thinkpool-pair 0.7.64 → 0.7.66

package/account.mjs

@@ -270,9 +270,27 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
   // don't subscribe to this event, so the dashboard button is a harmless no-op there.
   acct.on('broadcast', { event: 'restart' }, () => {
+    const supervised = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
     process.stderr.write('\n  ◇ restart requested from the dashboard — bouncing bridge (sessions resume).\n')
     restarting = true
-    setTimeout(() => { try { releaseSingleton() } catch { /* noop */ } process.exit(1) }, 2500)
+    setTimeout(() => {
+      try { releaseSingleton() } catch { /* noop */ }
+      // A SUPERVISED bridge (launchd KeepAlive / systemd Restart=always / the
+      // bridge.mjs --supervise wrapper) is respawned by its supervisor on exit, so a
+      // bare exit(1) bounces cleanly. A plain FOREGROUND bridge has NO supervisor —
+      // there exit = death and the dashboard "Restart" becomes a footgun (2026-06-25:
+      // Max's manual `npx thinkpool-pair` died on Restart and never came back). So when
+      // unsupervised, re-spawn ourselves DETACHED *after* releasing the machine lock
+      // (the child's acquireSingleton() then sees no live owner and takes it). The child
+      // has no TTY → bridge.mjs routes a bare invocation straight to account mode. Gated
+      // on `supervised` so we never double-spawn (supervisor + self) into two bridges.
+      if (!supervised) {
+        try {
+          spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref()
+        } catch { /* respawn failed → exit anyway, no worse than the old behaviour */ }
+      }
+      process.exit(1)
+    }, 2500)
     process.kill(process.pid, 'SIGTERM')
   })
   // Throttled so a realtime reconnect storm can't machine-gun track() into the

package/bridge.mjs

@@ -708,6 +708,15 @@ function printLocal(evt) {
 // first). EVERY event that joins entry.log must go through here so the client's
 // "drop ≤ seqHi" cursor stays correct (a logged event with no seq would break it).
 function pushLog(entry, evt) {
+  // Single stamp point: guarantee ts+cid on EVERY logged event. echoYou() and the
+  // /model,/clear control lines called pushLog WITHOUT a prior stampEvent, so
+  // `you`/`control` were logged with a seq but NO ts. On a long session the
+  // client's capEvents evicts the agent turns below an old `you` line, leaving it
+  // with no lower-seq checkpoint → orderEvents pins the ts-less line to ts 0 and
+  // every old user message stacks at the TOP of the timeline (room XE3IQ, 2026-06-25).
+  // A real ts makes ordering wall-clock — immune to eviction AND /clear seq resets.
+  // stampEvent is idempotent, so the callers that already stamp are unaffected.
+  stampEvent(evt)
   // Only TRANSCRIPT events consume a seq (seqable) — replay-chrome kinds the web
   // filters out (system/thinking_tokens/effort) ride the log seq-less so they don't
   // hole the client's applied sequence. See event-id.mjs NO_SEQ_KINDS.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.64",
+  "version": "0.7.66",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {