chore: version 2.0.0-alpha.2 + changelog

Search view: read ?q from hash, call /api/search, group hits by kind
with rank + space_id; sidebar filters for kinds and space_id; updates
on Enter or filter change.

Bumps package.json + server.js VERSION to 2.0.0-alpha.2 and pins the
/health version assertion to match.

CHANGELOG: full Plan 2 entry covering API surface, capability tiering,
audit chain extension (approve/reject events), and the SPA shell.

Security: adds safeHref() to dom.js and applies it everywhere an
API-supplied URL becomes href / src (reference media block + reference
source_url anchor + resource url anchor). javascript: and other
non-http(s)/mailto schemes from agent-suggested content can no longer
execute in the owner's browser.

Plan 2 surface is feature-complete: 22/22 tasks landed, 185 tests
across 43 files, SPA renders end-to-end including the suggest -> approve
agent flow.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

public/dom.js

@@ -46,3 +46,15 @@ export function mount(node, ...children) {
   clear(node);
   appendAll(node, children);
 }
+
+// Validate a URL before using it as href/src. Agent-suggested content
+// could carry a `javascript:` scheme that would execute in the owner's
+// browser context when clicked. Only http(s)/mailto/relative pass.
+export function safeHref(u) {
+  if (!u) return '#';
+  try {
+    const url = new URL(u, location.origin);
+    if (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'mailto:') return url.href;
+    return '#';
+  } catch { return '#'; }
+}

public/views/reference.js

@@ -1,10 +1,12 @@
 // Reference detail: media block + summary + metadata + tag attach/detach + linked-from.
 import { api } from '../api.js';
-import { el, mount, clear } from '../dom.js';
+import { el, mount, clear, safeHref } from '../dom.js';
 
 function mediaBlock(ref) {
   if (ref.kind === 'image' && (ref.source_url || ref.blob_path)) {
-    return el('img', { src: ref.source_url || ref.blob_path, style: { maxWidth: '100%', borderRadius: '4px', border: '1px solid var(--border)' } });
+    const src = safeHref(ref.source_url || ref.blob_path);
+    if (src === '#') return el('span', { class: 'muted' }, '(image url rejected by scheme check)');
+    return el('img', { src, style: { maxWidth: '100%', borderRadius: '4px', border: '1px solid var(--border)' } });
   }
   if (ref.kind === 'video' && ref.source_url) {
     const yt = ref.source_url.match(/(?:youtube\.com\/watch\?v=|youtu\.be\/)([\w-]{6,})/);
@@ -16,10 +18,10 @@ function mediaBlock(ref) {
         referrerpolicy: 'no-referrer'
       });
     }
-    return el('a', { href: ref.source_url, target: '_blank', rel: 'noopener noreferrer' }, ref.source_url);
+    return el('a', { href: safeHref(ref.source_url), target: '_blank', rel: 'noopener noreferrer' }, ref.source_url);
   }
   if (ref.source_url) {
-    return el('a', { href: ref.source_url, target: '_blank', rel: 'noopener noreferrer' }, ref.source_url);
+    return el('a', { href: safeHref(ref.source_url), target: '_blank', rel: 'noopener noreferrer' }, ref.source_url);
   }
   return el('span', { class: 'muted' }, '(no source)');
 }

public/views/resource.js

@@ -1,6 +1,6 @@
 // Resource detail: status header + dependencies + source docs + runbook pages + change history.
 import { api } from '../api.js';
-import { el, mount, clear } from '../dom.js';
+import { el, mount, clear, safeHref } from '../dom.js';
 
 function statusClass(s) {
   return s === 'running' ? 'ok' : s === 'stopped' ? 'warn' : s === 'down' ? 'bad' : 'idle';
@@ -114,7 +114,7 @@ export async function render(main, ctx) {
       ' · ', el('span', { class: 'status idle' }, res.runtime_type),
       res.host ? ' · ' + res.host : '',
       res.url ? ' · ' : '',
-      res.url ? el('a', { href: res.url, target: '_blank', rel: 'noopener noreferrer' }, res.url) : null
+      res.url ? el('a', { href: safeHref(res.url), target: '_blank', rel: 'noopener noreferrer' }, res.url) : null
     ),
     el('div', { class: 'row' },
       el('div', { class: 'card' },

