thinkpool-pair 0.7.75 → 0.7.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.75",
+  "version": "0.7.76",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/session-store.mjs

@@ -12,14 +12,33 @@ import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
 
-const ROOT = path.join(os.homedir(), '.thinkpool-pair')
-const dir = (room) => path.join(ROOT, room || 'default')
+// TP_PAIR_ROOT override exists for tests + sandboxes so they never touch the real
+// ~/.thinkpool-pair store. Read LIVE per call (not captured at module load) so a test
+// can point each case at a fresh tempdir after importing this module. Production leaves
+// it unset → the real home-dir store.
+const ROOT = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
+const dir = (room) => path.join(ROOT(), room || 'default')
+const archiveDir = (room) => path.join(dir(room), '.archive')
 // Only resume the live SDK context for recent sessions — an expired session id
 // fails ("No conversation found"); past this window we restore transcript only.
 const RESUME_MAX_AGE_MS = 12 * 60 * 60 * 1000
-const KEEP = 8   // newest N session files per room
+const KEEP = 8   // newest N UNNAMED session files per room (named are immune — see prune)
 
 function ensureDir(room) { try { fs.mkdirSync(dir(room), { recursive: true }) } catch { /* noop */ } }
+// Move a session file into <room>/.archive/ instead of unlinking it. Archived files
+// are OUTSIDE the readdirSync(dir) path loadAll/listRecs read, so a bridge restart
+// never resurrects them — but they survive on disk for manual recovery. This is the
+// data-loss backstop: a pruned/closed terminal's transcript is always recoverable.
+// (2026-06-26: prune used to unlinkSync, permanently destroying older terminals —
+// "Blightborne" was lost this way. Named terminals are now additionally immune.)
+function archive(room, file) {
+  try {
+    fs.mkdirSync(archiveDir(room), { recursive: true })
+    const base = path.basename(file)
+    const dst = path.join(archiveDir(room), `${base}.${Date.now()}`)
+    fs.renameSync(file, dst)
+  } catch { /* noop */ }
+}
 function listRecs(room) {
   try {
     return fs.readdirSync(dir(room)).filter((f) => f.endsWith('.json'))
@@ -29,10 +48,15 @@ function listRecs(room) {
 }
 function prune(room) {
   try {
+    const names = loadNames(room)            // { id: label } — NAMED terminals are immune
+    const namedId = (p) => { try { return JSON.parse(fs.readFileSync(p, 'utf8')).id } catch { return null } }
     const files = fs.readdirSync(dir(room)).filter((f) => f.endsWith('.json'))
-      .map((f) => { const p = path.join(dir(room), f); let m = 0; try { m = JSON.parse(fs.readFileSync(p, 'utf8')).savedAt || 0 } catch { /* noop */ } return { p, m } })
+      .map((f) => { const p = path.join(dir(room), f); let m = 0; try { m = JSON.parse(fs.readFileSync(p, 'utf8')).savedAt || 0 } catch { /* noop */ } return { p, f, m } })
       .sort((a, b) => b.m - a.m)
-    files.slice(KEEP).forEach((x) => { try { fs.unlinkSync(x.p) } catch { /* noop */ } })
+    // Only UNNAMED sessions are eligible for prune. A named terminal is deliberate
+    // user intent (a project) and must never be silently destroyed by churn.
+    const prunable = files.filter((x) => { const id = namedId(x.p); return !id || !names[id] })
+    prunable.slice(KEEP).forEach((x) => archive(room, x.p))
   } catch { /* noop */ }
 }
 
@@ -46,13 +70,14 @@ export function saveSession(room, id, data) {
   timers.set(id, setTimeout(() => write(room, id, data), 1500))
 }
 export function flushSession(room, id, data) { clearTimeout(timers.get(id)); write(room, id, data) }
-// User-initiated close: cancel any pending debounced save and remove the on-disk
-// record so a later loadAll() (bridge restart) can't resurrect a closed terminal.
-// PTY ids never have an <id>.json (they use the .pty-id dotfile), so this no-ops
-// harmlessly for them.
+// User-initiated close: cancel any pending debounced save and move the on-disk
+// record to .archive/ so a later loadAll() (bridge restart) can't resurrect a
+// closed terminal — but the transcript stays recoverable. PTY ids never have an
+// <id>.json (they use the .pty-id dotfile), so this no-ops harmlessly for them.
 export function deleteSession(room, id) {
   clearTimeout(timers.get(id)); timers.delete(id)
-  try { fs.unlinkSync(path.join(dir(room), `${id}.json`)) } catch { /* noop */ }
+  const p = path.join(dir(room), `${id}.json`)
+  try { if (fs.existsSync(p)) archive(room, p) } catch { /* noop */ }
 }
 
 // Most-recently-saved structured session for the room (drives attached restore).