@threadbase-sh/streamer 1.60.0 → 1.61.1

package/dist/cli.cjs

@@ -31270,7 +31270,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash8 } = require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash9 } = require("crypto");
     var { Duplex, Readable: Readable2 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -31938,7 +31938,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -32307,7 +32307,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter5 = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash8 } = require("crypto");
+    var { createHash: createHash9 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -32614,7 +32614,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -97360,6 +97360,81 @@ var init_platform = __esm({
   }
 });
 
+// src/server-identity.ts
+function serverIdentityKeyPath() {
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path3.join)((0, import_os5.homedir)(), ".threadbase");
+  return (0, import_path3.join)(dir, "keys", "server-identity.key");
+}
+function loadOrCreateServerIdentity() {
+  const path2 = serverIdentityKeyPath();
+  let raw2;
+  try {
+    raw2 = (0, import_fs4.readFileSync)(path2, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    return generateIdentity(path2);
+  }
+  let privateKey;
+  try {
+    privateKey = (0, import_crypto4.createPrivateKey)({ key: JSON.parse(raw2).key, format: "jwk" });
+  } catch {
+    throw new Error(
+      `Server identity key at ${path2} could not be read. Refusing to generate a new one \u2014 that would invalidate every paired device. Repair or delete the file deliberately.`
+    );
+  }
+  return { publicKey: publicKeyOf(privateKey), privateKey };
+}
+function serverIdentityPublicKey() {
+  return loadOrCreateServerIdentity().publicKey;
+}
+function serverIdentityFingerprint(publicKeyBase64url) {
+  const raw2 = Buffer.from(publicKeyBase64url, "base64url");
+  const hex3 = (0, import_crypto4.createHash)("sha256").update(raw2).digest().subarray(0, 16).toString("hex");
+  return hex3.match(/.{4}/g)?.join(" ") ?? hex3;
+}
+function currentServerIdentityFingerprint() {
+  return serverIdentityFingerprint(serverIdentityPublicKey());
+}
+function generateIdentity(path2) {
+  const { privateKey } = (0, import_crypto4.generateKeyPairSync)("x25519");
+  const file2 = {
+    v: IDENTITY_FILE_VERSION,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    key: privateKey.export({ format: "jwk" })
+  };
+  (0, import_fs4.mkdirSync)((0, import_path3.dirname)(path2), { recursive: true, mode: 448 });
+  const tmp = `${path2}.tmp`;
+  (0, import_fs4.writeFileSync)(tmp, `${JSON.stringify(file2)}
+`, { encoding: "utf-8", mode: 384 });
+  (0, import_fs4.chmodSync)(tmp, 384);
+  (0, import_fs4.renameSync)(tmp, path2);
+  const publicKey = publicKeyOf(privateKey);
+  getLogger("identity").info(`Generated server identity key ${publicKey}`, {
+    event: "identity.key_generated",
+    path: path2
+  });
+  return { publicKey, privateKey };
+}
+function publicKeyOf(privateKey) {
+  const jwk = (0, import_crypto4.createPublicKey)(privateKey).export({ format: "jwk" });
+  if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
+    throw new Error(`Server identity key at ${serverIdentityKeyPath()} is not an X25519 key`);
+  }
+  return jwk.x;
+}
+var import_crypto4, import_fs4, import_os5, import_path3, IDENTITY_FILE_VERSION;
+var init_server_identity = __esm({
+  "src/server-identity.ts"() {
+    "use strict";
+    import_crypto4 = require("crypto");
+    import_fs4 = require("fs");
+    import_os5 = require("os");
+    import_path3 = require("path");
+    init_logger();
+    IDENTITY_FILE_VERSION = 1;
+  }
+});
+
 // node_modules/fast-glob/out/utils/array.js
 var require_array = __commonJS({
   "node_modules/fast-glob/out/utils/array.js"(exports2) {
@@ -128273,6 +128348,43 @@ var init_repo = __esm({
   }
 });
 
+// cli/identity.ts
+var identity_exports = {};
+__export(identity_exports, {
+  formatIdentityBanner: () => formatIdentityBanner,
+  runIdentity: () => runIdentity
+});
+function runIdentity(deps) {
+  const keyPath = (deps.keyPath ?? serverIdentityKeyPath)();
+  const fingerprint2 = deps.fingerprint ?? currentServerIdentityFingerprint;
+  let value;
+  try {
+    value = fingerprint2();
+  } catch (err) {
+    deps.log.error(
+      `Could not read the server identity key: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return 1;
+  }
+  deps.log.info(formatIdentityBanner(value, keyPath));
+  return 0;
+}
+function formatIdentityBanner(fingerprint2, keyPath) {
+  return [
+    `Server identity  (X25519, ${keyPath})`,
+    "",
+    `  ${fingerprint2}`,
+    "",
+    "Compare this with the fingerprint your phone shows when you add this server."
