@omnicross/daemon 0.2.0 → 0.3.0

package/dist/cli.js

@@ -1139,8 +1139,16 @@ ${turn.responseBody}`);
 import { parseArgs as parseArgs2 } from "util";
 import {
   DEFAULT_IMAGES_SERVER_CONFIG as DEFAULT_IMAGES_SERVER_CONFIG2,
-  loadServerConfig as loadServerConfig3
+  loadServerConfig as loadServerConfig4
 } from "@omnicross/core/outbound-api";
+import {
+  apiSearchContributions as apiSearchContributions3
+} from "@omnicross/core/search/api";
+import { builtinHttpSearchContributions as builtinHttpSearchContributions4 } from "@omnicross/core/search/http";
+import {
+  DEFAULT_SEARCH_FRONTEND_MODES,
+  SEARCH_FRONTEND_NAMES
+} from "@omnicross/core/search";
 
 // src/bootstrap.ts
 import { accessSync, constants as fsConstants, existsSync as existsSync29, mkdirSync as mkdirSync9 } from "fs";
@@ -1155,7 +1163,8 @@ import {
   DEFAULT_ACCOUNT_PROBE,
   DEFAULT_OUTBOUND_PORT,
   getOutboundApiServer,
-  normalizeServerConfig as normalizeServerConfig2
+  normalizeServerConfig as normalizeServerConfig2,
+  validateSearchServerConfig as validateSearchServerConfig2
 } from "@omnicross/core/outbound-api";
 import { setSubscriptionRegistryForOutbound } from "@omnicross/core/outbound-api/subscriptionRegistryPort";
 import { getSharedAccountHealth as getSharedAccountHealth4 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
@@ -2012,14 +2021,16 @@ import http from "http";
 import {
   createNamedKey,
   DEFAULT_IMAGES_SERVER_CONFIG,
+  DEFAULT_SEARCH_SERVER_CONFIG as DEFAULT_SEARCH_SERVER_CONFIG2,
   effectiveOutboundPermissions as effectiveOutboundPermissions2,
   gatewayBindingToEndpointConfig,
   isKindMappedEndpoint,
-  loadServerConfig as loadServerConfig2,
+  loadServerConfig as loadServerConfig3,
   mergeServerConfig,
   normalizeProxyConfig,
   saveServerConfig,
-  validateOutboundPermissions
+  validateOutboundPermissions,
+  validateSearchServerConfig
 } from "@omnicross/core/outbound-api";
 import {
   IMAGE_CAPABILITY_UNAVAILABLE_REASONS
@@ -4585,6 +4596,510 @@ async function handleDashboard(deps) {
   return { status: 200, body: summary };
 }
 
+// src/admin/searchAdminApi.ts
+import { DEFAULT_SEARCH_SERVER_CONFIG, loadServerConfig } from "@omnicross/core/outbound-api";
+import { apiSearchContributions as apiSearchContributions2 } from "@omnicross/core/search/api";
+import { builtinHttpSearchContributions as builtinHttpSearchContributions3, createSearchHttpTransport as createSearchHttpTransport2 } from "@omnicross/core/search/http";
+import { createSearchRuntime as createSearchRuntime2 } from "@omnicross/core/search";
+
+// src/search/searchDoctorProjection.ts
+import { toSearchErrorShape } from "@omnicross/contracts/search-types";
+import {
+  JINA_CAPABILITIES,
+  SEARXNG_CAPABILITIES,
+  TAVILY_CAPABILITIES,
+  ZHIPU_CAPABILITIES
+} from "@omnicross/core/search/api";
+import { builtinHttpSearchContributions } from "@omnicross/core/search/http";
+var API_DOCTOR_PROVIDERS = [
+  {
+    id: "tavily",
+    capabilities: TAVILY_CAPABILITIES,
+    configured: (configs) => configs.tavily !== void 0,
+    missingReason: "no API key configured"
+  },
+  {
+    id: "jina",
+    capabilities: JINA_CAPABILITIES,
+    configured: (configs) => configs.jina !== void 0,
+    // Honest about the asymmetry: Jina CAN run keyless, but a provider nobody
+    // asked for is still not enabled.
+    missingReason: "not configured (Jina can run without a key, but must be enabled explicitly)"
+  },
+  {
+    id: "searxng",
+    capabilities: SEARXNG_CAPABILITIES,
+    configured: (configs) => configs.searxng !== void 0,
+    missingReason: "no API host configured"
+  },
+  {
+    id: "zhipu",
+    capabilities: ZHIPU_CAPABILITIES,
+    configured: (configs) => configs.zhipu !== void 0,
+    missingReason: "no API key configured"
+  },
+  {
+    id: "z.ai",
+    capabilities: ZHIPU_CAPABILITIES,
+    configured: (configs) => configs["z.ai"] !== void 0,
+    missingReason: "no API key configured"
+  }
+];
+function buildSearchDoctorSnapshot(contributions = builtinHttpSearchContributions(), apiConfigs) {
+  const rows = contributions.map((contribution) => ({
+    providerId: contribution.id,
+    source: contribution.source,
+    kind: contribution.kind,
+    capabilities: contribution.capabilities
+  }));
+  if (apiConfigs === void 0) return rows;
+  for (const provider of API_DOCTOR_PROVIDERS) {
+    if (provider.configured(apiConfigs)) continue;
+    rows.push({
+      providerId: provider.id,
+      source: "builtin",
+      kind: "api",
+      capabilities: provider.capabilities,
+      status: "unconfigured",
+      reason: provider.missingReason
+    });
+  }
+  return rows;
+}
+var SEARCH_DOCTOR_QUERY = "MDN HTTP headers documentation";
+function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
+  if (outcome.kind === "results") {
+    if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
+    return {
+      providerId,
+      status: "degraded",
+      checkedAt,
+      reason: "reachable, but the engine returned no usable results (possible partial drift)"
+    };
+  }
+  const error = toSearchErrorShape(outcome.error);
+  const stage = error.details?.stage;
+  const { status, reason } = classifySearchFailure(stage, error.code);
+  return { providerId, status, checkedAt, reason, error };
+}
+function classifySearchFailure(stage, code) {
+  if (stage === "challenge") {
+    return { status: "blocked", reason: "the engine served a bot challenge instead of results" };
+  }
+  if (stage === "trust") {
+    return {
+      status: "blocked",
+      reason: "the engine served a page that failed the anti-decoy trust check"
+    };
+  }
+  if (code === "policy_denied") {
+    return {
+      status: "blocked",
+      reason: "the egress policy refused the request target"
+    };
+  }
+  if (code === "parse_failed") {
+    return {
+      status: "failed",
+      reason: "the response was not recognizable as a search result page (parser drift suspected)"
+    };
+  }
+  if (code === "timeout") {
+    return { status: "failed", reason: "the request exceeded its time budget" };
+  }
+  return { status: "failed", reason: `the request failed (${code})` };
+}
+async function runSearchLiveChecks(contributions, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+  const diagnostics = [];
