@threadbase-sh/streamer 1.37.0 → 1.39.0

package/dist/index.d.cts

@@ -81,6 +81,9 @@ interface Logger {
 /** Claude Code `--permission-mode` values, as accepted by CLI v2.1.x. */
 declare const PERMISSION_MODES: readonly ["acceptEdits", "auto", "bypassPermissions", "manual", "dontAsk", "plan"];
 type PermissionMode = (typeof PERMISSION_MODES)[number];
+/** Claude Code `--effort` levels, as accepted by CLI v2.1.x. */
+declare const EFFORT_LEVELS: readonly ["low", "medium", "high", "xhigh", "max"];
+type EffortLevel = (typeof EFFORT_LEVELS)[number];
 type FlagValueType = "boolean" | "string" | "enum" | "list";
 /** How risky enabling a flag is. Drives the client's confirmation UX. */
 type FlagRisk = "low" | "elevated" | "dangerous";
@@ -102,6 +105,17 @@ interface FlagDefinition {
 type ClaudeFlagValue = string | string[] | boolean;
 type ClaudeFlagValues = Record<string, ClaudeFlagValue>;
 
+interface FeatureFlagDefinition {
+    /** Stable config/wire key. Used in server.yaml, on the CLI, and over HTTP. */
+    id: string;
+    /** Shipped to clients alongside the values so a UI can render it. */
+    description: string;
+    default: boolean;
+    /** Full env var name. */
+    env: string;
+}
+type FeatureFlagValues = Record<string, boolean>;
+
 declare const CLAUDE_CODE_PROVIDER: "claude-code";
 declare const CODEX_CLI_PROVIDER: "codex-cli";
 type ProviderName = typeof CLAUDE_CODE_PROVIDER | typeof CODEX_CLI_PROVIDER;
@@ -234,6 +248,7 @@ type WSMessage = {
     type: "terminal_output";
     sessionId: string;
     data: string;
+    seq?: number;
 } | {
     type: "session_update";
     session?: SessionResponse;
@@ -292,6 +307,7 @@ type WSMessage = {
     sessionId: string;
     lines: string[];
     userMessages?: UserMessage[];
+    seq?: number;
 } | {
     type: "session_ready";
     session: SessionResponse;
@@ -482,14 +498,17 @@ interface ServerConfig {
     }>;
     codexRoots?: string[];
     scannerPersistent?: boolean;
+    skipStartupWarmup?: boolean;
     ptyGracePeriodMs?: number;
     cacheDir?: string;
     tailSize?: number;
     directoryScanDebounceMs?: number;
     defaultSystemPrompt?: string;
+    codexSystemPromptEnabled?: boolean;
+    featureFlags?: FeatureFlagValues;
     defaultPermissionMode?: PermissionMode;
     defaultModel?: string;
-    defaultEffort?: "low" | "medium" | "high" | "xhigh" | "max";
+    defaultEffort?: EffortLevel;
     claudeFlags?: ClaudeFlagValues;
     claudeExtraArgs?: string;
 }
@@ -514,7 +533,7 @@ interface StartSessionOptions {
     branch?: string;
     permissionMode?: PermissionMode;
     model?: string;
-    effort?: "low" | "medium" | "high" | "xhigh" | "max";
+    effort?: EffortLevel;
     claudeFlags?: ClaudeFlagValues;
     claudeExtraArgs?: string;
 }
@@ -524,7 +543,7 @@ interface StartFreshSessionOptions {
     systemPrompt?: string;
     permissionMode?: PermissionMode;
     model?: string;
-    effort?: "low" | "medium" | "high" | "xhigh" | "max";
+    effort?: EffortLevel;
     claudeFlags?: ClaudeFlagValues;
     claudeExtraArgs?: string;
 }
@@ -1045,6 +1064,18 @@ declare class ProjectsRepository {
     upsertProjectByPath(rawPath: string, input?: UpsertProjectInput): Project;
 }
 
+/**
+ * Token kinds. A device supplies three non-interchangeable types, and
+ * conflating them fails only at send time with no signal at registration:
+ *
+ * - `expo` — Expo relay token, for ordinary push notifications.
+ * - `liveactivity_start` — ActivityKit push-to-start token. App-wide, one per
+ *   device, long-lived. Starts an activity when none exists.
+ * - `liveactivity_update` — ActivityKit per-activity update token, issued by
+ *   iOS after an activity starts, scoped to that one activity, short-lived.
+ */
+declare const PUSH_TOKEN_KINDS: readonly ["expo", "liveactivity_start", "liveactivity_update"];
+type PushTokenKind = (typeof PUSH_TOKEN_KINDS)[number];
 interface PushTokenRow {
     token: string;
     platform: string;
@@ -1055,6 +1086,13 @@ interface PushTokenRow {
     last_failure_code: string | null;
     failure_streak: number;
     revoked_at: number | null;
+    kind: PushTokenKind;
+    activity_id: string | null;
+    session_id: string | null;
+    expires_at: number | null;
+    stale_date: number | null;
+    started_at: number | null;
+    renewed_at: number | null;
 }
 /**
  * Health as reported to a client. Deliberately omits the token itself — a push
@@ -1071,10 +1109,16 @@ interface PushTokenHealth {
     failureStreak: number;
     revokedAt: number | null;
     /**
-     * Never delivered vs delivering vs failing vs revoked. The distinction the
-     * user actually needs: "not yet" and "broken" look identical without it.
+     * Never delivered vs delivering vs failing vs revoked vs expired. The
+     * distinction the user actually needs: "not yet" and "broken" look identical
+     * without it.
      */
-    state: "never-delivered" | "healthy" | "failing" | "dead" | "revoked";
+    state: "never-delivered" | "healthy" | "failing" | "dead" | "revoked" | "expired";
+    kind: PushTokenKind;
+    /** Present only for per-activity Live Activity tokens. */
+    activityId: string | null;
+    sessionId: string | null;
+    expiresAt: number | null;
 }
 declare class PushRepository {
     private upsertStmt;
@@ -1086,18 +1130,78 @@ declare class PushRepository {
     private revokeStmt;
     private claimEventStmt;
     private markDeliveredStmt;
+    private listByKindSessionStmt;
+    private listByKindStmt;
+    private listRenewableStmt;
+    private claimRenewalStmt;
+    private expireStmt;
+    private expireSessionActivitiesStmt;
     constructor(db: Database.Database);
+    /**
+     * Register or refresh a token.
+     *
+     * `kind` defaults to Expo so a released client posting `{ token, platform }`
+     * keeps working — tb-mobile cannot be force-updated, and every client
+     * predating Live Activities is registering an Expo relay token.
+     *
+     * Several rows per device is normal and intended: a device runs one activity
+     * per live session, each with its own update token. The token itself is the
+     * primary key, so distinct activities never collide.
+     */
     register(args: {
         token: string;
         platform: string;
         deviceId?: string | null;
+        kind?: PushTokenKind;
+        activityId?: string | null;
+        sessionId?: string | null;
+        expiresAt?: number | null;
+        staleDate?: number | null;
+        startedAt?: number | null;
         now?: number;
     }): void;
     get(token: string): PushTokenRow | null;
-    /** Tokens eligible for delivery — not revoked, not past the failure limit. */
+    /**
+     * Expo tokens eligible for delivery — not revoked, not past the failure limit.
+     *
+     * Deliberately Expo-only. ActivityKit tokens go over direct APNs with a
+     * different topic and are rejected by Expo's relay, so the ordinary
+     * notification fan-out must not see them.
+     */
     listDeliverable(): PushTokenRow[];
+    /** Live-activity tokens for one session, eligible for delivery. */
+    listForSession(kind: PushTokenKind, sessionId: string, now?: number): PushTokenRow[];
+    /**
+     * Every deliverable token of one kind.
+     *
+     * Used for push-to-start, which is app-wide rather than session-scoped: the
+     * activity does not exist yet, so there is no per-activity token to look up.
+     */
+    listByKind(kind: PushTokenKind, now?: number): PushTokenRow[];
+    /** Unrenewed activities with a renewal deadline, soonest first. */
+    listRenewable(): PushTokenRow[];
+    /**
+     * Claim a row for renewal.
+     *
+     * Returns true exactly once per row. A restart re-arms timers from the
+     * persisted deadline, so the same renewal can be attempted twice; the loser
+     * gets false and must not send. Doing this as a conditional UPDATE rather
+     * than read-then-write avoids the race where both attempts observe
+     * "not yet renewed".
+     */
+    claimRenewal(token: string, now?: number): boolean;
+    /** Mark one token expired, so it stops being a delivery target. */
+    expire(token: string, now?: number): void;
+    /**
+     * Expire every live activity for a session.
+     *
+     * Called when the session ends. Without this, a per-activity token outlives
+     * its session and a later renewal sweep would resurrect an activity for a
+     * session that is already gone.
+     */
+    expireSessionActivities(sessionId: string, now?: number): void;
     /** Every token, including dead and revoked ones, for the health report. */
-    listHealth(): PushTokenHealth[];
+    listHealth(now?: number): PushTokenHealth[];
     recordSuccess(token: string, now?: number): void;
     recordFailure(token: string, code: string, now?: number): void;
     revoke(token: string, now?: number): boolean;
@@ -1179,6 +1283,7 @@ declare class WSHub {
     private pongTimers;
     addClient(ws: WebSocket): void;
     broadcast(message: WSMessage): void;
+    broadcastToClients(clients: Iterable<WebSocket>, message: WSMessage): void;
     unicast(ws: WebSocket, message: WSMessage): void;
     get connectionCount(): number;
     dispose(): void;
@@ -1288,6 +1393,10 @@ type ApiDeps = {
         extraArgs: string | null;
         persisted: boolean;
     };
+    featureFlagsConfig: () => {
+        registry: readonly FeatureFlagDefinition[];
+        values: FeatureFlagValues;
+    };
     publicUrl: string | null;
     browseRoot: string | null;
     browserCors: string | undefined;
@@ -1316,6 +1425,8 @@ type ApiDeps = {
     handleCancel: (sessionId: string, res: ServerResponse) => void;
     handleStopSession: (sessionId: string, res: ServerResponse) => Promise<void>;
     handleSetSessionName: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleSetSessionModel: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleSetSessionEffort: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleUploadFile: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleAdopt: (sessionId: string, res: ServerResponse) => Promise<void>;
     handleResume: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
@@ -1486,6 +1597,7 @@ declare class StreamerServer {
     private dbPool;
     private dbInstanceId;
     private disableDb;
+    private skipStartupWarmup;
     private browseRoot;
     private publicUrl;
     private browserCors;
@@ -1495,6 +1607,8 @@ declare class StreamerServer {
     private sessionInputAttempts;
     private ptyGracePeriodMs;
     private defaultSystemPrompt;
+    private featureFlags;
+    private codexSystemPromptEnabled;
     private defaultPermissionMode;
     private defaultModel;
     private defaultEffort;
@@ -1505,6 +1619,7 @@ declare class StreamerServer {
     private ptyGraceDeferCounts;
     private sessionSubscribers;
     private lastAgentChunkAt;
+    private terminalSeq;
     private idempotency;
     private sessionLifecycles;
     private idleReaperTimer;
@@ -1520,6 +1635,9 @@ declare class StreamerServer {
     private cacheMetadataRepo;
     private pushRepo;
     private devicesRepo;
+    private apnsClient;
+    private liveActivityNotifier;
+    private liveActivityRenewal;
     private discoveryCache;
     private cacheDir;
     private tailSize;
@@ -1560,6 +1678,17 @@ declare class StreamerServer {
      */
     private withReconciledLifecycle;
     private addSessionSubscriber;
+    /**
+     * Bring up Live Activity push, if credentials are present (Feature 12).
+     *
+     * APNS_KEY absent is the ordinary case on a dev machine and in CI, so this
+     * logs once at info and leaves the feature off rather than failing: the server
+     * must not refuse to boot over a missing optional push credential.
+     *
+     * The key is read from the environment as PEM contents and never from a path
+     * on disk; neither it nor any device token is ever logged.
+     */
+    private initLiveActivityPush;
     /**
      * Classify sessions left behind by previous streamer runs (C1 Phase 3a).
      *
@@ -1643,6 +1772,14 @@ declare class StreamerServer {
     private handlePairStart;
     private handlePairExchange;
     private rotateApiKey;
+    /**
+     * The registry ships with the values so a client renders the list from one
+     * round-trip, same as getClaudeFlagsConfig().
+     *
+     * Deliberately no `persisted` field: unlike claude-flags there is no PUT, and
+     * the absence of that field is the signal that this endpoint is read-only.
+     */
+    private getFeatureFlagsConfig;
     private getClaudeFlagsConfig;
     /**
      * Replace the per-server flag set. Applies to the NEXT spawn — a live PTY
@@ -1656,6 +1793,21 @@ declare class StreamerServer {
      * permission prompts entirely, so it needs a forensic trail.
      */
     private setClaudeFlagsConfig;
+    /**
+     * The three spawn options that a configured claude-flag can override, with
+     * the boot-time CLI/yaml default as the fallback. Spread into every
+     * start/resume/adopt call so all three paths agree.
+     *
+     * These ids are excluded from buildFlagArgs (SPAWN_POSITIONAL_FLAG_IDS)
+     * precisely because they arrive here instead — the PTY spawn paths pass them
+     * as explicit positionals, so emitting them from the allowlist too would
+     * duplicate the flag.
+     *
+     * Narrowed with the type guards rather than cast: ClaudeFlagValues is a loose
+     * Record by design, and while validateFlagValues already guarantees the shape
+     * on the way in, TypeScript cannot see that through the record.
+     */
+    private spawnFlagOverrides;
     private checkRateLimit;
     private checkExchangeRateLimit;
     private checkSessionStartRateLimit;
@@ -1776,6 +1928,21 @@ declare class StreamerServer {
     private handleBrowse;
     private handleMkdir;
     private handleSetSessionName;
+    /**
+     * Retarget a LIVE session's model or effort by typing the corresponding
+     * Claude Code slash command into its PTY.
+     *
+     * There is no CLI or IPC channel for this — `--model`/`--effort` are spawn
+     * arguments — so the interactive `/model <x>` / `/effort <y>` commands are the
+     * only way to change a session already running. Both accept an argument and
+     * apply it without opening the picker (verified against Claude Code v2.1.220).
+     *
+     * Answers 202, not 200: the value is applied by the TUI on its next render, so
+     * there is nothing truthful to echo back synchronously. Clients confirm with
+     * `GET /api/sessions/:id`, which scrapes the applied value off the live status
+     * line.
+     */
+    private applyLiveSessionSetting;
     private handleGetSessionNames;
 }
 

package/dist/index.d.ts

@@ -81,6 +81,9 @@ interface Logger {
 /** Claude Code `--permission-mode` values, as accepted by CLI v2.1.x. */
 declare const PERMISSION_MODES: readonly ["acceptEdits", "auto", "bypassPermissions", "manual", "dontAsk", "plan"];
 type PermissionMode = (typeof PERMISSION_MODES)[number];
+/** Claude Code `--effort` levels, as accepted by CLI v2.1.x. */
+declare const EFFORT_LEVELS: readonly ["low", "medium", "high", "xhigh", "max"];
+type EffortLevel = (typeof EFFORT_LEVELS)[number];
 type FlagValueType = "boolean" | "string" | "enum" | "list";
 /** How risky enabling a flag is. Drives the client's confirmation UX. */
 type FlagRisk = "low" | "elevated" | "dangerous";
@@ -102,6 +105,17 @@ interface FlagDefinition {
 type ClaudeFlagValue = string | string[] | boolean;
 type ClaudeFlagValues = Record<string, ClaudeFlagValue>;
 
+interface FeatureFlagDefinition {
+    /** Stable config/wire key. Used in server.yaml, on the CLI, and over HTTP. */
+    id: string;
+    /** Shipped to clients alongside the values so a UI can render it. */
+    description: string;
+    default: boolean;
+    /** Full env var name. */
+    env: string;
+}
+type FeatureFlagValues = Record<string, boolean>;
+
 declare const CLAUDE_CODE_PROVIDER: "claude-code";
 declare const CODEX_CLI_PROVIDER: "codex-cli";
 type ProviderName = typeof CLAUDE_CODE_PROVIDER | typeof CODEX_CLI_PROVIDER;
@@ -234,6 +248,7 @@ type WSMessage = {
     type: "terminal_output";
     sessionId: string;
     data: string;
+    seq?: number;
 } | {
     type: "session_update";
     session?: SessionResponse;
@@ -292,6 +307,7 @@ type WSMessage = {
     sessionId: string;
     lines: string[];
     userMessages?: UserMessage[];
+    seq?: number;
 } | {
     type: "session_ready";
     session: SessionResponse;
@@ -482,14 +498,17 @@ interface ServerConfig {
     }>;
     codexRoots?: string[];
     scannerPersistent?: boolean;
+    skipStartupWarmup?: boolean;
     ptyGracePeriodMs?: number;
     cacheDir?: string;
     tailSize?: number;
     directoryScanDebounceMs?: number;
     defaultSystemPrompt?: string;
+    codexSystemPromptEnabled?: boolean;
+    featureFlags?: FeatureFlagValues;
     defaultPermissionMode?: PermissionMode;
     defaultModel?: string;
-    defaultEffort?: "low" | "medium" | "high" | "xhigh" | "max";
+    defaultEffort?: EffortLevel;
     claudeFlags?: ClaudeFlagValues;
     claudeExtraArgs?: string;
 }
@@ -514,7 +533,7 @@ interface StartSessionOptions {
     branch?: string;
     permissionMode?: PermissionMode;
     model?: string;
-    effort?: "low" | "medium" | "high" | "xhigh" | "max";
+    effort?: EffortLevel;
     claudeFlags?: ClaudeFlagValues;
     claudeExtraArgs?: string;
 }
@@ -524,7 +543,7 @@ interface StartFreshSessionOptions {
     systemPrompt?: string;
     permissionMode?: PermissionMode;
     model?: string;
-    effort?: "low" | "medium" | "high" | "xhigh" | "max";
+    effort?: EffortLevel;
     claudeFlags?: ClaudeFlagValues;
     claudeExtraArgs?: string;
 }
@@ -1045,6 +1064,18 @@ declare class ProjectsRepository {
     upsertProjectByPath(rawPath: string, input?: UpsertProjectInput): Project;
 }
 
+/**
+ * Token kinds. A device supplies three non-interchangeable types, and
+ * conflating them fails only at send time with no signal at registration:
+ *
+ * - `expo` — Expo relay token, for ordinary push notifications.
+ * - `liveactivity_start` — ActivityKit push-to-start token. App-wide, one per
+ *   device, long-lived. Starts an activity when none exists.
+ * - `liveactivity_update` — ActivityKit per-activity update token, issued by
+ *   iOS after an activity starts, scoped to that one activity, short-lived.
+ */
+declare const PUSH_TOKEN_KINDS: readonly ["expo", "liveactivity_start", "liveactivity_update"];
+type PushTokenKind = (typeof PUSH_TOKEN_KINDS)[number];
 interface PushTokenRow {
     token: string;
     platform: string;
@@ -1055,6 +1086,13 @@ interface PushTokenRow {
     last_failure_code: string | null;
     failure_streak: number;
     revoked_at: number | null;
+    kind: PushTokenKind;
+    activity_id: string | null;
+    session_id: string | null;
+    expires_at: number | null;
+    stale_date: number | null;
+    started_at: number | null;
+    renewed_at: number | null;
 }
 /**
  * Health as reported to a client. Deliberately omits the token itself — a push
@@ -1071,10 +1109,16 @@ interface PushTokenHealth {
     failureStreak: number;
     revokedAt: number | null;
     /**
-     * Never delivered vs delivering vs failing vs revoked. The distinction the
-     * user actually needs: "not yet" and "broken" look identical without it.
+     * Never delivered vs delivering vs failing vs revoked vs expired. The
+     * distinction the user actually needs: "not yet" and "broken" look identical
+     * without it.
      */
-    state: "never-delivered" | "healthy" | "failing" | "dead" | "revoked";
+    state: "never-delivered" | "healthy" | "failing" | "dead" | "revoked" | "expired";
+    kind: PushTokenKind;
+    /** Present only for per-activity Live Activity tokens. */
+    activityId: string | null;
+    sessionId: string | null;
+    expiresAt: number | null;
 }
 declare class PushRepository {
     private upsertStmt;
@@ -1086,18 +1130,78 @@ declare class PushRepository {
     private revokeStmt;
     private claimEventStmt;
     private markDeliveredStmt;
+    private listByKindSessionStmt;
+    private listByKindStmt;
+    private listRenewableStmt;
+    private claimRenewalStmt;
+    private expireStmt;
+    private expireSessionActivitiesStmt;
     constructor(db: Database.Database);
+    /**
+     * Register or refresh a token.
+     *
+     * `kind` defaults to Expo so a released client posting `{ token, platform }`
+     * keeps working — tb-mobile cannot be force-updated, and every client
+     * predating Live Activities is registering an Expo relay token.
+     *
+     * Several rows per device is normal and intended: a device runs one activity
+     * per live session, each with its own update token. The token itself is the
+     * primary key, so distinct activities never collide.
+     */
     register(args: {
         token: string;
         platform: string;
         deviceId?: string | null;
+        kind?: PushTokenKind;
+        activityId?: string | null;
+        sessionId?: string | null;
+        expiresAt?: number | null;
+        staleDate?: number | null;
+        startedAt?: number | null;
         now?: number;
     }): void;
     get(token: string): PushTokenRow | null;
-    /** Tokens eligible for delivery — not revoked, not past the failure limit. */
+    /**
+     * Expo tokens eligible for delivery — not revoked, not past the failure limit.
+     *
+     * Deliberately Expo-only. ActivityKit tokens go over direct APNs with a
+     * different topic and are rejected by Expo's relay, so the ordinary
+     * notification fan-out must not see them.
+     */
     listDeliverable(): PushTokenRow[];
+    /** Live-activity tokens for one session, eligible for delivery. */
+    listForSession(kind: PushTokenKind, sessionId: string, now?: number): PushTokenRow[];
+    /**
+     * Every deliverable token of one kind.
+     *
+     * Used for push-to-start, which is app-wide rather than session-scoped: the
+     * activity does not exist yet, so there is no per-activity token to look up.
+     */
+    listByKind(kind: PushTokenKind, now?: number): PushTokenRow[];
+    /** Unrenewed activities with a renewal deadline, soonest first. */
+    listRenewable(): PushTokenRow[];
+    /**
+     * Claim a row for renewal.
+     *
+     * Returns true exactly once per row. A restart re-arms timers from the
+     * persisted deadline, so the same renewal can be attempted twice; the loser
+     * gets false and must not send. Doing this as a conditional UPDATE rather
+     * than read-then-write avoids the race where both attempts observe
+     * "not yet renewed".
+     */
+    claimRenewal(token: string, now?: number): boolean;
+    /** Mark one token expired, so it stops being a delivery target. */
+    expire(token: string, now?: number): void;
+    /**
+     * Expire every live activity for a session.
+     *
+     * Called when the session ends. Without this, a per-activity token outlives
+     * its session and a later renewal sweep would resurrect an activity for a
+     * session that is already gone.
+     */
+    expireSessionActivities(sessionId: string, now?: number): void;
     /** Every token, including dead and revoked ones, for the health report. */
-    listHealth(): PushTokenHealth[];
+    listHealth(now?: number): PushTokenHealth[];
     recordSuccess(token: string, now?: number): void;
     recordFailure(token: string, code: string, now?: number): void;
     revoke(token: string, now?: number): boolean;
@@ -1179,6 +1283,7 @@ declare class WSHub {
     private pongTimers;
     addClient(ws: WebSocket): void;
     broadcast(message: WSMessage): void;
+    broadcastToClients(clients: Iterable<WebSocket>, message: WSMessage): void;
     unicast(ws: WebSocket, message: WSMessage): void;
     get connectionCount(): number;
     dispose(): void;
@@ -1288,6 +1393,10 @@ type ApiDeps = {
         extraArgs: string | null;
         persisted: boolean;
     };
+    featureFlagsConfig: () => {
+        registry: readonly FeatureFlagDefinition[];
+        values: FeatureFlagValues;
+    };
     publicUrl: string | null;
     browseRoot: string | null;
     browserCors: string | undefined;
@@ -1316,6 +1425,8 @@ type ApiDeps = {
     handleCancel: (sessionId: string, res: ServerResponse) => void;
     handleStopSession: (sessionId: string, res: ServerResponse) => Promise<void>;
     handleSetSessionName: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleSetSessionModel: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleSetSessionEffort: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleUploadFile: (sessionId: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleAdopt: (sessionId: string, res: ServerResponse) => Promise<void>;
     handleResume: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
@@ -1486,6 +1597,7 @@ declare class StreamerServer {
     private dbPool;
     private dbInstanceId;
     private disableDb;
+    private skipStartupWarmup;
     private browseRoot;
     private publicUrl;
     private browserCors;
@@ -1495,6 +1607,8 @@ declare class StreamerServer {
     private sessionInputAttempts;
     private ptyGracePeriodMs;
     private defaultSystemPrompt;
+    private featureFlags;
+    private codexSystemPromptEnabled;
     private defaultPermissionMode;
     private defaultModel;
     private defaultEffort;
@@ -1505,6 +1619,7 @@ declare class StreamerServer {
     private ptyGraceDeferCounts;
     private sessionSubscribers;
     private lastAgentChunkAt;
+    private terminalSeq;
     private idempotency;
     private sessionLifecycles;
     private idleReaperTimer;
@@ -1520,6 +1635,9 @@ declare class StreamerServer {
     private cacheMetadataRepo;
     private pushRepo;
     private devicesRepo;
+    private apnsClient;
+    private liveActivityNotifier;
+    private liveActivityRenewal;
     private discoveryCache;
     private cacheDir;
     private tailSize;
@@ -1560,6 +1678,17 @@ declare class StreamerServer {
      */
     private withReconciledLifecycle;
     private addSessionSubscriber;
+    /**
+     * Bring up Live Activity push, if credentials are present (Feature 12).
