@threadbase-sh/streamer 1.57.0 → 1.58.1

package/dist/index.d.cts

@@ -1204,6 +1204,11 @@ interface DeviceRow {
     created_at: number;
     last_seen_at: number | null;
     revoked_at: number | null;
+    /** Noise static public key, base64. Null on every row that predates E2EE. */
+    e2ee_static_pub: string | null;
+    /** The downgrade lock. 1 once this device has completed a handshake. */
+    e2ee_required: number;
+    e2ee_version: number | null;
 }
 /** A device as reported over the API. Deliberately carries no credential. */
 interface DeviceView {
@@ -1213,6 +1218,16 @@ interface DeviceView {
     createdAt: number;
     lastSeenAt: number | null;
     revokedAt: number | null;
+    /**
+     * Whether this device is pinned to encryption.
+     *
+     * A boolean, never the key and never a hash of it: `GET /api/devices` exists
+     * so a user can spot a device they did not pair, and answering "is this one
+     * encrypted" needs no key material to do it. Publishing the static key would
+     * hand an attacker who reached this endpoint the value that identifies a
+     * device.
+     */
+    e2ee: boolean;
 }
 interface RegisteredDevice {
     deviceId: string;
@@ -1229,6 +1244,8 @@ declare class DevicesRepository {
     private touchStmt;
     private deleteStmt;
     private deleteRevokedStmt;
+    private byE2eeStaticPubStmt;
+    private repairStmt;
     constructor(db: Database.Database);
     /**
      * Record a newly paired device and mint its token.
@@ -1241,7 +1258,16 @@ declare class DevicesRepository {
         name?: string | null;
         preset?: CapabilityPreset;
         now?: number;
+        /**
+         * The device's Noise static public key, base64, when pairing completed a
+         * handshake. Absent on a plaintext pairing, which stays exactly as it is
+         * today: no key, no pin, no behaviour change.
+         */
+        e2eeStaticPub?: string;
+        e2eeVersion?: number;
     }): RegisteredDevice;
+    /** The device that owns a Noise static key, or null. */
+    getByE2eeStaticPub(staticPub: string): DeviceRow | null;
     /**
      * Resolve a presented token to a device, or null.
      *

package/dist/index.d.ts

@@ -1204,6 +1204,11 @@ interface DeviceRow {
     created_at: number;
     last_seen_at: number | null;
     revoked_at: number | null;
+    /** Noise static public key, base64. Null on every row that predates E2EE. */
+    e2ee_static_pub: string | null;
+    /** The downgrade lock. 1 once this device has completed a handshake. */
+    e2ee_required: number;
+    e2ee_version: number | null;
 }
 /** A device as reported over the API. Deliberately carries no credential. */
 interface DeviceView {
@@ -1213,6 +1218,16 @@ interface DeviceView {
     createdAt: number;
     lastSeenAt: number | null;
     revokedAt: number | null;
+    /**
+     * Whether this device is pinned to encryption.
+     *
+     * A boolean, never the key and never a hash of it: `GET /api/devices` exists
+     * so a user can spot a device they did not pair, and answering "is this one
+     * encrypted" needs no key material to do it. Publishing the static key would
+     * hand an attacker who reached this endpoint the value that identifies a
+     * device.
+     */
+    e2ee: boolean;
 }
 interface RegisteredDevice {
     deviceId: string;
@@ -1229,6 +1244,8 @@ declare class DevicesRepository {
     private touchStmt;
     private deleteStmt;
     private deleteRevokedStmt;
+    private byE2eeStaticPubStmt;
+    private repairStmt;
     constructor(db: Database.Database);
     /**
      * Record a newly paired device and mint its token.
@@ -1241,7 +1258,16 @@ declare class DevicesRepository {
         name?: string | null;
         preset?: CapabilityPreset;
         now?: number;
+        /**
+         * The device's Noise static public key, base64, when pairing completed a
+         * handshake. Absent on a plaintext pairing, which stays exactly as it is
+         * today: no key, no pin, no behaviour change.
+         */
+        e2eeStaticPub?: string;
+        e2eeVersion?: number;
     }): RegisteredDevice;
+    /** The device that owns a Noise static key, or null. */
+    getByE2eeStaticPub(staticPub: string): DeviceRow | null;
     /**
      * Resolve a presented token to a device, or null.
      *

