@threadbase-sh/streamer 1.19.1 → 1.21.0

package/dist/cli.cjs

@@ -26078,7 +26078,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter6 } = require("events");
     var { Worker: Worker2 } = require("worker_threads");
-    var { join: join24 } = require("path");
+    var { join: join25 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -26129,7 +26129,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join24(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join25(__dirname, "lib", "worker.js");
       const worker = new Worker2(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -26597,7 +26597,7 @@ var require_transport = __commonJS({
     var { createRequire } = require("module");
     var { existsSync: existsSync11 } = require("fs");
     var getCallers = require_caller();
-    var { join: join24, isAbsolute: isAbsolute3, sep: sep2 } = require("path");
+    var { join: join25, isAbsolute: isAbsolute3, sep: sep2 } = require("path");
     var { fileURLToPath: fileURLToPath3 } = require("url");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -26750,7 +26750,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join24(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join25(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -26768,7 +26768,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join24(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join25(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -26791,7 +26791,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join24(__dirname, "..", "file.js");
+          return join25(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -27772,7 +27772,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join24 = ",";
+            let join25 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -27786,7 +27786,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join24 = `,
+                join25 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -27794,13 +27794,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join24;
+                res += join25;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join24}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join25}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -27821,7 +27821,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join24 = `,
+              join25 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -27835,13 +27835,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join24;
+                separator = join25;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join24;
+              separator = join25;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -27882,7 +27882,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join24 = ",";
+            let join25 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -27895,7 +27895,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join24 = `,
+                join25 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -27903,13 +27903,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join24;
+                res += join25;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join24}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join25}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -27922,7 +27922,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join24 = `,
+              join25 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -27931,7 +27931,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join24;
+                separator = join25;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -27989,20 +27989,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join25 = `,
+              const join26 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join25;
+                res2 += join26;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join25}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join26}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -28018,16 +28018,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join24 = `,
+            const join25 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join24, maximumBreadth);
+              res += stringifyTypedArray(value, join25, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join24;
+              separator = join25;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -28038,13 +28038,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join24;
+                separator = join25;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join24;
+              separator = join25;
             }
             if (separator !== "") {
               res = `
@@ -124399,20 +124399,20 @@ var require_semver2 = __commonJS({
 
 // src/lifecycle/constants.ts
 function installDir() {
-  return process.env.THREADBASE_INSTALL_DIR ?? (0, import_node_path21.join)((0, import_node_os4.homedir)(), ".threadbase");
+  return process.env.THREADBASE_INSTALL_DIR ?? (0, import_node_path22.join)((0, import_node_os4.homedir)(), ".threadbase");
 }
 function markerPath() {
-  return (0, import_node_path21.join)(installDir(), "prod-suspended.json");
+  return (0, import_node_path22.join)(installDir(), "prod-suspended.json");
 }
 function prefsPath() {
-  return (0, import_node_path21.join)(installDir(), "dev-prefs.json");
+  return (0, import_node_path22.join)(installDir(), "dev-prefs.json");
 }
-var import_node_os4, import_node_path21, LAUNCHD_LABEL, TASK_NAME;
+var import_node_os4, import_node_path22, LAUNCHD_LABEL, TASK_NAME;
 var init_constants = __esm({
   "src/lifecycle/constants.ts"() {
     "use strict";
     import_node_os4 = require("os");
-    import_node_path21 = require("path");
+    import_node_path22 = require("path");
     LAUNCHD_LABEL = "com.ronen.threadbase";
     TASK_NAME = process.env.THREADBASE_TASK_NAME ?? "Threadbase";
   }
@@ -124487,8 +124487,8 @@ function darwinPlistPath() {
   return `${process.env.HOME}/Library/LaunchAgents/${resolveLoadedLabel()}.plist`;
 }
 function getLogPaths() {
-  const dir = (0, import_node_path22.join)(installDir(), "logs");
-  return { stdout: (0, import_node_path22.join)(dir, "stdout.log"), stderr: (0, import_node_path22.join)(dir, "stderr.log") };
+  const dir = (0, import_node_path23.join)(installDir(), "logs");
+  return { stdout: (0, import_node_path23.join)(dir, "stdout.log"), stderr: (0, import_node_path23.join)(dir, "stderr.log") };
 }
 function getAgentPid() {
   try {
@@ -124508,12 +124508,12 @@ function getAgentPid() {
     return null;
   }
 }
-var import_node_child_process4, import_node_path22, BREW_LAUNCHD_LABEL2;
+var import_node_child_process4, import_node_path23, BREW_LAUNCHD_LABEL2;
 var init_launchd = __esm({
   "src/lifecycle/launchd.ts"() {
     "use strict";
     import_node_child_process4 = require("child_process");
-    import_node_path22 = require("path");
+    import_node_path23 = require("path");
     init_constants();
     BREW_LAUNCHD_LABEL2 = "homebrew.mxcl.tb-streamer";
   }
@@ -124538,9 +124538,9 @@ var init_marker_schema = __esm({
 
 // src/lifecycle/marker.ts
 function readMarker() {
-  if (!(0, import_node_fs18.existsSync)(markerPath())) return null;
+  if (!(0, import_node_fs19.existsSync)(markerPath())) return null;
   try {
-    const raw2 = (0, import_node_fs18.readFileSync)(markerPath(), "utf8");
+    const raw2 = (0, import_node_fs19.readFileSync)(markerPath(), "utf8");
     const parsed = JSON.parse(raw2);
     return MarkerSchema.parse(parsed);
   } catch (err) {
@@ -124552,21 +124552,21 @@ function readMarker() {
 }
 function writeMarker(marker) {
   MarkerSchema.parse(marker);
-  (0, import_node_fs18.mkdirSync)((0, import_node_path23.dirname)(markerPath()), { recursive: true });
+  (0, import_node_fs19.mkdirSync)((0, import_node_path24.dirname)(markerPath()), { recursive: true });
   const tmp = `${markerPath()}.tmp`;
-  (0, import_node_fs18.writeFileSync)(tmp, `${JSON.stringify(marker, null, 2)}
+  (0, import_node_fs19.writeFileSync)(tmp, `${JSON.stringify(marker, null, 2)}
 `, { mode: 384 });
-  (0, import_node_fs18.renameSync)(tmp, markerPath());
+  (0, import_node_fs19.renameSync)(tmp, markerPath());
 }
 function clearMarker() {
-  if ((0, import_node_fs18.existsSync)(markerPath())) (0, import_node_fs18.rmSync)(markerPath());
+  if ((0, import_node_fs19.existsSync)(markerPath())) (0, import_node_fs19.rmSync)(markerPath());
 }
-var import_node_fs18, import_node_path23, log3;
+var import_node_fs19, import_node_path24, log3;
 var init_marker = __esm({
   "src/lifecycle/marker.ts"() {
     "use strict";
-    import_node_fs18 = require("fs");
-    import_node_path23 = require("path");
+    import_node_fs19 = require("fs");
+    import_node_path24 = require("path");
     init_logger();
     init_constants();
     init_marker_schema();
@@ -124661,9 +124661,9 @@ var init_platform = __esm({
 // src/lifecycle/prefs.ts
 function readPrefs() {
   const path2 = prefsPath();
-  if (!(0, import_node_fs20.existsSync)(path2)) return { repos: {} };
+  if (!(0, import_node_fs21.existsSync)(path2)) return { repos: {} };
   try {
-    return PrefsSchema.parse(JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8")));
+    return PrefsSchema.parse(JSON.parse((0, import_node_fs21.readFileSync)(path2, "utf8")));
   } catch (err) {
     log5.warn(`prefs at ${path2} are malformed; treating as empty`, {
       error: err instanceof Error ? err.message : String(err)
@@ -124673,11 +124673,11 @@ function readPrefs() {
 }
 function savePrefs(p2) {
   const path2 = prefsPath();
-  (0, import_node_fs20.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
+  (0, import_node_fs21.mkdirSync)((0, import_node_path25.dirname)(path2), { recursive: true });
   const tmp = `${path2}.tmp`;
-  (0, import_node_fs20.writeFileSync)(tmp, `${JSON.stringify(p2, null, 2)}
+  (0, import_node_fs21.writeFileSync)(tmp, `${JSON.stringify(p2, null, 2)}
 `, { mode: 384 });
-  (0, import_node_fs20.renameSync)(tmp, path2);
+  (0, import_node_fs21.renameSync)(tmp, path2);
 }
 function writePrefForRepo(repoToplevel, choice) {
   const p2 = readPrefs();
@@ -124698,14 +124698,14 @@ function forgetRepo(repoToplevel) {
 }
 function forgetAll() {
   const path2 = prefsPath();
-  if ((0, import_node_fs20.existsSync)(path2)) (0, import_node_fs20.rmSync)(path2);
+  if ((0, import_node_fs21.existsSync)(path2)) (0, import_node_fs21.rmSync)(path2);
 }
-var import_node_fs20, import_node_path24, log5, PrefsSchema;
+var import_node_fs21, import_node_path25, log5, PrefsSchema;
 var init_prefs = __esm({
   "src/lifecycle/prefs.ts"() {
     "use strict";
-    import_node_fs20 = require("fs");
-    import_node_path24 = require("path");
+    import_node_fs21 = require("fs");
+    import_node_path25 = require("path");
     init_zod();
     init_logger();
     init_constants();
@@ -124927,7 +124927,7 @@ __export(setKey_exports, {
 async function defaultReadStdin() {
   return new Promise((resolve6, reject) => {
     const chunks = [];
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
     process.stdin.on("end", () => resolve6(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
@@ -136445,13 +136445,23 @@ var authMiddleware = (deps) => async (c, next) => {
 };
 
