@threadbase-sh/streamer 1.52.5 → 1.53.0

package/dist/cli.cjs

@@ -3608,7 +3608,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter5 } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join34 } = require("path");
+    var { join: join35 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -3659,7 +3659,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join34(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join35(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -4127,7 +4127,7 @@ var require_transport = __commonJS({
     var { createRequire } = require("module");
     var { existsSync: existsSync21 } = require("fs");
     var getCallers = require_caller();
-    var { join: join34, isAbsolute: isAbsolute2, sep: sep3 } = require("path");
+    var { join: join35, isAbsolute: isAbsolute2, sep: sep3 } = require("path");
     var { fileURLToPath: fileURLToPath3 } = require("url");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -4280,7 +4280,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join34(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join35(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -4298,7 +4298,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join34(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join35(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -4321,7 +4321,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join34(__dirname, "..", "file.js");
+          return join35(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -5302,7 +5302,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join34 = ",";
+            let join35 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -5316,7 +5316,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join34 = `,
+                join35 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -5324,13 +5324,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join34;
+                res += join35;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join34}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join35}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -5351,7 +5351,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join34 = `,
+              join35 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -5365,13 +5365,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join34;
+                separator = join35;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join34;
+              separator = join35;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -5412,7 +5412,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join34 = ",";
+            let join35 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -5425,7 +5425,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join34 = `,
+                join35 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -5433,13 +5433,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join34;
+                res += join35;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join34}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join35}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -5452,7 +5452,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join34 = `,
+              join35 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -5461,7 +5461,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join34;
+                separator = join35;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -5519,20 +5519,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join35 = `,
+              const join36 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join35;
+                res2 += join36;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join35}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join36}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -5548,16 +5548,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join34 = `,
+            const join35 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join34, maximumBreadth);
+              res += stringifyTypedArray(value, join35, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join34;
+              separator = join35;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -5568,13 +5568,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join34;
+                separator = join35;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join34;
+              separator = join35;
             }
             if (separator !== "") {
               res = `
@@ -6285,7 +6285,8 @@ function loadOrCreateApiKey() {
   const key = generateApiKey();
   (0, import_fs.mkdirSync)(configDir(), { recursive: true });
   (0, import_fs.writeFileSync)(configFile(), `api_key: ${key}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
+  (0, import_fs.chmodSync)(configFile(), 384);
   return key;
 }
 function loadBrowseRoot() {
@@ -96870,6 +96871,252 @@ var require_lib3 = __commonJS({
   }
 });
 
+// src/services/security/capabilities.ts
+function isCapability(value) {
+  return typeof value === "string" && CAPABILITIES.includes(value);
+}
+function capabilitiesForPreset(preset) {
+  return preset === "read-only" ? [...READ_ONLY_CAPABILITIES] : [...FULL_CAPABILITIES];
+}
+function legacyPrincipal() {
+  return { kind: "legacy", capabilities: [...FULL_CAPABILITIES, "admin"] };
+}
+function hasCapability(principal, required2) {
+  return principal.capabilities.includes(required2);
+}
+function requiredCapability(path2, method) {
+  if (path2.startsWith("/api/sessions") && (method === "GET" || method === "HEAD")) {
+    return "history:read";
+  }
+  let best = null;
+  for (const [prefix, cap] of ROUTE_CAPABILITIES) {
+    if (path2.startsWith(prefix) && (best === null || prefix.length > best.len)) {
+      best = { len: prefix.length, cap };
+    }
+  }
+  return best?.cap ?? null;
+}
+var CAPABILITIES, FULL_CAPABILITIES, READ_ONLY_CAPABILITIES, ROUTE_CAPABILITIES;
+var init_capabilities = __esm({
+  "src/services/security/capabilities.ts"() {
+    "use strict";
+    CAPABILITIES = [
+      "history:read",
+      // read conversations, search
+      "session:control",
+      // start, resume, send input, interrupt
+      "fs:browse",
+      // browse the project tree
+      "fs:upload",
+      // upload files into a project
+      "notifications",
+      // register for push
+      "admin"
+      // rotate keys, manage devices
+    ];
+    FULL_CAPABILITIES = [
+      "history:read",
+      "session:control",
+      "fs:browse",
+      "fs:upload",
+      "notifications"
+    ];
+    READ_ONLY_CAPABILITIES = ["history:read"];
+    ROUTE_CAPABILITIES = [
+      // Most specific first for readability; matching sorts by length anyway.
+      ["/api/sessions/", "session:control"],
+      ["/api/sessions", "history:read"],
+      // listing sessions is a read
+      ["/api/conversations", "history:read"],
+      ["/api/projects", "history:read"],
+      ["/api/search", "history:read"],
+      ["/api/providers", "history:read"],
+      ["/api/browse", "fs:browse"],
+      ["/api/upload", "fs:upload"],
+      ["/api/push", "notifications"],
+      ["/api/devices", "admin"],
+      ["/api/config", "admin"],
+      ["/api/auth/rotate", "admin"],
+      ["/api/backup", "admin"],
+      // Server identity and capability discovery. A read-only device must be able
+      // to see WHICH server it is talking to and what it supports, or it cannot
+      // render anything at all.
+      ["/api/info", "history:read"],
+      ["/api/profiles", "history:read"],
+      ["/api/diagnostics", "history:read"],
+      ["/api/cache/alert", "history:read"],
+      // Client log shipping: any authenticated client may report its own errors.
+      // Gating this behind a capability would silence diagnostics from exactly the
+      // devices most likely to be misbehaving.
+      ["/api/__client-log", "history:read"],
+      // Logs viewer is localhost-only and already bypasses this middleware; the
+      // mapping exists so a remote request is classified rather than denied as
+      // unclassified.
+      ["/api/logs", "admin"],
+      // Pairing routes other than the public exchange (e.g. minting a token).
+      ["/api/pair", "admin"],
+      // The live WebSocket. Subscribing is a read — terminal output, session
+      // updates, conversation events. Control still flows through the HTTP input
+      // routes, which carry their own capability check, so a read-only device can
+      // watch a session stream without being able to drive it.
+      ["/ws", "history:read"],
+      // Progress webhook (multi-agent). Authenticated by HMAC in the handler and
+      // already skipped by the middleware; classified so a stray request is denied
+      // by rule rather than as "unclassified".
+      ["/internal/sessions", "admin"]
+    ];
+  }
+});
+
+// src/db/repositories/devices.repository.ts
+var devices_repository_exports = {};
+__export(devices_repository_exports, {
+  DevicesRepository: () => DevicesRepository,
+  generateDeviceToken: () => generateDeviceToken,
+  hashDeviceToken: () => hashDeviceToken,
+  parseCapabilities: () => parseCapabilities,
+  safeHashEquals: () => safeHashEquals,
+  toDeviceView: () => toDeviceView
+});
+function generateDeviceToken() {
+  return (0, import_crypto3.randomBytes)(32).toString("base64url");
+}
+function hashDeviceToken(token) {
+  return (0, import_crypto3.createHash)("sha256").update(token).digest("hex");
+}
+function safeHashEquals(a, b2) {
+  if (a.length !== b2.length) return false;
+  return (0, import_crypto3.timingSafeEqual)(Buffer.from(a, "utf8"), Buffer.from(b2, "utf8"));
+}
+function parseCapabilities(raw2) {
+  try {
+    const parsed = JSON.parse(raw2);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter(isCapability);
+  } catch {
+    return [];
+  }
+}
+function toDeviceView(row) {
+  return {
+    deviceId: row.device_id,
+    name: row.name,
+    capabilities: parseCapabilities(row.capabilities),
+    createdAt: row.created_at,
+    lastSeenAt: row.last_seen_at,
+    revokedAt: row.revoked_at
+  };
+}
+var import_crypto3, DevicesRepository;
+var init_devices_repository = __esm({
+  "src/db/repositories/devices.repository.ts"() {
+    "use strict";
+    import_crypto3 = require("crypto");
+    init_capabilities();
+    DevicesRepository = class {
+      insertStmt;
+      byTokenHashStmt;
+      byIdStmt;
+      listStmt;
+      revokeStmt;
+      touchStmt;
+      deleteStmt;
+      deleteRevokedStmt;
+      constructor(db) {
+        this.insertStmt = db.prepare(`
+      INSERT INTO devices (
+        device_id, public_key, token_hash, name, capabilities, created_at
+      ) VALUES (
+        @device_id, @public_key, @token_hash, @name, @capabilities, @created_at
+      )
+    `);
+        this.byTokenHashStmt = db.prepare("SELECT * FROM devices WHERE token_hash = ?");
+        this.byIdStmt = db.prepare("SELECT * FROM devices WHERE device_id = ?");
+        this.listStmt = db.prepare("SELECT * FROM devices ORDER BY created_at DESC");
+        this.revokeStmt = db.prepare("UPDATE devices SET revoked_at = ? WHERE device_id = ?");
+        this.touchStmt = db.prepare("UPDATE devices SET last_seen_at = ? WHERE device_id = ?");
+        this.deleteStmt = db.prepare("DELETE FROM devices WHERE device_id = ?");
+        this.deleteRevokedStmt = db.prepare("DELETE FROM devices WHERE revoked_at IS NOT NULL");
+      }
+      /**
+       * Record a newly paired device and mint its token.
+       *
+       * The raw token is returned to the caller and never stored — this is the only
+       * moment it exists outside the client.
+       */
+      register(args) {
+        const deviceId = (0, import_crypto3.randomUUID)();
+        const deviceToken = generateDeviceToken();
+        const capabilities = capabilitiesForPreset(args.preset ?? "full");
+        this.insertStmt.run({
+          device_id: deviceId,
+          public_key: args.publicKey,
+          token_hash: hashDeviceToken(deviceToken),
+          name: args.name ?? null,
+          capabilities: JSON.stringify(capabilities),
+          created_at: args.now ?? Date.now()
+        });
+        return { deviceId, deviceToken, capabilities };
+      }
+      /**
+       * Resolve a presented token to a device, or null.
+       *
+       * Returns null for a revoked device, so revocation takes effect on the very
+       * next request with no cache to go stale.
+       */
+      authenticate(token) {
+        const hash2 = hashDeviceToken(token);
+        const row = this.byTokenHashStmt.get(hash2);
+        if (!row) return null;
+        if (!safeHashEquals(row.token_hash, hash2)) return null;
+        if (row.revoked_at != null) return null;
+        return row;
+      }
+      get(deviceId) {
+        return this.byIdStmt.get(deviceId) ?? null;
+      }
+      /** All devices, including revoked ones — an audit surface needs the history. */
+      list() {
+        return this.listStmt.all().map(toDeviceView);
+      }
+      /** Revoke one device. Others are untouched — no key rotation, no collateral. */
+      revoke(deviceId, now = Date.now()) {
+        return this.revokeStmt.run(now, deviceId).changes > 0;
+      }
+      /**
+       * Erase one device's record outright.
+       *
+       * Deliberately separate from `revoke`, which is a soft delete that keeps the
+       * row so `list()` can show what happened. That audit trail is the right
+       * default — but it meant a `devices` row, including the user-supplied `name`
+       * ("Ronen's iPhone"), had no removal path at all once the registry moved to
+       * runtime.db, which no command deletes. This is that path.
+       *
+       * Erasure is NOT revocation: deleting a row frees its `token_hash`, so a
+       * device whose token is still on a phone somewhere stops being *known* rather
+       * than being *refused*. Revoke first, delete second, is the safe order, and
+       * `deleteRevoked()` exists so that is the easy thing to do.
+       */
+      delete(deviceId) {
+        return this.deleteStmt.run(deviceId).changes > 0;
+      }
+      /**
+       * Erase every already-revoked device. The bulk companion to `delete`, and the
+       * one that is safe by construction: a revoked device is already refused, so
+       * removing its row cannot restore access to anything.
+       *
+       * Returns the number of rows removed.
+       */
+      deleteRevoked() {
+        return this.deleteRevokedStmt.run().changes;
+      }
+      touch(deviceId, now = Date.now()) {
+        this.touchStmt.run(now, deviceId);
+      }
+    };
+  }
+});
+
 // src/platform.ts
 function isWindowsExecutablePath(path2) {
   const dot = path2.lastIndexOf(".");
@@ -102777,6 +103024,132 @@ var require_out4 = __commonJS({
   }
 });
 
