@threadbase-sh/streamer 1.25.0 → 1.27.0

package/dist/cli.cjs

@@ -1530,6 +1530,15 @@ function loadPublicUrl() {
   }
   return void 0;
 }
+function loadBrowserCors() {
+  try {
+    const content = (0, import_fs.readFileSync)(configFile(), "utf-8");
+    const match2 = content.match(/browser_cors:\s*(.+)/);
+    if (match2?.[1]) return match2[1].trim();
+  } catch {
+  }
+  return void 0;
+}
 function loadCacheDir() {
   try {
     const content = (0, import_fs.readFileSync)(configFile(), "utf-8");
@@ -135802,25 +135811,55 @@ var authMiddleware = (deps) => async (c, next) => {
 };
 
 // src/api/middleware/cors.middleware.ts
-var ALLOWED_ORIGINS = /* @__PURE__ */ new Set([
+var DEFAULT_DEV_ORIGINS = [
   "http://localhost:8081",
   "http://localhost:19006",
   "http://localhost:3000"
-]);
-var corsMiddleware = () => async (c, next) => {
-  const origin = c.req.header("origin");
-  const allowedOrigin = origin && ALLOWED_ORIGINS.has(origin) ? origin : null;
-  if (allowedOrigin) {
-    c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
-    c.res.headers.set("Vary", "Origin");
-    c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
-    c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
-    c.res.headers.set("Access-Control-Expose-Headers", "ETag");
-  }
-  if (c.req.method === "OPTIONS") {
-    return c.newResponse(null, allowedOrigin ? 204 : 403);
-  }
-  await next();
+];
+function resolveAllowedOrigins(raw2) {
+  if (!raw2) return null;
+  const trimmed = raw2.trim();
+  const lower = trimmed.toLowerCase();
+  if (lower === "0" || lower === "false" || lower === "no" || lower === "off" || trimmed === "") {
+    return null;
+  }
+  const origins = new Set(DEFAULT_DEV_ORIGINS);
+  if (!["1", "true", "yes", "on"].includes(lower)) {
+    for (const o of trimmed.split(",")) {
+      const origin = o.trim();
+      if (origin) origins.add(origin);
+    }
+  }
+  return origins;
+}
+var corsMiddleware = (configValue) => {
+  const allowedOrigins = resolveAllowedOrigins(
+    process.env.THREADBASE_ALLOW_BROWSER_CORS ?? configValue
+  );
+  return async (c, next) => {
+    const origin = c.req.header("origin");
+    const allowedOrigin = allowedOrigins && origin && allowedOrigins.has(origin) ? origin : null;
+    if (allowedOrigin) {
+      const raw2 = c.env.outgoing;
+      raw2.setHeader("Access-Control-Allow-Origin", allowedOrigin);
+      raw2.setHeader("Vary", "Origin");
+      raw2.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, QUERY, OPTIONS");
+      raw2.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
+      raw2.setHeader("Access-Control-Expose-Headers", "ETag, Accept-Query");
+      c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+      c.res.headers.set("Vary", "Origin");
+      c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, QUERY, OPTIONS");
+      c.res.headers.set(
+        "Access-Control-Allow-Headers",
+        "Authorization, Content-Type, If-None-Match"
+      );
+      c.res.headers.set("Access-Control-Expose-Headers", "ETag, Accept-Query");
+    }
+    if (c.req.method === "OPTIONS") {
+      return c.newResponse(null, allowedOrigin ? 204 : 403);
+    }
+    await next();
+  };
 };
 
 // src/api/middleware/error.middleware.ts
@@ -135856,6 +135895,11 @@ var createConversationRoutes = (deps) => {
     await deps.handleConversationsCount(url2, c.env.outgoing);
     return alreadyHandled2();
   });
+  app.on("QUERY", "/:id{.+}/search-target", async (c) => {
+    const id = c.req.param("id");
+    await deps.handleSearchTarget(id, c.env.incoming, c.env.outgoing);
+    return alreadyHandled2();
+  });
   app.get("/:id{.+}", async (c) => {
     const id = c.req.param("id");
     const url2 = new URL(c.req.url);
@@ -136317,7 +136361,7 @@ var createHonoApp = (deps, upgradeWebSocket) => {
       event: "http.request"
     });
   });
-  app.use("*", corsMiddleware());
+  app.use("*", corsMiddleware(deps.browserCors));
   app.use("*", authMiddleware(deps));
   app.onError(errorMiddleware);
   app.route("/healthz", createHealthRoutes());
@@ -141311,6 +141355,55 @@ var ConversationWatcher = class {
   }
 };
 
+// src/services/conversations/findSearchTarget.ts
+var SNIPPET_CONTEXT = 60;
+var MAX_MATCH_INDEXES = 1e3;
+function buildSnippet(source, matchStart, matchLength) {
+  const start = Math.max(0, matchStart - SNIPPET_CONTEXT);
+  const end = Math.min(source.length, matchStart + matchLength + SNIPPET_CONTEXT);
+  const prefix = start > 0 ? "\u2026" : "";
+  const suffix = end < source.length ? "\u2026" : "";
+  return `${prefix}${source.slice(start, end).replace(/\s+/g, " ").trim()}${suffix}`;
+}
+function extendedBody(m2) {
+  const parts = [];
+  if (m2.isThinking && m2.thinkingContent) parts.push(m2.thinkingContent);
+  for (const b2 of m2.metadata?.toolUseBlocks ?? []) {
+    if (b2.input !== void 0) parts.push(JSON.stringify(b2.input));
+  }
+  for (const r of m2.metadata?.toolResults ?? []) {
+    if (r.content !== void 0) parts.push(JSON.stringify(r.content));
+  }
+  return parts.join("\n");
+}
+function collectMatches(messages, needle, body) {
+  const indexes = [];
+  for (let i = 0; i < messages.length; i++) {
+    if (body(messages[i]).toLowerCase().includes(needle)) indexes.push(i);
+  }
+  return indexes;
+}
+function findSearchTarget(messages, query) {
+  const needle = query.toLowerCase();
+  let body = (m2) => m2.text ?? "";
+  let matches = collectMatches(messages, needle, body);
+  if (matches.length === 0) {
+    body = extendedBody;
+    matches = collectMatches(messages, needle, body);
+  }
+  if (matches.length === 0) return null;
+  const anchorIndex = matches[matches.length - 1];
+  const anchorBody = body(messages[anchorIndex]);
+  const at2 = anchorBody.toLowerCase().indexOf(needle);
+  return {
+    messageIndex: anchorIndex,
+    uuid: messages[anchorIndex].uuid ?? null,
+    snippet: buildSnippet(anchorBody, at2, query.length),
+    matchIndexes: matches.slice(-MAX_MATCH_INDEXES),
+    totalMatches: matches.length
+  };
+}
+
 // src/services/conversations/pruneAgentConversations.ts
 var import_fs23 = require("fs");
 function pruneAgentConversations(cache) {
@@ -142164,6 +142257,7 @@ var StreamerServer = class {
   disableDb = false;
   browseRoot = null;
   publicUrl = null;
+  browserCors;
   pairTokens = new PairTokenStore();
   exchangeAttempts = /* @__PURE__ */ new Map();
   sessionStartAttempts = /* @__PURE__ */ new Map();
@@ -142249,6 +142343,7 @@ var StreamerServer = class {
         this.log.warn(`Warning: ${result.error}`, { error: result.error });
       }
     }
+    this.browserCors = config2.browserCors ?? loadBrowserCors();
     this.sessionStore = new SessionStore();
     this.wsHub = new WSHub();
     this.fileWatcher = new ConversationWatcher({
@@ -142403,6 +142498,7 @@ var StreamerServer = class {
       rotateApiKey: () => this.rotateApiKey(),
       publicUrl: this.publicUrl,
       browseRoot: this.browseRoot,
+      browserCors: this.browserCors,
       ptyManager: this.ptyManager,
       sessionStore: this.sessionStore,
       wsHub: this.wsHub,
@@ -142431,6 +142527,7 @@ var StreamerServer = class {
       handleConversationsCount: (url2, res) => this.handleConversationsCount(url2, res),
       handleGetConversation: (id, url2, res, ifNoneMatch) => this.handleGetConversation(id, url2, res, ifNoneMatch),
       handleSearch: (url2, res) => this.handleSearch(url2, res),
+      handleSearchTarget: (id, req, res) => this.handleSearchTarget(id, req, res),
       handleListProjects: (url2, res) => handleListProjects(url2, res),
       handleGetPopularProjects: (url2, res) => this.handleGetPopularProjects(url2, res),
       handlePairStart: (res) => this.handlePairStart(res),