 // src/api/middleware/cors.middleware.ts
+var ALLOWED_ORIGINS = /* @__PURE__ */ new Set([
+  "http://localhost:8081",
+  "http://localhost:19006",
+  "http://localhost:3000"
+]);
 var corsMiddleware = () => async (c, next) => {
-  c.res.headers.set("Access-Control-Allow-Origin", "*");
-  c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
-  c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
-  c.res.headers.set("Access-Control-Expose-Headers", "ETag");
+  const origin = c.req.header("origin");
+  const allowedOrigin = origin && ALLOWED_ORIGINS.has(origin) ? origin : null;
+  if (allowedOrigin) {
+    c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+    c.res.headers.set("Vary", "Origin");
+    c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
+    c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
+    c.res.headers.set("Access-Control-Expose-Headers", "ETag");
+  }
   if (c.req.method === "OPTIONS") {
-    return c.newResponse(null, 204);
+    return c.newResponse(null, allowedOrigin ? 204 : 403);
   }
   await next();
 };
@@ -136595,6 +136605,19 @@ var createMiscRoutes = (deps) => {
     });
   });
   app.get("/api/profiles", (c) => c.json([]));
+  app.post("/api/auth/rotate", (c) => {
+    if (deps.localNoAuth) {
+      return c.json({ error: "key rotation is disabled while localNoAuth is active" }, 403);
+    }
+    const { newKey, persisted } = deps.rotateApiKey();
+    return c.json({
+      apiKey: newKey,
+      persisted,
+      ...persisted ? {} : {
+        warning: "Key rotated in memory only. The server was started with --api-key, so the old key will be restored on restart. Remove --api-key and let the server manage the key via ~/.threadbase/server.yaml for rotation to survive restarts."
+      }
+    });
+  });
   app.post("/api/push/register", (c) => c.json({ ok: true }));
   app.post("/api/__update", async (c) => {
     const cfg = loadUpdateConfig();
@@ -136796,6 +136819,11 @@ var ALREADY_HANDLED4 = 597;
 var alreadyHandled4 = () => new Response(null, { status: ALREADY_HANDLED4 });
 var createProjectRoutes = (deps) => {
   const app = new Hono2();
+  app.get("/", (c) => {
+    const url2 = new URL(c.req.url);
+    deps.handleListProjects(url2, c.env.outgoing);
+    return alreadyHandled4();
+  });
   app.get("/popular", (c) => {
     const url2 = new URL(c.req.url);
     deps.handleGetPopularProjects(url2, c.env.outgoing);
@@ -136814,11 +136842,6 @@ var createScannerRoutes = (deps) => {
     await deps.handleSearch(url2, c.env.outgoing);
     return alreadyHandled5();
   });
-  app.get("/project-chats", async (c) => {
-    const url2 = new URL(c.req.url);
-    await deps.handleListProjectChats(url2, c.env.outgoing);
-    return alreadyHandled5();
-  });
   return app;
 };
 
@@ -138082,517 +138105,39 @@ async function recordUpload(pool2, instanceId, row) {
   );
 }
 
