Meme Search v2.3.0: search beyond the web app

Your self-hosted meme collection can now meet you where you work. This release
adds a documented, token-authenticated Search API v1, a dependency-free local
CLI, and an experimental unpacked Chromium popup. Together they make it
possible to search and retrieve memes without opening the web app—or granting
an integration direct access to PostgreSQL, Docker internals, or filesystem
paths.

Security boundary: official support remains loopback-only. API v1 is
read-only, and its bearer tokens do not authenticate the web UI or settings.
Do not expose the app directly to a public network.

Start here

• Search API guide and OpenAPI contract
• Dependency-free Python CLI
• Experimental unpacked Chromium popup
• 16-second app-and-CLI demo
• Propose a community integration

What is included

• A stable, additive, permanently read-only /api/v1 contract for keyword or
  vector search, metadata, tags, and authorized original-media streaming.
• Hashed, scoped, expiring, individually revocable tokens. Create them in
  Settings → API tokens or with the included Rails tasks.
• A Python 3 CLI with no third-party runtime dependencies. It searches, emits
  human-readable or JSON results, and fetches media with redirect, size, and
  overwrite protections.
• An experimental unpacked Chromium popup for loopback search, explicit copy,
  and download actions. It is not published to an extension store.
• Shared client-conformance fixtures, OpenAPI validation, migration coverage,
  security checks, and CI coverage for both included clients.
• An optional UI-independent relevance evaluator. Its checked-in dataset is a
  replace-me template, not a benchmark result or search-quality claim.

Upgrade

Back up your database, then update and apply the token-table migration:

docker compose pull
docker compose up -d
docker compose exec meme_search bin/rails db:migrate:status

The status output should show 20260728000000 Create api tokens as up.
Existing libraries and search behavior remain available through the web app;
integrations need a newly created token with only the read scopes they use.

We would love to see what this unlocks: launchers, shell pickers, local
Discord/Slack/Matrix companions, mobile shortcuts, and other conversation
workflows are all welcome—provided they preserve the documented local,
read-only security boundary.