thinkpool-pair 0.7.71 → 0.7.73

package/bridge.mjs

@@ -39,7 +39,7 @@ import { createClient } from '@supabase/supabase-js'
 import { startClaudeSession } from './claude-session.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast } from './event-id.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
@@ -629,6 +629,64 @@ const ownerOutbox = (kind, id) => path.join(MOCKUP_OUTBOX, kind, id)
 // back to the old "first live session/terminal" heuristic for it alone.
 watchOutbox(MOCKUP_OUTBOX, () => [...sessions.keys()][0] || attachedId || [...terms.keys()][0])
 
+// ── agent image hand-off ───────────────────────────────────────────
+// A screenshot the agent produces arrives as a tool_result whose content carries
+// an inline base64 image (100-600KB+). That overflows Realtime's broadcast frame —
+// it can ride neither a live `code-event` nor a replay (boundEventForBroadcast
+// strips it to a text placeholder so delivery survives). So BEFORE the event is
+// logged/broadcast we lift each image OUT: upload the bytes to Storage (mirrors the
+// mockup path → /api/code-image, service-key write) and rewrite the block to a tiny
+// { type:'image', path } ref. The persisted log + every replay then carry the path,
+// never base64; the web client mints a signed URL on render (structured.jsx, same
+// as the mockup thumbs). Spec: docs/specs/2026-06-26-code-agent-images.md
+async function uploadCodeImage(term, cid, im) {
+  const headers = { 'Content-Type': 'application/json' }
+  if (codeAuthToken) headers.Authorization = `Bearer ${codeAuthToken}`
+  const res = await fetch(`${WEB_BASE}/api/code-image`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({ code: room, term, cid, idx: im.idx, mediaType: im.mediaType, b64: im.b64 }),
+  })
+  if (!res.ok) throw new Error(`code-image ${res.status}`)
+  const { path } = await res.json()
+  if (!path) throw new Error('code-image: no path')
+  return path
+}
+// Defer an image-bearing tool_result behind a per-session upload chain (preserves
+// arrival order among images), then log + broadcast the URL-only event through the
+// normal path. pushLog is the single seq-assignment point, so the deferred event
+// still gets a contiguous seq at chain-resolution time; its ts was stamped at
+// arrival, so it sorts into place. On upload failure the block degrades to the same
+// render-safe text placeholder — base64 is NEVER logged, broadcast, or persisted.
+function deferImageEvent(entry, id, evt, imgs, emitTail) {
+  entry.imageChain = (entry.imageChain || Promise.resolve()).then(async () => {
+    for (const im of imgs) {
+      try {
+        const path = await uploadCodeImage(id, evt.cid, im)
+        evt.content[im.idx] = { type: 'image', path, mediaType: im.mediaType }
+      } catch (e) {
+        process.stderr.write(`\n  ◇ screenshot upload failed (${e?.message || e}).\n`)
+        evt.content[im.idx] = { type: 'text', text: '[screenshot omitted — upload failed]' }
+      }
+    }
+    emitTail(evt)
+  }).catch(() => {})
+}
+// Fire-and-forget: drop a closed term's screenshots from Storage so they don't
+// outlive the room (COGS). Per-term scope — never touches a sibling term's images.
+function fireImageCleanup(term) {
+  if (!term) return
+  try {
+    const headers = { 'Content-Type': 'application/json' }
+    if (codeAuthToken) headers.Authorization = `Bearer ${codeAuthToken}`
+    fetch(`${WEB_BASE}/api/code-image-cleanup`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ code: room, term }),
+    }).catch(() => { /* best-effort — the TTL sweep mops up orphans */ })
+  } catch { /* noop */ }
+}
+
 // ── shared-PTY geometry ───────────────────────────────────────────
 // The attached PTY is CAPPED at 120×32, never pinned (2026-06-11).
 // Mangling physics: a PTY *wider/taller* than the host's window forces
@@ -851,10 +909,23 @@ function openStructured({ id, model, resume, log, commands, mode }) {
         entry.compacting = false
         bcast('code-event', { term: id, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
       }
-      if (!chrome) pushLog(entry, evt)
-      bcast('code-event', { term: id, evt })
-      printLocal(evt)
-      if (!chrome) persist()
+      // Single tail: stamp into the log (transcript kinds only), broadcast live,
+      // print locally, persist. Shared so a deferred image event re-enters it once
+      // its base64 has been lifted to a Storage path (see deferImageEvent).
+      const emitTail = (e) => {
+        if (!chrome) pushLog(entry, e)
+        bcast('code-event', { term: id, evt: e })
+        printLocal(e)
+        if (!chrome) persist()
+      }
+      // A tool_result carrying an inline base64 image can't ride a broadcast frame
+      // (live OR replay). Lift it to Storage FIRST, then emit the URL-only event —
+      // so the persisted log + replay carry a path, never base64. Order/seq stay
+      // intact: pushLog (inside emitTail) is the single seq point, called when the
+      // upload resolves. Other kinds emit synchronously, unchanged.
+      const imgs = inlineImageBlocks(evt)
+      if (imgs.length) { deferImageEvent(entry, id, evt, imgs, emitTail); return }
+      emitTail(evt)
     },
     requestPermission: (req) => new Promise((resolve) => {
       // Keep the broadcast payload with the resolver so a reconnect can re-send it
@@ -902,6 +973,7 @@ function endStructured(id) {
     try { s.mockupWatcher?.close() } catch { /* noop */ }
     sessions.delete(id)
     bcast('term-exit', { id })
+    fireImageCleanup(id)   // drop this term's screenshots from Storage (COGS)
   }
   deleteSession(room, id)   // remove <id>.json so loadAll() won't bring it back
   if (s) announce()

