@threadbase-sh/streamer 1.39.1 → 1.40.0

package/dist/index.js

@@ -3017,7 +3017,7 @@ import { randomUUID as randomUUID5 } from "crypto";
 import { EventEmitter } from "events";
 import {
   createReadStream,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   watch as fsWatch,
   readdirSync as readdirSync6,
   readFileSync as readFileSync8,
@@ -3025,7 +3025,7 @@ import {
 } from "fs";
 import { realpath as realpath2 } from "fs/promises";
 import { createServer } from "http";
-import { homedir as homedir9, hostname as hostname2 } from "os";
+import { homedir as homedir9, hostname as hostname3 } from "os";
 import { basename as basename5, dirname as dirname9, join as join18 } from "path";
 import { createInterface } from "readline";
 
@@ -3285,7 +3285,7 @@ async function handleStartAgentSession(body, deps) {
 }
 
 // src/api/app.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono18 } from "hono";
 
 // src/db/repositories/devices.repository.ts
 import { createHash, randomBytes as randomBytes2, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -3605,12 +3605,222 @@ var errorMiddleware = (err, c) => {
   return c.json({ error: message }, 500);
 };
 
-// src/api/routes/browse.routes.ts
+// src/api/routes/backup.routes.ts
 import { Hono as Hono2 } from "hono";
+import { hostname } from "os";
+
+// src/services/backup/backup.ts
+var BACKUP_FORMAT_VERSION = 1;
+var BackupError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function validateArchive(input) {
+  if (!input || typeof input !== "object") {
+    throw new BackupError("Backup is not an object", "INVALID_ARCHIVE");
+  }
+  const archive = input;
+  const manifest = archive.manifest;
+  if (!manifest || typeof manifest !== "object") {
+    throw new BackupError("Backup is missing its manifest", "INVALID_ARCHIVE");
+  }
+  if (manifest.formatVersion !== BACKUP_FORMAT_VERSION) {
+    throw new BackupError(
+      `Unsupported backup format version ${String(manifest.formatVersion)}; this build reads version ${BACKUP_FORMAT_VERSION}`,
+      "UNSUPPORTED_VERSION"
+    );
+  }
+  if (!Array.isArray(archive.projects)) {
+    throw new BackupError("Backup is missing its projects array", "INVALID_ARCHIVE");
+  }
+  for (const [i, p] of archive.projects.entries()) {
+    if (!p || typeof p !== "object") {
+      throw new BackupError(`Project at index ${i} is not an object`, "INVALID_ARCHIVE");
+    }
+    if (typeof p.id !== "string" || p.id.length === 0) {
+      throw new BackupError(`Project at index ${i} has no id`, "INVALID_ARCHIVE");
+    }
+    if (typeof p.path !== "string" || p.path.length === 0) {
+      throw new BackupError(`Project at index ${i} has no path`, "INVALID_ARCHIVE");
+    }
+  }
+  const ids = new Set(archive.projects.map((p) => p.id));
+  if (ids.size !== archive.projects.length) {
+    throw new BackupError("Backup contains duplicate project ids", "INVALID_ARCHIVE");
+  }
+  return archive;
+}
+function remapPaths(projects, rules) {
+  const ordered = [...rules].sort((a, b) => b.from.length - a.from.length);
+  return projects.map((p) => {
+    const rule = ordered.find((r) => p.path === r.from || p.path.startsWith(`${r.from}/`));
+    if (!rule) return p;
+    return { ...p, path: `${rule.to}${p.path.slice(rule.from.length)}` };
+  });
+}
+function planRestore(incoming, existing) {
+  const byId = new Map(existing.map((e) => [e.id, e]));
+  const byPath = new Map(existing.map((e) => [e.path, e]));
+  const plan = { create: [], update: [], conflict: [] };
+  for (const p of incoming) {
+    const sameId = byId.get(p.id);
+    if (sameId) {
+      if (sameId.path !== p.path) plan.update.push(p);
+      continue;
+    }
+    const samePath = byPath.get(p.path);
+    if (samePath) {
+      plan.conflict.push({ incoming: p, existingId: samePath.id });
+      continue;
+    }
+    plan.create.push(p);
+  }
+  return plan;
+}
+
+// src/version.ts
+import { readFileSync as readFileSync4, realpathSync } from "fs";
+import { dirname as dirname5, join as join7 } from "path";
+var cached;
+function getVersion() {
+  if (cached !== void 0) return cached;
+  cached = resolveVersion();
+  return cached;
+}
+function resolveVersion() {
+  const scriptPath = process.argv[1] ?? "";
+  const here = scriptPath ? dirname5(scriptPath) : process.cwd();
+  let realHere = here;
+  try {
+    realHere = dirname5(realpathSync(scriptPath));
+  } catch {
+  }
+  const searchDirs = realHere === here ? [here, join7(here, "..")] : [here, join7(here, ".."), realHere, join7(realHere, "..")];
+  for (const dir of searchDirs) {
+    try {
+      const v = readFileSync4(join7(dir, "version.txt"), "utf8").trim();
+      if (v) return v;
+    } catch {
+    }
+  }
+  try {
+    const pkg = JSON.parse(readFileSync4(join7(here, "..", "package.json"), "utf8"));
+    if (pkg.version) return `${pkg.version}+source`;
+  } catch {
+  }
+  return "0.0.0+unknown";
+}
+
+// src/api/routes/backup.routes.ts
+function readBody(c) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    c.env.incoming.on("data", (chunk) => chunks.push(chunk));
+    c.env.incoming.on("end", () => {
+      try {
+        const raw = Buffer.concat(chunks).toString("utf-8");
+        resolve2(raw ? JSON.parse(raw) : {});
+      } catch {
+        reject(new Error("Invalid JSON body"));
+      }
+    });
+    c.env.incoming.on("error", reject);
+  });
+}
+var createBackupRoutes = (deps) => {
+  const app = new Hono2();
+  app.get("/export", (c) => {
+    const repo = deps.projectsRepo();
+    if (!repo) {
+      return c.json({ error: "Project store is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    const projects = repo.listProjects().map((p) => ({
+      id: p.id,
+      path: p.path,
+      name: p.name ?? null,
+      createdAt: p.createdAt,
+      updatedAt: p.updatedAt
+    }));
+    return c.json({
+      manifest: {
+        formatVersion: BACKUP_FORMAT_VERSION,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        streamerVersion: getVersion(),
+        sourceHost: hostname(),
+        // No endpoint here exports the API key. The flag is recorded so an
+        // archive is self-describing about its own sensitivity rather than
+        // requiring a reader to infer it.
+        includesSecrets: false,
+        counts: { projects: projects.length }
+      },
+      projects
+    });
+  });
+  app.post("/restore", async (c) => {
+    const repo = deps.projectsRepo();
+    if (!repo) {
+      return c.json({ error: "Project store is unavailable", code: "STORE_UNAVAILABLE" }, 503);
+    }
+    let body;
+    try {
+      body = await readBody(c);
+    } catch {
+      return c.json({ error: "Invalid JSON body", code: "INVALID_BODY" }, 400);
+    }
+    let archive;
+    try {
+      archive = validateArchive(body.archive);
+    } catch (err) {
+      if (err instanceof BackupError) {
+        return c.json({ error: err.message, code: err.code }, 400);
+      }
+      throw err;
+    }
+    const rules = Array.isArray(body.pathMap) ? body.pathMap.filter((r) => typeof r?.from === "string" && typeof r?.to === "string").map((r) => ({ from: r.from, to: r.to })) : [];
+    const incoming = rules.length > 0 ? remapPaths(archive.projects, rules) : archive.projects;
+    const existing = repo.listProjects().map((p) => ({ id: p.id, path: p.path }));
+    const plan = planRestore(incoming, existing);
+    const summary = {
+      create: plan.create.length,
+      update: plan.update.length,
+      conflict: plan.conflict.length
+    };
+    if (body.apply !== true) {
+      return c.json({ applied: false, summary, plan });
+    }
+    if (plan.conflict.length > 0) {
+      return c.json(
+        {
+          error: "Restore has unresolved conflicts",
+          code: "RESTORE_CONFLICT",
+          summary,
+          plan
+        },
+        409
+      );
+    }
+    let applied = 0;
+    for (const p of [...plan.create, ...plan.update]) {
+      try {
+        repo.upsertProjectByPath(p.path, { name: p.name });
+        applied++;
+      } catch {
+      }
+    }
+    return c.json({ applied: true, summary, appliedCount: applied });
+  });
+  return app;
+};
+
+// src/api/routes/browse.routes.ts
+import { Hono as Hono3 } from "hono";
 var ALREADY_HANDLED = 597;
 var alreadyHandled = () => new Response(null, { status: ALREADY_HANDLED });
 var createBrowseRoutes = (deps) => {
-  const app = new Hono2();
+  const app = new Hono3();
   app.get("/browse", async (c) => {
     const url = new URL(c.req.url);
     await deps.handleBrowse(url, c.env.outgoing);
@@ -3624,7 +3834,7 @@ var createBrowseRoutes = (deps) => {
 };
 
