@threadbase-sh/streamer 1.19.1 → 1.21.0

package/dist/index.cjs

@@ -406,6 +406,31 @@ function validatePublicUrl(raw) {
 function stripTrailingSlash(url) {
   return url.endsWith("/") ? url.slice(0, -1) : url;
 }
+function setApiKey(key) {
+  (0, import_fs.mkdirSync)(CONFIG_DIR, { recursive: true });
+  let content = "";
+  try {
+    content = (0, import_fs.readFileSync)(CONFIG_FILE, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  const apiKeyLine = `api_key: ${key}`;
+  let updated;
+  if (/^api_key:\s*.+$/m.test(content)) {
+    updated = content.replace(/^api_key:\s*.+$/m, apiKeyLine);
+  } else if (content.length === 0 || content.endsWith("\n")) {
+    updated = `${content}${apiKeyLine}
+`;
+  } else {
+    updated = `${content}
+${apiKeyLine}
+`;
+  }
+  const tmpFile = `${CONFIG_FILE}.tmp`;
+  (0, import_fs.writeFileSync)(tmpFile, updated, { encoding: "utf-8", mode: 384 });
+  (0, import_fs.chmodSync)(tmpFile, 384);
+  (0, import_fs.renameSync)(tmpFile, CONFIG_FILE);
+}
 
 // src/db/config.ts
 function isDbEnabled() {
@@ -1799,13 +1824,23 @@ var authMiddleware = (deps) => async (c, next) => {
 };
 
 // src/api/middleware/cors.middleware.ts
+var ALLOWED_ORIGINS = /* @__PURE__ */ new Set([
+  "http://localhost:8081",
+  "http://localhost:19006",
+  "http://localhost:3000"
+]);
 var corsMiddleware = () => async (c, next) => {
-  c.res.headers.set("Access-Control-Allow-Origin", "*");
-  c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
-  c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
-  c.res.headers.set("Access-Control-Expose-Headers", "ETag");
+  const origin = c.req.header("origin");
+  const allowedOrigin = origin && ALLOWED_ORIGINS.has(origin) ? origin : null;
+  if (allowedOrigin) {
+    c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+    c.res.headers.set("Vary", "Origin");
+    c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
+    c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
+    c.res.headers.set("Access-Control-Expose-Headers", "ETag");
+  }
   if (c.req.method === "OPTIONS") {
-    return c.newResponse(null, 204);
+    return c.newResponse(null, allowedOrigin ? 204 : 403);
   }
   await next();
 };
@@ -1992,6 +2027,19 @@ var createMiscRoutes = (deps) => {
     });
   });
   app.get("/api/profiles", (c) => c.json([]));
+  app.post("/api/auth/rotate", (c) => {
+    if (deps.localNoAuth) {
+      return c.json({ error: "key rotation is disabled while localNoAuth is active" }, 403);
+    }
+    const { newKey, persisted } = deps.rotateApiKey();
+    return c.json({
+      apiKey: newKey,
+      persisted,
+      ...persisted ? {} : {
+        warning: "Key rotated in memory only. The server was started with --api-key, so the old key will be restored on restart. Remove --api-key and let the server manage the key via ~/.threadbase/server.yaml for rotation to survive restarts."
