@threadbase-sh/streamer 1.36.4 → 1.38.0

package/dist/migrations/010_create_managed_sessions.sql

@@ -0,0 +1,65 @@
+-- Managed-session registry (durable session runtime, C1 Phase 2).
+-- See docs/architecture/2026-07-24-durable-session-runtime.md.
+--
+-- Until now managed session state lived only in SessionStore's in-memory Maps,
+-- so a streamer restart lost startedAt, promptCount, sessionName, projectId,
+-- the Codex placeholder→rollout binding, and failureReason outright. Sessions
+-- did not come back as "recoverable" — they ceased to exist, reappearing at
+-- best as external discovered processes with no managed metadata.
+--
+-- This table stores identity and provenance so the boot reconciler can say what
+-- happened to each session. It deliberately does NOT store the byte stream:
+-- outputBuffer is 64KiB of raw ANSI rewritten on every PTY chunk, and its
+-- authoritative copy is already the provider's JSONL. Persisting it would turn
+-- every chunk into a DB write to duplicate data we can re-read. Post-restart
+-- replay is therefore conversation-accurate, not byte-accurate.
+CREATE TABLE IF NOT EXISTS managed_sessions (
+  -- Provider-native resume identifier: the JSONL UUID for Claude Code, the
+  -- rollout id for Codex. This is what --resume / `codex resume` consumes, so
+  -- the registry never invents an identifier of its own.
+  session_id            TEXT PRIMARY KEY,
+  provider              TEXT    NOT NULL,
+
+  -- Liveness probing. pid alone is never treated as identity: PIDs get reused,
+  -- so the reconciler matches the recorded cmdline before claiming a live
+  -- process is ours, and reports `orphaned` on a mismatch rather than guessing.
+  pid                   INTEGER,
+  cmdline               TEXT,
+
+  project_path          TEXT    NOT NULL,
+  project_name          TEXT    NOT NULL,
+  branch                TEXT    NOT NULL DEFAULT '',
+
+  -- Semantic status (running/waiting_input/idle) as last observed. The
+  -- reconciler never trusts this over a live PID probe — a SIGKILLed streamer
+  -- never ran its exit writes, so a stored 'running' can be arbitrarily stale.
+  -- status_source records how the value was obtained so that staleness is
+  -- visible instead of implied.
+  status                TEXT    NOT NULL,
+  status_source         TEXT    NOT NULL,
+  status_updated_at     INTEGER NOT NULL,
+
+  started_at            INTEGER NOT NULL,
+  completed_at          INTEGER,
+  last_activity_at      INTEGER,
+  prompt_count          INTEGER NOT NULL DEFAULT 0,
+
+  -- User-visible identity that today vanishes silently on restart.
+  session_name          TEXT,
+  project_id            TEXT,
+  -- Codex two-id model: the placeholder id the session was created under vs the
+  -- rollout id its history is indexed by. Losing this on restart orphans the
+  -- conversation from the session (types.ts:36-44).
+  bound_conversation_id TEXT,
+  resumed_from_conversation_id TEXT,
+  failure_reason        TEXT,
+
+  -- Which streamer run started this session. A row whose instance differs from
+  -- the current run is the orphan test: the process outlived its streamer.
+  streamer_instance_id  TEXT    NOT NULL
+);
+
+-- The reconciler's only read path on boot: every row not already in a terminal
+-- state. Terminal rows are retained for history but never re-probed.
+CREATE INDEX IF NOT EXISTS idx_managed_sessions_status
+  ON managed_sessions (status);