+  ].join("\n");
+}
+var init_identity = __esm({
+  "cli/identity.ts"() {
+    "use strict";
+    init_server_identity();
+  }
+});
+
 // cli/setKey.ts
 var setKey_exports = {};
 __export(setKey_exports, {
@@ -135627,67 +135739,7 @@ var PushRepository = class {
 
 // src/api/routes/misc.routes.ts
 init_logger();
-
-// src/server-identity.ts
-var import_crypto4 = require("crypto");
-var import_fs4 = require("fs");
-var import_os5 = require("os");
-var import_path3 = require("path");
-init_logger();
-var IDENTITY_FILE_VERSION = 1;
-function serverIdentityKeyPath() {
-  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path3.join)((0, import_os5.homedir)(), ".threadbase");
-  return (0, import_path3.join)(dir, "keys", "server-identity.key");
-}
-function loadOrCreateServerIdentity() {
-  const path2 = serverIdentityKeyPath();
-  let raw2;
-  try {
-    raw2 = (0, import_fs4.readFileSync)(path2, "utf-8");
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-    return generateIdentity(path2);
-  }
-  let privateKey;
-  try {
-    privateKey = (0, import_crypto4.createPrivateKey)({ key: JSON.parse(raw2).key, format: "jwk" });
-  } catch {
-    throw new Error(
-      `Server identity key at ${path2} could not be read. Refusing to generate a new one \u2014 that would invalidate every paired device. Repair or delete the file deliberately.`
-    );
-  }
-  return { publicKey: publicKeyOf(privateKey), privateKey };
-}
-function serverIdentityPublicKey() {
-  return loadOrCreateServerIdentity().publicKey;
-}
-function generateIdentity(path2) {
-  const { privateKey } = (0, import_crypto4.generateKeyPairSync)("x25519");
-  const file2 = {
-    v: IDENTITY_FILE_VERSION,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    key: privateKey.export({ format: "jwk" })
-  };
-  (0, import_fs4.mkdirSync)((0, import_path3.dirname)(path2), { recursive: true, mode: 448 });
-  const tmp = `${path2}.tmp`;
-  (0, import_fs4.writeFileSync)(tmp, `${JSON.stringify(file2)}
-`, { encoding: "utf-8", mode: 384 });
-  (0, import_fs4.chmodSync)(tmp, 384);
-  (0, import_fs4.renameSync)(tmp, path2);
-  const publicKey = publicKeyOf(privateKey);
-  getLogger("identity").info(`Generated server identity key ${publicKey}`, {
-    event: "identity.key_generated",
-    path: path2
-  });
-  return { publicKey, privateKey };
-}
-function publicKeyOf(privateKey) {
-  const jwk = (0, import_crypto4.createPublicKey)(privateKey).export({ format: "jwk" });
-  if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
-    throw new Error(`Server identity key at ${serverIdentityKeyPath()} is not an X25519 key`);
-  }
-  return jwk.x;
-}
+init_server_identity();
 
 // src/services/push/apnsClient.ts
 var import_node_crypto = require("crypto");
@@ -140776,18 +140828,43 @@ function readGitBranch(projectPath) {
   log15.trace({ projectPath }, "git: no .git found within depth");
   return null;
 }
+var FTS_HIT_OPEN = "";
+var FTS_HIT_CLOSE = "";
+var FTS_SNIPPET_TOKENS = 16;
+var FTS_ELLIPSIS = "\u2026";
+var CONTENT_FIELD = "content";
+function parseFtsSnippet(raw2) {
+  if (!raw2?.includes(FTS_HIT_OPEN)) return null;
+  const highlights = [];
+  let snippet = "";
+  let openAt = -1;
+  for (const ch of raw2) {
+    if (ch === FTS_HIT_OPEN) {
+      openAt = snippet.length;
+      continue;
+    }
+    if (ch === FTS_HIT_CLOSE) {
+      if (openAt >= 0 && snippet.length > openAt) {
+        highlights.push({ start: openAt, end: snippet.length });
+      }
+      openAt = -1;
+      continue;
+    }
+    snippet += ch;
+  }
+  return highlights.length > 0 ? { snippet, highlights } : null;
+}
 function generateMatches(meta3, query) {
   const matches = [];
   const lowerQuery = query.toLowerCase();
   const fields = [
-    ["contentSnippet", meta3.contentSnippet],
-    ["projectName", meta3.projectName],
-    ["sessionId", meta3.sessionId],
     ["sessionName", meta3.sessionName],
-    ["account", meta3.account],
-    ["model", meta3.model || ""],
+    ["projectName", meta3.projectName],
     ["gitBranch", meta3.gitBranch || ""],
-    ["toolNames", meta3.toolNames.join(" ")]
+    ["toolNames", meta3.toolNames.join(" ")],
+    ["model", meta3.model || ""],
+    ["account", meta3.account],
+    ["sessionId", meta3.sessionId]
   ];
   for (const [field, value] of fields) {
     const idx = value.toLowerCase().indexOf(lowerQuery);
@@ -140802,11 +140879,29 @@ function generateMatches(meta3, query) {
   }
   return matches.length > 0 ? matches : [{ field: "preview", snippet: meta3.preview }];
 }
+function buildContentMatch(searchContent, query) {
+  if (!searchContent || !query.trim()) return null;
+  const idx = searchContent.toLowerCase().indexOf(query.toLowerCase());
+  if (idx === -1) return null;
+  const start = Math.max(0, idx - 80);
+  const end = Math.min(searchContent.length, idx + query.length + 120);
+  const body = searchContent.slice(start, end).replace(/\s+/g, " ").trim();
+  const hitAt = body.toLowerCase().indexOf(query.toLowerCase());
+  const prefix = start > 0 ? FTS_ELLIPSIS : "";
+  const suffix = end < searchContent.length ? FTS_ELLIPSIS : "";
+  const snippet = `${prefix}${body}${suffix}`;
+  const highlights = hitAt === -1 ? [] : [{ start: hitAt + prefix.length, end: hitAt + prefix.length + query.length }];
+  return { field: CONTENT_FIELD, snippet, highlights };
+}
 var FlexSearch = flexsearch_bundle_module_min_default.default ?? flexsearch_bundle_module_min_default;
 var SearchIndexer = class {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   index;
   documents = /* @__PURE__ */ new Map();
+  // The indexed body per conversation, kept so a hit can produce a real excerpt
+  // instead of falling back to an unrelated preview. Sized by the caller (the
+  // scanner tail-caps it to the content tier) — see the note on addDocument.
+  searchContents = /* @__PURE__ */ new Map();
   constructor() {
     this.index = this.createIndex();
   }
@@ -140832,25 +140927,25 @@ var SearchIndexer = class {
       cache: 100
     });
   }
-  addDocument(meta3) {
+  // `searchContent` is the combined search document (text + thinking + tools),
+  // NOT meta.contentSnippet.
+  //
+  // It arrives pre-capped. This index is `tokenize: "forward"` at resolution 9,
+  // which stores every prefix of every token, so it is a resident-memory
+  // structure whose cost is very different from the on-disk FTS index. Feeding
+  // it the full ~128 KB budget across a few hundred conversations would be a
+  // multi-hundred-MB-to-GB index. The scanner therefore caps this to the active
+  // tier's snippetMax and accepts that `persistent: false` has lower recall than
+  // SQLite — an honest, documented divergence rather than a silent one.