 // src/api/routes/cacheAlert.routes.ts
-import { Hono as Hono3 } from "hono";
+import { Hono as Hono4 } from "hono";
 
 // src/schemas/cacheAlert.schema.ts
 import { z } from "zod";
@@ -3647,7 +3857,7 @@ function readRawBody2(req) {
   });
 }
 var createCacheAlertRoutes = (deps) => {
-  const app = new Hono3();
+  const app = new Hono4();
   app.get("/", (c) => {
     const monitor = deps.cacheMonitor();
     return c.json({ pending: monitor?.pending ?? null });
@@ -3684,7 +3894,7 @@ var createCacheAlertRoutes = (deps) => {
 };
 
 // src/api/routes/config.routes.ts
-import { Hono as Hono4 } from "hono";
+import { Hono as Hono5 } from "hono";
 
 // src/schemas/claudeFlags.schema.ts
 import { z as z2 } from "zod";
@@ -3705,7 +3915,7 @@ function readRawBody3(req) {
   });
 }
 var createConfigRoutes = (deps) => {
-  const app = new Hono4();
+  const app = new Hono5();
   app.get("/claude-flags", (c) => c.json(deps.claudeFlagsConfig()));
   app.get("/feature-flags", (c) => c.json(deps.featureFlagsConfig()));
   app.put("/claude-flags", async (c) => {
@@ -3740,11 +3950,11 @@ var createConfigRoutes = (deps) => {
 };
 
 // src/api/routes/conversations.routes.ts
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono6 } from "hono";
 var ALREADY_HANDLED2 = 597;
 var alreadyHandled2 = () => new Response(null, { status: ALREADY_HANDLED2 });
 var createConversationRoutes = (deps) => {
-  const app = new Hono5();
+  const app = new Hono6();
   app.get("/count", async (c) => {
     const url = new URL(c.req.url);
     await deps.handleConversationsCount(url, c.env.outgoing);
@@ -3771,9 +3981,9 @@ var createConversationRoutes = (deps) => {
 };
 
