feat: metadata search UI in the workspace file browser (#159)

[Zach Dunn (zachdunn)]

Adds a metadata search surface to the web, folded into the existing per-workspace file browser on /account/workspaces. Implements the "Web search UI" follow-up from #159 — the CLI/MCP filter path shipped in #157 is now reachable from the browser.

What's in it

• API — new session-authed GET /me/workspaces/:name/files/search?meta.<key>=<value> (me.ts). Reuses the shipped validateMetadataFilters/findObjectsByMetadata helpers; AND-of-equality semantics; member-gated; communal → empty; caps at 100 with a truncated flag.
• Web — pure helpers (workspace-search-url.ts: filter validation + URL sync), a searchWorkspaceFiles API client, MetadataSearchResults (filter chips + results list with thumbnail/filename/metadata/open+copy), and a WorkspaceFiles wrapper that switches the browser between folder-browse and search. AccountFileBrowser is untouched.

Design & plan

• Spec: docs/superpowers/specs/2026-07-14-metadata-search-ui-design.md
• Plan: docs/superpowers/plans/2026-07-14-metadata-search-ui.md

Scope / accepted tradeoffs

• Per-workspace only; no cross-workspace search; no key/value autocomplete (no distinct-values endpoint).
• Results carry no visibility annotation (it isn't in the D1 index — documented Per-file metadata: post-ship follow-ups (#157/#158) #159 caveat); search results have no visibility toggle by design.

Testing

• API 346/346, web 92/92 green; typecheck clean.
• Route matching verified by in-process Hono tests; the route shape (:name + static files/search) is not the fix: metadata endpoints 404 on real keys in production #158 {.+}-suffix trap and matches deployed siblings (file-url, files/visibility, file-browser).
• ⚠️ Not yet done: signed-in live-worker clickthrough — blocked locally by the prod-auth wall (no .dev.vars). Please verify on the deploy preview: add a filter (e.g. gh.repo), confirm results render and GET .../files/search returns 200.

Built and reviewed task-by-task plus a whole-branch review; the one Important finding (unbounded fetch) was fixed in 627725e.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7ed003d8-796a-421b-9583-5c0d27f9d1ef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/uploads-next-priority-a0690f

---

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-web	627725e	Commit Preview URL Branch Preview URL	Jul 14 2026, 02:39 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-api	627725e	Commit Preview URL Branch Preview URL	Jul 14 2026, 02:40 PM