+// src/db/query-timing.ts
+function deriveLabel(sql) {
+  const verb = /^\s*(\w+)/.exec(sql)?.[1]?.toLowerCase() ?? "sql";
+  const table = /(?:from|into|update)\s+([A-Za-z_]\w*)/i.exec(sql)?.[1] ?? "?";
+  return `${verb}:${table}`;
+}
+function resolveSlowMs() {
+  const raw2 = process.env.THREADBASE_DB_SLOW_QUERY_MS;
+  if (raw2 === void 0 || raw2 === "") return DEFAULT_SLOW_QUERY_MS;
+  const parsed = Number(raw2);
+  return Number.isFinite(parsed) ? parsed : DEFAULT_SLOW_QUERY_MS;
+}
+function record2(label, ms2, rows, slowMs) {
+  if (slowMs > 0 && ms2 >= slowMs) {
+    log2.warn(
+      `[db] slow query ${label} ${ms2.toFixed(1)}ms rows=${rows}`,
+      { event: "db.slow_query", stmt: label, ms: Math.round(ms2 * 100) / 100, rows },
+      "pino"
+    );
+    return;
+  }
+  if (log2.pino.isLevelEnabled("debug")) {
+    log2.debug(
+      `[db] ${label} ${ms2.toFixed(2)}ms rows=${rows}`,
+      { event: "db.query", stmt: label, ms: Math.round(ms2 * 100) / 100, rows },
+      "pino"
+    );
+  }
+}
+function rowsOf(method, result) {
+  if (method === "all") return Array.isArray(result) ? result.length : 0;
+  if (method === "run") return result?.changes ?? 0;
+  return result === void 0 ? 0 : 1;
+}
+function instrumentDatabase(db, options = {}) {
+  const slowMs = options.slowMs ?? resolveSlowMs();
+  const prepare = db.prepare.bind(db);
+  db.prepare = ((sql) => {
+    const stmt = prepare(sql);
+    const box = { label: deriveLabel(sql) };
+    Object.defineProperty(stmt, LABEL, { value: box, configurable: true });
+    for (const method of ["get", "all", "run"]) {
+      const original = stmt[method].bind(stmt);
+      Object.defineProperty(stmt, method, {
+        configurable: true,
+        writable: true,
+        value: (...args) => {
+          const started = performance.now();
+          const result = original(...args);
+          record2(box.label, performance.now() - started, rowsOf(method, result), slowMs);
+          return result;
+        }
+      });
+    }
+    return stmt;
+  });
+  return db;
+}
+function labelStatements(statements) {
+  for (const [name, stmt] of Object.entries(statements)) {
+    const box = stmt?.[LABEL];
+    if (box) box.label = name;
+  }
+}
+var log2, DEFAULT_SLOW_QUERY_MS, LABEL;
+var init_query_timing = __esm({
+  "src/db/query-timing.ts"() {
+    "use strict";
+    init_logger();
+    log2 = getLogger("db");
+    DEFAULT_SLOW_QUERY_MS = 35;
+    LABEL = /* @__PURE__ */ Symbol("tbQueryLabel");
+  }
+});
+
+// src/db/sqlite-migrate.ts
+function getMigrationsDir() {
+  if (typeof import_meta2 !== "undefined" && import_meta2.url) {
+    return (0, import_path14.dirname)((0, import_url6.fileURLToPath)(import_meta2.url));
+  }
+  return __dirname;
+}
+function resolveMigrationsDir(name = "migrations") {
+  return (0, import_path14.join)(getMigrationsDir(), name);
+}
+function runSqliteMigrations(db, migrationsDir) {
+  db.exec(SCHEMA_MIGRATIONS_SQL);
+  const dir = migrationsDir ?? resolveMigrationsDir();
+  const files = (0, import_fs15.readdirSync)(dir).filter((f2) => f2.endsWith(".sql")).sort();
+  const appliedRows = db.prepare("SELECT id FROM schema_migrations").all();
+  const appliedSet = new Set(appliedRows.map((r) => r.id));
+  const recordApplied = db.prepare("INSERT INTO schema_migrations (id, applied_at) VALUES (?, ?)");
+  const applied = [];
+  const skipped = [];
+  for (const file2 of files) {
+    if (appliedSet.has(file2)) {
+      skipped.push(file2);
+      continue;
+    }
+    const sql = (0, import_fs15.readFileSync)((0, import_path14.join)(dir, file2), "utf-8");
+    const tx = db.transaction(() => {
+      db.exec(sql);
+      recordApplied.run(file2, (/* @__PURE__ */ new Date()).toISOString());
+    });
+    tx();
+    applied.push(file2);
+  }
+  return { applied, skipped };
+}
+var import_fs15, import_path14, import_url6, import_meta2, SCHEMA_MIGRATIONS_SQL;
+var init_sqlite_migrate = __esm({
+  "src/db/sqlite-migrate.ts"() {
+    "use strict";
+    import_fs15 = require("fs");
+    import_path14 = require("path");
+    import_url6 = require("url");
+    import_meta2 = {};
+    SCHEMA_MIGRATIONS_SQL = `
+CREATE TABLE IF NOT EXISTS schema_migrations (
+  id TEXT PRIMARY KEY,
+  applied_at TEXT NOT NULL
+);
+`;
+  }
+});
+
 // src/services/questions/codexScreen.ts
 function parseCodexNumberedOptions(lines) {
   const options = [];
@@ -114874,6 +115247,113 @@ var init_esm2 = __esm({
   }
 });
 