@@ -143331,7 +143428,7 @@ var StreamerServer = class {
       messageCount: etagSource.messageCount,
       timestamp: etagSource.timestamp
     });
-    const isFirstPage = !url2.searchParams.has("before_index");
+    const isFirstPage = !url2.searchParams.has("before_index") && !url2.searchParams.has("anchor_index") && !url2.searchParams.has("after_index");
     if (isFirstPage && ifNoneMatch && ifNoneMatch === etag) {
       res.writeHead(304, { ETag: etag, "Access-Control-Expose-Headers": "ETag" });
       res.end();
@@ -143339,29 +143436,53 @@ var StreamerServer = class {
     }
     const filtered = conversation.messages;
     const total = filtered.length;
-    const usePaging = url2.searchParams.has("msg_limit") || url2.searchParams.has("before_index");
+    const hasAnchor = url2.searchParams.has("anchor_index");
+    const hasAfter = url2.searchParams.has("after_index");
+    const usePaging = url2.searchParams.has("msg_limit") || url2.searchParams.has("before_index") || hasAnchor || hasAfter;
     let slice = filtered;
     let fromIdx = 0;
     let messagePagination;
     if (usePaging) {
       const limit = Math.min(Math.max(intParam(url2, "msg_limit", 80), 1), 500);
       let beforeIndex = total;
+      let scanLimit = limit;
+      let anchorIndex = null;
+      let newerPaging = false;
       if (url2.searchParams.has("before_index")) {
         beforeIndex = intParam(url2, "before_index", total);
         beforeIndex = Math.min(Math.max(beforeIndex, 0), total);
+      } else if (hasAfter) {
+        const from = Math.min(Math.max(intParam(url2, "after_index", 0), 0), total);
+        beforeIndex = Math.min(total, from + limit);
+        scanLimit = beforeIndex - from;
+        newerPaging = true;
+      } else if (hasAnchor) {
+        anchorIndex = Math.min(
+          Math.max(intParam(url2, "anchor_index", 0), 0),
+          Math.max(0, total - 1)
+        );
+        const from = Math.max(0, anchorIndex - Math.floor(limit / 2));
+        beforeIndex = Math.min(total, from + limit);
+        newerPaging = true;
       }
       const pagedScanner = this.scannerReady ? await this.getScanner(true) : null;
-      const page = pagedScanner && typeof pagedScanner.getConversationPage === "function" ? await pagedScanner.getConversationPage(id, { beforeIndex, limit }) : null;
-      const start = page?.fromIndex ?? Math.max(0, beforeIndex - limit);
+      const page = scanLimit > 0 && pagedScanner && typeof pagedScanner.getConversationPage === "function" ? await pagedScanner.getConversationPage(id, { beforeIndex, limit: scanLimit }) : null;
+      const start = page?.fromIndex ?? Math.max(0, beforeIndex - scanLimit);
       slice = page?.messages ?? filtered.slice(start, beforeIndex);
       fromIdx = start;
+      const effectiveTotal = page?.total ?? total;
       messagePagination = {
-        total: page?.total ?? total,
+        total: effectiveTotal,
         before_index: beforeIndex,
         from_index: start,
         has_more_older: start > 0,
         next_before_index: start > 0 ? start : null
       };
+      if (anchorIndex != null) messagePagination.anchor_index = anchorIndex;
+      if (newerPaging) {
+        messagePagination.has_more_newer = beforeIndex < effectiveTotal;
+        messagePagination.next_after_index = beforeIndex < effectiveTotal ? beforeIndex : null;
+      }
     }
     const messagesPayload = slice.map((m2, localIdx) => {
       const content = [];
@@ -143436,6 +143557,65 @@ var StreamerServer = class {
     });
     res.end(JSON.stringify(body));
   }
+  // Resolves an active search query to the message a client should anchor to
+  // inside one conversation. Matching is body-only (text first, then
+  // thinking/tool payloads) — a metadata-only search hit (project path, title)
+  // has no scroll target and returns 404 search_target_not_found.
