thinkpool-pair 0.7.60 → 0.7.62

package/account.mjs

@@ -15,6 +15,7 @@ import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
 import { saveAuth, loadAuth, loadDirs, bindDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
+import { makeThrottledTrack } from './presence.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -247,8 +248,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   })
   // Dashboard "Restart" → broadcast restart → graceful stop with a NON-ZERO exit so
   // EVERY supervisor respawns us: launchd KeepAlive / systemd Restart=always respawn
-  // regardless of exit code, and the bridge.mjs --supervise wrappers (cmux tier, room
-  // tier) respawn on non-zero but treat 0 as a clean stop. Children persist + resume
+  // regardless of exit code, and the bridge.mjs --supervise wrapper (room tier)
+  // respawns on non-zero but treats 0 as a clean stop. Children persist + resume
   // their sessions (session-store), so the bounce is invisible in-room. Unlike shutdown
   // we do NOT uninstall the service. A plain foreground bridge has no supervisor, so it
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
@@ -259,7 +260,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     setTimeout(() => { try { releaseSingleton() } catch { /* noop */ } process.exit(1) }, 2500)
     process.kill(process.pid, 'SIGTERM')
   })
-  const pushPresence = () => { try { acct.track({ name: machine, version: VERSION, rooms: [...children.keys()], ts: Date.now() }) } catch { /* noop */ } }
+  // Throttled so a realtime reconnect storm can't machine-gun track() into the
+  // per-client presence rate limit (ClientPresenceRateLimitReached → channel closed
+  // → dashboard reads "no bridge" while sessions run; 2026-06-17/-22/-24). The 15s
+  // tick + token-refresh callers are unaffected (their interval exceeds the window).
+  const trackPresence = makeThrottledTrack(acct, { minMs: 5000 })
+  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], ts: Date.now() })
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.

package/bridge.mjs

@@ -40,6 +40,7 @@ import { startClaudeSession } from './claude-session.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable } from './event-id.mjs'
+import { makeThrottledTrack } from './presence.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
 // Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.
@@ -149,14 +150,7 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
   const autoUpdate = argv.includes('--auto-update')
   const svc = await import('./service.mjs')
   if (argv[0] === 'install-service') svc.installService(svcRoom, svcCmd, { autoUpdate })
-  else {
-    // Account scope (room=null) may be the cmux-hosted tier (cmux-service.json) —
-    // that's torn down via cmux, not launchctl/systemctl. Room scope is always OS.
-    const cmux = await import('./cmux.mjs')
-    if (svcRoom === null && cmux.isCmuxServiceInstalled()) {
-      cmux.uninstallCmuxService(); process.stderr.write('  ◆ removed the cmux-hosted account service.\n')
-    } else svc.uninstallService(svcRoom)
-  }
+  else svc.uninstallService(svcRoom)
   process.exit(0)
 }
 
@@ -165,10 +159,7 @@ if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {
 if (argv[0] === 'restart-service') {
   const arg1 = argv[1] || ''
   const svcRoom = (!arg1 || arg1.startsWith('-')) ? null : arg1.toUpperCase().trim()
-  const cmux = await import('./cmux.mjs')
-  if (svcRoom === null && cmux.isCmuxServiceInstalled()) {
-    cmux.restartCmuxService(); process.stderr.write('  ◆ restarted the cmux-hosted account service — sessions resume in place.\n')
-  } else { const svc = await import('./service.mjs'); svc.restartService(svcRoom) }
+  const svc = await import('./service.mjs'); svc.restartService(svcRoom)
   process.exit(0)
 }
 
@@ -189,62 +180,6 @@ if (argv[0] === 'login') { const { runLogin } = await import('./account.mjs'); a
 if (argv[0] === 'bind')  { const { runBind }  = await import('./account.mjs'); runBind(argv[1], argv[2]) }
 if (argv[0] === 'provider') { const { runProvider } = await import('./provider.mjs'); await runProvider(argv.slice(1)); process.exit(0) }
 