+// src/db/runtime-store.ts
+var runtime_store_exports = {};
+__export(runtime_store_exports, {
+  RuntimeStore: () => RuntimeStore,
+  resolveRuntimeDbPath: () => resolveRuntimeDbPath
+});
+function resolveRuntimeDbPath(override) {
+  return override ?? process.env.THREADBASE_RUNTIME_DB ?? (0, import_path23.join)(process.env.THREADBASE_CONFIG_DIR ?? (0, import_path23.join)((0, import_os9.homedir)(), ".threadbase"), "runtime.db");
+}
+var import_better_sqlite33, import_os9, import_path23, RuntimeStore;
+var init_runtime_store = __esm({
+  "src/db/runtime-store.ts"() {
+    "use strict";
+    import_better_sqlite33 = __toESM(require("better-sqlite3"), 1);
+    import_os9 = require("os");
+    import_path23 = require("path");
+    init_query_timing();
+    init_sqlite_migrate();
+    RuntimeStore = class _RuntimeStore {
+      constructor(db) {
+        this.db = db;
+      }
+      db;
+      static open(dbPath, migrationsDir) {
+        const db = instrumentDatabase(new import_better_sqlite33.default(dbPath));
+        db.pragma("journal_mode = WAL");
+        runSqliteMigrations(db, migrationsDir ?? resolveMigrationsDir("runtime-migrations"));
+        return new _RuntimeStore(db);
+      }
+      getDatabase() {
+        return this.db;
+      }
+      /**
+       * One-time move of `managed_sessions` rows out of a pre-split `cache.db`.
+       *
+       * Returns the number of rows copied.
+       */
+      importLegacyManagedSessions(source) {
+        return this.importLegacyTable(source, "managed_sessions");
+      }
+      /**
+       * One-time move of `devices` rows out of `cache.db`, where the registry used
+       * to live (migration `011_create_devices.sql`).
+       *
+       * Losing this table invalidates every device token ever issued, and cache.db
+       * is the file `tb-streamer cache clear` deletes and the integrity monitor
+       * rebuilds — see `runtime-migrations/003_create_devices.sql`.
+       *
+       * Unlike `managed_sessions`, this one MOVES rather than copies: the source
+       * rows are deleted once the copy is verified. A `devices` row carries a
+       * user-supplied label ("Ronen's iPhone"), and leaving a second copy of that
+       * on disk indefinitely — in the one file the user is told to delete when
+       * something goes wrong — is more retained personal data than the rollback
+       * path is worth. Recovering from a rollback is re-scanning a pairing QR.
+       *
+       * The delete is conditional on the copy being complete: `INSERT OR IGNORE`
+       * can silently skip a row, so the destination count must match what was read
+       * before anything is removed. A mismatch keeps the source and reports
+       * `purged: false` rather than throwing — the import itself still succeeded,
+       * and keeping data is the safe direction to fail in.
+       */
+      importLegacyDevices(source) {
+        const copied = this.importLegacyTable(source, "devices");
+        if (copied === 0) return { copied: 0, purged: false };
+        const landed = this.db.prepare("SELECT COUNT(*) AS n FROM devices").get().n;
+        if (landed !== copied) return { copied, purged: false };
+        source.prepare("DELETE FROM devices").run();
+        return { copied, purged: true };
+      }
+      /**
+       * Copy a whole table out of a pre-split `cache.db` into this file.
+       *
+       * The copy itself is non-destructive — the source is left in place, so an
+       * older streamer rolled back onto the same machine still finds its data.
+       * `importLegacyDevices` deletes the source afterwards for its own reasons;
+       * `managed_sessions` does not. Runs only when this file's table is empty, so
+       * a second boot is a no-op rather than a re-copy that would resurrect rows
+       * deleted since.
+       *
+       * The table name is interpolated into SQL, so it is typed as a closed union
+       * rather than `string` — the set of tables that can ever be lifted is known
+       * at compile time, and that is what keeps a caller from making this a hole.
+       */
+      importLegacyTable(source, table) {
+        const existing = this.db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get();
+        if (existing.n > 0) return 0;
+        const hasTable = source.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+        if (!hasTable) return 0;
+        const rows = source.prepare(`SELECT * FROM ${table}`).all();
+        if (rows.length === 0) return 0;
+        const columns = Object.keys(rows[0]);
+        const insert = this.db.prepare(
+          `INSERT OR IGNORE INTO ${table} (${columns.join(", ")})
+       VALUES (${columns.map((c) => `@${c}`).join(", ")})`
+        );
+        this.db.transaction((batch) => {
+          for (const row of batch) insert.run(row);
+        })(rows);
+        return rows.length;
+      }
+      close() {
+        this.db.close();
+      }
+    };
+  }
+});
+
 // node_modules/@xterm/headless/lib-headless/xterm-headless.js
 var require_xterm_headless = __commonJS({
   "node_modules/@xterm/headless/lib-headless/xterm-headless.js"(exports2) {
@@ -119964,8 +120444,8 @@ var init_pty_shared = __esm({
 
 // src/services/questions/codexGateAnswers.ts
 function gateAnswersPath() {
-  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path23.join)((0, import_os9.homedir)(), ".threadbase");
-  return (0, import_path23.join)(dir, "gate-answers.json");
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path24.join)((0, import_os10.homedir)(), ".threadbase");
+  return (0, import_path24.join)(dir, "gate-answers.json");
 }
 function loadGateAnswers() {
   try {
@@ -119977,7 +120457,7 @@ function loadGateAnswers() {
 }
 function saveGateAnswer(key, value) {
   const path2 = gateAnswersPath();
-  (0, import_fs24.mkdirSync)((0, import_path23.dirname)(path2), { recursive: true });
+  (0, import_fs24.mkdirSync)((0, import_path24.dirname)(path2), { recursive: true });
   (0, import_fs24.writeFileSync)(path2, `${JSON.stringify({ ...loadGateAnswers(), [key]: value }, null, 2)}
 `);
 }
@@ -119990,13 +120470,13 @@ function rememberedGateDigit(gate) {
   }
   return answers.codexTrustGate === "yes" ? "1" : null;
 }
-var import_fs24, import_os9, import_path23;
+var import_fs24, import_os10, import_path24;
 var init_codexGateAnswers = __esm({
   "src/services/questions/codexGateAnswers.ts"() {
     "use strict";
     import_fs24 = require("fs");
-    import_os9 = require("os");
-    import_path23 = require("path");
+    import_os10 = require("os");
+    import_path24 = require("path");
   }
 });
 
@@ -120057,13 +120537,13 @@ function toPublicSession(s3) {
     ...s3.filePath != null && { filePath: s3.filePath }
   };
 }
-var import_crypto9, import_fs25, import_path24, OUTPUT_BUFFER_MAX, INPUT_HISTORY_MAX, QUIET_DETECT_MS, CODEX_READY_FALLBACK_MS, SUBMIT_BYTES, CODEX_SUBMIT_DELAY_MS, CODEX_SUBMIT_MAX_WAIT_MS, CODEX_SUBMIT_STALE_MS, CodexPtyRunner;
+var import_crypto9, import_fs25, import_path25, OUTPUT_BUFFER_MAX, INPUT_HISTORY_MAX, QUIET_DETECT_MS, CODEX_READY_FALLBACK_MS, SUBMIT_BYTES, CODEX_SUBMIT_DELAY_MS, CODEX_SUBMIT_MAX_WAIT_MS, CODEX_SUBMIT_STALE_MS, CodexPtyRunner;
 var init_codex_pty_runner = __esm({
   "src/codex-pty-runner.ts"() {
     "use strict";
     import_crypto9 = require("crypto");
     import_fs25 = require("fs");
-    import_path24 = require("path");
+    import_path25 = require("path");
     init_logger();
     init_platform();
     init_providers();
@@ -120164,7 +120644,7 @@ var init_codex_pty_runner = __esm({
       // resume, fresh and fork is argv.
       async launch(sessionId, args, options) {
         const nodePty = await loadPty();
-        const projectName = options.projectName ?? (0, import_path24.basename)(options.projectPath);
+        const projectName = options.projectName ?? (0, import_path25.basename)(options.projectPath);
         let proc;
         try {
           proc = nodePty.spawn(resolveCodexExe(), args, {
@@ -121407,13 +121887,13 @@ function toPublicSession2(s3) {
     ...s3.firstMessageText != null && { firstMessageText: s3.firstMessageText }
   };
 }
-var import_crypto10, import_fs26, import_path25, OUTPUT_BUFFER_MAX2, INPUT_HISTORY_MAX2, CLAUDE_PROMPT_MARKERS, QUIET_DETECT_MS2, OSC_TAIL_CHARS, SCRAPE_THROTTLE_MS, CLAUDE_READY_FALLBACK_MS, SUBMIT_BYTES2, SUBMIT_DELAY_MS, SUBMIT_MAX_WAIT_MS, PTYManager;
+var import_crypto10, import_fs26, import_path26, OUTPUT_BUFFER_MAX2, INPUT_HISTORY_MAX2, CLAUDE_PROMPT_MARKERS, QUIET_DETECT_MS2, OSC_TAIL_CHARS, SCRAPE_THROTTLE_MS, CLAUDE_READY_FALLBACK_MS, SUBMIT_BYTES2, SUBMIT_DELAY_MS, SUBMIT_MAX_WAIT_MS, PTYManager;
 var init_pty_manager = __esm({
   "src/pty-manager.ts"() {
     "use strict";
     import_crypto10 = require("crypto");
     import_fs26 = require("fs");
-    import_path25 = require("path");
+    import_path26 = require("path");
     init_claude_flags();
     init_logger();
     init_platform();
@@ -121535,7 +122015,7 @@ var init_pty_manager = __esm({
       }
       async doStart(sessionId, options) {
         const nodePty = await loadPty();
-        const projectName = options.projectName ?? (0, import_path25.basename)(options.projectPath);
+        const projectName = options.projectName ?? (0, import_path26.basename)(options.projectPath);
         const permissionMode = options.permissionMode ?? "acceptEdits";
         const args = [
           "--permission-mode",
@@ -121599,7 +122079,7 @@ var init_pty_manager = __esm({
       async startFresh(options) {
         const nodePty = await loadPty();
         const sessionId = (0, import_crypto10.randomUUID)();
-        const projectName = options.projectName ?? (0, import_path25.basename)(options.projectPath);
+        const projectName = options.projectName ?? (0, import_path26.basename)(options.projectPath);
         const permissionMode = options.permissionMode ?? "acceptEdits";
         const args = [
           "--permission-mode",
@@ -122205,11 +122685,11 @@ var init_pty_manager = __esm({
 });
 
 // src/live-session-manager.ts
-var import_path26, LiveSessionManager;
+var import_path27, LiveSessionManager;
 var init_live_session_manager = __esm({
   "src/live-session-manager.ts"() {
     "use strict";
-    import_path26 = require("path");
+    import_path27 = require("path");
     init_codex_pty_runner();
     init_providers();
     init_remote_session_runner();
@@ -122352,7 +122832,7 @@ var init_live_session_manager = __esm({
         const runner = this.runners.get(provider);
         if (runner) return runner;
         const err = new Error(
-          `Live ${provider} sessions are not implemented yet for ${(0, import_path26.basename)(projectPath)}`
+          `Live ${provider} sessions are not implemented yet for ${(0, import_path27.basename)(projectPath)}`
         );
         err.statusCode = 501;
         throw err;
@@ -131471,8 +131951,8 @@ var import_events2 = require("events");
 var import_fs38 = require("fs");
 var import_promises16 = require("fs/promises");
 var import_http = require("http");
-var import_os15 = require("os");
-var import_path33 = require("path");
+var import_os16 = require("os");
+var import_path34 = require("path");
 
 // src/agent/agent-client.ts
 var userInputSignal = { type: "signal", name: "userInput" };
@@ -133697,203 +134177,8 @@ init_logger();
 
