thinkpool-pair 0.7.81 → 0.7.82

package/README.md

@@ -1,8 +1,8 @@
 # thinkpool-pair — the ThinkPool Code bridge
 
-Share your local **Claude Code** (or any terminal CLI) into a ThinkPool Code
-room, live. Both people see the real terminal stream and can both drive it —
-no copy/paste.
+Pair two people on one live **coding agent** — running **any model you choose**
+(Claude, GPT, Gemini, Llama, or a local model) — in a ThinkPool Code room. Both
+people see the live stream and can both drive it, no copy/paste.
 
 > A web page can't read your terminal directly (browser security). This tiny
 > helper is the bridge: it runs CLIs in PTYs and streams them to the room.
@@ -114,24 +114,33 @@ npx thinkpool-pair@latest <ROOM> -- claude           # structured Claude, no TTY
 - `resize` — web viewport size → headless PTYs only (the attached terminal
   follows your own TTY).
 
-## Alternative LLM Providers
+## Run any model
 
-The bridge can run on **any Anthropic-compatible endpoint** instead of Anthropic
-directly — Z.ai GLM, OpenRouter, your own proxy, etc. **CLI-agent-compatible
-only:** the bridge spawns the `claude` CLI, which talks the Anthropic Messages
-API, so the base url must be a root the SDK can append `/v1/messages` to (an
-OpenAI-style `/v1/chat/completions` endpoint will not work).
+ThinkPool Code runs **any model you choose** — not just Anthropic. The agent
+talks the Anthropic Messages API, so you point it at any endpoint that speaks
+that format:
+
+- **Anthropic-compatible endpoints directly** — Z.ai GLM, OpenRouter, your own proxy.
+- **Any other model via a gateway** — put a translator like **LiteLLM** or
+  OpenRouter in front and run **GPT, Gemini, Llama, DeepSeek, or a local model**;
+  the gateway presents the Anthropic Messages API while calling whatever you pick.
 
 ```bash
 npx thinkpool-pair provider custom --base <url> --token <key> [--model <name>]
 ```
 
-Common base urls (the SDK appends `/v1/messages`):
+Common base urls (the agent appends `/v1/messages`):
+
+| Provider / gateway | Base url                          | Models                       |
+|--------------------|-----------------------------------|------------------------------|
+| Z.ai GLM           | `https://api.z.ai/api/anthropic`  | GLM                          |
+| OpenRouter         | `https://openrouter.ai/api`       | many, incl. non-Anthropic    |
+| LiteLLM (your own) | `http://localhost:4000`           | GPT, Gemini, Llama, local, … |
 
-| Provider      | Base url                          |
-|---------------|-----------------------------------|
-| Z.ai GLM      | `https://api.z.ai/api/anthropic`  |
-| OpenRouter    | `https://openrouter.ai/api`       |
+> The endpoint must serve the Anthropic Messages API (`/v1/messages`). A raw
+> OpenAI-style `/v1/chat/completions` won't work directly — that's exactly what a
+> gateway is for. Avoid LiteLLM 1.82.7 / 1.82.8 (compromised releases); use a
+> current version.
 
 Show the current provider (`npx thinkpool-pair provider`), or reset back to your
 regular Claude login:

package/bridge.mjs

@@ -36,7 +36,10 @@ import { spawn, execSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
+import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
+import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
+import { formatPeek, PEEK } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'
@@ -293,7 +296,11 @@ if (_superOwn.includes('--supervise') || _superOwn.includes('--keep-alive')) {
   const { acquireMachineLock, releaseMachineLock, shouldHoldMachineLock } = await import('./account.mjs')
   if (shouldHoldMachineLock(process.env) && !acquireMachineLock()) {
     console.error('\n  ◇ A thinkpool-pair bridge is already running on this machine\n    (~/.thinkpool-pair/account.lock). Only one can be active, and the running\n    one already serves every room you are in — use it, or stop it first.\n    (If you are certain none is running, delete that stale lock file.)\n')
-    process.exit(1)
+    // Intentional stand-down → exit 0 so a supervisor (systemd RestartPreventExitStatus=0 /
+    // launchd KeepAlive.SuccessfulExit=false) does NOT relaunch us into a thrash loop.
+    // Matches account.mjs's stand-down exit(0). Was exit(1), which read as a crash and
+    // got relentlessly restarted (the 2026-06-28 account-bridge restart loop).
+    process.exit(0)
   }
   if (shouldHoldMachineLock(process.env)) process.on('exit', () => { try { releaseMachineLock() } catch { /* noop */ } })
 }
@@ -553,9 +560,23 @@ const announce = () =>
   })
 