-// Explicit account-serve entrypoint — used by the cmux-hosted service tier (cmux.mjs).
-// A cmux surface HAS a TTY, so a bare invocation would open the interactive launcher
-// instead of serving; `serve` runs account mode directly, regardless of TTY. With
-// `--supervise` it first wraps itself in a crash-restart loop (re-execing `serve`
-// without the flag): cmux, unlike launchd KeepAlive, will not relaunch a surface
-// whose command exits, so the account supervisor must restart itself.
-if (argv[0] === 'serve') {
-  if (argv.includes('--supervise') || argv.includes('--keep-alive')) {
-    const childArgs = process.argv.slice(1).filter((a) => a !== '--supervise' && a !== '--keep-alive')
-    let backoff = 1000, stopping = false, child = null
-    const spawnChild = () => {
-      const t0 = Date.now()
-      child = spawn(process.execPath, childArgs, { stdio: 'inherit' })
-      child.on('exit', (code, signal) => {
-        if (stopping || code === 0) process.exit(code || 0)
-        const ranLong = Date.now() - t0 > 60000
-        const wait = ranLong ? 1000 : backoff
-        backoff = ranLong ? 1000 : Math.min(backoff * 2, 30000)
-        process.stderr.write(`\n  ⚠ account supervisor exited (${signal || `code ${code}`}); restarting in ${Math.round(wait / 1000)}s…\n`)
-        setTimeout(spawnChild, wait)
-      })
-      child.on('error', () => { /* spawn failure → exit handler retries */ })
-    }
-    for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stopping = true; try { child?.kill(sig) } catch { /* noop */ } setTimeout(() => process.exit(0), 400) })
-    process.stderr.write('\n  ◆ supervisor up — keeping the account bridge alive (auto-restart on crash).\n')
-    spawnChild()
-    await new Promise(() => {})   // block forever; the child IS the account supervisor
-  }
-  const { runAccount } = await import('./account.mjs')
-  await runAccount(SUPABASE_URL, SUPABASE_ANON)
-  process.exit(0)
-}
-
-// `npx thinkpool-pair cmux-doctor` — explain why the cmux service tier did/didn't engage.
-// Detection is env-based (CMUX_WORKSPACE_ID/SURFACE_ID); the socket is only needed for the
-// actual surface spawn. This prints both so a "it didn't detect cmux" report is one command.
-if (argv[0] === 'cmux-doctor') {
-  const cmux = await import('./cmux.mjs')
-  const env = process.env
-  const w = (s) => process.stderr.write(s + '\n')
-  const reachable = cmux.cmuxReachable()
-  w('\n  thinkpool-pair · cmux doctor')
-  w(`    CMUX_WORKSPACE_ID : ${env.CMUX_WORKSPACE_ID || '(unset)'}`)
-  w(`    CMUX_SURFACE_ID   : ${env.CMUX_SURFACE_ID || '(unset)'}`)
-  w(`    CMUX_SOCKET_PATH  : ${env.CMUX_SOCKET_PATH || '(unset)'}`)
-  w(`    cmux on PATH      : ${onPath('cmux')}`)
-  w(`    inCmux()          : ${cmux.inCmux()}`)
-  w(`    cmux ping         : ${reachable ? 'ok' : 'FAILED (socket unreachable)'}`)
-  w(`    detectCmux()      : ${cmux.detectCmux()}   ${cmux.detectCmux() ? '→ cmux-surface offered' : '→ falls back to OS service'}`)
-  w(`    cmux service set  : ${cmux.isCmuxServiceInstalled()}`)
-  if (!cmux.inCmux()) w('\n  ⚠ not launched from cmux (no CMUX_WORKSPACE_ID/SURFACE_ID). Run this INSIDE a cmux\n    terminal surface — a plain Terminal/iTerm window will not be detected.')
-  else if (!reachable) w('\n  ⚠ in cmux, but the automation socket is unreachable. detectCmux() is env-based so\n    the surface is still offered, but the actual spawn needs the socket — if install\n    falls back to the OS service, enable cmux automation/socket access in cmux settings.')
