@240xu/dsh-websearch 2.8.2 → 2.8.4

package/README.md

@@ -266,3 +266,12 @@ MIT © 2026 240xu
   exa 漏了——默认关 deepCoverage 也注入 category 收窄结果，与 README 承诺相反。
 - 回归测试 3 条（零结果/limiter 不死锁带 HUNG 超时护栏/exa 双态门控）；
   `createLimiter` 导出供测试。89/89。
+
+## 2.8.3 · Bug 猎场修复第二批（P2×3 + 测试）
+
+- **[P2] 整形空查询早拒**：寒暄独词（"搜索"/"search"/"查询"）被剥空后不再扇出、
+  不入缓存（原来空串共享缓存键 + 落入 all-backends-failed(0) 误导错误）；
+  ZH 寒暄表补裸「搜索」（原 `搜索一下?` 要求带“一”漏掉裸词）。
+- **[P2] CJK 分隔符词内保护**：和/比较/对比 须**任一侧**有空白/标点边界才切——
+  词内裸和（柔和光线/和平精英）不再切断实体；单侧空格的真分隔（"sftp 和面板"）照切。
+- 回归测试 ×4（零结果/limiter 死锁/exa 门控/CJK 保护/空查询拒），91/91。

package/lib/backends/anthropic-like.js

@@ -17,6 +17,7 @@
 
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 /** Attribution header; bumped with the package version. */
 const UA = "dsh-websearch/2.3";
@@ -111,7 +112,7 @@ export function createAnthropicLikeBackend(spec) {
 
       let response;
       try {
-        response = await fetch(endpoint, {
+        response = await egressFetch(endpoint, {
           method: "POST",
           redirect: "error",
           headers: {

package/lib/backends/brave.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applyBraveFilters, normalizeFilters, safeSearchParams } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const BRAVE_ENDPOINT = "https://api.search.brave.com/res/v1/web/search";
 
@@ -46,7 +47,7 @@ export const braveBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers: {
           "X-Subscription-Token": apiKey,

package/lib/backends/ddg.js

@@ -8,6 +8,7 @@
 import { searchAborted, isAbortError, throwIfSearchAborted } from "../util/abort.js";
 import { applyDdgFilters, normalizeFilters } from "../util/filters.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 export const DDG_ENDPOINT = "https://html.duckduckgo.com/html/";
 
@@ -34,7 +35,7 @@ export const ddgBackend = {
 
     let text;
     try {
-      const res = await fetch(DDG_ENDPOINT, {
+      const res = await egressFetch(DDG_ENDPOINT, {
         method: "POST",
         redirect: "error",
         headers: {

package/lib/backends/mojeek.js

@@ -7,6 +7,7 @@
 
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const MOJEEK_ENDPOINT = "https://api.mojeek.com/v1/search";
 
@@ -52,7 +53,7 @@ export const mojeekBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers,
         redirect: "error",

package/lib/backends/openai.js

@@ -12,6 +12,7 @@
 
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const UA = "dsh-websearch/2.3";
 
@@ -67,7 +68,7 @@ export const openaiBackend = {
 
     let response;
     try {
-      response = await fetch(endpoint, {
+      response = await egressFetch(endpoint, {
         method: "POST",
         redirect: "error",
         headers: {

package/lib/backends/searxng.js

@@ -9,6 +9,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applySearxngFilters, normalizeFilters, safeSearchParams } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const DEFAULT_SEARXNG_URL = "https://searx.be";
 
@@ -61,7 +62,7 @@ export const searxngBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers,
         redirect: "error",

package/lib/backends/serper.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applySerperFilters, normalizeFilters } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const SERPER_ENDPOINT = "https://google.serper.dev/search";
 
@@ -46,7 +47,7 @@ export const serperBackend = {
 
     let response;
     try {
-      response = await fetch(baseURL, {
+      response = await egressFetch(baseURL, {
         method: "POST",
         headers: {
           "X-API-KEY": apiKey,

package/lib/backends/tavily.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applyTavilyFilters, normalizeFilters } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const TAVILY_ENDPOINT = "https://api.tavily.com/search";
 