 // src/api/routes/devices.routes.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 var createDeviceRoutes = (deps) => {
-  const app = new Hono6();
+  const app = new Hono7();
   app.get("/", (c) => {
     const repo = deps.devicesRepo();
     if (!repo) return c.json({ devices: [], available: false });
@@ -3796,45 +4006,134 @@ var createDeviceRoutes = (deps) => {
   return app;
 };
 
-// src/api/routes/health.routes.ts
-import { Hono as Hono7 } from "hono";
+// src/api/routes/diagnostics.routes.ts
+import { existsSync as existsSync5 } from "fs";
+import { Hono as Hono8 } from "hono";
 
-// src/version.ts
-import { readFileSync as readFileSync4, realpathSync } from "fs";
-import { dirname as dirname5, join as join7 } from "path";
-var cached;
-function getVersion() {
-  if (cached !== void 0) return cached;
-  cached = resolveVersion();
-  return cached;
+// src/services/diagnostics/diagnostics.ts
+var DIAGNOSTICS_CONTRACT_VERSION = 1;
+function redactPath(path) {
+  if (!path) return null;
+  const parts = path.split(/[/\\]/).filter(Boolean);
+  if (parts.length <= 2) return parts.join("/");
+  return `\u2026/${parts.slice(-2).join("/")}`;
+}
+function worstStatus(checks) {
+  const rank = { ok: 0, unknown: 1, degraded: 2, failed: 3 };
+  return checks.reduce(
+    (worst, c) => rank[c.status] > rank[worst] ? c.status : worst,
+    "ok"
+  );
 }
-function resolveVersion() {
-  const scriptPath = process.argv[1] ?? "";
-  const here = scriptPath ? dirname5(scriptPath) : process.cwd();
-  let realHere = here;
-  try {
-    realHere = dirname5(realpathSync(scriptPath));
-  } catch {
+function buildReport(checks, now = /* @__PURE__ */ new Date()) {
+  return {
+    contractVersion: DIAGNOSTICS_CONTRACT_VERSION,
+    generatedAt: now.toISOString(),
+    overall: worstStatus(checks),
+    checks
+  };
+}
+var SECRET_KEY_RE = /(key|token|secret|password|passwd|credential|authorization|cookie)/i;
+function redactValue(value) {
+  if (Array.isArray(value)) {
+    return value.map((v) => redactValue(v));
   }
-  const searchDirs = realHere === here ? [here, join7(here, "..")] : [here, join7(here, ".."), realHere, join7(realHere, "..")];
-  for (const dir of searchDirs) {
-    try {
-      const v = readFileSync4(join7(dir, "version.txt"), "utf8").trim();
-      if (v) return v;
-    } catch {
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = SECRET_KEY_RE.test(k) ? "[redacted]" : redactValue(v);
     }
+    return out;
   }
+  return value;
+}
+
+// src/api/routes/diagnostics.routes.ts
+function providerCheck(name, resolve2) {
   try {
-    const pkg = JSON.parse(readFileSync4(join7(here, "..", "package.json"), "utf8"));
-    if (pkg.version) return `${pkg.version}+source`;
+    const exe = resolve2();
+    return {
+      id: `provider:${name}`,
+      status: "ok",
+      summary: `${name} CLI is installed.`,
+      remediation: "NONE",
+      detail: { location: redactPath(exe) }
+    };
   } catch {
+    return {
+      id: `provider:${name}`,
+      status: "failed",
+      summary: `${name} CLI could not be located. Sessions for this provider cannot start.`,
+      remediation: "PROVIDER_NOT_INSTALLED"
+    };
   }
-  return "0.0.0+unknown";
 }
+var createDiagnosticsRoutes = (deps) => {
+  const app = new Hono8();
+  app.get("/", (c) => {
+    const checks = [];
+    checks.push({
+      id: "streamer",
+      status: "ok",
+      summary: "Streamer is running.",
+      remediation: "NONE",
+      detail: { version: getVersion(), uptimeSeconds: Math.floor(process.uptime()) }
+    });
+    checks.push(providerCheck("claude-code", resolveClaudeExe));
+    checks.push(providerCheck("codex-cli", resolveCodexExe));
+    const cacheAlert = deps.cacheMonitor()?.healthzField();
+    checks.push(
+      cacheAlert ? {
+        id: "cache",
+        status: "degraded",
+        summary: "Conversation cache reported an integrity alert.",
+        remediation: "CACHE_DEGRADED"
+      } : {
+        id: "cache",
+        status: "ok",
+        summary: "Conversation cache is healthy.",
+        remediation: "NONE"
+      }
+    );
+    let ptyOk = true;
+    try {
+      __require.resolve("node-pty");
+    } catch {
+      ptyOk = false;
+    }
+    checks.push(
+      ptyOk ? { id: "pty", status: "ok", summary: "PTY subsystem is available.", remediation: "NONE" } : {
+        id: "pty",
+        status: "failed",
+        summary: "node-pty failed to load, so no managed session can start.",
+        remediation: "PTY_UNAVAILABLE"
+      }
+    );
+    const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+    const claudeProjects = home ? `${home}/.claude/projects` : "";
+    checks.push(
+      claudeProjects && existsSync5(claudeProjects) ? {
+        id: "filesystem",
+        status: "ok",
+        summary: "Provider history directory is present.",
+        remediation: "NONE",
+        detail: { location: redactPath(claudeProjects) }
+      } : {
+        id: "filesystem",
+        status: "degraded",
+        summary: "Provider history directory was not found; history may be unavailable.",
+        remediation: "FS_SCOPE_MISSING"
+      }
+    );
+    return c.json(redactValue(buildReport(checks)));
+  });
+  return app;
+};
 
 // src/api/routes/health.routes.ts
+import { Hono as Hono9 } from "hono";
 var createHealthRoutes = (deps) => {
-  const app = new Hono7();
+  const app = new Hono9();
   app.get("/", (c) => {
     const cacheAlert = deps.cacheMonitor()?.healthzField();
     return c.json({ ok: true, version: getVersion(), ...cacheAlert ? { cacheAlert } : {} });
@@ -3843,9 +4142,9 @@ var createHealthRoutes = (deps) => {
 };
 
 // src/api/routes/logs.routes.ts
-import { closeSync, existsSync as existsSync5, fstatSync, openSync, readSync, statSync } from "fs";
+import { closeSync, existsSync as existsSync6, fstatSync, openSync, readSync, statSync } from "fs";
 import { join as join9 } from "path";
-import { Hono as Hono8 } from "hono";
+import { Hono as Hono10 } from "hono";
 
 // src/lifecycle/constants.ts
 import { homedir as homedir4 } from "os";
@@ -3863,12 +4162,12 @@ function resolveLogPath(source) {
 function pickDefaultSource() {
   for (const source of ["stdout", "stderr", "dev"]) {
     const p = resolveLogPath(source);
-    if (existsSync5(p) && statSync(p).size > 0) return source;
+    if (existsSync6(p) && statSync(p).size > 0) return source;
   }
   return "stdout";
 }
 function readLogLines(filePath, sinceOffset, limit) {
-  if (!existsSync5(filePath)) {
+  if (!existsSync6(filePath)) {
     return { lines: [], offset: 0, total: 0 };
   }
   const fd = openSync(filePath, "r");
@@ -3903,7 +4202,7 @@ function readLogLines(filePath, sinceOffset, limit) {
   }
 }
 function createLogsRoutes() {
-  const app = new Hono8();
+  const app = new Hono10();
   app.get("/", (c) => {
     try {
       const sourceParam = (c.req.query("source") || "").toLowerCase();
@@ -3911,7 +4210,7 @@ function createLogsRoutes() {
       const logPath = resolveLogPath(source);
       const sinceOffset = parseInt(c.req.query("since") || "0", 10);
       const limit = Math.min(parseInt(c.req.query("limit") || "100", 10) || 100, 1e3);
-      if (!existsSync5(logPath)) {
+      if (!existsSync6(logPath)) {
         return c.json({
           logs: [],
           message: `No log file found for source=${source}`,
@@ -3948,7 +4247,7 @@ function createLogsRoutes() {
     try {
       const sources = ["stdout", "stderr", "dev"].map((source) => {
         const logPath = resolveLogPath(source);
-        if (!existsSync5(logPath)) {
+        if (!existsSync6(logPath)) {
           return { source, exists: false, total: 0, fileSize: 0 };
         }
         const stats = statSync(logPath);
@@ -3974,8 +4273,8 @@ function createLogsRoutes() {
 // src/api/routes/misc.routes.ts
 import { spawn } from "child_process";
 import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
-import { Hono as Hono9 } from "hono";
-import { hostname } from "os";
+import { Hono as Hono11 } from "hono";
+import { hostname as hostname2 } from "os";
 
 // src/config/update-config.ts
 import { readFileSync as readFileSync5 } from "fs";
@@ -4305,12 +4604,12 @@ function verifyWebhookSignature(body, header, secret) {
 }
 var clientLog = getLogger("client");
 var createMiscRoutes = (deps) => {
-  const app = new Hono9();
+  const app = new Hono11();
   app.get("/api/info", (c) => {
     const ptyIds = deps.ptyAttachedIds();
     return c.json({
       version: getVersion(),
-      machineName: hostname(),
+      machineName: hostname2(),
       platform: process.platform,
       activeSessions: deps.sessionStore.list(ptyIds).filter((s) => s.status === "running").length,
       publicUrl: deps.publicUrl,
@@ -4436,11 +4735,11 @@ var createMiscRoutes = (deps) => {
 };
 
 // src/api/routes/pair.routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono12 } from "hono";
 var ALREADY_HANDLED3 = 597;
 var alreadyHandled3 = () => new Response(null, { status: ALREADY_HANDLED3 });
 var createPairRoutes = (deps) => {
-  const app = new Hono10();
+  const app = new Hono12();
   app.post("/start", (c) => {
     deps.handlePairStart(c.env.outgoing);
     return alreadyHandled3();
@@ -4453,11 +4752,11 @@ var createPairRoutes = (deps) => {
 };
 
 // src/api/routes/projects.routes.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono13 } from "hono";
 var ALREADY_HANDLED4 = 597;
 var alreadyHandled4 = () => new Response(null, { status: ALREADY_HANDLED4 });
 var createProjectRoutes = (deps) => {
-  const app = new Hono11();
+  const app = new Hono13();
   app.get("/", (c) => {
     const url = new URL(c.req.url);
     deps.handleListProjects(url, c.env.outgoing);
@@ -4472,7 +4771,7 @@ var createProjectRoutes = (deps) => {
 };
 
 // src/api/routes/providers.routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono14 } from "hono";
 
 // src/services/providers/providerHealth.ts
 import { execFile as execFile2 } from "child_process";
@@ -4595,7 +4894,7 @@ async function providerHealth(name, resolveExe, detect = runVersion) {
 
 // src/api/routes/providers.routes.ts
 var createProviderRoutes = () => {
-  const app = new Hono12();
+  const app = new Hono14();
   app.get("/", async (c) => {
     const providers = await Promise.all([
       providerHealth(CLAUDE_CODE_PROVIDER, resolveClaudeExe),
@@ -4607,11 +4906,11 @@ var createProviderRoutes = () => {
 };
 
