feat(serve,ui): V19 slice 3 — FTS5 full-text search (v0.3)

Replace the line-scanning grep fallback with a real SQLite FTS5 index
over the tool_call event stream. A hub subscriber writes each tool call
into a virtual table (trigram tokenizer for substring matching of paths
and identifiers); the /api/search handler queries the index and returns
sessions+snippets newest-first.

Backend
- internal/serve/store: add tool_calls_fts virtual table + IndexToolCall
  and SearchFTS methods on the sqlite cost store. Schema version bumped
  and FTS table wiped on boot so the tailer's JSONL replay rebuilds it
  from scratch — no divergence vs the source of truth on disk.
- internal/serve/store/tool_call_subscriber.go: hub subscriber that
  indexes every tool_call published after boot.
- internal/serve/api/search.go: rewrite handler around SearchFTS, bump
  minimum query length 2 → 3 (matches the trigram tokenizer's minimum
  useful length). Drops scanned_files from the response shape.
- internal/serve/server.go: wire the FTS subscriber and inject the new
  SearchSource / SessionNameResolver adapters.

Build
- Makefile: add GO_TAGS := sqlite_fts5 and apply to every go invocation
  so test + build + install all pull in the FTS5 amalgamation.

UI
- useSearch: MIN_Q 2 → 3, drop scanned_files from the response type.
- SearchPalette: gate on ≥3 chars.

Tests
- internal/serve/store/search_store_test.go: 9 tests covering literal
  substring, session filter, truncation, path-like tokens, empty
  content, closed-store errors, subscriber indexing, non-tool-call
  filtering, FTS wipe on boot.
- ui/e2e/fixtures/mocks.ts: add a shape-aware catch-all for unmocked
  /api/** paths. A 401 from any endpoint bubbles up as
  UnauthorizedError and clears the bearer token, dropping the test back
  to the paste screen — V13 /api/cost was silently doing that. Catch-all
  prevents the whole class of newly-added-endpoint regressions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

Makefile

@@ -8,6 +8,12 @@ UI_DIR        := ui
 UI_DIST       := $(UI_DIR)/dist
 EMBED_DIST    := internal/serve/dist
 
+# V19 slice 3 requires SQLite FTS5. mattn/go-sqlite3 compiles FTS5 in
+# only when the sqlite_fts5 build tag is set; applied to every go
+# build / test / install invocation below. Binaries built without it
+# will panic at boot on "no such module: fts5".
+GO_TAGS       := sqlite_fts5
+
 .PHONY: ui build dev clean help e2e regression
 
 help:
@@ -30,7 +36,7 @@ ui:
 
 build: ui
 	@echo "==> go build"
-	go build -trimpath ./...
+	go build -trimpath -tags $(GO_TAGS) ./...
 
 # Dev: run pnpm dev (Vite proxies to :37778) and go run . serve in parallel.
 # Trap SIGINT so Ctrl-C tears down both.
@@ -62,11 +68,11 @@ e2e:
 # it does not get replaced. See ui/e2e/README.md.
 regression:
 	@echo "==> go build ./..."
-	go build ./...
+	go build -tags $(GO_TAGS) ./...
 	@echo "==> go test ./..."
-	go test ./...
+	go test -tags $(GO_TAGS) ./...
 	@echo "==> go test -race ./internal/serve/..."
-	go test -race ./internal/serve/...
+	go test -race -tags $(GO_TAGS) ./internal/serve/...
 	@echo "==> govulncheck ./..."
 	govulncheck ./...
 	@echo "==> pnpm -C ui tsc --noEmit"

internal/serve/api/search.go

@@ -1,21 +1,27 @@
 package api
 
+// V19 slice 3: /api/search is now backed by the FTS5 index maintained
+// in internal/serve/store. The handler no longer walks *.jsonl files
+// — queries hit the index directly. Trigram tokenization means the
+// minimum query length bumps from 2 to 3 chars.
+//
 // Wiring (central, server.go):
-//   mux.Handle("GET /api/search", authHF(api.Search(s.logDir, logsUUIDResolver{proj: s.proj})))
+//   mux.Handle("GET /api/search", authHF(api.Search(searchSourceAdapter{s.cost}, logsUUIDResolver{proj: s.proj})))
 
 import (
-	"bufio"
-	"encoding/json"
+	"errors"
 	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
+	"time"
 )
 
