@threadbase-sh/streamer 1.36.3 → 1.37.0

package/dist/migrations/010_create_managed_sessions.sql

@@ -0,0 +1,65 @@
+-- Managed-session registry (durable session runtime, C1 Phase 2).
+-- See docs/architecture/2026-07-24-durable-session-runtime.md.
+--
+-- Until now managed session state lived only in SessionStore's in-memory Maps,
+-- so a streamer restart lost startedAt, promptCount, sessionName, projectId,
+-- the Codex placeholder→rollout binding, and failureReason outright. Sessions
+-- did not come back as "recoverable" — they ceased to exist, reappearing at
+-- best as external discovered processes with no managed metadata.
+--
+-- This table stores identity and provenance so the boot reconciler can say what
+-- happened to each session. It deliberately does NOT store the byte stream:
+-- outputBuffer is 64KiB of raw ANSI rewritten on every PTY chunk, and its
+-- authoritative copy is already the provider's JSONL. Persisting it would turn
+-- every chunk into a DB write to duplicate data we can re-read. Post-restart
+-- replay is therefore conversation-accurate, not byte-accurate.
+CREATE TABLE IF NOT EXISTS managed_sessions (
+  -- Provider-native resume identifier: the JSONL UUID for Claude Code, the
+  -- rollout id for Codex. This is what --resume / `codex resume` consumes, so
+  -- the registry never invents an identifier of its own.
+  session_id            TEXT PRIMARY KEY,
+  provider              TEXT    NOT NULL,
+
+  -- Liveness probing. pid alone is never treated as identity: PIDs get reused,
+  -- so the reconciler matches the recorded cmdline before claiming a live
+  -- process is ours, and reports `orphaned` on a mismatch rather than guessing.
+  pid                   INTEGER,
+  cmdline               TEXT,
+
+  project_path          TEXT    NOT NULL,
+  project_name          TEXT    NOT NULL,
+  branch                TEXT    NOT NULL DEFAULT '',
+
+  -- Semantic status (running/waiting_input/idle) as last observed. The
+  -- reconciler never trusts this over a live PID probe — a SIGKILLed streamer
+  -- never ran its exit writes, so a stored 'running' can be arbitrarily stale.
+  -- status_source records how the value was obtained so that staleness is
+  -- visible instead of implied.
+  status                TEXT    NOT NULL,
+  status_source         TEXT    NOT NULL,
+  status_updated_at     INTEGER NOT NULL,
+
+  started_at            INTEGER NOT NULL,
+  completed_at          INTEGER,
+  last_activity_at      INTEGER,
+  prompt_count          INTEGER NOT NULL DEFAULT 0,
+
+  -- User-visible identity that today vanishes silently on restart.
+  session_name          TEXT,
+  project_id            TEXT,
+  -- Codex two-id model: the placeholder id the session was created under vs the
+  -- rollout id its history is indexed by. Losing this on restart orphans the
+  -- conversation from the session (types.ts:36-44).
+  bound_conversation_id TEXT,
+  resumed_from_conversation_id TEXT,
+  failure_reason        TEXT,
+
+  -- Which streamer run started this session. A row whose instance differs from
+  -- the current run is the orphan test: the process outlived its streamer.
+  streamer_instance_id  TEXT    NOT NULL
+);
+
+-- The reconciler's only read path on boot: every row not already in a terminal
+-- state. Terminal rows are retained for history but never re-probed.
+CREATE INDEX IF NOT EXISTS idx_managed_sessions_status
+  ON managed_sessions (status);