+  for (const contribution of contributions) {
+    try {
+      const results = await contribution.provider.search(SEARCH_DOCTOR_QUERY, { maxResults: 5 });
+      diagnostics.push(
+        classifyLiveSearchOutcome(contribution.id, { kind: "results", count: results.length }, now())
+      );
+    } catch (error) {
+      diagnostics.push(classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, now()));
+    }
+  }
+  return diagnostics;
+}
+
+// src/search/SearchAssembly.ts
+import { resolveUpstreamDispatcher } from "@omnicross/core/pipeline/upstreamFetch";
+import { createSearchRuntime } from "@omnicross/core/search";
+import { apiSearchContributions } from "@omnicross/core/search/api";
+import {
+  builtinHttpSearchContributions as builtinHttpSearchContributions2,
+  createSearchHttpTransport
+} from "@omnicross/core/search/http";
+function searchEgressPolicyFrom(config) {
+  const hosts = config.egress.allowedPrivateHosts;
+  return hosts.length > 0 ? { allowedPrivateHosts: [...hosts] } : {};
+}
+function searchPolicyFrom(config) {
+  const { preferred, allowed, fallbackEnabled, maxAttempts } = config.policy;
+  return {
+    ...preferred !== void 0 ? { preferred } : {},
+    ...allowed !== void 0 ? { allowed: [...allowed] } : {},
+    fallbackEnabled,
+    ...maxAttempts !== void 0 ? { maxAttempts } : {}
+  };
+}
+function resolveSearchUpstreamDispatcher(url) {
+  return resolveUpstreamDispatcher({ url });
+}
+var searchUpstreamProxyConfig = createUpstreamProxyResolver();
+function resolveSearchUpstreamProxyConfig(url) {
+  return searchUpstreamProxyConfig({ url });
+}
+function searchContributionsFrom(config) {
+  return [
+    ...builtinHttpSearchContributions2(
+      createSearchHttpTransport({
+        resolveProxyDispatcher: resolveSearchUpstreamDispatcher,
+        resolveProxyConfig: resolveSearchUpstreamProxyConfig
+      })
+    ),
+    ...apiSearchContributions(config.providers, {
+      egressPolicy: searchEgressPolicyFrom(config),
+      resolveProxyDispatcher: resolveSearchUpstreamDispatcher
+    })
+  ];
+}
+function buildSearchRuntime(config, options = {}) {
+  const logger = options.logger ?? null;
+  return createSearchRuntime({
+    contributions: options.contributions ?? searchContributionsFrom(config),
+    policy: searchPolicyFrom(config),
+    ...logger ? {
+      onEvent: (event) => {
+        logger.debug(`[search] ${formatSearchEvent(event)}`);
+      }
+    } : {}
+  });
+}
+function formatSearchEvent(event) {
+  const parts = [
+    `type=${event.type}`,
+    `request=${event.requestId}`,
+    `queryHash=${event.queryHash}`,
+    `durationMs=${event.durationMs}`
+  ];
+  if ("providerId" in event && event.providerId !== void 0) {
+    parts.push(`provider=${event.providerId}`);
+  }
+  if ("outcome" in event && event.outcome !== void 0) parts.push(`outcome=${event.outcome}`);
+  if ("errorCode" in event && event.errorCode !== void 0) parts.push(`error=${event.errorCode}`);
+  if ("resultCount" in event && event.resultCount !== void 0) {
+    parts.push(`results=${event.resultCount}`);
+  }
+  if ("fallbackCount" in event && event.fallbackCount !== void 0) {
+    parts.push(`fallbacks=${event.fallbackCount}`);
+  }
+  return parts.join(" ");
+}
+
+// src/admin/searchAdminApi.ts
+var KEYLESS_HTTP_PROVIDER_IDS = /* @__PURE__ */ new Set(["http-bing", "http-duckduckgo"]);
+var API_PROVIDER_IDS = /* @__PURE__ */ new Set([
+  "tavily",
+  "jina",
+  "searxng",
+  "zhipu",
+  "z.ai"
+]);
+var SEARCH_QUERY_MAX_CODE_UNITS = 256;
+var QUERY_CONTROL_CHARS = /[\u0000-\u001f\u007f]/u;
+var SEARCH_RESULT_FIELD_CAPS = { title: 512, url: 2048, content: 1024 };
+var SEARCH_QUERY_MAX_RESULTS = 5;
+function sanitizeResultField(value, cap) {
+  const text = typeof value === "string" ? value : value === null || value === void 0 ? "" : String(value);
+  return text.replace(/[\u0000-\u001f\u007f]/gu, "").slice(0, cap);
+}
+function writeJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeErr(res, status, message) {
+  writeJson(res, status, { error: { type: "admin_api_error", message } });
+}
+var SEARCH_MAX_BODY_BYTES = 64 * 1024;
+var SearchBodyTooLargeError = class extends Error {
+};
+async function readJsonBody2(req) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > SEARCH_MAX_BODY_BYTES) throw new SearchBodyTooLargeError("request body is too large");
+    chunks.push(buffer);
+  }
+  const raw = Buffer.concat(chunks).toString("utf8");
+  if (!raw.trim()) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function readBodyOrReject(req, res) {
+  try {
+    return await readJsonBody2(req);
+  } catch (error) {
+    if (error instanceof SearchBodyTooLargeError) {
+      writeErr(res, 400, error.message);
+      return void 0;
+    }
+    throw error;
+  }
+}
+async function handleSearchAdmin(req, res, method, rest, deps) {
+  if (rest.length === 1 && rest[0] === "diagnostics") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "GET") {
+      return writeErr(res, 405, `method ${method} not allowed on search diagnostics`);
+    }
+    return handleSearchDiagnostics(res, deps);
+  }
+  if (rest.length === 1 && rest[0] === "test") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "POST") {
+      return writeErr(res, 405, `method ${method} not allowed on search test`);
+    }
+    return handleSearchTest(req, res, deps);
+  }
+  if (rest.length === 1 && rest[0] === "query") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "POST") {
+      return writeErr(res, 405, `method ${method} not allowed on search query`);
+    }
+    return handleSearchQuery(req, res, deps);
+  }
+  return writeErr(res, 404, `unknown search route '/${rest.join("/")}'`);
+}
+async function handleSearchDiagnostics(res, deps) {
+  const status = deps.searchStatus;
+  const persisted = await loadServerConfig(deps.settingsStore);
+  const search = persisted.search ?? DEFAULT_SEARCH_SERVER_CONFIG;
+  const rows = buildSearchDoctorSnapshot(
+    status.runtime.listProviders(),
+    search.providers
+  );
+  const snapshot = {
+    rows,
+    modes: {
+      // codex is read from the LIVE config per request — an admin PUT has
+      // already applied. responses/anthropic were captured at bootstrap.