 // One flush timer batches every terminal's pending bytes (~35ms cadence).
+//
+// Viewer gate (2026-06-28): pty-out is the single biggest Realtime-message
+// generator (~28 frames/sec/terminal). A bridge serving a room whose PTY keeps
+// emitting (a dev server, a log tail, a running agent) would broadcast that
+// stream into an EMPTY channel — nobody watching — at full cadence, 24/7. With
+// no public users that was the entire Realtime bill (~2.4M msgs/day per chatty
+// unwatched terminal). So: when no web peer is present we still DRAIN buf (keep
+// memory bounded — scrollback already holds the history) but do NOT broadcast.
+// A viewer who arrives later gets the full catch-up via replay-request →
+// scrollback, the same path a reconnect already uses. lastActivity is still
+// stamped so an actively-working-but-unwatched agent isn't seen as idle and
+// restarted mid-output by the auto-update gate.
 const flushAll = () => {
+  const watched = webPeerPresent()
   for (const [id, t] of terms) {
     if (!t.buf) continue
+    if (!watched) { t.buf = ''; lastActivity = Date.now(); continue }
     const b64 = Buffer.from(t.buf, 'utf8').toString('base64')
     t.buf = ''
     bcast('pty-out', { term: id, b64 })
@@ -878,8 +899,37 @@ function openStructured({ id, model, resume, log, commands, mode }) {
   // 1.5s saveSession debounce window) and on shutdown (so events since the last
   // debounced write aren't lost). Contract #2: restart resumes, no lost messages.
   entry.flush = () => flushSession(room, id, sessionData())
+  // B2 cross-terminal peek — an in-process, READ-ONLY tool the agent can call to
+  // see a SIBLING terminal's recent output (vs B1's always-on @pool digest). The
+  // handler closes over the module-scope `sessions`/`terms` Maps + this session's
+  // own `id` (excluded) + `entry` (per-turn call counter, reset by the code-turn
+  // handler). Auto-allowed by the PreToolUse gate (mcp__thinkpool__ prefix).
+  // Spec: docs/specs/2026-06-28-cross-terminal-awareness.md
+  const peekServer = createSdkMcpServer({
+    name: 'thinkpool',
+    version: '1.0.0',
+    tools: [
+      tool(
+        'read_terminal',
+        'Read-only view of ANOTHER terminal in this ThinkPool Code room (a sibling agent or a shell the people are using). Call with no arguments to list the other open terminals; call with `terminal` (a ref, id, or command from that list) to read its recent activity. It never changes another terminal — reading only. Use it when your work depends on what another terminal is doing.',
+        {
+          terminal: z.string().optional().describe('ref, id, or command of the terminal to read; omit to list the open terminals'),
+          lines: z.number().int().positive().max(PEEK.maxLines).optional().describe(`how many recent lines to return (default ${PEEK.defaultLines})`),
+        },
+        async (args) => {
+          entry.peekCount = (entry.peekCount || 0) + 1
+          if (entry.peekCount > PEEK.perTurnCap) {
+            return { content: [{ type: 'text', text: `Cross-terminal read limit reached for this turn (${PEEK.perTurnCap}). Continue with what you have, or ask the people in the room.` }] }
+          }
+          const text = formatPeek({ selfId: id, sessions, terms, terminal: args?.terminal, lines: args?.lines })
+          return { content: [{ type: 'text', text }] }
+        },
+      ),
+    ],
+  })
   entry.session = startClaudeSession({
     cwd: process.cwd(), model, resume, mode,
+    mcpServers: { thinkpool: peekServer },
     env: { ...process.env, TP_MOCKUP_OUTBOX: mockupOutbox },
     onEvent: (evt) => {
       // Self-heal a stale resume — the saved SDK session expired. Reopen fresh,
@@ -1166,6 +1216,7 @@ channel
     const s = payload?.term && sessions.get(payload.term)
     if (!s || payload.text == null) return
     markActivity()
+    s.peekCount = 0   // B2: fresh cross-terminal read budget per user turn
     const text = String(payload.text)
     // Echo the turn so BOTH readers (and late joiners, via the log) show who
     // said what — UNLESS silent (an @pool fire, which renders its own line).