-// src/schemas/queryParams.schema.ts
-init_zod();
-var ListProjectChatsQuerySchema = external_exports.object({
-  refresh: external_exports.enum(["1"]).optional(),
-  refreshConversations: external_exports.enum(["1"]).optional()
-});
-
-// src/services/cache/cacheMetadata.ts
-function getCacheMetadata(repo, key) {
-  return repo.getCacheMetadata(key);
-}
-function setCacheMetadata(repo, key, value) {
-  repo.setCacheMetadata(key, value);
-}
-
-// node_modules/date-fns/constants.js
-var daysInYear = 365.2425;
-var maxTime = Math.pow(10, 8) * 24 * 60 * 60 * 1e3;
-var minTime = -maxTime;
-var millisecondsInMinute = 6e4;
-var millisecondsInHour = 36e5;
-var secondsInHour = 3600;
-var secondsInDay = secondsInHour * 24;
-var secondsInWeek = secondsInDay * 7;
-var secondsInYear = secondsInDay * daysInYear;
-var secondsInMonth = secondsInYear / 12;
-var secondsInQuarter = secondsInMonth * 3;
-var constructFromSymbol = /* @__PURE__ */ Symbol.for("constructDateFrom");
-
-// node_modules/date-fns/constructFrom.js
-function constructFrom(date5, value) {
-  if (typeof date5 === "function") return date5(value);
-  if (date5 && typeof date5 === "object" && constructFromSymbol in date5)
-    return date5[constructFromSymbol](value);
-  if (date5 instanceof Date) return new date5.constructor(value);
-  return new Date(value);
-}
-
-// node_modules/date-fns/toDate.js
-function toDate(argument, context) {
-  return constructFrom(context || argument, argument);
-}
-
-// node_modules/date-fns/compareDesc.js
-function compareDesc(dateLeft, dateRight) {
-  const diff = +toDate(dateLeft) - +toDate(dateRight);
-  if (diff > 0) return -1;
-  else if (diff < 0) return 1;
-  return diff;
-}
-
-// node_modules/date-fns/isDate.js
-function isDate(value) {
-  return value instanceof Date || typeof value === "object" && Object.prototype.toString.call(value) === "[object Date]";
-}
-
-// node_modules/date-fns/isValid.js
-function isValid(date5) {
-  return !(!isDate(date5) && typeof date5 !== "number" || isNaN(+toDate(date5)));
-}
-
-// node_modules/date-fns/parseISO.js
-function parseISO(argument, options) {
-  const invalidDate = () => constructFrom(options?.in, NaN);
-  const additionalDigits = options?.additionalDigits ?? 2;
-  const dateStrings = splitDateString(argument);
-  let date5;
-  if (dateStrings.date) {
-    const parseYearResult = parseYear(dateStrings.date, additionalDigits);
-    date5 = parseDate(parseYearResult.restDateString, parseYearResult.year);
-  }
-  if (!date5 || isNaN(+date5)) return invalidDate();
-  const timestamp = +date5;
-  let time3 = 0;
-  let offset;
-  if (dateStrings.time) {
-    time3 = parseTime(dateStrings.time);
-    if (isNaN(time3)) return invalidDate();
-  }
-  if (dateStrings.timezone) {
-    offset = parseTimezone(dateStrings.timezone);
-    if (isNaN(offset)) return invalidDate();
-  } else {
-    const tmpDate = new Date(timestamp + time3);
-    const result = toDate(0, options?.in);
-    result.setFullYear(
-      tmpDate.getUTCFullYear(),
-      tmpDate.getUTCMonth(),
-      tmpDate.getUTCDate()
-    );
-    result.setHours(
-      tmpDate.getUTCHours(),
-      tmpDate.getUTCMinutes(),
-      tmpDate.getUTCSeconds(),
-      tmpDate.getUTCMilliseconds()
-    );
-    return result;
-  }
-  return toDate(timestamp + time3 + offset, options?.in);
-}
-var patterns = {
-  dateTimeDelimiter: /[T ]/,
-  timeZoneDelimiter: /[Z ]/i,
-  timezone: /([Z+-].*)$/
-};
-var dateRegex = /^-?(?:(\d{3})|(\d{2})(?:-?(\d{2}))?|W(\d{2})(?:-?(\d{1}))?|)$/;
-var timeRegex = /^(\d{2}(?:[.,]\d*)?)(?::?(\d{2}(?:[.,]\d*)?))?(?::?(\d{2}(?:[.,]\d*)?))?$/;
-var timezoneRegex = /^([+-])(\d{2})(?::?(\d{2}))?$/;
-function splitDateString(dateString) {
-  const dateStrings = {};
-  const array2 = dateString.split(patterns.dateTimeDelimiter);
-  let timeString;
-  if (array2.length > 2) {
-    return dateStrings;
-  }
-  if (/:/.test(array2[0])) {
-    timeString = array2[0];
-  } else {
-    dateStrings.date = array2[0];
-    timeString = array2[1];
-    if (patterns.timeZoneDelimiter.test(dateStrings.date)) {
-      dateStrings.date = dateString.split(patterns.timeZoneDelimiter)[0];
-      timeString = dateString.substr(
-        dateStrings.date.length,
-        dateString.length
-      );
-    }
-  }
-  if (timeString) {
-    const token = patterns.timezone.exec(timeString);
-    if (token) {
-      dateStrings.time = timeString.replace(token[1], "");
-      dateStrings.timezone = token[1];
-    } else {
-      dateStrings.time = timeString;
-    }
-  }
-  return dateStrings;
-}
-function parseYear(dateString, additionalDigits) {
-  const regex = new RegExp(
-    "^(?:(\\d{4}|[+-]\\d{" + (4 + additionalDigits) + "})|(\\d{2}|[+-]\\d{" + (2 + additionalDigits) + "})$)"
-  );
-  const captures = dateString.match(regex);
-  if (!captures) return { year: NaN, restDateString: "" };
-  const year = captures[1] ? parseInt(captures[1]) : null;
-  const century = captures[2] ? parseInt(captures[2]) : null;
-  return {
-    year: century === null ? year : century * 100,
-    restDateString: dateString.slice((captures[1] || captures[2]).length)
-  };
-}
-function parseDate(dateString, year) {
-  if (year === null) return /* @__PURE__ */ new Date(NaN);
-  const captures = dateString.match(dateRegex);
-  if (!captures) return /* @__PURE__ */ new Date(NaN);
-  const isWeekDate = !!captures[4];
-  const dayOfYear = parseDateUnit(captures[1]);
-  const month = parseDateUnit(captures[2]) - 1;
-  const day = parseDateUnit(captures[3]);
-  const week = parseDateUnit(captures[4]);
-  const dayOfWeek = parseDateUnit(captures[5]) - 1;
-  if (isWeekDate) {
-    if (!validateWeekDate(year, week, dayOfWeek)) {
-      return /* @__PURE__ */ new Date(NaN);
-    }
-    return dayOfISOWeekYear(year, week, dayOfWeek);
-  } else {
-    const date5 = /* @__PURE__ */ new Date(0);
-    if (!validateDate(year, month, day) || !validateDayOfYearDate(year, dayOfYear)) {
-      return /* @__PURE__ */ new Date(NaN);
-    }
-    date5.setUTCFullYear(year, month, Math.max(dayOfYear, day));
-    return date5;
-  }
-}
-function parseDateUnit(value) {
-  return value ? parseInt(value) : 1;
-}
-function parseTime(timeString) {
-  const captures = timeString.match(timeRegex);
-  if (!captures) return NaN;
-  const hours = parseTimeUnit(captures[1]);
-  const minutes = parseTimeUnit(captures[2]);
-  const seconds = parseTimeUnit(captures[3]);
-  if (!validateTime(hours, minutes, seconds)) {
-    return NaN;
-  }
-  return hours * millisecondsInHour + minutes * millisecondsInMinute + seconds * 1e3;
-}
-function parseTimeUnit(value) {
-  return value && parseFloat(value.replace(",", ".")) || 0;
-}