+  addDocument(meta3, searchContent = "") {
     this.documents.set(meta3.id, meta3);
-    this.index.add({
-      id: meta3.id,
-      content: meta3.contentSnippet,
-      projectName: meta3.projectName,
-      projectPath: meta3.projectPath,
-      sessionId: meta3.sessionId,
-      sessionName: meta3.sessionName,
-      account: meta3.account,
-      model: meta3.model || "",
-      gitBranch: meta3.gitBranch || "",
-      toolNames: meta3.toolNames.join(" ")
-    });
+    this.searchContents.set(meta3.id, searchContent);
+    this.index.add(toIndexDoc(meta3, searchContent));
   }
-  buildIndex(metas) {
+  buildIndex(metas, searchContents) {
     this.clear();
     for (const meta3 of metas) {
-      this.addDocument(meta3);
+      this.addDocument(meta3, searchContents?.get(meta3.id) ?? "");
     }
     getLogger2().debug({ docCount: metas.length }, "indexer: built");
   }
@@ -140870,14 +140965,26 @@ var SearchIndexer = class {
         seen.add(id);
         const meta3 = this.documents.get(id);
         if (!meta3) continue;
-        const matches = generateMatches(meta3, query);
-        searchResults.push({ meta: meta3, score: 1, matches });
+        searchResults.push({
+          meta: meta3,
+          score: 1,
+          matches: this.matchesFor(meta3, query)
+        });
         if (searchResults.length >= limit) break;
       }
       if (searchResults.length >= limit) break;
     }
     return searchResults;
   }
+  // Body context first (that is what explains why the result appeared), then any
+  // metadata matches. Only when neither hits does generateMatches' preview
+  // fallback stand in.
+  matchesFor(meta3, query) {
+    const contentMatch = buildContentMatch(this.searchContents.get(meta3.id) ?? "", query);
+    const metaMatches = generateMatches(meta3, query);
+    if (!contentMatch) return metaMatches;
+    return [contentMatch, ...metaMatches.filter((m2) => m2.field !== "preview")];
+  }
   getRecent(limit) {
     return Array.from(this.documents.values()).sort((a, b2) => b2.timestamp.localeCompare(a.timestamp)).slice(0, limit).map((meta3) => ({
       meta: meta3,
@@ -140891,31 +140998,37 @@ var SearchIndexer = class {
   // Replace an already-indexed document in place. FlexSearch's `add` does not
   // overwrite an existing id, so a single-file refresh must go through
   // `update` to avoid stale matches lingering in the index.
-  updateDocument(meta3) {
+  updateDocument(meta3, searchContent = "") {
     this.documents.set(meta3.id, meta3);
-    this.index.update({
-      id: meta3.id,
-      content: meta3.contentSnippet,
-      projectName: meta3.projectName,
-      projectPath: meta3.projectPath,
-      sessionId: meta3.sessionId,
-      sessionName: meta3.sessionName,
-      account: meta3.account,
-      model: meta3.model || "",
-      gitBranch: meta3.gitBranch || "",
-      toolNames: meta3.toolNames.join(" ")
-    });
+    this.searchContents.set(meta3.id, searchContent);
+    this.index.update(toIndexDoc(meta3, searchContent));
   }
   removeDocument(id) {
     this.documents.delete(id);
+    this.searchContents.delete(id);
     this.index.remove(id);
   }
   clear() {
     this.documents.clear();
+    this.searchContents.clear();
     this.index = this.createIndex();
     getLogger2().trace("indexer: cleared");
   }
 };
+function toIndexDoc(meta3, searchContent) {
+  return {
+    id: meta3.id,
+    content: searchContent,
+    projectName: meta3.projectName,
+    projectPath: meta3.projectPath,
+    sessionId: meta3.sessionId,
+    sessionName: meta3.sessionName,
+    account: meta3.account,
+    model: meta3.model || "",
+    gitBranch: meta3.gitBranch || "",
+    toolNames: meta3.toolNames.join(" ")
+  };
+}
 var CLAUDE_CODE_PROVIDER2 = "claude-code";
 var CODEX_CLI_PROVIDER2 = "codex-cli";
 function initialReducerState() {
@@ -141065,7 +141178,7 @@ var SYSTEM_TAG_RE = new RegExp(`<(${SYSTEM_TAGS.join("|")})[^>]*>[\\s\\S]*?<\\/\
 function cleanSystemTags(text) {
   return text.replace(SYSTEM_TAG_RE, "").replace(/[^\S\n]+/g, " ").replace(/\n{3,}/g, "\n\n").trim();
 }
-async function parseMeta(filePath, account, tier) {
+async function parseMeta(filePath, account, tier, onEntry) {
   const log15 = getLogger2();
   log15.trace({ filePath, account, tier: tier.name }, "parseMeta: start");
   const state = initialReducerState();
@@ -141082,6 +141195,7 @@ async function parseMeta(filePath, account, tier) {
         continue;
       }
       reduceLine(state, entry, tier);
+      onEntry?.(entry);
     }
   } catch (err) {
     log15.warn({ filePath, err }, "parseMeta: read failed");
@@ -141776,7 +141890,7 @@ var LRUCache = class {
   }
 };
 var YIELD_EVERY_LINES = 500;
-async function tailReduce(filePath, startOffset, startLine, state, tier) {
+async function tailReduce(filePath, startOffset, startLine, state, tier, onEntry) {
   const stream = (0, import_fs11.createReadStream)(filePath, { start: startOffset, encoding: "utf8" });
   let buffer = "";
   let offset = startOffset;
@@ -141792,7 +141906,9 @@ async function tailReduce(filePath, startOffset, startLine, state, tier) {
       buffer = buffer.slice(nl + 1);
       if (text.length > 0) {
         try {
-          reduceLine(state, JSON.parse(text), tier);
+          const entry = JSON.parse(text);
+          reduceLine(state, entry, tier);
+          onEntry?.(entry);
         } catch {
           state.badJsonLines++;
         }
@@ -142013,7 +142129,7 @@ function classify(filePath, existing) {
   }
   return { change: "reindex", stat: stat42 };
 }
-async function parseMetaWithProvider(provider, filePath, account, tier) {
+async function parseMetaWithProvider(provider, filePath, account, tier, onEntry) {
   const log15 = getLogger2();
   const acc = provider.createEmptyAccumulator();
   const rl = (0, import_readline3.createInterface)({
@@ -142031,6 +142147,7 @@ async function parseMetaWithProvider(provider, filePath, account, tier) {
       }
       try {
         provider.reduceEntry(acc, entry, tier);
+        onEntry?.(entry);
       } catch (err) {
         log15.warn({ filePath, provider: provider.name, err }, "provider reduce threw; line skipped");
       }
@@ -142041,6 +142158,149 @@ async function parseMetaWithProvider(provider, filePath, account, tier) {
   }
   return provider.finalize(acc, filePath, account, tier);
 }
+var SEARCH_BUDGET = {
+  textMax: 64 * 1024,
+  thinkingMax: 32 * 1024,
+  toolsMax: 32 * 1024,
+  toolPayloadMax: 4 * 1024
+};
+var SEP = "\n\n";
+function emptySearchDocument() {
+  return { text: "", thinking: "", tools: "" };
+}
+function appendSearchDelta(doc, delta) {
+  return {
+    text: tailAppend(doc.text, delta.text, SEARCH_BUDGET.textMax),
+    thinking: tailAppend(doc.thinking, delta.thinking, SEARCH_BUDGET.thinkingMax),
+    tools: tailAppend(doc.tools, delta.tools, SEARCH_BUDGET.toolsMax)
+  };
+}
+function tailAppend(current, incoming, max) {
+  if (!incoming) return current;
+  const joined = current ? current + SEP + incoming : incoming;
+  return joined.length <= max ? joined : joined.slice(-max);
+}
+function combineSearchContent(doc) {
+  return [doc.text, doc.thinking, doc.tools].filter(Boolean).join(SEP);
+}
+function capToolPayload(value) {
+  const raw2 = stringifyPayload(value);
+  if (!raw2) return "";
+  return raw2.length > SEARCH_BUDGET.toolPayloadMax ? raw2.slice(0, SEARCH_BUDGET.toolPayloadMax) : raw2;
+}
+function stringifyPayload(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value) ?? "";
+  } catch {
+    return "";
+  }
+}
+function extractSearchDelta(entry) {
+  if (entry.type === "response_item" || entry.type === "session_meta") {
+    return extractCodexDelta(entry);
+  }
+  return extractClaudeDelta(entry);
+}
+function extractClaudeDelta(entry) {
+  const type = entry.type;
+  if (type !== "user" && type !== "assistant") return emptySearchDocument();
+  if (entry.isMeta) return emptySearchDocument();
+  const msg = entry.message;
+  const content = msg?.content;
+  const tools = [
+    extractClaudeToolContent(content),
+    // Claude stores the rich/structured tool result at the JSONL entry's top
+    // level, not inside message.content — indexing only message.content would
+    // miss most real tool output (file reads, command stdout).
