trainbud 0.5.0 → 0.5.2

package/dist/appDb.d.ts

@@ -14,7 +14,7 @@ export interface PromptJob {
     created_at: number;
     completed_at: number | null;
 }
-export declare const APP_DB_SCHEMA = "\n    CREATE TABLE IF NOT EXISTS settings (\n      key   TEXT PRIMARY KEY,\n      value TEXT NOT NULL\n    );\n    CREATE TABLE IF NOT EXISTS pair_tokens (\n      code        TEXT PRIMARY KEY,\n      created_at  INTEGER NOT NULL,\n      expires_at  INTEGER NOT NULL,\n      approved_at INTEGER\n    );\n    CREATE TABLE IF NOT EXISTS prompt_jobs (\n      id           TEXT PRIMARY KEY,\n      prompt       TEXT NOT NULL,\n      status       TEXT NOT NULL DEFAULT 'pending',\n      result       TEXT,\n      error        TEXT,\n      created_at   INTEGER NOT NULL,\n      completed_at INTEGER\n    );\n\n    -- Usage. cost_usd is nullable ON PURPOSE: a model this build has no\n    -- published price for records its tokens and leaves the cost unknown,\n    -- because a call priced at zero is a monthly cap that can never trip.\n    -- The schema lives here rather than in usage.ts so that opening the\n    -- database does not have to import the module that writes to it.\n    CREATE TABLE IF NOT EXISTS ai_usage (\n      id            INTEGER PRIMARY KEY AUTOINCREMENT,\n      at            INTEGER NOT NULL,\n      kind          TEXT    NOT NULL,\n      model         TEXT    NOT NULL,\n      source        TEXT    NOT NULL,\n      input_tokens  INTEGER NOT NULL,\n      output_tokens INTEGER NOT NULL,\n      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,\n      cache_write_tokens INTEGER NOT NULL DEFAULT 0,\n      cost_usd      REAL\n    );\n    CREATE INDEX IF NOT EXISTS ai_usage_at ON ai_usage(at);\n\n    CREATE TABLE IF NOT EXISTS feature_usage (\n      name  TEXT NOT NULL,\n      day   TEXT NOT NULL,\n      count INTEGER NOT NULL,\n      PRIMARY KEY (name, day)\n    );\n";
+export declare const APP_DB_SCHEMA = "\n    CREATE TABLE IF NOT EXISTS settings (\n      key   TEXT PRIMARY KEY,\n      value TEXT NOT NULL\n    );\n    CREATE TABLE IF NOT EXISTS pair_tokens (\n      code        TEXT PRIMARY KEY,\n      created_at  INTEGER NOT NULL,\n      expires_at  INTEGER NOT NULL,\n      approved_at INTEGER\n    );\n    -- One row per paired watch. Only the SHA-256 of the token is kept; see\n    -- deviceTokens.ts for why the plaintext is not stored anywhere. Created by\n    -- IF NOT EXISTS on every open, so a database written before 0.5.2 gains\n    -- the table without a migration step and without touching its other rows.\n    CREATE TABLE IF NOT EXISTS device_tokens (\n      id           INTEGER PRIMARY KEY AUTOINCREMENT,\n      token_hash   TEXT    NOT NULL UNIQUE,\n      label        TEXT    NOT NULL,\n      created_at   INTEGER NOT NULL,\n      last_seen_at INTEGER\n    );\n\n    CREATE TABLE IF NOT EXISTS prompt_jobs (\n      id           TEXT PRIMARY KEY,\n      prompt       TEXT NOT NULL,\n      status       TEXT NOT NULL DEFAULT 'pending',\n      result       TEXT,\n      error        TEXT,\n      created_at   INTEGER NOT NULL,\n      completed_at INTEGER\n    );\n\n    -- Usage. cost_usd is nullable ON PURPOSE: a model this build has no\n    -- published price for records its tokens and leaves the cost unknown,\n    -- because a call priced at zero is a monthly cap that can never trip.\n    -- The schema lives here rather than in usage.ts so that opening the\n    -- database does not have to import the module that writes to it.\n    CREATE TABLE IF NOT EXISTS ai_usage (\n      id            INTEGER PRIMARY KEY AUTOINCREMENT,\n      at            INTEGER NOT NULL,\n      kind          TEXT    NOT NULL,\n      model         TEXT    NOT NULL,\n      source        TEXT    NOT NULL,\n      input_tokens  INTEGER NOT NULL,\n      output_tokens INTEGER NOT NULL,\n      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,\n      cache_write_tokens INTEGER NOT NULL DEFAULT 0,\n      cost_usd      REAL\n    );\n    CREATE INDEX IF NOT EXISTS ai_usage_at ON ai_usage(at);\n\n    CREATE TABLE IF NOT EXISTS feature_usage (\n      name  TEXT NOT NULL,\n      day   TEXT NOT NULL,\n      count INTEGER NOT NULL,\n      PRIMARY KEY (name, day)\n    );\n";
 /**
  * The open handle, for modules that own their own tables.