 // src/api/middleware/auth.middleware.ts
 init_auth();
-
-// src/db/repositories/devices.repository.ts
-var import_crypto3 = require("crypto");
-
-// src/services/security/capabilities.ts
-var CAPABILITIES = [
-  "history:read",
-  // read conversations, search
-  "session:control",
-  // start, resume, send input, interrupt
-  "fs:browse",
-  // browse the project tree
-  "fs:upload",
-  // upload files into a project
-  "notifications",
-  // register for push
-  "admin"
-  // rotate keys, manage devices
-];
-function isCapability(value) {
-  return typeof value === "string" && CAPABILITIES.includes(value);
-}
-var FULL_CAPABILITIES = [
-  "history:read",
-  "session:control",
-  "fs:browse",
-  "fs:upload",
-  "notifications"
-];
-var READ_ONLY_CAPABILITIES = ["history:read"];
-function capabilitiesForPreset(preset) {
-  return preset === "read-only" ? [...READ_ONLY_CAPABILITIES] : [...FULL_CAPABILITIES];
-}
-function legacyPrincipal() {
-  return { kind: "legacy", capabilities: [...FULL_CAPABILITIES, "admin"] };
-}
-function hasCapability(principal, required2) {
-  return principal.capabilities.includes(required2);
-}
-var ROUTE_CAPABILITIES = [
-  // Most specific first for readability; matching sorts by length anyway.
-  ["/api/sessions/", "session:control"],
-  ["/api/sessions", "history:read"],
-  // listing sessions is a read
-  ["/api/conversations", "history:read"],
-  ["/api/projects", "history:read"],
-  ["/api/search", "history:read"],
-  ["/api/providers", "history:read"],
-  ["/api/browse", "fs:browse"],
-  ["/api/upload", "fs:upload"],
-  ["/api/push", "notifications"],
-  ["/api/devices", "admin"],
-  ["/api/config", "admin"],
-  ["/api/auth/rotate", "admin"],
-  ["/api/backup", "admin"],
-  // Server identity and capability discovery. A read-only device must be able
-  // to see WHICH server it is talking to and what it supports, or it cannot
-  // render anything at all.
-  ["/api/info", "history:read"],
-  ["/api/profiles", "history:read"],
-  ["/api/diagnostics", "history:read"],
-  ["/api/cache/alert", "history:read"],
-  // Client log shipping: any authenticated client may report its own errors.
-  // Gating this behind a capability would silence diagnostics from exactly the
-  // devices most likely to be misbehaving.
-  ["/api/__client-log", "history:read"],
-  // Logs viewer is localhost-only and already bypasses this middleware; the
-  // mapping exists so a remote request is classified rather than denied as
-  // unclassified.
-  ["/api/logs", "admin"],
-  // Pairing routes other than the public exchange (e.g. minting a token).
-  ["/api/pair", "admin"],
-  // The live WebSocket. Subscribing is a read — terminal output, session
-  // updates, conversation events. Control still flows through the HTTP input
-  // routes, which carry their own capability check, so a read-only device can
-  // watch a session stream without being able to drive it.
-  ["/ws", "history:read"],
-  // Progress webhook (multi-agent). Authenticated by HMAC in the handler and
-  // already skipped by the middleware; classified so a stray request is denied
-  // by rule rather than as "unclassified".
-  ["/internal/sessions", "admin"]
-];
-function requiredCapability(path2, method) {
-  if (path2.startsWith("/api/sessions") && (method === "GET" || method === "HEAD")) {
-    return "history:read";
-  }
-  let best = null;
-  for (const [prefix, cap] of ROUTE_CAPABILITIES) {
-    if (path2.startsWith(prefix) && (best === null || prefix.length > best.len)) {
-      best = { len: prefix.length, cap };
-    }
-  }
-  return best?.cap ?? null;
-}
-
-// src/db/repositories/devices.repository.ts
-function generateDeviceToken() {
-  return (0, import_crypto3.randomBytes)(32).toString("base64url");
-}
-function hashDeviceToken(token) {
-  return (0, import_crypto3.createHash)("sha256").update(token).digest("hex");
-}
-function safeHashEquals(a, b2) {
-  if (a.length !== b2.length) return false;
-  return (0, import_crypto3.timingSafeEqual)(Buffer.from(a, "utf8"), Buffer.from(b2, "utf8"));
-}
-function parseCapabilities(raw2) {
-  try {
-    const parsed = JSON.parse(raw2);
-    if (!Array.isArray(parsed)) return [];
-    return parsed.filter(isCapability);
-  } catch {
-    return [];
-  }
-}
-function toDeviceView(row) {
-  return {
-    deviceId: row.device_id,
-    name: row.name,
-    capabilities: parseCapabilities(row.capabilities),
-    createdAt: row.created_at,
-    lastSeenAt: row.last_seen_at,
-    revokedAt: row.revoked_at
-  };
-}
-var DevicesRepository = class {
-  insertStmt;
-  byTokenHashStmt;
-  byIdStmt;
-  listStmt;
-  revokeStmt;
-  touchStmt;
-  constructor(db) {
-    this.insertStmt = db.prepare(`
-      INSERT INTO devices (
-        device_id, public_key, token_hash, name, capabilities, created_at
-      ) VALUES (
-        @device_id, @public_key, @token_hash, @name, @capabilities, @created_at
-      )
-    `);
-    this.byTokenHashStmt = db.prepare("SELECT * FROM devices WHERE token_hash = ?");
-    this.byIdStmt = db.prepare("SELECT * FROM devices WHERE device_id = ?");
-    this.listStmt = db.prepare("SELECT * FROM devices ORDER BY created_at DESC");
-    this.revokeStmt = db.prepare("UPDATE devices SET revoked_at = ? WHERE device_id = ?");
-    this.touchStmt = db.prepare("UPDATE devices SET last_seen_at = ? WHERE device_id = ?");
-  }
-  /**
-   * Record a newly paired device and mint its token.
-   *
-   * The raw token is returned to the caller and never stored — this is the only
-   * moment it exists outside the client.
-   */
-  register(args) {
-    const deviceId = (0, import_crypto3.randomUUID)();
-    const deviceToken = generateDeviceToken();
-    const capabilities = capabilitiesForPreset(args.preset ?? "full");
-    this.insertStmt.run({
-      device_id: deviceId,
-      public_key: args.publicKey,
-      token_hash: hashDeviceToken(deviceToken),
-      name: args.name ?? null,
-      capabilities: JSON.stringify(capabilities),
-      created_at: args.now ?? Date.now()
-    });
-    return { deviceId, deviceToken, capabilities };
-  }
-  /**
-   * Resolve a presented token to a device, or null.
-   *
-   * Returns null for a revoked device, so revocation takes effect on the very
-   * next request with no cache to go stale.
-   */
-  authenticate(token) {
-    const hash2 = hashDeviceToken(token);
-    const row = this.byTokenHashStmt.get(hash2);
-    if (!row) return null;
-    if (!safeHashEquals(row.token_hash, hash2)) return null;
-    if (row.revoked_at != null) return null;
-    return row;
-  }
-  get(deviceId) {
-    return this.byIdStmt.get(deviceId) ?? null;
-  }
-  /** All devices, including revoked ones — an audit surface needs the history. */
-  list() {
-    return this.listStmt.all().map(toDeviceView);
-  }
-  /** Revoke one device. Others are untouched — no key rotation, no collateral. */
-  revoke(deviceId, now = Date.now()) {
-    return this.revokeStmt.run(now, deviceId).changes > 0;
-  }
-  touch(deviceId, now = Date.now()) {
-    this.touchStmt.run(now, deviceId);
-  }
-};
-
-// src/api/middleware/auth.middleware.ts
+init_devices_repository();
+init_capabilities();
 function isLocalRequest(remoteAddr) {
   const addr = remoteAddr ?? "";
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
@@ -134404,6 +134689,34 @@ var createDeviceRoutes = (deps) => {
     repo.revoke(id);
     return c.json({ ok: true, alreadyRevoked: false });
   });
+  app.delete("/:id", (c) => {
+    const repo = deps.devicesRepo();
+    if (!repo) {
+      return c.json({ error: "Device registry is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    const id = c.req.param("id");
+    const existing = repo.get(id);
+    if (!existing) return c.json({ ok: true, alreadyDeleted: true });
+    const force = c.req.query("force") === "1" || c.req.query("force") === "true";
+    if (existing.revoked_at == null && !force) {
+      return c.json(
+        {
+          error: "Revoke the device before deleting it, or pass ?force=1",
+          code: "DEVICE_ACTIVE"
+        },
+        409
+      );
+    }
+    repo.delete(id);
+    return c.json({ ok: true, alreadyDeleted: false });
+  });
+  app.delete("/", (c) => {
+    const repo = deps.devicesRepo();
+    if (!repo) {
+      return c.json({ error: "Device registry is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    return c.json({ ok: true, deleted: repo.deleteRevoked() });
+  });
   return app;
 };
 