package/event-id.mjs

@@ -157,3 +157,23 @@ export function boundEventForBroadcast(evt, cap = PER_EVENT_CAP) {
   out._bounded = true
   return out
 }
+
+// Detect inline base64 IMAGE blocks on a tool_result event (a screenshot the agent
+// produced — content:[{type:'image', source:{type:'base64', media_type, data}}]).
+// Returns [{ idx, b64, mediaType }] per base64 image block, or [] when none. Pure +
+// import-safe so bridge/test-seq.mjs can exercise it. The bridge uses this to lift
+// images OUT of the event (upload to Storage, swap to a {type:'image', path} ref)
+// BEFORE the base64 ever enters the persisted log or a broadcast frame — so a
+// screenshot renders live AND in replay instead of being stripped to a placeholder
+// by boundEventForBroadcast (which stays the fallback for any block we don't lift).
+export function inlineImageBlocks(evt) {
+  if (!evt || evt.kind !== 'tool_result' || !Array.isArray(evt.content)) return []
+  const out = []
+  evt.content.forEach((b, idx) => {
+    if (b && b.type === 'image' && b.source && b.source.type === 'base64' &&
+        typeof b.source.data === 'string' && b.source.data.length) {
+      out.push({ idx, b64: b.source.data, mediaType: b.source.media_type || 'image/png' })
+    }
+  })
+  return out
+}

package/launcher.mjs

@@ -13,6 +13,7 @@
 import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
+import { execSync } from 'node:child_process'
 
 const HOME = os.homedir()
 const CFG_DIR = path.join(HOME, '.thinkpool-pair')
@@ -48,6 +49,18 @@ function serviceFile(room) {
   return path.join(startup, `thinkpool-pair-${room || 'account'}.cmd`)
 }
 