-function parseTimezone(timezoneString) {
-  if (timezoneString === "Z") return 0;
-  const captures = timezoneString.match(timezoneRegex);
-  if (!captures) return 0;
-  const sign = captures[1] === "+" ? -1 : 1;
-  const hours = parseInt(captures[2]);
-  const minutes = captures[3] && parseInt(captures[3]) || 0;
-  if (!validateTimezone(hours, minutes)) {
-    return NaN;
-  }
-  return sign * (hours * millisecondsInHour + minutes * millisecondsInMinute);
-}
-function dayOfISOWeekYear(isoWeekYear, week, day) {
-  const date5 = /* @__PURE__ */ new Date(0);
-  date5.setUTCFullYear(isoWeekYear, 0, 4);
-  const fourthOfJanuaryDay = date5.getUTCDay() || 7;
-  const diff = (week - 1) * 7 + day + 1 - fourthOfJanuaryDay;
-  date5.setUTCDate(date5.getUTCDate() + diff);
-  return date5;
-}
-var daysInMonths = [31, null, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-function isLeapYearIndex(year) {
-  return year % 400 === 0 || year % 4 === 0 && year % 100 !== 0;
-}
-function validateDate(year, month, date5) {
-  return month >= 0 && month <= 11 && date5 >= 1 && date5 <= (daysInMonths[month] || (isLeapYearIndex(year) ? 29 : 28));
-}
-function validateDayOfYearDate(year, dayOfYear) {
-  return dayOfYear >= 1 && dayOfYear <= (isLeapYearIndex(year) ? 366 : 365);
-}
-function validateWeekDate(_year, week, day) {
-  return week >= 1 && week <= 53 && day >= 0 && day <= 6;
-}
-function validateTime(hours, minutes, seconds) {
-  if (hours === 24) {
-    return minutes === 0 && seconds === 0;
-  }
-  return seconds >= 0 && seconds < 60 && minutes >= 0 && minutes < 60 && hours >= 0 && hours < 25;
-}
-function validateTimezone(_hours, minutes) {
-  return minutes >= 0 && minutes <= 59;
-}
-
-// src/utils/dates.ts
-function parseIsoDateOrNull(value) {
-  if (!value) return null;
-  const parsed = parseISO(value);
-  return isValid(parsed) ? parsed : null;
-}
-function compareIsoDesc(a, b2) {
-  const dateA = parseIsoDateOrNull(a);
-  const dateB = parseIsoDateOrNull(b2);
-  if (!dateA && !dateB) return 0;
-  if (!dateA) return 1;
-  if (!dateB) return -1;
-  return compareDesc(dateA, dateB);
-}
-
-// src/services/projects/ensureProjectsForConversations.ts
-function ensureProjectsForConversations(repo, conversations) {
-  const conversationsByPath = /* @__PURE__ */ new Map();
-  for (const conversation of conversations) {
-    if (!conversation.projectPath) continue;
-    const canonical = canonicalizeProjectPath(conversation.projectPath);
-    if (!canonical) continue;
-    const existing = conversationsByPath.get(canonical) ?? [];
-    existing.push(conversation);
-    conversationsByPath.set(canonical, existing);
-  }
-  const pathToProjectId = /* @__PURE__ */ new Map();
-  for (const [path2, projectConversations] of conversationsByPath) {
-    const latest = pickLatestConversation(projectConversations);
-    const project = repo.upsertProjectByPath(path2, {
-      lastConversationId: latest?.id ?? null,
-      lastConversationCreatedAt: latest?.createdAt ?? null,
-      latestMessageAt: latest?.latestMessageAt ?? null
-    });
-    pathToProjectId.set(path2, project.id);
-  }
-  return pathToProjectId;
-}
-function pickLatestConversation(conversations) {
-  if (conversations.length === 0) return void 0;
-  return [...conversations].sort((a, b2) => {
-    const cmp = compareIsoDesc(a.latestMessageAt ?? null, b2.latestMessageAt ?? null);
-    if (cmp !== 0) return cmp;
-    return compareIsoDesc(a.createdAt ?? null, b2.createdAt ?? null);
-  })[0];
-}
-
-// src/services/conversations/refreshConversationCache.ts
-function refreshConversationCache(deps) {
-  const { projectsRepo, conversationsRepo, cacheMetadataRepo } = deps;
-  const conversations = conversationsRepo.listConversationsForProjectBackfill();
-  const pathToProjectId = ensureProjectsForConversations(
-    projectsRepo,
-    conversations.map((c) => ({
-      id: c.id,
-      projectPath: c.projectPath,
-      latestMessageAt: c.lastActivity ?? null,
-      createdAt: c.lastActivity ?? null
-    }))
-  );
-  let conversationsBackfilled = 0;
-  for (const conversation of conversations) {
-    if (!conversation.projectPath) continue;
-    if (conversation.projectId) continue;
-    const projectId = pathToProjectId.get(canonicalizeProjectPath(conversation.projectPath));
-    if (!projectId) continue;
-    conversationsRepo.updateConversationProjectId({
-      conversationId: conversation.id,
-      projectId
-    });
-    conversationsBackfilled += 1;
-  }
-  const latest = conversationsRepo.getLatestConversation();
-  if (latest) {
-    setCacheMetadata(cacheMetadataRepo, "last_conversation_id", latest.id);
-    if (latest.lastActivity) {
-      setCacheMetadata(cacheMetadataRepo, "last_conversation_created_at", latest.lastActivity);
-    }
-  }
-  setCacheMetadata(cacheMetadataRepo, "conversations_last_indexed_at", (/* @__PURE__ */ new Date()).toISOString());
-  return {
-    projectsTouched: pathToProjectId.size,
-    conversationsBackfilled,
-    latestConversationId: latest?.id ?? null
-  };
-}
-
-// src/services/conversations/shouldRefreshProjectsFromHdd.ts
+// src/handlers/handleListProjects.ts
 var import_fs18 = require("fs");
 var import_os7 = require("os");
 var import_path14 = require("path");
-var DEFAULT_PROJECTS_DIR = (0, import_path14.join)((0, import_os7.homedir)(), ".claude", "projects");
-function shouldRefreshProjectsFromHdd(conversationsRepo, cacheMetadataRepo, opts = {}) {
-  if (conversationsRepo.hasOrphanRows()) return true;
-  const projectsDir = opts.projectsDir ?? DEFAULT_PROJECTS_DIR;
-  let dirMtimeMs;
+function decodeProjectPath(dirName) {
+  return dirName.replace(/-/g, "/");
+}
+function handleListProjects(url2, res) {
+  const limit = Math.max(1, parseInt(url2.searchParams.get("limit") ?? "50", 10) || 50);
+  const offset = Math.max(0, parseInt(url2.searchParams.get("offset") ?? "0", 10) || 0);
+  const projectsDir = (0, import_path14.join)((0, import_os7.homedir)(), ".claude", "projects");
+  let entries;
   try {
-    dirMtimeMs = (0, import_fs18.statSync)(projectsDir).mtimeMs;
+    entries = (0, import_fs18.readdirSync)(projectsDir).map((dirName) => {
+      const fullPath = (0, import_path14.join)(projectsDir, dirName);
+      let mtime = 0;
+      try {
+        mtime = (0, import_fs18.statSync)(fullPath).mtimeMs;
+      } catch {
+      }
+      const path2 = decodeProjectPath(dirName);
+      const name = path2.split("/").filter(Boolean).pop() ?? dirName;
+      return { name, path: path2, dirName, mtime };
+    }).sort((a, b2) => b2.mtime - a.mtime);
   } catch {
-    return false;
-  }
-  const lastIndexedIso = getCacheMetadata(cacheMetadataRepo, "conversations_last_indexed_at");