  *
@@ -44,6 +44,45 @@ export declare function getPairToken(code: string): PairToken | null;
 export declare function approvePairToken(code: string): boolean;
 export declare function deletePairToken(code: string): void;
 export declare function listPendingPairTokens(): PairToken[];
+export interface DeviceToken {
+    id: number;
+    label: string;
+    created_at: number;
+    last_seen_at: number | null;
+}
+/**
+ * Mints a token, stores its hash, and returns the plaintext exactly once.
+ *
+ * There is no way to read it back afterwards, which is the point: the only
+ * copy that survives this call is the one the watch stores. A lost token is
+ * re-paired, not recovered.
+ */
+export declare function createDeviceToken(label: string): {
+    id: number;
+    token: string;
+};
+/**
+ * The id behind a token, or null.
+ *
+ * The lookup is an indexed equality match on a hash rather than a constant-time
+ * comparison, and that is deliberate: timing here can only leak how close a
+ * guess came to an existing *hash*, and producing a token that hashes to a
+ * known value is the preimage problem. The master key comparison in
+ * httpServer.ts is timing-safe because there the secret itself is compared.
+ */
+export declare function findDeviceTokenId(token: string): number | null;
+/**
+ * Records that a device was seen, at most once a minute.
+ *
+ * The watch polls, and an unthrottled write here would mean a database write
+ * per request for a column nobody reads more precisely than "today".
+ */
+export declare function touchDeviceToken(id: number, now?: number): void;
+export declare function listDeviceTokens(): DeviceToken[];
+/** True if a row was actually removed, so the CLI can say so honestly. */
+export declare function revokeDeviceToken(id: number): boolean;
+/** Returns how many were revoked. */
+export declare function revokeAllDeviceTokens(): number;
 /**
  * How old an unfinished job has to be before it counts as wreckage.
  *

package/dist/appDb.js

@@ -3,56 +3,69 @@ import { randomInt } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { appConfig } from "./config.js";
+import { generateDeviceToken, hashDeviceToken, looksLikeDeviceToken } from "./deviceTokens.js";
 import { restrictExistingFile } from "./utils/secretFile.js";
 // SECTION: App DB — settings, pair tokens, prompt jobs
 const DB_PATH = path.resolve(path.dirname(appConfig.cachePath), "app.db");
 let _db = null;
-export const APP_DB_SCHEMA = `
-    CREATE TABLE IF NOT EXISTS settings (
-      key   TEXT PRIMARY KEY,
-      value TEXT NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS pair_tokens (
-      code        TEXT PRIMARY KEY,
-      created_at  INTEGER NOT NULL,
-      expires_at  INTEGER NOT NULL,
-      approved_at INTEGER
-    );
-    CREATE TABLE IF NOT EXISTS prompt_jobs (
-      id           TEXT PRIMARY KEY,
-      prompt       TEXT NOT NULL,
-      status       TEXT NOT NULL DEFAULT 'pending',
-      result       TEXT,
-      error        TEXT,
-      created_at   INTEGER NOT NULL,
-      completed_at INTEGER
-    );
-
-    -- Usage. cost_usd is nullable ON PURPOSE: a model this build has no
-    -- published price for records its tokens and leaves the cost unknown,
-    -- because a call priced at zero is a monthly cap that can never trip.
-    -- The schema lives here rather than in usage.ts so that opening the
-    -- database does not have to import the module that writes to it.
-    CREATE TABLE IF NOT EXISTS ai_usage (
-      id            INTEGER PRIMARY KEY AUTOINCREMENT,
-      at            INTEGER NOT NULL,
-      kind          TEXT    NOT NULL,
-      model         TEXT    NOT NULL,
-      source        TEXT    NOT NULL,
-      input_tokens  INTEGER NOT NULL,
-      output_tokens INTEGER NOT NULL,
-      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,
-      cache_write_tokens INTEGER NOT NULL DEFAULT 0,
-      cost_usd      REAL
-    );
-    CREATE INDEX IF NOT EXISTS ai_usage_at ON ai_usage(at);
-
-    CREATE TABLE IF NOT EXISTS feature_usage (
-      name  TEXT NOT NULL,
-      day   TEXT NOT NULL,
-      count INTEGER NOT NULL,
-      PRIMARY KEY (name, day)
-    );
+export const APP_DB_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS settings (
+      key   TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS pair_tokens (
+      code        TEXT PRIMARY KEY,
+      created_at  INTEGER NOT NULL,
+      expires_at  INTEGER NOT NULL,
+      approved_at INTEGER
+    );
+    -- One row per paired watch. Only the SHA-256 of the token is kept; see
+    -- deviceTokens.ts for why the plaintext is not stored anywhere. Created by
+    -- IF NOT EXISTS on every open, so a database written before 0.5.2 gains
+    -- the table without a migration step and without touching its other rows.