+      codex: search.modes.codex,
+      responses: status.modes.responses,
+      anthropic: status.modes.anthropic
+    },
+    applySemantics: { codex: "immediate", rest: "restart" }
+  };
+  return writeJson(res, 200, { diagnostics: snapshot });
+}
+function persistedSearchContributions(search, fetchImpl) {
+  if (fetchImpl) {
+    const egressPolicy = searchEgressPolicyFrom(search);
+    return [
+      ...builtinHttpSearchContributions3(
+        createSearchHttpTransport2({ fetch: fetchImpl, egressPolicy })
+      ),
+      ...apiSearchContributions2(search.providers, { egressPolicy, fetchImpl })
+    ];
+  }
+  return searchContributionsFrom(search);
+}
+async function handleSearchTest(req, res, deps) {
+  const status = deps.searchStatus;
+  const body = await readBodyOrReject(req, res);
+  if (body === void 0) return;
+  const providerId = body["providerId"];
+  if (typeof providerId !== "string" || providerId.length === 0) {
+    return writeErr(res, 400, "providerId must be a non-empty string");
+  }
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && !API_PROVIDER_IDS.has(providerId)) {
+    return writeErr(res, 404, `unknown search provider '${providerId}'`);
+  }
+  const persisted = await loadServerConfig(deps.settingsStore);
+  const search = persisted.search ?? DEFAULT_SEARCH_SERVER_CONFIG;
+  const providers = search.providers;
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const fetchImpl = status.testFetch;
+  const contributions = persistedSearchContributions(search, fetchImpl);
+  const contribution = contributions.find((c) => c.id === providerId);
+  if (!contribution) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const results = await contribution.provider.search(SEARCH_DOCTOR_QUERY, { maxResults: 5 });
+    const diagnostic = classifyLiveSearchOutcome(
+      contribution.id,
+      { kind: "results", count: results.length },
+      checkedAt
+    );
+    const response = { diagnostic, resultCount: results.length };
+    return writeJson(res, 200, { result: response });
+  } catch (error) {
+    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const response = { diagnostic };
+    return writeJson(res, 200, { result: response });
+  }
+}
+async function handleSearchQuery(req, res, deps) {
+  const status = deps.searchStatus;
+  const body = await readBodyOrReject(req, res);
+  if (body === void 0) return;
+  const providerId = body["providerId"];
+  if (typeof providerId !== "string" || providerId.length === 0) {
+    return writeErr(res, 400, "providerId must be a non-empty string");
+  }
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && !API_PROVIDER_IDS.has(providerId)) {
+    return writeErr(res, 404, `unknown search provider '${providerId}'`);
+  }
+  const query2 = body["query"];
+  if (typeof query2 !== "string" || query2.trim().length === 0) {
+    return writeErr(res, 400, "query must be a non-empty string");
+  }
+  if (query2.length > SEARCH_QUERY_MAX_CODE_UNITS) {
+    return writeErr(res, 400, `query must be at most ${SEARCH_QUERY_MAX_CODE_UNITS} characters`);
+  }
+  if (QUERY_CONTROL_CHARS.test(query2)) {
+    return writeErr(res, 400, "query must not contain control characters");
+  }
+  const persisted = await loadServerConfig(deps.settingsStore);
+  const search = persisted.search ?? DEFAULT_SEARCH_SERVER_CONFIG;
+  const providers = search.providers;
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const fetchImpl = status.testFetch;
+  const runtime = createSearchRuntime2({
+    contributions: persistedSearchContributions(search, fetchImpl),
+    policy: {
+      ...searchPolicyFrom(search),
+      // The panel always walks: it answers "does a search WORK for this
+      // operator", not "does this one provider behave" — that is `/test`'s
+      // job. The persisted policy's allowlist still bounds the walk.
+      fallbackEnabled: true,
+      preferred: providerId
+    }
+  });
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const orchestrated = await runtime.search({ query: query2, options: { maxResults: 5 } });
+    const results = orchestrated.results;
+    const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
+      title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
+      url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
+      content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
+    }));
+    const diagnostic = sanitized.length === 0 ? { providerId: orchestrated.providerId, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      orchestrated.providerId,
+      { kind: "results", count: sanitized.length },
+      checkedAt
+    );
+    const response = {
+      diagnostic,
+      providerUsed: orchestrated.providerId,
+      fallbackCount: orchestrated.fallbackCount,
+      resultCount: sanitized.length,
+      results: sanitized
+    };
+    return writeJson(res, 200, { result: response });
+  } catch (error) {
+    const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
+    const response = { diagnostic };
+    return writeJson(res, 200, { result: response });
+  }
+}
+
+// src/admin/searchAdminView.ts
+var API_KEY_PROVIDERS = /* @__PURE__ */ new Set(["tavily", "jina", "zhipu", "z.ai"]);
+var BASIC_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["searxng"]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function redactSearchServerConfig(search) {
+  const providers = {};
+  for (const [id, raw] of Object.entries(search.providers)) {
+    const entry = raw;
+    const view = {};
+    if (entry.apiHost !== void 0) view.apiHost = entry.apiHost;
+    if (entry.basicAuthUsername !== void 0) view.basicAuthUsername = entry.basicAuthUsername;
+    if (API_KEY_PROVIDERS.has(id)) {
+      view.apiKeyConfigured = typeof entry.apiKey === "string" && entry.apiKey.length > 0;
+    }
+    if (BASIC_AUTH_PROVIDERS.has(id)) {
+      view.basicAuthPasswordConfigured = typeof entry.basicAuthPassword === "string" && entry.basicAuthPassword.length > 0;
+    }
+    providers[id] = view;
+  }
+  return {
+    modes: search.modes,
+    providers,
+    egress: { allowedPrivateHosts: [...search.egress.allowedPrivateHosts] },
+    policy: { ...search.policy, ...search.policy.allowed ? { allowed: [...search.policy.allowed] } : {} }
+  };
+}
+function storedSecrets(current, id) {
+  const entry = current.providers[id];
+  if (!entry) return {};
+  const out = {};
+  if (typeof entry.apiKey === "string" && entry.apiKey.length > 0) out.apiKey = entry.apiKey;
+  if (typeof entry.basicAuthPassword === "string" && entry.basicAuthPassword.length > 0) {
+    out.basicAuthPassword = entry.basicAuthPassword;
+  }
+  return out;
+}
+function resolveSecretField(entry, field, stored) {
+  if (!(field in entry)) {
+    if (stored !== void 0) entry[field] = stored;
+    return;
+  }
+  const value = entry[field];
+  if (value === null) {
+    delete entry[field];
+    return;
+  }
+  if (typeof value === "string" && value.trim().length > 0) return;
+  if (stored !== void 0) entry[field] = stored;
+  else delete entry[field];
+}
+function preserveSearchSecrets(incoming, current) {
+  if (!isRecord(incoming)) return incoming;
+  const section = { ...incoming };
+  const providersValue = section["providers"];
+  if (!isRecord(providersValue)) return section;
+  const providers = {};
+  for (const [id, entryValue] of Object.entries(providersValue)) {
+    if (!isRecord(entryValue)) {
+      providers[id] = entryValue;
+      continue;
+    }
+    const entry = { ...entryValue };
+    delete entry["apiKeyConfigured"];
+    delete entry["basicAuthPasswordConfigured"];
+    const stored = storedSecrets(current, id);
+    resolveSecretField(entry, "apiKey", stored.apiKey);
+    resolveSecretField(entry, "basicAuthPassword", stored.basicAuthPassword);
+    providers[id] = entry;
+  }
+  section["providers"] = providers;
+  return section;
+}
+
 // src/admin/keyPolicyBody.ts
 function parseKeyPolicyBody(body) {
   const policy = {};
@@ -4647,7 +5162,7 @@ function parseKeyPolicyBody(body) {
 var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
 var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
 var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
-function isRecord(value) {
+function isRecord2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function nonBlank(value) {
@@ -4667,7 +5182,7 @@ function validateGatewayBindingsSegment(patch) {
   const ids = /* @__PURE__ */ new Set();
   raw.forEach((entry, index) => {
     const path2 = `bindings[${index}]`;
-    if (!isRecord(entry)) {
+    if (!isRecord2(entry)) {
       errors.push(`${path2} must be an object`);
       return;
     }
