@threadbase-sh/streamer 1.52.5 → 1.53.0

package/dist/index.cjs

@@ -607,7 +607,8 @@ function loadOrCreateApiKey() {
   const key = generateApiKey();
   (0, import_fs.mkdirSync)(configDir(), { recursive: true });
   (0, import_fs.writeFileSync)(configFile(), `api_key: ${key}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
+  (0, import_fs.chmodSync)(configFile(), 384);
   return key;
 }
 function loadBrowseRoot() {
@@ -3916,8 +3917,8 @@ var import_events = require("events");
 var import_fs27 = require("fs");
 var import_promises7 = require("fs/promises");
 var import_http = require("http");
-var import_os12 = require("os");
-var import_path22 = require("path");
+var import_os13 = require("os");
+var import_path23 = require("path");
 
 // src/api/app.ts
 var import_hono18 = require("hono");
@@ -4053,6 +4054,8 @@ var DevicesRepository = class {
   listStmt;
   revokeStmt;
   touchStmt;
+  deleteStmt;
+  deleteRevokedStmt;
   constructor(db) {
     this.insertStmt = db.prepare(`
       INSERT INTO devices (
@@ -4066,6 +4069,8 @@ var DevicesRepository = class {
     this.listStmt = db.prepare("SELECT * FROM devices ORDER BY created_at DESC");
     this.revokeStmt = db.prepare("UPDATE devices SET revoked_at = ? WHERE device_id = ?");
     this.touchStmt = db.prepare("UPDATE devices SET last_seen_at = ? WHERE device_id = ?");
+    this.deleteStmt = db.prepare("DELETE FROM devices WHERE device_id = ?");
+    this.deleteRevokedStmt = db.prepare("DELETE FROM devices WHERE revoked_at IS NOT NULL");
   }
   /**
    * Record a newly paired device and mint its token.
@@ -4112,6 +4117,33 @@ var DevicesRepository = class {
   revoke(deviceId, now = Date.now()) {
     return this.revokeStmt.run(now, deviceId).changes > 0;
   }
+  /**
+   * Erase one device's record outright.
+   *
+   * Deliberately separate from `revoke`, which is a soft delete that keeps the
+   * row so `list()` can show what happened. That audit trail is the right
+   * default — but it meant a `devices` row, including the user-supplied `name`
+   * ("Ronen's iPhone"), had no removal path at all once the registry moved to
+   * runtime.db, which no command deletes. This is that path.
+   *
+   * Erasure is NOT revocation: deleting a row frees its `token_hash`, so a
+   * device whose token is still on a phone somewhere stops being *known* rather
+   * than being *refused*. Revoke first, delete second, is the safe order, and
+   * `deleteRevoked()` exists so that is the easy thing to do.
+   */
+  delete(deviceId) {
+    return this.deleteStmt.run(deviceId).changes > 0;
+  }
+  /**
+   * Erase every already-revoked device. The bulk companion to `delete`, and the
+   * one that is safe by construction: a revoked device is already refused, so
+   * removing its row cannot restore access to anything.
+   *
+   * Returns the number of rows removed.
+   */
+  deleteRevoked() {
+    return this.deleteRevokedStmt.run().changes;
+  }
   touch(deviceId, now = Date.now()) {
     this.touchStmt.run(now, deviceId);
   }
@@ -4638,6 +4670,34 @@ var createDeviceRoutes = (deps) => {
     repo.revoke(id);
     return c.json({ ok: true, alreadyRevoked: false });
   });
+  app.delete("/:id", (c) => {
+    const repo = deps.devicesRepo();
+    if (!repo) {
+      return c.json({ error: "Device registry is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    const id = c.req.param("id");
+    const existing = repo.get(id);
+    if (!existing) return c.json({ ok: true, alreadyDeleted: true });
+    const force = c.req.query("force") === "1" || c.req.query("force") === "true";
+    if (existing.revoked_at == null && !force) {
+      return c.json(
+        {
+          error: "Revoke the device before deleting it, or pass ?force=1",
+          code: "DEVICE_ACTIVE"
+        },
+        409
+      );
+    }
+    repo.delete(id);
+    return c.json({ ok: true, alreadyDeleted: false });
+  });
+  app.delete("/", (c) => {
+    const repo = deps.devicesRepo();
+    if (!repo) {
+      return c.json({ error: "Device registry is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    return c.json({ ok: true, deleted: repo.deleteRevoked() });
+  });
   return app;
 };
 
@@ -5554,6 +5614,13 @@ var createMiscRoutes = (deps) => {
       // Same contract: this server serves GET /api/projects/summary, which the
       // Hub's grouped views need before they can draw a tree.
