@threadbase-sh/streamer 1.48.0 → 1.50.0

package/dist/cli.cjs

@@ -1490,6 +1490,10 @@ function isPermissionMode(value) {
 function isDangerousPermissionMode(mode) {
   return DANGEROUS_PERMISSION_MODES.includes(mode);
 }
+function effectivePermissionMode(flags, fallback) {
+  const candidate = flags?.permissionMode ?? fallback;
+  return isPermissionMode(candidate) ? candidate : void 0;
+}
 function isEffortLevel(value) {
   return typeof value === "string" && EFFORT_LEVELS.includes(value);
 }
@@ -142369,7 +142373,7 @@ function createLogsRoutes() {
 
 // src/api/routes/misc.routes.ts
 var import_node_child_process2 = require("child_process");
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var import_os7 = require("os");
 
 // src/db/repositories/push.repository.ts
@@ -142628,6 +142632,170 @@ var PushRepository = class {
 
 // src/api/routes/misc.routes.ts
 init_logger();
+
+// src/services/push/apnsClient.ts
+var import_node_crypto = require("crypto");
+var import_node_http2 = require("http2");
+init_logger();
+var log3 = getLogger("apns");
+var APNS_HOST_SANDBOX = "api.sandbox.push.apple.com";
+var APNS_MAX_PAYLOAD_BYTES = 4096;
+var JWT_TTL_SECONDS = 3e3;
+var DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set([
+  "BadDeviceToken",
+  "DeviceTokenNotForTopic",
+  "Unregistered",
+  "ExpiredToken"
+]);
+function base64url3(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function readApnsCredentialsFromEnv(env = process.env) {
+  const key = env.APNS_KEY;
+  if (!key || key.trim().length === 0) return null;
+  const keyId = env.APNS_KEY_ID?.trim();
+  const teamId = env.APNS_TEAM_ID?.trim();
+  const bundleId = env.APNS_BUNDLE_ID?.trim();
+  if (!keyId || !teamId || !bundleId) return null;
+  const host = env.APNS_HOST ?? APNS_HOST_SANDBOX;
+  return { key, keyId, teamId, bundleId, host };
+}
+function describeMissingApnsCredentials(env = process.env) {
+  if (!env.APNS_KEY || env.APNS_KEY.trim().length === 0) {
+    return "APNS_KEY is not set, so Live Activity push is disabled. Set it to the p8 key contents (not a path) to enable it.";
+  }
+  const missing = [
+    ["APNS_KEY_ID", env.APNS_KEY_ID],
+    ["APNS_TEAM_ID", env.APNS_TEAM_ID],
+    ["APNS_BUNDLE_ID", env.APNS_BUNDLE_ID]
+  ].filter(([, value]) => !value || value.trim().length === 0).map(([name]) => name);
+  if (missing.length === 0) return null;
+  return `APNS_KEY is set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not, so Live Activity push is disabled. Under launchd, APNS_KEY_ID is derived from the AuthKey_<keyId>.p8 filename; the team and bundle ids must be set explicitly.`;
+}
+var ApnsClient = class {
+  constructor(creds) {
+    this.creds = creds;
+  }
+  creds;
+  session = null;
+  cachedJwt = null;
+  /**
+   * The `apns-topic` for Live Activity pushes.
+   *
+   * The `.push-type.liveactivity` suffix is mandatory and is why the signing key
+   * must be Team Scoped (All Topics) — a key scoped to the bundle id alone
+   * cannot sign this topic.
+   */
+  get topic() {
+    return `${this.creds.bundleId}.push-type.liveactivity`;
+  }
+  /**
+   * Mint or reuse the provider JWT.
+   *
+   * ES256 over the p8 key. Cached until shortly before expiry: Apple rejects a
+   * token older than an hour, but minting one per request is wasteful and can
+   * trip APNs' provider-token-update throttle.
+   */
+  getJwt(now = Date.now()) {
+    const nowSeconds = Math.floor(now / 1e3);
+    if (this.cachedJwt && this.cachedJwt.expiresAt > nowSeconds + 60) {
+      return this.cachedJwt.token;
+    }
+    const header = base64url3(JSON.stringify({ alg: "ES256", kid: this.creds.keyId, typ: "JWT" }));
+    const payload = base64url3(JSON.stringify({ iss: this.creds.teamId, iat: nowSeconds }));
+    const signingInput = `${header}.${payload}`;
+    const signature = (0, import_node_crypto.createSign)("SHA256").update(signingInput).sign({ key: this.creds.key, dsaEncoding: "ieee-p1363" });
+    const token = `${signingInput}.${base64url3(signature)}`;
+    this.cachedJwt = { token, expiresAt: nowSeconds + JWT_TTL_SECONDS };
+    return token;
+  }
+  /**
+   * Reuse one HTTP/2 session across sends.
+   *
+   * APNs expects a long-lived connection; a fresh TLS handshake per push is slow
+   * and Apple treats connection churn as abuse.
+   */
+  getSession() {
+    if (this.session && !this.session.closed && !this.session.destroyed) {
+      return this.session;
+    }
+    const session = (0, import_node_http2.connect)(`https://${this.creds.host}`);
+    session.on("error", (err) => {
+      log3.warn("apns.session_error", { event: "apns.session_error", err: String(err) });
+    });
+    this.session = session;
+    return session;
+  }
+  /**
+   * Send one push.
+   *
+   * Resolves with a result rather than rejecting on an APNs rejection: a
+   * rejected push is an expected outcome the caller must act on (retire the
+   * token), not an exception. Only a genuinely unexpected local failure throws,
+   * and the caller logs it.
+   */
+  async send(args) {
+    const body = Buffer.from(JSON.stringify(args.payload), "utf-8");
+    if (body.byteLength > APNS_MAX_PAYLOAD_BYTES) {
+      throw new Error(
+        `APNs payload is ${body.byteLength} bytes, over the ${APNS_MAX_PAYLOAD_BYTES} byte limit`
+      );
+    }
+    const session = this.getSession();
+    const headers = {
+      [import_node_http2.constants.HTTP2_HEADER_METHOD]: "POST",
+      [import_node_http2.constants.HTTP2_HEADER_PATH]: `/3/device/${args.deviceToken}`,
+      [import_node_http2.constants.HTTP2_HEADER_AUTHORIZATION]: `bearer ${this.getJwt()}`,
+      "apns-push-type": "liveactivity",
+      "apns-topic": this.topic,
+      "apns-priority": String(args.priority ?? 10),
+      ...args.expirationSeconds != null && {
+        "apns-expiration": String(args.expirationSeconds)
+      },
+      [import_node_http2.constants.HTTP2_HEADER_CONTENT_TYPE]: "application/json",
+      [import_node_http2.constants.HTTP2_HEADER_CONTENT_LENGTH]: String(body.byteLength)
+    };
+    return new Promise((resolve4, reject) => {
+      const req = session.request(headers);
+      req.setTimeout(args.timeoutMs ?? 1e4, () => {
+        req.close(import_node_http2.constants.NGHTTP2_CANCEL);
+        resolve4({ ok: false, status: 0, reason: "Timeout", tokenDead: false });
+      });
+      let status = 0;
+      req.on("response", (resHeaders) => {
+        status = Number(resHeaders[import_node_http2.constants.HTTP2_HEADER_STATUS] ?? 0);
+      });
+      const chunks = [];
+      req.on("data", (chunk) => chunks.push(chunk));
+      req.on("error", reject);
+      req.on("end", () => {
+        const raw2 = Buffer.concat(chunks).toString("utf-8");
+        let reason;
+        if (raw2.length > 0) {
+          try {
+            reason = JSON.parse(raw2).reason;
+          } catch {
+            reason = raw2.slice(0, 200);
+          }
+        }
+        resolve4({
+          ok: status === 200,
+          status,
+          reason,
+          tokenDead: reason != null && DEAD_TOKEN_REASONS.has(reason)
+        });
+      });
+      req.end(body);
+    });
+  }
+  /** Close the shared connection. Called on server shutdown. */
+  close() {
+    this.session?.close();
+    this.session = null;
+  }
+};
+
+// src/api/routes/misc.routes.ts
 function numberOrNull(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
@@ -142657,11 +142825,22 @@ function readRawBody3(req) {
 function verifyWebhookSignature(body, header, secret) {
   if (!header) return false;
   const provided = header.startsWith("sha256=") ? header.slice(7) : header;
-  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(body).digest("hex");
+  const expected = (0, import_node_crypto2.createHmac)("sha256", secret).update(body).digest("hex");
   const a = Buffer.from(provided, "utf-8");
   const b2 = Buffer.from(expected, "utf-8");
   if (a.length !== b2.length) return false;
-  return (0, import_node_crypto.timingSafeEqual)(a, b2);
+  return (0, import_node_crypto2.timingSafeEqual)(a, b2);
+}
+function describePushCapability(liveActivityEnabled, env = process.env) {
+  if (liveActivityEnabled) return { liveActivity: true, notifications: false };
+  return {
+    liveActivity: false,
+    notifications: false,
+    // describeMissingApnsCredentials only explains a *credential* gap and
+    // returns null once the credentials are complete — reachable here, because
+    // an unavailable token store disables the feature with the key still set.
+    liveActivityReason: describeMissingApnsCredentials(env) ?? "APNs credentials are set but the push token store is unavailable, so Live Activity push is disabled."
+  };
 }
 var clientLog = getLogger("client");
 var createMiscRoutes = (deps) => {
@@ -142684,7 +142863,12 @@ var createMiscRoutes = (deps) => {
       featureFlags: true,
       // Same contract: this server serves GET /api/projects/summary, which the
       // Hub's grouped views need before they can draw a tree.
-      projectSummary: true
+      projectSummary: true,
+      // Delivery capability, not endpoint support: whether this server can
+      // actually send a push, so mobile can hide an affordance instead of
+      // registering tokens nothing will ever send to. Absent on older servers,
+      // which a client should read as "unknown", not "unavailable".
+      push: describePushCapability(deps.liveActivityPushEnabled())
     });
   });
   app.get("/api/profiles", (c) => c.json([]));
@@ -142745,9 +142929,10 @@ var createMiscRoutes = (deps) => {
     return c.json({ ok: true });
   });
   app.get("/api/push/health", (c) => {
+    const push = describePushCapability(deps.liveActivityPushEnabled());
     const repo = deps.pushRepo();
-    if (!repo) return c.json({ tokens: [], available: false });
-    return c.json({ tokens: repo.listHealth(), available: true });
+    if (!repo) return c.json({ tokens: [], available: false, push });
+    return c.json({ tokens: repo.listHealth(), available: true, push });
   });
   app.post("/api/__update", async (c) => {
     const cfg = loadUpdateConfig();
@@ -142815,7 +143000,7 @@ var createPairRoutes = (deps) => {
 };
 
 // src/api/routes/progress.routes.ts
-var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_node_crypto3 = __toESM(require("crypto"), 1);
 function readRawBody4(req) {
   return new Promise((resolve4, reject) => {
     const chunks = [];
@@ -142826,10 +143011,10 @@ function readRawBody4(req) {
 }
 function verifySignature(rawBody, signature, secret) {
   if (!signature || signature.length === 0) return false;
-  const expected = import_node_crypto2.default.createHmac("sha256", secret).update(rawBody).digest("hex");
+  const expected = import_node_crypto3.default.createHmac("sha256", secret).update(rawBody).digest("hex");
   if (expected.length !== signature.length) return false;
   try {
-    return import_node_crypto2.default.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+    return import_node_crypto3.default.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
   } catch {
     return false;
   }
@@ -143382,7 +143567,7 @@ var import_promises13 = require("timers/promises");
 
 // src/db/query-timing.ts
 init_logger();
-var log3 = getLogger("db");
+var log4 = getLogger("db");
 var DEFAULT_SLOW_QUERY_MS = 35;
 var LABEL = /* @__PURE__ */ Symbol("tbQueryLabel");
 function deriveLabel(sql) {
@@ -143398,15 +143583,15 @@ function resolveSlowMs() {
 }
 function record2(label, ms2, rows, slowMs) {
   if (slowMs > 0 && ms2 >= slowMs) {
-    log3.warn(
+    log4.warn(
       `[db] slow query ${label} ${ms2.toFixed(1)}ms rows=${rows}`,
       { event: "db.slow_query", stmt: label, ms: Math.round(ms2 * 100) / 100, rows },
       "pino"
     );
     return;
   }
-  if (log3.pino.isLevelEnabled("debug")) {
-    log3.debug(
+  if (log4.pino.isLevelEnabled("debug")) {
+    log4.debug(
       `[db] ${label} ${ms2.toFixed(2)}ms rows=${rows}`,
       { event: "db.query", stmt: label, ms: Math.round(ms2 * 100) / 100, rows },
       "pino"
@@ -146810,168 +146995,6 @@ function deriveProjectChatTitle(input) {
   return `Untitled \xB7 ${input.id.slice(0, 8)}`;
 }
 
-// src/services/push/apnsClient.ts
-var import_node_crypto3 = require("crypto");
-var import_node_http2 = require("http2");
-init_logger();
-var log4 = getLogger("apns");
-var APNS_HOST_SANDBOX = "api.sandbox.push.apple.com";
-var APNS_MAX_PAYLOAD_BYTES = 4096;
-var JWT_TTL_SECONDS = 3e3;
-var DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set([
-  "BadDeviceToken",
-  "DeviceTokenNotForTopic",
-  "Unregistered",
-  "ExpiredToken"
-]);
-function base64url3(input) {
-  return Buffer.from(input).toString("base64url");
-}
-function readApnsCredentialsFromEnv(env = process.env) {
-  const key = env.APNS_KEY;
-  if (!key || key.trim().length === 0) return null;
-  const keyId = env.APNS_KEY_ID?.trim();
-  const teamId = env.APNS_TEAM_ID?.trim();
-  const bundleId = env.APNS_BUNDLE_ID?.trim();
-  if (!keyId || !teamId || !bundleId) return null;
-  const host = env.APNS_HOST ?? APNS_HOST_SANDBOX;
-  return { key, keyId, teamId, bundleId, host };
-}
-function describeMissingApnsCredentials(env = process.env) {
-  if (!env.APNS_KEY || env.APNS_KEY.trim().length === 0) {
-    return "APNS_KEY is not set, so Live Activity push is disabled. Set it to the p8 key contents (not a path) to enable it.";
-  }
-  const missing = [
-    ["APNS_KEY_ID", env.APNS_KEY_ID],
-    ["APNS_TEAM_ID", env.APNS_TEAM_ID],
-    ["APNS_BUNDLE_ID", env.APNS_BUNDLE_ID]
-  ].filter(([, value]) => !value || value.trim().length === 0).map(([name]) => name);
-  if (missing.length === 0) return null;
-  return `APNS_KEY is set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not, so Live Activity push is disabled. Under launchd, APNS_KEY_ID is derived from the AuthKey_<keyId>.p8 filename; the team and bundle ids must be set explicitly.`;
-}
-var ApnsClient = class {
-  constructor(creds) {
-    this.creds = creds;
-  }
-  creds;
-  session = null;
-  cachedJwt = null;
-  /**
-   * The `apns-topic` for Live Activity pushes.
-   *
-   * The `.push-type.liveactivity` suffix is mandatory and is why the signing key
-   * must be Team Scoped (All Topics) — a key scoped to the bundle id alone
-   * cannot sign this topic.
-   */
-  get topic() {
-    return `${this.creds.bundleId}.push-type.liveactivity`;
-  }
-  /**
-   * Mint or reuse the provider JWT.
-   *
-   * ES256 over the p8 key. Cached until shortly before expiry: Apple rejects a
-   * token older than an hour, but minting one per request is wasteful and can
-   * trip APNs' provider-token-update throttle.
-   */
-  getJwt(now = Date.now()) {
-    const nowSeconds = Math.floor(now / 1e3);
-    if (this.cachedJwt && this.cachedJwt.expiresAt > nowSeconds + 60) {
-      return this.cachedJwt.token;
-    }
-    const header = base64url3(JSON.stringify({ alg: "ES256", kid: this.creds.keyId, typ: "JWT" }));
-    const payload = base64url3(JSON.stringify({ iss: this.creds.teamId, iat: nowSeconds }));
-    const signingInput = `${header}.${payload}`;
-    const signature = (0, import_node_crypto3.createSign)("SHA256").update(signingInput).sign({ key: this.creds.key, dsaEncoding: "ieee-p1363" });
-    const token = `${signingInput}.${base64url3(signature)}`;
-    this.cachedJwt = { token, expiresAt: nowSeconds + JWT_TTL_SECONDS };
-    return token;
-  }
-  /**
-   * Reuse one HTTP/2 session across sends.
-   *
-   * APNs expects a long-lived connection; a fresh TLS handshake per push is slow
-   * and Apple treats connection churn as abuse.
-   */
-  getSession() {
-    if (this.session && !this.session.closed && !this.session.destroyed) {
-      return this.session;
-    }
-    const session = (0, import_node_http2.connect)(`https://${this.creds.host}`);
-    session.on("error", (err) => {
-      log4.warn("apns.session_error", { event: "apns.session_error", err: String(err) });
-    });
-    this.session = session;
-    return session;
-  }
-  /**
-   * Send one push.
-   *
-   * Resolves with a result rather than rejecting on an APNs rejection: a
-   * rejected push is an expected outcome the caller must act on (retire the
-   * token), not an exception. Only a genuinely unexpected local failure throws,
-   * and the caller logs it.
-   */
-  async send(args) {
-    const body = Buffer.from(JSON.stringify(args.payload), "utf-8");
-    if (body.byteLength > APNS_MAX_PAYLOAD_BYTES) {
-      throw new Error(
-        `APNs payload is ${body.byteLength} bytes, over the ${APNS_MAX_PAYLOAD_BYTES} byte limit`
-      );
-    }
-    const session = this.getSession();
-    const headers = {
-      [import_node_http2.constants.HTTP2_HEADER_METHOD]: "POST",
-      [import_node_http2.constants.HTTP2_HEADER_PATH]: `/3/device/${args.deviceToken}`,
-      [import_node_http2.constants.HTTP2_HEADER_AUTHORIZATION]: `bearer ${this.getJwt()}`,
-      "apns-push-type": "liveactivity",
-      "apns-topic": this.topic,
-      "apns-priority": String(args.priority ?? 10),
-      ...args.expirationSeconds != null && {
-        "apns-expiration": String(args.expirationSeconds)
-      },
-      [import_node_http2.constants.HTTP2_HEADER_CONTENT_TYPE]: "application/json",
-      [import_node_http2.constants.HTTP2_HEADER_CONTENT_LENGTH]: String(body.byteLength)
-    };
-    return new Promise((resolve4, reject) => {
-      const req = session.request(headers);
-      req.setTimeout(args.timeoutMs ?? 1e4, () => {
-        req.close(import_node_http2.constants.NGHTTP2_CANCEL);
-        resolve4({ ok: false, status: 0, reason: "Timeout", tokenDead: false });
-      });
-      let status = 0;
-      req.on("response", (resHeaders) => {
-        status = Number(resHeaders[import_node_http2.constants.HTTP2_HEADER_STATUS] ?? 0);
-      });
-      const chunks = [];
-      req.on("data", (chunk) => chunks.push(chunk));
-      req.on("error", reject);
-      req.on("end", () => {
-        const raw2 = Buffer.concat(chunks).toString("utf-8");
-        let reason;
-        if (raw2.length > 0) {
-          try {
-            reason = JSON.parse(raw2).reason;
-          } catch {
-            reason = raw2.slice(0, 200);
-          }
-        }
-        resolve4({
-          ok: status === 200,
-          status,
-          reason,
-          tokenDead: reason != null && DEAD_TOKEN_REASONS.has(reason)
-        });
-      });
-      req.end(body);
-    });
-  }
-  /** Close the shared connection. Called on server shutdown. */
-  close() {
-    this.session?.close();
-    this.session = null;
-  }
-};
-
 // src/services/push/expoPushSender.ts
 init_logger();
 var log5 = getLogger("expo-push");
@@ -149290,6 +149313,7 @@ var StreamerServer = class {
       cache: () => this.cache,
       cacheMonitor: () => this.cacheMonitor,
       pushRepo: () => this.pushRepo,
+      liveActivityPushEnabled: () => this.liveActivityNotifier !== null,
       devicesRepo: () => this.devicesRepo,
       projectsRepo: () => this.projectsRepo,
       conversationsRepo: () => this.conversationsRepo,
@@ -157454,6 +157478,17 @@ program2.command("serve").description("Start the streamer server").option("-p, -
       takeoverProd2({ port: plan.port, repoToplevel });
     }
   }
+  const spawnMode = effectivePermissionMode(
+    claudeFlags,
+    resolvedDefaultPermissionMode ?? loadDefaultPermissionMode()
+  );
+  if (spawnMode !== void 0 && isDangerousPermissionMode(spawnMode)) {
+    log14.warn(
+      `[WARN] permission mode is ${spawnMode} \u2014 spawned sessions run without confirmation prompts, so anyone holding the API key can execute arbitrary code on this machine. There is no spend limit.`,
+      void 0,
+      "console"
+    );
+  }
   const server = new StreamerServer({
     port: resolvedPort,
     apiKey,