+      }
+    });
+  });
   app.post("/api/push/register", (c) => c.json({ ok: true }));
   app.post("/api/__update", async (c) => {
     const cfg = loadUpdateConfig();
@@ -2065,6 +2113,11 @@ var ALREADY_HANDLED4 = 597;
 var alreadyHandled4 = () => new Response(null, { status: ALREADY_HANDLED4 });
 var createProjectRoutes = (deps) => {
   const app = new import_hono7.Hono();
+  app.get("/", (c) => {
+    const url = new URL(c.req.url);
+    deps.handleListProjects(url, c.env.outgoing);
+    return alreadyHandled4();
+  });
   app.get("/popular", (c) => {
     const url = new URL(c.req.url);
     deps.handleGetPopularProjects(url, c.env.outgoing);
@@ -2084,11 +2137,6 @@ var createScannerRoutes = (deps) => {
     await deps.handleSearch(url, c.env.outgoing);
     return alreadyHandled5();
   });
-  app.get("/project-chats", async (c) => {
-    const url = new URL(c.req.url);
-    await deps.handleListProjectChats(url, c.env.outgoing);
-    return alreadyHandled5();
-  });
   return app;
 };
 
@@ -3261,297 +3309,39 @@ async function recordUpload(pool2, instanceId, row) {
   );
 }
 
-// src/schemas/queryParams.schema.ts
-var import_zod2 = require("zod");
-var ListProjectChatsQuerySchema = import_zod2.z.object({
-  refresh: import_zod2.z.enum(["1"]).optional(),
-  refreshConversations: import_zod2.z.enum(["1"]).optional()
-});
-
-// src/services/cache/cacheMetadata.ts
-function getCacheMetadata(repo, key) {
-  return repo.getCacheMetadata(key);
-}
-function setCacheMetadata(repo, key, value) {
-  repo.setCacheMetadata(key, value);
-}
-
-// src/utils/dates.ts
-var import_date_fns = require("date-fns");
-function parseIsoDateOrNull(value) {
-  if (!value) return null;
-  const parsed = (0, import_date_fns.parseISO)(value);
-  return (0, import_date_fns.isValid)(parsed) ? parsed : null;
-}
-function compareIsoDesc(a, b) {
-  const dateA = parseIsoDateOrNull(a);
-  const dateB = parseIsoDateOrNull(b);
-  if (!dateA && !dateB) return 0;
-  if (!dateA) return 1;
-  if (!dateB) return -1;
-  return (0, import_date_fns.compareDesc)(dateA, dateB);
-}
-
-// src/services/projects/ensureProjectsForConversations.ts
-function ensureProjectsForConversations(repo, conversations) {
-  const conversationsByPath = /* @__PURE__ */ new Map();
-  for (const conversation of conversations) {
-    if (!conversation.projectPath) continue;
-    const canonical = canonicalizeProjectPath(conversation.projectPath);
-    if (!canonical) continue;
-    const existing = conversationsByPath.get(canonical) ?? [];
-    existing.push(conversation);
-    conversationsByPath.set(canonical, existing);
-  }
-  const pathToProjectId = /* @__PURE__ */ new Map();
-  for (const [path, projectConversations] of conversationsByPath) {
-    const latest = pickLatestConversation(projectConversations);
-    const project = repo.upsertProjectByPath(path, {
-      lastConversationId: latest?.id ?? null,
-      lastConversationCreatedAt: latest?.createdAt ?? null,
-      latestMessageAt: latest?.latestMessageAt ?? null
-    });
-    pathToProjectId.set(path, project.id);
-  }
-  return pathToProjectId;
-}
-function pickLatestConversation(conversations) {
-  if (conversations.length === 0) return void 0;
-  return [...conversations].sort((a, b) => {
-    const cmp = compareIsoDesc(a.latestMessageAt ?? null, b.latestMessageAt ?? null);
-    if (cmp !== 0) return cmp;
-    return compareIsoDesc(a.createdAt ?? null, b.createdAt ?? null);
-  })[0];
-}
-
-// src/services/conversations/refreshConversationCache.ts
-function refreshConversationCache(deps) {
-  const { projectsRepo, conversationsRepo, cacheMetadataRepo } = deps;
-  const conversations = conversationsRepo.listConversationsForProjectBackfill();
-  const pathToProjectId = ensureProjectsForConversations(
-    projectsRepo,
-    conversations.map((c) => ({
-      id: c.id,
-      projectPath: c.projectPath,
-      latestMessageAt: c.lastActivity ?? null,
-      createdAt: c.lastActivity ?? null
-    }))
-  );
-  let conversationsBackfilled = 0;
-  for (const conversation of conversations) {