       projectSummary: true,
+      // The paired-device registry lives in runtime.db, so it survives
+      // `tb-streamer cache clear` and the integrity monitor's reset-and-rescan.
+      // A client may only prefer its scoped device token over the shared API
+      // key when this is true: on an older server the registry is inside
+      // cache.db, where a documented troubleshooting step deletes it and every
+      // device token with it. Absent means "old server, assume not durable".
+      devicesDurable: true,
       // Delivery capability, not endpoint support: whether this server can
       // actually send a push, so mobile can hide an affordance instead of
       // registering tokens nothing will ever send to. Absent on older servers,
@@ -5964,7 +6031,13 @@ var createWsRoutes = (deps, upgradeWebSocket) => {
   const app = new import_hono17.Hono();
   app.get(
     "/ws",
-    upgradeWebSocket(() => {
+    // The principal is read here, at the upgrade, and captured for the life of
+    // the socket. authMiddleware sets it because /ws is classified
+    // `history:read`, but it only ever reaches the HTTP request — without
+    // capturing it the socket has no principal at all, so every frame after
+    // the upgrade is unauthorized-by-omission.
+    upgradeWebSocket((c) => {
+      const principal = c.get("principal") ?? null;
       let openWs = null;
       return {
         onOpen(_evt, ws) {
@@ -5974,7 +6047,7 @@ var createWsRoutes = (deps, upgradeWebSocket) => {
           deps.handleWsOpen(raw);
         },
         onMessage(evt, _ws) {
-          if (openWs) deps.handleWsMessage(openWs, evt.data);
+          if (openWs) deps.handleWsMessage(openWs, evt.data, principal);
         },
         onClose(_evt, _ws) {
           if (openWs) deps.handleWsClose(openWs);
@@ -10696,6 +10769,11 @@ var SessionsRepository = class {
 
 // src/db/runtime-store.ts
 var import_better_sqlite32 = __toESM(require("better-sqlite3"), 1);
+var import_os7 = require("os");
+var import_path16 = require("path");
+function resolveRuntimeDbPath(override) {
+  return override ?? process.env.THREADBASE_RUNTIME_DB ?? (0, import_path16.join)(process.env.THREADBASE_CONFIG_DIR ?? (0, import_path16.join)((0, import_os7.homedir)(), ".threadbase"), "runtime.db");
+}
 var RuntimeStore = class _RuntimeStore {
   constructor(db) {
     this.db = db;
@@ -10713,23 +10791,64 @@ var RuntimeStore = class _RuntimeStore {
   /**
    * One-time move of `managed_sessions` rows out of a pre-split `cache.db`.
    *
-   * Non-destructive by design: the source table is left in place so an older
-   * streamer rolled back onto the same machine still finds its registry. Runs
-   * only when this file's table is empty, so a second boot is a no-op rather
-   * than a re-copy that would resurrect rows deleted since.
-   *
    * Returns the number of rows copied.
    */
   importLegacyManagedSessions(source) {
-    const existing = this.db.prepare("SELECT COUNT(*) AS n FROM managed_sessions").get();
+    return this.importLegacyTable(source, "managed_sessions");
+  }
+  /**
+   * One-time move of `devices` rows out of `cache.db`, where the registry used
+   * to live (migration `011_create_devices.sql`).
+   *
+   * Losing this table invalidates every device token ever issued, and cache.db
+   * is the file `tb-streamer cache clear` deletes and the integrity monitor
+   * rebuilds — see `runtime-migrations/003_create_devices.sql`.