+    capToolPayload(entry.toolUseResult)
+  ].filter(Boolean).join(SEP);
+  return {
+    text: extractClaudeText(content),
+    thinking: type === "assistant" ? extractThinking(content).content : "",
+    tools
+  };
+}
+function extractClaudeText(content) {
+  if (typeof content === "string") return cleanSystemTags(content);
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const item of content) {
+    if (typeof item === "string") {
+      const cleaned = cleanSystemTags(item);
+      if (cleaned) parts.push(cleaned);
+    } else if (item?.type === "text" && typeof item.text === "string") {
+      const cleaned = cleanSystemTags(item.text);
+      if (cleaned) parts.push(cleaned);
+    }
+  }
+  return parts.join(SEP);
+}
+function extractClaudeToolContent(content) {
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const item of content) {
+    if (item?.type === "tool_use") {
+      const capped = capToolPayload(item.input);
+      if (capped) parts.push(capped);
+    } else if (item?.type === "tool_result") {
+      const capped = capToolPayload(item.content);
+      if (capped) parts.push(capped);
+    }
+  }
+  return parts.join(SEP);
+}
+function extractCodexDelta(entry) {
+  const payload = entry.payload;
+  if (!payload || typeof payload !== "object") return emptySearchDocument();
+  const ptype = payload.type;
+  if (ptype === "function_call" || ptype === "custom_tool_call") {
+    return { text: "", thinking: "", tools: capToolPayload(payload.arguments) };
+  }
+  if (ptype === "function_call_output" || ptype === "custom_tool_call_output") {
+    return { text: "", thinking: "", tools: capToolPayload(payload.output) };
+  }
+  if (ptype === "reasoning") {
+    return { text: "", thinking: extractCodexReasoning(payload), tools: "" };
+  }
+  if (ptype === "message") {
+    const role = payload.role;
+    if (role !== "user" && role !== "assistant") return emptySearchDocument();
+    return { text: extractCodexText2(payload.content), thinking: "", tools: "" };
+  }
+  return emptySearchDocument();
+}
+function extractCodexReasoning(payload) {
+  const parts = [];
+  for (const key of ["summary", "content"]) {
+    const blocks = payload[key];
+    if (!Array.isArray(blocks)) continue;
+    for (const block of blocks) {
+      if (typeof block === "string") parts.push(block);
+      else if (typeof block?.text === "string") parts.push(block.text);
+    }
+  }
+  return parts.filter(Boolean).join(SEP);
+}
+function extractCodexText2(content) {
+  if (typeof content === "string") return cleanSystemTags(content);
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const item of content) {
+    if (typeof item === "string") {
+      const cleaned = cleanSystemTags(item);
+      if (cleaned) parts.push(cleaned);
+      continue;
+    }
+    const t = item?.type;
+    if ((t === "input_text" || t === "output_text" || t === "text") && typeof item.text === "string") {
+      const cleaned = cleanSystemTags(item.text);
+      if (cleaned) parts.push(cleaned);
+    }
+  }
+  return parts.join(SEP);
+}
 var DEFAULT_TIERS = {
   standard: { name: "standard", previewMax: 200, snippetMax: 5e3 },
   full: { name: "full", previewMax: 1200, snippetMax: 5e4 }
@@ -142054,7 +142314,7 @@ function resolveTier(tierName, customTiers) {
   }
   return tier;
 }
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 5;
 var SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS conversation_files (
   id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -142154,13 +142414,27 @@ CREATE INDEX IF NOT EXISTS idx_conversations_account_recent ON conversations(acc
 CREATE INDEX IF NOT EXISTS idx_conversations_subagent_recent ON conversations(is_subagent, timestamp DESC);
 CREATE INDEX IF NOT EXISTS idx_conversations_team_recent ON conversations(team_name, timestamp DESC);
 
--- Full-text search index over conversation content + metadata. Kept separate
--- from the metadata tables so list-screen queries stay small and fast.
--- source_path is UNINDEXED (stored, not tokenized) and links back to a
--- conversations row. One FTS row per conversation, replaced on each upsert.
+-- Full-text search index over conversation body + metadata. Kept separate from
+-- the metadata tables so list-screen queries stay small and fast. One FTS row
+-- per conversation, replaced on each upsert.
+--
+-- The row's rowid IS conversation_files.id. That is load-bearing, not cosmetic:
+-- FTS5's query planner only handles MATCH, rowid and rank, so any other
+-- constraint (including a source_path equality on an UNINDEXED column) has no
+-- index and linear-scans the whole table. At ~128 KB of body per row that would
+-- mean scanning the entire corpus on every append. Look rows up by rowid.
+-- source_path stays stored-but-UNINDEXED so a search hit can resolve back to a
+-- conversations row.