-  if (!lastIndexedIso) return true;
-  const lastIndexedMs = Date.parse(lastIndexedIso);
-  if (Number.isNaN(lastIndexedMs)) return true;
-  return dirMtimeMs > lastIndexedMs;
-}
-
-// src/services/sessions/ensureSessionProjectIdsFromExistingProjects.ts
-function ensureSessionProjectIdsFromExistingProjects(projectsRepo, sessionsRepo) {
-  let linked = 0;
-  let missing = 0;
-  for (const session of sessionsRepo.listManagedSessions()) {
-    if (session.projectId) continue;
-    const canonical = canonicalizeProjectPath(session.projectPath);
-    if (!canonical) continue;
-    const project = projectsRepo.getProjectByPath(canonical);
-    if (!project) {
-      missing += 1;
-      continue;
-    }
-    sessionsRepo.updateSessionProjectId({ sessionId: session.id, projectId: project.id });
-    linked += 1;
-  }
-  return { linked, missing };
-}
-
-// src/services/projectChats/sortProjectChats.ts
-function sortProjectChats(a, b2) {
-  const byLatest = compareIsoDesc(a.latestMessageAt, b2.latestMessageAt);
-  if (byLatest !== 0) return byLatest;
-  const byUpdated = compareIsoDesc(a.updatedAt ?? null, b2.updatedAt ?? null);
-  if (byUpdated !== 0) return byUpdated;
-  const byCreated = compareIsoDesc(a.createdAt ?? null, b2.createdAt ?? null);
-  if (byCreated !== 0) return byCreated;
-  return a.title.localeCompare(b2.title);
-}
-
-// src/services/projectChats/mergeProjectChats.ts
-function mergeProjectChats(args) {
-  const { sessions, conversations } = args;
-  const resumedConversationIds = new Set(
-    sessions.filter((c) => c.type === "session").map((c) => c.resumedFromConversationId).filter((id) => Boolean(id))
-  );
-  const visibleConversations = conversations.filter((c) => {
-    if (c.type !== "conversation") return true;
-    return !resumedConversationIds.has(c.id);
-  });
-  return [...sessions, ...visibleConversations].sort(sortProjectChats);
-}
-
-// src/services/projectChats/deriveProjectChatTitle.ts
-function deriveProjectChatTitle(input) {
-  const trimmed = input.title?.trim();
-  if (trimmed) return trimmed;
-  const name = input.projectName?.trim();
-  if (name) return name;
-  const pathSuffix = input.projectPath ? input.projectPath.split(/[/\\]/).filter(Boolean).slice(-2).join("/") : "";
-  if (pathSuffix) return pathSuffix;
-  return `Untitled \xB7 ${input.id.slice(0, 8)}`;
-}
-
-// src/services/projectChats/normalizeConversationToProjectChat.ts
-function normalizeConversationToProjectChat(conversation) {
-  if (!conversation.projectId) {
-    throw new Error(
-      `normalizeConversationToProjectChat: conversation ${conversation.id} has no projectId \u2014 resolve it before normalizing`
-    );
-  }
-  return {
-    type: "conversation",
-    id: conversation.id,
-    projectId: conversation.projectId,
-    projectPath: conversation.projectPath ?? null,
-    title: deriveProjectChatTitle({
-      title: conversation.title,
-      projectName: conversation.projectName,
-      projectPath: conversation.projectPath,
-      id: conversation.id
-    }),
-    latestMessageAt: conversation.lastActivity ?? null,
-    updatedAt: conversation.lastActivity ?? null,
-    createdAt: null,
-    status: "resumable",
-    source: "hdd-cache",
-    provider: conversation.provider ?? CLAUDE_CODE_PROVIDER2,
-    indexedAt: null,
-    fileMtime: null,
-    filePath: conversation.filePath ?? null,
-    sourceHash: null
-  };
-}
-
-// src/services/projectChats/normalizeSessionToProjectChat.ts
-function normalizeSessionToProjectChat(session) {
-  if (!session.projectId) {
-    throw new Error(
-      `normalizeSessionToProjectChat: session ${session.id} has no projectId \u2014 resolve it before normalizing`
-    );
-  }
-  return {
-    type: "session",
-    id: session.id,
-    projectId: session.projectId,
-    projectPath: session.projectPath ?? null,
-    title: deriveProjectChatTitle({
-      title: session.sessionName,
-      projectName: session.projectName,
-      projectPath: session.projectPath,
-      id: session.id
-    }),
-    latestMessageAt: session.lastMessageAt ?? session.lastActivityAt ?? null,
-    updatedAt: session.lastActivityAt ?? null,
-    createdAt: session.startedAt ?? null,
-    status: "active",
-    source: "session-store",
-    resumedFromConversationId: session.resumedFromConversationId ?? null
-  };
-}
-
-// src/services/projectChats/listProjectChats.ts
-async function listProjectChats(deps, args) {
-  const {
-    cache,
-    projectsRepo,
-    conversationsRepo,
-    sessionsRepo,
-    cacheMetadataRepo,
-    getSessionResponses,
-    getFreshScanner,
-    projectsDir
-  } = deps;
-  const needsRefresh = args.refreshConversations || shouldRefreshProjectsFromHdd(conversationsRepo, cacheMetadataRepo, { projectsDir });
-  if (needsRefresh) {
-    const scanner = await getFreshScanner();
-    const metas = [...scanner.getMetadataCache().values()];
-    if (metas.length > 0) {
-      cache.upsertFromScannerMeta(metas);
-    }
-    refreshConversationCache({ cache, projectsRepo, conversationsRepo, cacheMetadataRepo });
-  }
-  ensureSessionProjectIdsFromExistingProjects(projectsRepo, sessionsRepo);
-  const sessionResponses = getSessionResponses();
-  const sessionChats = [];
-  for (const s3 of sessionResponses) {
-    if (!s3.projectId) continue;
-    sessionChats.push(normalizeSessionToProjectChat(s3));
-  }
-  const conversationChats = [];
-  const { conversations } = cache.listConversations({ limit: 1e3, offset: 0 });
-  for (const c of conversations) {
-    if (!c.projectId) continue;
-    conversationChats.push(normalizeConversationToProjectChat(c));
-  }
-  return mergeProjectChats({ sessions: sessionChats, conversations: conversationChats });
-}
-
-// src/handlers/handleListProjectChats.ts
-async function handleListProjectChats(url2, res, deps) {
-  const queryObj = Object.fromEntries(url2.searchParams.entries());
-  const parsed = ListProjectChatsQuerySchema.safeParse(queryObj);
-  if (!parsed.success) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: "Invalid query parameters",
-        details: parsed.error.flatten()
-      })
-    );
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ projects: [], total: 0 }));
     return;
   }
-  const refreshConversations = parsed.data.refreshConversations === "1" || parsed.data.refresh === "1";
-  const chats = await listProjectChats(deps, { refreshConversations });
+  const total = entries.length;
+  const page = entries.slice(offset, offset + limit).map(({ name, path: path2, dirName }) => ({ name, path: path2, dirName }));
   res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ projectChats: chats }));
+  res.end(JSON.stringify({ projects: page, total }));
 }
 
