 10) || 0,
   })
 
@@ -287,6 +296,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // can't make a child self-exit; flag it as an account child instead.
       const env = { ...process.env, THINKPOOL_PAIR_ACCOUNT_CHILD: '1' }
       delete env.THINKPOOL_PAIR_AUTOUPDATE
+      // Hand the child the owner JWT for authed web writes (code-mockup, L16).
+      if (currentAccessToken) env.TP_ACCESS_TOKEN = currentAccessToken
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child

package/bridge.mjs

@@ -47,6 +47,14 @@ const SUPABASE_URL  = process.env.TP_SUPABASE_URL  || 'https://daytvtakmlixpfbbq
 const WEB_BASE      = process.env.TP_WEB_BASE      || 'https://thinkpool.io'
 const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
 
+// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).
+// The room-bridge is anon by design; the account supervisor (account.mjs) owns the
+// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes
+// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a
+// directly-started bridge with no account login — those writes go unattributed,
+// never owner-spoofed (the server treats a missing/!owner token accordingly).
+let codeAuthToken = process.env.TP_ACCESS_TOKEN || null
+
 // Per-terminal rolling scrollback (raw chars). Replayed to joining clients.
 // Kept comfortably under realtime payload limits once base64'd.
 const SCROLLBACK_MAX = 120_000
@@ -141,7 +149,14 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
   const autoUpdate = argv.includes('--auto-update')
   const svc = await import('./service.mjs')
   if (argv[0] === 'install-service') svc.installService(svcRoom, svcCmd, { autoUpdate })
-  else svc.uninstallService(svcRoom)
+  else {
+    // Account scope (room=null) may be the cmux-hosted tier (cmux-service.json) —
+    // that's torn down via cmux, not launchctl/systemctl. Room scope is always OS.
+    const cmux = await import('./cmux.mjs')
+    if (svcRoom === null && cmux.isCmuxServiceInstalled()) {
+      cmux.uninstallCmuxService(); process.stderr.write('  ◆ removed the cmux-hosted account service.\n')
+    } else svc.uninstallService(svcRoom)
+  }
   process.exit(0)
 }
 
@@ -150,8 +165,10 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
 if (argv[0] === 'restart-service') {
   const arg1 = argv[1] || ''
   const svcRoom = (!arg1 || arg1.startsWith('-')) ? null : arg1.toUpperCase().trim()
-  const svc = await import('./service.mjs')
-  svc.restartService(svcRoom)
+  const cmux = await import('./cmux.mjs')
+  if (svcRoom === null && cmux.isCmuxServiceInstalled()) {
+    cmux.restartCmuxService(); process.stderr.write('  ◆ restarted the cmux-hosted account service — sessions resume in place.\n')
+  } else { const svc = await import('./service.mjs'); svc.restartService(svcRoom) }
   process.exit(0)
 }
 
@@ -172,6 +189,39 @@ if (argv[0] === 'login') { const { runLogin } = await import('./account.mjs'); a
 if (argv[0] === 'bind')  { const { runBind }  = await import('./account.mjs'); runBind(argv[1], argv[2]) }
 if (argv[0] === 'provider') { const { runProvider } = await import('./provider.mjs'); await runProvider(argv.slice(1)); process.exit(0) }
 