@@ -55,7 +56,7 @@ export const tavilyBackend = {
 
     let response;
     try {
-      response = await fetch(baseURL, {
+      response = await egressFetch(baseURL, {
         method: "POST",
         headers: {
           "Authorization": `Bearer ${apiKey}`,

package/lib/client.js

@@ -171,6 +171,78 @@ window.__ModuleLoader__.load({
 			};
 		}
 
+		/**
+		 * Settings bridge for 0.2.x builds where the legacy `settingsScope`
+		 * client service is gone: the same snapshot/subscribe/set/unset surface
+		 * the card controller expects, backed by this plugin's fenced settings
+		 * route. Writes land in the volatile profile entry the host provider
+		 * resolves from on the next call -- no second settings store.
+		 */
+		class SettingsRoutesBridge {
+			constructor() {
+				this.store = createStore({
+					status: "loading",
+					writable: false,
+					value: undefined,
+					base: undefined,
+					user: undefined,
+					revision: undefined,
+					mode: "routes",
+				});
+			}
+
+			getSnapshot() { return this.store.getSnapshot(); }
+			subscribe(listener) { return this.store.subscribe(listener); }
+
+			accept(payload) {
+				if (payload === null || typeof payload !== "object" || payload.ok !== true || payload.writable === false) {
+					// Keep the card rendered (status ready) but read-only, so the section
+					// explains itself instead of showing an endless loading ellipsis.
+					this.store.set({ status: "ready", writable: false, value: {}, base: undefined, user: undefined, revision: undefined, mode: "routes" });
+					return;
+				}
+				this.store.set({
+					status: "ready",
+					writable: true,
+					value: payload.value,
+					base: payload.base,
+					user: payload.user,
+					revision: payload.revision,
+					mode: "routes",
+				});
+			}
+
+			async load() {
+				try {
+				const response = await fetch("/api/unified-search/settings", { credentials: "same-origin", headers: { accept: "application/json" } });
+				const payload = await response.json().catch(() => undefined);
+				this.accept(response.status === 404 ? undefined : payload);
+				} catch (_noRoutes) {
+				this.accept(undefined);
+				}
+			}
+
+			async write(ops) {
+				const expectedRevision = this.store.getSnapshot().revision;
+				const response = await fetch("/api/unified-search/settings", {
+					method: "POST",
+					credentials: "same-origin",
+					headers: { "content-type": "application/json", accept: "application/json" },
+					// eslint-disable-next-line object-shorthand
+					body: JSON.stringify(expectedRevision === undefined ? { ops } : { ops, expectedRevision }),
+				});
+				const payload = await response.json().catch(() => undefined);
+				if (response.status === 409 || (payload !== undefined && payload.code === "SETTINGS_CONFLICT")) throw new Error("SETTINGS_CONFLICT");
+				if (!response.ok || payload === undefined || payload.ok !== true) {
+					throw new Error(payload !== undefined && payload.error !== undefined ? String(payload.error) : "settings request failed (" + response.status + ")");
+				}
+				this.accept(payload);
+			}
+
+			set(field, value) { return this.write([{ op: "set", path: [field], value }]); }
+			unset(field) { return this.write([{ op: "unset", path: [field] }]); }
+		}
+
 		/**
 		 * Card state machine: reads the bound settings scope snapshot, stages edits,
 		 * writes section fields through scope.set/unset and secrets via credentials.
@@ -247,14 +319,37 @@ window.__ModuleLoader__.load({
 