@@ -4696,12 +5211,12 @@ function validateGatewayBindingsSegment(patch) {
       } else if (entry.modelMappings.length > 100) {
         errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
       } else if (entry.modelMappings.some(
-        (mapping) => !isRecord(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+        (mapping) => !isRecord2(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
       )) {
         errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
       }
     }
-    if (!isRecord(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+    if (!isRecord2(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
       errors.push(`${path2}.target is invalid`);
     } else {
       if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
@@ -4716,7 +5231,7 @@ function validateGatewayBindingsSegment(patch) {
       }
     }
     if (entry.modelMap !== void 0) {
-      if (!isRecord(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+      if (!isRecord2(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
         errors.push(`${path2}.modelMap must contain string values`);
       }
     }
@@ -4737,19 +5252,19 @@ function validateGatewayBindingsSegment(patch) {
 import {
   generateVoucherCode,
   hashVoucherCode,
-  loadServerConfig,
+  loadServerConfig as loadServerConfig2,
   newVoucherId,
   toVoucherInfo,
   voucherCodePrefix
 } from "@omnicross/core/outbound-api";
-function writeJson(res, status, body) {
+function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function writeErr(res, status, message) {
-  writeJson(res, status, { error: { type: "voucher_error", message } });
+function writeErr2(res, status, message) {
+  writeJson2(res, status, { error: { type: "voucher_error", message } });
 }
-function readJsonBody2(req) {
+function readJsonBody3(req) {
   return new Promise((resolve11, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
@@ -4800,26 +5315,26 @@ function parseVoucherCreateBody(body) {
   return { ok: true, input };
 }
 async function voucherEnabled(deps) {
-  const config = await loadServerConfig(deps.settingsStore);
+  const config = await loadServerConfig2(deps.settingsStore);
   return config.voucher?.enabled === true;
 }
 async function handleVoucher(req, res, method, rest, deps) {
   const voucherDb = deps.voucherDb;
-  if (!voucherDb) return writeErr(res, 501, "Voucher feature is not available");
+  if (!voucherDb) return writeErr2(res, 501, "Voucher feature is not available");
   if (method === "GET" && rest.length === 0) {
     const rows = await voucherDb.voucherList();
-    return writeJson(res, 200, { vouchers: rows.map(toVoucherInfo) });
+    return writeJson2(res, 200, { vouchers: rows.map(toVoucherInfo) });
   }
   if (method === "POST" && rest.length === 0) {
-    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     let body;
     try {
-      body = await readJsonBody2(req);
+      body = await readJsonBody3(req);
     } catch {
-      return writeErr(res, 400, "Invalid JSON in request body");
+      return writeErr2(res, 400, "Invalid JSON in request body");
     }
     const parsed = parseVoucherCreateBody(body);
-    if (!parsed.ok) return writeErr(res, 400, parsed.message);
+    if (!parsed.ok) return writeErr2(res, 400, parsed.message);
     const code = generateVoucherCode();
     const created = await voucherDb.voucherCreate({
       id: newVoucherId(),
@@ -4827,7 +5342,7 @@ async function handleVoucher(req, res, method, rest, deps) {
       codePrefix: voucherCodePrefix(code),
       ...parsed.input
     });
-    return writeJson(res, 201, {
+    return writeJson2(res, 201, {
       id: created.id,
       codePrefix: created.codePrefix,
       type: created.type,
@@ -4838,11 +5353,11 @@ async function handleVoucher(req, res, method, rest, deps) {
   }
   const id = rest[0];
   if (method === "POST" && id && rest[1] === "revoke") {
-    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     const ok = await voucherDb.voucherRevokeCas(id, Date.now());
-    return writeJson(res, ok ? 200 : 409, { ok });
+    return writeJson2(res, ok ? 200 : 409, { ok });
   }
-  return writeErr(res, 405, `method ${method} not allowed on voucher`);
+  return writeErr2(res, 405, `method ${method} not allowed on voucher`);
 }
 
 // src/admin/webhookConfigBody.ts
@@ -5756,12 +6271,12 @@ async function handlePricingResolveConflicts(body, deps) {
 }
 
 // src/admin/accountAllowanceApi.ts
-function writeJson2(res, status, body) {
+function writeJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeError2(res, status, message) {
-  writeJson2(res, status, { error: { type: "account_allowance_error", message } });
+  writeJson3(res, status, { error: { type: "account_allowance_error", message } });
 }
 function readJson2(req) {
   return new Promise((resolve11, reject) => {
@@ -5794,7 +6309,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (!service.getSchedulingStatus) {
       return writeError2(res, 501, "allowance scheduling diagnostics are not available");
     }
-    return writeJson2(res, 200, { scheduling: service.getSchedulingStatus() });
+    return writeJson3(res, 200, { scheduling: service.getSchedulingStatus() });
   }
   if (method === "GET") {
     const params = query(req);
@@ -5803,7 +6318,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (providerId === null) return writeError2(res, 400, "providerId must be claude or codex");
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
-    return writeJson2(res, 200, { allowances });
+    return writeJson3(res, 200, { allowances });
   }
   if (method === "POST" && rest[0] === "refresh") {
     const body = await readJson2(req);
@@ -5818,7 +6333,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (accountId && allowances.length === 0) {
       return writeError2(res, 404, `Claude account '${accountId}' not found`);
     }
-    return writeJson2(res, 200, { allowances });
+    return writeJson3(res, 200, { allowances });
   }
   return writeError2(res, 405, `method ${method} not allowed on account allowances`);
 }
@@ -5837,7 +6352,7 @@ function readBody(req) {
     req.on("error", reject);
   });
 }
-async function readJsonBody3(req) {
+async function readJsonBody4(req) {
   const raw = await readBody(req);
   if (!raw.trim()) return {};
   try {
@@ -5847,12 +6362,12 @@ async function readJsonBody3(req) {
     return {};
   }
 }
-function writeJson3(res, status, body) {
+function writeJson4(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeJsonError(res, status, message) {
-  writeJson3(res, status, { error: { type: "admin_api_error", message } });
+  writeJson4(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -5959,6 +6474,8 @@ async function handleAdminApi(req, res, path2, deps) {
         return await handleServer(req, res, method, deps);
       case "images":
         return await handleImages(res, method, rest, deps);
+      case "search":
+        return await handleSearchAdmin(req, res, method, rest, deps);
       case "accounts":
         return await handleAccounts(req, res, method, rest, deps);
       case "cli":
@@ -5992,7 +6509,7 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson3(res, result.status, result.body);
+  writeJson4(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
@@ -6001,13 +6518,13 @@ async function handleUsage(req, res, method, rest, deps) {
 async function handleDashboardRoute(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
   const result = await handleDashboard(deps);
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
     if (method === "GET") return writeResult(res, await handlePricingList(deps));
     if (method === "PUT") {
-      return writeResult(res, await handlePricingUpsert(await readJsonBody3(req), deps));
+      return writeResult(res, await handlePricingUpsert(await readJsonBody4(req), deps));
     }
     if (method === "DELETE") {
       return writeResult(res, await handlePricingDelete(requestQuery(req), deps));
@@ -6018,7 +6535,7 @@ async function handlePricing(req, res, method, rest, deps) {
     return writeResult(res, await handlePricingFetchLatest(deps));
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "resolve-conflicts") {
-    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody3(req), deps));
+    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody4(req), deps));
   }
   return writeJsonError(res, 404, `unknown pricing route '${rest.join("/")}'`);
 }
@@ -6032,15 +6549,15 @@ function migrationDeps(deps) {
 }
 async function handleMigrationExport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -6071,13 +6588,13 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