package/byok-detect.mjs

@@ -0,0 +1,82 @@
+/* ─────────────────────────────────────────────────────────────
+   byok-detect — "paste a key → pick a model" for the bridge menu.
+   ThinkPool Code is structured-only (Anthropic Messages API), so only
+   endpoints that speak that format work directly. OpenRouter is the
+   universal path: one key, any model, an Anthropic-compatible endpoint.
+   A bare OpenAI/Gemini/Groq key is DETECTED so we can guide the user to
+   OpenRouter or a gateway instead of failing silently.
+   Spec: docs/specs/2026-06-28-byok-only-two-tier-pivot.md (addendum)
+   ───────────────────────────────────────────────────────────── */
+
+// Providers whose endpoint speaks the Anthropic Messages API → usable directly
+// in structured mode. `base` is what we set as ANTHROPIC_BASE_URL; `models` is
+// the model-list endpoint; `auth` is how the model-list call authenticates.
+export const ANTHROPIC_COMPATIBLE = {
+  anthropic: {
+    name:   'Anthropic',
+    base:   'https://api.anthropic.com',
+    models: 'https://api.anthropic.com/v1/models',
+    auth:   'x-api-key',
+  },
+  openrouter: {
+    name:   'OpenRouter — any model',
+    base:   'https://openrouter.ai/api',
+    models: 'https://openrouter.ai/api/v1/models',
+    auth:   'bearer',
+  },
+}
+
+// Key-prefix → provider. `compatible: true` means it works directly; false
+// means we detected it but it needs OpenRouter or a gateway (different wire
+// format). Keep the most specific prefixes first (sk-ant- / sk-or- before sk-).
+const PREFIXES = [
+  ['sk-ant-', 'anthropic',  true,  'Anthropic'],
+  ['sk-or-',  'openrouter', true,  'OpenRouter'],
+  ['AIza',    'google',     false, 'Google Gemini'],
+  ['gsk_',    'groq',       false, 'Groq'],
+  ['pplx-',   'perplexity', false, 'Perplexity'],
+  ['xai-',    'xai',        false, 'xAI (Grok)'],
+  ['fw_',     'fireworks',  false, 'Fireworks'],
+  ['sk-',     'openai',     false, 'OpenAI'],   // generic sk- LAST (after sk-ant-/sk-or-)
+]
+
+// Detect the provider from a pasted key. Returns { id, name, compatible }.
+export function detectProvider(key) {
+  const k = String(key || '').trim()
+  if (!k) return { id: 'unknown', name: 'unknown', compatible: false }
+  for (const [prefix, id, compatible, name] of PREFIXES) {
+    if (k.startsWith(prefix)) return { id, name, compatible }
+  }
+  return { id: 'unknown', name: 'unknown', compatible: false }
+}
+
+// Fetch the model-id list for an Anthropic-compatible provider. Handles both
+// OpenAI-shape ({ data: [{ id }] }) and Google-shape ({ models: [{ name }] }).
+// Returns [] on any failure (caller falls back to a free-text model prompt).
+export async function fetchModels({ modelsUrl, key, auth }) {
+  const headers = auth === 'x-api-key'
+    ? { 'x-api-key': key, 'anthropic-version': '2023-06-01' }
+    : { Authorization: `Bearer ${key}` }
+  const ctrl = new AbortController()
+  const timer = setTimeout(() => ctrl.abort(), 12_000)
+  try {
+    const r = await fetch(modelsUrl, { headers, signal: ctrl.signal, redirect: 'error' })
+    if (!r.ok) return []
+    const data = await r.json()
+    const raw = Array.isArray(data?.data) ? data.data
+              : Array.isArray(data?.models) ? data.models
+              : []
+    return raw
+      .map((m) => String(m.id || m.name || '').replace(/^models\//, ''))
+      .filter(Boolean)
+  } catch {
+    return []
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+// The friendly message shown when a detected key isn't directly usable.
+export function gatewayHint(name) {
+  return `That key looks like ${name}. ThinkPool Code runs on the Anthropic Messages API, so it can't use that key directly. Easiest fix: paste an OpenRouter key (sk-or-…) — one key, every model (GPT, Gemini, Llama, and more). Or point it at your own gateway (e.g. LiteLLM).`
+}