-  else w('\n  ✓ cmux detected and drivable — the cmux-surface service tier is available.')
-  process.exit(0)
-}
-
 // One-command launcher: a bare invocation on a TTY (or the `setup` alias) opens the
 // interactive menu instead of going straight to account mode. The menu only ASSEMBLES
 // existing commands — it re-execs `<ROOM>`, or calls installService / runLogin /
@@ -254,7 +189,6 @@ if (argv[0] === 'cmux-doctor') {
 if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
   const { runLauncher, detectState } = await import('./launcher.mjs')
   const svc = await import('./service.mjs')
-  const cmux = await import('./cmux.mjs')
   const PKG_VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return 'latest' } })()
   const BRIDGE = fileURLToPath(import.meta.url)
   const io = {
@@ -277,39 +211,14 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
     // notes, and RETURN so the launcher loop drops you back at the menu (the service
     // runs in its own launchd/systemd process; this launcher isn't itself a bridge).
     installService: ({ room = null, agentCmd } = {}) => { svc.installService(room, agentCmd ? [agentCmd] : []) },
-    uninstallService: ({ room = null } = {}) => {
-      if (room === null && cmux.isCmuxServiceInstalled()) { cmux.uninstallCmuxService(); process.stderr.write('\n  ◆ removed the cmux-hosted account service.\n') }
-      else svc.uninstallService(room)
-    },
-    restartService: ({ room = null } = {}) => {
-      if (room === null && cmux.isCmuxServiceInstalled()) { cmux.restartCmuxService(); process.stderr.write('\n  ◆ restarted the cmux-hosted account service — sessions resume in place.\n') }
-      else svc.restartService(room)
-    },
-    // "Restart & update the bridge" — re-pin the service to THIS launcher's version
-    // (you launched via @latest, so it's the newest publish) and restart. The cmux
-    // surface re-pins + respawns; the OS service is reinstalled (rewrites the plist/unit
-    // to the new version and reloads). Pinned throughout — no auto-roll.
+    uninstallService: ({ room = null } = {}) => { svc.uninstallService(room) },
+    restartService: ({ room = null } = {}) => { svc.restartService(room) },
+    // "Restart & update the bridge" — re-pin the OS service to THIS launcher's version
+    // (you launched via @latest, so it's the newest publish) and restart: the service is
+    // reinstalled (rewrites the plist/unit to the new version and reloads). Pinned — no auto-roll.
     restartUpdateService: ({ room = null } = {}) => {
-      if (room === null && cmux.isCmuxServiceInstalled()) {
-        cmux.restartCmuxService({ version: PKG_VERSION })
-        process.stderr.write(`\n  ◆ updated the cmux account service to v${PKG_VERSION} and restarted it — sessions resume in place.\n`)
-      } else {
-        process.stderr.write(`\n  ◆ updating the background service to v${PKG_VERSION} and restarting…\n`)
-        svc.installService(room, [])   // rewrites the plist/unit at this version + reloads = update + restart
-      }
-    },
-    // Account service hosted as a cmux surface — offered only inside cmux, with its
-    // weaker-persistence caveat shown first (launcher.mjs serveAccount). Falls back to
-    // the OS service if the cmux socket can't actually be driven (detection is env-based).
-    detectCmux: () => cmux.detectCmux(),
-    installAccountCmux: () => {
-      try {
-        const rec = cmux.installCmuxService({ version: PKG_VERSION })