+     *
+     * APNS_KEY absent is the ordinary case on a dev machine and in CI, so this
+     * logs once at info and leaves the feature off rather than failing: the server
+     * must not refuse to boot over a missing optional push credential.
+     *
+     * The key is read from the environment as PEM contents and never from a path
+     * on disk; neither it nor any device token is ever logged.
+     */
+    private initLiveActivityPush;
     /**
      * Classify sessions left behind by previous streamer runs (C1 Phase 3a).
      *
@@ -1643,6 +1772,14 @@ declare class StreamerServer {
     private handlePairStart;
     private handlePairExchange;
     private rotateApiKey;
+    /**
+     * The registry ships with the values so a client renders the list from one
+     * round-trip, same as getClaudeFlagsConfig().
+     *
+     * Deliberately no `persisted` field: unlike claude-flags there is no PUT, and
+     * the absence of that field is the signal that this endpoint is read-only.
+     */
+    private getFeatureFlagsConfig;
     private getClaudeFlagsConfig;
     /**
      * Replace the per-server flag set. Applies to the NEXT spawn — a live PTY
@@ -1656,6 +1793,21 @@ declare class StreamerServer {
      * permission prompts entirely, so it needs a forensic trail.
      */
     private setClaudeFlagsConfig;
+    /**
+     * The three spawn options that a configured claude-flag can override, with
+     * the boot-time CLI/yaml default as the fallback. Spread into every
+     * start/resume/adopt call so all three paths agree.
+     *
+     * These ids are excluded from buildFlagArgs (SPAWN_POSITIONAL_FLAG_IDS)
+     * precisely because they arrive here instead — the PTY spawn paths pass them
+     * as explicit positionals, so emitting them from the allowlist too would
+     * duplicate the flag.
+     *
+     * Narrowed with the type guards rather than cast: ClaudeFlagValues is a loose
+     * Record by design, and while validateFlagValues already guarantees the shape
+     * on the way in, TypeScript cannot see that through the record.
+     */
+    private spawnFlagOverrides;
     private checkRateLimit;
     private checkExchangeRateLimit;
     private checkSessionStartRateLimit;
@@ -1776,6 +1928,21 @@ declare class StreamerServer {
     private handleBrowse;
     private handleMkdir;
     private handleSetSessionName;
+    /**
+     * Retarget a LIVE session's model or effort by typing the corresponding
+     * Claude Code slash command into its PTY.
+     *
+     * There is no CLI or IPC channel for this — `--model`/`--effort` are spawn
+     * arguments — so the interactive `/model <x>` / `/effort <y>` commands are the
+     * only way to change a session already running. Both accept an argument and
+     * apply it without opening the picker (verified against Claude Code v2.1.220).
+     *
+     * Answers 202, not 200: the value is applied by the TUI on its next render, so
+     * there is nothing truthful to echo back synchronously. Clients confirm with
+     * `GET /api/sessions/:id`, which scrapes the applied value off the live status
+     * line.
+     */
+    private applyLiveSessionSetting;
     private handleGetSessionNames;
 }