thinkpool-pair 0.7.65 → 0.7.67

package/account.mjs

@@ -270,9 +270,27 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // just stops — restart is meaningful for the always-on bridge. Old bridges (pre-0.7.60)
   // don't subscribe to this event, so the dashboard button is a harmless no-op there.
   acct.on('broadcast', { event: 'restart' }, () => {
+    const supervised = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
     process.stderr.write('\n  ◇ restart requested from the dashboard — bouncing bridge (sessions resume).\n')
     restarting = true
-    setTimeout(() => { try { releaseSingleton() } catch { /* noop */ } process.exit(1) }, 2500)
+    setTimeout(() => {
+      try { releaseSingleton() } catch { /* noop */ }
+      // A SUPERVISED bridge (launchd KeepAlive / systemd Restart=always / the
+      // bridge.mjs --supervise wrapper) is respawned by its supervisor on exit, so a
+      // bare exit(1) bounces cleanly. A plain FOREGROUND bridge has NO supervisor —
+      // there exit = death and the dashboard "Restart" becomes a footgun (2026-06-25:
+      // Max's manual `npx thinkpool-pair` died on Restart and never came back). So when
+      // unsupervised, re-spawn ourselves DETACHED *after* releasing the machine lock
+      // (the child's acquireSingleton() then sees no live owner and takes it). The child
+      // has no TTY → bridge.mjs routes a bare invocation straight to account mode. Gated
+      // on `supervised` so we never double-spawn (supervisor + self) into two bridges.
+      if (!supervised) {
+        try {
+          spawn(process.execPath, [process.argv[1]], { detached: true, stdio: 'ignore', env: process.env }).unref()
+        } catch { /* respawn failed → exit anyway, no worse than the old behaviour */ }
+      }
+      process.exit(1)
+    }, 2500)
     process.kill(process.pid, 'SIGTERM')
   })
   // Throttled so a realtime reconnect storm can't machine-gun track() into the

package/bridge.mjs

@@ -39,7 +39,7 @@ import { createClient } from '@supabase/supabase-js'
 import { startClaudeSession } from './claude-session.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable } from './event-id.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents } from './event-id.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
@@ -975,9 +975,11 @@ channel
     flushAll()
     for (const [id, t] of terms) {
       if (!t.scrollback) continue
+      // Cap scrollback too — a huge PTY buffer would blow the same frame limit.
+      const sb = t.scrollback.length > 100000 ? t.scrollback.slice(-100000) : t.scrollback
       bcast('pty-replay', {
         to: payload?.to ?? null, term: id,
-        b64: Buffer.from(t.scrollback, 'utf8').toString('base64'),
+        b64: Buffer.from(sb, 'utf8').toString('base64'),
       })
     }
     // Structured sessions replay their event log (reader rebuilds from it).
@@ -990,7 +992,10 @@ channel
     for (const [id, s] of sessions) {
       if (!s.log.length) continue
       const from = Number(payload?.cursors?.[id]) || 0
-      const events = from > 0 ? s.log.filter((e) => e.seq == null || e.seq > from) : s.log
+      const tail = from > 0 ? s.log.filter((e) => e.seq == null || e.seq > from) : s.log
+      // Cap to a frame-safe size — the full log on a fresh-reload (empty cursor) is
+      // multi-MB and gets dropped by Realtime, freezing the terminal. See capReplayEvents.
+      const events = capReplayEvents(tail)
       bcast('code-replay', { to: payload?.to ?? null, term: id, events })
     }
     // Re-send any still-pending permission/question cards. They ride a one-shot

package/event-id.mjs

@@ -67,3 +67,29 @@ export function maxSeq(events) {
   for (const e of events) if (e && typeof e.seq === 'number' && e.seq > m) m = e.seq
   return m
 }
+
+// Cap a replay event list to a byte budget so the broadcast frame fits under the
+// Realtime size limit. THE BUG (2026-06-26, room XE3IQ): on a fresh reload the client
+// sends replay-request with an EMPTY cursor (seqHi=0), so the bridge replied with the
+// ENTIRE per-term log — multi-thousand events / multiple MB for an established terminal.
+// That frame exceeds Realtime's broadcast size limit and is silently DROPPED (and breaks
+// the socket for the rest of the tick, taking small terminals' replays + the CHANNEL_ERROR
+// churn down with it). The terminal then never refills and every live event is gap-dropped
+// → "messages vanish, agent never responds, only brand-new terminals work".
+// Keep the MOST RECENT events that fit: the client's DB transcript snapshot (code_messages
+// tx:, last 200) already renders older history, and seqDedup.classifyReplay explicitly
+// accepts the seq eviction-jump, so the client's live cursor (seqHi) still reaches current.
+// Empirically a ~266KB frame delivered while multi-MB did not; 150KB is a safe margin.
+// Always keeps at least the newest event so seqHi can advance even if it alone is oversized.
+export const REPLAY_BYTE_BUDGET = 150000
+export function capReplayEvents(events, budget = REPLAY_BYTE_BUDGET) {
+  if (!Array.isArray(events) || events.length === 0) return events
+  let total = 0, i = events.length
+  while (i > 0) {
+    const sz = JSON.stringify(events[i - 1]).length + 1
+    if (i < events.length && total + sz > budget) break
+    total += sz
+    i--
+  }
+  return i === 0 ? events : events.slice(i)
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.65",
+  "version": "0.7.67",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {