@threadbase-sh/streamer 1.52.5 → 1.52.6

package/dist/index.js

@@ -555,7 +555,8 @@ function loadOrCreateApiKey() {
   const key = generateApiKey();
   mkdirSync(configDir(), { recursive: true });
   writeFileSync(configFile(), `api_key: ${key}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
+  chmodSync(configFile(), 384);
   return key;
 }
 function loadBrowseRoot() {
@@ -3863,8 +3864,8 @@ import { EventEmitter } from "events";
 import { existsSync as existsSync16 } from "fs";
 import { realpath as realpath2 } from "fs/promises";
 import { createServer as createServer2 } from "http";
-import { homedir as homedir12, hostname as hostname3 } from "os";
-import { dirname as dirname10, join as join23 } from "path";
+import { homedir as homedir13, hostname as hostname3 } from "os";
+import { dirname as dirname10, join as join24 } from "path";
 
 // src/api/app.ts
 import { Hono as Hono18 } from "hono";
@@ -4000,6 +4001,8 @@ var DevicesRepository = class {
   listStmt;
   revokeStmt;
   touchStmt;
+  deleteStmt;
+  deleteRevokedStmt;
   constructor(db) {
     this.insertStmt = db.prepare(`
       INSERT INTO devices (
@@ -4013,6 +4016,8 @@ var DevicesRepository = class {
     this.listStmt = db.prepare("SELECT * FROM devices ORDER BY created_at DESC");
     this.revokeStmt = db.prepare("UPDATE devices SET revoked_at = ? WHERE device_id = ?");
     this.touchStmt = db.prepare("UPDATE devices SET last_seen_at = ? WHERE device_id = ?");
+    this.deleteStmt = db.prepare("DELETE FROM devices WHERE device_id = ?");
+    this.deleteRevokedStmt = db.prepare("DELETE FROM devices WHERE revoked_at IS NOT NULL");
   }
   /**
    * Record a newly paired device and mint its token.
@@ -4059,6 +4064,33 @@ var DevicesRepository = class {
   revoke(deviceId, now = Date.now()) {
     return this.revokeStmt.run(now, deviceId).changes > 0;
   }
+  /**
+   * Erase one device's record outright.
+   *
+   * Deliberately separate from `revoke`, which is a soft delete that keeps the
+   * row so `list()` can show what happened. That audit trail is the right
+   * default — but it meant a `devices` row, including the user-supplied `name`
+   * ("Ronen's iPhone"), had no removal path at all once the registry moved to
+   * runtime.db, which no command deletes. This is that path.
+   *
+   * Erasure is NOT revocation: deleting a row frees its `token_hash`, so a
+   * device whose token is still on a phone somewhere stops being *known* rather
+   * than being *refused*. Revoke first, delete second, is the safe order, and
+   * `deleteRevoked()` exists so that is the easy thing to do.
+   */
+  delete(deviceId) {
+    return this.deleteStmt.run(deviceId).changes > 0;
+  }
+  /**
+   * Erase every already-revoked device. The bulk companion to `delete`, and the
+   * one that is safe by construction: a revoked device is already refused, so
+   * removing its row cannot restore access to anything.
+   *
+   * Returns the number of rows removed.
+   */
+  deleteRevoked() {
+    return this.deleteRevokedStmt.run().changes;
+  }
   touch(deviceId, now = Date.now()) {
     this.touchStmt.run(now, deviceId);
   }
@@ -4585,6 +4617,34 @@ var createDeviceRoutes = (deps) => {
     repo.revoke(id);
     return c.json({ ok: true, alreadyRevoked: false });
   });
+  app.delete("/:id", (c) => {
+    const repo = deps.devicesRepo();
+    if (!repo) {
+      return c.json({ error: "Device registry is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    const id = c.req.param("id");
+    const existing = repo.get(id);
+    if (!existing) return c.json({ ok: true, alreadyDeleted: true });
+    const force = c.req.query("force") === "1" || c.req.query("force") === "true";
+    if (existing.revoked_at == null && !force) {
+      return c.json(
+        {
+          error: "Revoke the device before deleting it, or pass ?force=1",
+          code: "DEVICE_ACTIVE"
+        },
+        409
+      );
+    }
+    repo.delete(id);
+    return c.json({ ok: true, alreadyDeleted: false });
+  });
+  app.delete("/", (c) => {
+    const repo = deps.devicesRepo();
+    if (!repo) {
+      return c.json({ error: "Device registry is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    return c.json({ ok: true, deleted: repo.deleteRevoked() });
+  });
   return app;
 };
 
@@ -5501,6 +5561,13 @@ var createMiscRoutes = (deps) => {
       // Same contract: this server serves GET /api/projects/summary, which the
       // Hub's grouped views need before they can draw a tree.
       projectSummary: true,
+      // The paired-device registry lives in runtime.db, so it survives
+      // `tb-streamer cache clear` and the integrity monitor's reset-and-rescan.
+      // A client may only prefer its scoped device token over the shared API
+      // key when this is true: on an older server the registry is inside
+      // cache.db, where a documented troubleshooting step deletes it and every
+      // device token with it. Absent means "old server, assume not durable".
+      devicesDurable: true,
       // Delivery capability, not endpoint support: whether this server can
       // actually send a push, so mobile can hide an affordance instead of
       // registering tokens nothing will ever send to. Absent on older servers,
@@ -5911,7 +5978,13 @@ var createWsRoutes = (deps, upgradeWebSocket) => {
   const app = new Hono17();
   app.get(
     "/ws",
-    upgradeWebSocket(() => {
+    // The principal is read here, at the upgrade, and captured for the life of
+    // the socket. authMiddleware sets it because /ws is classified
+    // `history:read`, but it only ever reaches the HTTP request — without
+    // capturing it the socket has no principal at all, so every frame after
+    // the upgrade is unauthorized-by-omission.
+    upgradeWebSocket((c) => {
+      const principal = c.get("principal") ?? null;
       let openWs = null;
       return {
         onOpen(_evt, ws) {
@@ -5921,7 +5994,7 @@ var createWsRoutes = (deps, upgradeWebSocket) => {
           deps.handleWsOpen(raw);
         },
         onMessage(evt, _ws) {
-          if (openWs) deps.handleWsMessage(openWs, evt.data);
+          if (openWs) deps.handleWsMessage(openWs, evt.data, principal);
         },
         onClose(_evt, _ws) {
           if (openWs) deps.handleWsClose(openWs);
@@ -10651,6 +10724,11 @@ var SessionsRepository = class {
 
 // src/db/runtime-store.ts
 import Database2 from "better-sqlite3";
+import { homedir as homedir6 } from "os";
+import { join as join16 } from "path";
+function resolveRuntimeDbPath(override) {
+  return override ?? process.env.THREADBASE_RUNTIME_DB ?? join16(process.env.THREADBASE_CONFIG_DIR ?? join16(homedir6(), ".threadbase"), "runtime.db");
+}
 var RuntimeStore = class _RuntimeStore {
   constructor(db) {
     this.db = db;
@@ -10668,23 +10746,64 @@ var RuntimeStore = class _RuntimeStore {
   /**
    * One-time move of `managed_sessions` rows out of a pre-split `cache.db`.
    *
-   * Non-destructive by design: the source table is left in place so an older
-   * streamer rolled back onto the same machine still finds its registry. Runs
-   * only when this file's table is empty, so a second boot is a no-op rather
-   * than a re-copy that would resurrect rows deleted since.
-   *
    * Returns the number of rows copied.
    */
   importLegacyManagedSessions(source) {
-    const existing = this.db.prepare("SELECT COUNT(*) AS n FROM managed_sessions").get();
+    return this.importLegacyTable(source, "managed_sessions");
+  }
+  /**
+   * One-time move of `devices` rows out of `cache.db`, where the registry used
+   * to live (migration `011_create_devices.sql`).
+   *
+   * Losing this table invalidates every device token ever issued, and cache.db
+   * is the file `tb-streamer cache clear` deletes and the integrity monitor
+   * rebuilds — see `runtime-migrations/003_create_devices.sql`.
+   *
+   * Unlike `managed_sessions`, this one MOVES rather than copies: the source
+   * rows are deleted once the copy is verified. A `devices` row carries a
+   * user-supplied label ("Ronen's iPhone"), and leaving a second copy of that
+   * on disk indefinitely — in the one file the user is told to delete when
+   * something goes wrong — is more retained personal data than the rollback
+   * path is worth. Recovering from a rollback is re-scanning a pairing QR.
+   *
+   * The delete is conditional on the copy being complete: `INSERT OR IGNORE`
+   * can silently skip a row, so the destination count must match what was read
+   * before anything is removed. A mismatch keeps the source and reports
+   * `purged: false` rather than throwing — the import itself still succeeded,
+   * and keeping data is the safe direction to fail in.
+   */
+  importLegacyDevices(source) {
+    const copied = this.importLegacyTable(source, "devices");
+    if (copied === 0) return { copied: 0, purged: false };
+    const landed = this.db.prepare("SELECT COUNT(*) AS n FROM devices").get().n;
+    if (landed !== copied) return { copied, purged: false };
+    source.prepare("DELETE FROM devices").run();
+    return { copied, purged: true };
+  }
+  /**
+   * Copy a whole table out of a pre-split `cache.db` into this file.
+   *
+   * The copy itself is non-destructive — the source is left in place, so an
+   * older streamer rolled back onto the same machine still finds its data.
+   * `importLegacyDevices` deletes the source afterwards for its own reasons;
+   * `managed_sessions` does not. Runs only when this file's table is empty, so
+   * a second boot is a no-op rather than a re-copy that would resurrect rows
+   * deleted since.
+   *
+   * The table name is interpolated into SQL, so it is typed as a closed union
+   * rather than `string` — the set of tables that can ever be lifted is known
+   * at compile time, and that is what keeps a caller from making this a hole.
+   */
+  importLegacyTable(source, table) {
+    const existing = this.db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get();
     if (existing.n > 0) return 0;
-    const hasTable = source.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'managed_sessions'").get();
+    const hasTable = source.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
     if (!hasTable) return 0;
-    const rows = source.prepare("SELECT * FROM managed_sessions").all();
+    const rows = source.prepare(`SELECT * FROM ${table}`).all();
     if (rows.length === 0) return 0;
     const columns = Object.keys(rows[0]);
     const insert = this.db.prepare(
-      `INSERT OR IGNORE INTO managed_sessions (${columns.join(", ")})
+      `INSERT OR IGNORE INTO ${table} (${columns.join(", ")})
        VALUES (${columns.map((c) => `@${c}`).join(", ")})`
     );
     this.db.transaction((batch) => {
@@ -10926,14 +11045,14 @@ import { spawn as spawn2 } from "child_process";
 
 // src/pty-host/socket.ts
 import { createConnection, createServer } from "net";
-import { homedir as homedir6 } from "os";
-import { join as join16 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join17 } from "path";
 function hostSocketPath(instanceId) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\threadbase-pty-host-${instanceId}`;
   }
-  const dir = process.env.THREADBASE_CONFIG_DIR ?? join16(homedir6(), ".threadbase");
-  return join16(dir, "run", `pty-host-${instanceId}.sock`);
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? join17(homedir7(), ".threadbase");
+  return join17(dir, "run", `pty-host-${instanceId}.sock`);
 }
 function socketTransport(socket) {
   socket.setEncoding("utf8");
@@ -11008,8 +11127,8 @@ import {
   ConversationScanner
 } from "@threadbase-sh/scanner";
 import { statSync as statSync7 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join18 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join19 } from "path";
 
 // src/services/cache/cacheMetadata.ts
 function getCacheMetadata(repo, key) {
@@ -11109,9 +11228,9 @@ function refreshConversationCache(deps) {
 
 // src/services/conversations/shouldRefreshProjectsFromHdd.ts
 import { readdirSync as readdirSync4, statSync as statSync6 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join17 } from "path";
-var DEFAULT_PROJECTS_DIR = join17(homedir7(), ".claude", "projects");
+import { homedir as homedir8 } from "os";
+import { join as join18 } from "path";
+var DEFAULT_PROJECTS_DIR = join18(homedir8(), ".claude", "projects");
 function maxProjectsTreeMtimeMs(projectsDir) {
   let maxMs;
   try {
@@ -11123,7 +11242,7 @@ function maxProjectsTreeMtimeMs(projectsDir) {
     for (const ent of readdirSync4(projectsDir, { withFileTypes: true })) {
       if (!ent.isDirectory()) continue;
       try {
-        const childMs = statSync6(join17(projectsDir, ent.name)).mtimeMs;
+        const childMs = statSync6(join18(projectsDir, ent.name)).mtimeMs;
         if (childMs > maxMs) maxMs = childMs;
       } catch {
       }
@@ -11295,9 +11414,9 @@ var ScannerManager = class {
   projectsDirs() {
     const profiles = this.deps.scanProfiles;
     if (profiles && profiles.length > 0) {
-      return profiles.filter((p) => p.enabled).map((p) => join18(p.configDir, "projects"));
+      return profiles.filter((p) => p.enabled).map((p) => join19(p.configDir, "projects"));
     }
-    return [join18(homedir8(), ".claude", "projects")];
+    return [join19(homedir9(), ".claude", "projects")];
   }
   // ─── staleness ────────────────────────────────────────────────────
   // Drain the stale set and disarm the flag together. The caller owns the
@@ -11578,8 +11697,8 @@ import { statSync as statSync9 } from "fs";
 
 // src/handlers/handleListProjects.ts
 import { closeSync as closeSync4, openSync as openSync4, readdirSync as readdirSync5, readSync as readSync4, statSync as statSync8 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join19 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join20 } from "path";
 var HEAD_BYTES = 64 * 1024;
 var MAX_FILES_PROBED = 3;
 function readRecordedCwd(dir) {
@@ -11592,7 +11711,7 @@ function readRecordedCwd(dir) {
   for (const file of files.slice(0, MAX_FILES_PROBED)) {
     let fd;
     try {
-      fd = openSync4(join19(dir, file), "r");
+      fd = openSync4(join20(dir, file), "r");
       const buf = Buffer.alloc(HEAD_BYTES);
       const bytes = readSync4(fd, buf, 0, HEAD_BYTES, 0);
       for (const line of buf.subarray(0, bytes).toString("utf8").split("\n")) {
@@ -11616,11 +11735,11 @@ function decodeProjectPath(dirName) {
 function handleListProjects(url, res) {
   const limit = Math.max(1, parseInt(url.searchParams.get("limit") ?? "50", 10) || 50);
   const offset = Math.max(0, parseInt(url.searchParams.get("offset") ?? "0", 10) || 0);
-  const projectsDir = join19(homedir9(), ".claude", "projects");
+  const projectsDir = join20(homedir10(), ".claude", "projects");
   let entries;
   try {
     entries = readdirSync5(projectsDir).map((dirName) => {
-      const fullPath = join19(projectsDir, dirName);
+      const fullPath = join20(projectsDir, dirName);
       let mtime = 0;
       try {
         mtime = statSync8(fullPath).mtimeMs;
@@ -11635,7 +11754,7 @@ function handleListProjects(url, res) {
   }
   const total = entries.length;
   const page = entries.slice(offset, offset + limit).map(({ dirName }) => {
-    const path = readRecordedCwd(join19(projectsDir, dirName)) ?? decodeProjectPath(String(dirName));
+    const path = readRecordedCwd(join20(projectsDir, dirName)) ?? decodeProjectPath(String(dirName));
     const name = path.split(/[\\/]/).filter(Boolean).pop() ?? dirName;
     return { name, path, dirName };
   });
@@ -11644,6 +11763,9 @@ function handleListProjects(url, res) {
 }
 
 // src/server-wiring.ts
+function wsAllows(principal, required) {
+  return principal === null || hasCapability(principal, required);
+}
 function createConversationWatcherEvents(deps) {
   return {
     onNewLineSpans: (filePath, spans, readFrom, endOffset) => {
@@ -11925,7 +12047,15 @@ function createApiDeps(deps) {
       const alertMsg = deps.cacheMonitor()?.wsMessage();
       if (alertMsg) deps.wsHub.unicast(ws, alertMsg);
     },
-    handleWsMessage: async (ws, raw) => {
+    handleWsMessage: async (ws, raw, principal) => {
+      const deny = (type, required) => {
+        deps.log().warn(`[ws.capability_denied] ${type} requires ${required}`, {
+          event: "ws.capability_denied",
+          type,
+          required,
+          ...principal?.deviceId ? { deviceId: principal.deviceId } : {}
+        });
+      };
       try {
         const msg = JSON.parse(String(raw));
         if (msg.type === "register" && typeof msg.clientId === "string") {
@@ -11935,6 +12065,10 @@ function createApiDeps(deps) {
           deps.wsToClientId.set(ws, msg.clientId);
         }
         if (msg.type === "subscribe_session" && typeof msg.sessionId === "string") {
+          if (!wsAllows(principal, "history:read")) {
+            deny(msg.type, "history:read");
+            return;
+          }
           deps.addSessionSubscriber(msg.sessionId, ws);
           if (deps.ptyManager.hasSession(msg.sessionId)) {
             const lines = await deps.ptyManager.getOutputLines(msg.sessionId, 200);
@@ -11983,6 +12117,10 @@ function createApiDeps(deps) {
           }
         }
         if (msg.type === "hold_session" && typeof msg.sessionId === "string") {
+          if (!wsAllows(principal, "session:control")) {
+            deny(msg.type, "session:control");
+            return;
+          }
           deps.startGraceTimer(msg.sessionId, deps.ptyGracePeriodMs);
         }
       } catch {
@@ -12010,11 +12148,11 @@ import { existsSync as existsSync12 } from "fs";
 
 // src/services/cache-integrity/alertStore.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir10 } from "os";
-import { dirname as dirname9, join as join20 } from "path";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname9, join as join21 } from "path";
 function alertStatePath() {
-  const dir = process.env.THREADBASE_CONFIG_DIR ?? join20(homedir10(), ".threadbase");
-  return join20(dir, "cache-alert.json");
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? join21(homedir11(), ".threadbase");
+  return join21(dir, "cache-alert.json");
 }
 function loadAlertState() {
   try {
@@ -12033,7 +12171,7 @@ function saveAlertState(state) {
 
 // src/services/cache-integrity/backup.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as readdirSync6, statSync as statSync10, unlinkSync } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var DEFAULT_RETAIN = 3;
 function retainCount() {
   const parsed = Number.parseInt(process.env.THREADBASE_CACHE_BACKUP_RETAIN ?? "", 10);
@@ -12044,13 +12182,13 @@ function timestamp(d) {
   return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
 }
 async function backupCacheDb(db, cacheDir) {
-  const backupsDir = join21(cacheDir, "backups");
+  const backupsDir = join22(cacheDir, "backups");
   mkdirSync5(backupsDir, { recursive: true });
-  const destPath = join21(backupsDir, `cache-${timestamp(/* @__PURE__ */ new Date())}.db`);
+  const destPath = join22(backupsDir, `cache-${timestamp(/* @__PURE__ */ new Date())}.db`);
   await db.backup(destPath);
   const retain = retainCount();
   const backups = readdirSync6(backupsDir).filter((f) => f.startsWith("cache-") && f.endsWith(".db")).map((f) => {
-    const full = join21(backupsDir, f);
+    const full = join22(backupsDir, f);
     return { full, mtime: statSync10(full).mtimeMs };
   }).sort((a, b) => b.mtime - a.mtime);
   for (const stale of backups.slice(retain)) {
@@ -14001,8 +14139,8 @@ function discoveredToResponse(d, conversationId) {
 
 // src/session-watchers.ts
 import { existsSync as existsSync15, watch as fsWatch, readdirSync as readdirSync7, readFileSync as readFileSync9, statSync as statSync12 } from "fs";
-import { homedir as homedir11 } from "os";
-import { basename as basename6, join as join22 } from "path";
+import { homedir as homedir12 } from "os";
+import { basename as basename6, join as join23 } from "path";
 var SessionWatchers = class {
   constructor(deps) {
     this.deps = deps;
@@ -14083,9 +14221,9 @@ var SessionWatchers = class {
   // was passed to Claude via --session-id so the filename matches from the start.
   watchForJsonl(sessionId, projectPath) {
     const encoded = projectPath.replace(/[/\\:.]/g, "-");
-    const projectsDir = join22(homedir11(), ".claude", "projects", encoded);
+    const projectsDir = join23(homedir12(), ".claude", "projects", encoded);
     const expectedFile = `${sessionId}.jsonl`;
-    const filePath = join22(projectsDir, expectedFile);
+    const filePath = join23(projectsDir, expectedFile);
     const deadline = Date.now() + 12e4;
     let watcher = null;
     const cleanup = () => {
@@ -14107,10 +14245,10 @@ var SessionWatchers = class {
       if (!resolvedFilePath && existsSync15(projectsDir)) {
         try {
           const now = Date.now();
-          const match = readdirSync7(projectsDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, mtime: statSync12(join22(projectsDir, f)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).filter(
-            ({ f }) => basename6(f, ".jsonl") === sessionId || this.readFirstLineSessionId(join22(projectsDir, f)) === sessionId
+          const match = readdirSync7(projectsDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, mtime: statSync12(join23(projectsDir, f)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).filter(
+            ({ f }) => basename6(f, ".jsonl") === sessionId || this.readFirstLineSessionId(join23(projectsDir, f)) === sessionId
           ).sort((a, b) => b.mtime - a.mtime)[0];
-          if (match) resolvedFilePath = join22(projectsDir, match.f);
+          if (match) resolvedFilePath = join23(projectsDir, match.f);
         } catch {
         }
       }
@@ -14154,7 +14292,7 @@ var SessionWatchers = class {
   watchForCodexRollout(sessionId, projectPath) {
     const deadline = Date.now() + 12e4;
     const now = /* @__PURE__ */ new Date();
-    const dateDir = join22(
+    const dateDir = join23(
       String(now.getFullYear()),
       String(now.getMonth() + 1).padStart(2, "0"),
       String(now.getDate()).padStart(2, "0")
@@ -14195,7 +14333,7 @@ var SessionWatchers = class {
         this.deps.sessionStore.listManaged().filter((s) => s.id !== sessionId && s.boundConversationId != null).map((s) => s.boundConversationId)
       );
       for (const root of this.deps.codexRoots) {
-        const sessionsDir = join22(root, dateDir);
+        const sessionsDir = join23(root, dateDir);
         if (!existsSync15(sessionsDir)) continue;
         let candidateFiles;
         try {
@@ -14204,9 +14342,9 @@ var SessionWatchers = class {
           continue;
         }
         const nowMs = Date.now();
-        const recentCandidates = candidateFiles.map((f) => ({ f, mtime: statSync12(join22(sessionsDir, f)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b) => b.mtime - a.mtime);
+        const recentCandidates = candidateFiles.map((f) => ({ f, mtime: statSync12(join23(sessionsDir, f)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b) => b.mtime - a.mtime);
         for (const { f } of recentCandidates) {
-          const candidatePath = join22(sessionsDir, f);
+          const candidatePath = join23(sessionsDir, f);
           const match = matchesProjectPath(candidatePath);
           if (!match) continue;
           if (boundElsewhere.has(match.id)) continue;
@@ -14610,7 +14748,7 @@ var StreamerServer = class {
     this.skipStartupWarmup = config.skipStartupWarmup ?? false;
     this.autoResumeOnBoot = config.autoResumeOnBoot ?? false;
     this.scanProfiles = config.scanProfiles;
-    this.codexRoots = config.codexRoots ?? [join23(homedir12(), ".codex", "sessions")];
+    this.codexRoots = config.codexRoots ?? [join24(homedir13(), ".codex", "sessions")];
     this.ptyGracePeriodMs = config.ptyGracePeriodMs ?? DEFAULT_PTY_GRACE_PERIOD_MS;
     this.defaultSystemPrompt = config.defaultSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
     const flagResolution = resolveFeatureFlags({
@@ -14627,8 +14765,8 @@ var StreamerServer = class {
     this.claudeFlagsPersistable = config.claudeFlags === void 0;
     this.claudeFlags = config.claudeFlags ?? loadClaudeFlags();
     this.claudeExtraArgs = config.claudeExtraArgs ?? loadClaudeExtraArgs();
-    this.cacheDir = config.cacheDir ?? loadCacheDir() ?? join23(homedir12(), ".threadbase", "cache");
-    this.runtimeDbPath = config.runtimeDbPath ?? process.env.THREADBASE_RUNTIME_DB ?? join23(process.env.THREADBASE_CONFIG_DIR ?? join23(homedir12(), ".threadbase"), "runtime.db");
+    this.cacheDir = config.cacheDir ?? loadCacheDir() ?? join24(homedir13(), ".threadbase", "cache");
+    this.runtimeDbPath = resolveRuntimeDbPath(config.runtimeDbPath);
     this.tailSize = config.tailSize ?? loadTailSize() ?? 10;
     this.directoryDebounceMs = parseDirScanDebounceEnv(process.env.THREADBASE_DIR_SCAN_DEBOUNCE_MS) ?? config.directoryScanDebounceMs ?? 1e3;
     this.scannerManager = new ScannerManager({
@@ -14804,7 +14942,7 @@ var StreamerServer = class {
         temporalClient,
         taskQueue: agentConfig.temporal.taskQueue
       });
-      const conversationsBaseDir = agentConfig.conversationsDir || join23(dirname10(this.cacheDir), "conversations");
+      const conversationsBaseDir = agentConfig.conversationsDir || join24(dirname10(this.cacheDir), "conversations");
       conversationWriter = createConversationWriter({
         baseDir: conversationsBaseDir
       });
@@ -15277,6 +15415,7 @@ var StreamerServer = class {
         try {
           this.runtimeStore = RuntimeStore.open(this.runtimeDbPath);
           this.managedSessionsRepo = new ManagedSessionsRepository(this.runtimeStore.getDatabase());
+          this.devicesRepo = new DevicesRepository(this.runtimeStore.getDatabase());
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           const abiMismatch = message.includes("NODE_MODULE_VERSION") || message.includes("was compiled against a different Node.js version");
@@ -15296,7 +15435,7 @@ var StreamerServer = class {
         }
         try {
           this.cache = ConversationCache.open(
-            join23(this.cacheDir, "cache.db"),
+            join24(this.cacheDir, "cache.db"),
             this.tailSize,
             void 0,
             {
@@ -15326,18 +15465,39 @@ var StreamerServer = class {
             if (copied > 0) {
               this.log.info(`Copied ${copied} managed session row(s) from cache.db to runtime.db`, {
                 copied,
+                table: "managed_sessions",
                 event: "runtime.legacy_import"
               });
             }
           } catch (err) {
             this.log.warn("[registry] legacy managed_sessions copy failed", {
               event: "runtime.legacy_import_failed",
+              table: "managed_sessions",
+              err
+            });
+          }
+          try {
+            const result = this.runtimeStore?.importLegacyDevices(db);
+            if (result && result.copied > 0) {
+              this.log.info(
+                `Moved ${result.copied} device row(s) from cache.db to runtime.db` + (result.purged ? "; removed the cache-side copy" : "; KEPT the cache-side copy (row count did not match after copy)"),
+                {
+                  copied: result.copied,
+                  purged: result.purged,
+                  table: "devices",
+                  event: "runtime.legacy_import"
+                }
+              );
+            }
+          } catch (err) {
+            this.log.warn("[registry] legacy devices move failed", {
+              event: "runtime.legacy_import_failed",
+              table: "devices",
               err
             });
           }
           this.cacheMetadataRepo = new CacheMetadataRepository(db);
           this.pushRepo = new PushRepository(db);
-          this.devicesRepo = new DevicesRepository(db);
           this.initLiveActivityPush(this.pushRepo);
           this.initWaitingInputPush(this.pushRepo);
           this.cacheMonitor = new CacheIntegrityMonitor(