 // src/server.ts
@@ -141512,6 +141057,17 @@ function pruneAgentConversations(cache) {
   return { scanned: rows.length, pruned, missing };
 }
 
+// src/services/projectChats/deriveProjectChatTitle.ts
+function deriveProjectChatTitle(input) {
+  const trimmed = input.title?.trim();
+  if (trimmed) return trimmed;
+  const name = input.projectName?.trim();
+  if (name) return name;
+  const pathSuffix = input.projectPath ? input.projectPath.split(/[/\\]/).filter(Boolean).slice(-2).join("/") : "";
+  if (pathSuffix) return pathSuffix;
+  return `Untitled \xB7 ${input.id.slice(0, 8)}`;
+}
+
 // src/services/questions/detectAskUserQuestion.ts
 function normalizeContent2(raw2) {
   if (Array.isArray(raw2)) return raw2;
@@ -141941,6 +141497,226 @@ function debounce(fn, waitMs) {
   return debounced;
 }
 
+// node_modules/date-fns/constants.js
+var daysInYear = 365.2425;
+var maxTime = Math.pow(10, 8) * 24 * 60 * 60 * 1e3;
+var minTime = -maxTime;
+var millisecondsInMinute = 6e4;
+var millisecondsInHour = 36e5;
+var secondsInHour = 3600;
+var secondsInDay = secondsInHour * 24;
+var secondsInWeek = secondsInDay * 7;
+var secondsInYear = secondsInDay * daysInYear;
+var secondsInMonth = secondsInYear / 12;
+var secondsInQuarter = secondsInMonth * 3;
+var constructFromSymbol = /* @__PURE__ */ Symbol.for("constructDateFrom");
+
+// node_modules/date-fns/constructFrom.js
+function constructFrom(date5, value) {
+  if (typeof date5 === "function") return date5(value);
+  if (date5 && typeof date5 === "object" && constructFromSymbol in date5)
+    return date5[constructFromSymbol](value);
+  if (date5 instanceof Date) return new date5.constructor(value);
+  return new Date(value);
+}
+
+// node_modules/date-fns/toDate.js
+function toDate(argument, context) {
+  return constructFrom(context || argument, argument);
+}
+
+// node_modules/date-fns/isDate.js
+function isDate(value) {
+  return value instanceof Date || typeof value === "object" && Object.prototype.toString.call(value) === "[object Date]";
+}
+
+// node_modules/date-fns/isValid.js
+function isValid(date5) {
+  return !(!isDate(date5) && typeof date5 !== "number" || isNaN(+toDate(date5)));
+}
+
+// node_modules/date-fns/parseISO.js
+function parseISO(argument, options) {
+  const invalidDate = () => constructFrom(options?.in, NaN);
+  const additionalDigits = options?.additionalDigits ?? 2;
+  const dateStrings = splitDateString(argument);
+  let date5;
+  if (dateStrings.date) {
+    const parseYearResult = parseYear(dateStrings.date, additionalDigits);
+    date5 = parseDate(parseYearResult.restDateString, parseYearResult.year);
+  }
+  if (!date5 || isNaN(+date5)) return invalidDate();
+  const timestamp = +date5;
+  let time3 = 0;
+  let offset;
+  if (dateStrings.time) {
+    time3 = parseTime(dateStrings.time);
+    if (isNaN(time3)) return invalidDate();
+  }
+  if (dateStrings.timezone) {
+    offset = parseTimezone(dateStrings.timezone);
+    if (isNaN(offset)) return invalidDate();
+  } else {
+    const tmpDate = new Date(timestamp + time3);
+    const result = toDate(0, options?.in);
+    result.setFullYear(
+      tmpDate.getUTCFullYear(),
+      tmpDate.getUTCMonth(),
+      tmpDate.getUTCDate()
+    );
+    result.setHours(
+      tmpDate.getUTCHours(),
+      tmpDate.getUTCMinutes(),
+      tmpDate.getUTCSeconds(),
+      tmpDate.getUTCMilliseconds()
+    );
+    return result;
+  }
+  return toDate(timestamp + time3 + offset, options?.in);
+}
+var patterns = {
+  dateTimeDelimiter: /[T ]/,
+  timeZoneDelimiter: /[Z ]/i,
+  timezone: /([Z+-].*)$/
+};
+var dateRegex = /^-?(?:(\d{3})|(\d{2})(?:-?(\d{2}))?|W(\d{2})(?:-?(\d{1}))?|)$/;
+var timeRegex = /^(\d{2}(?:[.,]\d*)?)(?::?(\d{2}(?:[.,]\d*)?))?(?::?(\d{2}(?:[.,]\d*)?))?$/;
+var timezoneRegex = /^([+-])(\d{2})(?::?(\d{2}))?$/;
+function splitDateString(dateString) {
+  const dateStrings = {};
+  const array2 = dateString.split(patterns.dateTimeDelimiter);
+  let timeString;
+  if (array2.length > 2) {
+    return dateStrings;
+  }
+  if (/:/.test(array2[0])) {
+    timeString = array2[0];
+  } else {
+    dateStrings.date = array2[0];
+    timeString = array2[1];
+    if (patterns.timeZoneDelimiter.test(dateStrings.date)) {
+      dateStrings.date = dateString.split(patterns.timeZoneDelimiter)[0];
+      timeString = dateString.substr(
+        dateStrings.date.length,
+        dateString.length
+      );
+    }
+  }
+  if (timeString) {
+    const token = patterns.timezone.exec(timeString);
+    if (token) {
+      dateStrings.time = timeString.replace(token[1], "");
+      dateStrings.timezone = token[1];
+    } else {
+      dateStrings.time = timeString;
+    }
+  }
+  return dateStrings;
+}
+function parseYear(dateString, additionalDigits) {
+  const regex = new RegExp(
+    "^(?:(\\d{4}|[+-]\\d{" + (4 + additionalDigits) + "})|(\\d{2}|[+-]\\d{" + (2 + additionalDigits) + "})$)"
+  );
+  const captures = dateString.match(regex);
+  if (!captures) return { year: NaN, restDateString: "" };
+  const year = captures[1] ? parseInt(captures[1]) : null;
+  const century = captures[2] ? parseInt(captures[2]) : null;
+  return {
+    year: century === null ? year : century * 100,
+    restDateString: dateString.slice((captures[1] || captures[2]).length)
+  };
+}
+function parseDate(dateString, year) {
+  if (year === null) return /* @__PURE__ */ new Date(NaN);
+  const captures = dateString.match(dateRegex);
+  if (!captures) return /* @__PURE__ */ new Date(NaN);
+  const isWeekDate = !!captures[4];
+  const dayOfYear = parseDateUnit(captures[1]);
+  const month = parseDateUnit(captures[2]) - 1;
+  const day = parseDateUnit(captures[3]);
+  const week = parseDateUnit(captures[4]);
+  const dayOfWeek = parseDateUnit(captures[5]) - 1;
+  if (isWeekDate) {
+    if (!validateWeekDate(year, week, dayOfWeek)) {
+      return /* @__PURE__ */ new Date(NaN);
+    }
+    return dayOfISOWeekYear(year, week, dayOfWeek);
+  } else {
+    const date5 = /* @__PURE__ */ new Date(0);
+    if (!validateDate(year, month, day) || !validateDayOfYearDate(year, dayOfYear)) {
+      return /* @__PURE__ */ new Date(NaN);
+    }
+    date5.setUTCFullYear(year, month, Math.max(dayOfYear, day));
+    return date5;
+  }
+}
+function parseDateUnit(value) {
+  return value ? parseInt(value) : 1;
+}
+function parseTime(timeString) {
+  const captures = timeString.match(timeRegex);
+  if (!captures) return NaN;
+  const hours = parseTimeUnit(captures[1]);
+  const minutes = parseTimeUnit(captures[2]);
+  const seconds = parseTimeUnit(captures[3]);
+  if (!validateTime(hours, minutes, seconds)) {
+    return NaN;
+  }
+  return hours * millisecondsInHour + minutes * millisecondsInMinute + seconds * 1e3;
+}
+function parseTimeUnit(value) {
+  return value && parseFloat(value.replace(",", ".")) || 0;
+}
+function parseTimezone(timezoneString) {
+  if (timezoneString === "Z") return 0;
+  const captures = timezoneString.match(timezoneRegex);
+  if (!captures) return 0;
+  const sign = captures[1] === "+" ? -1 : 1;
+  const hours = parseInt(captures[2]);
+  const minutes = captures[3] && parseInt(captures[3]) || 0;
+  if (!validateTimezone(hours, minutes)) {
+    return NaN;
+  }
+  return sign * (hours * millisecondsInHour + minutes * millisecondsInMinute);
+}
+function dayOfISOWeekYear(isoWeekYear, week, day) {
+  const date5 = /* @__PURE__ */ new Date(0);
+  date5.setUTCFullYear(isoWeekYear, 0, 4);
+  const fourthOfJanuaryDay = date5.getUTCDay() || 7;
+  const diff = (week - 1) * 7 + day + 1 - fourthOfJanuaryDay;
+  date5.setUTCDate(date5.getUTCDate() + diff);
+  return date5;
+}
+var daysInMonths = [31, null, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+function isLeapYearIndex(year) {
+  return year % 400 === 0 || year % 4 === 0 && year % 100 !== 0;
+}
+function validateDate(year, month, date5) {
+  return month >= 0 && month <= 11 && date5 >= 1 && date5 <= (daysInMonths[month] || (isLeapYearIndex(year) ? 29 : 28));
+}
+function validateDayOfYearDate(year, dayOfYear) {
+  return dayOfYear >= 1 && dayOfYear <= (isLeapYearIndex(year) ? 366 : 365);
+}
+function validateWeekDate(_year, week, day) {
+  return week >= 1 && week <= 53 && day >= 0 && day <= 6;
+}
+function validateTime(hours, minutes, seconds) {
+  if (hours === 24) {
+    return minutes === 0 && seconds === 0;
+  }
+  return seconds >= 0 && seconds < 60 && minutes >= 0 && minutes < 60 && hours >= 0 && hours < 25;
+}
+function validateTimezone(_hours, minutes) {
+  return minutes >= 0 && minutes <= 59;
+}
+
+// src/utils/dates.ts
+function parseIsoDateOrNull(value) {
+  if (!value) return null;
+  const parsed = parseISO(value);
+  return isValid(parsed) ? parsed : null;
+}
+
 // src/utils/isScannedSnapshotStale.ts
 var STALENESS_TOLERANCE_MS = 1e3;
 function isScannedSnapshotStale(snapshotTimestamp, fileMtimeMs) {
@@ -142077,6 +141853,7 @@ var WSHub = class {
 