package/claude-session.mjs

@@ -120,7 +120,7 @@ const simplifyBlocks = (blocks = []) => blocks.map((b) => {
  */
 const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers }) {
   const ac = new AbortController()
   let input = makeInputStream()   // `let`: auto-restart swaps in a fresh stream
   let sessionId = resume || null
@@ -248,6 +248,12 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     // Surface it to the room when it changes; absent on models without effort.
     const lvl = hookInput.effort?.level
     if (lvl && lvl !== effort) { effort = lvl; emit({ kind: 'effort', level: effort }) }
+    // ThinkPool's own in-process tools (B2 cross-terminal read) are read-only and
+    // within-room — never prompt for them, in any mode. They still surface as
+    // tool_use/tool_result cards so the room sees the peek.
+    if (typeof toolName === 'string' && toolName.startsWith('mcp__thinkpool__')) {
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (read-only ThinkPool cross-terminal read).' } }
+    }
     // ── Plan approval — ExitPlanMode is how the agent presents its plan in
     // plan mode. Render a dedicated plan card (not the generic perm card) with
     // three outcomes: run (exit → default), accept (exit → acceptEdits), keep
@@ -364,6 +370,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       'SHOW YOUR WORK, do not just describe it: the room is watched live from a phone, where a wall of text is painful to read. Whenever you build, change, or fix anything visual — a UI, a page, an HTML artifact, a chart, a diagram, a rendered result — capture a screenshot and surface the PNG (for example, read the image file into your turn) so it appears inline in the room. The room auto-uploads any image you surface. Default to showing a picture of the result over narrating it; err toward more screenshots, not fewer.',
       'HTML PREVIEWS: for any HTML you produce, give the room something it can actually open, by whichever path is available. (a) IN-ROOM PREVIEW: if a mockup render helper is present — one that writes a manifest into the directory named by $TP_MOCKUP_OUTBOX, such as the mockup-iterate render.sh script when the bridge was launched from the thinkpool repo — use it; it surfaces an inline card with desktop and mobile views that the room can expand. (b) SHAREABLE LINK: additionally or otherwise, publish the HTML to a GitHub Pages URL per the LINKS & ARTIFACTS rule above and post the link. Never leave an HTML artifact viewable only as a local path.',
       'RUN IT, DO NOT ASK: verify your own work before calling it done. Actually run or serve what you changed, observe that it behaves correctly, and show the evidence in the room — a screenshot of the running result, the passing test output, or the real response — rather than telling the user "this should work, go test it." If you could not verify something, say exactly what is unverified. This room follows verify-before-claiming: runtime evidence you produced, not assertion.',
+      'CROSS-TERMINAL AWARENESS: this room may have other terminals open alongside yours — other agents working, or shells the people are driving. You have a READ-ONLY tool, read_terminal: call it with no arguments to list the other open terminals, or with a terminal ref/id/command to read that terminal\'s recent activity. Reach for it when your work depends on what another terminal is doing (e.g. someone says "see what the other terminal hit", or you need to coordinate with a sibling agent before acting). It only ever reads — it never changes another terminal.',
       'WRITE PLANS INTO THE CHAT: whenever you form or revise a plan — because the room is in Plan mode, or because someone asked you to plan, design, or think it through first — write the actual plan out as a normal message in the room as you develop it: the approach, the concrete steps, the files you will touch, the open questions. The room does NOT surface plan files at all, and the plan-approval card does not reliably carry the plan text, so a plan that lives only in a plan file or only inside ExitPlanMode is INVISIBLE to the people you are working with — they just see "plan ready" with no content. The chat is the canonical place your plan lives; put it there so the room can read and react to it before you proceed.',
     ].join(' '),
     // Needed for live thinking-token progress (SDKThinkingTokensMessage) to
@@ -386,6 +393,10 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // CLAUDE.md / agents either way — strict only governs MCP server sourcing. Flip
   // this to the default (or curate a slim allowlist) once the numbers justify it.
   if (process.env.TP_MCP_STRICT === '1') { opts.strictMcpConfig = true; opts.mcpServers = {} }
+  // In-process ThinkPool tools (B2 read_terminal) — MERGED with the host's
+  // filesystem MCP (non-strict), or the sole servers under TP_MCP_STRICT. The SDK
+  // namespaces these as mcp__<key>__<tool>; the PreToolUse gate auto-allows them.
+  if (mcpServers && Object.keys(mcpServers).length) opts.mcpServers = { ...(opts.mcpServers || {}), ...mcpServers }
   if (cwd) opts.cwd = cwd
   if (model) opts.model = model
   if (resume) opts.resume = resume