 			async readCredential(ref) {
 				try {
-					const res = await this.connection.api.credentials.describe({ refs: [ref] });
-					if (!res.result.ok) return;
-					const view = res.result.value.credentials[ref];
-					this.keyState.set(ref, { configured: view?.configured ?? false, writable: view?.writable !== false });
+					let view;
+					if (this.remote !== undefined && this.remote.credentials !== undefined && typeof this.remote.credentials.describe === "function") {
+						// 0.2.x remote face: Record<ref, {configured, writable, source}> behind {ok, value}.
+						const res = await this.remote.credentials.describe([ref]);
+						const record = res !== null && typeof res === "object" && res.value !== undefined ? res.value : res;
+						const byRef = record !== null && typeof record === "object" && record.credentials !== undefined ? record.credentials : record;
+						view = byRef !== null && typeof byRef === "object" ? byRef[ref] : undefined;
+					}
+					if (view === undefined && this.connection !== undefined && this.connection.api !== undefined && this.connection.api.credentials !== undefined) {
+						// Older line: the connection controller's credentials API.
+						const res = await this.connection.api.credentials.describe({ refs: [ref] });
+						if (res?.result?.ok) view = res.result.value.credentials[ref];
+					}
+					if (view === undefined) return;
+					this.keyState.set(ref, { configured: view.configured === true, writable: view.writable !== false });
 				} catch { /* ignore */ }
 				this.republish();
 			}
 
+			async writeCredential(ref, value) {
+				if (this.remote !== undefined && this.remote.credentials !== undefined && typeof this.remote.credentials.set === "function") {
+					await this.remote.credentials.set(ref, value);
+					return;
+				}
+				if (this.connection !== undefined && this.connection.api !== undefined && this.connection.api.credentials !== undefined && typeof this.connection.api.credentials.set === "function") {
+					await this.connection.api.credentials.set({ ref, value });
+					return;
+				}
+				throw new Error("credentials service unavailable");
+			}
+
 			refreshAllCredentials() {
 				for (const b of BACKENDS) if (b.keyEnv) this.readCredential(b.keyEnv);
 			}
@@ -291,7 +386,7 @@ window.__ModuleLoader__.load({
 								backendTimeoutMs: [1000, 120000],
 							};
 							const [lo, hi] = BOUNDS[field] ?? [-Infinity, Infinity];
-							{ this.failed = true; this.failedFields.add(field); continue; }
+							if (!Number.isFinite(num) || num < lo || num > hi) { this.failed = true; this.failedFields.add(field); continue; }
 							await this.scope.set(field, num);
 							doneFields.push(field);
 						} else {
@@ -303,7 +398,7 @@ window.__ModuleLoader__.load({
 						const value = staged.text.trim();
 						if (value !== "") {
 							try {
-								await this.connection.api.credentials.set({ ref, value });
+								await this.writeCredential(ref, value);
 								this.keyState.set(ref, { configured: true, writable: true });
 								doneKeys.push(ref);
 								this.failedKeys.delete(ref);
@@ -424,6 +519,7 @@ window.__ModuleLoader__.load({
 						backend: b,
 						value: state.value[toggleField(b.id)],
 						keyConfigured: true,
+						t: props.t,
 						onChange: (checked) => card.setToggle(b.id, checked),
 					}, b.id)
 				) }),
@@ -433,6 +529,7 @@ window.__ModuleLoader__.load({
 						backend: b,
 						value: state.value[toggleField(b.id)],
 						keyConfigured: !!state.keyState[b.keyEnv]?.configured,
+						t: props.t,
 						onChange: (checked) => card.setToggle(b.id, checked),
 					}, b.id)
 				) }),
@@ -545,27 +642,49 @@ window.__ModuleLoader__.load({
 