+   *
+   * Unlike `managed_sessions`, this one MOVES rather than copies: the source
+   * rows are deleted once the copy is verified. A `devices` row carries a
+   * user-supplied label ("Ronen's iPhone"), and leaving a second copy of that
+   * on disk indefinitely — in the one file the user is told to delete when
+   * something goes wrong — is more retained personal data than the rollback
+   * path is worth. Recovering from a rollback is re-scanning a pairing QR.
+   *
+   * The delete is conditional on the copy being complete: `INSERT OR IGNORE`
+   * can silently skip a row, so the destination count must match what was read
+   * before anything is removed. A mismatch keeps the source and reports
+   * `purged: false` rather than throwing — the import itself still succeeded,
+   * and keeping data is the safe direction to fail in.
+   */
+  importLegacyDevices(source) {
+    const copied = this.importLegacyTable(source, "devices");
+    if (copied === 0) return { copied: 0, purged: false };
+    const landed = this.db.prepare("SELECT COUNT(*) AS n FROM devices").get().n;
+    if (landed !== copied) return { copied, purged: false };
+    source.prepare("DELETE FROM devices").run();
+    return { copied, purged: true };
+  }
+  /**
+   * Copy a whole table out of a pre-split `cache.db` into this file.
+   *
+   * The copy itself is non-destructive — the source is left in place, so an
+   * older streamer rolled back onto the same machine still finds its data.
+   * `importLegacyDevices` deletes the source afterwards for its own reasons;
+   * `managed_sessions` does not. Runs only when this file's table is empty, so
+   * a second boot is a no-op rather than a re-copy that would resurrect rows
+   * deleted since.
+   *
+   * The table name is interpolated into SQL, so it is typed as a closed union
+   * rather than `string` — the set of tables that can ever be lifted is known
+   * at compile time, and that is what keeps a caller from making this a hole.
+   */
+  importLegacyTable(source, table) {
+    const existing = this.db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get();
     if (existing.n > 0) return 0;
-    const hasTable = source.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'managed_sessions'").get();
+    const hasTable = source.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
     if (!hasTable) return 0;
-    const rows = source.prepare("SELECT * FROM managed_sessions").all();
+    const rows = source.prepare(`SELECT * FROM ${table}`).all();
     if (rows.length === 0) return 0;
     const columns = Object.keys(rows[0]);
     const insert = this.db.prepare(
-      `INSERT OR IGNORE INTO managed_sessions (${columns.join(", ")})
+      `INSERT OR IGNORE INTO ${table} (${columns.join(", ")})
        VALUES (${columns.map((c) => `@${c}`).join(", ")})`
     );
     this.db.transaction((batch) => {
@@ -11051,8 +11170,8 @@ function spawnDetachedHost(socketPath, entryPoint) {
 // src/scanner-manager.ts
 var import_scanner4 = require("@threadbase-sh/scanner");
 var import_fs17 = require("fs");
-var import_os8 = require("os");
-var import_path17 = require("path");
+var import_os9 = require("os");
+var import_path18 = require("path");
 
 // src/services/cache/cacheMetadata.ts
 function getCacheMetadata(repo, key) {
@@ -11152,9 +11271,9 @@ function refreshConversationCache(deps) {
 
 // src/services/conversations/shouldRefreshProjectsFromHdd.ts
 var import_fs16 = require("fs");
-var import_os7 = require("os");
-var import_path16 = require("path");
-var DEFAULT_PROJECTS_DIR = (0, import_path16.join)((0, import_os7.homedir)(), ".claude", "projects");
+var import_os8 = require("os");
+var import_path17 = require("path");
+var DEFAULT_PROJECTS_DIR = (0, import_path17.join)((0, import_os8.homedir)(), ".claude", "projects");
 function maxProjectsTreeMtimeMs(projectsDir) {
   let maxMs;
   try {
@@ -11166,7 +11285,7 @@ function maxProjectsTreeMtimeMs(projectsDir) {
     for (const ent of (0, import_fs16.readdirSync)(projectsDir, { withFileTypes: true })) {
       if (!ent.isDirectory()) continue;
       try {
-        const childMs = (0, import_fs16.statSync)((0, import_path16.join)(projectsDir, ent.name)).mtimeMs;
+        const childMs = (0, import_fs16.statSync)((0, import_path17.join)(projectsDir, ent.name)).mtimeMs;