package/dist/index.js

@@ -1252,11 +1252,19 @@ var CodexPtyRunner = class {
   onStatusChange;
   onPhaseChange;
   onReady;
-  // Broadcasts Codex's blocking startup gates (directory trust, hooks review)
-  // as question cards; null dismisses the card once the gate leaves the screen.
+  // Every Codex prompt the client can answer — startup gates (directory trust,
+  // hooks review), command approvals, and the rate-limit model picker — is
+  // broadcast through this one channel; null dismisses the card once the prompt
+  // leaves the screen.
+  //
+  // Deliberately NOT onLiveQuestion/onLiveQuestionGone, which is Claude's
+  // AskUserQuestion transport. Both channels land on the same mobile
+  // QuestionCard, and the permission one is the correct fit for Codex: its menus
+  // are answered by the option's real on-screen number (parseCodexNumberedOptions
+  // emits `answerKeys: "2\r"`), which is exactly what `permissionIndices` carries
+  // and what AskUserQuestion's down-arrow-count model cannot express. Wiring the
+  // question channel as well would be a second path to the same card.
   onPermissionChange;
-  onLiveQuestion;
-  onLiveQuestionGone;
   onUserMessage;
   log;
   // Tracks sessions whose PTY has spawned but Codex hasn't yet reached its
@@ -1306,8 +1314,6 @@ var CodexPtyRunner = class {
     this.onPhaseChange = options.onPhaseChange;
     this.onReady = options.onReady;
     this.onPermissionChange = options.onPermissionChange;
-    this.onLiveQuestion = options.onLiveQuestion;
-    this.onLiveQuestionGone = options.onLiveQuestionGone;
     this.onUserMessage = options.onUserMessage;
     this.log = options.logger ?? getLogger("codex-pty");
   }
@@ -4135,7 +4141,12 @@ function toDeviceView(row) {
     capabilities: parseCapabilities(row.capabilities),
     createdAt: row.created_at,
     lastSeenAt: row.last_seen_at,
-    revokedAt: row.revoked_at
+    revokedAt: row.revoked_at,
+    // Reported from `e2ee_required` rather than from the key's presence. The
+    // two agree today, but they answer different questions — the key is what a
+    // handshake is checked against, `e2ee_required` is whether plaintext is
+    // refused — and it is the second one a user is asking about.
+    e2ee: row.e2ee_required === 1
   };
 }
 var DevicesRepository = class {
@@ -4147,14 +4158,30 @@ var DevicesRepository = class {
   touchStmt;
   deleteStmt;
   deleteRevokedStmt;
+  byE2eeStaticPubStmt;
+  repairStmt;
   constructor(db) {
     this.insertStmt = db.prepare(`
       INSERT INTO devices (
-        device_id, public_key, token_hash, name, capabilities, created_at
+        device_id, public_key, token_hash, name, capabilities, created_at,
+        e2ee_static_pub, e2ee_required, e2ee_version
       ) VALUES (
-        @device_id, @public_key, @token_hash, @name, @capabilities, @created_at
+        @device_id, @public_key, @token_hash, @name, @capabilities, @created_at,
+        @e2ee_static_pub, @e2ee_required, @e2ee_version
       )
     `);
+    this.byE2eeStaticPubStmt = db.prepare("SELECT * FROM devices WHERE e2ee_static_pub = ?");
+    this.repairStmt = db.prepare(`
+      UPDATE devices SET
+        public_key = @public_key,
+        token_hash = @token_hash,
+        name = @name,
+        capabilities = @capabilities,
+        e2ee_required = 1,
+        e2ee_version = @e2ee_version,
+        revoked_at = NULL
+      WHERE device_id = @device_id
+    `);
     this.byTokenHashStmt = db.prepare("SELECT * FROM devices WHERE token_hash = ?");
     this.byIdStmt = db.prepare("SELECT * FROM devices WHERE device_id = ?");
     this.listStmt = db.prepare("SELECT * FROM devices ORDER BY created_at DESC");
@@ -4170,19 +4197,42 @@ var DevicesRepository = class {
    * moment it exists outside the client.
    */
   register(args) {
-    const deviceId = randomUUID3();
     const deviceToken = generateDeviceToken();
     const capabilities = capabilitiesForPreset(args.preset ?? "full");
+    const now = args.now ?? Date.now();
+    const existing = args.e2eeStaticPub ? this.byE2eeStaticPubStmt.get(args.e2eeStaticPub) : void 0;