 // src/server.ts
 var BROWSE_SYSTEM_PROMPT = (browseRoot) => `You are working within the project boundary: ${browseRoot}. Do not read, write, or execute commands that access files or directories outside this boundary.`;
+var DEFAULT_SYSTEM_PROMPT = "When presenting options or choices to the user, limit the options to at most 3.";
 var DEFAULT_PTY_GRACE_PERIOD_MS = 27e4;
 function parseIncludeAgentsEnv(raw2) {
   if (raw2 === void 0) return false;
@@ -142115,6 +141892,7 @@ var StreamerServer = class {
   binding = false;
   cacheReady = false;
   apiKey;
+  apiKeySource;
   localNoAuth;
   logMenubarRequests;
   verbose;
@@ -142126,7 +141904,10 @@ var StreamerServer = class {
   publicUrl = null;
   pairTokens = new PairTokenStore();
   exchangeAttempts = /* @__PURE__ */ new Map();
+  sessionStartAttempts = /* @__PURE__ */ new Map();
+  sessionInputAttempts = /* @__PURE__ */ new Map();
   ptyGracePeriodMs;
+  defaultSystemPrompt;
   // Map of sessionId → grace timer; fires to kill PTY after WS disconnect
   ptyGraceTimers = /* @__PURE__ */ new Map();
   // Map of sessionId → set of subscribed WS clients
@@ -142160,13 +141941,20 @@ var StreamerServer = class {
   constructor(config2) {
     this.sessionStatusBus.setMaxListeners(0);
     this.apiKey = config2.apiKey;
+    this.apiKeySource = config2.apiKeySource ?? "config";
     this.localNoAuth = config2.localNoAuth ?? false;
     this.logMenubarRequests = config2.logMenubarRequests ?? false;
+    if (this.localNoAuth) {
+      console.warn(
+        "[WARN] localNoAuth is ENABLED \u2014 all requests from localhost bypass authentication. Do not run with --local-no-auth in shared or production environments."
+      );
+    }
     this.verbose = config2.verbose ?? false;
     this.disableDb = config2.disableDb ?? false;
     this.scanProfiles = config2.scanProfiles;
     this.codexRoots = config2.codexRoots ?? [(0, import_path19.join)((0, import_os10.homedir)(), ".codex", "sessions")];
     this.ptyGracePeriodMs = config2.ptyGracePeriodMs ?? DEFAULT_PTY_GRACE_PERIOD_MS;
+    this.defaultSystemPrompt = config2.defaultSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
     this.cacheDir = config2.cacheDir ?? loadCacheDir() ?? (0, import_path19.join)((0, import_os10.homedir)(), ".threadbase", "cache");
     this.tailSize = config2.tailSize ?? loadTailSize() ?? 10;
     this.directoryDebounceMs = parseDirScanDebounceEnv(process.env.THREADBASE_DIR_SCAN_DEBOUNCE_MS) ?? config2.directoryScanDebounceMs ?? 1e3;
@@ -142338,10 +142126,15 @@ var StreamerServer = class {
       });
     }
     const agentClient = this.agentClient;
+    const self2 = this;
     const apiDeps = {
-      apiKey: this.apiKey,
+      // ponytail: getter so rotateApiKey() takes effect without restarting the server
+      get apiKey() {
+        return self2.apiKey;
+      },
       localNoAuth: this.localNoAuth,
       logMenubarRequests: this.logMenubarRequests,
+      rotateApiKey: () => this.rotateApiKey(),
       publicUrl: this.publicUrl,
       browseRoot: this.browseRoot,
       ptyManager: this.ptyManager,
@@ -142372,8 +142165,8 @@ var StreamerServer = class {
       handleConversationsCount: (url2, res) => this.handleConversationsCount(url2, res),
       handleGetConversation: (id, url2, res, ifNoneMatch) => this.handleGetConversation(id, url2, res, ifNoneMatch),
       handleSearch: (url2, res) => this.handleSearch(url2, res),
+      handleListProjects: (url2, res) => handleListProjects(url2, res),
       handleGetPopularProjects: (url2, res) => this.handleGetPopularProjects(url2, res),
-      handleListProjectChats: (url2, res) => this.handleListProjectChats(url2, res),
       handlePairStart: (res) => this.handlePairStart(res),
       handlePairExchange: (req, res) => this.handlePairExchange(req, res),
       handleBrowse: (url2, res) => this.handleBrowse(url2, res),
@@ -142808,19 +142601,38 @@ var StreamerServer = class {
       machineName: hostname4()
     });
   }
-  checkExchangeRateLimit(ip) {
+  rotateApiKey() {
+    const newKey = generateApiKey();
+    const persisted = this.apiKeySource === "config";
+    if (persisted) setApiKey(newKey);
+    this.apiKey = newKey;
+    return { newKey, persisted };
+  }
+  checkRateLimit(map2, key, limit, windowMs) {
     const now = Date.now();
-    const windowMs = 6e4;
-    const limit = 5;
-    const arr = (this.exchangeAttempts.get(ip) ?? []).filter((t2) => now - t2 < windowMs);
+    const arr = (map2.get(key) ?? []).filter((t2) => now - t2 < windowMs);
     if (arr.length >= limit) {
-      this.exchangeAttempts.set(ip, arr);
+      map2.set(key, arr);
       return false;
     }
     arr.push(now);
-    this.exchangeAttempts.set(ip, arr);
+    map2.set(key, arr);
+    setTimeout(() => {
+      const remaining = (map2.get(key) ?? []).filter((t2) => Date.now() - t2 < windowMs);
+      if (remaining.length === 0) map2.delete(key);
+      else map2.set(key, remaining);
+    }, windowMs);
     return true;
   }
+  checkExchangeRateLimit(ip) {
+    return this.checkRateLimit(this.exchangeAttempts, ip, 5, 6e4);
+  }
+  checkSessionStartRateLimit(ip) {
+    return this.checkRateLimit(this.sessionStartAttempts, ip, 10, 6e4);
+  }
+  checkSessionInputRateLimit(sessionId) {
+    return this.checkRateLimit(this.sessionInputAttempts, sessionId, 500, 6e4);
+  }
   async handleListConversations(url2, res) {
     const limit = intParam(url2, "limit", 50);
     const offset = intParam(url2, "offset", 0);
@@ -142982,21 +142794,6 @@ var StreamerServer = class {
     const projects = this.cache.getPopularProjects(limit);
     json2(res, 200, { projects, total: projects.length });
   }
-  async handleListProjectChats(url2, res) {
-    if (!this.cache || !this.projectsRepo || !this.conversationsRepo || !this.sessionsRepo || !this.cacheMetadataRepo) {
-      json2(res, 503, { error: "Cache not available" });
-      return;
-    }
-    await handleListProjectChats(url2, res, {
-      cache: this.cache,
-      projectsRepo: this.projectsRepo,
-      conversationsRepo: this.conversationsRepo,
-      sessionsRepo: this.sessionsRepo,
-      cacheMetadataRepo: this.cacheMetadataRepo,
-      getSessionResponses: () => this.sessionStore.list(this.ptyAttachedIds()),
-      getFreshScanner: () => this.getFreshScanner()
-    });
-  }
   buildStatCache(previousScanner) {
     if (!this.cache) return void 0;
     const dbStats = this.cache.getFileStats();
@@ -143473,6 +143270,10 @@ var StreamerServer = class {
     }
   }
   async handleSendInput(sessionId, req, res) {
+    if (!this.checkSessionInputRateLimit(sessionId)) {
+      json2(res, 429, { error: "Too many input requests for this session. Please slow down." });
+      return;
+    }
     if (this.agentConfig.enabled) {
       const body2 = await readBody(req);
       const cache = this.cache;
@@ -143754,6 +143555,13 @@ var StreamerServer = class {
     json2(res, 201, { sessionId: session.id });
   }
   async handleStartSession(req, res) {
+    const ip = req.socket?.remoteAddress ?? "unknown";
+    if (!this.checkSessionStartRateLimit(ip)) {
+      json2(res, 429, {
+        error: "Too many session start requests. Please wait before trying again."
+      });
+      return;
+    }
     if (this.agentConfig.enabled) {
       const body2 = await readBody(req);
       const result = await handleStartAgentSession(body2, {
@@ -143777,7 +143585,7 @@ var StreamerServer = class {
       return;
     }
     const body = await readBody(req);
-    const { path: relativePath } = body;
+    const { path: relativePath, systemPrompt: clientPrompt } = body;
     if (typeof relativePath !== "string") {
       json2(res, 400, { error: "Missing path field" });
       return;
@@ -143791,11 +143599,16 @@ var StreamerServer = class {
       return;
     }
     this.discoveryCache = null;
+    const systemPromptParts = [
+      this.defaultSystemPrompt,
+      BROWSE_SYSTEM_PROMPT(this.browseRoot),
+      typeof clientPrompt === "string" ? clientPrompt : null
+    ].filter(Boolean);
     try {
       const session = await this.ptyManager.startFresh({
         projectPath: resolvedPath,
         projectName: body.projectName,
-        systemPrompt: BROWSE_SYSTEM_PROMPT(this.browseRoot)
+        systemPrompt: systemPromptParts.join("\n")
       });
       this.sessionStore.addManaged(session);
       json2(res, 202, { id: session.id, status: "pending" });
@@ -144272,7 +144085,7 @@ async function checkForUpdate(opts) {
 }
 