         if (childMs > maxMs) maxMs = childMs;
       } catch {
       }
@@ -11338,9 +11457,9 @@ var ScannerManager = class {
   projectsDirs() {
     const profiles = this.deps.scanProfiles;
     if (profiles && profiles.length > 0) {
-      return profiles.filter((p) => p.enabled).map((p) => (0, import_path17.join)(p.configDir, "projects"));
+      return profiles.filter((p) => p.enabled).map((p) => (0, import_path18.join)(p.configDir, "projects"));
     }
-    return [(0, import_path17.join)((0, import_os8.homedir)(), ".claude", "projects")];
+    return [(0, import_path18.join)((0, import_os9.homedir)(), ".claude", "projects")];
   }
   // ─── staleness ────────────────────────────────────────────────────
   // Drain the stale set and disarm the flag together. The caller owns the
@@ -11621,8 +11740,8 @@ var import_fs19 = require("fs");
 
 // src/handlers/handleListProjects.ts
 var import_fs18 = require("fs");
-var import_os9 = require("os");
-var import_path18 = require("path");
+var import_os10 = require("os");
+var import_path19 = require("path");
 var HEAD_BYTES = 64 * 1024;
 var MAX_FILES_PROBED = 3;
 function readRecordedCwd(dir) {
@@ -11635,7 +11754,7 @@ function readRecordedCwd(dir) {
   for (const file of files.slice(0, MAX_FILES_PROBED)) {
     let fd;
     try {
-      fd = (0, import_fs18.openSync)((0, import_path18.join)(dir, file), "r");
+      fd = (0, import_fs18.openSync)((0, import_path19.join)(dir, file), "r");
       const buf = Buffer.alloc(HEAD_BYTES);
       const bytes = (0, import_fs18.readSync)(fd, buf, 0, HEAD_BYTES, 0);
       for (const line of buf.subarray(0, bytes).toString("utf8").split("\n")) {
@@ -11659,11 +11778,11 @@ function decodeProjectPath(dirName) {
 function handleListProjects(url, res) {
   const limit = Math.max(1, parseInt(url.searchParams.get("limit") ?? "50", 10) || 50);
   const offset = Math.max(0, parseInt(url.searchParams.get("offset") ?? "0", 10) || 0);
-  const projectsDir = (0, import_path18.join)((0, import_os9.homedir)(), ".claude", "projects");
+  const projectsDir = (0, import_path19.join)((0, import_os10.homedir)(), ".claude", "projects");
   let entries;
   try {
     entries = (0, import_fs18.readdirSync)(projectsDir).map((dirName) => {
-      const fullPath = (0, import_path18.join)(projectsDir, dirName);
+      const fullPath = (0, import_path19.join)(projectsDir, dirName);
       let mtime = 0;
       try {
         mtime = (0, import_fs18.statSync)(fullPath).mtimeMs;
@@ -11678,7 +11797,7 @@ function handleListProjects(url, res) {
   }
   const total = entries.length;
   const page = entries.slice(offset, offset + limit).map(({ dirName }) => {
-    const path = readRecordedCwd((0, import_path18.join)(projectsDir, dirName)) ?? decodeProjectPath(String(dirName));
+    const path = readRecordedCwd((0, import_path19.join)(projectsDir, dirName)) ?? decodeProjectPath(String(dirName));
     const name = path.split(/[\\/]/).filter(Boolean).pop() ?? dirName;
     return { name, path, dirName };
   });
@@ -11687,6 +11806,9 @@ function handleListProjects(url, res) {
 }
 
 // src/server-wiring.ts
+function wsAllows(principal, required) {
+  return principal === null || hasCapability(principal, required);
+}
 function createConversationWatcherEvents(deps) {
   return {
     onNewLineSpans: (filePath, spans, readFrom, endOffset) => {
@@ -11968,7 +12090,15 @@ function createApiDeps(deps) {
       const alertMsg = deps.cacheMonitor()?.wsMessage();
       if (alertMsg) deps.wsHub.unicast(ws, alertMsg);
     },
-    handleWsMessage: async (ws, raw) => {
+    handleWsMessage: async (ws, raw, principal) => {
+      const deny = (type, required) => {
+        deps.log().warn(`[ws.capability_denied] ${type} requires ${required}`, {
+          event: "ws.capability_denied",
+          type,
+          required,
+          ...principal?.deviceId ? { deviceId: principal.deviceId } : {}
+        });
+      };
       try {
         const msg = JSON.parse(String(raw));
         if (msg.type === "register" && typeof msg.clientId === "string") {
@@ -11978,6 +12108,10 @@ function createApiDeps(deps) {
           deps.wsToClientId.set(ws, msg.clientId);
         }
         if (msg.type === "subscribe_session" && typeof msg.sessionId === "string") {