 // src/api/routes/scanner.routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono15 } from "hono";
 var ALREADY_HANDLED5 = 597;
 var alreadyHandled5 = () => new Response(null, { status: ALREADY_HANDLED5 });
 var createScannerRoutes = (deps) => {
-  const app = new Hono13();
+  const app = new Hono15();
   app.get("/api/search", async (c) => {
     const url = new URL(c.req.url);
     await deps.handleSearch(url, c.env.outgoing);
@@ -4621,11 +4920,11 @@ var createScannerRoutes = (deps) => {
 };
 
 // src/api/routes/sessions.routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono16 } from "hono";
 var ALREADY_HANDLED6 = 597;
 var alreadyHandled6 = () => new Response(null, { status: ALREADY_HANDLED6 });
 var createSessionRoutes = (deps) => {
-  const app = new Hono14();
+  const app = new Hono16();
   app.get("/count", (c) => {
     deps.handleSessionsCount(c.env.outgoing);
     return alreadyHandled6();
@@ -4700,9 +4999,9 @@ var createSessionRoutes = (deps) => {
 };
 
 // src/api/routes/ws.routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono17 } from "hono";
 var createWsRoutes = (deps, upgradeWebSocket) => {
-  const app = new Hono15();
+  const app = new Hono17();
   app.get(
     "/ws",
     upgradeWebSocket(() => {
@@ -4728,7 +5027,7 @@ var createWsRoutes = (deps, upgradeWebSocket) => {
 
 // src/api/app.ts
 var createHonoApp = (deps, upgradeWebSocket) => {
-  const app = new Hono16();
+  const app = new Hono18();
   const httpLog = getLogger("http");
   app.use("*", async (c, next) => {
     const start = Date.now();
@@ -4749,6 +5048,7 @@ var createHonoApp = (deps, upgradeWebSocket) => {
   app.use("*", authMiddleware(deps));
   app.onError(errorMiddleware);
   app.route("/healthz", createHealthRoutes(deps));
+  app.route("/api/diagnostics", createDiagnosticsRoutes(deps));
   app.route("/", createMiscRoutes(deps));
   app.route("/api/sessions", createSessionRoutes(deps));
   app.route("/api/conversations", createConversationRoutes(deps));
@@ -4757,6 +5057,7 @@ var createHonoApp = (deps, upgradeWebSocket) => {
   app.route("/api/projects", createProjectRoutes(deps));
   app.route("/api/providers", createProviderRoutes());
   app.route("/api/devices", createDeviceRoutes(deps));
+  app.route("/api/backup", createBackupRoutes(deps));
   app.route("/api/pair", createPairRoutes(deps));
   app.route("/api", createBrowseRoutes(deps));
   app.route("/", createScannerRoutes(deps));
@@ -4825,7 +5126,7 @@ import {
   parseJsonlLine
 } from "@threadbase-sh/scanner";
 import Database from "better-sqlite3";
-import { closeSync as closeSync3, existsSync as existsSync6, mkdirSync as mkdirSync3, openSync as openSync3, readSync as readSync3, statSync as statSync3 } from "fs";
+import { closeSync as closeSync3, existsSync as existsSync7, mkdirSync as mkdirSync3, openSync as openSync3, readSync as readSync3, statSync as statSync3 } from "fs";
 import { open as openAsync } from "fs/promises";
 import { dirname as dirname7 } from "path";
 import { setImmediate as yieldToEventLoop } from "timers/promises";
@@ -6057,7 +6358,7 @@ var ConversationCache = class _ConversationCache {
    * `handleGetConversation` can still serve the cached tail even when the
    * JSONL has been deleted.
    */
-  pruneGhostFiles(exists = existsSync6) {
+  pruneGhostFiles(exists = existsSync7) {
     const rows = this.stmts.allFilePaths.all();
     const ghosts = [];
     const prune = this.db.transaction((ids) => {
@@ -6112,7 +6413,7 @@ var ConversationCache = class _ConversationCache {
    * Returns the removed IDs.
    */
   reconcileDeletions(livePaths, opts) {
-    const exists = opts?.exists ?? existsSync6;
+    const exists = opts?.exists ?? existsSync7;
     const rows = this.stmts.allFilePaths.all();
     const removed = [];
     const drop = this.db.transaction((ids) => {
@@ -6147,7 +6448,7 @@ var ConversationCache = class _ConversationCache {
    * reports drift for the CacheIntegrityMonitor to classify. `tailed` flags
    * rows that still have cached history (which pruneGhostFiles would keep).
    */
-  listMissingFiles(exists = existsSync6) {
+  listMissingFiles(exists = existsSync7) {
     const rows = this.stmts.allFilePathsWithTitle.all();
     const missing = [];
     for (const row of rows) {
@@ -6648,7 +6949,7 @@ function setCacheMetadata(repo, key, value) {
 
 // src/services/cache-integrity/cacheIntegrityMonitor.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 
 // src/services/cache-integrity/alertStore.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
@@ -6674,7 +6975,7 @@ function saveAlertState(state) {
 }
 