+--
+-- Body is three columns, not one: text > thinking > tools priority has to
+-- survive an append (a new user message belongs in the text column, not after
+-- the tool output already written). They are deliberately NOT concatenated into
+-- a fourth column - that would double-weight body hits and inflate bm25 length.
 CREATE VIRTUAL TABLE IF NOT EXISTS conversation_messages_fts USING fts5(
   source_path UNINDEXED,
-  content,
+  text,
+  thinking,
+  tools,
   project_name,
   session_id,
   session_name,
@@ -142228,6 +142502,24 @@ function runMigrations(db) {
   if (current >= 1 && current < 3 && tableExists(db, "conversations")) {
     db.exec("UPDATE conversations SET provider = 'claude-code' WHERE provider = 'threadbase'");
   }
+  if (current >= 1 && current < 5) {
+    db.exec("DROP TABLE IF EXISTS conversation_messages_fts");
+    if (tableExists(db, "conversation_files")) {
+      const assignments = [];
+      if (hasColumn(db, "conversation_files", "last_indexed_offset")) {
+        assignments.push("last_indexed_offset = 0");
+      }
+      if (hasColumn(db, "conversation_files", "last_indexed_line")) {
+        assignments.push("last_indexed_line = 0");
+      }
+      if (hasColumn(db, "conversation_files", "reducer_state")) {
+        assignments.push("reducer_state = NULL");
+      }
+      if (assignments.length > 0) {
+        db.exec(`UPDATE conversation_files SET ${assignments.join(", ")}`);
+      }
+    }
+  }
   db.exec(SCHEMA_SQL);
   db.pragma(`user_version = ${SCHEMA_VERSION}`);
 }
@@ -142247,6 +142539,7 @@ function openDatabase(dbPath) {
   db.pragma("synchronous = NORMAL");
   db.pragma("temp_store = MEMORY");
   db.pragma("foreign_keys = ON");
+  db.pragma("busy_timeout = 5000");
   runMigrations(db);
   getLogger2().debug({ dbPath }, "db: opened");
   return db;
@@ -142681,22 +142974,31 @@ var ConversationsRepo = class {
     return this.db.prepare("SELECT COUNT(*) AS n FROM conversations WHERE status = 'active'").get().n;
   }
 };
+var BODY_COLUMNS = [
+  { name: "text", index: 1 },
+  { name: "thinking", index: 2 },
+  { name: "tools", index: 3 }
+];
 var FtsRepo = class {
   constructor(db) {
     this.db = db;
   }
   db;
-  upsert(meta3) {
+  upsert(rowId, meta3, doc) {
     const sourcePath = canonicalPath(meta3.id);
     const tx = this.db.transaction(() => {
-      this.db.prepare("DELETE FROM conversation_messages_fts WHERE source_path = ?").run(sourcePath);
+      this.db.prepare("DELETE FROM conversation_messages_fts WHERE rowid = ?").run(rowId);
       this.db.prepare(
         `INSERT INTO conversation_messages_fts
-             (source_path, content, project_name, session_id, session_name, account, model, branch, tool_names)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+             (rowid, source_path, text, thinking, tools,
+              project_name, session_id, session_name, account, model, branch, tool_names)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
       ).run(
+        rowId,
         sourcePath,
-        meta3.contentSnippet ?? "",
+        doc.text,
+        doc.thinking,
+        doc.tools,
         meta3.projectName ?? "",
         meta3.sessionId ?? "",
         meta3.sessionName ?? "",
@@ -142708,26 +143010,94 @@ var FtsRepo = class {
     });
     tx();
   }
-  remove(sourcePath) {
-    this.db.prepare("DELETE FROM conversation_messages_fts WHERE source_path = ?").run(canonicalPath(sourcePath));
+  // Current durable buckets for a conversation, so an append can tail-extend
+  // them without reparsing the file. Returns null when no row exists yet.
+  readDocument(rowId) {
+    const row = this.db.prepare("SELECT text, thinking, tools FROM conversation_messages_fts WHERE rowid = ?").get(rowId);
+    if (!row) return null;
+    return { text: row.text ?? "", thinking: row.thinking ?? "", tools: row.tools ?? "" };
   }
-  // Ranked source_paths matching the query, best first. Returns [] on an empty
-  // query (callers fall back to a recency listing).
-  search(query, limit) {
+  // True when the stored row already equals what we would write, so an append
+  // can skip re-tokenizing ~128 KB of body for nothing.
+  //
+  // The check covers the metadata columns too, not just the buckets: a
+  // newly-seen tool name or a late-resolved session_name changes metadata while
+  // the body is byte-identical, and nothing else ever rewrites this row — so
+  // skipping on "body unchanged" alone would strand that stale value forever.
+  isCurrent(rowId, meta3, doc) {
+    const row = this.db.prepare(
+      `SELECT text, thinking, tools,
+                project_name, session_id, session_name, account, model, branch, tool_names
+         FROM conversation_messages_fts WHERE rowid = ?`
+    ).get(rowId);
+    if (!row) return false;
+    return row.text === doc.text && row.thinking === doc.thinking && row.tools === doc.tools && row.project_name === (meta3.projectName ?? "") && row.session_id === (meta3.sessionId ?? "") && row.session_name === (meta3.sessionName ?? "") && row.account === (meta3.account ?? "") && row.model === (meta3.model ?? "") && row.branch === (meta3.gitBranch ?? "") && row.tool_names === meta3.toolNames.join(" ");
+  }
+  remove(rowId) {
+    this.db.prepare("DELETE FROM conversation_messages_fts WHERE rowid = ?").run(rowId);
+  }
+  // Ranked hits matching the query, best first. Filters run in SQL BEFORE LIMIT:
+  // with a wide corpus a popular term matches far more conversations than one
+  // page, so post-filtering an already-truncated list would report "no results"
+  // for queries that do have them.