+          if (!wsAllows(principal, "history:read")) {
+            deny(msg.type, "history:read");
+            return;
+          }
           deps.addSessionSubscriber(msg.sessionId, ws);
           if (deps.ptyManager.hasSession(msg.sessionId)) {
             const lines = await deps.ptyManager.getOutputLines(msg.sessionId, 200);
@@ -12026,6 +12160,10 @@ function createApiDeps(deps) {
           }
         }
         if (msg.type === "hold_session" && typeof msg.sessionId === "string") {
+          if (!wsAllows(principal, "session:control")) {
+            deny(msg.type, "session:control");
+            return;
+          }
           deps.startGraceTimer(msg.sessionId, deps.ptyGracePeriodMs);
         }
       } catch {
@@ -12053,11 +12191,11 @@ var import_fs22 = require("fs");
 
 // src/services/cache-integrity/alertStore.ts
 var import_fs20 = require("fs");
-var import_os10 = require("os");
-var import_path19 = require("path");
+var import_os11 = require("os");
+var import_path20 = require("path");
 function alertStatePath() {
-  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path19.join)((0, import_os10.homedir)(), ".threadbase");
-  return (0, import_path19.join)(dir, "cache-alert.json");
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path20.join)((0, import_os11.homedir)(), ".threadbase");
+  return (0, import_path20.join)(dir, "cache-alert.json");
 }
 function loadAlertState() {
   try {
@@ -12069,14 +12207,14 @@ function loadAlertState() {
 }
 function saveAlertState(state) {
   const path = alertStatePath();
-  (0, import_fs20.mkdirSync)((0, import_path19.dirname)(path), { recursive: true });
+  (0, import_fs20.mkdirSync)((0, import_path20.dirname)(path), { recursive: true });
   (0, import_fs20.writeFileSync)(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 
 // src/services/cache-integrity/backup.ts
 var import_fs21 = require("fs");
-var import_path20 = require("path");
+var import_path21 = require("path");
 var DEFAULT_RETAIN = 3;
 function retainCount() {
   const parsed = Number.parseInt(process.env.THREADBASE_CACHE_BACKUP_RETAIN ?? "", 10);
@@ -12087,13 +12225,13 @@ function timestamp(d) {
   return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
 }
 async function backupCacheDb(db, cacheDir) {
-  const backupsDir = (0, import_path20.join)(cacheDir, "backups");
+  const backupsDir = (0, import_path21.join)(cacheDir, "backups");
   (0, import_fs21.mkdirSync)(backupsDir, { recursive: true });
-  const destPath = (0, import_path20.join)(backupsDir, `cache-${timestamp(/* @__PURE__ */ new Date())}.db`);
+  const destPath = (0, import_path21.join)(backupsDir, `cache-${timestamp(/* @__PURE__ */ new Date())}.db`);
   await db.backup(destPath);
   const retain = retainCount();
   const backups = (0, import_fs21.readdirSync)(backupsDir).filter((f) => f.startsWith("cache-") && f.endsWith(".db")).map((f) => {
-    const full = (0, import_path20.join)(backupsDir, f);
+    const full = (0, import_path21.join)(backupsDir, f);
     return { full, mtime: (0, import_fs21.statSync)(full).mtimeMs };
   }).sort((a, b) => b.mtime - a.mtime);
   for (const stale of backups.slice(retain)) {
@@ -13907,9 +14045,15 @@ function getSortValue(s, key) {
     case "projectName":
       return s.projectName;
     case "status":
-      return s.status;
+      return statusSortValue(s);
   }
 }
+function statusSortValue(s) {
+  const rank = s.status === "idle" ? 1 : 0;
+  const activeAt = Date.parse(s.lastActivityAt ?? s.startedAt);
+  const recency = String(1e15 - (Number.isNaN(activeAt) ? 0 : activeAt)).padStart(16, "0");
+  return `${rank}:${recency}`;
+}
 function compareValues(a, b) {
   if (a === void 0 && b === void 0) return 0;
   if (a === void 0) return 1;
@@ -14044,8 +14188,8 @@ function discoveredToResponse(d, conversationId) {
 
 // src/session-watchers.ts
 var import_fs26 = require("fs");
-var import_os11 = require("os");
-var import_path21 = require("path");
+var import_os12 = require("os");
+var import_path22 = require("path");
 var SessionWatchers = class {
   constructor(deps) {
     this.deps = deps;
@@ -14126,9 +14270,9 @@ var SessionWatchers = class {
   // was passed to Claude via --session-id so the filename matches from the start.