package/dist/migrations/011_create_devices.sql

@@ -0,0 +1,39 @@
+-- Paired-device registry (C5 scoped device capabilities).
+-- See docs/architecture/2026-07-24-device-identity-and-capabilities.md.
+--
+-- Pairing exchanged a short-lived token for the streamer's API key — the SAME
+-- string for every device that ever paired. Nothing recorded that a device
+-- existed, so there was no attribution, no per-device revocation (rotating the
+-- key de-authenticated everyone at once), and no way to scope authority.
+CREATE TABLE IF NOT EXISTS devices (
+  -- Minted server-side. A client-supplied id would let one device claim
+  -- another's identity.
+  device_id     TEXT PRIMARY KEY,
+
+  -- The client public key already supplied at pairing, previously used once as
+  -- a sealing target and then discarded.
+  public_key    TEXT NOT NULL,
+
+  -- SHA-256 of the device token, never the token itself: a read of this table
+  -- must not let anyone impersonate a device. Same reasoning as password hashes.
+  token_hash    TEXT NOT NULL UNIQUE,
+
+  -- Client-supplied label ("Ronen's iPhone"). Display only, never trusted for
+  -- authorization.
+  name          TEXT,
+
+  -- JSON array of capability strings. Unknown entries are dropped on read, so a
+  -- downgrade cannot silently grant a capability this build does not understand.
+  capabilities  TEXT NOT NULL,
+
+  created_at    INTEGER NOT NULL,
+  last_seen_at  INTEGER,
+
+  -- Set to revoke. Checked per request rather than cached — a stale cache is
+  -- exactly the window that makes revocation useless.
+  revoked_at    INTEGER
+);
+
+-- Authentication looks a device up by token hash on every request, so this is
+-- the hot path.
+CREATE INDEX IF NOT EXISTS idx_devices_token_hash ON devices (token_hash);

package/dist/migrations/012_create_push_tokens.sql

@@ -0,0 +1,49 @@
+-- Push registration and delivery state (C7 notification reliability).
+--
+-- POST /api/push/register was a no-op returning { ok: true }: mobile registered,
+-- received success, and nothing was stored. No token existed, so no notification
+-- could ever be delivered, no failure could be observed, and the client had no
+-- way to discover that its "successful" registration meant nothing.
+CREATE TABLE IF NOT EXISTS push_tokens (
+  -- The provider push token (Expo). Natural key: re-registering the same token
+  -- must update the existing row rather than accumulate duplicates, which is
+  -- how the same device ends up receiving one notification several times.
+  token             TEXT PRIMARY KEY,
+  platform          TEXT NOT NULL,
+
+  -- Optional device attribution. Nullable because push registration predates
+  -- device identity (C5) and must keep working without it.
+  device_id         TEXT,
+
+  registered_at     INTEGER NOT NULL,
+
+  -- Delivery health. Distinguishing "we have never tried" from "we tried and it
+  -- failed" is the difference between a client showing "not yet delivered" and
+  -- "your notifications are broken" — the report the user actually needs.
+  last_success_at   INTEGER,
+  last_failure_at   INTEGER,
+  last_failure_code TEXT,
+
+  -- Consecutive failures. Reset on success. A token the provider has rejected
+  -- repeatedly is dead (app uninstalled, token rotated) and should stop being
+  -- retried rather than failing forever.
+  failure_streak    INTEGER NOT NULL DEFAULT 0,
+
+  -- Set when the provider tells us the token is permanently invalid, or the
+  -- user unregisters. Retained rather than deleted so the health report can
+  -- explain why delivery stopped.
+  revoked_at        INTEGER
+);
+
+-- Delivery attempts are keyed by event id so a retry, a reconnect
+-- reconciliation, or a duplicate trigger cannot notify the user twice for the
+-- same underlying event.
+CREATE TABLE IF NOT EXISTS push_events (
+  event_id     TEXT PRIMARY KEY,
+  session_id   TEXT,
+  created_at   INTEGER NOT NULL,
+  delivered_at INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_push_tokens_revoked ON push_tokens (revoked_at);
+CREATE INDEX IF NOT EXISTS idx_push_events_created ON push_events (created_at);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadbase-sh/streamer",
-  "version": "1.36.3",
+  "version": "1.37.0",
   "description": "PTY session management, WebSocket streaming, and REST API server for Claude Code conversations",
   "license": "MIT",
   "author": "Ronen Mars",