-    if (!conversation.projectPath) continue;
-    if (conversation.projectId) continue;
-    const projectId = pathToProjectId.get(canonicalizeProjectPath(conversation.projectPath));
-    if (!projectId) continue;
-    conversationsRepo.updateConversationProjectId({
-      conversationId: conversation.id,
-      projectId
-    });
-    conversationsBackfilled += 1;
-  }
-  const latest = conversationsRepo.getLatestConversation();
-  if (latest) {
-    setCacheMetadata(cacheMetadataRepo, "last_conversation_id", latest.id);
-    if (latest.lastActivity) {
-      setCacheMetadata(cacheMetadataRepo, "last_conversation_created_at", latest.lastActivity);
-    }
-  }
-  setCacheMetadata(cacheMetadataRepo, "conversations_last_indexed_at", (/* @__PURE__ */ new Date()).toISOString());
-  return {
-    projectsTouched: pathToProjectId.size,
-    conversationsBackfilled,
-    latestConversationId: latest?.id ?? null
-  };
-}
-
-// src/services/conversations/shouldRefreshProjectsFromHdd.ts
+// src/handlers/handleListProjects.ts
 var import_fs8 = require("fs");
 var import_os5 = require("os");
 var import_path9 = require("path");
-var DEFAULT_PROJECTS_DIR = (0, import_path9.join)((0, import_os5.homedir)(), ".claude", "projects");
-function shouldRefreshProjectsFromHdd(conversationsRepo, cacheMetadataRepo, opts = {}) {
-  if (conversationsRepo.hasOrphanRows()) return true;
-  const projectsDir = opts.projectsDir ?? DEFAULT_PROJECTS_DIR;
-  let dirMtimeMs;
+function decodeProjectPath(dirName) {
+  return dirName.replace(/-/g, "/");
+}
+function handleListProjects(url, res) {
+  const limit = Math.max(1, parseInt(url.searchParams.get("limit") ?? "50", 10) || 50);
+  const offset = Math.max(0, parseInt(url.searchParams.get("offset") ?? "0", 10) || 0);
+  const projectsDir = (0, import_path9.join)((0, import_os5.homedir)(), ".claude", "projects");
+  let entries;
   try {
-    dirMtimeMs = (0, import_fs8.statSync)(projectsDir).mtimeMs;
+    entries = (0, import_fs8.readdirSync)(projectsDir).map((dirName) => {
+      const fullPath = (0, import_path9.join)(projectsDir, dirName);
+      let mtime = 0;
+      try {
+        mtime = (0, import_fs8.statSync)(fullPath).mtimeMs;
+      } catch {
+      }
+      const path = decodeProjectPath(dirName);
+      const name = path.split("/").filter(Boolean).pop() ?? dirName;
+      return { name, path, dirName, mtime };
+    }).sort((a, b) => b.mtime - a.mtime);
   } catch {
-    return false;
-  }
-  const lastIndexedIso = getCacheMetadata(cacheMetadataRepo, "conversations_last_indexed_at");
-  if (!lastIndexedIso) return true;
-  const lastIndexedMs = Date.parse(lastIndexedIso);
-  if (Number.isNaN(lastIndexedMs)) return true;
-  return dirMtimeMs > lastIndexedMs;
-}
-
-// src/services/sessions/ensureSessionProjectIdsFromExistingProjects.ts
-function ensureSessionProjectIdsFromExistingProjects(projectsRepo, sessionsRepo) {
-  let linked = 0;
-  let missing = 0;
-  for (const session of sessionsRepo.listManagedSessions()) {
-    if (session.projectId) continue;
-    const canonical = canonicalizeProjectPath(session.projectPath);
-    if (!canonical) continue;
-    const project = projectsRepo.getProjectByPath(canonical);
-    if (!project) {
-      missing += 1;
-      continue;
-    }
-    sessionsRepo.updateSessionProjectId({ sessionId: session.id, projectId: project.id });
-    linked += 1;
-  }
-  return { linked, missing };
-}
-
-// src/services/projectChats/sortProjectChats.ts
-function sortProjectChats(a, b) {
-  const byLatest = compareIsoDesc(a.latestMessageAt, b.latestMessageAt);
-  if (byLatest !== 0) return byLatest;
-  const byUpdated = compareIsoDesc(a.updatedAt ?? null, b.updatedAt ?? null);
-  if (byUpdated !== 0) return byUpdated;
-  const byCreated = compareIsoDesc(a.createdAt ?? null, b.createdAt ?? null);
-  if (byCreated !== 0) return byCreated;
-  return a.title.localeCompare(b.title);
-}
-
-// src/services/projectChats/mergeProjectChats.ts
-function mergeProjectChats(args) {
-  const { sessions, conversations } = args;