-        process.stderr.write(`\n  ◆ account service now runs as a cmux surface ("${cmux.WS_NAME}") — visible and killable.\n  ◆ it restarts itself on crash; stop it with:  npx thinkpool-pair uninstall-service\n  ◆ pinned to v${rec.version}.\n\n`)
-      } catch (e) {
-        process.stderr.write(`\n  ⚠ couldn't spawn a cmux surface (${e.message || e}). The cmux automation socket may be\n    disabled — run 'npx thinkpool-pair cmux-doctor' to check. Falling back to the system service.\n`)
-        svc.installService(null, [])
-      }
+      process.stderr.write(`\n  ◆ updating the background service to v${PKG_VERSION} and restarting…\n`)
+      svc.installService(room, [])   // rewrites the plist/unit at this version + reloads = update + restart
     },
     login: async () => { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) },
     // Provider config is NOT terminal — it writes provider.json and returns to the
@@ -476,6 +385,13 @@ const safeName = (n) => String(n || 'file').replace(/[^a-zA-Z0-9._-]/g, '_').sli
 const supabase = createClient(SUPABASE_URL, SUPABASE_ANON, {
   realtime: { params: { eventsPerSecond: 60 } },
 })
+// Throttled presence track() (presence.mjs) — a reconnect storm re-fires SUBSCRIBED and
+// the handler re-track()s; without throttle that spirals into the per-client presence
+// rate limit (ClientPresenceRateLimitReached). Lazy so it binds `channel` (the chain
+// result below) only on first call — always after the async subscribe callback, by which
+// point the const is assigned.
+let _presence = null
+const trackPresence = (payload) => { (_presence ||= makeThrottledTrack(channel, { minMs: 5000 }))(payload) }
 const channel = supabase.channel(`tpcode:${room}`, {
   config: { broadcast: { self: false }, presence: { key: `bridge:${name}` } },
 })
@@ -747,7 +663,7 @@ function printLocal(evt) {
     case 'you': return w(`${A.cyan}❯ ${evt.text}${A.rst}${evt.by ? ` ${A.dim}(${evt.by})${A.rst}` : ''}`)
     case 'chat': return w(`${A.dim}${evt.by}: ${evt.text}${A.rst}`)
     case 'whisper': return w(`${A.dim}// ${evt.by}: ${evt.text}${A.rst}`)
-    case 'pool': return w(evt.pending ? `${A.cyan}◌ pool synthesizing…${A.rst}` : `${A.cyan}◆ pool → ${evt.text}${A.rst}`)
+    case 'pool': return w(evt.pending ? `${A.cyan}◌ pool dispatching…${A.rst}` : `${A.cyan}◆ pool → ${evt.text}${A.rst}`)
     case 'note': return w(`${A.dim}— ${evt.text} —${A.rst}`)
     case 'clear': return w(`${A.dim}— context cleared —${A.rst}`)
     case 'usage': { const c = evt.ctx; return c ? w(`${A.dim}  ctx ${c.pct}% · ${Math.round(c.used / 1000)}k/${Math.round(c.max / 1000)}k${evt.costUsd != null ? ` · $${evt.costUsd.toFixed(3)}` : ''}${A.rst}`) : undefined }
@@ -1091,7 +1007,7 @@ channel
     markActivity()
     const text = String(payload.text)
     // Echo the turn so BOTH readers (and late joiners, via the log) show who
-    // said what — UNLESS silent (an @pool synthesis, which renders its own line).
+    // said what — UNLESS silent (an @pool fire, which renders its own line).
     const echoYou = () => {
       if (payload.silent) return
       // Display the clean body (web sends `body` when the agent `text` carries host
@@ -1181,7 +1097,7 @@ channel
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
-      channel.track({ name, role: 'bridge' })
+      trackPresence({ name, role: 'bridge' })
       const startCmd = attachedCmd || autoAgent   // autoAgent: account-mode auto-open (headless)
       if (startCmd && !terms.size && !sessions.size) {
         // Claude + structured mode → Agent SDK session; everything else → PTY.