 // src/services/cache-integrity/backup.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync4, statSync as statSync5, unlinkSync } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync4, statSync as statSync5, unlinkSync } from "fs";
 import { join as join15 } from "path";
 var DEFAULT_RETAIN = 3;
 function retainCount() {
@@ -6696,7 +6997,7 @@ async function backupCacheDb(db, cacheDir) {
     return { full, mtime: statSync5(full).mtimeMs };
   }).sort((a, b) => b.mtime - a.mtime);
   for (const stale of backups.slice(retain)) {
-    if (existsSync7(stale.full)) unlinkSync(stale.full);
+    if (existsSync8(stale.full)) unlinkSync(stale.full);
   }
   return destPath;
 }
@@ -6793,7 +7094,7 @@ var CacheIntegrityMonitor = class {
    * the pending record, back up on high severity, and broadcast the alert.
    */
   async runDetection(detectedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-    const all = this.cache.listMissingFiles(existsSync8);
+    const all = this.cache.listMissingFiles(existsSync9);
     const missing = all.filter((m) => !this.ignoredIds.has(m.id));
     if (missing.length === 0) {
       if (this._pending) {
@@ -6897,7 +7198,7 @@ var CacheIntegrityMonitor = class {
       case "prune_all": {
         await this.ensureBackup(pending);
         const backupPath = pending.backupPath;
-        const stillMissing = pending.missing.filter((m) => !existsSync8(m.filePath)).map((m) => m.id);
+        const stillMissing = pending.missing.filter((m) => !existsSync9(m.filePath)).map((m) => m.id);
         const pruned = this.cache.dropRowsById(stillMissing);
         this.applyDeferredUnlinks();
         this.clearPending();
@@ -7167,14 +7468,14 @@ function findSearchTarget(messages, query) {
 }
 
 // src/services/conversations/pruneAgentConversations.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 function pruneAgentConversations(cache) {
   const db = cache.getDatabase();
   const rows = db.prepare("SELECT id, file_path FROM conversation_meta").all();
   let pruned = 0;
   let missing = 0;
   for (const row of rows) {
-    if (!existsSync9(row.file_path)) {
+    if (!existsSync10(row.file_path)) {
       missing += 1;
       continue;
     }
@@ -8051,6 +8352,88 @@ function resolveAnswer(pending, body) {
   }
 }
 