+  search(query, limit, filters = {}) {
     const match2 = toMatchQuery(query);
     if (!match2) return [];
+    const snippetSelects = BODY_COLUMNS.map(
+      (c) => `snippet(conversation_messages_fts, ${c.index}, ?, ?, ?, ?) AS snippet_${c.name}`
+    ).join(", ");
+    const params = [];
+    for (const _col of BODY_COLUMNS) {
+      params.push(FTS_HIT_OPEN, FTS_HIT_CLOSE, FTS_ELLIPSIS, FTS_SNIPPET_TOKENS);
+    }
+    params.push(match2);
+    const where = ["conversation_messages_fts MATCH ?", "c.status = 'active'"];
+    if (filters.account) {
+      where.push("c.account = ?");
+      params.push(filters.account);
+    }
+    if (filters.provider) {
+      where.push("c.provider = ?");
+      params.push(filters.provider);
+    }
+    if (filters.project) {
+      where.push("(lower(c.project_path) LIKE ? OR lower(c.project_name) LIKE ?)");
+      const like = `%${filters.project.toLowerCase()}%`;
+      params.push(like, like);
+    }
+    if (filters.since) {
+      where.push("c.timestamp >= ?");
+      params.push(filters.since.toISOString());
+    }
+    if (filters.include === "conversations") {
+      where.push("c.is_subagent = 0 AND c.is_teammate = 0");
+    } else if (filters.include === "subagents") {
+      where.push("c.is_subagent = 1");
+    } else if (filters.include === "teammates") {
+      where.push("c.is_teammate = 1");
+    }
+    params.push(limit);
     const rows = this.db.prepare(
-      `SELECT source_path FROM conversation_messages_fts
-         WHERE conversation_messages_fts MATCH ?
+      `SELECT conversation_messages_fts.source_path AS source_path, ${snippetSelects}
+         FROM conversation_messages_fts
+         JOIN conversations c ON c.source_path = conversation_messages_fts.source_path
+         WHERE ${where.join(" AND ")}
          ORDER BY rank
          LIMIT ?`
-    ).all(match2, limit);
-    return rows.map((r) => r.source_path);
+    ).all(...params);
+    return rows.map((row) => ({ sourcePath: row.source_path, body: pickBodySnippet(row) }));
   }
   count() {
     return this.db.prepare("SELECT COUNT(*) AS n FROM conversation_messages_fts").get().n;
   }
 };
+function pickBodySnippet(row) {
+  for (const col of BODY_COLUMNS) {
+    const parsed = parseFtsSnippet(row[`snippet_${col.name}`]);
+    if (parsed) return parsed;
+  }
+  return null;
+}
 function toMatchQuery(query) {
   const terms = query.trim().split(/\s+/).map((t) => t.replace(/"/g, "").trim()).filter(Boolean);
   if (terms.length === 0) return "";
@@ -142903,9 +143273,13 @@ var PersistentEngine = class {
     const state = resume ? JSON.parse(existing.reducer_state) : initialReducerState();
     const startOffset = resume ? existing.last_indexed_offset : 0;
     const startLine = resume ? existing.last_indexed_line : 0;
+    let searchDelta = emptySearchDocument();
+    const collectSearch = (entry) => {
+      searchDelta = appendSearchDelta(searchDelta, extractSearchDelta(entry));
+    };
     let result;
     try {
-      result = await tailReduce(filePath, startOffset, startLine, state, tier);
+      result = await tailReduce(filePath, startOffset, startLine, state, tier, collectSearch);
     } catch (err) {
       log15.warn({ filePath, err }, "persistent: tail read failed");
       return { meta: null, change };
@@ -142918,9 +143292,13 @@ var PersistentEngine = class {
     meta3.gitBranch = resolveGitBranch(meta3.projectPath);
     const fp = stat42.size > 0 ? fingerprint(filePath, stat42.size) : null;
     const fileId = this.files.ensure(filePath, account);
+    const base = resume ? this.fts.readDocument(fileId) ?? emptySearchDocument() : emptySearchDocument();
+    const searchDoc = appendSearchDelta(base, searchDelta);
     const upsert = this.db.transaction(() => {
       this.conversations.upsert(fileId, meta3, state.pageMessageCount);
-      this.fts.upsert(meta3);
+      if (!this.fts.isCurrent(fileId, meta3, searchDoc)) {
+        this.fts.upsert(fileId, meta3, searchDoc);
+      }
       if (!resume) this.checkpoints.remove(filePath);
       this.files.updateCursor(fileId, {
         sizeBytes: stat42.size,
@@ -142963,7 +143341,10 @@ var PersistentEngine = class {
   // any change reparses from 0 again. No reducer_state is persisted.
   async indexFileWithProvider(provider, filePath, account, tier, stat42, resolveGitBranch) {
     const log15 = getLogger2();
-    const meta3 = await parseMetaWithProvider(provider, filePath, account, tier);
+    let searchDoc = emptySearchDocument();
+    const meta3 = await parseMetaWithProvider(provider, filePath, account, tier, (entry) => {
+      searchDoc = appendSearchDelta(searchDoc, extractSearchDelta(entry));
+    });
     if (!meta3) {
       this.markDeleted(filePath);
       return null;
@@ -142975,7 +143356,9 @@ var PersistentEngine = class {
     const fileId = this.files.ensure(filePath, account);
     const upsert = this.db.transaction(() => {
       this.conversations.upsert(fileId, meta3, meta3.messageCount);
-      this.fts.upsert(meta3);
+      if (!this.fts.isCurrent(fileId, meta3, searchDoc)) {
+        this.fts.upsert(fileId, meta3, searchDoc);
+      }
       this.checkpoints.remove(filePath);
       this.files.updateCursor(fileId, {
         sizeBytes: stat42.size,
@@ -143001,7 +143384,7 @@ var PersistentEngine = class {
     if (!existing) return;
     const tx = this.db.transaction(() => {
       this.conversations.deleteByFileId(existing.id);
-      this.fts.remove(filePath);
+      this.fts.remove(existing.id);
       this.checkpoints.remove(filePath);
       this.files.setStatus(existing.id, "deleted");
     });
@@ -143017,20 +143400,24 @@ var PersistentEngine = class {
   getAllBySessionId(sessionId) {
     return this.conversations.getAllBySessionId(sessionId);
   }
-  // Ranked metas matching the FTS query, best first. Empty query returns the
-  // most recent conversations (mirroring the in-memory indexer's empty-query
-  // behavior). Resolves each FTS hit to its active conversation row.
-  searchMetas(query, limit) {
-    if (!query.trim()) {
-      return this.conversations.recent(limit);
-    }
-    const paths = this.fts.search(query, limit);
-    const metas = [];
-    for (const path2 of paths) {
-      const meta3 = this.conversations.getBySourcePath(path2);
-      if (meta3) metas.push(meta3);
+  // Ranked hits matching the FTS query, best first, each already resolved to its
+  // active conversation row and carrying the body excerpt when the match was in
+  // the conversation body.
+  //
+  // Filters are passed down into SQL rather than applied to the result: with a
+  // wide corpus, filtering an already-LIMITed list drops conversations that
+  // would have matched.