     if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson3(res, 200, { apiKey: row.apiKey ?? "" });
+    return writeJson4(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson3(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson4(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const provider = parseProviderInput(body, void 0);
     if (!provider) return writeJsonError(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
     if (cfg.providers.some((p) => p.id === provider.id)) {
@@ -6085,25 +6602,25 @@ async function handleProviders(req, res, method, rest, deps) {
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson3(res, 201, { provider: toProviderView(provider) });
+    return writeJson4(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (method === "PUT") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const existing = cfg.providers[idx];
     const updated = parseProviderInput(body, existing);
     if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson3(res, 200, { provider: toProviderView(updated) });
+    return writeJson4(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson3(res, 200, { ok: true });
+    return writeJson4(res, 200, { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on providers`);
 }
@@ -6112,7 +6629,7 @@ function persistProviders(cfg, deps) {
   deps.llmConfig.reload(cfg);
 }
 async function handleProviderReorder(req, res, cfg, deps) {
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const rawOrder = body["order"];
   if (!Array.isArray(rawOrder)) {
     return writeJsonError(res, 400, "reorder requires { order: string[] }");
@@ -6136,14 +6653,14 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson3(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson4(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 async function handleDiscoverModels(res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (row.apiFormat !== "openai" && row.apiFormat !== "openai-response") {
-    return writeJson3(res, 200, { models: [], unsupportedFormat: true });
+    return writeJson4(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -6160,32 +6677,32 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson3(res, 200, { models });
+    return writeJson4(res, 200, { models });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson3(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson4(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
   if (!model) return writeJsonError(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson3(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson4(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson3(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson4(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
   let url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
@@ -6224,9 +6741,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson3(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson4(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -6234,7 +6751,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson3(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson4(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -6275,7 +6792,7 @@ async function handleProviderKeys(res, id, cfg, deps) {
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parsePoolKeyInput(body, existing) {
   const out = {};
@@ -6294,7 +6811,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const parsed = parsePoolKeyInput(body);
   if (!parsed.apiKey) return writeJsonError(res, 400, "add requires a non-empty apiKey");
   const keyId = `key-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -6306,7 +6823,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -6316,7 +6833,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const existing = row.apiKeys[keyIdx];
   const parsed = parsePoolKeyInput(body, existing);
   const entry = { id: keyId, apiKey: parsed.apiKey || existing.apiKey };
@@ -6326,7 +6843,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -6340,7 +6857,7 @@ async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -6350,11 +6867,11 @@ async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -6540,13 +7057,13 @@ function handlePresets(res, method) {
     website: p.website,
     modelsEndpoint: p.modelsEndpoint
   }));
-  return writeJson3(res, 200, { presets, excluded });
+  return writeJson4(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
     const reader = deps.keySpendReader;
-    if (!reader) return writeJson3(res, 200, { keys: rows.map(toKeyInfo) });
+    if (!reader) return writeJson4(res, 200, { keys: rows.map(toKeyInfo) });
     const now = Date.now();
     const keys = await Promise.all(
       rows.map(async (row) => {
@@ -6558,13 +7075,13 @@ async function handleKeys(req, res, method, rest, deps) {
         return info;
       })
     );
-    return writeJson3(res, 200, { keys });
+    return writeJson4(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
     const created = await createNamedKey(deps.keyDb, name);
-    return writeJson3(res, 201, {
+    return writeJson4(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -6575,7 +7092,7 @@ async function handleKeys(req, res, method, rest, deps) {
   }
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal") {
     const revealed = await deps.keyDb.outboundApiKeysReveal(rest[0]);
-    if (revealed !== null) return writeJson3(res, 200, { key: revealed });
+    if (revealed !== null) return writeJson4(res, 200, { key: revealed });
     const exists = (await deps.keyDb.outboundApiKeysList()).some((r) => r.id === rest[0]);
     if (!exists) return writeJsonError(res, 404, `key '${rest[0]}' not found`);
     return writeJsonError(
@@ -6590,26 +7107,26 @@ async function handleKeys(req, res, method, rest, deps) {
     const bound = await integrationKeyRequirement(deps, id);
     if (bound) return writeJsonError(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   if (method === "DELETE" && id && !action) {
     const bound = await integrationKeyRequirement(deps, id);
     if (bound) return writeJsonError(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysDelete(id);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const enabled = body["enabled"] === true;
     if (!enabled) {
       const bound = await integrationKeyRequirement(deps, id);
       if (bound) return writeJsonError(res, 409, bound);
     }
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson3(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson4(res, ok ? 200 : 404, { ok, enabled });
   }
   if (method === "POST" && id && action === "permissions") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     if (Object.keys(body).length !== 1 || !Object.prototype.hasOwnProperty.call(body, "permissions")) {
       return writeJsonError(res, 400, "body must contain only permissions");
     }
@@ -6624,19 +7141,19 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const before = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-    if (!before) return writeJson3(res, 404, { ok: false });
-    if (before.revokedAt !== null) return writeJson3(res, 409, { ok: false });
+    if (!before) return writeJson4(res, 404, { ok: false });
+    if (before.revokedAt !== null) return writeJson4(res, 409, { ok: false });
     const required = await integrationKeyRequirement(deps, id, permissions);
     if (required) return writeJsonError(res, 409, required);
     const ok = await deps.keyDb.outboundApiKeysSetPermissions(id, permissions);
     if (!ok) {
       const current = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-      return writeJson3(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
+      return writeJson4(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
     }
-    return writeJson3(res, 200, { ok: true, allowedEndpoints: permissions });
+    return writeJson4(res, 200, { ok: true, allowedEndpoints: permissions });
   }
   if (method === "POST" && id && action === "max-concurrency") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const raw = body["maxConcurrency"];
     let value;
     if (raw === null) {
@@ -6651,14 +7168,14 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
-    return writeJson3(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+    return writeJson4(res, ok ? 200 : 404, { ok, maxConcurrency: value });
   }
   if (method === "POST" && id && action === "policy") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const parsed = parseKeyPolicyBody(body);
     if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
     const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on keys`);
 }
@@ -6749,7 +7266,8 @@ function outboundServerConfigInput(config) {
