thinkpool-pair 0.7.75 → 0.7.77

package/claude-session.mjs

@@ -384,7 +384,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // it; idempotent + no-op on clean transcripts. See transcript-sanitize.mjs.
   if (resume) {
     const healed = sanitizeSession(cwd || process.cwd(), resume)
-    if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} cross-provider tool block(s) in the transcript before resume.\n`)
+    if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} malformed tool block(s) in the transcript before resume.\n`)
   }
 
   // One-shot Haiku fallback suggestion. Runs on the SAME subscription auth as the room

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.75",
+  "version": "0.7.77",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/session-store.mjs

@@ -12,14 +12,33 @@ import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
 
-const ROOT = path.join(os.homedir(), '.thinkpool-pair')
-const dir = (room) => path.join(ROOT, room || 'default')
+// TP_PAIR_ROOT override exists for tests + sandboxes so they never touch the real
+// ~/.thinkpool-pair store. Read LIVE per call (not captured at module load) so a test
+// can point each case at a fresh tempdir after importing this module. Production leaves
+// it unset → the real home-dir store.
+const ROOT = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
+const dir = (room) => path.join(ROOT(), room || 'default')
+const archiveDir = (room) => path.join(dir(room), '.archive')
 // Only resume the live SDK context for recent sessions — an expired session id
 // fails ("No conversation found"); past this window we restore transcript only.
 const RESUME_MAX_AGE_MS = 12 * 60 * 60 * 1000
-const KEEP = 8   // newest N session files per room
+const KEEP = 8   // newest N UNNAMED session files per room (named are immune — see prune)
 
 function ensureDir(room) { try { fs.mkdirSync(dir(room), { recursive: true }) } catch { /* noop */ } }
+// Move a session file into <room>/.archive/ instead of unlinking it. Archived files
+// are OUTSIDE the readdirSync(dir) path loadAll/listRecs read, so a bridge restart
+// never resurrects them — but they survive on disk for manual recovery. This is the
+// data-loss backstop: a pruned/closed terminal's transcript is always recoverable.
+// (2026-06-26: prune used to unlinkSync, permanently destroying older terminals —
+// "Blightborne" was lost this way. Named terminals are now additionally immune.)
+function archive(room, file) {
+  try {
+    fs.mkdirSync(archiveDir(room), { recursive: true })
+    const base = path.basename(file)
+    const dst = path.join(archiveDir(room), `${base}.${Date.now()}`)
+    fs.renameSync(file, dst)
+  } catch { /* noop */ }
+}
 function listRecs(room) {
   try {
     return fs.readdirSync(dir(room)).filter((f) => f.endsWith('.json'))
@@ -29,10 +48,15 @@ function listRecs(room) {
 }
 function prune(room) {
   try {
+    const names = loadNames(room)            // { id: label } — NAMED terminals are immune
+    const namedId = (p) => { try { return JSON.parse(fs.readFileSync(p, 'utf8')).id } catch { return null } }
     const files = fs.readdirSync(dir(room)).filter((f) => f.endsWith('.json'))
-      .map((f) => { const p = path.join(dir(room), f); let m = 0; try { m = JSON.parse(fs.readFileSync(p, 'utf8')).savedAt || 0 } catch { /* noop */ } return { p, m } })
+      .map((f) => { const p = path.join(dir(room), f); let m = 0; try { m = JSON.parse(fs.readFileSync(p, 'utf8')).savedAt || 0 } catch { /* noop */ } return { p, f, m } })
       .sort((a, b) => b.m - a.m)
-    files.slice(KEEP).forEach((x) => { try { fs.unlinkSync(x.p) } catch { /* noop */ } })
+    // Only UNNAMED sessions are eligible for prune. A named terminal is deliberate
+    // user intent (a project) and must never be silently destroyed by churn.
+    const prunable = files.filter((x) => { const id = namedId(x.p); return !id || !names[id] })
+    prunable.slice(KEEP).forEach((x) => archive(room, x.p))
   } catch { /* noop */ }
 }
 
@@ -46,13 +70,14 @@ export function saveSession(room, id, data) {
   timers.set(id, setTimeout(() => write(room, id, data), 1500))
 }
 export function flushSession(room, id, data) { clearTimeout(timers.get(id)); write(room, id, data) }
-// User-initiated close: cancel any pending debounced save and remove the on-disk
-// record so a later loadAll() (bridge restart) can't resurrect a closed terminal.
-// PTY ids never have an <id>.json (they use the .pty-id dotfile), so this no-ops
-// harmlessly for them.
+// User-initiated close: cancel any pending debounced save and move the on-disk
+// record to .archive/ so a later loadAll() (bridge restart) can't resurrect a
+// closed terminal — but the transcript stays recoverable. PTY ids never have an
+// <id>.json (they use the .pty-id dotfile), so this no-ops harmlessly for them.
 export function deleteSession(room, id) {
   clearTimeout(timers.get(id)); timers.delete(id)
-  try { fs.unlinkSync(path.join(dir(room), `${id}.json`)) } catch { /* noop */ }
+  const p = path.join(dir(room), `${id}.json`)
+  try { if (fs.existsSync(p)) archive(room, p) } catch { /* noop */ }
 }
 
 // Most-recently-saved structured session for the room (drives attached restore).

package/transcript-sanitize.mjs

@@ -48,7 +48,8 @@ const ANTHROPIC_SERVER_TOOLS = new Set([
   'tool_search_tool_bm25',
 ])
 
-const MARKER = '"server_tool_use"'
+const STU_MARKER = '"server_tool_use"'
+const TR_MARKER = '"tool_result"'
 
 /**
  * Resolve a session's transcript path the same way Claude Code names it:
@@ -72,6 +73,38 @@ function fixContent(content) {
   return n
 }
 