+  searchHits(query, limit, filters = {}) {
+    const hits = [];
+    for (const hit of this.fts.search(query, limit, filters)) {
+      const meta3 = this.conversations.getBySourcePath(hit.sourcePath);
+      if (meta3) hits.push({ meta: meta3, body: hit.body });
     }
-    return metas;
+    return hits;
+  }
+  // Empty-query listing, mirroring the in-memory indexer's behavior.
+  recentMetas(limit) {
+    return this.conversations.recent(limit);
   }
   getProjects() {
     return this.conversations.distinctProjects();
@@ -143184,6 +143571,10 @@ var DEFAULT_CONFIG_PATH2 = "~/.config/threadbase-scanner";
 function defaultDbPath() {
   return process.env.TB_SCANNER_DB ?? (0, import_path10.join)((0, import_os8.homedir)(), ".config", "threadbase-scanner", "index.db");
 }
+function capForMemory(doc, max) {
+  const combined = combineSearchContent(doc);
+  return combined.length > max ? combined.slice(-max) : combined;
+}
 var ConversationScanner = class {
   metadataCache = /* @__PURE__ */ new Map();
   // Parsed conversations plus (persistent claude-code entries only) the resume
@@ -143195,6 +143586,10 @@ var ConversationScanner = class {
   sessionIdIndex = /* @__PURE__ */ new Map();
   projects = /* @__PURE__ */ new Set();
   indexer = new SearchIndexer();
+  // Search body per conversation for the in-memory path, already tail-capped to
+  // the content tier. Survives scan() so a statCache hit — which skips the parse
+  // entirely — can still index a body rather than an empty string.
+  searchContents = /* @__PURE__ */ new Map();
   // Tier the most recent scan() ran with, so refreshFile() re-parses a single
   // file at the same content depth. Defaults to the standard tier.
   lastTier = resolveTier("standard");
@@ -143355,34 +143750,42 @@ var ConversationScanner = class {
               try {
                 const s3 = (0, import_fs9.statSync)(filePath);
                 if (s3.mtimeMs === cached4.stat.mtimeMs && s3.size === cached4.stat.size) {
-                  return cached4.meta;
+                  return {
+                    meta: cached4.meta,
+                    searchContent: this.searchContents.get(cached4.meta.id)
+                  };
                 }
               } catch {
               }
             }
           }
           try {
-            const meta3 = await parseMetaWithProvider(provider, filePath, account, tier);
+            let doc = emptySearchDocument();
+            const meta3 = await parseMetaWithProvider(provider, filePath, account, tier, (entry) => {
+              doc = appendSearchDelta(doc, extractSearchDelta(entry));
+            });
             if (meta3 && meta3.gitBranch === null && meta3.projectPath) {
               meta3.gitBranch = resolveGitBranch(meta3.projectPath);
             }
-            return meta3;
+            return { meta: meta3, searchContent: capForMemory(doc, tier.snippetMax) };
           } catch (err) {
             parseFailures++;
             log15.warn({ filePath, account, provider: provider.name, err }, "scan: parse threw");
-            return null;
+            return { meta: null, searchContent: void 0 };
           }
         })
       );
       const batchMetas = [];
-      for (const meta3 of results) {
+      for (const { meta: meta3, searchContent } of results) {
         if (meta3 && meta3.messageCount > 0) {
           this.metadataCache.set(meta3.id, meta3);
           this.addToSessionIndex(meta3);
           this.projects.add(meta3.projectPath);
           allMetas.push(meta3);
           batchMetas.push(meta3);
-          this.indexer.addDocument(meta3);
+          const content = searchContent ?? this.searchContents.get(meta3.id) ?? "";
+          this.searchContents.set(meta3.id, content);
+          this.indexer.addDocument(meta3, content);
         }
       }
       if (batchMetas.length > 0) {
@@ -143419,12 +143822,29 @@ var ConversationScanner = class {
         const activeProfiles = profiles.filter((p2) => p2.enabled && p2.scanHistory !== false);
         await engine.indexAll(activeProfiles, { ...options, limit: void 0, offset: void 0 });
       }
-      const metas = engine.searchMetas(query, (options.limit ?? 50) * 2);
-      results = query.trim() ? metas.map((meta3) => ({ meta: meta3, score: 1, matches: generateMatches(meta3, query) })) : metas.map((meta3) => ({
-        meta: meta3,
-        score: 1,
-        matches: [{ field: "timestamp", snippet: meta3.preview }]
-      }));
+      if (query.trim()) {
+        const want = (options.limit ?? 50) + (options.offset ?? 0);
+        results = engine.searchHits(query, want, {
+          account: options.account,
+          provider: options.provider,
+          project: options.project,
+          since: options.since ? parseSinceCutoff(options.since) : void 0,
+          include: options.include
+        }).map(({ meta: meta3, body }) => ({
+          meta: meta3,
+          score: 1,
+          matches: body ? [
+            { field: CONTENT_FIELD, snippet: body.snippet, highlights: body.highlights },
+            ...generateMatches(meta3, query).filter((m2) => m2.field !== "preview")
+          ] : generateMatches(meta3, query)
+        }));
+      } else {
+        results = engine.recentMetas((options.limit ?? 50) + (options.offset ?? 0)).map((meta3) => ({
+          meta: meta3,
+          score: 1,
+          matches: [{ field: "timestamp", snippet: meta3.preview }]
+        }));
+      }
     } else {
       if (this.indexer.getDocumentCount() === 0) {
         log15.debug("search: index empty, triggering scan");
@@ -143618,8 +144038,11 @@ var ConversationScanner = class {
     const previous = this.metadataCache.get(filePath);
     const resolvedAccount = account ?? previous?.account ?? "default";
     let meta3 = null;
+    let searchDoc = emptySearchDocument();
     try {
-      meta3 = await parseMeta(filePath, resolvedAccount, this.lastTier);
+      meta3 = await parseMeta(filePath, resolvedAccount, this.lastTier, (entry) => {
+        searchDoc = appendSearchDelta(searchDoc, extractSearchDelta(entry));
+      });
     } catch (err) {
       log15.warn({ filePath, err }, "refreshFile: parseMeta threw");
       meta3 = null;