public/views/search.js

@@ -1,9 +1,134 @@
-// T17 stub — full implementation lands in T22.
-import { el, mount } from '../dom.js';
-export async function render(main, ctx) {
-  mount(main,
-    el('h1', { class: 'view-h1' }, 'Search'),
-    el('p', { class: 'view-sub muted' }, 'q: ' + (ctx.query.q || '—')),
-    el('div', { class: 'card muted' }, 'Search view ships in T22.')
+// Search results — read q from hash, group hits by kind, sidebar
+// filters for kinds and space_id.
+import { api } from '../api.js';
+import { el, mount, clear } from '../dom.js';
+import { navigate } from '../router.js';
+
+const KINDS = ['page', 'ref', 'source_doc', 'message'];
+const KIND_LABEL = { page: 'Pages', ref: 'References', source_doc: 'Source docs', message: 'Messages' };
+const ROUTE_BY_KIND = {
+  page: id => '#/page/' + id,
+  ref: id => '#/ref/' + id,
+  source_doc: () => null,
+  message: () => null
+};
+
+function hitRow(h) {
+  const route = ROUTE_BY_KIND[h.kind];
+  const target = route ? route(h.id) : null;
+  return el('div', { class: 'search-hit' },
+    target
+      ? el('a', { href: target }, h.title_or_snippet || '(untitled)')
+      : el('span', {}, h.title_or_snippet || '(untitled)'),
+    el('div', { class: 'hit-meta' },
+      'rank ' + (h.rank || 0).toFixed(3) +
+      (h.space_id ? ' · space ' + h.space_id.slice(0, 8) : ' · no space')
+    )
   );
 }
+
+async function runSearch(resultsEl, statusEl, q, opts) {
+  if (!q) {
+    clear(resultsEl);
+    mount(statusEl, el('span', { class: 'muted' }, 'Type a query above to start.'));
+    return;
+  }
+  mount(statusEl, el('span', { class: 'muted' }, 'Searching …'));
+  const url = new URL('/api/search', location.origin);
+  url.searchParams.set('q', q);
+  if (opts.space_id) url.searchParams.set('space_id', opts.space_id);
+  if (opts.kinds.length && opts.kinds.length < KINDS.length) url.searchParams.set('kinds', opts.kinds.join(','));
+  url.searchParams.set('limit', '100');
+  let hits = [];
+  try { hits = await api.get(url.pathname + url.search); }
+  catch (e) {
+    clear(resultsEl);
+    mount(statusEl, el('span', { class: 'muted' }, 'Error: ' + e.message));
+    return;
+  }
+  mount(statusEl, el('span', { class: 'muted' }, hits.length + ' hits'));
+
+  const byKind = new Map();
+  for (const h of hits) {
+    if (!byKind.has(h.kind)) byKind.set(h.kind, []);
+    byKind.get(h.kind).push(h);
+  }
+  clear(resultsEl);
+  if (!hits.length) {
+    resultsEl.appendChild(el('p', { class: 'muted' }, 'No matches.'));
+    return;
+  }
+  for (const k of KINDS) {
+    const items = byKind.get(k);
+    if (!items?.length) continue;
+    resultsEl.appendChild(el('div', { class: 'search-group' },
+      el('div', { class: 'group-h' }, KIND_LABEL[k] + ' (' + items.length + ')'),
+      items.map(hitRow)
+    ));
+  }
+}
+
+export async function render(main, ctx) {
+  const q = ctx.query.q || '';
+  let spaces = [];
+  try { spaces = await api.get('/api/spaces'); } catch { /* */ }
+
+  const queryInput = el('input', { type: 'text', placeholder: 'Search …', value: q, style: { width: '100%' } });
+
+  const opts = { kinds: [...KINDS], space_id: '' };
+  const kindCheckboxes = KINDS.map(k => {
+    const cb = el('input', {
+      type: 'checkbox', checked: true,
+      onchange: () => {
+        opts.kinds = KINDS.filter((kk, i) => kindCheckboxes[i].querySelector('input').checked);
+        runSearch(resultsEl, statusEl, queryInput.value, opts);
+      }
+    });
+    return el('label', { style: { display: 'block', cursor: 'pointer', padding: '2px 0' } },
+      cb, ' ', KIND_LABEL[k]
+    );
+  });
+
+  const spaceSelect = el('select', {
+    style: { width: '100%' },
+    onchange: () => {
+      opts.space_id = spaceSelect.value;
+      runSearch(resultsEl, statusEl, queryInput.value, opts);
+    }
+  });
+  spaceSelect.appendChild(el('option', { value: '' }, '(all spaces)'));
+  for (const s of spaces) spaceSelect.appendChild(el('option', { value: s.id }, s.name));
+
+  const statusEl = el('div', { class: 'muted', style: { marginBottom: '10px', fontSize: '12px' } });
+  const resultsEl = el('div');
+
+  queryInput.addEventListener('keydown', (e) => {
+    if (e.key === 'Enter') {
+      const v = queryInput.value.trim();
+      navigate('/search?q=' + encodeURIComponent(v));
+      runSearch(resultsEl, statusEl, v, opts);
+    }
+  });
+
+  mount(main,
+    el('h1', { class: 'view-h1' }, 'Search'),
+    el('p', { class: 'view-sub muted' }, 'Full-text across pages, references, source docs, and messages.'),
+    el('div', { class: 'row' },
+      el('div', { class: 'card', style: { flex: '0 0 240px' } },
+        el('h3', {}, 'Filters'),
+        el('div', { class: 'muted', style: { fontSize: '11px', marginBottom: '4px' } }, 'Kinds'),
+        kindCheckboxes,
+        el('div', { class: 'muted', style: { fontSize: '11px', margin: '10px 0 4px' } }, 'Space'),
+        spaceSelect
+      ),
+      el('div', { class: 'card' },
+        el('h3', {}, 'Query'),
+        queryInput,
+        statusEl,
+        resultsEl
+      )
+    )
+  );
+
+  runSearch(resultsEl, statusEl, q, opts);
+}