   watchForJsonl(sessionId, projectPath) {
     const encoded = projectPath.replace(/[/\\:.]/g, "-");
-    const projectsDir = (0, import_path21.join)((0, import_os11.homedir)(), ".claude", "projects", encoded);
+    const projectsDir = (0, import_path22.join)((0, import_os12.homedir)(), ".claude", "projects", encoded);
     const expectedFile = `${sessionId}.jsonl`;
-    const filePath = (0, import_path21.join)(projectsDir, expectedFile);
+    const filePath = (0, import_path22.join)(projectsDir, expectedFile);
     const deadline = Date.now() + 12e4;
     let watcher = null;
     const cleanup = () => {
@@ -14150,10 +14294,10 @@ var SessionWatchers = class {
       if (!resolvedFilePath && (0, import_fs26.existsSync)(projectsDir)) {
         try {
           const now = Date.now();
-          const match = (0, import_fs26.readdirSync)(projectsDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, mtime: (0, import_fs26.statSync)((0, import_path21.join)(projectsDir, f)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).filter(
-            ({ f }) => (0, import_path21.basename)(f, ".jsonl") === sessionId || this.readFirstLineSessionId((0, import_path21.join)(projectsDir, f)) === sessionId
+          const match = (0, import_fs26.readdirSync)(projectsDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, mtime: (0, import_fs26.statSync)((0, import_path22.join)(projectsDir, f)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).filter(
+            ({ f }) => (0, import_path22.basename)(f, ".jsonl") === sessionId || this.readFirstLineSessionId((0, import_path22.join)(projectsDir, f)) === sessionId
           ).sort((a, b) => b.mtime - a.mtime)[0];
-          if (match) resolvedFilePath = (0, import_path21.join)(projectsDir, match.f);
+          if (match) resolvedFilePath = (0, import_path22.join)(projectsDir, match.f);
         } catch {
         }
       }
@@ -14197,7 +14341,7 @@ var SessionWatchers = class {
   watchForCodexRollout(sessionId, projectPath) {
     const deadline = Date.now() + 12e4;
     const now = /* @__PURE__ */ new Date();
-    const dateDir = (0, import_path21.join)(
+    const dateDir = (0, import_path22.join)(
       String(now.getFullYear()),
       String(now.getMonth() + 1).padStart(2, "0"),
       String(now.getDate()).padStart(2, "0")
@@ -14238,7 +14382,7 @@ var SessionWatchers = class {
         this.deps.sessionStore.listManaged().filter((s) => s.id !== sessionId && s.boundConversationId != null).map((s) => s.boundConversationId)
       );
       for (const root of this.deps.codexRoots) {
-        const sessionsDir = (0, import_path21.join)(root, dateDir);
+        const sessionsDir = (0, import_path22.join)(root, dateDir);
         if (!(0, import_fs26.existsSync)(sessionsDir)) continue;
         let candidateFiles;
         try {
@@ -14247,9 +14391,9 @@ var SessionWatchers = class {
           continue;
         }
         const nowMs = Date.now();
-        const recentCandidates = candidateFiles.map((f) => ({ f, mtime: (0, import_fs26.statSync)((0, import_path21.join)(sessionsDir, f)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b) => b.mtime - a.mtime);
+        const recentCandidates = candidateFiles.map((f) => ({ f, mtime: (0, import_fs26.statSync)((0, import_path22.join)(sessionsDir, f)).mtimeMs })).filter(({ mtime }) => nowMs - mtime < 1e4).sort((a, b) => b.mtime - a.mtime);
         for (const { f } of recentCandidates) {
-          const candidatePath = (0, import_path21.join)(sessionsDir, f);
+          const candidatePath = (0, import_path22.join)(sessionsDir, f);
           const match = matchesProjectPath(candidatePath);