 		/**
 		 * Plugin entry: register the card into the settings plugins page.
-		 * Compatibility (compat-audit P0): the settingsScope client service was
-		 * removed in DSH 0.1.7. It stays in `inject` so the fiber still
-		 * activates when the shim supplies it; every access is feature-detected.
+		 * Compatibility: the legacy `settingsScope` client service was removed on
+		 * the 0.2.x line; the card binds whichever data source the build offers
+		 * (see selectBridge) and registers the section unconditionally.
 		 */
-		const inject = ["slots", "locale", "connection", "remote", "settingsScope"];
+		const inject = ["slots", "locale", "connection", "remote"];
+		/**
+		 * Resolve the settings data source for this build, in order:
+		 *  1. the legacy `settingsScope` service (DSH <= 0.1.6 line, or a shim);
+		 *  2. this plugin's own fenced settings routes (0.2.x line, where the
+		 *     client service was removed and the settings shell renders client
+		 *     slot sections only);
+		 *  3. an unavailable bridge -- the section still registers and the card
+		 *     explains itself through its read-only banner.
+		 */
+		function selectBridge(ctx) {
+			try {
+			const scope = ctx.get("settingsScope");
+			if (scope !== undefined && typeof scope.bind === "function") return scope.bind({ namespace: PLUGIN_NS });
+			} catch (_noSettingsScope) { /* fall through to the routes bridge */ }
+			return new SettingsRoutesBridge();
+		}
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register(NS, { zh, en }), "websearch: copy dictionaries");
-			const hasSettingsScope = ctx.get("settingsScope") !== undefined && typeof ctx.settingsScope?.bind === "function";
-			if (!hasSettingsScope) {
-				// DSH >= 0.1.7 without dsh-settings-scope-shim: the settings card
-				// cannot bind its scope. Stop wiring the card instead of hard-
-				// crashing the client fiber; the breadcrumb aids diagnosis.
-				console.warn("[dsh-websearch] settingsScope service unavailable (DSH >= 0.1.7); unified-search settings card disabled. Configure via server settings/cordis config or install dsh-settings-scope-shim.");
-				return;
-			}
+			const bridge = selectBridge(ctx);
+			if (typeof bridge.load === "function") void bridge.load();
 			const controller = new UnifiedSearchCardController(
-				ctx.settingsScope.bind({ namespace: PLUGIN_NS }),
+				bridge,
 				ctx.get("connection"),
 				ctx.get("remote"),
 			);
-			ctx.effect(() => ctx.remote.$on("credentials/updated", () => controller.refreshAllCredentials()), "websearch: credential invalidations");
+			// Credential invalidations: 0.2.x forwards `credentials/reference-updated`;
+			// older lines forwarded `credentials/updated`. Subscribe to whichever
+			// event face this build exposes; a missing face must not abort apply().
+			for (const event of ["credentials/reference-updated", "credentials/updated"]) {
+				try {
+				ctx.effect(() => ctx.remote.$on(event, () => controller.refreshAllCredentials()), "websearch: credential invalidations");
+				} catch (_noEventFace) { /* this build does not forward that event */ }
+			}
+			// Re-read when another client saves this namespace (settings document
+			// revisions travel through the remote event face on 0.2.x).
+			try {
+				ctx.effect(() => ctx.remote.$on("settings/document-updated", () => { if (typeof bridge.load === "function") void bridge.load(); }), "websearch: settings document invalidations");
+			} catch (_noSettingsEvent) { /* settings events unavailable */ }
 			ctx.slots.inject("settings.section", () => ctx.slots.register({
 				name: "settings.section",
 				id: "websearch",

package/lib/health.js

@@ -7,6 +7,8 @@
 // provider's own telemetry truncation) and run through a defensive redaction
 // pass for token-like fragments.
 
+import { rejectionFor } from "./trust.js";
+
 const MAX_ERROR_CHARS = 120;
 
 /** Token-like fragments that must never appear in a health payload. */
@@ -89,6 +91,11 @@ export function registerHealthRoute(ws, deps) {
         res.writeHead(code, { "content-type": "application/json" });
         res.end(JSON.stringify(body));
       };
+      const rejection = rejectionFor(req, typeof deps.getConnection === "function" ? deps.getConnection() : undefined);
+      if (rejection !== undefined) {
+        send(rejection, { ok: false, error: rejection === 503 ? "admission unavailable" : "untrusted request" });
+        return;
+      }
       if (req.method !== "GET" && req.method !== "HEAD") {
         send(405, { ok: false, error: "method not allowed (GET only)" });
         return;

package/lib/history.js

@@ -8,6 +8,7 @@
 
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { rejectionFor } from "./trust.js";
 
