cloudflare / cloudflare/agentic-inbox
Potential PR: long search strings can 500 via Durable Object SQLite LIKE pattern limit
- Dominant language
- TypeScript
- Stars
- 7.5k
- Forks
- 964
- PR merge metrics
- No merged PRs in 30d
Description
## Problem
Search requests can return HTTP 500 when the free-text query or field filters are long enough to produce a SQLite `LIKE` pattern over Cloudflare Durable Object SQLite's apparent pattern-length limit.
## Reproduction
On a deployed Agentic Inbox worker, calling the search endpoint with a long subject or query failed consistently:
```sh
GET /api/v1/mailboxes/:mailboxId/search?subject=cf-agentic-inbox-external-inbound-alchang-20260513T233604Z
```
Observed locally against a live deployment:
- 46, 47, and 48 character search values: OK
- 49 and 50 character search values: HTTP 500
- Searching a shorter substring of the same subject: OK
Because the code wraps the value as `%${value}%`, a 49 character value becomes a 51 character `LIKE` pattern.
## Suspected cause
`MailboxDO.#buildSearchConditions()` builds broad `LIKE` conditions for `query`, `from`, `to`, and `subject` using the full value directly. Cloudflare DO SQLite appears to reject `LIKE` patterns above 50 characters.
Relevant path:
```text
workers/durableObject/index.ts
```
## Expected behavior
Long search terms should either work or fail with a clear validation error. They should not produce a server-side 500.
## Potential fix
This looks PR-sized. One small fix is to split long search values into chunks no larger than 48 characters before adding the surrounding `%` wildcards, then AND the chunk predicates together. That keeps each generated `LIKE` pattern at or below 50 characters without silently truncating the user's search.
Contributor guide
Assessment
This issue has not been assessed yet.