           if (!match) continue;
           if (boundElsewhere.has(match.id)) continue;
@@ -14653,7 +14797,7 @@ var StreamerServer = class {
     this.skipStartupWarmup = config.skipStartupWarmup ?? false;
     this.autoResumeOnBoot = config.autoResumeOnBoot ?? false;
     this.scanProfiles = config.scanProfiles;
-    this.codexRoots = config.codexRoots ?? [(0, import_path22.join)((0, import_os12.homedir)(), ".codex", "sessions")];
+    this.codexRoots = config.codexRoots ?? [(0, import_path23.join)((0, import_os13.homedir)(), ".codex", "sessions")];
     this.ptyGracePeriodMs = config.ptyGracePeriodMs ?? DEFAULT_PTY_GRACE_PERIOD_MS;
     this.defaultSystemPrompt = config.defaultSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
     const flagResolution = resolveFeatureFlags({
@@ -14670,8 +14814,8 @@ var StreamerServer = class {
     this.claudeFlagsPersistable = config.claudeFlags === void 0;
     this.claudeFlags = config.claudeFlags ?? loadClaudeFlags();
     this.claudeExtraArgs = config.claudeExtraArgs ?? loadClaudeExtraArgs();
-    this.cacheDir = config.cacheDir ?? loadCacheDir() ?? (0, import_path22.join)((0, import_os12.homedir)(), ".threadbase", "cache");
-    this.runtimeDbPath = config.runtimeDbPath ?? process.env.THREADBASE_RUNTIME_DB ?? (0, import_path22.join)(process.env.THREADBASE_CONFIG_DIR ?? (0, import_path22.join)((0, import_os12.homedir)(), ".threadbase"), "runtime.db");
+    this.cacheDir = config.cacheDir ?? loadCacheDir() ?? (0, import_path23.join)((0, import_os13.homedir)(), ".threadbase", "cache");
+    this.runtimeDbPath = resolveRuntimeDbPath(config.runtimeDbPath);
     this.tailSize = config.tailSize ?? loadTailSize() ?? 10;
     this.directoryDebounceMs = parseDirScanDebounceEnv(process.env.THREADBASE_DIR_SCAN_DEBOUNCE_MS) ?? config.directoryScanDebounceMs ?? 1e3;
     this.scannerManager = new ScannerManager({
@@ -14847,7 +14991,7 @@ var StreamerServer = class {
         temporalClient,
         taskQueue: agentConfig.temporal.taskQueue
       });
-      const conversationsBaseDir = agentConfig.conversationsDir || (0, import_path22.join)((0, import_path22.dirname)(this.cacheDir), "conversations");
+      const conversationsBaseDir = agentConfig.conversationsDir || (0, import_path23.join)((0, import_path23.dirname)(this.cacheDir), "conversations");
       conversationWriter = createConversationWriter({
         baseDir: conversationsBaseDir
       });
@@ -15099,14 +15243,14 @@ var StreamerServer = class {
     }
     this.apnsClient = new ApnsClient(creds);
     const sender = new LiveActivitySender(this.apnsClient, pushRepo);
-    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os12.hostname)();
-    this.liveActivityNotifier = new LiveActivityNotifier(sender, serverId, (0, import_os12.hostname)());
+    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os13.hostname)();
+    this.liveActivityNotifier = new LiveActivityNotifier(sender, serverId, (0, import_os13.hostname)());
     this.liveActivityRenewal = new LiveActivityRenewalScheduler({
       repo: pushRepo,
       sender,
       sessionStore: this.sessionStore,
       serverId,
-      serverLabel: (0, import_os12.hostname)()
+      serverLabel: (0, import_os13.hostname)()
     });
     this.liveActivityRenewal.start();
     this.log.info("Live Activity push enabled", {
@@ -15126,7 +15270,7 @@ var StreamerServer = class {
    */
   initWaitingInputPush(pushRepo) {
     const sender = new ExpoPushSender(pushRepo, process.env.THREADBASE_EXPO_ACCESS_TOKEN);
-    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os12.hostname)();