@@ -143636,6 +144059,7 @@ var ConversationScanner = class {
         this.metadataCache.delete(previous.id);
         this.removeFromSessionIndex(previous);
         this.indexer.removeDocument(previous.id);
+        this.searchContents.delete(previous.id);
       }
       log15.debug({ filePath }, "refreshFile: dropped (no parseable messages)");
       return null;
@@ -143645,10 +144069,12 @@ var ConversationScanner = class {
     this.metadataCache.set(meta3.id, meta3);
     this.addToSessionIndex(meta3);
     this.projects.add(meta3.projectPath);
+    const searchContent = capForMemory(searchDoc, this.lastTier.snippetMax);
+    this.searchContents.set(meta3.id, searchContent);
     if (previous) {
-      this.indexer.updateDocument(meta3);
+      this.indexer.updateDocument(meta3, searchContent);
     } else {
-      this.indexer.addDocument(meta3);
+      this.indexer.addDocument(meta3, searchContent);
     }
     log15.debug(
       { filePath, messageCount: meta3.messageCount },
@@ -145498,7 +145924,7 @@ function paginate(results, offset, limit) {
 }
 
 // src/utils/codexConversationLine.ts
-function extractCodexText2(content) {
+function extractCodexText3(content) {
   if (typeof content === "string") return content.trim();
   if (!Array.isArray(content)) return "";
   return content.map((item) => {
@@ -145537,7 +145963,7 @@ function classifyCodexLine(line) {
   if (role !== "user" && role !== "assistant") {
     return { kind: "ignored", reason: `role ${String(role)} is not rendered` };
   }
-  const text = extractCodexText2(payload.content);
+  const text = extractCodexText3(payload.content);
   if (!text) {
     return { kind: "ignored", reason: "message has no extractable text" };
   }
@@ -150263,6 +150689,9 @@ function seal(plaintext, recipientPublicKeyBase64) {
   };
 }
 
+// src/server.ts
+init_server_identity();
+
 // src/server-wiring.ts
 var import_fs31 = require("fs");
 
@@ -154474,13 +154903,16 @@ var StreamerServer = class {
       json2(res, 400, { error: "Missing token or clientPublicKey" });
       return;
     }
-    let e2eeRequest;
-    try {
-      e2eeRequest = parseE2eeRequest(body?.e2ee);
-    } catch (err) {
-      const e = err;
-      json2(res, 400, { error: e.message, code: e.code });
-      return;
+    const e2eeEnabled = describeE2eeCapability(this.featureFlags.e2ee).enabled;
+    let e2eeRequest = null;
+    if (e2eeEnabled) {
+      try {
+        e2eeRequest = parseE2eeRequest(body?.e2ee);
+      } catch (err) {
+        const e = err;
+        json2(res, 400, { error: e.message, code: e.code });
+        return;
+      }
     }
     const precheck = this.pairTokens.wouldConsume(token);
     if (!precheck.ok) {
@@ -155134,6 +155566,9 @@ function parseDirScanDebounceEnv(raw2) {
   return Number.isNaN(parsed) || parsed < 0 ? void 0 : parsed;
 }
 
+// cli/index.ts
+init_server_identity();
+
 // src/updater/check-update.ts
 var import_semver = __toESM(require_semver2(), 1);
 
@@ -158775,6 +159210,7 @@ init_platform2();
 init_logger();
 init_protocol();
 init_socket();
+init_server_identity();
 var log11 = getLogger("prod");
 function clearSupervisorLogs() {
   let paths;
@@ -158827,6 +159263,7 @@ async function runProdStatus() {
 async function runProdDoctor(opts, deps = {}) {
   const findings = [];
   const repairs = [];
+  let identity;
   let ptyHost;
   const marker = readMarker();
   if (marker && !marker.userHeld && !isPidAlive(marker.devPid)) {
@@ -158839,6 +159276,15 @@ async function runProdDoctor(opts, deps = {}) {
   if (!getSupervisor().isAgentLoaded()) {
     findings.push("launchd agent is not loaded \u2014 prod is fully down");
   }
+  if (deps.serverIdentityFingerprint) {
+    try {
+      identity = deps.serverIdentityFingerprint();
+    } catch (err) {
+      findings.push(
+        `server identity key at ${serverIdentityKeyPath()} is unreadable: ` + (err instanceof Error ? err.message : String(err))
+      );
+    }
+  }
   const conflicts = detectConflictingAgents();
   for (const c of conflicts) {
     if (c.resolution === "uninstall-homebrew") {
@@ -158867,7 +159313,7 @@ async function runProdDoctor(opts, deps = {}) {
       );
     }
   }
-  return { findings, repairs, ...ptyHost ? { ptyHost } : {} };
+  return { findings, repairs, ...identity ? { identity } : {}, ...ptyHost ? { ptyHost } : {} };
 }
 function toPowerShellLiteral(value) {
   return `'${value.replace(/'/g, "''")}'`;
@@ -159016,7 +159462,13 @@ function registerProdCommands(program3) {
     log11.info(what, void 0, "console");
   });
   prod.command("doctor").description("Detect stale markers, missing agents, and pty-host health").option("--fix", "Apply repairs (default is dry-run)", false).action(async (opts) => {
-    const r = await runProdDoctor({ fix: opts.fix === true });
+    const r = await runProdDoctor(
+      { fix: opts.fix === true },
+      { serverIdentityFingerprint: currentServerIdentityFingerprint }
+    );
+    if (r.identity) {
+      log11.info(`identity: ${r.identity}`, void 0, "console");
+    }
     if (r.ptyHost) {
       log11.info(
         r.ptyHost.reachable ? `pty-host: reachable, protocol=${r.ptyHost.protocolVersion}, sessions=${r.ptyHost.sessionCount}` : `pty-host: unreachable (${r.ptyHost.error})`,
@@ -159408,6 +159860,16 @@ program2.command("pair").description("Print a pairing QR code (server must alrea
   const publicUrl = loadPublicUrl() ?? null;
   await printServerBanner({ port, apiKey, publicUrl, includeQr: true });
 });
+program2.command("identity").description("Print this server's identity fingerprint for out-of-band verification").action(async () => {
+  const { runIdentity: runIdentity2 } = await Promise.resolve().then(() => (init_identity(), identity_exports));
+  const code = runIdentity2({
+    log: {
+      info: (msg) => log14.info(msg, void 0, "console"),
+      error: (msg) => log14.error(msg, void 0, "console")
+    }
+  });
+  process.exit(code);
+});
 program2.command("set-key [key]").description("Set the streamer API key in ~/.threadbase/server.yaml").action(async (key) => {
   const { runSetKey: runSetKey2 } = await Promise.resolve().then(() => (init_setKey(), setKey_exports));
   const code = await runSetKey2(