+    if (existing) {
+      this.repairStmt.run({
+        device_id: existing.device_id,
+        public_key: args.publicKey,
+        token_hash: hashDeviceToken(deviceToken),
+        name: args.name ?? null,
+        capabilities: JSON.stringify(capabilities),
+        e2ee_version: args.e2eeVersion ?? null
+      });
+      return { deviceId: existing.device_id, deviceToken, capabilities };
+    }
+    const deviceId = randomUUID3();
     this.insertStmt.run({
       device_id: deviceId,
       public_key: args.publicKey,
       token_hash: hashDeviceToken(deviceToken),
       name: args.name ?? null,
       capabilities: JSON.stringify(capabilities),
-      created_at: args.now ?? Date.now()
+      created_at: now,
+      e2ee_static_pub: args.e2eeStaticPub ?? null,
+      // The downgrade lock, set in the same write that records the key. Once
+      // set, nothing a client can send clears it (design.md §6.3) — which is
+      // what makes it a lock rather than a preference.
+      e2ee_required: args.e2eeStaticPub ? 1 : 0,
+      e2ee_version: args.e2eeVersion ?? null
     });
     return { deviceId, deviceToken, capabilities };
   }
+  /** The device that owns a Noise static key, or null. */
+  getByE2eeStaticPub(staticPub) {
+    return this.byE2eeStaticPubStmt.get(staticPub) ?? null;
+  }
   /**
    * Resolve a presented token to a device, or null.
    *
@@ -11302,7 +11352,37 @@ var PairTokenStore = class {
       expiresInSeconds: Math.floor(this.ttlMs / 1e3)
     };
   }
+  /**
+   * Whether `consume` would succeed right now, WITHOUT spending the token.
+   *
+   * Exists so a caller can reject a bad token before doing any work, and still
+   * spend the token only once the work has succeeded. A pair token is
+   * single-use and lives 180 seconds, so spending it on a request that then
+   * fails costs the user a whole new QR — and, worse, makes their retry
+   * indistinguishable from an attacker replaying a photographed code, which is
+   * the one signal `design.md` §2.6 designates as replay detection.
+   *
+   * Advisory, not a reservation: it takes no lock and holds nothing. The
+   * authoritative answer is still `consume`'s.
+   */
+  verify(token) {
+    const result = this.check(token);
+    return result.ok ? { ok: true } : result;
+  }
   consume(token) {
+    const result = this.check(token);
+    if (!result.ok) return result;
+    result.record.used = true;
+    return { ok: true };
+  }
+  /**
+   * The shared predicate behind `verify` and `consume`.
+   *
+   * One implementation on purpose: two copies of "is this token usable" is two
+   * places for the expiry or single-use rule to drift, and a drift in this
+   * direction fails open.
+   */
+  check(token) {
     const record2 = this.current;
     if (!record2 || record2.token !== token) return { ok: false, reason: "unknown" };
     if (Date.now() > record2.expiresAt) {
@@ -11310,8 +11390,7 @@ var PairTokenStore = class {
       return { ok: false, reason: "expired" };
     }
     if (record2.used) return { ok: false, reason: "used" };
-    record2.used = true;
-    return { ok: true };
+    return { ok: true, record: record2 };
   }
   peek() {
     return this.current;
@@ -16103,9 +16182,9 @@ var StreamerServer = class {
       json(res, 400, { error: "Missing token or clientPublicKey" });
       return;
     }
-    const result = this.pairTokens.consume(token);
-    if (!result.ok) {
-      json(res, 401, { error: `Pair token ${result.reason}` });
+    const precheck = this.pairTokens.verify(token);
+    if (!precheck.ok) {
+      json(res, 401, { error: `Pair token ${precheck.reason}` });
       return;
     }
     let sealed;
@@ -16116,6 +16195,11 @@ var StreamerServer = class {
       json(res, 400, { error: message });
       return;
     }
+    const result = this.pairTokens.consume(token);
+    if (!result.ok) {
+      json(res, 401, { error: `Pair token ${result.reason}` });
+      return;
+    }
     const ts = (/* @__PURE__ */ new Date()).toISOString();
     this.log.info(`[pair] token exchanged from ${ip} at ${ts}`, {
       event: "pair.token_exchanged",