-// UUIDNameResolver is already defined in logs_usage.go (V21) —
-// satisfied by serve.logsUUIDResolver. Reused here.
+// SessionNameResolver reverse-maps session name → log UUID. Satisfied
+// by serve.logsUUIDResolver. Kept separate from UUIDNameResolver so
+// callers can depend on only the direction they need.
+type SessionNameResolver interface {
+	ResolveSessionName(name string) (uuid string, ok bool)
+}
+
+var errNotPositiveInt = errors.New("not a positive int")
 
 // SearchMatch is one hit in the search response.
 type SearchMatch struct {
@@ -28,24 +34,42 @@ type SearchMatch struct {
 
 // SearchResponse wraps matches with scan stats for the UI.
 type SearchResponse struct {
-	Query        string        `json:"query"`
-	Matches      []SearchMatch `json:"matches"`
-	ScannedFiles int           `json:"scanned_files"`
-	Truncated    bool          `json:"truncated"`
+	Query     string        `json:"query"`
+	Matches   []SearchMatch `json:"matches"`
+	Truncated bool          `json:"truncated"`
+}
+
+// SearchSource is the persistence seam — in production it's the FTS5
+// store; tests fake it with an in-memory slice.
+type SearchSource interface {
+	SearchFTS(q, sessionFilter string, limit int) ([]SearchHit, bool, error)
+}
+
+// SearchHit mirrors store.SearchMatch in wire-neutral form so the api
+// package doesn't depend on the store package.
+type SearchHit struct {
+	Session string
+	TS      time.Time
+	Tool    string
+	Snippet string
 }
 
 const (
-	searchMinLen   = 2
+	searchMinLen   = 3
 	searchMaxLen   = 256
 	searchMaxLimit = 500
 	searchDefLimit = 100
-	snippetHalf    = 30
-	maxLineBytes   = 1 << 20 // 1 MiB, matches tailer
 )
 
-// Search returns a handler that scans *.jsonl files under logDir for
-// substring hits against q. Slice 1 of V19 — regex and FTS5 come later.
-func Search(logDir string, resolver UUIDNameResolver) http.HandlerFunc {
+// Search returns a handler that queries the FTS5 index for substring
+// hits against q. Response shape matches V19 slice 1 — UUID is
+// resolved from the session name at query time.
+func Search(src SearchSource, resolver SessionNameResolver) http.HandlerFunc {
+	// Build an inverse name → uuid map once per request (via a
+	// resolver-scan closure) so Search can stamp the UUID field.
+	// Resolver walks via (uuid → name); we keep the call site cheap
+	// by doing an O(n) scan on cache miss. For v0.3 the session
+	// count is small (<100) so this is fine.
 	return func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodGet {
 			w.Header().Set("Allow", "GET")
@@ -54,172 +78,67 @@ func Search(logDir string, resolver UUIDNameResolver) http.HandlerFunc {
 		}
 		q := r.URL.Query().Get("q")
 		if len(q) < searchMinLen || len(q) > searchMaxLen {
-			http.Error(w, "q must be 2..256 chars", http.StatusBadRequest)
+			http.Error(w, "q must be 3..256 chars", http.StatusBadRequest)
 			return
 		}
 		sessionFilter := r.URL.Query().Get("session")
 		limit := searchDefLimit
 		if v := r.URL.Query().Get("limit"); v != "" {
-			if n, err := parsePositiveInt(v); err == nil {
+			if n, err := parseSearchPositiveInt(v); err == nil {
 				limit = n
 			}
 		}
 		if limit > searchMaxLimit {
 			limit = searchMaxLimit
 		}
 
-		entries, err := os.ReadDir(logDir)
+		hits, truncated, err := src.SearchFTS(q, sessionFilter, limit)
 		if err != nil {
-			// Missing dir is treated as empty — the UI shouldn't blow up
-			// before the first session ever runs.
-			if os.IsNotExist(err) {
-				writeJSON(w, http.StatusOK, SearchResponse{Query: q, Matches: []SearchMatch{}})
-				return
-			}
-			http.Error(w, "read log dir", http.StatusInternalServerError)
+			http.Error(w, "search: "+err.Error(), http.StatusInternalServerError)
 			return
 		}
 
