thinkpool-pair 0.7.87 → 0.7.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.87",
+  "version": "0.7.88",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -67,7 +67,15 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   // version — a bad publish can't auto-roll here. `autoUpdate` opts into `@latest` tracking
   // (and the in-process self-updater via THINKPOOL_PAIR_AUTOUPDATE below).
   const verSpec = autoUpdate ? 'thinkpool-pair@latest' : `thinkpool-pair@${version}`
-  const pkgArgs = room ? ['-y', verSpec, room] : ['-y', verSpec]
+  // Anti-zombie (2026-06-29): cacheWipe removes the INSTALLED package, but npx still
+  // resolves `@latest` from npm's cached registry metadata (TTL'd). A restart inside
+  // that window reinstalls the OLD version even though a newer one is published — the
+  // bridge "comes back from the dead" stale (left FVIHV1DE on 0.7.86 while @latest was
+  // 0.7.87). `--prefer-online` forces npx to REVALIDATE the packument against the
+  // registry every resolve, so `@latest` always means the true latest. Only needed for
+  // the @latest (autoUpdate) tier — a pinned exact version is immutable, no staleness.
+  const onlineFlag = autoUpdate ? ['--prefer-online'] : []
+  const pkgArgs = room ? ['-y', ...onlineFlag, verSpec, room] : ['-y', ...onlineFlag, verSpec]
   // In-process self-update (account.mjs / bridge.mjs) is gated on this env — only on when
   // the user explicitly opted into auto-update.
   const autoUpdateEnv = autoUpdate ? { THINKPOOL_PAIR_AUTOUPDATE: '1' } : {}
@@ -158,8 +166,8 @@ WantedBy=default.target
     const startup = path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup')
     const file = path.join(startup, `thinkpool-pair-${id}.cmd`)
     const inner = room
-      ? ['npx', '-y', verSpec, room, '--supervise', ...tail].join(' ')
-      : ['npx', '-y', verSpec].join(' ')
+      ? ['npx', '-y', ...onlineFlag, verSpec, room, '--supervise', ...tail].join(' ')
+      : ['npx', '-y', ...onlineFlag, verSpec].join(' ')
     const content = `@echo off\r\ntitle thinkpool-pair ${id}\r\n${inner}\r\n`
     return { file, content, logDir, post: [], note: 'Installed to the Startup folder — runs at login' + (room ? ' with --supervise (auto-restart on crash).' : ' (account mode).') + ' Start it now without rebooting by double-clicking the .cmd, or run it from a terminal.' }
   }