+// Explicit account-serve entrypoint — used by the cmux-hosted service tier (cmux.mjs).
+// A cmux surface HAS a TTY, so a bare invocation would open the interactive launcher
+// instead of serving; `serve` runs account mode directly, regardless of TTY. With
+// `--supervise` it first wraps itself in a crash-restart loop (re-execing `serve`
+// without the flag): cmux, unlike launchd KeepAlive, will not relaunch a surface
+// whose command exits, so the account supervisor must restart itself.
+if (argv[0] === 'serve') {
+  if (argv.includes('--supervise') || argv.includes('--keep-alive')) {
+    const childArgs = process.argv.slice(1).filter((a) => a !== '--supervise' && a !== '--keep-alive')
+    let backoff = 1000, stopping = false, child = null
+    const spawnChild = () => {
+      const t0 = Date.now()
+      child = spawn(process.execPath, childArgs, { stdio: 'inherit' })
+      child.on('exit', (code, signal) => {
+        if (stopping || code === 0) process.exit(code || 0)
+        const ranLong = Date.now() - t0 > 60000
+        const wait = ranLong ? 1000 : backoff
+        backoff = ranLong ? 1000 : Math.min(backoff * 2, 30000)
+        process.stderr.write(`\n  ⚠ account supervisor exited (${signal || `code ${code}`}); restarting in ${Math.round(wait / 1000)}s…\n`)
+        setTimeout(spawnChild, wait)
+      })
+      child.on('error', () => { /* spawn failure → exit handler retries */ })
+    }
+    for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stopping = true; try { child?.kill(sig) } catch { /* noop */ } setTimeout(() => process.exit(0), 400) })
+    process.stderr.write('\n  ◆ supervisor up — keeping the account bridge alive (auto-restart on crash).\n')
+    spawnChild()
+    await new Promise(() => {})   // block forever; the child IS the account supervisor
+  }
+  const { runAccount } = await import('./account.mjs')
+  await runAccount(SUPABASE_URL, SUPABASE_ANON)
+  process.exit(0)
+}
+
 // One-command launcher: a bare invocation on a TTY (or the `setup` alias) opens the
 // interactive menu instead of going straight to account mode. The menu only ASSEMBLES
 // existing commands — it re-execs `<ROOM>`, or calls installService / runLogin /
@@ -181,6 +231,8 @@ if (argv[0] === 'provider') { const { runProvider } = await import('./provider.m
 if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
   const { runLauncher, detectState } = await import('./launcher.mjs')
   const svc = await import('./service.mjs')
+  const cmux = await import('./cmux.mjs')
+  const PKG_VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return 'latest' } })()
   const BRIDGE = fileURLToPath(import.meta.url)
   const io = {
     print: (s) => process.stderr.write(s + '\n'),
@@ -202,8 +254,21 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     // notes, and RETURN so the launcher loop drops you back at the menu (the service
     // runs in its own launchd/systemd process; this launcher isn't itself a bridge).
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
-    uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
-    restartService: ({ room = null } = {}) => { svc.restartService(room) },
+    uninstallService: ({ room = null } = {}) => {
+      if (room === null && cmux.isCmuxServiceInstalled()) { cmux.uninstallCmuxService(); process.stderr.write('\n  ◆ removed the cmux-hosted account service.\n') }
+      else svc.uninstallService(room)
+    },
+    restartService: ({ room = null } = {}) => {
+      if (room === null && cmux.isCmuxServiceInstalled()) { cmux.restartCmuxService(); process.stderr.write('\n  ◆ restarted the cmux-hosted account service — sessions resume in place.\n') }
+      else svc.restartService(room)
+    },
+    // Account service hosted as a cmux surface — offered only inside cmux, with its
+    // weaker-persistence caveat shown first (launcher.mjs serveAccount).
+    detectCmux: () => cmux.detectCmux(),
+    installAccountCmux: () => {
+      const rec = cmux.installCmuxService({ version: PKG_VERSION })
+      process.stderr.write(`\n  ◆ account service now runs as a cmux surface ("${cmux.WS_NAME}") — visible and killable.\n  ◆ it restarts itself on crash; stop it with:  npx thinkpool-pair uninstall-service\n  ◆ pinned to v${rec.version}.\n\n`)
+    },
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
     // Provider config is NOT terminal — it writes provider.json and returns to the
     // menu so you can pick a model, switch back, or do something else. (It used to
@@ -518,9 +583,14 @@ const handleManifest = async (box, file, term) => {
   const readTxt = (p) => { try { return p && fs.readFileSync(p, 'utf8') } catch { return null } }
   const cid = randomUUID()
   try {
+    const mockupHeaders = { 'Content-Type': 'application/json' }
+    // Authenticate as the owner so the server can attribute the persisted row to a
+    // verified user instead of trusting "knows the code" (whip L16). Omitted when
+    // we have no token (direct bridge, no login) → server persists it unattributed.
+    if (codeAuthToken) mockupHeaders.Authorization = `Bearer ${codeAuthToken}`
     const res = await fetch(`${WEB_BASE}/api/code-mockup`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: mockupHeaders,
       body: JSON.stringify({
         code: room, slug: m.slug, title: m.title, cid, ts: m.ts, term,
         desktopPng: readB64(m.desktop), mobilePng: readB64(m.mobile), html: readTxt(m.html),
@@ -1206,7 +1276,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   // Contract #1) + `idle` (the quiet window, for the unattended fallback) + whether a
   // web peer is present, so the supervisor restarts on an explicit click between turns
   // and otherwise waits for true idle with nobody watching (Slice 3).
-  process.on('message', (m) => { if (m && m.t === 'update-available') surfaceUpdate(m.version) })
+  process.on('message', (m) => {
+    if (!m) return
+    if (m.t === 'update-available') surfaceUpdate(m.version)
+    // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
+    // it so our authed writes (code-mockup) never go stale on a long session (L16).
+    else if (m.t === 'token') codeAuthToken = m.accessToken || null
+  })
   setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but