package/launcher.mjs

@@ -13,7 +13,6 @@
 import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
-import { isCmuxServiceInstalled } from './cmux.mjs'
 
 const HOME = os.homedir()
 const CFG_DIR = path.join(HOME, '.thinkpool-pair')
@@ -61,11 +60,7 @@ export function detectState() {
     provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
     providerModel: isCustom ? (provider.model || null) : null,
     agents: KNOWN_AGENTS.filter(a => onPath(a.cmd)),
-    accountSvc: fs.existsSync(serviceFile(null)) || isCmuxServiceInstalled(),
-    // Which tier hosts the account service, so the menu can label it honestly.
-    // Cheap, read-only (file existence) — no cmux socket call here; the live
-    // cmux detection (which pings) happens in serveAccount at install time.
-    accountSvcKind: isCmuxServiceInstalled() ? 'cmux' : (fs.existsSync(serviceFile(null)) ? 'os' : null),
+    accountSvc: fs.existsSync(serviceFile(null)),
     cwd: process.cwd(),
   }
 }
@@ -100,7 +95,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     io.print(`  ${C.dim('│ provider ')} ${state.provider}`)
     io.print(`  ${C.dim('│ agents   ')} ${state.agents.length ? state.agents.map(a => a.label).join(', ') : C.yellow('none on PATH')}`)
     io.print(`  ${C.dim('│ directory')} ${C.dim(state.cwd)}`)
-    io.print(`  ${C.dim('│ service  ')} ${state.accountSvc ? C.green('account service installed' + (state.accountSvcKind === 'cmux' ? ' (cmux surface)' : state.accountSvcKind === 'os' ? ' (system service)' : '')) : 'none'}`)
+    io.print(`  ${C.dim('│ service  ')} ${state.accountSvc ? C.green('account service installed') : 'none'}`)
     io.print('  ' + C.dim('└' + '─'.repeat(54)) + '\n')
   }
 
@@ -134,19 +129,7 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     ])
     if (how === 2) return
     if (how === 1) { await actions.serveAccountForeground(); return }
-    // how === 0 — always-on. Environment-aware: inside cmux, offer the cmux-hosted
-    // surface (visible + killable) — but flag its weaker persistence FIRST and let
-    // the user opt back into the durable OS service.
-    if (actions.detectCmux && actions.detectCmux()) {
-      io.print('\n  ' + C.cyan('Detected cmux') + ' — I can run the service as a cmux surface you can see and kill,')
-      io.print('  alongside your other terminals. Heads up — this is ' + C.yellow('less durable') + ' than the system service:')
-      io.print('    ' + C.dim('•') + ' stays up while cmux is running')
-      io.print('    ' + C.dim('•') + ' restarts itself on crash (--supervise)')
-      io.print('    ' + C.dim('•') + ' best-effort return via cmux session-restore')
-      io.print('    ' + C.dim('•') + ' ' + C.yellow('does NOT survive logout/reboot') + ' unless cmux launches at login')
-      const useCmux = await askYesNo('\n  Run it as a cmux surface? (n = always-on system service)', true)
-      if (useCmux) { await actions.installAccountCmux(); resync(); return }
-    }
+    // how === 0 — always-on durable OS service (launchd / systemd / Windows Startup).
     await actions.installService({ room: null }); resync()
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.60",
+  "version": "0.7.62",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "transcript-sanitize.mjs",
     "session-store.mjs",
     "service.mjs",
-    "cmux.mjs",
+    "presence.mjs",
     "account.mjs",
     "auth-store.mjs",
     "provider.mjs",

package/presence.mjs

@@ -0,0 +1,51 @@
+/* ─────────────────────────────────────────────────────────────
+   presence.mjs — a throttled wrapper for Supabase Realtime presence
+   track(), shared by the account supervisor (account.mjs) and every
+   room bridge (bridge.mjs).
+
+   The bug it fixes: supabase-js auto-rejoins a dropped channel and
+   re-fires `SUBSCRIBED`; our subscribe handlers re-`track()` presence
+   on each one. With no throttle a SINGLE drop can spiral —
+     track() → trip the per-client presence rate limit
+            → server closes the channel → auto-rejoin → SUBSCRIBED
+            → track() → trip again → … forever
+   which the server logs as `ClientPresenceRateLimitReached:
+   :client_rate_limit_exceeded`. The supervisor stays alive and keeps
+   relaying sessions, but its presence never re-sticks, so the dashboard
+   reads "No bridge connected" while sessions plainly run (the
+   2026-06-17 / -22 / -24 recurrences).
+
+   makeThrottledTrack coalesces bursts to at most one track() per
+   window: the FIRST call fires immediately (presence appears fast),
+   any further calls inside the window collapse into a single trailing
+   fire with the latest payload. At minMs=5000 that's ≤0.2 track/s —
+   far under any presence rate limit — so a reconnect storm can never
+   trip it, while the steady-state callers (a 15s tick, a token refresh)
+   are unaffected (their interval already exceeds the window).
+   ───────────────────────────────────────────────────────────── */
+
+// channel: a supabase RealtimeChannel (stable across reconnects — supabase-js
+// rejoins the same object, so channel.track stays valid). Returns a function you
+// call with the presence payload anywhere you'd have called channel.track(payload).
+export function makeThrottledTrack(channel, { minMs = 5000 } = {}) {
+  let last = 0
+  let timer = null
+  let pending = null
+  const fire = () => {
+    timer = null
+    last = Date.now()
+    const payload = pending
+    pending = null
+    try { channel.track(payload) } catch { /* presence track is best-effort */ }
+  }
+  return (payload) => {
+    pending = payload
+    const since = Date.now() - last
+    if (since >= minMs) {
+      if (timer) { clearTimeout(timer) }
+      fire()                                   // leading edge — presence appears immediately
+    } else if (!timer) {
+      timer = setTimeout(fire, minMs - since)  // trailing edge — coalesce the burst
+    }
+  }
+}