@@ -135278,6 +135591,13 @@ var createMiscRoutes = (deps) => {
       // Same contract: this server serves GET /api/projects/summary, which the
       // Hub's grouped views need before they can draw a tree.
       projectSummary: true,
+      // The paired-device registry lives in runtime.db, so it survives
+      // `tb-streamer cache clear` and the integrity monitor's reset-and-rescan.
+      // A client may only prefer its scoped device token over the shared API
+      // key when this is true: on an older server the registry is inside
+      // cache.db, where a documented troubleshooting step deletes it and every
+      // device token with it. Absent means "old server, assume not durable".
+      devicesDurable: true,
       // Delivery capability, not endpoint support: whether this server can
       // actually send a push, so mobile can hide an affordance instead of
       // registering tokens nothing will ever send to. Absent on older servers,
@@ -135817,7 +136137,13 @@ var createWsRoutes = (deps, upgradeWebSocket) => {
   const app = new Hono2();
   app.get(
     "/ws",
-    upgradeWebSocket(() => {
+    // The principal is read here, at the upgrade, and captured for the life of
+    // the socket. authMiddleware sets it because /ws is classified
+    // `history:read`, but it only ever reaches the HTTP request — without
+    // capturing it the socket has no principal at all, so every frame after
+    // the upgrade is unauthorized-by-omission.
+    upgradeWebSocket((c) => {
+      const principal = c.get("principal") ?? null;
       let openWs = null;
       return {
         onOpen(_evt, ws2) {
@@ -135827,7 +136153,7 @@ var createWsRoutes = (deps, upgradeWebSocket) => {
           deps.handleWsOpen(raw2);
         },
         onMessage(evt, _ws) {
-          if (openWs) deps.handleWsMessage(openWs, evt.data);
+          if (openWs) deps.handleWsMessage(openWs, evt.data, principal);
         },
         onClose(_evt, _ws) {
           if (openWs) deps.handleWsClose(openWs);
@@ -143257,122 +143583,8 @@ var import_fs17 = require("fs");
 var import_promises11 = require("fs/promises");
 var import_path16 = require("path");
 var import_promises12 = require("timers/promises");
-
-// src/db/query-timing.ts
-init_logger();
-var log2 = getLogger("db");
-var DEFAULT_SLOW_QUERY_MS = 35;
-var LABEL = /* @__PURE__ */ Symbol("tbQueryLabel");
-function deriveLabel(sql) {
-  const verb = /^\s*(\w+)/.exec(sql)?.[1]?.toLowerCase() ?? "sql";
-  const table = /(?:from|into|update)\s+([A-Za-z_]\w*)/i.exec(sql)?.[1] ?? "?";
-  return `${verb}:${table}`;
-}
-function resolveSlowMs() {
-  const raw2 = process.env.THREADBASE_DB_SLOW_QUERY_MS;
-  if (raw2 === void 0 || raw2 === "") return DEFAULT_SLOW_QUERY_MS;
-  const parsed = Number(raw2);
-  return Number.isFinite(parsed) ? parsed : DEFAULT_SLOW_QUERY_MS;
-}
-function record2(label, ms2, rows, slowMs) {
-  if (slowMs > 0 && ms2 >= slowMs) {
-    log2.warn(
-      `[db] slow query ${label} ${ms2.toFixed(1)}ms rows=${rows}`,
-      { event: "db.slow_query", stmt: label, ms: Math.round(ms2 * 100) / 100, rows },
-      "pino"
-    );
-    return;
-  }
-  if (log2.pino.isLevelEnabled("debug")) {
-    log2.debug(
-      `[db] ${label} ${ms2.toFixed(2)}ms rows=${rows}`,
-      { event: "db.query", stmt: label, ms: Math.round(ms2 * 100) / 100, rows },
-      "pino"
-    );
-  }
-}
-function rowsOf(method, result) {
-  if (method === "all") return Array.isArray(result) ? result.length : 0;
-  if (method === "run") return result?.changes ?? 0;
-  return result === void 0 ? 0 : 1;
-}
-function instrumentDatabase(db, options = {}) {
-  const slowMs = options.slowMs ?? resolveSlowMs();
-  const prepare = db.prepare.bind(db);
-  db.prepare = ((sql) => {
-    const stmt = prepare(sql);
-    const box = { label: deriveLabel(sql) };
-    Object.defineProperty(stmt, LABEL, { value: box, configurable: true });
-    for (const method of ["get", "all", "run"]) {
-      const original = stmt[method].bind(stmt);
-      Object.defineProperty(stmt, method, {
-        configurable: true,
-        writable: true,
-        value: (...args) => {
-          const started = performance.now();
-          const result = original(...args);
-          record2(box.label, performance.now() - started, rowsOf(method, result), slowMs);
-          return result;
-        }
-      });
-    }
-    return stmt;
-  });
-  return db;
-}
-function labelStatements(statements) {
-  for (const [name, stmt] of Object.entries(statements)) {
-    const box = stmt?.[LABEL];
-    if (box) box.label = name;
-  }
-}
-
-// src/db/sqlite-migrate.ts
-var import_fs15 = require("fs");
-var import_path14 = require("path");
-var import_url6 = require("url");
-var import_meta2 = {};
-function getMigrationsDir() {
-  if (typeof import_meta2 !== "undefined" && import_meta2.url) {
-    return (0, import_path14.dirname)((0, import_url6.fileURLToPath)(import_meta2.url));
-  }
-  return __dirname;
-}
-function resolveMigrationsDir(name = "migrations") {
-  return (0, import_path14.join)(getMigrationsDir(), name);
-}
-var SCHEMA_MIGRATIONS_SQL = `
-CREATE TABLE IF NOT EXISTS schema_migrations (
-  id TEXT PRIMARY KEY,
-  applied_at TEXT NOT NULL
-);
-`;
-function runSqliteMigrations(db, migrationsDir) {
-  db.exec(SCHEMA_MIGRATIONS_SQL);
-  const dir = migrationsDir ?? resolveMigrationsDir();
-  const files = (0, import_fs15.readdirSync)(dir).filter((f2) => f2.endsWith(".sql")).sort();
-  const appliedRows = db.prepare("SELECT id FROM schema_migrations").all();
-  const appliedSet = new Set(appliedRows.map((r) => r.id));
-  const recordApplied = db.prepare("INSERT INTO schema_migrations (id, applied_at) VALUES (?, ?)");
-  const applied = [];
-  const skipped = [];
-  for (const file2 of files) {
-    if (appliedSet.has(file2)) {
-      skipped.push(file2);
-      continue;
-    }
-    const sql = (0, import_fs15.readFileSync)((0, import_path14.join)(dir, file2), "utf-8");
-    const tx = db.transaction(() => {
-      db.exec(sql);
-      recordApplied.run(file2, (/* @__PURE__ */ new Date()).toISOString());
-    });
-    tx();
-    applied.push(file2);
-  }
-  return { applied, skipped };
-}
-
-// src/conversation-cache.ts
+init_query_timing();
+init_sqlite_migrate();
 init_logger();
 init_providers();
 
@@ -147942,6 +148154,9 @@ var ConversationsRepository = class {
   }
 };
 
+// src/server.ts
+init_devices_repository();
+
 // src/db/repositories/managed-sessions.repository.ts
 var PROBE_SET_MAX = 200;
 var DIAGNOSTICS_MAX = 200;
@@ -148257,53 +148472,8 @@ var SessionsRepository = class {
   }
 };
 
-// src/db/runtime-store.ts
-var import_better_sqlite33 = __toESM(require("better-sqlite3"), 1);
-var RuntimeStore = class _RuntimeStore {
-  constructor(db) {
-    this.db = db;
-  }
-  db;
-  static open(dbPath, migrationsDir) {
-    const db = instrumentDatabase(new import_better_sqlite33.default(dbPath));
-    db.pragma("journal_mode = WAL");
-    runSqliteMigrations(db, migrationsDir ?? resolveMigrationsDir("runtime-migrations"));
-    return new _RuntimeStore(db);
-  }
-  getDatabase() {
-    return this.db;
-  }
-  /**
-   * One-time move of `managed_sessions` rows out of a pre-split `cache.db`.
-   *
-   * Non-destructive by design: the source table is left in place so an older
-   * streamer rolled back onto the same machine still finds its registry. Runs
-   * only when this file's table is empty, so a second boot is a no-op rather
-   * than a re-copy that would resurrect rows deleted since.
-   *
-   * Returns the number of rows copied.
-   */
-  importLegacyManagedSessions(source) {
-    const existing = this.db.prepare("SELECT COUNT(*) AS n FROM managed_sessions").get();
-    if (existing.n > 0) return 0;
-    const hasTable = source.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'managed_sessions'").get();
-    if (!hasTable) return 0;
-    const rows = source.prepare("SELECT * FROM managed_sessions").all();
-    if (rows.length === 0) return 0;
-    const columns = Object.keys(rows[0]);
-    const insert = this.db.prepare(
-      `INSERT OR IGNORE INTO managed_sessions (${columns.join(", ")})
-       VALUES (${columns.map((c) => `@${c}`).join(", ")})`
-    );
-    this.db.transaction((batch) => {
-      for (const row of batch) insert.run(row);
-    })(rows);
-    return rows.length;
-  }
-  close() {
-    this.db.close();
-  }
-};
+// src/server.ts
+init_runtime_store();
 
 // src/external-tails.ts
 var import_fs23 = require("fs");
@@ -148576,8 +148746,8 @@ function spawnDetachedHost(socketPath, entryPoint) {
 
 // src/scanner-manager.ts
 var import_fs28 = require("fs");
-var import_os11 = require("os");
-var import_path28 = require("path");
+var import_os12 = require("os");
+var import_path29 = require("path");
 init_logger();
 init_providers();
 
@@ -148899,9 +149069,9 @@ function refreshConversationCache(deps) {
 
 // src/services/conversations/shouldRefreshProjectsFromHdd.ts
 var import_fs27 = require("fs");
-var import_os10 = require("os");
-var import_path27 = require("path");
-var DEFAULT_PROJECTS_DIR = (0, import_path27.join)((0, import_os10.homedir)(), ".claude", "projects");
+var import_os11 = require("os");
+var import_path28 = require("path");
+var DEFAULT_PROJECTS_DIR = (0, import_path28.join)((0, import_os11.homedir)(), ".claude", "projects");
 function maxProjectsTreeMtimeMs(projectsDir) {
   let maxMs;
   try {
@@ -148913,7 +149083,7 @@ function maxProjectsTreeMtimeMs(projectsDir) {
     for (const ent of (0, import_fs27.readdirSync)(projectsDir, { withFileTypes: true })) {
       if (!ent.isDirectory()) continue;
       try {
-        const childMs = (0, import_fs27.statSync)((0, import_path27.join)(projectsDir, ent.name)).mtimeMs;
+        const childMs = (0, import_fs27.statSync)((0, import_path28.join)(projectsDir, ent.name)).mtimeMs;
         if (childMs > maxMs) maxMs = childMs;
       } catch {
       }
@@ -149088,9 +149258,9 @@ var ScannerManager = class {
   projectsDirs() {
     const profiles = this.deps.scanProfiles;
     if (profiles && profiles.length > 0) {
-      return profiles.filter((p2) => p2.enabled).map((p2) => (0, import_path28.join)(p2.configDir, "projects"));
+      return profiles.filter((p2) => p2.enabled).map((p2) => (0, import_path29.join)(p2.configDir, "projects"));
     }
-    return [(0, import_path28.join)((0, import_os11.homedir)(), ".claude", "projects")];
+    return [(0, import_path29.join)((0, import_os12.homedir)(), ".claude", "projects")];
   }
   // ─── staleness ────────────────────────────────────────────────────
   // Drain the stale set and disarm the flag together. The caller owns the
@@ -149371,8 +149541,8 @@ var import_fs30 = require("fs");
 