package/cmux.mjs

@@ -0,0 +1,139 @@
+/* ─────────────────────────────────────────────────────────────
+   cmux.mjs — host the ACCOUNT service as a cmux surface instead of
+   a detached launchd/systemd daemon, when the bridge was launched
+   from inside cmux.
+
+   Why a separate tier: the OS service (service.mjs) is invisible —
+   it logs to a file and is supervised by launchd KeepAlive. Inside
+   cmux, the user would rather see the service running in a normal
+   surface they can watch and kill, alongside everything else. cmux,
+   unlike launchd, does NOT relaunch a surface whose command exits,
+   so the surface runs `serve --supervise` (bridge.mjs) which restarts
+   the account supervisor itself on crash.
+
+   Detection is deliberately strict: being on $PATH is NOT proof cmux
+   spawned us (claude-session.mjs makes the same distinction). Only the
+   CMUX_WORKSPACE_ID / CMUX_SURFACE_ID env vars — which cmux injects
+   into every surface it creates — prove it, and we additionally confirm
+   the socket actually answers before committing to this tier. If either
+   check fails the caller falls back to the OS service.
+
+   Persistence trade-off (flagged to the user in launcher.mjs before
+   install): up while cmux runs · crash-restart via --supervise ·
+   best-effort return on cmux session-restore · does NOT survive
+   logout/reboot unless cmux launches at login.
+
+   Spec: docs/specs/2026-06-23-cmux-hosted-account-service.md
+   ───────────────────────────────────────────────────────────── */
+
+import os from 'node:os'
+import fs from 'node:fs'
+import path from 'node:path'
+import { execFileSync } from 'node:child_process'
+
+const HOME = os.homedir()
+const CFG_DIR = path.join(HOME, '.thinkpool-pair')
+// One stable record per machine → exactly one cmux-hosted account service.
+export const RECORD = path.join(CFG_DIR, 'cmux-service.json')
+export const WS_NAME = 'thinkpool-pair service'
+
+// Run a cmux CLI command; return trimmed stdout, or throw. Isolated so the rest
+// of the module (and its tests) can run without the socket by injecting `run`.
+function cmux(args, { timeout = 6000 } = {}) {
+  return execFileSync('cmux', args, { encoding: 'utf8', timeout, stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
+// cmux injects these into every surface it spawns. PATH containing a cmux shim is
+// NOT enough — only the env proves cmux launched this shell.
+export function inCmux(env = process.env) {
+  return !!(env.CMUX_WORKSPACE_ID || env.CMUX_SURFACE_ID)
+}
+
+// Can we actually drive cmux right now? (socket answers a ping.) Returns false on
+// any failure — a broken/absent socket means we cannot host a surface, so fall back.
+export function cmuxReachable(run = cmux) {
+  try { run(['ping'], { timeout: 4000 }); return true } catch { return false }
+}
+
+// Use the cmux tier only when BOTH hold: cmux spawned us AND the socket answers.
+export function detectCmux(env = process.env, run = cmux) {
+  return inCmux(env) && cmuxReachable(run)
+}
+
+export function readRecord(recordFile = RECORD) {
+  try { return JSON.parse(fs.readFileSync(recordFile, 'utf8')) } catch { return null }
+}
+
+export function isCmuxServiceInstalled(recordFile = RECORD) {