package/cmux.mjs

@@ -1,148 +0,0 @@
-/* ─────────────────────────────────────────────────────────────
-   cmux.mjs — host the ACCOUNT service as a cmux surface instead of
-   a detached launchd/systemd daemon, when the bridge was launched
-   from inside cmux.
-
-   Why a separate tier: the OS service (service.mjs) is invisible —
-   it logs to a file and is supervised by launchd KeepAlive. Inside
-   cmux, the user would rather see the service running in a normal
-   surface they can watch and kill, alongside everything else. cmux,
-   unlike launchd, does NOT relaunch a surface whose command exits,
-   so the surface runs `serve --supervise` (bridge.mjs) which restarts
-   the account supervisor itself on crash.
-
-   Detection is deliberately strict: being on $PATH is NOT proof cmux
-   spawned us (claude-session.mjs makes the same distinction). Only the
-   CMUX_WORKSPACE_ID / CMUX_SURFACE_ID env vars — which cmux injects
-   into every surface it creates — prove it, and we additionally confirm
-   the socket actually answers before committing to this tier. If either
-   check fails the caller falls back to the OS service.
-
-   Persistence trade-off (flagged to the user in launcher.mjs before
-   install): up while cmux runs · crash-restart via --supervise ·
-   best-effort return on cmux session-restore · does NOT survive
-   logout/reboot unless cmux launches at login.
-
-   Spec: docs/specs/2026-06-23-cmux-hosted-account-service.md
-   ───────────────────────────────────────────────────────────── */
-
-import os from 'node:os'
-import fs from 'node:fs'
-import path from 'node:path'
-import { execFileSync } from 'node:child_process'
-
-const HOME = os.homedir()
-const CFG_DIR = path.join(HOME, '.thinkpool-pair')
-// One stable record per machine → exactly one cmux-hosted account service.
-export const RECORD = path.join(CFG_DIR, 'cmux-service.json')
-export const WS_NAME = 'thinkpool-pair service'
-
-// Run a cmux CLI command; return trimmed stdout, or throw. Isolated so the rest
-// of the module (and its tests) can run without the socket by injecting `run`.
-function cmux(args, { timeout = 6000 } = {}) {
-  return execFileSync('cmux', args, { encoding: 'utf8', timeout, stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
-
-// cmux injects these into every surface it spawns. PATH containing a cmux shim is
-// NOT enough — only the env proves cmux launched this shell.
-export function inCmux(env = process.env) {
-  return !!(env.CMUX_WORKSPACE_ID || env.CMUX_SURFACE_ID)
-}
-
-// Can we actually drive cmux right now? (socket answers a ping.) Returns false on
-// any failure — a broken/absent socket means we cannot host a surface, so fall back.
-export function cmuxReachable(run = cmux) {
-  try { run(['ping'], { timeout: 4000 }); return true } catch { return false }
-}
-
-// Detection keys ONLY on the env cmux injects into every surface it spawns — NOT on
-// whether the socket answers. The socket ping proved flaky (it needs CMUX_SOCKET_PASSWORD
-// and can broken-pipe even from a real surface), and gating detection on it silently
-// killed the cmux offer in 0.7.57. If the env says cmux we offer the cmux tier; if the
-// actual new-workspace spawn then can't reach the socket, installCmuxService throws and
-// the caller falls back to the OS service. (cmuxReachable stays exported for cmux-doctor.)
-export function detectCmux(env = process.env) {
-  return inCmux(env)
-}
-
-export function readRecord(recordFile = RECORD) {
-  try { return JSON.parse(fs.readFileSync(recordFile, 'utf8')) } catch { return null }
-}
-