+  //
+  // Implements HTTP QUERY (RFC 10008): the search query travels in a JSON
+  // request body instead of a URL query param — QUERY is safe + idempotent +
+  // cacheable like GET, but (like POST) can carry a body, which fits this
+  // endpoint's single-string input exactly. `Accept-Query` advertises the
+  // supported request media type per the spec.
+  async handleSearchTarget(id, req, res) {
+    const contentType = (req.headers["content-type"] ?? "").split(";")[0].trim();
+    if (contentType && contentType !== "application/json") {
+      res.setHeader("Accept-Query", "application/json");
+      json2(res, 415, {
+        error: "Unsupported Content-Type; expected application/json",
+        code: "unsupported_media_type"
+      });
+      return;
+    }
+    let body;
+    try {
+      body = await readBody(req);
+    } catch {
+      res.setHeader("Accept-Query", "application/json");
+      json2(res, 422, { error: "Malformed JSON body", code: "invalid_query" });
+      return;
+    }
+    const q2 = typeof body?.q === "string" ? body.q.trim() : "";
+    if (!q2) {
+      res.setHeader("Accept-Query", "application/json");
+      json2(res, 422, { error: "Missing or empty query field: q", code: "invalid_query" });
+      return;
+    }
+    if (q2.length > 256) {
+      res.setHeader("Accept-Query", "application/json");
+      json2(res, 422, { error: "Query too long (max 256 characters)", code: "invalid_query" });
+      return;
+    }
+    const conversation = await this.findConversationByUuid(id);
+    if (!conversation) {
+      json2(res, 404, { error: "Conversation not found", code: "not_found" });
+      return;
+    }
+    const target = findSearchTarget(conversation.messages, q2);
+    if (!target) {
+      json2(res, 404, { error: "No message body matches query", code: "search_target_not_found" });
+      return;
+    }
+    res.setHeader("Accept-Query", "application/json");
+    json2(res, 200, {
+      query: q2,
+      message_index: target.messageIndex,
+      uuid: target.uuid,
+      snippet: target.snippet,
+      match_indexes: target.matchIndexes,
+      total_matches: target.totalMatches
+    });
+  }
   async handleSearch(url2, res) {
     const q2 = url2.searchParams.get("q") ?? "";
     if (!q2) {
@@ -143455,7 +143635,11 @@ var StreamerServer = class {
       scanner
     );
     const adapted = results.map((r) => ({
-      id: r.meta.id.split("/").pop()?.replace(/\.jsonl$/, "") || r.meta.id,
+      // Use sessionId so the id matches /api/conversations and resolves via
+      // findConversationByUuid — a client can round-trip a search result into
+      // GET /api/conversations/:id or the search-target QUERY. The old
+      // filename-stem derivation produced an id no other endpoint recognized.
+      id: r.meta.sessionId || r.meta.id,
       title: r.meta.projectName,
       sessionName: r.meta.sessionName || void 0,
       filePath: r.meta.filePath,