 /** Ring-buffer cap (spec: 50). */
 export const HISTORY_MAX_ENTRIES = 50;
@@ -143,18 +144,19 @@ export function toBackendObservability(healthMap, nowMs = Date.now()) {
  *   backends: per-backend last real outcome/latency/breaker state (v2.8.0),
  *   so fallback redundancy is observable without a separate endpoint.
  * POST /api/websearch/history/clear  -> { ok, cleared: true }
- * Both routes sit behind isTrustedApiRequest (loopback Host + same-site).
+ * Both routes sit behind the host connection admission fence (the same
+ * decision the kernel applies to its own /api routes).
  */
-export function registerHistoryRoutes(ws, { getStore, getBackendHealth }) {
+export function registerHistoryRoutes(ws, { getStore, getBackendHealth, getConnection }) {
   if (!ws || typeof ws.register !== "function") return;
   const send = (res, code, body) => {
     res.writeHead(code, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
   };
   const guarded = (handler) => (req, res) => {
-    const fence = isTrustedApiRequest(req);
-    if (fence) {
-      send(res, 403, { ok: false, error: `untrusted request (${fence})` });
+    const rejection = rejectionFor(req, typeof getConnection === "function" ? getConnection() : undefined);
+    if (rejection !== undefined) {
+      send(res, rejection, { ok: false, error: rejection === 503 ? "admission unavailable" : "untrusted request" });
       return;
     }
     handler(req, res);

package/lib/index.js

@@ -37,6 +37,7 @@ import { createUnifiedSearchProvider, getLatestBackendHealth } from "./provider.
 import { registerHealthRoute } from "./health.js";
 import { createSearchCache, CACHE_DEFAULTS } from "./cache.js";
 import { createHistoryStore, registerHistoryRoutes, HISTORY_MAX_ENTRIES } from "./history.js";
+import { registerSettingsRoutes } from "./settings-api.js";
 import { BREAKER_DEFAULTS } from "./breaker.js";
 import os from "node:os";
 import path from "node:path";
@@ -391,6 +392,8 @@ export function resolveStoreDir(env = process.env, fallbackHome = os.homedir())
  */
 export function apply(ctx, config) {
   let current = () => config;
+  /** 0.2.x SettingsForms instance, captured for the browser settings bridge. */
+  let settingsForms;
 
   ctx.inject(["settings"], (settingsCtx) => {
     const settings = settingsCtx.settings;
@@ -404,10 +407,11 @@ export function apply(ctx, config) {
       });
       return;
     }
-    // 0.2.0 SettingsForms line: no installSection; the settings form is
-    // auto-generated from the volatile-marked Config above — no action and no
-    // warning here (the form IS the section; a warning would contradict the
-    // visible UI). Config values still resolve via cordis config.
+    // 0.2.x SettingsForms line: no installSection. Keep the service so the
+    // browser settings card can read/write this profile entry through the
+    // fenced bridge in ./settings-api.js; values keep resolving via cordis
+    // config (the same volatile entry), so there is no second settings store.
+    if (typeof settings?.describe === "function" && typeof settings?.mutate === "function") settingsForms = settings;
   });
 
   // v2.7.0 stores: disk cache + append-only search history, both under
@@ -449,16 +453,33 @@ export function apply(ctx, config) {
   // only reads the settings snapshot + last per-search telemetry — it never
   // probes backends and never touches credential values.
   ctx.inject(["webServer"], (webCtx) => {
+    const getConnection = () => {
+      try {
+        return ctx.get("connection");
+      } catch {
+        return undefined;
+      }
+    };
     registerHealthRoute(webCtx.webServer, {
       resolveOptions: () => resolveOptions(ctx, current()),
       backends: BACKENDS,
       getBackendHealth: getLatestBackendHealth,
+      getConnection,
     });
     // v2.7.0 search history: read-only GET + explicit clear POST.
     // v2.8.0: GET also carries per-backend last-outcome observability.
     registerHistoryRoutes(webCtx.webServer, {
       getStore: () => historyStore,
       getBackendHealth: getLatestBackendHealth,
+      getConnection,
+    });
+    // Settings bridge for the browser card on 0.2.x builds (no legacy
+    // settingsScope service). Fenced by the host connection admission; writes
+    // land in the volatile config entry above.
+    registerSettingsRoutes(webCtx.webServer, {
+      getSettings: () => settingsForms,
+      getConfig: () => Config,
+      getConnection,
     });
   });
 }

