cloudflare / cloudflare/agentic-inbox

Potential PR: long search strings can 500 via Durable Object SQLite LIKE pattern limit

Open
#36 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
7.5k
Forks
964
PR merge metrics
No merged PRs in 30d

Description

## Problem

Search requests can return HTTP 500 when the free-text query or field filters are long enough to produce a SQLite `LIKE` pattern over Cloudflare Durable Object SQLite's apparent pattern-length limit.

## Reproduction

On a deployed Agentic Inbox worker, calling the search endpoint with a long subject or query failed consistently:

```sh
GET /api/v1/mailboxes/:mailboxId/search?subject=cf-agentic-inbox-external-inbound-alchang-20260513T233604Z
```

Observed locally against a live deployment:

- 46, 47, and 48 character search values: OK
- 49 and 50 character search values: HTTP 500
- Searching a shorter substring of the same subject: OK

Because the code wraps the value as `%${value}%`, a 49 character value becomes a 51 character `LIKE` pattern.

## Suspected cause

`MailboxDO.#buildSearchConditions()` builds broad `LIKE` conditions for `query`, `from`, `to`, and `subject` using the full value directly. Cloudflare DO SQLite appears to reject `LIKE` patterns above 50 characters.

Relevant path:

```text
workers/durableObject/index.ts
```

## Expected behavior

Long search terms should either work or fail with a clear validation error. They should not produce a server-side 500.

## Potential fix

This looks PR-sized. One small fix is to split long search values into chunks no larger than 48 characters before adding the surrounding `%` wildcards, then AND the chunk predicates together. That keeps each generated `LIKE` pattern at or below 50 characters without silently truncating the user's search.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.