-  const resumedConversationIds = new Set(
-    sessions.filter((c) => c.type === "session").map((c) => c.resumedFromConversationId).filter((id) => Boolean(id))
-  );
-  const visibleConversations = conversations.filter((c) => {
-    if (c.type !== "conversation") return true;
-    return !resumedConversationIds.has(c.id);
-  });
-  return [...sessions, ...visibleConversations].sort(sortProjectChats);
-}
-
-// src/services/projectChats/deriveProjectChatTitle.ts
-function deriveProjectChatTitle(input) {
-  const trimmed = input.title?.trim();
-  if (trimmed) return trimmed;
-  const name = input.projectName?.trim();
-  if (name) return name;
-  const pathSuffix = input.projectPath ? input.projectPath.split(/[/\\]/).filter(Boolean).slice(-2).join("/") : "";
-  if (pathSuffix) return pathSuffix;
-  return `Untitled \xB7 ${input.id.slice(0, 8)}`;
-}
-
-// src/services/projectChats/normalizeConversationToProjectChat.ts
-function normalizeConversationToProjectChat(conversation) {
-  if (!conversation.projectId) {
-    throw new Error(
-      `normalizeConversationToProjectChat: conversation ${conversation.id} has no projectId \u2014 resolve it before normalizing`
-    );
-  }
-  return {
-    type: "conversation",
-    id: conversation.id,
-    projectId: conversation.projectId,
-    projectPath: conversation.projectPath ?? null,
-    title: deriveProjectChatTitle({
-      title: conversation.title,
-      projectName: conversation.projectName,
-      projectPath: conversation.projectPath,
-      id: conversation.id
-    }),
-    latestMessageAt: conversation.lastActivity ?? null,
-    updatedAt: conversation.lastActivity ?? null,
-    createdAt: null,
-    status: "resumable",
-    source: "hdd-cache",
-    provider: conversation.provider ?? CLAUDE_CODE_PROVIDER,
-    indexedAt: null,
-    fileMtime: null,
-    filePath: conversation.filePath ?? null,
-    sourceHash: null
-  };
-}
-
-// src/services/projectChats/normalizeSessionToProjectChat.ts
-function normalizeSessionToProjectChat(session) {
-  if (!session.projectId) {
-    throw new Error(
-      `normalizeSessionToProjectChat: session ${session.id} has no projectId \u2014 resolve it before normalizing`
-    );
-  }
-  return {
-    type: "session",
-    id: session.id,
-    projectId: session.projectId,
-    projectPath: session.projectPath ?? null,
-    title: deriveProjectChatTitle({
-      title: session.sessionName,
-      projectName: session.projectName,
-      projectPath: session.projectPath,
-      id: session.id
-    }),
-    latestMessageAt: session.lastMessageAt ?? session.lastActivityAt ?? null,
-    updatedAt: session.lastActivityAt ?? null,
-    createdAt: session.startedAt ?? null,
-    status: "active",
-    source: "session-store",
-    resumedFromConversationId: session.resumedFromConversationId ?? null
-  };
-}
-
-// src/services/projectChats/listProjectChats.ts
-async function listProjectChats(deps, args) {
-  const {
-    cache,
-    projectsRepo,
-    conversationsRepo,
-    sessionsRepo,
-    cacheMetadataRepo,
-    getSessionResponses,
-    getFreshScanner,
-    projectsDir
-  } = deps;
-  const needsRefresh = args.refreshConversations || shouldRefreshProjectsFromHdd(conversationsRepo, cacheMetadataRepo, { projectsDir });
-  if (needsRefresh) {
-    const scanner = await getFreshScanner();
-    const metas = [...scanner.getMetadataCache().values()];
-    if (metas.length > 0) {
-      cache.upsertFromScannerMeta(metas);
-    }
-    refreshConversationCache({ cache, projectsRepo, conversationsRepo, cacheMetadataRepo });
-  }
-  ensureSessionProjectIdsFromExistingProjects(projectsRepo, sessionsRepo);
-  const sessionResponses = getSessionResponses();
-  const sessionChats = [];
-  for (const s of sessionResponses) {
-    if (!s.projectId) continue;
-    sessionChats.push(normalizeSessionToProjectChat(s));
-  }
-  const conversationChats = [];
-  const { conversations } = cache.listConversations({ limit: 1e3, offset: 0 });
-  for (const c of conversations) {
-    if (!c.projectId) continue;
