@threadbase-sh/streamer 1.25.0 → 1.27.0

package/dist/index.d.cts

@@ -307,6 +307,7 @@ interface ServerConfig {
     logMenubarRequests?: boolean;
     browseRoot?: string;
     publicUrl?: string;
+    browserCors?: string;
     disableDb?: boolean;
     scanProfiles?: Array<{
         id: string;
@@ -717,6 +718,7 @@ type ApiDeps = {
     };
     publicUrl: string | null;
     browseRoot: string | null;
+    browserCors: string | undefined;
     ptyManager: LiveSessionManager;
     sessionStore: SessionStore;
     wsHub: WSHub;
@@ -745,6 +747,7 @@ type ApiDeps = {
     handleConversationsCount: (url: URL, res: ServerResponse) => Promise<void>;
     handleGetConversation: (id: string, url: URL, res: ServerResponse, ifNoneMatch?: string) => Promise<void>;
     handleSearch: (url: URL, res: ServerResponse) => Promise<void>;
+    handleSearchTarget: (id: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleListProjects: (url: URL, res: ServerResponse) => void;
     handleGetPopularProjects: (url: URL, res: ServerResponse) => void;
     handlePairStart: (res: ServerResponse) => void;
@@ -893,6 +896,7 @@ declare class StreamerServer {
     private disableDb;
     private browseRoot;
     private publicUrl;
+    private browserCors;
     private pairTokens;
     private exchangeAttempts;
     private sessionStartAttempts;
@@ -967,6 +971,7 @@ declare class StreamerServer {
     private findConversationByUuid;
     private isConversationSnapshotStale;
     private handleGetConversation;
+    private handleSearchTarget;
     private handleSearch;
     private handleListSessions;
     private handleGetSession;

package/dist/index.d.ts

@@ -307,6 +307,7 @@ interface ServerConfig {
     logMenubarRequests?: boolean;
     browseRoot?: string;
     publicUrl?: string;
+    browserCors?: string;
     disableDb?: boolean;
     scanProfiles?: Array<{
         id: string;
@@ -717,6 +718,7 @@ type ApiDeps = {
     };
     publicUrl: string | null;
     browseRoot: string | null;
+    browserCors: string | undefined;
     ptyManager: LiveSessionManager;
     sessionStore: SessionStore;
     wsHub: WSHub;
@@ -745,6 +747,7 @@ type ApiDeps = {
     handleConversationsCount: (url: URL, res: ServerResponse) => Promise<void>;
     handleGetConversation: (id: string, url: URL, res: ServerResponse, ifNoneMatch?: string) => Promise<void>;
     handleSearch: (url: URL, res: ServerResponse) => Promise<void>;
+    handleSearchTarget: (id: string, req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleListProjects: (url: URL, res: ServerResponse) => void;
     handleGetPopularProjects: (url: URL, res: ServerResponse) => void;
     handlePairStart: (res: ServerResponse) => void;
@@ -893,6 +896,7 @@ declare class StreamerServer {
     private disableDb;
     private browseRoot;
     private publicUrl;
+    private browserCors;
     private pairTokens;
     private exchangeAttempts;
     private sessionStartAttempts;
@@ -967,6 +971,7 @@ declare class StreamerServer {
     private findConversationByUuid;
     private isConversationSnapshotStale;
     private handleGetConversation;
+    private handleSearchTarget;
     private handleSearch;
     private handleListSessions;
     private handleGetSession;

package/dist/index.js

@@ -324,6 +324,15 @@ function loadPublicUrl() {
   }
   return void 0;
 }
+function loadBrowserCors() {
+  try {
+    const content = readFileSync(configFile(), "utf-8");
+    const match = content.match(/browser_cors:\s*(.+)/);
+    if (match?.[1]) return match[1].trim();
+  } catch {
+  }
+  return void 0;
+}
 function loadCacheDir() {
   try {
     const content = readFileSync(configFile(), "utf-8");
@@ -2574,25 +2583,55 @@ var authMiddleware = (deps) => async (c, next) => {
 };
 