package/cross-terminal.mjs

@@ -0,0 +1,100 @@
+/* ThinkPool Code — B2 cross-terminal peek (read-only sibling access).
+   Pure formatting for the in-process `read_terminal` MCP tool that bridge.mjs
+   wires into every structured Claude session. Lets an agent PULL a sibling
+   terminal's recent output on demand (vs B1's always-on @pool digest) so it can
+   reason across lanes when its own work depends on another terminal.
+
+   Bridge-local on purpose — it cannot import the frontend's code-constants, so
+   the structured-event compaction here mirrors that file's digestLine shape.
+   Spec: docs/specs/2026-06-28-cross-terminal-awareness.md */
+
+// Bounds — the pull tool is self-limiting (the agent only calls it when it needs
+// to), but a runaway loop must still be capped (the cost-guard / C10 class).
+export const PEEK = {
+  defaultLines: 40,
+  maxLines: 200,
+  perTurnCap: 10,     // read_terminal calls allowed per user turn (bridge resets it)
+  lineCap: 200,       // per-line truncation
+  rosterPreview: 100, // last-line preview length in the roster listing
+}
+
+const clip = (s, cap) => {
+  const t = String(s == null ? '' : s).replace(/\s+/g, ' ').trim()
+  return t.length > cap ? t.slice(0, cap - 1) + '…' : t
+}
+
+// Compact ONE structured log event into a single line, or '' to skip it.
+// Mirrors src/pages/code/code-constants.js digestLine — keep them in step.
+export const digestLogEvent = (e, cap = PEEK.lineCap) => {
+  if (!e || typeof e !== 'object') return ''
+  switch (e.kind) {
+    case 'you': return clip(`${e.by || 'someone'}: ${e.text || ''}`, cap)
+    case 'assistant': {
+      const parts = []
+      for (const b of (Array.isArray(e.blocks) ? e.blocks : [])) {
+        if (b?.type === 'text' && String(b.text || '').trim()) parts.push(String(b.text).trim())
+        else if (b?.type === 'tool_use' && b.name) parts.push(`→ ${b.name}`)
+      }
+      return parts.length ? clip(`assistant: ${parts.join(' ')}`, cap) : ''
+    }
+    case 'tool_result': return e.isError ? clip('⎿ error', cap) : ''
+    case 'result': return (e.subtype && e.subtype !== 'success') ? clip(`turn ended — ${e.subtype}`, cap) : ''
+    case 'error': return clip(`error: ${e.message || ''}`, cap)
+    default: return ''   // chat/whisper/pool/note/control/compaction/system → not lane work
+  }
+}
+
+// Strip ANSI / control bytes from a PTY scrollback buffer, return last N real lines.
+export const cleanPtyTail = (buf, n) => {
+  /* eslint-disable no-control-regex -- stripping terminal escape/control bytes is the whole point */
+  const txt = String(buf || '')
+    .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')   // OSC sequences
+    .replace(/\x1b[@-_][0-?]*[ -/]*[@-~]/g, '')          // CSI / escape sequences
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')    // remaining control chars
+  /* eslint-enable no-control-regex */
+  const lines = txt.split(/\r?\n/).map(l => l.replace(/\s+$/, '')).filter(l => l.trim())
+  return lines.slice(-Math.max(1, n))
+}
+
+// Build the tool's text reply. `selfId` is excluded. `sessions` (structured) and
+// `terms` (PTY) are the bridge's module-scope Maps (id → entry). With no
+// `terminal`, returns the roster; with one, returns that lane's recent output.
+export const formatPeek = ({ selfId, sessions, terms, terminal, lines } = {}) => {
+  const n = Math.min(PEEK.maxLines, Math.max(1, Number(lines) || PEEK.defaultLines))
+  const sib = []
+  for (const [id, s] of (sessions || new Map())) {
+    if (id === selfId) continue
+    sib.push({ id, kind: 'agent', cmd: s?.cmd || 'claude', log: Array.isArray(s?.log) ? s.log : [] })
+  }
+  for (const [id, t] of (terms || new Map())) {
+    if (id === selfId) continue
+    sib.push({ id, kind: 'shell', cmd: t?.cmd || 'shell', buf: t?.buf || '' })
+  }
+  if (!sib.length) return 'No other terminals are open in this room right now.'
+
+  const ref = (x) => String(x.id).slice(0, 8)
+
+  if (!terminal) {
+    const rows = sib.map(x => {
+      let preview
+      if (x.kind === 'agent') { const ls = x.log.map(e => digestLogEvent(e, PEEK.rosterPreview)).filter(Boolean); preview = ls[ls.length - 1] || '(no activity yet)' }
+      else { preview = cleanPtyTail(x.buf, 1)[0] || '(no output yet)' }
+      return `- ${ref(x)} · ${x.kind} · ${x.cmd} — ${clip(preview, PEEK.rosterPreview)}`
+    })
+    return `Other terminals in this room (call read_terminal with one of these refs to read it):\n${rows.join('\n')}`
+  }
+
+  const q = String(terminal).toLowerCase().trim()
+  const hit = sib.find(x => String(x.id).toLowerCase() === q)
+    || sib.find(x => ref(x).toLowerCase() === q || String(x.id).toLowerCase().startsWith(q))
+    || sib.find(x => String(x.cmd).toLowerCase().includes(q))
+  if (!hit) return `No terminal matches "${terminal}". Call read_terminal with no argument to list the open terminals.`
+
+  let body
+  if (hit.kind === 'agent') {
+    body = hit.log.map(e => digestLogEvent(e, PEEK.lineCap)).filter(Boolean).slice(-n).join('\n') || '(no activity yet)'
+  } else {
+    body = cleanPtyTail(hit.buf, n).join('\n') || '(no output yet)'
+  }
+  return `Terminal ${ref(hit)} (${hit.kind} · ${hit.cmd}) — last ${n} lines:\n${body}`
+}