     userMessageQueue: config.userMessageQueue,
     concurrencyQueue: config.concurrencyQueue,
     voucher: config.voucher,
-    anthropic: config.anthropic
+    anthropic: config.anthropic,
+    search: config.search
   };
 }
 function projectImagesConfigForAdmin(config) {
@@ -6812,15 +7330,21 @@ function currentImageGenerationId(deps) {
 }
 async function handleServer(req, res, method, deps) {
   if (method === "GET") {
-    const config = await loadServerConfig2(deps.settingsStore);
+    const config = await loadServerConfig3(deps.settingsStore);
     let server = config;
     if (config.proxy) server = { ...server, proxy: redactOutboundProxy(config.proxy) };
     if (config.webhook) server = { ...server, webhook: redactWebhookConfig(config.webhook) };
     if (config.billing) server = { ...server, billing: redactBillingConfig(config.billing) };
-    return writeJson3(res, 200, { server: projectImagesConfigForAdmin(server) });
+    if (config.search) {
+      server = {
+        ...server,
+        search: redactSearchServerConfig(config.search)
+      };
+    }
+    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(server) });
   }
   if (method === "PUT") {
-    const patch = await readJsonBody3(req);
+    const patch = await readJsonBody4(req);
     const queueErrors = validateQueueSegments(patch);
     if (queueErrors.length > 0) {
       return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
@@ -6849,7 +7373,7 @@ async function handleServer(req, res, method, deps) {
     if (billingErrors.length > 0) {
       return writeJsonError(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
     }
-    const current = await loadServerConfig2(deps.settingsStore);
+    const current = await loadServerConfig3(deps.settingsStore);
     let effectivePatch = patch;
     if (patch.proxy) {
       effectivePatch = { ...effectivePatch, proxy: preserveOutboundProxySecrets(patch.proxy, current.proxy) };
@@ -6870,6 +7394,20 @@ async function handleServer(req, res, method, deps) {
       }
       effectivePatch = { ...effectivePatch, images };
     }
+    if (patch.search !== void 0) {
+      const searchPatch = preserveSearchSecrets(
+        patch.search,
+        current.search ?? DEFAULT_SEARCH_SERVER_CONFIG2
+      );
+      const searchErrors = validateSearchServerConfig(searchPatch);
+      if (searchErrors.length > 0) {
+        return writeJsonError(res, 400, `invalid search config: ${searchErrors.join("; ")}`);
+      }
+      effectivePatch = {
+        ...effectivePatch,
+        search: searchPatch
+      };
+    }
     const merged = mergeServerConfig(current, effectivePatch);
     const priorImageGenerationId = currentImageGenerationId(deps);
     try {
@@ -6922,7 +7460,11 @@ async function handleServer(req, res, method, deps) {
       } catch {
       }
     }
-    return writeJson3(res, 200, { server: projectImagesConfigForAdmin(merged) });
+    const mergedForAdmin = merged.search ? {
+      ...merged,
+      search: redactSearchServerConfig(merged.search)
+    } : merged;
+    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(mergedForAdmin) });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on server`);
 }
@@ -6939,7 +7481,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       sessionKey: query2.get("sessionKey") ?? void 0,
       limit: Number.isFinite(parsedLimit) ? parsedLimit : 100
     });
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       available: true,
       records,
       capacity: ACCOUNT_ROUTE_ACTIVITY_LIMIT,
@@ -6955,7 +7497,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       providerId: query2.get("providerId") ?? void 0,
       accountId: query2.get("accountId") ?? void 0
     });
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       available: true,
       entries,
       collectedAt: Date.now()
@@ -6974,10 +7516,10 @@ async function handleAccounts(req, res, method, rest, deps) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson3(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson4(res, 200, { accounts, providerAccounts, externalCli });
   }
   if (method === "POST" && rest[0] === "batch" && rest.length === 1) {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const parsed = validateAccountBatchBody(body);
     if (!parsed) return writeJsonError(res, 400, "invalid account batch request");
     const result = await deps.subscriptionTokenWriter.batchManageAccounts(parsed.refs, parsed.mutation);
@@ -6993,15 +7535,15 @@ async function handleAccounts(req, res, method, rest, deps) {
         deps.accountAllowanceService?.removeAccountSnapshot?.(ref.providerId, ref.accountId);
       }
     }
-    return writeJson3(res, 200, { ok: true, affected: result.affected });
+    return writeJson4(res, 200, { ok: true, affected: result.affected });
   }
   if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
     const result = handleCodexOAuthStatus(rest[2], deps);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
     const result = handleCodexOAuthCancel(rest[2], deps);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -7023,7 +7565,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       resumeAt: entry.resumeAt
     })) ?? [];
     const diagnostics = [...health2, ...allowance].sort((left, right) => right.at - left.at).slice(0, 200);
-    return writeJson3(res, 200, { diagnostics });
+    return writeJson4(res, 200, { diagnostics });
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "events") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -7035,17 +7577,17 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     const snapshot = deps.accountProbeService?.getAllHistory().find((entry) => entry.providerId === providerId && entry.accountId === accountId);
     const diagnostics = getSharedAccountHealth().getDiagnostics({ providerId, accountId });
-    return writeJson3(res, 200, { events: snapshot?.records ?? [], diagnostics });
+    return writeJson4(res, 200, { events: snapshot?.records ?? [], diagnostics });
   }
   if (method === "PATCH" && rest.length === 2) {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const patch = validateAccountMetadataPatch(body);
     if (!patch) return writeJsonError(res, 400, "invalid account metadata patch");
     const result = await deps.subscriptionTokenWriter.patchAccountMetadata(providerId, rest[1], patch);
     if (!result.ok) return writeJsonError(res, 404, `account '${rest[1]}' not found`);
-    return writeJson3(res, 200, { ok: true });
+    return writeJson4(res, 200, { ok: true });
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -7054,15 +7596,15 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
-      return writeJson3(res, result.status, result.body);
+      return writeJson4(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson3(res, result.status, result.body);
+      return writeJson4(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const block = validateTokenBody(providerId, body2);
       if (!block) {
         return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
@@ -7070,20 +7612,20 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson4(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
         return writeJsonError(res, 400, `provider '${providerId}' has no external CLI store`);
       }
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       const result = await deps.subscriptionTokenWriter.importExternalCliAccount(providerId, label);
       if (!result.ok) {
         return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         ok: true,
         account: status2 ?? void 0,
         nativeCredentialMode: result.nativeCredentialMode,
@@ -7098,7 +7640,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       const writer2 = deps.subscriptionTokenWriter;
       const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson4(res, 200, { ok, account: status2 ?? void 0 });
     }
     if (method === "POST" && rest.length === 3 && rest[2] === "test") {
       const accountId = rest[1];
@@ -7108,7 +7650,7 @@ async function handleAccounts(req, res, method, rest, deps) {
         return writeJsonError(res, 404, `account '${accountId}' not found`);
       }
       const result = await deps.accountProbeService.testAccountConnection(providerId, accountId);
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         ok: result.ok,
         marked: result.marked,
         tier: result.tier,
@@ -7117,15 +7659,15 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "priority") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const raw = body2["priority"];
       const priority = typeof raw === "number" ? raw : Number(raw);