 // src/api/middleware/cors.middleware.ts
-var ALLOWED_ORIGINS = /* @__PURE__ */ new Set([
+var DEFAULT_DEV_ORIGINS = [
   "http://localhost:8081",
   "http://localhost:19006",
   "http://localhost:3000"
-]);
-var corsMiddleware = () => async (c, next) => {
-  const origin = c.req.header("origin");
-  const allowedOrigin = origin && ALLOWED_ORIGINS.has(origin) ? origin : null;
-  if (allowedOrigin) {
-    c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
-    c.res.headers.set("Vary", "Origin");
-    c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
-    c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
-    c.res.headers.set("Access-Control-Expose-Headers", "ETag");
-  }
-  if (c.req.method === "OPTIONS") {
-    return c.newResponse(null, allowedOrigin ? 204 : 403);
-  }
-  await next();
+];
+function resolveAllowedOrigins(raw) {
+  if (!raw) return null;
+  const trimmed = raw.trim();
+  const lower = trimmed.toLowerCase();
+  if (lower === "0" || lower === "false" || lower === "no" || lower === "off" || trimmed === "") {
+    return null;
+  }
+  const origins = new Set(DEFAULT_DEV_ORIGINS);
+  if (!["1", "true", "yes", "on"].includes(lower)) {
+    for (const o of trimmed.split(",")) {
+      const origin = o.trim();
+      if (origin) origins.add(origin);
+    }
+  }
+  return origins;
+}
+var corsMiddleware = (configValue) => {
+  const allowedOrigins = resolveAllowedOrigins(
+    process.env.THREADBASE_ALLOW_BROWSER_CORS ?? configValue
+  );
+  return async (c, next) => {
+    const origin = c.req.header("origin");
+    const allowedOrigin = allowedOrigins && origin && allowedOrigins.has(origin) ? origin : null;
+    if (allowedOrigin) {
+      const raw = c.env.outgoing;
+      raw.setHeader("Access-Control-Allow-Origin", allowedOrigin);
+      raw.setHeader("Vary", "Origin");
+      raw.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, QUERY, OPTIONS");
+      raw.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
+      raw.setHeader("Access-Control-Expose-Headers", "ETag, Accept-Query");
+      c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+      c.res.headers.set("Vary", "Origin");
+      c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, QUERY, OPTIONS");
+      c.res.headers.set(
+        "Access-Control-Allow-Headers",
+        "Authorization, Content-Type, If-None-Match"
+      );
+      c.res.headers.set("Access-Control-Expose-Headers", "ETag, Accept-Query");
+    }
+    if (c.req.method === "OPTIONS") {
+      return c.newResponse(null, allowedOrigin ? 204 : 403);
+    }
+    await next();
+  };
 };
 
 // src/api/middleware/error.middleware.ts
@@ -2630,6 +2669,11 @@ var createConversationRoutes = (deps) => {
     await deps.handleConversationsCount(url, c.env.outgoing);
     return alreadyHandled2();
   });
+  app.on("QUERY", "/:id{.+}/search-target", async (c) => {
+    const id = c.req.param("id");
+    await deps.handleSearchTarget(id, c.env.incoming, c.env.outgoing);
+    return alreadyHandled2();
+  });
   app.get("/:id{.+}", async (c) => {
     const id = c.req.param("id");
     const url = new URL(c.req.url);
@@ -3007,7 +3051,7 @@ var createHonoApp = (deps, upgradeWebSocket) => {
       event: "http.request"
     });
   });
-  app.use("*", corsMiddleware());
+  app.use("*", corsMiddleware(deps.browserCors));
   app.use("*", authMiddleware(deps));
   app.onError(errorMiddleware);
   app.route("/healthz", createHealthRoutes());
@@ -4447,6 +4491,55 @@ var ConversationWatcher = class {
   }
 };
 