+    CREATE TABLE IF NOT EXISTS device_tokens (
+      id           INTEGER PRIMARY KEY AUTOINCREMENT,
+      token_hash   TEXT    NOT NULL UNIQUE,
+      label        TEXT    NOT NULL,
+      created_at   INTEGER NOT NULL,
+      last_seen_at INTEGER
+    );
+
+    CREATE TABLE IF NOT EXISTS prompt_jobs (
+      id           TEXT PRIMARY KEY,
+      prompt       TEXT NOT NULL,
+      status       TEXT NOT NULL DEFAULT 'pending',
+      result       TEXT,
+      error        TEXT,
+      created_at   INTEGER NOT NULL,
+      completed_at INTEGER
+    );
+
+    -- Usage. cost_usd is nullable ON PURPOSE: a model this build has no
+    -- published price for records its tokens and leaves the cost unknown,
+    -- because a call priced at zero is a monthly cap that can never trip.
+    -- The schema lives here rather than in usage.ts so that opening the
+    -- database does not have to import the module that writes to it.
+    CREATE TABLE IF NOT EXISTS ai_usage (
+      id            INTEGER PRIMARY KEY AUTOINCREMENT,
+      at            INTEGER NOT NULL,
+      kind          TEXT    NOT NULL,
+      model         TEXT    NOT NULL,
+      source        TEXT    NOT NULL,
+      input_tokens  INTEGER NOT NULL,
+      output_tokens INTEGER NOT NULL,
+      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,
+      cache_write_tokens INTEGER NOT NULL DEFAULT 0,
+      cost_usd      REAL
+    );
+    CREATE INDEX IF NOT EXISTS ai_usage_at ON ai_usage(at);
+
+    CREATE TABLE IF NOT EXISTS feature_usage (
+      name  TEXT NOT NULL,
+      day   TEXT NOT NULL,
+      count INTEGER NOT NULL,
+      PRIMARY KEY (name, day)
+    );
 `;
 function getDb() {
     if (_db)
@@ -161,6 +174,62 @@ export function listPendingPairTokens() {
         .prepare("SELECT code, created_at, expires_at, approved_at FROM pair_tokens WHERE expires_at > ? AND approved_at IS NULL ORDER BY created_at DESC")
         .all(now);
 }
+/**
+ * Mints a token, stores its hash, and returns the plaintext exactly once.
+ *
+ * There is no way to read it back afterwards, which is the point: the only
+ * copy that survives this call is the one the watch stores. A lost token is
+ * re-paired, not recovered.
+ */
+export function createDeviceToken(label) {
+    const token = generateDeviceToken();
+    const now = Math.floor(Date.now() / 1000);
+    const result = getDb()
+        .prepare("INSERT INTO device_tokens (token_hash, label, created_at, last_seen_at) VALUES (?, ?, ?, NULL)")
+        .run(hashDeviceToken(token), label, now);
+    return { id: Number(result.lastInsertRowid), token };
+}
+/**
+ * The id behind a token, or null.
+ *
+ * The lookup is an indexed equality match on a hash rather than a constant-time
+ * comparison, and that is deliberate: timing here can only leak how close a
+ * guess came to an existing *hash*, and producing a token that hashes to a
+ * known value is the preimage problem. The master key comparison in
+ * httpServer.ts is timing-safe because there the secret itself is compared.
+ */
+export function findDeviceTokenId(token) {
+    if (!looksLikeDeviceToken(token))
+        return null;
+    const row = getDb()
+        .prepare("SELECT id FROM device_tokens WHERE token_hash = ?")
+        .get(hashDeviceToken(token));
+    return row?.id ?? null;
+}
+/**
+ * Records that a device was seen, at most once a minute.
+ *
+ * The watch polls, and an unthrottled write here would mean a database write
+ * per request for a column nobody reads more precisely than "today".
+ */
+export function touchDeviceToken(id, now = Math.floor(Date.now() / 1000)) {
+    getDb()
+        .prepare("UPDATE device_tokens SET last_seen_at = ? WHERE id = ? AND (last_seen_at IS NULL OR last_seen_at < ?)")