+// Ground truth for the header: is the service actually LOADED, not just a plist on disk?
+// `launchctl load` can silently no-op, leaving a plist that never loads — file-existence
+// would report "installed" while the bridge is off (the 2026-06-26 bug). Query the manager.
+function serviceLoaded(room) {
+  const label = room ? `io.thinkpool.pair.${room.toLowerCase()}` : 'io.thinkpool.pair.account'
+  try {
+    if (process.platform === 'darwin') { execSync(`launchctl print gui/$(id -u)/${label}`, { stdio: 'ignore' }); return true }
+    if (process.platform === 'linux')  { execSync(`systemctl --user is-active --quiet ${label}.service`); return true }
+    return fs.existsSync(serviceFile(room)) // Windows: no daemon, file presence is the only proxy
+  } catch { return false }
+}
+
 export function detectState() {
   const auth = readJson(path.join(CFG_DIR, 'auth.json'))
   const provider = readJson(path.join(CFG_DIR, 'provider.json'))
@@ -60,7 +73,7 @@ export function detectState() {
     provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
     providerModel: isCustom ? (provider.model || null) : null,
     agents: KNOWN_AGENTS.filter(a => onPath(a.cmd)),
-    accountSvc: fs.existsSync(serviceFile(null)),
+    accountSvc: serviceLoaded(null),
     cwd: process.cwd(),
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.71",
+  "version": "0.7.73",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -79,7 +79,13 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   <key>StandardErrorPath</key><string>${xml(log)}</string>
   <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(process.env.PATH || '')}</string>${autoUpdate ? '<key>THINKPOOL_PAIR_AUTOUPDATE</key><string>1</string>' : ''}</dict>
 </dict></plist>\n`
-    return { file, content, logDir, post: [`launchctl unload "${file}" 2>/dev/null; launchctl load "${file}"`], note: 'Loaded as a LaunchAgent — starts at login, restarts on crash.' }
+    // Modern bootstrap/enable, NOT the deprecated `launchctl load`. On current macOS
+    // (Darwin 24/25) `load` silently no-ops for a GUI LaunchAgent — the plist lands on
+    // disk but never loads, so the bridge is "installed" yet off (the 2026-06-26 bug).
+    // bootout first (idempotent clean reinstall), enable to clear any stale `disabled`
+    // override left by a prior bootout (the account-storm cleanup), then bootstrap = load.
+    const dom = `gui/$(id -u)`
+    return { file, content, logDir, post: [`launchctl bootout ${dom}/${label(room)} 2>/dev/null; launchctl enable ${dom}/${label(room)}; launchctl bootstrap ${dom} "${file}"`], note: 'Loaded as a LaunchAgent — starts at login, restarts on crash.' }
   }
 
   if (platform === 'linux') {
@@ -173,18 +179,34 @@ export function restartService(room) {
   }
 }
 
-// Is a boot-persistent service already installed? (artifact file present.)
-// room falsy → checks the ACCOUNT service. Lets the main run skip the offer +
-// avoid starting a second bridge that would race the service.
+// Ground truth: is the OS service manager ACTUALLY running our service right now?
+// A leftover plist/unit on disk does NOT mean it's loaded — `launchctl load` can
+// silently no-op (the 2026-06-26 "says installed but it's off" bug), and a unit can
+// be left disabled. Ask the manager, don't trust file presence. room falsy → account.
+export function serviceActive(room) {
+  const plat = process.platform
+  const id = label(room)
+  try {
+    if (plat === 'darwin') { execSync(`launchctl print gui/$(id -u)/${id}`, { stdio: 'ignore' }); return true }
+    if (plat === 'linux')  { execSync(`systemctl --user is-active --quiet ${id}.service`); return true }
+    // Windows has no managed daemon — the Startup-folder script's presence is the only proxy.
+    return fs.existsSync(buildArtifact(plat, { room }).file)
+  } catch { return false }
+}
+
+// Is a boot-persistent service installed AND loaded? room falsy → the ACCOUNT service.
+// Lets the main run skip the offer + avoid starting a second bridge that races the
+// service. Reflects launchd/systemd reality, not just file existence (so a plist that
+// failed to load reads as not-installed → the menu re-offers install, which self-heals).
 export function isServiceInstalled(room) {
-  try { return fs.existsSync(buildArtifact(process.platform, { room }).file) } catch { return false }
+  return serviceActive(room)
 }
 
 export function uninstallService(room) {
   const plat = process.platform
   let a
   try { a = buildArtifact(plat, { room }) } catch (e) { process.stderr.write(`  ⚠ ${e.message}\n`); return }
-  if (plat === 'darwin') { try { execSync(`launchctl unload "${a.file}" 2>/dev/null`) } catch { /* noop */ } }
+  if (plat === 'darwin') { try { execSync(`launchctl bootout gui/$(id -u)/${label(room)} 2>/dev/null`) } catch { /* noop */ } }
   if (plat === 'linux') { try { execSync(`systemctl --user disable --now ${label(room)}.service 2>/dev/null`) } catch { /* noop */ } }
   try { fs.rmSync(a.file, { force: true }); process.stderr.write(`  ◆ removed ${a.file}\n`) } catch (e) { process.stderr.write(`  ⚠ ${e.message}\n`) }
 }