+    const serverId = process.env.THREADBASE_INSTANCE_ID ?? (0, import_os13.hostname)();
     this.waitingInputNotifier = new WaitingInputNotifier(
       sender,
       serverId,
@@ -15263,7 +15407,7 @@ var StreamerServer = class {
         let sessions = null;
         for (let attempt = 0; attempt < 2; attempt += 1) {
           const transport = await connectOrSpawnHost({
-            instanceId: process.env.THREADBASE_INSTANCE_ID ?? (0, import_os12.hostname)()
+            instanceId: process.env.THREADBASE_INSTANCE_ID ?? (0, import_os13.hostname)()
           });
           try {
             sessions = await this.ptyManager.useRemoteRunner(transport);
@@ -15320,6 +15464,7 @@ var StreamerServer = class {
         try {
           this.runtimeStore = RuntimeStore.open(this.runtimeDbPath);
           this.managedSessionsRepo = new ManagedSessionsRepository(this.runtimeStore.getDatabase());
+          this.devicesRepo = new DevicesRepository(this.runtimeStore.getDatabase());
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           const abiMismatch = message.includes("NODE_MODULE_VERSION") || message.includes("was compiled against a different Node.js version");
@@ -15339,7 +15484,7 @@ var StreamerServer = class {
         }
         try {
           this.cache = ConversationCache.open(
-            (0, import_path22.join)(this.cacheDir, "cache.db"),
+            (0, import_path23.join)(this.cacheDir, "cache.db"),
             this.tailSize,
             void 0,
             {
@@ -15369,18 +15514,39 @@ var StreamerServer = class {
             if (copied > 0) {
               this.log.info(`Copied ${copied} managed session row(s) from cache.db to runtime.db`, {
                 copied,
+                table: "managed_sessions",
                 event: "runtime.legacy_import"
               });
             }
           } catch (err) {
             this.log.warn("[registry] legacy managed_sessions copy failed", {
               event: "runtime.legacy_import_failed",
+              table: "managed_sessions",
+              err
+            });
+          }
+          try {
+            const result = this.runtimeStore?.importLegacyDevices(db);
+            if (result && result.copied > 0) {
+              this.log.info(
+                `Moved ${result.copied} device row(s) from cache.db to runtime.db` + (result.purged ? "; removed the cache-side copy" : "; KEPT the cache-side copy (row count did not match after copy)"),
+                {
+                  copied: result.copied,
+                  purged: result.purged,
+                  table: "devices",
+                  event: "runtime.legacy_import"
+                }
+              );
+            }
+          } catch (err) {
+            this.log.warn("[registry] legacy devices move failed", {
+              event: "runtime.legacy_import_failed",
+              table: "devices",
               err
             });
           }
           this.cacheMetadataRepo = new CacheMetadataRepository(db);
           this.pushRepo = new PushRepository(db);
-          this.devicesRepo = new DevicesRepository(db);
           this.initLiveActivityPush(this.pushRepo);
           this.initWaitingInputPush(this.pushRepo);
           this.cacheMonitor = new CacheIntegrityMonitor(
@@ -15706,7 +15872,7 @@ var StreamerServer = class {
       nonce: sealed.nonce,
       ephemeralPublicKey: sealed.ephemeralPublicKey,
       publicUrl: this.publicUrl,
-      machineName: (0, import_os12.hostname)(),
+      machineName: (0, import_os13.hostname)(),
       ...device && {
         deviceId: device.deviceId,
         deviceToken: device.deviceToken,