 // src/handlers/handleListProjects.ts
 var import_fs29 = require("fs");
-var import_os12 = require("os");
-var import_path29 = require("path");
+var import_os13 = require("os");
+var import_path30 = require("path");
 var HEAD_BYTES = 64 * 1024;
 var MAX_FILES_PROBED = 3;
 function readRecordedCwd(dir) {
@@ -149385,7 +149555,7 @@ function readRecordedCwd(dir) {
   for (const file2 of files.slice(0, MAX_FILES_PROBED)) {
     let fd;
     try {
-      fd = (0, import_fs29.openSync)((0, import_path29.join)(dir, file2), "r");
+      fd = (0, import_fs29.openSync)((0, import_path30.join)(dir, file2), "r");
       const buf = Buffer.alloc(HEAD_BYTES);
       const bytes = (0, import_fs29.readSync)(fd, buf, 0, HEAD_BYTES, 0);
       for (const line of buf.subarray(0, bytes).toString("utf8").split("\n")) {
@@ -149409,11 +149579,11 @@ function decodeProjectPath(dirName) {
 function handleListProjects(url2, res) {
   const limit = Math.max(1, parseInt(url2.searchParams.get("limit") ?? "50", 10) || 50);
   const offset = Math.max(0, parseInt(url2.searchParams.get("offset") ?? "0", 10) || 0);
-  const projectsDir = (0, import_path29.join)((0, import_os12.homedir)(), ".claude", "projects");
+  const projectsDir = (0, import_path30.join)((0, import_os13.homedir)(), ".claude", "projects");
   let entries;
   try {
     entries = (0, import_fs29.readdirSync)(projectsDir).map((dirName) => {
-      const fullPath = (0, import_path29.join)(projectsDir, dirName);
+      const fullPath = (0, import_path30.join)(projectsDir, dirName);
       let mtime = 0;
       try {
         mtime = (0, import_fs29.statSync)(fullPath).mtimeMs;
@@ -149428,7 +149598,7 @@ function handleListProjects(url2, res) {
   }
   const total = entries.length;
   const page = entries.slice(offset, offset + limit).map(({ dirName }) => {
-    const path2 = readRecordedCwd((0, import_path29.join)(projectsDir, dirName)) ?? decodeProjectPath(String(dirName));
+    const path2 = readRecordedCwd((0, import_path30.join)(projectsDir, dirName)) ?? decodeProjectPath(String(dirName));
     const name = path2.split(/[\\/]/).filter(Boolean).pop() ?? dirName;
     return { name, path: path2, dirName };
   });
@@ -149438,6 +149608,10 @@ function handleListProjects(url2, res) {
 
 // src/server-wiring.ts
 init_logger();
+init_capabilities();
+function wsAllows(principal, required2) {
+  return principal === null || hasCapability(principal, required2);
+}
 function createConversationWatcherEvents(deps) {
   return {
     onNewLineSpans: (filePath, spans, readFrom, endOffset) => {
@@ -149719,7 +149893,15 @@ function createApiDeps(deps) {
       const alertMsg = deps.cacheMonitor()?.wsMessage();
       if (alertMsg) deps.wsHub.unicast(ws2, alertMsg);
     },
-    handleWsMessage: async (ws2, raw2) => {
+    handleWsMessage: async (ws2, raw2, principal) => {
+      const deny = (type, required2) => {
+        deps.log().warn(`[ws.capability_denied] ${type} requires ${required2}`, {
+          event: "ws.capability_denied",
+          type,
+          required: required2,
+          ...principal?.deviceId ? { deviceId: principal.deviceId } : {}
+        });
+      };
       try {
         const msg = JSON.parse(String(raw2));
         if (msg.type === "register" && typeof msg.clientId === "string") {
@@ -149729,6 +149911,10 @@ function createApiDeps(deps) {
           deps.wsToClientId.set(ws2, msg.clientId);
         }
         if (msg.type === "subscribe_session" && typeof msg.sessionId === "string") {
+          if (!wsAllows(principal, "history:read")) {
+            deny(msg.type, "history:read");
+            return;
+          }
           deps.addSessionSubscriber(msg.sessionId, ws2);
           if (deps.ptyManager.hasSession(msg.sessionId)) {
             const lines = await deps.ptyManager.getOutputLines(msg.sessionId, 200);
@@ -149777,6 +149963,10 @@ function createApiDeps(deps) {
           }
         }
         if (msg.type === "hold_session" && typeof msg.sessionId === "string") {
+          if (!wsAllows(principal, "session:control")) {
+            deny(msg.type, "session:control");
+            return;
+          }
           deps.startGraceTimer(msg.sessionId, deps.ptyGracePeriodMs);
         }
       } catch {
@@ -149804,11 +149994,11 @@ var import_fs33 = require("fs");
 
 // src/services/cache-integrity/alertStore.ts
 var import_fs31 = require("fs");
-var import_os13 = require("os");
-var import_path30 = require("path");
+var import_os14 = require("os");
+var import_path31 = require("path");
 function alertStatePath() {
-  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path30.join)((0, import_os13.homedir)(), ".threadbase");
-  return (0, import_path30.join)(dir, "cache-alert.json");
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path31.join)((0, import_os14.homedir)(), ".threadbase");
+  return (0, import_path31.join)(dir, "cache-alert.json");
 }
 function loadAlertState() {
   try {
@@ -149820,14 +150010,14 @@ function loadAlertState() {
 }
 function saveAlertState(state) {
   const path2 = alertStatePath();
-  (0, import_fs31.mkdirSync)((0, import_path30.dirname)(path2), { recursive: true });
+  (0, import_fs31.mkdirSync)((0, import_path31.dirname)(path2), { recursive: true });
   (0, import_fs31.writeFileSync)(path2, `${JSON.stringify(state, null, 2)}
 `);
 }
 
 // src/services/cache-integrity/backup.ts
 var import_fs32 = require("fs");
-var import_path31 = require("path");
+var import_path32 = require("path");
 var DEFAULT_RETAIN = 3;
 function retainCount() {
   const parsed = Number.parseInt(process.env.THREADBASE_CACHE_BACKUP_RETAIN ?? "", 10);
@@ -149838,13 +150028,13 @@ function timestamp(d) {
   return `${d.getFullYear()}${p2(d.getMonth() + 1)}${p2(d.getDate())}-${p2(d.getHours())}${p2(d.getMinutes())}${p2(d.getSeconds())}`;
 }
 async function backupCacheDb(db, cacheDir) {
-  const backupsDir = (0, import_path31.join)(cacheDir, "backups");
+  const backupsDir = (0, import_path32.join)(cacheDir, "backups");
   (0, import_fs32.mkdirSync)(backupsDir, { recursive: true });
-  const destPath = (0, import_path31.join)(backupsDir, `cache-${timestamp(/* @__PURE__ */ new Date())}.db`);
+  const destPath = (0, import_path32.join)(backupsDir, `cache-${timestamp(/* @__PURE__ */ new Date())}.db`);
   await db.backup(destPath);
   const retain = retainCount();
   const backups = (0, import_fs32.readdirSync)(backupsDir).filter((f2) => f2.startsWith("cache-") && f2.endsWith(".db")).map((f2) => {
-    const full = (0, import_path31.join)(backupsDir, f2);
+    const full = (0, import_path32.join)(backupsDir, f2);
     return { full, mtime: (0, import_fs32.statSync)(full).mtimeMs };
   }).sort((a, b2) => b2.mtime - a.mtime);
   for (const stale of backups.slice(retain)) {
@@ -151701,9 +151891,15 @@ function getSortValue(s3, key) {
     case "projectName":
       return s3.projectName;
     case "status":
-      return s3.status;
+      return statusSortValue(s3);
   }
 }
+function statusSortValue(s3) {
+  const rank = s3.status === "idle" ? 1 : 0;
+  const activeAt = Date.parse(s3.lastActivityAt ?? s3.startedAt);
+  const recency = String(1e15 - (Number.isNaN(activeAt) ? 0 : activeAt)).padStart(16, "0");
+  return `${rank}:${recency}`;
+}
 function compareValues(a, b2) {
   if (a === void 0 && b2 === void 0) return 0;
   if (a === void 0) return 1;
@@ -151838,8 +152034,8 @@ function discoveredToResponse(d, conversationId) {
 