-		// Pre-resolve file list, with session-filter short-circuit when set.
-		type job struct {
-			path string
-			uuid string
-			name string
-		}
-		var jobs []job
-		for _, e := range entries {
-			if e.IsDir() || !strings.HasSuffix(e.Name(), ".jsonl") {
-				continue
+		matches := make([]SearchMatch, 0, len(hits))
+		uuidOf := map[string]string{}
+		for _, h := range hits {
+			uuid, ok := uuidOf[h.Session]
+			if !ok && resolver != nil {
+				uuid, _ = resolver.ResolveSessionName(h.Session)
+				uuidOf[h.Session] = uuid
 			}
-			uuid := strings.TrimSuffix(e.Name(), ".jsonl")
-			name := ""
-			if resolver != nil {
-				name, _ = resolver.ResolveUUID(uuid)
-			}
-			if sessionFilter != "" && name != sessionFilter {
-				continue
-			}
-			jobs = append(jobs, job{
-				path: filepath.Join(logDir, e.Name()),
-				uuid: uuid,
-				name: name,
-			})
-		}
-
-		// Worker pool over files. Slice 1: single pass, no early-abort via
-		// ctx — handlers inherit request ctx and the OS cancels on client
-		// disconnect via the file close path.
-		workers := runtime.GOMAXPROCS(0)
-		if workers > len(jobs) {
-			workers = len(jobs)
-		}
-		if workers < 1 {
-			workers = 1
-		}
-		jobCh := make(chan job)
-		resCh := make(chan SearchMatch, 256)
-		var wg sync.WaitGroup
-		for i := 0; i < workers; i++ {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				for j := range jobCh {
-					scanFile(j.path, j.uuid, j.name, q, resCh)
-				}
-			}()
-		}
-		go func() {
-			for _, j := range jobs {
-				jobCh <- j
+			m := SearchMatch{
+				Session: h.Session,
+				UUID:    uuid,
+				Tool:    h.Tool,
+				Snippet: h.Snippet,
 			}
-			close(jobCh)
-			wg.Wait()
-			close(resCh)
-		}()
-
-		matches := make([]SearchMatch, 0, limit)
-		truncated := false
-		for m := range resCh {
-			if len(matches) >= limit {
-				truncated = true
-				// Keep draining so workers finish, but stop appending.
-				continue
+			if !h.TS.IsZero() {
+				m.TS = h.TS.Format(time.RFC3339Nano)
 			}
 			matches = append(matches, m)
 		}
 
 		writeJSON(w, http.StatusOK, SearchResponse{
-			Query:        q,
-			Matches:      matches,
-			ScannedFiles: len(jobs),
-			Truncated:    truncated,
+			Query:     q,
+			Matches:   matches,
+			Truncated: truncated,
 		})
 	}
 }
 
-// scanFile emits one match per matching line. Slice 1 behaviour: plain
-// substring match with a 60-char snippet centered on the hit.
-func scanFile(path, uuid, session, q string, out chan<- SearchMatch) {
-	f, err := os.Open(path)
-	if err != nil {
-		return
-	}
-	defer f.Close()
-
-	sc := bufio.NewScanner(f)
-	sc.Buffer(make([]byte, 0, 64*1024), maxLineBytes)
-	for sc.Scan() {
-		line := sc.Text()
-		idx := strings.Index(line, q)
-		if idx < 0 {
-			continue
-		}
-		// Parse just enough JSON for ts/tool — best-effort only. Rows
-		// that don't parse still count as hits (the snippet is what the
-		// user wants to see).
-		var row struct {
-			TS   string `json:"ts"`
-			Tool string `json:"tool"`
-		}
-		_ = json.Unmarshal([]byte(line), &row)
-
-		start := idx - snippetHalf
-		if start < 0 {
-			start = 0
-		}
-		end := idx + len(q) + snippetHalf
-		if end > len(line) {
-			end = len(line)
-		}
-		out <- SearchMatch{
-			Session: session,
-			UUID:    uuid,
-			TS:      row.TS,
-			Tool:    row.Tool,
-			Snippet: line[start:end],
-		}
-	}
-}
-
-func parsePositiveInt(s string) (int, error) {
+func parseSearchPositiveInt(s string) (int, error) {
 	n := 0
 	for _, c := range s {
 		if c < '0' || c > '9' {
-			return 0, errNotInt
+			return 0, errNotPositiveInt
 		}
 		n = n*10 + int(c-'0')
 		if n > 1<<20 {
 			return n, nil
 		}
 	}
 	if n <= 0 {
-		return 0, errNotInt
+		return 0, errNotPositiveInt
 	}
 	return n, nil
 }
-
-var errNotInt = &apiError{msg: "not a positive int"}
-
-type apiError struct{ msg string }
-
-func (e *apiError) Error() string { return e.msg }