       if (!Number.isFinite(priority)) {
@@ -7133,11 +7675,11 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "proxy") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const rawProxy = body2["proxy"];
       let proxy;
       if (rawProxy !== null && rawProxy !== void 0) {
@@ -7146,63 +7688,63 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "supported-models") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const parsed = validateSupportedModelsBody(body2["supportedModels"]);
       if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
       const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const id = typeof body2["id"] === "string" ? body2["id"] : "";
       if (!id) return writeJsonError(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
       if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
       if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
       deps.accountAllowanceService?.removeAccountSnapshot?.(providerId, accountId);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 1) {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
       deps.accountAllowanceService?.removeProviderSnapshots?.(providerId);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE") {
       return writeJsonError(res, 405, "method DELETE not allowed on this accounts path");
     }
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const config = validateTokenBody(providerId, body);
     if (!config) {
       return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson3(res, 200, status ? { account: status } : { ok: true });
+    return writeJson4(res, 200, status ? { account: status } : { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
@@ -7210,14 +7752,14 @@ async function handleCli(req, res, method, rest, deps) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const providers = loadConfig(deps.configPath).providers ?? [];
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
@@ -7226,7 +7768,7 @@ async function handleCli(req, res, method, rest, deps) {
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   return writeJsonError(res, 405, `method ${method} not allowed on cli`);
 }
@@ -7236,52 +7778,52 @@ async function handleIntegrations(req, res, method, rest, deps) {
   const manager = factory();
   try {
     if (method === "GET" && rest.length === 0) {
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         integrations: await manager.listStatus(),
         gateway: deps.outboundApiServer.getStatus()
       });
     }
     if (method === "POST" && rest.length === 1 && rest[0] === "rotate") {
       await manager.rotateGatewayKey();
-      return writeJson3(res, 200, { ok: true, integrations: await manager.listStatus() });
+      return writeJson4(res, 200, { ok: true, integrations: await manager.listStatus() });
     }
     const client = rest[0];
     if (!isIntegrationClient(client)) {
       return writeJsonError(res, 400, `unknown integration client '${client ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "key") {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       if (Object.keys(body).length !== 1 || typeof body.keyId !== "string" || !body.keyId.trim()) {
         return writeJsonError(res, 400, "body must contain a non-empty keyId string");
       }
       const status = await manager.bindIntegrationKey(client, body.keyId.trim());
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "plan") {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
         return writeJsonError(res, 400, "configPath must be a string");
       }
       const plan = await manager.plan(client, configPath);
-      return writeJson3(res, 200, { plan });
+      return writeJson4(res, 200, { plan });
     }
     if (method === "POST" && (rest[1] === "install" || rest[1] === "apply")) {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
         return writeJsonError(res, 400, "configPath must be a string");
       }
       const status = await manager.install(client, configPath);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "repair") {
       const status = await manager.repair(client);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "DELETE" && rest.length === 1 || method === "POST" && rest[1] === "remove") {
       const status = await manager.remove(client);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     return writeJsonError(res, 405, `method ${method} not allowed on integrations`);
   } catch (error) {
@@ -7424,7 +7966,7 @@ async function handleImages(res, method, rest, deps) {
   }
   const reader = deps.imageRuntimeStatus;
   if (!reader) return writeJsonError(res, 501, "Images runtime status is not available");
-  const serverConfig = await loadServerConfig2(deps.settingsStore);
+  const serverConfig = await loadServerConfig3(deps.settingsStore);
   const images = serverConfig.images ?? DEFAULT_IMAGES_SERVER_CONFIG;
   const lifecycle = reader.status();
   const capability = await reader.inspectCapability(IMAGE_ADMIN_STATUS_TENANT);
@@ -7444,7 +7986,7 @@ async function handleImages(res, method, rest, deps) {
     httpLeases: safeStatusCount(generation.httpLeases),
     hostedLeases: safeStatusCount(generation.hostedLeases)
   }));
-  return writeJson3(res, 200, {
+  return writeJson4(res, 200, {
     configured: {
       enabled: images.enabled,
       provider: images.provider,
@@ -7472,7 +8014,7 @@ async function handleImages(res, method, rest, deps) {
 async function handleStatus(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
-  const serverConfig = await loadServerConfig2(deps.settingsStore);
+  const serverConfig = await loadServerConfig3(deps.settingsStore);
   const endpoints = ["chat", "responses", "messages", "gemini"].map((endpoint) => {
     const routes = (serverConfig.bindings ?? []).filter((binding) => binding.enabled && binding.endpoint === endpoint).map((binding) => gatewayBindingToEndpointConfig(binding));
     const useSubscription = routes.some((route) => route.useSubscription);
@@ -7510,14 +8052,14 @@ async function handleStatus(res, method, deps) {
   })() : void 0;
   if (status.running) {
     const queueStatus = deps.outboundApiServer.getQueueStatus();
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       ...status,
       endpoints,
       queueStatus,
       ...imageRuntime ? { imageRuntime } : {}
     });
   }
-  return writeJson3(res, 200, {
+  return writeJson4(res, 200, {
     ...status,
     endpoints,
     ...imageRuntime ? { imageRuntime } : {}
@@ -7541,18 +8083,18 @@ function resolvePlaygroundPath(endpoint, body) {
 }
 async function handlePlayground(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on playground`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const endpoint = typeof body["endpoint"] === "string" ? body["endpoint"] : "";
   const key = typeof body["key"] === "string" ? body["key"] : "";
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord2(payload) ? payload : {});
+  const path2 = resolvePlaygroundPath(endpoint, isRecord3(payload) ? payload : {});
   if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord2(v) {
+function isRecord3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
@@ -7687,7 +8229,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -17582,6 +18124,14 @@ function buildDaemon(config, paths) {
     onEvent: (row, at) => usageThroughput.record(row, at)
   });
   const initialImagesConfig = normalizeServerConfig2(decryptedConfig.server).images;
+  const initialSearchConfig = normalizeServerConfig2(decryptedConfig.server).search;
+  for (const issue of validateSearchServerConfig2(
+    decryptedConfig.server?.search
+  )) {
+    logger.warn("[search] ignoring invalid config: " + issue);
+  }
+  const searchRuntime = buildSearchRuntime(initialSearchConfig, { logger });
+  const searchFrontendModes = initialSearchConfig.modes;
   const imageObservability = new ImageObservability();
   const imageRuntimeObservability = Object.freeze({
     telemetrySink: imageObservability.telemetrySink,
@@ -17711,7 +18261,9 @@ function buildDaemon(config, paths) {
       apiKeyPool,
       usageRecorder,
       openAIOperationRegistry,
-      responsesHostedImageIngress
+      responsesHostedImageIngress,
+      searchRuntime,
+      searchFrontendModes
     });
     if (providerProxy.getDeps().openAIOperationRegistry !== openAIOperationRegistry) {
       throw new Error(
@@ -17776,7 +18328,9 @@ function buildDaemon(config, paths) {
     keySpendTracker,
     // configurable-logging: route the server's OWN lifecycle + relay dispatch-error
     // lines through the injected logger (honors level/format/file sink).