 // src/session-watchers.ts
 var import_fs37 = require("fs");
-var import_os14 = require("os");
-var import_path32 = require("path");
+var import_os15 = require("os");
+var import_path33 = require("path");
 init_logger();
 var SessionWatchers = class {
   constructor(deps) {
@@ -151921,9 +152117,9 @@ var SessionWatchers = class {
   // was passed to Claude via --session-id so the filename matches from the start.
   watchForJsonl(sessionId, projectPath) {
     const encoded = projectPath.replace(/[/\\:.]/g, "-");
-    const projectsDir = (0, import_path32.join)((0, import_os14.homedir)(), ".claude", "projects", encoded);
+    const projectsDir = (0, import_path33.join)((0, import_os15.homedir)(), ".claude", "projects", encoded);
     const expectedFile = `${sessionId}.jsonl`;
-    const filePath = (0, import_path32.join)(projectsDir, expectedFile);
+    const filePath = (0, import_path33.join)(projectsDir, expectedFile);
     const deadline = Date.now() + 12e4;
     let watcher = null;
     const cleanup = () => {
@@ -151945,10 +152141,10 @@ var SessionWatchers = class {
       if (!resolvedFilePath && (0, import_fs37.existsSync)(projectsDir)) {
         try {
           const now = Date.now();
-          const match2 = (0, import_fs37.readdirSync)(projectsDir).filter((f2) => f2.endsWith(".jsonl")).map((f2) => ({ f: f2, mtime: (0, import_fs37.statSync)((0, import_path32.join)(projectsDir, f2)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).filter(
-            ({ f: f2 }) => (0, import_path32.basename)(f2, ".jsonl") === sessionId || this.readFirstLineSessionId((0, import_path32.join)(projectsDir, f2)) === sessionId
+          const match2 = (0, import_fs37.readdirSync)(projectsDir).filter((f2) => f2.endsWith(".jsonl")).map((f2) => ({ f: f2, mtime: (0, import_fs37.statSync)((0, import_path33.join)(projectsDir, f2)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).filter(
+            ({ f: f2 }) => (0, import_path33.basename)(f2, ".jsonl") === sessionId || this.readFirstLineSessionId((0, import_path33.join)(projectsDir, f2)) === sessionId
           ).sort((a, b2) => b2.mtime - a.mtime)[0];
-          if (match2) resolvedFilePath = (0, import_path32.join)(projectsDir, match2.f);
+          if (match2) resolvedFilePath = (0, import_path33.join)(projectsDir, match2.f);
         } catch {
         }
       }
@@ -151992,7 +152188,7 @@ var SessionWatchers = class {
   watchForCodexRollout(sessionId, projectPath) {
     const deadline = Date.now() + 12e4;
     const now = /* @__PURE__ */ new Date();
-    const dateDir = (0, import_path32.join)(
+    const dateDir = (0, import_path33.join)(
       String(now.getFullYear()),
       String(now.getMonth() + 1).padStart(2, "0"),
       String(now.getDate()).padStart(2, "0")
@@ -152033,7 +152229,7 @@ var SessionWatchers = class {
         this.deps.sessionStore.listManaged().filter((s3) => s3.id !== sessionId && s3.boundConversationId != null).map((s3) => s3.boundConversationId)
       );
       for (const root of this.deps.codexRoots) {
-        const sessionsDir = (0, import_path32.join)(root, dateDir);
+        const sessionsDir = (0, import_path33.join)(root, dateDir);
         if (!(0, import_fs37.existsSync)(sessionsDir)) continue;
         let candidateFiles;
         try {
@@ -152042,9 +152238,9 @@ var SessionWatchers = class {
           continue;
         }
         const nowMs = Date.now();
-        const recentCandidates = candidateFiles.map((f2) => ({ f: f2, mtime: (0, import_fs37.statSync)((0, import_path32.join)(sessionsDir, f2)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b2) => b2.mtime - a.mtime);
+        const recentCandidates = candidateFiles.map((f2) => ({ f: f2, mtime: (0, import_fs37.statSync)((0, import_path33.join)(sessionsDir, f2)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b2) => b2.mtime - a.mtime);
         for (const { f: f2 } of recentCandidates) {
-          const candidatePath = (0, import_path32.join)(sessionsDir, f2);
+          const candidatePath = (0, import_path33.join)(sessionsDir, f2);
           const match2 = matchesProjectPath(candidatePath);
           if (!match2) continue;
           if (boundElsewhere.has(match2.id)) continue;
@@ -152448,7 +152644,7 @@ var StreamerServer = class {
     this.skipStartupWarmup = config2.skipStartupWarmup ?? false;
     this.autoResumeOnBoot = config2.autoResumeOnBoot ?? false;
     this.scanProfiles = config2.scanProfiles;
-    this.codexRoots = config2.codexRoots ?? [(0, import_path33.join)((0, import_os15.homedir)(), ".codex", "sessions")];
+    this.codexRoots = config2.codexRoots ?? [(0, import_path34.join)((0, import_os16.homedir)(), ".codex", "sessions")];
     this.ptyGracePeriodMs = config2.ptyGracePeriodMs ?? DEFAULT_PTY_GRACE_PERIOD_MS;
     this.defaultSystemPrompt = config2.defaultSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
     const flagResolution = resolveFeatureFlags({
@@ -152465,8 +152661,8 @@ var StreamerServer = class {
     this.claudeFlagsPersistable = config2.claudeFlags === void 0;
     this.claudeFlags = config2.claudeFlags ?? loadClaudeFlags();
     this.claudeExtraArgs = config2.claudeExtraArgs ?? loadClaudeExtraArgs();
-    this.cacheDir = config2.cacheDir ?? loadCacheDir() ?? (0, import_path33.join)((0, import_os15.homedir)(), ".threadbase", "cache");
-    this.runtimeDbPath = config2.runtimeDbPath ?? process.env.THREADBASE_RUNTIME_DB ?? (0, import_path33.join)(process.env.THREADBASE_CONFIG_DIR ?? (0, import_path33.join)((0, import_os15.homedir)(), ".threadbase"), "runtime.db");
+    this.cacheDir = config2.cacheDir ?? loadCacheDir() ?? (0, import_path34.join)((0, import_os16.homedir)(), ".threadbase", "cache");
+    this.runtimeDbPath = resolveRuntimeDbPath(config2.runtimeDbPath);
     this.tailSize = config2.tailSize ?? loadTailSize() ?? 10;
     this.directoryDebounceMs = parseDirScanDebounceEnv(process.env.THREADBASE_DIR_SCAN_DEBOUNCE_MS) ?? config2.directoryScanDebounceMs ?? 1e3;
     this.scannerManager = new ScannerManager({
@@ -152642,7 +152838,7 @@ var StreamerServer = class {
         temporalClient,
         taskQueue: agentConfig.temporal.taskQueue
       });
-      const conversationsBaseDir = agentConfig.conversationsDir || (0, import_path33.join)((0, import_path33.dirname)(this.cacheDir), "conversations");
+      const conversationsBaseDir = agentConfig.conversationsDir || (0, import_path34.join)((0, import_path34.dirname)(this.cacheDir), "conversations");
       conversationWriter = createConversationWriter({
         baseDir: conversationsBaseDir
       });
@@ -152894,14 +153090,14 @@ var StreamerServer = class {
     }
     this.apnsClient = new ApnsClient(creds);
     const sender = new LiveActivitySender(this.apnsClient, pushRepo);
-    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os15.hostname)();
-    this.liveActivityNotifier = new LiveActivityNotifier(sender, serverId, (0, import_os15.hostname)());
+    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os16.hostname)();
+    this.liveActivityNotifier = new LiveActivityNotifier(sender, serverId, (0, import_os16.hostname)());
     this.liveActivityRenewal = new LiveActivityRenewalScheduler({
       repo: pushRepo,
       sender,
       sessionStore: this.sessionStore,
       serverId,
-      serverLabel: (0, import_os15.hostname)()
+      serverLabel: (0, import_os16.hostname)()
     });
     this.liveActivityRenewal.start();
     this.log.info("Live Activity push enabled", {
@@ -152921,7 +153117,7 @@ var StreamerServer = class {
    */
   initWaitingInputPush(pushRepo) {
     const sender = new ExpoPushSender(pushRepo, process.env.THREADBASE_EXPO_ACCESS_TOKEN);
-    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os15.hostname)();
+    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os16.hostname)();
     this.waitingInputNotifier = new WaitingInputNotifier(
       sender,
       serverId,
@@ -153058,7 +153254,7 @@ var StreamerServer = class {
         let sessions = null;
         for (let attempt = 0; attempt < 2; attempt += 1) {
           const transport = await connectOrSpawnHost({
-            instanceId: process.env.THREADBASE_INSTANCE_ID ?? (0, import_os15.hostname)()
+            instanceId: process.env.THREADBASE_INSTANCE_ID ?? (0, import_os16.hostname)()
           });
           try {
             sessions = await this.ptyManager.useRemoteRunner(transport);
@@ -153115,6 +153311,7 @@ var StreamerServer = class {
         try {
           this.runtimeStore = RuntimeStore.open(this.runtimeDbPath);
           this.managedSessionsRepo = new ManagedSessionsRepository(this.runtimeStore.getDatabase());
+          this.devicesRepo = new DevicesRepository(this.runtimeStore.getDatabase());
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           const abiMismatch = message.includes("NODE_MODULE_VERSION") || message.includes("was compiled against a different Node.js version");
@@ -153134,7 +153331,7 @@ var StreamerServer = class {
         }
         try {
           this.cache = ConversationCache.open(
-            (0, import_path33.join)(this.cacheDir, "cache.db"),
+            (0, import_path34.join)(this.cacheDir, "cache.db"),
             this.tailSize,
             void 0,
             {
@@ -153164,18 +153361,39 @@ var StreamerServer = class {
             if (copied > 0) {
               this.log.info(`Copied ${copied} managed session row(s) from cache.db to runtime.db`, {
                 copied,
+                table: "managed_sessions",
                 event: "runtime.legacy_import"
               });
             }
           } catch (err) {
             this.log.warn("[registry] legacy managed_sessions copy failed", {
               event: "runtime.legacy_import_failed",
+              table: "managed_sessions",
+              err
+            });
+          }
+          try {
+            const result = this.runtimeStore?.importLegacyDevices(db);
+            if (result && result.copied > 0) {
+              this.log.info(