-    conversationChats.push(normalizeConversationToProjectChat(c));
-  }
-  return mergeProjectChats({ sessions: sessionChats, conversations: conversationChats });
-}
-
-// src/handlers/handleListProjectChats.ts
-async function handleListProjectChats(url, res, deps) {
-  const queryObj = Object.fromEntries(url.searchParams.entries());
-  const parsed = ListProjectChatsQuerySchema.safeParse(queryObj);
-  if (!parsed.success) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: "Invalid query parameters",
-        details: parsed.error.flatten()
-      })
-    );
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ projects: [], total: 0 }));
     return;
   }
-  const refreshConversations = parsed.data.refreshConversations === "1" || parsed.data.refresh === "1";
-  const chats = await listProjectChats(deps, { refreshConversations });
+  const total = entries.length;
+  const page = entries.slice(offset, offset + limit).map(({ name, path, dirName }) => ({ name, path, dirName }));
   res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ projectChats: chats }));
+  res.end(JSON.stringify({ projects: page, total }));
 }
 
 // src/pair-store.ts
@@ -3780,6 +3570,17 @@ function pruneAgentConversations(cache) {
   return { scanned: rows.length, pruned, missing };
 }
 
+// src/services/projectChats/deriveProjectChatTitle.ts
+function deriveProjectChatTitle(input) {
+  const trimmed = input.title?.trim();
+  if (trimmed) return trimmed;
+  const name = input.projectName?.trim();
+  if (name) return name;
+  const pathSuffix = input.projectPath ? input.projectPath.split(/[/\\]/).filter(Boolean).slice(-2).join("/") : "";
+  if (pathSuffix) return pathSuffix;
+  return `Untitled \xB7 ${input.id.slice(0, 8)}`;
+}
+
 // src/services/questions/detectAskUserQuestion.ts
 function normalizeContent2(raw) {
   if (Array.isArray(raw)) return raw;
@@ -4183,6 +3984,14 @@ function debounce(fn, waitMs) {
   return debounced;
 }
 
+// src/utils/dates.ts
+var import_date_fns = require("date-fns");
+function parseIsoDateOrNull(value) {
+  if (!value) return null;
+  const parsed = (0, import_date_fns.parseISO)(value);
+  return (0, import_date_fns.isValid)(parsed) ? parsed : null;
+}
+
 // src/utils/isScannedSnapshotStale.ts
 var STALENESS_TOLERANCE_MS = 1e3;
 function isScannedSnapshotStale(snapshotTimestamp, fileMtimeMs) {
@@ -4319,6 +4128,7 @@ var WSHub = class {
 
 // src/server.ts
 var BROWSE_SYSTEM_PROMPT = (browseRoot) => `You are working within the project boundary: ${browseRoot}. Do not read, write, or execute commands that access files or directories outside this boundary.`;
+var DEFAULT_SYSTEM_PROMPT = "When presenting options or choices to the user, limit the options to at most 3.";
 var DEFAULT_PTY_GRACE_PERIOD_MS = 27e4;
 function parseIncludeAgentsEnv(raw) {
   if (raw === void 0) return false;
@@ -4357,6 +4167,7 @@ var StreamerServer = class {
   binding = false;
   cacheReady = false;
   apiKey;
+  apiKeySource;
   localNoAuth;
   logMenubarRequests;
   verbose;
@@ -4368,7 +4179,10 @@ var StreamerServer = class {
   publicUrl = null;
   pairTokens = new PairTokenStore();
   exchangeAttempts = /* @__PURE__ */ new Map();
+  sessionStartAttempts = /* @__PURE__ */ new Map();
+  sessionInputAttempts = /* @__PURE__ */ new Map();
   ptyGracePeriodMs;
+  defaultSystemPrompt;
   // Map of sessionId → grace timer; fires to kill PTY after WS disconnect
   ptyGraceTimers = /* @__PURE__ */ new Map();
   // Map of sessionId → set of subscribed WS clients
@@ -4402,13 +4216,20 @@ var StreamerServer = class {
   constructor(config) {
     this.sessionStatusBus.setMaxListeners(0);
     this.apiKey = config.apiKey;
+    this.apiKeySource = config.apiKeySource ?? "config";
     this.localNoAuth = config.localNoAuth ?? false;
     this.logMenubarRequests = config.logMenubarRequests ?? false;
+    if (this.localNoAuth) {
+      console.warn(
+        "[WARN] localNoAuth is ENABLED \u2014 all requests from localhost bypass authentication. Do not run with --local-no-auth in shared or production environments."