package/dist/migrations/011_create_devices.sql

@@ -0,0 +1,39 @@
+-- Paired-device registry (C5 scoped device capabilities).
+-- See docs/architecture/2026-07-24-device-identity-and-capabilities.md.
+--
+-- Pairing exchanged a short-lived token for the streamer's API key — the SAME
+-- string for every device that ever paired. Nothing recorded that a device
+-- existed, so there was no attribution, no per-device revocation (rotating the
+-- key de-authenticated everyone at once), and no way to scope authority.
+CREATE TABLE IF NOT EXISTS devices (
+  -- Minted server-side. A client-supplied id would let one device claim
+  -- another's identity.
+  device_id     TEXT PRIMARY KEY,
+
+  -- The client public key already supplied at pairing, previously used once as
+  -- a sealing target and then discarded.
+  public_key    TEXT NOT NULL,
+
+  -- SHA-256 of the device token, never the token itself: a read of this table
+  -- must not let anyone impersonate a device. Same reasoning as password hashes.
+  token_hash    TEXT NOT NULL UNIQUE,
+
+  -- Client-supplied label ("Ronen's iPhone"). Display only, never trusted for
+  -- authorization.
+  name          TEXT,
+
+  -- JSON array of capability strings. Unknown entries are dropped on read, so a
+  -- downgrade cannot silently grant a capability this build does not understand.
+  capabilities  TEXT NOT NULL,
+
+  created_at    INTEGER NOT NULL,
+  last_seen_at  INTEGER,
+
+  -- Set to revoke. Checked per request rather than cached — a stale cache is
+  -- exactly the window that makes revocation useless.
+  revoked_at    INTEGER
+);
+
+-- Authentication looks a device up by token hash on every request, so this is
+-- the hot path.
+CREATE INDEX IF NOT EXISTS idx_devices_token_hash ON devices (token_hash);

package/dist/migrations/012_create_push_tokens.sql

@@ -0,0 +1,49 @@
+-- Push registration and delivery state (C7 notification reliability).
+--
+-- POST /api/push/register was a no-op returning { ok: true }: mobile registered,
+-- received success, and nothing was stored. No token existed, so no notification
+-- could ever be delivered, no failure could be observed, and the client had no
+-- way to discover that its "successful" registration meant nothing.
+CREATE TABLE IF NOT EXISTS push_tokens (
+  -- The provider push token (Expo). Natural key: re-registering the same token
+  -- must update the existing row rather than accumulate duplicates, which is
+  -- how the same device ends up receiving one notification several times.
+  token             TEXT PRIMARY KEY,
+  platform          TEXT NOT NULL,
+
+  -- Optional device attribution. Nullable because push registration predates
+  -- device identity (C5) and must keep working without it.
+  device_id         TEXT,
+
+  registered_at     INTEGER NOT NULL,
+
+  -- Delivery health. Distinguishing "we have never tried" from "we tried and it
+  -- failed" is the difference between a client showing "not yet delivered" and
+  -- "your notifications are broken" — the report the user actually needs.
+  last_success_at   INTEGER,
+  last_failure_at   INTEGER,
+  last_failure_code TEXT,
+
+  -- Consecutive failures. Reset on success. A token the provider has rejected
+  -- repeatedly is dead (app uninstalled, token rotated) and should stop being
+  -- retried rather than failing forever.
+  failure_streak    INTEGER NOT NULL DEFAULT 0,
+
+  -- Set when the provider tells us the token is permanently invalid, or the
+  -- user unregisters. Retained rather than deleted so the health report can
+  -- explain why delivery stopped.
+  revoked_at        INTEGER
+);
+
+-- Delivery attempts are keyed by event id so a retry, a reconnect
+-- reconciliation, or a duplicate trigger cannot notify the user twice for the
+-- same underlying event.
+CREATE TABLE IF NOT EXISTS push_events (
+  event_id     TEXT PRIMARY KEY,
+  session_id   TEXT,
+  created_at   INTEGER NOT NULL,
+  delivered_at INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_push_tokens_revoked ON push_tokens (revoked_at);
+CREATE INDEX IF NOT EXISTS idx_push_events_created ON push_events (created_at);