+                `Moved ${result.copied} device row(s) from cache.db to runtime.db` + (result.purged ? "; removed the cache-side copy" : "; KEPT the cache-side copy (row count did not match after copy)"),
+                {
+                  copied: result.copied,
+                  purged: result.purged,
+                  table: "devices",
+                  event: "runtime.legacy_import"
+                }
+              );
+            }
+          } catch (err) {
+            this.log.warn("[registry] legacy devices move failed", {
+              event: "runtime.legacy_import_failed",
+              table: "devices",
               err
             });
           }
           this.cacheMetadataRepo = new CacheMetadataRepository(db);
           this.pushRepo = new PushRepository(db);
-          this.devicesRepo = new DevicesRepository(db);
           this.initLiveActivityPush(this.pushRepo);
           this.initWaitingInputPush(this.pushRepo);
           this.cacheMonitor = new CacheIntegrityMonitor(
@@ -153501,7 +153719,7 @@ var StreamerServer = class {
       nonce: sealed.nonce,
       ephemeralPublicKey: sealed.ephemeralPublicKey,
       publicUrl: this.publicUrl,
-      machineName: (0, import_os15.hostname)(),
+      machineName: (0, import_os16.hostname)(),
       ...device && {
         deviceId: device.deviceId,
         deviceToken: device.deviceToken,
@@ -154568,7 +154786,7 @@ var import_node_stream2 = __toESM(require("stream"), 1);
 var import_node_string_decoder = require("string_decoder");
 var import_node_path15 = __toESM(require("path"), 1);
 var import_node_fs13 = __toESM(require("fs"), 1);
-var import_path34 = require("path");
+var import_path35 = require("path");
 var import_events4 = require("events");
 var import_assert = __toESM(require("assert"), 1);
 var import_buffer2 = require("buffer");
@@ -154578,9 +154796,9 @@ var import_node_path16 = require("path");
 var import_node_path17 = require("path");
 var import_fs40 = __toESM(require("fs"), 1);
 var import_fs41 = __toESM(require("fs"), 1);
-var import_path35 = __toESM(require("path"), 1);
-var import_node_path18 = require("path");
 var import_path36 = __toESM(require("path"), 1);
+var import_node_path18 = require("path");
+var import_path37 = __toESM(require("path"), 1);
 var import_node_fs14 = __toESM(require("fs"), 1);
 var import_node_assert = __toESM(require("assert"), 1);
 var import_node_crypto6 = require("crypto");
@@ -155952,11 +156170,11 @@ var vn = (s3) => {
 var Qi = (s3, t) => {
   let e = new Map(t.map((o) => [mt(o), true])), i = s3.filter, r = 100, n = (o, h = "", a = 0) => {
     if (a >= r) return e.set(o, false), false;
-    let l = h || (0, import_path34.parse)(o).root || ".", c;
+    let l = h || (0, import_path35.parse)(o).root || ".", c;
     if (o === l) c = false;
     else {
       let d = e.get(o);
-      c = d !== void 0 ? d : n((0, import_path34.dirname)(o), l, a + 1);
+      c = d !== void 0 ? d : n((0, import_path35.dirname)(o), l, a + 1);
     }
     return e.set(o, c), c;
   };
@@ -156076,7 +156294,7 @@ var de = class extends A {
       let [o, h] = ce(this.path);
       o && typeof h == "string" && (this.path = h, r = o);
     }
-    this.win32 = !!i.win32 || process.platform === "win32", this.win32 && (this.path = Qs(this.path.replaceAll(/\\/g, "/")), t = t.replaceAll(/\\/g, "/")), this.absolute = f(i.absolute || import_path35.default.resolve(this.cwd, t)), this.path === "" && (this.path = "./"), r && this.warn("TAR_ENTRY_INFO", `stripping ${r} from absolute path`, { entry: this, path: r + this.path });
+    this.win32 = !!i.win32 || process.platform === "win32", this.win32 && (this.path = Qs(this.path.replaceAll(/\\/g, "/")), t = t.replaceAll(/\\/g, "/")), this.absolute = f(i.absolute || import_path36.default.resolve(this.cwd, t)), this.path === "" && (this.path = "./"), r && this.warn("TAR_ENTRY_INFO", `stripping ${r} from absolute path`, { entry: this, path: r + this.path });
     let n = this.statCache.get(this.absolute);
     n ? this[si](n) : this[ss]();
   }
@@ -156135,7 +156353,7 @@ var de = class extends A {
   }
   [sr](t) {
     if (!this.stat) throw new Error("cannot create link entry without stat");
-    this.type = "Link", this.linkpath = f(import_path35.default.relative(this.cwd, t)), this.stat.size = 0, this[fe](), this.end();
+    this.type = "Link", this.linkpath = f(import_path36.default.relative(this.cwd, t)), this.stat.size = 0, this[fe](), this.end();
   }
   [er]() {
     if (!this.stat) throw new Error("cannot create file entry without stat");
@@ -156549,7 +156767,7 @@ var wt = class extends A {
     return typeof t == "string" ? this[ci](t) : this[or](t), this.flowing;
   }
   [or](t) {
-    let e = f(import_path36.default.resolve(this.cwd, t.path));
+    let e = f(import_path37.default.resolve(this.cwd, t.path));
     if (!this.filter(t.path, t)) t.resume();
     else {
       let i = new pi(t.path, e);
@@ -156558,7 +156776,7 @@ var wt = class extends A {
     this[Ft]();
   }
   [ci](t) {
-    let e = f(import_path36.default.resolve(this.cwd, t));
+    let e = f(import_path37.default.resolve(this.cwd, t));
     this[W2].push(new pi(t, e)), this[Ft]();
   }
   [ds](t) {
@@ -158213,8 +158431,8 @@ program2.command("cache").description("Manage the local SQLite conversation cach
     `${process.env.HOME}/.threadbase/cache`
   ).action((opts) => {
     const { rmSync: rmSync6, existsSync: existsSync21 } = require("fs");
-    const { join: join34 } = require("path");
-    const dbPath = join34(opts.cacheDir, "cache.db");
+    const { join: join35 } = require("path");
+    const dbPath = join35(opts.cacheDir, "cache.db");
     for (const suffix of ["", "-shm", "-wal"]) {
       const f2 = dbPath + suffix;
       if (existsSync21(f2)) {
@@ -158225,6 +158443,75 @@ program2.command("cache").description("Manage the local SQLite conversation cach
     log14.info("Cache cleared. Restart the server to rebuild.", void 0, "console");
   })
 );
+program2.command("devices").description("List, revoke and erase paired devices").addCommand(
+  new Command("list").description("Show every paired device, including revoked ones").option("--db <path>", "runtime.db path (default: ~/.threadbase/runtime.db)").action(async (opts) => {
+    const { RuntimeStore: RuntimeStore2, resolveRuntimeDbPath: resolveRuntimeDbPath2 } = await Promise.resolve().then(() => (init_runtime_store(), runtime_store_exports));
+    const { DevicesRepository: DevicesRepository2 } = await Promise.resolve().then(() => (init_devices_repository(), devices_repository_exports));
+    const store = RuntimeStore2.open(resolveRuntimeDbPath2(opts.db));
+    const devices = new DevicesRepository2(store.getDatabase()).list();
+    store.close();
+    if (devices.length === 0) {
+      log14.info("No paired devices.", void 0, "console");
+      return;
+    }
+    for (const d of devices) {
+      const state = d.revokedAt ? "revoked" : "active";
+      const seen = d.lastSeenAt ? new Date(d.lastSeenAt).toISOString() : "never";
+      log14.info(
+        `${d.deviceId}  ${state.padEnd(7)}  ${d.name ?? "(unnamed)"}  last seen ${seen}  [${d.capabilities.join(", ")}]`,
+        void 0,
+        "console"
+      );
+    }
+  })
+).addCommand(
+  new Command("revoke").argument("<deviceId>").description("Refuse this device's token, keeping its record for the audit trail").option("--db <path>", "runtime.db path (default: ~/.threadbase/runtime.db)").action(async (deviceId, opts) => {
+    const { RuntimeStore: RuntimeStore2, resolveRuntimeDbPath: resolveRuntimeDbPath2 } = await Promise.resolve().then(() => (init_runtime_store(), runtime_store_exports));
+    const { DevicesRepository: DevicesRepository2 } = await Promise.resolve().then(() => (init_devices_repository(), devices_repository_exports));
+    const store = RuntimeStore2.open(resolveRuntimeDbPath2(opts.db));
+    const ok = new DevicesRepository2(store.getDatabase()).revoke(deviceId);
+    store.close();
+    log14.info(ok ? `Revoked ${deviceId}.` : `No such device: ${deviceId}`, void 0, "console");
+    if (!ok) process.exitCode = 1;
+  })
+).addCommand(
+  new Command("delete").argument("[deviceId]").description("Erase a device record. With --revoked, erase every revoked device instead").option("--revoked", "Erase all revoked devices rather than one by id").option("--force", "Erase an ACTIVE device (revoking first is the safe order)").option("--db <path>", "runtime.db path (default: ~/.threadbase/runtime.db)").action(async (deviceId, opts) => {
+    const { RuntimeStore: RuntimeStore2, resolveRuntimeDbPath: resolveRuntimeDbPath2 } = await Promise.resolve().then(() => (init_runtime_store(), runtime_store_exports));
+    const { DevicesRepository: DevicesRepository2 } = await Promise.resolve().then(() => (init_devices_repository(), devices_repository_exports));
+    const store = RuntimeStore2.open(resolveRuntimeDbPath2(opts.db));
+    const repo = new DevicesRepository2(store.getDatabase());
+    if (opts.revoked) {
+      const n = repo.deleteRevoked();
+      store.close();
+      log14.info(`Erased ${n} revoked device record(s).`, void 0, "console");
+      return;
+    }
+    if (!deviceId) {
+      store.close();
+      log14.error("Pass a device id, or --revoked to erase all revoked devices.");
+      process.exitCode = 1;
+      return;
+    }
+    const existing = repo.get(deviceId);
+    if (!existing) {
+      store.close();
+      log14.info(`No such device: ${deviceId}`, void 0, "console");
+      process.exitCode = 1;
+      return;
+    }
+    if (existing.revoked_at == null && !opts.force) {
+      store.close();
+      log14.error(
+        `${deviceId} is still active. Run 'devices revoke ${deviceId}' first, or pass --force.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    repo.delete(deviceId);
+    store.close();
+    log14.info(`Erased ${deviceId}.`, void 0, "console");
+  })
+);
 program2.command("pair").description("Print a pairing QR code (server must already be running)").option("-p, --port <number>", "Port the server is listening on", "8766").action(async (opts) => {
   const port = Number.parseInt(opts.port, 10);
   const apiKey = loadOrCreateApiKey();