package/launcher.mjs

@@ -14,6 +14,7 @@ import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
 import { execSync } from 'node:child_process'
+import { detectProvider, fetchModels, ANTHROPIC_COMPATIBLE, gatewayHint } from './byok-detect.mjs'
 
 const HOME = os.homedir()
 const CFG_DIR = path.join(HOME, '.thinkpool-pair')
@@ -173,12 +174,47 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
     const cur = state.provider + (state.providerModel ? `, model ${state.providerModel}` : '')
     const p = await askChoice('\n  provider', [
       { label: 'Anthropic (default)', hint: 'regular Claude login' },
-      { label: 'Custom endpoint', hint: 'Z.ai GLM, OpenRouter, your own proxy' },
+      { label: 'Paste a key, pick a model', hint: 'auto-detects the provider · OpenRouter = any model' },
+      { label: 'Custom endpoint', hint: 'enter a base url + token by hand' },
       { label: '← Back', hint: `current: ${cur}` },
-    ], 3)  // Enter = Back
-    if (p === 2) return
+    ], 4)  // Enter = Back
+    if (p === 3) return
     if (p === 0) { await actions.setProvider({ kind: 'anthropic' }); resync(); io.print('\n  ' + C.green('✓ back on regular Claude.')); return }
-    // custom — every step can be aborted with a blank line, which backs out cleanly.
+
+    if (p === 1) {
+      // Paste a key → detect provider → auto base url → fetch model list → pick.
+      const key = (await io.ask(`\n  Paste your API key ${C.dim('(blank to cancel)')} ${C.cyan('▸')} `)).trim()
+      if (!key) { io.print('  ' + C.yellow('cancelled — provider unchanged')); return }
+      const det = detectProvider(key)
+      if (!det.compatible) { io.print('\n  ' + C.yellow(gatewayHint(det.name))); return }
+      const cfg = ANTHROPIC_COMPATIBLE[det.id]
+      io.print(`\n  ${C.green('✓ detected ' + cfg.name)} ${C.dim('— fetching models…')}`)
+      const models = await fetchModels({ modelsUrl: cfg.models, key, auth: cfg.auth })
+      let model
+      if (models.length === 0) {
+        model = (await io.ask(`  Couldn't list models. Model id ${C.dim('(blank = endpoint default)')} ${C.cyan('▸')} `)).trim() || undefined
+      } else if (models.length <= 40) {
+        const idx = await askChoice('\n  model', models.map((m) => ({ label: m })), 1)
+        model = models[idx]
+      } else {
+        io.print(`  ${C.dim(models.length + ' models available, e.g. ' + models.slice(0, 3).join(', ') + '…')}`)
+        for (;;) {
+          const q = (await io.ask(`  Type a model id or part of it ${C.dim('(blank to cancel)')} ${C.cyan('▸')} `)).trim()
+          if (!q) { io.print('  ' + C.yellow('cancelled — provider unchanged')); return }
+          const matches = models.filter((m) => m.toLowerCase().includes(q.toLowerCase()))
+          if (matches.length === 0) { io.print('  ' + C.yellow('no match — try again')); continue }
+          if (matches.length === 1) { model = matches[0]; break }
+          if (matches.length <= 40) { const i = await askChoice('\n  pick', matches.map((m) => ({ label: m })), 1); model = matches[i]; break }
+          io.print(`  ${C.yellow(matches.length + ' matches — narrow it down')}`)