+// src/services/search/searchQuery.ts
+var DEFAULT_SEARCH_LIMIT = 50;
+var MAX_SEARCH_LIMIT = 200;
+var MAX_QUERY_LENGTH = 256;
+var SearchQueryError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function intOr(raw, fallback) {
+  if (raw === null) return fallback;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) ? n : fallback;
+}
+function parseSearchQuery(params) {
+  const q = (params.get("q") ?? "").trim();
+  if (!q) {
+    throw new SearchQueryError("Missing query parameter: q", "invalid_query");
+  }
+  if (q.length > MAX_QUERY_LENGTH) {
+    throw new SearchQueryError(`Query exceeds ${MAX_QUERY_LENGTH} characters`, "query_too_long");
+  }
+  const limit = Math.min(
+    Math.max(intOr(params.get("limit"), DEFAULT_SEARCH_LIMIT), 1),
+    MAX_SEARCH_LIMIT
+  );
+  const offset = Math.max(intOr(params.get("offset"), 0), 0);
+  const filters = {};
+  const provider = params.get("provider");
+  if (provider !== null) {
+    if (!isProviderName(provider)) {
+      throw new SearchQueryError(`Unknown provider: ${provider}`, "invalid_filter");
+    }
+    filters.provider = provider;
+  }
+  const projectPath = params.get("projectPath");
+  if (projectPath) filters.projectPath = projectPath;
+  const branch = params.get("branch");
+  if (branch) filters.branch = branch;
+  for (const [key, field] of [
+    ["since", "since"],
+    ["until", "until"]
+  ]) {
+    const raw = params.get(key);
+    if (raw === null) continue;
+    const ms = Date.parse(raw);
+    if (Number.isNaN(ms)) {
+      throw new SearchQueryError(`Invalid ${key}: expected an ISO 8601 date`, "invalid_filter");
+    }
+    filters[field] = ms;
+  }
+  if (filters.since != null && filters.until != null && filters.since > filters.until) {
+    throw new SearchQueryError("`since` must not be after `until`", "invalid_filter");
+  }
+  return { q, limit, offset, filters };
+}
+function applyFilters(results, filters) {
+  return results.filter((r) => {
+    if (filters.provider && r.provider !== filters.provider) return false;
+    if (filters.projectPath && r.projectPath !== filters.projectPath) return false;
+    if (filters.branch && r.branch !== filters.branch) return false;
+    if (filters.since != null || filters.until != null) {
+      const ts = r.lastActivity == null ? Number.NaN : new Date(r.lastActivity).getTime();
+      if (Number.isNaN(ts)) return false;
+      if (filters.since != null && ts < filters.since) return false;
+      if (filters.until != null && ts > filters.until) return false;
+    }
+    return true;
+  });
+}
+function paginate(results, offset, limit) {
+  const items = results.slice(offset, offset + limit);
+  return {
+    items,
+    total: results.length,
+    offset,
+    hasMore: offset + items.length < results.length
+  };
+}
+
 // src/services/sessions/conversationBusy.ts
 import { statSync as statSync8 } from "fs";
 var RESUME_BUSY_WINDOW_MS = 12e4;
@@ -8753,6 +9136,8 @@ var DEFAULT_PTY_GRACE_PERIOD_MS = 27e4;
 var GRACE_MAX_DEFERS = 4;
 var IDLE_REAP_AFTER_MS = 6 * 60 * 60 * 1e3;
 var IDLE_REAP_SWEEP_MS = 5 * 60 * 1e3;
+var SEARCH_OVERFETCH = 4;
+var SEARCH_MAX_SCAN = 1e3;
 var RESUME_DISCOVERY_TIMEOUT_MS = 750;
 var DISCOVERY_TTL_MS = 15e3;
 var ADOPT_KILL_TIMEOUT_MS = 5e3;
@@ -9521,14 +9906,14 @@ var StreamerServer = class {
     }
     this.apnsClient = new ApnsClient(creds);
     const sender = new LiveActivitySender(this.apnsClient, pushRepo);
-    const serverId = process.env.THREADBASE_INSTANCE_ID ?? hostname2();
-    this.liveActivityNotifier = new LiveActivityNotifier(sender, serverId, hostname2());
+    const serverId = process.env.THREADBASE_INSTANCE_ID ?? hostname3();
+    this.liveActivityNotifier = new LiveActivityNotifier(sender, serverId, hostname3());
     this.liveActivityRenewal = new LiveActivityRenewalScheduler({
       repo: pushRepo,
       sender,
       sessionStore: this.sessionStore,
       serverId,
-      serverLabel: hostname2()
+      serverLabel: hostname3()
     });
     this.liveActivityRenewal.start();
     this.log.info("Live Activity push enabled", {
@@ -9867,7 +10252,7 @@ var StreamerServer = class {
             this.fileWatcher.watchDirectory(dir);
           }
           for (const dir of this.codexRoots) {
-            if (!existsSync10(dir)) continue;
+            if (!existsSync11(dir)) continue;
             this.fileWatcher.watchDirectory(dir);
           }
         } catch (err) {
@@ -10140,7 +10525,7 @@ var StreamerServer = class {
     }
     let body;
     try {
-      body = await readBody(req);
+      body = await readBody2(req);
     } catch (err) {
       const message = err instanceof Error ? err.message : "Invalid body";
       json(res, 400, { error: message });
@@ -10186,7 +10571,7 @@ var StreamerServer = class {
       nonce: sealed.nonce,
       ephemeralPublicKey: sealed.ephemeralPublicKey,
       publicUrl: this.publicUrl,
-      machineName: hostname2(),
+      machineName: hostname3(),
       ...device && {
         deviceId: device.deviceId,
         deviceToken: device.deviceToken,
@@ -10721,15 +11106,15 @@ var StreamerServer = class {
   findJsonlPath(uuid) {
     const filename = `${uuid}.jsonl`;
     for (const projectsDir of this.projectsDirs()) {
-      if (!existsSync10(projectsDir)) continue;
+      if (!existsSync11(projectsDir)) continue;
       for (const dir of readdirSync6(projectsDir)) {
         const fp = join18(projectsDir, dir, filename);
-        if (existsSync10(fp)) return fp;
+        if (existsSync11(fp)) return fp;
         const projectDir = join18(projectsDir, dir);
         try {
           for (const sub of readdirSync6(projectDir)) {
             const subagentPath = join18(projectDir, sub, "subagents", filename);
-            if (existsSync10(subagentPath)) return subagentPath;
+            if (existsSync11(subagentPath)) return subagentPath;
           }
         } catch {
         }
@@ -11266,7 +11651,7 @@ var StreamerServer = class {
     }
     let body;
     try {
-      body = await readBody(req);
+      body = await readBody2(req);
     } catch {
       res.setHeader("Accept-Query", "application/json");
       json(res, 422, { error: "Malformed JSON body", code: "invalid_query" });
@@ -11304,17 +11689,27 @@ var StreamerServer = class {
     });
   }
   async handleSearch(url, res) {
-    const q = url.searchParams.get("q") ?? "";
-    if (!q) {
-      json(res, 400, { error: "Missing query parameter: q" });
-      return;
+    let parsed;
+    try {
+      parsed = parseSearchQuery(url.searchParams);
+    } catch (err) {
+      if (err instanceof SearchQueryError) {
+        json(res, 400, { error: err.message, code: err.code });
+        return;
+      }
+      throw err;
     }
-    const limit = intParam(url, "limit", 50);
+    const { q, limit, offset, filters } = parsed;
+    const startedAt = Date.now();
     const scanner = await this.getScanner();
     const results = await search(
       q,
       {
-        limit,
+        // Fetch beyond the requested page: filters below are applied AFTER the
+        // scanner returns, so slicing at `limit` here would drop results that a