package/lib/multiquery.js

@@ -9,7 +9,14 @@
 // Separators per the v2.8 spec: "vs", "and", 比较, 对比, 和 — plus sentence
 // punctuation for the long-query case.
 
-const SEPARATOR_SPLIT_RE = /\s+(?:vs\.?|and)\s+|\s*(?:比较|对比|和)\s*|\s*[、；;。！？!?|]+\s*/i;
+// 2.8.2（P2）：CJK 分隔符必须两侧有空白才切——裸 "和"（无空格）常在词内
+// （柔和/和平/和尚），原无边界写法会把实体拦腰切断
+// （"柔和光线和自然光" → 变体丢 "柔和"；"和平精英" → 切出 "平精英"）。
+// 显式空格分隔的 "A 和 B" 与顿号/标点分隔仍正常切。
+// 2.8.2（P2 定稿）：CJK 分隔符须**任一侧**有空白/标点边界才切——词内裸和
+// （柔和/和平/和尚，两侧都无空白）不切，保住实体；"sftp 和面板"（单侧空格）
+// 这类真分隔照切。
+const SEPARATOR_SPLIT_RE = /\s+(?:vs\.?|and)\s+|\s+(?:比较|对比|和)|(?:比较|对比|和)\s+|\s*[、；;。！？!?|]+\s*/i;
 const COMPLEX_MARK_RE = /(?:\bvs\.?\b|\band\b|比较|对比|和)/i;
 
 /** Sub-query hard cap (original + 2 variants max). */

package/lib/prompting.js

@@ -30,7 +30,7 @@ export const QUERY_MAX_CHARS = 1500;
 const FILLER_PREFIX_RE =
   /^(?:please|pls|kindly|could you(?: please)?|can you(?: please)?|help me(?: to)?|search for|search|look up|google|find me|find|i(?:'d| would)? like to know|tell me|what is|who is|when is|where is|"|「|『)\s*/i;
 const FILLER_PREFIX_RE_ZH =
-  /^(?:请|麻烦|帮我?|帮忙|帮我查一?下|查一?下|查询|搜索一下?|搜一下?|查一下?|帮我找|找一下?|我想知道|请问)/;
+  /^(?:请|麻烦|帮我?|帮忙|帮我查一?下|查一?下|查询|搜索一?下?|搜一下?|查一下?|帮我找|找一下?|我想知道|请问)/;
 
 /**
  * 确定性查询整形：剥离口语前缀（循环多次以处理叠加寒暄）、压缩空白、

package/lib/provider.js

@@ -196,6 +196,15 @@ export function createUnifiedSearchProvider({ ctx, resolveOptions, backends, cac
       // 确定性归一 —— 剥离寒暄前缀、压缩空白、截断到 1500 字符；
       // 专名/版本号/日期原样保留，不改写语义。
       effReq.query = shapeQuery(effReq.query);
+      // 2.8.2（P2）：整形后为空（"搜索"/"search" 等寒暄独词被剥光）→ 早拒。
+      // 不拒会：①空串扇出全部后端 ②不同原始查询共享 "" 缓存键（别名污染）
+      // ③落入 all-backends-failed(0) 的误导错误。
+      if (!effReq.query) {
+        throw new WebError(
+          "unified search: empty query after shaping (the request contained only fillers like \"search\")",
+          "WEB_PROVIDER_ERROR",
+        );
+      }
       if (Object.keys(filters).length > 0) effReq = { ...effReq, filters };
       const maxResults = effReq.maxResults;
       const concurrency = opts.concurrency ?? 6;