package/dist/migrations/013_add_push_token_kind.sql

@@ -0,0 +1,63 @@
+-- Push token kinds, for iOS Live Activities (Feature 12 phase 1b).
+--
+-- push_tokens (012) modelled exactly one token per device: the Expo relay token
+-- used for ordinary notifications. A device now supplies three distinct token
+-- types, and they are NOT interchangeable:
+--
+--   expo             — Expo relay token. Ordinary push notifications.
+--   liveactivity_start — ActivityKit push-to-start token. App-wide, one per
+--                      device, long-lived. Starts an activity when none exists.
+--   liveactivity_update — ActivityKit per-activity update token. Issued by iOS
+--                      AFTER an activity starts, scoped to that one activity,
+--                      and short-lived.
+--
+-- Conflating them silently breaks delivery: an ActivityKit token posted to
+-- Expo's relay is rejected, and an Expo token used to sign a
+-- `.push-type.liveactivity` topic is rejected by APNs. Neither failure is
+-- visible at registration time, which is exactly why kind is stored explicitly
+-- rather than inferred from token shape.
+ALTER TABLE push_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'expo';
+
+-- The ActivityKit activity this token updates, for kind =
+-- 'liveactivity_update' only. A device runs several activities at once (one per
+-- live session), so device_id alone cannot identify which row to update or end
+-- — the reason 012's one-row-per-device shape does not stretch to cover this.
+ALTER TABLE push_tokens ADD COLUMN activity_id TEXT;
+
+-- The session this activity is rendering. Sending is driven by session
+-- lifecycle transitions, so the send path looks tokens up by session, not by
+-- device.
+ALTER TABLE push_tokens ADD COLUMN session_id TEXT;
+
+-- Per-activity tokens expire. Retained rather than deleted (matching
+-- revoked_at's reasoning in 012) so the health report can say "expired"
+-- instead of the row simply vanishing.
+ALTER TABLE push_tokens ADD COLUMN expires_at INTEGER;
+
+-- iOS ends a Live Activity ~8h after it starts, so a long session must be
+-- renewed before the cap. Stored per activity rather than derived at read time:
+-- a renewal must survive a restart, and re-arming timers on boot needs a
+-- persisted deadline to read (an in-process timer does not survive).
+ALTER TABLE push_tokens ADD COLUMN stale_date INTEGER;
+
+-- The activity's ORIGINAL start, carried unchanged across every renewal.
+-- iOS renders its own ticking elapsed timer from this value, so a renewal that
+-- stamps a fresh start visibly resets the user's timer to zero. Persisting the
+-- original is what makes elapsed time continuous across a renewal.
+ALTER TABLE push_tokens ADD COLUMN started_at INTEGER;
+
+-- Set once a renewal has been performed for this row, making renewal
+-- idempotent: a restart mid-window re-arms the timer, and this column is what
+-- stops the re-armed timer from sending a second time.
+ALTER TABLE push_tokens ADD COLUMN renewed_at INTEGER;
+
+-- The send path selects by (kind, session) — driven by a session status change,
+-- never by scanning every token.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_kind_session ON push_tokens (kind, session_id);
+
+-- The renewal scheduler scans for activities approaching their cap. Partial
+-- index: only unrenewed rows with a deadline are ever candidates, which keeps
+-- the boot-time re-arm scan proportional to pending renewals rather than to
+-- every token ever registered.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_stale_date ON push_tokens (stale_date)
+  WHERE stale_date IS NOT NULL AND renewed_at IS NULL;