+        // later page should contain. Bounded so a broad query cannot pull an
+        // unbounded set into memory.
+        limit: Math.min(offset + limit * SEARCH_OVERFETCH, SEARCH_MAX_SCAN),
         include: "conversations",
         ...this.scanProfiles ? { profiles: this.scanProfiles } : {},
         ...this.codexScanOpts()
@@ -11338,13 +11733,24 @@ var StreamerServer = class {
       lastActivity: r.meta.timestamp,
       firstMessage: r.meta.firstMessage ?? void 0,
       lastMessage: r.meta.lastMessage ?? void 0,
-      provider: r.meta.provider ?? CLAUDE_CODE_PROVIDER
+      provider: r.meta.provider ?? CLAUDE_CODE_PROVIDER,
+      // The scanner already computes relevance and match snippets; the previous
+      // adapter discarded both, so results arrived in an unexplained order with
+      // no indication of WHY anything matched.
+      score: r.score,
+      matches: Array.isArray(r.matches) ? r.matches.map((m) => ({
+        field: m.field,
+        snippet: m.snippet
+      })) : []
     }));
+    const page = paginate(applyFilters(adapted, filters), offset, limit);
     json(res, 200, {
-      conversations: adapted,
-      hasMore: false,
-      offset: 0,
-      total: adapted.length
+      conversations: page.items,
+      hasMore: page.hasMore,
+      offset: page.offset,
+      total: page.total,
+      // Query timing, so a slow search is diagnosable rather than merely felt.
+      tookMs: Date.now() - startedAt
     });
   }
   async handleListSessions(url, res) {
@@ -11390,7 +11796,7 @@ var StreamerServer = class {
     if (this.rejectIfWarmingUp(res)) return;
     const session = this.sessionStore.get(sessionId, this.ptyAttachedIds());
     if (session) {
-      if (!existsSync10(session.projectPath)) {
+      if (!existsSync11(session.projectPath)) {
         session.failureReason = `Project directory not found: ${session.projectPath}`;
       }
       const reconciled = this.withReconciledLifecycle([session])[0];
@@ -11417,7 +11823,7 @@ var StreamerServer = class {
     json(res, 404, { error: "Session not found" });
   }
   async handleResume(req, res) {
-    const body = await readBody(req);
+    const body = await readBody2(req);
     const sessionId = body.sessionId ?? body.conversationId;
     if (!sessionId) {
       json(res, 400, { error: "Missing sessionId" });
@@ -11549,7 +11955,7 @@ var StreamerServer = class {
       return;
     }
     if (this.agentConfig.enabled) {
-      const body2 = await readBody(req);
+      const body2 = await readBody2(req);
       const cache = this.cache;
       if (!cache) {
         json(res, 503, {
@@ -11568,7 +11974,7 @@ var StreamerServer = class {
       json(res, result.status, result.body);
       return;
     }
-    const body = await readBody(req);
+    const body = await readBody2(req);
     const { input, keys } = body;
     let idempotencyKey;
     try {
@@ -11732,7 +12138,7 @@ var StreamerServer = class {
     });
   }
   async handleSendAnswer(sessionId, req, res) {
-    const body = await readBody(req);
+    const body = await readBody2(req);
     const pending = this.pendingQuestions.get(sessionId);
     const resolution = resolveAnswer(pending, body);
     if (!resolution.ok) {
@@ -11761,7 +12167,7 @@ var StreamerServer = class {
       json(res, 400, { error: "Session has no project path" });
       return;
     }
-    const body = await readBody(req);
+    const body = await readBody2(req);
     const { filename, mimeType, dataBase64 } = body ?? {};
     if (typeof filename !== "string" || typeof mimeType !== "string" || typeof dataBase64 !== "string") {
       json(res, 400, { error: "Missing filename, mimeType, or dataBase64" });
@@ -11963,7 +12369,7 @@ var StreamerServer = class {
       return;
     }
     if (this.agentConfig.enabled) {
-      const body2 = await readBody(req);
+      const body2 = await readBody2(req);
       const result = await handleStartAgentSession(body2, {
         sessionStore: this.sessionStore,
         // biome-ignore lint/style/noNonNullAssertion: agentClient is set when agentConfig.enabled is true
@@ -11977,7 +12383,7 @@ var StreamerServer = class {
       }
       return;
     }
-    const body = await readBody(req);
+    const body = await readBody2(req);
     const { path: relativePath, provider: requestedProvider, systemPrompt: clientPrompt } = body;
     if (requestedProvider !== void 0 && !isProviderName(requestedProvider)) {
       json(res, 400, { error: "Invalid provider" });
@@ -12149,8 +12555,8 @@ var StreamerServer = class {
         cleanup();
         return;
       }
-      let resolvedFilePath = existsSync10(filePath) ? filePath : null;
-      if (!resolvedFilePath && existsSync10(projectsDir)) {
+      let resolvedFilePath = existsSync11(filePath) ? filePath : null;
+      if (!resolvedFilePath && existsSync11(projectsDir)) {
         try {
           const now = Date.now();
           const match = readdirSync6(projectsDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, mtime: statSync9(join18(projectsDir, f)).mtimeMs })).filter(({ mtime }) => now - mtime < 5e3).filter(
@@ -12246,7 +12652,7 @@ var StreamerServer = class {
       );
       for (const root of this.codexRoots) {
         const sessionsDir = join18(root, dateDir);
-        if (!existsSync10(sessionsDir)) continue;
+        if (!existsSync11(sessionsDir)) continue;
         let candidateFiles;
         try {
           candidateFiles = readdirSync6(sessionsDir).filter((f) => f.endsWith(".jsonl"));
@@ -12335,7 +12741,7 @@ var StreamerServer = class {
       });
       return;
     }
-    const body = await readBody(req);
+    const body = await readBody2(req);
     const { path: relativePath, name } = body;
     if (!name || typeof name !== "string") {
       json(res, 400, { error: "Missing name field" });
@@ -12365,7 +12771,7 @@ var StreamerServer = class {
     }
     let parsed;
     try {
-      parsed = await readBody(req);
+      parsed = await readBody2(req);
     } catch {
       json(res, 400, { error: "Invalid JSON" });
       return;
@@ -12422,7 +12828,7 @@ var StreamerServer = class {
     }
     let parsed;
     try {
-      parsed = await readBody(req);
+      parsed = await readBody2(req);
     } catch {
       json(res, 400, { error: "Invalid JSON" });
       return;
@@ -12481,7 +12887,7 @@ async function waitForProcessExit(pid, timeoutMs, pollMs = ADOPT_KILL_POLL_MS) {
 }
 function classifyResumability(cwd) {
   if (!cwd) return { resumable: true };
-  if (existsSync10(cwd)) return { resumable: true };
+  if (existsSync11(cwd)) return { resumable: true };
   const ranInWorktree = /\/\.worktrees\//.test(cwd) || /\/\.claude\/worktrees\//.test(cwd);
   return {
     resumable: false,
@@ -12599,7 +13005,7 @@ function parseSessionListQuery(url) {
   const cursor = url.searchParams.get("cursor") ?? void 0;
   return { query: { limit, sortBy, order, status, cursor } };
 }
-function readBody(req) {
+function readBody2(req) {
   return new Promise((resolve2, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(chunk));