 // src/updater/install.ts
-var import_node_fs17 = require("fs");
+var import_node_fs18 = require("fs");
 
 // src/updater/active-sessions.ts
 async function countActiveSessions(opts) {
@@ -147556,14 +147369,29 @@ async function unpackTarball(opts) {
   await So({ file: tarballPath, cwd: destDir });
 }
 
+// src/updater/update-log.ts
+var import_node_fs17 = require("fs");
+var import_node_path21 = require("path");
+var LOG_PATH = (0, import_node_path21.join)(THREADBASE_ROOT, "update.log");
+function appendUpdateLog(line) {
+  try {
+    (0, import_node_fs17.mkdirSync)(THREADBASE_ROOT, { recursive: true });
+    (0, import_node_fs17.appendFileSync)(LOG_PATH, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`, "utf8");
+  } catch {
+  }
+}
+
 // src/updater/install.ts
 async function runInstall(opts) {
   if (isBrewInstall()) {
-    return {
+    const result = {
       kind: "unsupported-install",
       reason: "Installed via Homebrew \u2014 run `brew upgrade tb-streamer` to update.",
       current: opts.currentVersion
     };
+    appendUpdateLog(`[no-op] ${result.reason}`);
+    return result;
   }
   const check2 = await checkForUpdate({
     currentVersion: opts.currentVersion,
@@ -147571,6 +147399,9 @@ async function runInstall(opts) {
     pinnedVersion: opts.pinnedVersion,
     allowMajor: opts.allowMajor
   });
+  appendUpdateLog(
+    `[check] current=${check2.current} latest=${check2.latest ?? "none"} status=${check2.reason}`
+  );
   if (!check2.wouldInstall) {
     return { kind: "no-op", reason: check2.reason, current: check2.current, latest: check2.latest };
   }
@@ -147596,33 +147427,27 @@ async function runInstall(opts) {
   const artifact = pickArtifact(manifest);
   if (opts.dryRun) {
     const asset = target.assets.find((a) => a.name === artifact.filename);
-    return {
-      kind: "dry-run",
-      latest: targetVersion,
-      tarballUrl: asset?.browserDownloadUrl ?? "(missing)"
-    };
+    const tarballUrl = asset?.browserDownloadUrl ?? "(missing)";
+    appendUpdateLog(
+      `[dry-run] would install ${check2.current} \u2192 ${targetVersion} from ${tarballUrl}`
+    );
+    return { kind: "dry-run", latest: targetVersion, tarballUrl };
   }
   if (opts.config.defer_if_active_sessions && !opts.force && opts.runningServer) {
     const active = await countActiveSessions(opts.runningServer);
     if (active.kind === "count" && active.count > 0) {
-      return {
-        kind: "deferred",
-        reason: `${active.count} active session(s); use --force to interrupt`,
-        activeSessions: active.count,
-        latest: targetVersion
-      };
+      const reason = `${active.count} active session(s); use --force to interrupt`;
+      appendUpdateLog(`[deferred] ${check2.current} \u2192 ${targetVersion}: ${reason}`);
+      return { kind: "deferred", reason, activeSessions: active.count, latest: targetVersion };
     }
     if (active.kind === "error") {
-      return {
-        kind: "deferred",
-        reason: `cannot determine active sessions (${active.reason}); use --force to override`,
-        activeSessions: -1,
-        latest: targetVersion
-      };
+      const reason = `cannot determine active sessions (${active.reason}); use --force to override`;
+      appendUpdateLog(`[deferred] ${check2.current} \u2192 ${targetVersion}: ${reason}`);
+      return { kind: "deferred", reason, activeSessions: -1, latest: targetVersion };
     }
   }
   ensureReleasesDir();
-  (0, import_node_fs17.mkdirSync)(DOWNLOAD_DIR, { recursive: true });
+  (0, import_node_fs18.mkdirSync)(DOWNLOAD_DIR, { recursive: true });
   const tarballPath = downloadPath(targetVersion, artifact.filename);
   await downloadAndVerify({ manifest, assets: target.assets, targetPath: tarballPath });
   const destDir = releaseDir(targetVersion);
@@ -147641,18 +147466,22 @@ async function runInstall(opts) {
   } catch (err) {
     restartMethod = `failed: ${err instanceof Error ? err.message : String(err)}`;
   }
-  return {
+  const installed = {
     kind: "installed",
     previous: check2.current,
     installed: targetVersion,
     pruned,
     restart: { method: restartMethod }
   };
+  appendUpdateLog(
+    `[installed] ${installed.previous} \u2192 ${installed.installed} restart=${installed.restart.method}${pruned.length > 0 ? ` pruned=${pruned.length}` : ""}`
+  );
+  return installed;
 }
 
 // cli/prod.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs19 = require("fs");
+var import_node_fs20 = require("fs");
 init_constants();
 init_launchd();
 init_marker();
@@ -147738,7 +147567,7 @@ async function runProdDoctor(opts) {
   return { findings, repairs };
 }
 var defaultSpawnTail = ({ files, lines, follow }) => {
-  const existing = files.filter((f2) => (0, import_node_fs19.existsSync)(f2));
+  const existing = files.filter((f2) => (0, import_node_fs20.existsSync)(f2));
   if (existing.length === 0) {
     return Promise.resolve({
       ok: false,
@@ -147894,6 +147723,7 @@ program2.command("serve").description("Start the streamer server").option("-p, -
   const server = new StreamerServer({
     port: resolvedPort,
     apiKey,
+    apiKeySource: opts.apiKey ? "cli" : "config",
     localNoAuth: opts.localNoAuth,
     verbose: opts.verbose,
     logMenubarRequests: opts.logMenubarRequests,
@@ -147957,8 +147787,8 @@ program2.command("cache").description("Manage the local SQLite conversation cach
     `${process.env.HOME}/.threadbase/cache`
   ).action((opts) => {
     const { rmSync: rmSync6, existsSync: existsSync11 } = require("fs");
-    const { join: join24 } = require("path");
-    const dbPath = join24(opts.cacheDir, "cache.db");
+    const { join: join25 } = require("path");
+    const dbPath = join25(opts.cacheDir, "cache.db");
     for (const suffix of ["", "-shm", "-wal"]) {
       const f2 = dbPath + suffix;
       if (existsSync11(f2)) {
@@ -148007,6 +147837,9 @@ program2.command("update").description("Check for streamer updates from GitHub R
         pinnedVersion: opts.version,
         allowMajor: opts.allowMajor
       });
+      appendUpdateLog(
+        `[check] current=${result2.current} latest=${result2.latest ?? "none"} status=${result2.reason}`
+      );
       log7.info(`Current : ${result2.current}`, void 0, "console");
       log7.info(`Latest  : ${result2.latest ?? "(none)"}`, void 0, "console");
       log7.info(`Channel : ${cfg.channel}`, void 0, "console");
@@ -148059,6 +147892,7 @@ program2.command("update").description("Check for streamer updates from GitHub R
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
+    appendUpdateLog(`[error] ${message}`);
     log7.error(`Update failed: ${message}`, { error: message }, "console");
     process.exitCode = 1;
   }