package/dist/pg-migrations/007_create_push_tokens.sql

@@ -0,0 +1,93 @@
+-- Push registration and delivery state, mirroring SQLite migrations 012 + 013.
+--
+-- SQLite is the primary persistence layer; Postgres is dormant (see CLAUDE.md).
+-- The two schemas are kept in sync so enabling Postgres later does not require
+-- reconstructing history. SQLite reached this shape in two steps (012 created
+-- the table, 013 added the kind columns); Postgres never had 012, so this
+-- single migration creates the end state directly.
+CREATE TABLE IF NOT EXISTS push_tokens (
+  -- The provider push token. Natural key: re-registering the same token must
+  -- update the existing row rather than accumulate duplicates, which is how one
+  -- device ends up receiving the same notification several times.
+  token             TEXT PRIMARY KEY,
+  platform          TEXT NOT NULL,
+
+  -- Optional device attribution. Nullable because push registration predates
+  -- device identity (C5) and must keep working without it.
+  device_id         TEXT,
+
+  registered_at     BIGINT NOT NULL,
+
+  -- Delivery health. Distinguishing "never tried" from "tried and failed" is
+  -- the difference between "not yet delivered" and "your notifications are
+  -- broken" — the report the user actually needs.
+  last_success_at   BIGINT,
+  last_failure_at   BIGINT,
+  last_failure_code TEXT,
+
+  -- Consecutive failures, reset on success. A token the provider has rejected
+  -- repeatedly is dead (app uninstalled, token rotated) and should stop being
+  -- retried rather than failing forever.
+  failure_streak    INTEGER NOT NULL DEFAULT 0,
+
+  -- Set when the provider reports the token permanently invalid, or the user
+  -- unregisters. Retained rather than deleted so the health report can explain
+  -- why delivery stopped.
+  revoked_at        BIGINT,
+
+  -- Token kind. A device supplies three non-interchangeable types: the Expo
+  -- relay token, the ActivityKit push-to-start token (app-wide), and an
+  -- ActivityKit per-activity update token (short-lived, issued after an
+  -- activity starts). Stored explicitly rather than inferred from token shape,
+  -- because a mismatch is rejected by the provider at send time with no signal
+  -- at registration time.
+  kind              TEXT NOT NULL DEFAULT 'expo',
+
+  -- The ActivityKit activity this token updates (kind =
+  -- 'liveactivity_update'). A device runs several activities at once, one per
+  -- live session, so device_id alone cannot identify which row to update.
+  activity_id       TEXT,
+
+  -- The session this activity renders. Sending is driven by session lifecycle
+  -- transitions, so the send path looks up by session rather than by device.
+  session_id        TEXT,
+
+  -- Per-activity tokens expire. Retained rather than deleted so health can
+  -- report "expired" instead of the row vanishing.
+  expires_at        BIGINT,
+
+  -- iOS ends a Live Activity ~8h after it starts. Persisted per activity
+  -- because a renewal must survive a restart: re-arming timers on boot needs a
+  -- durable deadline to read.
+  stale_date        BIGINT,
+
+  -- The activity's ORIGINAL start, carried unchanged across every renewal. iOS
+  -- renders its own ticking timer from this, so a renewal stamping a fresh
+  -- start visibly resets the user's elapsed time to zero.
+  started_at        BIGINT,
+
+  -- Set once this row has been renewed, making renewal idempotent: a restart
+  -- mid-window re-arms the timer, and this is what stops a second send.
+  renewed_at        BIGINT
+);
+
+-- Delivery attempts keyed by event id so a retry, a reconnect reconciliation,
+-- or a duplicate trigger cannot notify the user twice for one event.
+CREATE TABLE IF NOT EXISTS push_events (
+  event_id     TEXT PRIMARY KEY,
+  session_id   TEXT,
+  created_at   BIGINT NOT NULL,
+  delivered_at BIGINT
+);
+
+CREATE INDEX IF NOT EXISTS idx_push_tokens_revoked ON push_tokens (revoked_at);
+CREATE INDEX IF NOT EXISTS idx_push_events_created ON push_events (created_at);
+
+-- The send path selects by (kind, session), driven by a status change rather
+-- than by scanning every token.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_kind_session ON push_tokens (kind, session_id);
+
+-- Renewal candidates only. Partial index keeps the boot-time re-arm scan
+-- proportional to pending renewals, not to every token ever registered.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_stale_date ON push_tokens (stale_date)
+  WHERE stale_date IS NOT NULL AND renewed_at IS NULL;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadbase-sh/streamer",
-  "version": "1.36.4",
+  "version": "1.38.0",
   "description": "PTY session management, WebSocket streaming, and REST API server for Claude Code conversations",
   "license": "MIT",
   "author": "Ronen Mars",