-export function isCmuxServiceInstalled(recordFile = RECORD) {
-  return !!readRecord(recordFile)
-}
-
-// The command the cmux surface runs. PINNED to the installing version (same safety
-// default as service.mjs — a bad publish can't auto-roll to the always-on bridge).
-// `serve` runs account mode regardless of TTY (a cmux surface has a TTY, so a bare
-// invocation would open the interactive launcher instead). `--supervise` restarts
-// the account supervisor on crash, since cmux won't re-run a dead surface.
-export function serviceCommand(version) {
-  return `npx -y thinkpool-pair@${version || 'latest'} serve --supervise`
-}
-
-// Pull a stable handle out of cmux output. Prefer a UUID (stable across reorders);
-// fall back to a positional `workspace:N` ref; null if neither is present.
-export function parseWorkspaceRef(out) {
-  const uuid = (String(out).match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i) || [])[0]
-  if (uuid) return uuid
-  const ref = (String(out).match(/workspace:\d+/) || [])[0]
-  return ref || null
-}
-
-// Best-effort: find the service workspace by its name when we have no stored ref
-// (e.g. the record predates ref capture, or parsing failed at install time).
-function resolveByName(run, name = WS_NAME) {
-  try {
-    const out = run(['--id-format', 'uuids', 'list-workspaces'])
-    const line = String(out).split('\n').find((l) => l.includes(name))
-    return line ? parseWorkspaceRef(line) : null
-  } catch { return null }
-}
-
-function spawnSurface(run, command, cwd = HOME) {
-  // --focus false: never steal focus from the user's current surface.
-  const out = run(['--id-format', 'uuids', 'new-workspace', '--name', WS_NAME, '--cwd', cwd, '--command', command, '--focus', 'false'])
-  return parseWorkspaceRef(out)
-}
-
-function closeSurface(run, rec) {
-  const ref = rec.workspace || resolveByName(run)
-  if (!ref) return
-  try { run(['close-workspace', '--workspace', ref]) } catch { /* may already be gone */ }
-}
-
-export function installCmuxService({ version, cwd = HOME, run = cmux, recordFile = RECORD } = {}) {
-  const command = serviceCommand(version)
-  const workspace = spawnSurface(run, command, cwd)
-  const rec = { kind: 'cmux', version: version || 'latest', name: WS_NAME, command, workspace, installedAt: new Date().toISOString() }
-  fs.mkdirSync(path.dirname(recordFile), { recursive: true })
-  fs.writeFileSync(recordFile, JSON.stringify(rec, null, 2))
-  return rec
-}
-
-// Restart = close the surface + spawn a fresh one. The account supervisor restores
-// every active session from disk (session-store crash-resume), so sessions resume
-// in place — same contract as an OS-service restart. Passing `version` re-pins the
-// surface command to that version first (the "Restart & update the bridge" path):
-// the command stays PINNED (never @latest — no auto-roll), just bumped to the version
-// the user explicitly launched.
-export function restartCmuxService({ run = cmux, recordFile = RECORD, version } = {}) {
-  const rec = readRecord(recordFile)
-  if (!rec) return false
-  closeSurface(run, rec)
-  if (version) { rec.version = version; rec.command = serviceCommand(version) }
-  rec.workspace = spawnSurface(run, rec.command)
-  rec.installedAt = new Date().toISOString()
-  fs.writeFileSync(recordFile, JSON.stringify(rec, null, 2))
-  return true
-}
-
-export function uninstallCmuxService({ run = cmux, recordFile = RECORD } = {}) {
-  const rec = readRecord(recordFile)
-  if (!rec) return false
-  closeSurface(run, rec)
-  try { fs.rmSync(recordFile, { force: true }) } catch { /* noop */ }
-  return true
-}