+  return !!readRecord(recordFile)
+}
+
+// The command the cmux surface runs. PINNED to the installing version (same safety
+// default as service.mjs — a bad publish can't auto-roll to the always-on bridge).
+// `serve` runs account mode regardless of TTY (a cmux surface has a TTY, so a bare
+// invocation would open the interactive launcher instead). `--supervise` restarts
+// the account supervisor on crash, since cmux won't re-run a dead surface.
+export function serviceCommand(version) {
+  return `npx -y thinkpool-pair@${version || 'latest'} serve --supervise`
+}
+
+// Pull a stable handle out of cmux output. Prefer a UUID (stable across reorders);
+// fall back to a positional `workspace:N` ref; null if neither is present.
+export function parseWorkspaceRef(out) {
+  const uuid = (String(out).match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i) || [])[0]
+  if (uuid) return uuid
+  const ref = (String(out).match(/workspace:\d+/) || [])[0]
+  return ref || null
+}
+
+// Best-effort: find the service workspace by its name when we have no stored ref
+// (e.g. the record predates ref capture, or parsing failed at install time).
+function resolveByName(run, name = WS_NAME) {
+  try {
+    const out = run(['--id-format', 'uuids', 'list-workspaces'])
+    const line = String(out).split('\n').find((l) => l.includes(name))
+    return line ? parseWorkspaceRef(line) : null
+  } catch { return null }
+}
+
+function spawnSurface(run, command, cwd = HOME) {
+  // --focus false: never steal focus from the user's current surface.
+  const out = run(['--id-format', 'uuids', 'new-workspace', '--name', WS_NAME, '--cwd', cwd, '--command', command, '--focus', 'false'])
+  return parseWorkspaceRef(out)
+}
+
+function closeSurface(run, rec) {
+  const ref = rec.workspace || resolveByName(run)
+  if (!ref) return
+  try { run(['close-workspace', '--workspace', ref]) } catch { /* may already be gone */ }
+}
+
+export function installCmuxService({ version, cwd = HOME, run = cmux, recordFile = RECORD } = {}) {
+  const command = serviceCommand(version)
+  const workspace = spawnSurface(run, command, cwd)
+  const rec = { kind: 'cmux', version: version || 'latest', name: WS_NAME, command, workspace, installedAt: new Date().toISOString() }
+  fs.mkdirSync(path.dirname(recordFile), { recursive: true })
+  fs.writeFileSync(recordFile, JSON.stringify(rec, null, 2))
+  return rec
+}
+
+// Restart = close the surface + spawn a fresh one. The account supervisor restores
+// every active session from disk (session-store crash-resume), so sessions resume
+// in place — same contract as an OS-service restart.
+export function restartCmuxService({ run = cmux, recordFile = RECORD } = {}) {
+  const rec = readRecord(recordFile)
+  if (!rec) return false
+  closeSurface(run, rec)
+  rec.workspace = spawnSurface(run, rec.command)
+  rec.installedAt = new Date().toISOString()
+  fs.writeFileSync(recordFile, JSON.stringify(rec, null, 2))
+  return true
+}
+
+export function uninstallCmuxService({ run = cmux, recordFile = RECORD } = {}) {
+  const rec = readRecord(recordFile)
+  if (!rec) return false
+  closeSurface(run, rec)
+  try { fs.rmSync(recordFile, { force: true }) } catch { /* noop */ }
+  return true
+}

package/launcher.mjs

@@ -13,6 +13,7 @@
 import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
+import { isCmuxServiceInstalled } from './cmux.mjs'
 
 const HOME = os.homedir()
 const CFG_DIR = path.join(HOME, '.thinkpool-pair')
@@ -60,7 +61,11 @@ export function detectState() {
     provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
     providerModel: isCustom ? (provider.model || null) : null,
     agents: KNOWN_AGENTS.filter(a => onPath(a.cmd)),
-    accountSvc: fs.existsSync(serviceFile(null)),
+    accountSvc: fs.existsSync(serviceFile(null)) || isCmuxServiceInstalled(),
+    // Which tier hosts the account service, so the menu can label it honestly.
+    // Cheap, read-only (file existence) — no cmux socket call here; the live
+    // cmux detection (which pings) happens in serveAccount at install time.
+    accountSvcKind: isCmuxServiceInstalled() ? 'cmux' : (fs.existsSync(serviceFile(null)) ? 'os' : null),
     cwd: process.cwd(),
   }
 }
@@ -95,7 +100,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     io.print(`  ${C.dim('│ provider ')} ${state.provider}`)
     io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none on PATH')}`)
     io.print(`  ${C.dim('│ directory')} ${C.dim(state.cwd)}`)
-    io.print(`  ${C.dim('│ service  ')} ${state.accountSvc ? C.green('account service installed') : 'none'}`)
+    io.print(`  ${C.dim('│ service  ')} ${state.accountSvc ? C.green('account service installed' + (state.accountSvcKind === 'cmux' ? ' (cmux surface)' : state.accountSvcKind === 'os' ? ' (system service)' : '')) : 'none'}`)
     io.print('  ' + C.dim('└' + '─'.repeat(54)) + '\n')
   }
 
@@ -128,8 +133,21 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
       { label: '← Back to main menu', hint: '' },
     ])
     if (how === 2) return
-    if (how === 0) { await actions.installService({ room: null }); resync() }
-    else await actions.serveAccountForeground()
+    if (how === 1) { await actions.serveAccountForeground(); return }
+    // how === 0 — always-on. Environment-aware: inside cmux, offer the cmux-hosted
+    // surface (visible + killable) — but flag its weaker persistence FIRST and let
+    // the user opt back into the durable OS service.
+    if (actions.detectCmux && actions.detectCmux()) {
+      io.print('\n  ' + C.cyan('Detected cmux') + ' — I can run the service as a cmux surface you can see and kill,')
+      io.print('  alongside your other terminals. Heads up — this is ' + C.yellow('less durable') + ' than the system service:')
+      io.print('    ' + C.dim('•') + ' stays up while cmux is running')
+      io.print('    ' + C.dim('•') + ' restarts itself on crash (--supervise)')
+      io.print('    ' + C.dim('•') + ' best-effort return via cmux session-restore')
+      io.print('    ' + C.dim('•') + ' ' + C.yellow('does NOT survive logout/reboot') + ' unless cmux launches at login')
+      const useCmux = await askYesNo('\n  Run it as a cmux surface? (n = always-on system service)', true)
+      if (useCmux) { await actions.installAccountCmux(); resync(); return }
+    }
+    await actions.installService({ room: null }); resync()
   }
 
   const serviceMenu = async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.55",
+  "version": "0.7.57",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -15,6 +15,7 @@
     "transcript-sanitize.mjs",
     "session-store.mjs",
     "service.mjs",
+    "cmux.mjs",
     "account.mjs",
     "auth-store.mjs",
     "provider.mjs",