+      );
+    }
     this.verbose = config.verbose ?? false;
     this.disableDb = config.disableDb ?? false;
     this.scanProfiles = config.scanProfiles;
     this.codexRoots = config.codexRoots ?? [(0, import_path11.join)((0, import_os6.homedir)(), ".codex", "sessions")];
     this.ptyGracePeriodMs = config.ptyGracePeriodMs ?? DEFAULT_PTY_GRACE_PERIOD_MS;
+    this.defaultSystemPrompt = config.defaultSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
     this.cacheDir = config.cacheDir ?? loadCacheDir() ?? (0, import_path11.join)((0, import_os6.homedir)(), ".threadbase", "cache");
     this.tailSize = config.tailSize ?? loadTailSize() ?? 10;
     this.directoryDebounceMs = parseDirScanDebounceEnv(process.env.THREADBASE_DIR_SCAN_DEBOUNCE_MS) ?? config.directoryScanDebounceMs ?? 1e3;
@@ -4580,10 +4401,15 @@ var StreamerServer = class {
       });
     }
     const agentClient = this.agentClient;
+    const self = this;
     const apiDeps = {
-      apiKey: this.apiKey,
+      // ponytail: getter so rotateApiKey() takes effect without restarting the server
+      get apiKey() {
+        return self.apiKey;
+      },
       localNoAuth: this.localNoAuth,
       logMenubarRequests: this.logMenubarRequests,
+      rotateApiKey: () => this.rotateApiKey(),
       publicUrl: this.publicUrl,
       browseRoot: this.browseRoot,
       ptyManager: this.ptyManager,
@@ -4614,8 +4440,8 @@ var StreamerServer = class {
       handleConversationsCount: (url, res) => this.handleConversationsCount(url, res),
       handleGetConversation: (id, url, res, ifNoneMatch) => this.handleGetConversation(id, url, res, ifNoneMatch),
       handleSearch: (url, res) => this.handleSearch(url, res),
+      handleListProjects: (url, res) => handleListProjects(url, res),
       handleGetPopularProjects: (url, res) => this.handleGetPopularProjects(url, res),
-      handleListProjectChats: (url, res) => this.handleListProjectChats(url, res),
       handlePairStart: (res) => this.handlePairStart(res),
       handlePairExchange: (req, res) => this.handlePairExchange(req, res),
       handleBrowse: (url, res) => this.handleBrowse(url, res),
@@ -5050,19 +4876,38 @@ var StreamerServer = class {
       machineName: hostname2()
     });
   }
-  checkExchangeRateLimit(ip) {
+  rotateApiKey() {
+    const newKey = generateApiKey();
+    const persisted = this.apiKeySource === "config";
+    if (persisted) setApiKey(newKey);
+    this.apiKey = newKey;
+    return { newKey, persisted };
+  }
+  checkRateLimit(map, key, limit, windowMs) {
     const now = Date.now();
-    const windowMs = 6e4;
-    const limit = 5;
-    const arr = (this.exchangeAttempts.get(ip) ?? []).filter((t) => now - t < windowMs);
+    const arr = (map.get(key) ?? []).filter((t) => now - t < windowMs);
     if (arr.length >= limit) {
-      this.exchangeAttempts.set(ip, arr);
+      map.set(key, arr);
       return false;
     }
     arr.push(now);
-    this.exchangeAttempts.set(ip, arr);
+    map.set(key, arr);
+    setTimeout(() => {
+      const remaining = (map.get(key) ?? []).filter((t) => Date.now() - t < windowMs);
+      if (remaining.length === 0) map.delete(key);
+      else map.set(key, remaining);
+    }, windowMs);
     return true;
   }
+  checkExchangeRateLimit(ip) {
+    return this.checkRateLimit(this.exchangeAttempts, ip, 5, 6e4);