+// src/services/conversations/findSearchTarget.ts
+var SNIPPET_CONTEXT = 60;
+var MAX_MATCH_INDEXES = 1e3;
+function buildSnippet(source, matchStart, matchLength) {
+  const start = Math.max(0, matchStart - SNIPPET_CONTEXT);
+  const end = Math.min(source.length, matchStart + matchLength + SNIPPET_CONTEXT);
+  const prefix = start > 0 ? "\u2026" : "";
+  const suffix = end < source.length ? "\u2026" : "";
+  return `${prefix}${source.slice(start, end).replace(/\s+/g, " ").trim()}${suffix}`;
+}
+function extendedBody(m) {
+  const parts = [];
+  if (m.isThinking && m.thinkingContent) parts.push(m.thinkingContent);
+  for (const b of m.metadata?.toolUseBlocks ?? []) {
+    if (b.input !== void 0) parts.push(JSON.stringify(b.input));
+  }
+  for (const r of m.metadata?.toolResults ?? []) {
+    if (r.content !== void 0) parts.push(JSON.stringify(r.content));
+  }
+  return parts.join("\n");
+}
+function collectMatches(messages, needle, body) {
+  const indexes = [];
+  for (let i = 0; i < messages.length; i++) {
+    if (body(messages[i]).toLowerCase().includes(needle)) indexes.push(i);
+  }
+  return indexes;
+}
+function findSearchTarget(messages, query) {
+  const needle = query.toLowerCase();
+  let body = (m) => m.text ?? "";
+  let matches = collectMatches(messages, needle, body);
+  if (matches.length === 0) {
+    body = extendedBody;
+    matches = collectMatches(messages, needle, body);
+  }
+  if (matches.length === 0) return null;
+  const anchorIndex = matches[matches.length - 1];
+  const anchorBody = body(messages[anchorIndex]);
+  const at = anchorBody.toLowerCase().indexOf(needle);
+  return {
+    messageIndex: anchorIndex,
+    uuid: messages[anchorIndex].uuid ?? null,
+    snippet: buildSnippet(anchorBody, at, query.length),
+    matchIndexes: matches.slice(-MAX_MATCH_INDEXES),
+    totalMatches: matches.length
+  };
+}
+
 // src/services/conversations/pruneAgentConversations.ts
 import { existsSync as existsSync6 } from "fs";
 function pruneAgentConversations(cache) {
@@ -5062,6 +5155,7 @@ var StreamerServer = class {
   disableDb = false;
   browseRoot = null;
   publicUrl = null;
+  browserCors;
   pairTokens = new PairTokenStore();
   exchangeAttempts = /* @__PURE__ */ new Map();
   sessionStartAttempts = /* @__PURE__ */ new Map();
@@ -5147,6 +5241,7 @@ var StreamerServer = class {
         this.log.warn(`Warning: ${result.error}`, { error: result.error });
       }
     }
+    this.browserCors = config.browserCors ?? loadBrowserCors();
     this.sessionStore = new SessionStore();
     this.wsHub = new WSHub();
     this.fileWatcher = new ConversationWatcher({
@@ -5301,6 +5396,7 @@ var StreamerServer = class {
       rotateApiKey: () => this.rotateApiKey(),
       publicUrl: this.publicUrl,
       browseRoot: this.browseRoot,
+      browserCors: this.browserCors,
       ptyManager: this.ptyManager,
       sessionStore: this.sessionStore,
       wsHub: this.wsHub,
@@ -5329,6 +5425,7 @@ var StreamerServer = class {
       handleConversationsCount: (url, res) => this.handleConversationsCount(url, res),
       handleGetConversation: (id, url, res, ifNoneMatch) => this.handleGetConversation(id, url, res, ifNoneMatch),
       handleSearch: (url, res) => this.handleSearch(url, res),
+      handleSearchTarget: (id, req, res) => this.handleSearchTarget(id, req, res),
       handleListProjects: (url, res) => handleListProjects(url, res),
       handleGetPopularProjects: (url, res) => this.handleGetPopularProjects(url, res),
       handlePairStart: (res) => this.handlePairStart(res),
@@ -6229,7 +6326,7 @@ var StreamerServer = class {
       messageCount: etagSource.messageCount,
       timestamp: etagSource.timestamp
     });
-    const isFirstPage = !url.searchParams.has("before_index");
+    const isFirstPage = !url.searchParams.has("before_index") && !url.searchParams.has("anchor_index") && !url.searchParams.has("after_index");
     if (isFirstPage && ifNoneMatch && ifNoneMatch === etag) {
       res.writeHead(304, { ETag: etag, "Access-Control-Expose-Headers": "ETag" });
       res.end();
@@ -6237,29 +6334,53 @@ var StreamerServer = class {
     }
     const filtered = conversation.messages;
     const total = filtered.length;
-    const usePaging = url.searchParams.has("msg_limit") || url.searchParams.has("before_index");
+    const hasAnchor = url.searchParams.has("anchor_index");
+    const hasAfter = url.searchParams.has("after_index");
+    const usePaging = url.searchParams.has("msg_limit") || url.searchParams.has("before_index") || hasAnchor || hasAfter;
     let slice = filtered;
     let fromIdx = 0;
     let messagePagination;
     if (usePaging) {
       const limit = Math.min(Math.max(intParam(url, "msg_limit", 80), 1), 500);
       let beforeIndex = total;
+      let scanLimit = limit;
+      let anchorIndex = null;
+      let newerPaging = false;
       if (url.searchParams.has("before_index")) {
         beforeIndex = intParam(url, "before_index", total);
         beforeIndex = Math.min(Math.max(beforeIndex, 0), total);
+      } else if (hasAfter) {
+        const from = Math.min(Math.max(intParam(url, "after_index", 0), 0), total);