+        .run(now, id, now - 60);
+}
+export function listDeviceTokens() {
+    return getDb()
+        .prepare("SELECT id, label, created_at, last_seen_at FROM device_tokens ORDER BY created_at DESC")
+        .all();
+}
+/** True if a row was actually removed, so the CLI can say so honestly. */
+export function revokeDeviceToken(id) {
+    return getDb().prepare("DELETE FROM device_tokens WHERE id = ?").run(id).changes > 0;
+}
+/** Returns how many were revoked. */
+export function revokeAllDeviceTokens() {
+    return getDb().prepare("DELETE FROM device_tokens").run().changes;
+}
 // Prompt jobs
 /** Kept long enough to answer "what did it say earlier today", not forever. */
 const PROMPT_JOB_TTL_SECONDS = 7 * 24 * 60 * 60;
@@ -190,11 +259,11 @@ export const STALE_PROMPT_JOB_SECONDS = 5 * 60;
  * in flight.
  */
 export function reconcileStalePromptJobs(db, now = Math.floor(Date.now() / 1000)) {
-    db.prepare(`UPDATE prompt_jobs
-        SET status = 'error',
-            error = 'The server stopped before this answer came back.',
-            completed_at = ?
-      WHERE status IN ('pending', 'running')
+    db.prepare(`UPDATE prompt_jobs
+        SET status = 'error',
+            error = 'The server stopped before this answer came back.',
+            completed_at = ?
+      WHERE status IN ('pending', 'running')
         AND created_at < ?`).run(now, now - STALE_PROMPT_JOB_SECONDS);
     prunePromptJobs(db, now);
 }

package/dist/cli.js

@@ -17,6 +17,7 @@ import { startHistoryScheduler } from "./history/scheduler.js";
 import { closeHistoryDb, historyStats, pruneRawPayloads, RAW_RETENTION_DAYS, RAW_REVISIONS_KEPT, } from "./history/store.js";
 import { describeFindingsCoverage, runDetectors } from "./detect/index.js";
 import { printLiveCheckResults, runLiveCheck } from "./check.js";
+import { listDeviceTokens, revokeAllDeviceTokens, revokeDeviceToken } from "./appDb.js";
 // SECTION: Bootstrap
 //
 // Runs before every command. Moves pre-0.3.0 state out of `.garmin/` and warns
@@ -440,6 +441,52 @@ export function createCliProgram() {
             process.exitCode = 1;
         }
     });
+    // Revoking a watch used to mean rotating TRAINBUD_API_KEY, which logged out
+    // the dashboard and every MCP client at the same time -- and, until watch
+    // 2.0.2, left the watch holding a dead key it would not replace. A paired
+    // watch now carries a token of its own, and this is where it is taken away.
+    const devicesCommand = program.command("devices").description("List and revoke paired watches");
+    devicesCommand
+        .command("list", { isDefault: true })
+        .description("Show paired watches, newest first")
+        .action(() => {
+        const devices = listDeviceTokens();
+        if (devices.length === 0) {
+            console.log("No paired watches. Pair one from the watch app's setup screen.");
+            return;
+        }
+        for (const device of devices) {
+            const created = new Date(device.created_at * 1000).toISOString().slice(0, 10);
+            const seen = device.last_seen_at
+                ? new Date(device.last_seen_at * 1000).toISOString().slice(0, 16).replace("T", " ")
+                : "never";
+            console.log(`${String(device.id).padStart(3)}  ${device.label}  paired ${created}  last seen ${seen}`);
+        }
+    });
+    devicesCommand
+        .command("revoke [id]")
+        .description("Revoke one paired watch, or --all of them")
+        .option("--all", "Revoke every paired watch")
+        .action((id, options) => {
+        if (options.all) {
+            const count = revokeAllDeviceTokens();
+            console.log(count === 0 ? "Nothing to revoke." : `Revoked ${count} watch${count === 1 ? "" : "es"}.`);
+            return;
+        }
+        const numericId = Number(id);
+        if (!id || !Number.isInteger(numericId)) {
+            console.error("Pass the id from `trainbud devices list`, or --all.");
+            process.exitCode = 1;
+            return;
+        }
+        if (revokeDeviceToken(numericId)) {
+            console.log(`Revoked ${numericId}. That watch will show "Watch not authorised" and can pair again.`);
+        }
+        else {
+            console.error(`No paired watch with id ${numericId}.`);
+            process.exitCode = 1;
+        }
+    });
     program
         .command("status")
         .description("Show session and cache status")