+/* ─────────────────────────────────────────────────────────────
+   SECOND HEAL — interrupted-turn corruption (failure 2026-06-26):
+   a `tool_result` block stranded inside an ASSISTANT message.
+
+   When a turn is aborted/interrupted mid-tool-call, Claude Code can
+   persist a single assistant message holding BOTH the tool_use AND its
+   tool_result (plus stray thinking/text). Anthropic strictly 400s:
+     messages.N: tool_result blocks can only be in user messages
+   and the room wedges — every send re-hits message N and fails (exactly
+   what bricked the /code GLM session, transcript line 1196 / messages.165).
+
+   THE FIX: in an assistant content array, drop every stray tool_result
+   AND the tool_use block(s) it pairs with (same id) — removing the pair
+   together so no orphaned tool_use is left behind (an orphan would 400
+   differently: "tool_use ids were found without tool_result blocks").
+   The aborted call is dead history; dropping it lets the session resume.
+   If the message would be left empty, leave a placeholder text block
+   (Anthropic rejects a content-less assistant message). In-place, no row
+   split — so Claude Code's own uuid/parentUuid chain stays intact.
+   Returns the new content array + count removed. ───────────────────── */
+function fixToolResultInAssistant(content) {
+  if (!Array.isArray(content)) return { removed: 0, content }
+  const resultIds = new Set()
+  for (const b of content) if (b && b.type === 'tool_result') resultIds.add(b.tool_use_id)
+  if (!resultIds.size) return { removed: 0, content } // no stray result here — nothing to do
+  const before = content.length
+  let next = content.filter((b) =>
+    b && b.type !== 'tool_result' && !(b.type === 'tool_use' && resultIds.has(b.id)))
+  if (next.length === 0) next = [{ type: 'text', text: '[interrupted turn removed by transcript-sanitize]' }]
+  return { removed: before - next.length, content: next }
+}
+
 /**
  * Sanitize one transcript file in place. Returns { lines, blocks } counting the
  * transcript lines rewritten and the individual blocks flipped. A missing,
@@ -84,14 +117,19 @@ export function sanitizeTranscript(file) {
   } catch {
     return { lines: 0, blocks: 0 } // no transcript yet (fresh session) — nothing to do
   }
-  if (!raw.includes(MARKER)) return { lines: 0, blocks: 0 } // fast path: nothing illegal possible
+  const fileHasStu = raw.includes(STU_MARKER)
+  const fileHasTr = raw.includes(TR_MARKER)
+  if (!fileHasStu && !fileHasTr) return { lines: 0, blocks: 0 } // fast path: nothing illegal possible
 
   const rows = raw.split('\n')
   let lines = 0
   let blocks = 0
   for (let i = 0; i < rows.length; i++) {
     const row = rows[i]
-    if (!row || !row.includes(MARKER)) continue
+    if (!row) continue
+    const rowHasStu = row.includes(STU_MARKER)
+    const rowHasTr = row.includes(TR_MARKER)
+    if (!rowHasStu && !rowHasTr) continue
     let obj
     try {
       obj = JSON.parse(row)
@@ -99,8 +137,22 @@ export function sanitizeTranscript(file) {
       continue // never touch a line we can't parse — leave it byte-identical
     }
     let n = 0
-    if (obj.message && typeof obj.message === 'object') n += fixContent(obj.message.content)
-    n += fixContent(obj.content)
+    // Pass 1 — foreign server_tool_use → tool_use (any message).
+    if (rowHasStu) {
+      if (obj.message && typeof obj.message === 'object') n += fixContent(obj.message.content)
+      n += fixContent(obj.content)
+    }
+    // Pass 2 — stray tool_result inside an assistant message → drop it + its paired tool_use.
+    if (rowHasTr) {
+      if (obj.message && obj.message.role === 'assistant') {
+        const r = fixToolResultInAssistant(obj.message.content)
+        if (r.removed) { obj.message.content = r.content; n += r.removed }
+      }
+      if (obj.type === 'assistant' && Array.isArray(obj.content)) {
+        const r = fixToolResultInAssistant(obj.content)
+        if (r.removed) { obj.content = r.content; n += r.removed }
+      }
+    }
     if (n > 0) {
       rows[i] = JSON.stringify(obj)
       lines++
@@ -130,3 +182,27 @@ export function sanitizeSession(cwd, sessionId) {
     return { lines: 0, blocks: 0 }
   }
 }
+
+/* ─────────────────────────────────────────────────────────────
+   CLI — manual recovery for a wedged transcript (the auto-heal runs on
+   every resume via claude-session.mjs; this is the break-glass tool):
+     node bridge/transcript-sanitize.mjs <path-to-transcript.jsonl>
+     node bridge/transcript-sanitize.mjs <cwd> <sessionId>
+   Prints what it healed. A backup (<file>.bak) is written before any
+   change so a bad heal is one `mv` from undone.
+   ───────────────────────────────────────────────────────────── */
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const a = process.argv.slice(2)
+  if (a.length === 0) {
+    process.stderr.write('usage: transcript-sanitize.mjs <transcript.jsonl> | <cwd> <sessionId>\n')
+    process.exit(2)
+  }
+  const file = a.length >= 2 ? transcriptPath(a[0], a[1]) : a[0]
+  if (!fs.existsSync(file)) { process.stderr.write(`not found: ${file}\n`); process.exit(1) }
+  fs.copyFileSync(file, `${file}.bak`) // break-glass backup
+  const r = sanitizeTranscript(file)
+  process.stdout.write(r.blocks
+    ? `healed ${r.blocks} malformed tool block(s) across ${r.lines} line(s) in ${file}\n  backup: ${file}.bak\n`
+    : `no malformed tool blocks found in ${file} (already clean)\n`)
+  process.exit(0)
+}