+        beforeIndex = Math.min(total, from + limit);
+        scanLimit = beforeIndex - from;
+        newerPaging = true;
+      } else if (hasAnchor) {
+        anchorIndex = Math.min(
+          Math.max(intParam(url, "anchor_index", 0), 0),
+          Math.max(0, total - 1)
+        );
+        const from = Math.max(0, anchorIndex - Math.floor(limit / 2));
+        beforeIndex = Math.min(total, from + limit);
+        newerPaging = true;
       }
       const pagedScanner = this.scannerReady ? await this.getScanner(true) : null;
-      const page = pagedScanner && typeof pagedScanner.getConversationPage === "function" ? await pagedScanner.getConversationPage(id, { beforeIndex, limit }) : null;
-      const start = page?.fromIndex ?? Math.max(0, beforeIndex - limit);
+      const page = scanLimit > 0 && pagedScanner && typeof pagedScanner.getConversationPage === "function" ? await pagedScanner.getConversationPage(id, { beforeIndex, limit: scanLimit }) : null;
+      const start = page?.fromIndex ?? Math.max(0, beforeIndex - scanLimit);
       slice = page?.messages ?? filtered.slice(start, beforeIndex);
       fromIdx = start;
+      const effectiveTotal = page?.total ?? total;
       messagePagination = {
-        total: page?.total ?? total,
+        total: effectiveTotal,
         before_index: beforeIndex,
         from_index: start,
         has_more_older: start > 0,
         next_before_index: start > 0 ? start : null
       };
+      if (anchorIndex != null) messagePagination.anchor_index = anchorIndex;
+      if (newerPaging) {
+        messagePagination.has_more_newer = beforeIndex < effectiveTotal;
+        messagePagination.next_after_index = beforeIndex < effectiveTotal ? beforeIndex : null;
+      }
     }
     const messagesPayload = slice.map((m, localIdx) => {
       const content = [];
@@ -6334,6 +6455,65 @@ var StreamerServer = class {
     });
     res.end(JSON.stringify(body));
   }
+  // Resolves an active search query to the message a client should anchor to
+  // inside one conversation. Matching is body-only (text first, then
+  // thinking/tool payloads) — a metadata-only search hit (project path, title)
+  // has no scroll target and returns 404 search_target_not_found.
+  //
+  // Implements HTTP QUERY (RFC 10008): the search query travels in a JSON
+  // request body instead of a URL query param — QUERY is safe + idempotent +
+  // cacheable like GET, but (like POST) can carry a body, which fits this
+  // endpoint's single-string input exactly. `Accept-Query` advertises the
+  // supported request media type per the spec.
+  async handleSearchTarget(id, req, res) {
+    const contentType = (req.headers["content-type"] ?? "").split(";")[0].trim();
+    if (contentType && contentType !== "application/json") {
+      res.setHeader("Accept-Query", "application/json");
+      json(res, 415, {
+        error: "Unsupported Content-Type; expected application/json",
+        code: "unsupported_media_type"
+      });
+      return;
+    }
+    let body;
+    try {
+      body = await readBody(req);
+    } catch {
+      res.setHeader("Accept-Query", "application/json");
+      json(res, 422, { error: "Malformed JSON body", code: "invalid_query" });
+      return;
+    }
+    const q = typeof body?.q === "string" ? body.q.trim() : "";
+    if (!q) {
+      res.setHeader("Accept-Query", "application/json");
+      json(res, 422, { error: "Missing or empty query field: q", code: "invalid_query" });
+      return;
+    }
+    if (q.length > 256) {
+      res.setHeader("Accept-Query", "application/json");
+      json(res, 422, { error: "Query too long (max 256 characters)", code: "invalid_query" });
+      return;
+    }
+    const conversation = await this.findConversationByUuid(id);
+    if (!conversation) {
+      json(res, 404, { error: "Conversation not found", code: "not_found" });
+      return;
+    }
+    const target = findSearchTarget(conversation.messages, q);
+    if (!target) {
+      json(res, 404, { error: "No message body matches query", code: "search_target_not_found" });
+      return;
+    }
+    res.setHeader("Accept-Query", "application/json");
+    json(res, 200, {
+      query: q,
+      message_index: target.messageIndex,
+      uuid: target.uuid,
+      snippet: target.snippet,
+      match_indexes: target.matchIndexes,
+      total_matches: target.totalMatches
+    });
+  }
   async handleSearch(url, res) {
     const q = url.searchParams.get("q") ?? "";
     if (!q) {
@@ -6353,7 +6533,11 @@ var StreamerServer = class {
       scanner
     );
     const adapted = results.map((r) => ({
-      id: r.meta.id.split("/").pop()?.replace(/\.jsonl$/, "") || r.meta.id,
+      // Use sessionId so the id matches /api/conversations and resolves via
+      // findConversationByUuid — a client can round-trip a search result into
+      // GET /api/conversations/:id or the search-target QUERY. The old
+      // filename-stem derivation produced an id no other endpoint recognized.
+      id: r.meta.sessionId || r.meta.id,
       title: r.meta.projectName,
       sessionName: r.meta.sessionName || void 0,
       filePath: r.meta.filePath,