+        }
+      }
+      await actions.setProvider({ kind: 'custom', base: cfg.base, token: key, model })
+      resync()
+      io.print(`\n  ${C.green('✓ provider set.')}\n    ${cfg.name}\n    model: ${model || '(endpoint default)'}`)
+      return
+    }
+
+    // p === 2 — manual custom endpoint (kept as a fallback; blank line aborts each step).
     const base = (await io.ask(`\n  Base url ${C.dim('(blank to cancel · SDK appends /v1/messages)')} ${C.cyan('▸')} `)).trim()
     if (!base) { io.print('  ' + C.yellow('cancelled — provider unchanged')); return }
     const token = (await io.ask(`  API token ${C.dim('(blank to cancel)')} ${C.cyan('▸')} `)).trim()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.81",
+  "version": "0.7.82",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -9,11 +9,13 @@
   "files": [
     "bridge.mjs",
     "launcher.mjs",
+    "byok-detect.mjs",
     "claude-session.mjs",
     "update-gate.mjs",
     "event-id.mjs",
     "transcript-sanitize.mjs",
     "session-store.mjs",
+    "cross-terminal.mjs",
     "service.mjs",
     "presence.mjs",
     "account.mjs",
@@ -29,7 +31,8 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.185",
-    "@supabase/supabase-js": "^2.45.0"
+    "@supabase/supabase-js": "^2.45.0",
+    "zod": "^4.4.3"
   },
   "optionalDependencies": {
     "node-pty": "^1.2.0-beta.13"

package/service.mjs

@@ -85,7 +85,13 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   <key>Label</key><string>${label(room)}</string>
   <key>ProgramArguments</key><array>${args.map((a) => `<string>${xml(a)}</string>`).join('')}</array>
   <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
+  <!-- KeepAlive only on UNSUCCESSFUL exit. A bridge that exits 0 has intentionally
+       stood down — told to stop, or another bridge already owns this machine's
+       singleton lock — and must NOT be relaunched, or launchd thrashes it every
+       few seconds forever (the 2026-06-28 account-bridge restart loop). A crash
+       or an update-restart exits non-zero and IS relaunched. Mirrors the bridge's
+       own exit-code contract (stop()=0, restart-requested=non-zero). -->
+  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
   <key>WorkingDirectory</key><string>${xml(cwd)}</string>
   <key>StandardOutPath</key><string>${xml(log)}</string>
   <key>StandardErrorPath</key><string>${xml(log)}</string>
@@ -127,6 +133,12 @@ After=network-online.target
 ExecStart=${execStart}
 Restart=always
 RestartSec=2
+# Don't relaunch a clean stand-down. exit 0 = the bridge intentionally stopped —
+# told to stop, or another bridge already holds this machine's singleton lock —
+# so restarting it just thrashes every RestartSec forever (the 2026-06-28
+# account-bridge restart loop). Crashes + update-restarts exit non-zero and are
+# still restarted. Matches the bridge's exit-code contract (stop()=0, restart=non-zero).
+RestartPreventExitStatus=0
 WorkingDirectory=${cwd}
 Environment=PATH=${process.env.PATH || ''}
 ${autoUpdate ? 'Environment=THINKPOOL_PAIR_AUTOUPDATE=1\n' : ''}StandardOutput=append:${log}