+  }
+  checkSessionStartRateLimit(ip) {
+    return this.checkRateLimit(this.sessionStartAttempts, ip, 10, 6e4);
+  }
+  checkSessionInputRateLimit(sessionId) {
+    return this.checkRateLimit(this.sessionInputAttempts, sessionId, 500, 6e4);
+  }
   async handleListConversations(url, res) {
     const limit = intParam(url, "limit", 50);
     const offset = intParam(url, "offset", 0);
@@ -5224,21 +5069,6 @@ var StreamerServer = class {
     const projects = this.cache.getPopularProjects(limit);
     json(res, 200, { projects, total: projects.length });
   }
-  async handleListProjectChats(url, res) {
-    if (!this.cache || !this.projectsRepo || !this.conversationsRepo || !this.sessionsRepo || !this.cacheMetadataRepo) {
-      json(res, 503, { error: "Cache not available" });
-      return;
-    }
-    await handleListProjectChats(url, res, {
-      cache: this.cache,
-      projectsRepo: this.projectsRepo,
-      conversationsRepo: this.conversationsRepo,
-      sessionsRepo: this.sessionsRepo,
-      cacheMetadataRepo: this.cacheMetadataRepo,
-      getSessionResponses: () => this.sessionStore.list(this.ptyAttachedIds()),
-      getFreshScanner: () => this.getFreshScanner()
-    });
-  }
   buildStatCache(previousScanner) {
     if (!this.cache) return void 0;
     const dbStats = this.cache.getFileStats();
@@ -5715,6 +5545,10 @@ var StreamerServer = class {
     }
   }
   async handleSendInput(sessionId, req, res) {
+    if (!this.checkSessionInputRateLimit(sessionId)) {
+      json(res, 429, { error: "Too many input requests for this session. Please slow down." });
+      return;
+    }
     if (this.agentConfig.enabled) {
       const body2 = await readBody(req);
       const cache = this.cache;
@@ -5996,6 +5830,13 @@ var StreamerServer = class {
     json(res, 201, { sessionId: session.id });
   }
   async handleStartSession(req, res) {
+    const ip = req.socket?.remoteAddress ?? "unknown";
+    if (!this.checkSessionStartRateLimit(ip)) {
+      json(res, 429, {
+        error: "Too many session start requests. Please wait before trying again."
+      });
+      return;
+    }
     if (this.agentConfig.enabled) {
       const body2 = await readBody(req);
       const result = await handleStartAgentSession(body2, {
@@ -6019,7 +5860,7 @@ var StreamerServer = class {
       return;
     }
     const body = await readBody(req);
-    const { path: relativePath } = body;
+    const { path: relativePath, systemPrompt: clientPrompt } = body;
     if (typeof relativePath !== "string") {
       json(res, 400, { error: "Missing path field" });
       return;
@@ -6033,11 +5874,16 @@ var StreamerServer = class {
       return;
     }
     this.discoveryCache = null;
+    const systemPromptParts = [
+      this.defaultSystemPrompt,
+      BROWSE_SYSTEM_PROMPT(this.browseRoot),
+      typeof clientPrompt === "string" ? clientPrompt : null
+    ].filter(Boolean);
     try {
       const session = await this.ptyManager.startFresh({
         projectPath: resolvedPath,
         projectName: body.projectName,
-        systemPrompt: BROWSE_SYSTEM_PROMPT(this.browseRoot)
+        systemPrompt: systemPromptParts.join("\n")
       });
       this.sessionStore.addManaged(session);
       json(res, 202, { id: session.id, status: "pending" });