-    logger
+    logger,
+    // plan 阶段5: the same instance the managed frontends hold.
+    searchRuntime
   });
   const auditDir = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
@@ -17798,6 +18352,10 @@ function buildDaemon(config, paths) {
     }),
     routeLeaseManager,
     subscriptionAccounts,
+    // search-settings-ui D3: the daemon's ONE search runtime + its
+    // bootstrap-captured modes, for `GET /admin/api/search/diagnostics` and
+    // `POST /admin/api/search/test` (501 when a light embedder omits it).
+    searchStatus: { runtime: searchRuntime, modes: searchFrontendModes },
     accountAllowanceService,
     allowanceRefreshScheduler: claudeAllowanceRefreshScheduler,
     accountProbeService: accountHealthProbeScheduler,
@@ -17934,6 +18492,8 @@ function buildDaemon(config, paths) {
     keyDb,
     settingsStore,
     openAIOperationRegistry,
+    searchRuntime,
+    searchFrontendModes,
     imageRuntimeManager,
     imageObservability,
     imageCleanupService,
@@ -18080,6 +18640,116 @@ async function runImagesLiveDoctor(config, doctor, signal = new AbortController(
   );
   return true;
 }
+function readSearchApiConfigFromEnv(env = process.env) {
+  const configs = {};
+  const read = (name) => {
+    const value = env[`OMNICROSS_SEARCH_${name}`]?.trim();
+    return value ? value : void 0;
+  };
+  const tavilyKey = read("TAVILY_API_KEY");
+  if (tavilyKey) {
+    configs.tavily = { apiKey: tavilyKey, ...optionalHost(read("TAVILY_API_HOST")) };
+  }
+  const jinaKey = read("JINA_API_KEY");
+  const jinaHost = read("JINA_API_HOST");
+  if (jinaKey || jinaHost) {
+    configs.jina = { ...jinaKey ? { apiKey: jinaKey } : {}, ...optionalHost(jinaHost) };
+  }
+  const searxngHost = read("SEARXNG_API_HOST");
+  if (searxngHost) {
+    const username = read("SEARXNG_BASIC_AUTH_USERNAME");
+    const password = read("SEARXNG_BASIC_AUTH_PASSWORD");
+    configs.searxng = {
+      apiHost: searxngHost,
+      ...username ? { basicAuthUsername: username } : {},
+      ...password ? { basicAuthPassword: password } : {}
+    };
+  }
+  const zhipuKey = read("ZHIPU_API_KEY");
+  if (zhipuKey) {
+    configs.zhipu = { apiKey: zhipuKey, ...optionalHost(read("ZHIPU_API_HOST")) };
+  }
+  const zaiKey = read("Z_AI_API_KEY");
+  if (zaiKey) {
+    configs["z.ai"] = { apiKey: zaiKey, ...optionalHost(read("Z_AI_API_HOST")) };
+  }
+  return configs;
+}
+function optionalHost(apiHost) {
+  return apiHost ? { apiHost } : {};
+}
+function resolveSearchApiConfigs(configured, env = process.env) {
+  const fromEnv = readSearchApiConfigFromEnv(env);
+  const resolved = {};
+  const tavily = configured?.tavily ?? fromEnv.tavily;
+  if (tavily) resolved.tavily = tavily;
+  const jina = configured?.jina ?? fromEnv.jina;
+  if (jina) resolved.jina = jina;
+  const searxng = configured?.searxng ?? fromEnv.searxng;
+  if (searxng) resolved.searxng = searxng;
+  const zhipu = configured?.zhipu ?? fromEnv.zhipu;
+  if (zhipu) resolved.zhipu = zhipu;
+  const zai = configured?.["z.ai"] ?? fromEnv["z.ai"];
+  if (zai) resolved["z.ai"] = zai;
+  return resolved;
+}
+function formatCapabilities(capabilities) {
+  return [
+    `apiKey=${capabilities.requiresApiKey}`,
+    `cancellation=${capabilities.supportsCancellation}`,
+    `urlRead=${capabilities.supportsUrlRead}`,
+    `region=${capabilities.supportsRegion}`,
+    `language=${capabilities.supportsLanguage}`,
+    `timeRange=${capabilities.supportsTimeRange}`,
+    `maxResults=${capabilities.maxResults ?? "unbounded"}`
+  ].join(", ");
+}
+function formatDiagnostic(diagnostic) {
+  const parts = [diagnostic.status];
+  if (diagnostic.reason) parts.push(diagnostic.reason);
+  if (diagnostic.error) {
+    const { code, details } = diagnostic.error;
+    parts.push(
+      `code=${code}, transport=${details?.transport ?? "unknown"}, stage=${details?.stage ?? "unknown"}`
+    );
+  }
+  return parts.join(" \u2014 ");
+}
+async function runSearchDoctor(live, env = process.env, source = {}) {
+  const apiConfigs = resolveSearchApiConfigs(source.config?.providers, env);
+  const egressPolicy = source.config && source.config.egress.allowedPrivateHosts.length > 0 ? { allowedPrivateHosts: [...source.config.egress.allowedPrivateHosts] } : void 0;
+  const contributions = [
+    ...builtinHttpSearchContributions4(),
+    ...apiSearchContributions3(apiConfigs, { ...egressPolicy ? { egressPolicy } : {} })
+  ];
+  const declarations = source.runtime?.listProviders() ?? contributions;
+  console.info("omnicross doctor search \u2014 builtin search contributions (offline, no network)");
+  const modes = source.config?.modes ?? DEFAULT_SEARCH_FRONTEND_MODES;
+  console.info(
+    `  [i] frontend modes: ${SEARCH_FRONTEND_NAMES.map((name) => `${name}=${modes[name]}`).join(", ")}`
+  );
+  console.info(
+    "  [i] codex mode applies immediately; responses/anthropic modes, provider config, egress allowlist and policy apply on daemon restart"
+  );
+  for (const row of buildSearchDoctorSnapshot(declarations, apiConfigs)) {
+    const mark = row.status === "unconfigured" ? "\u2013" : "\u2713";
+    const suffix = row.status ? ` \u2014 ${row.status}: ${row.reason ?? ""}` : "";
+    console.info(
+      `  [${mark}] ${row.providerId}: source=${row.source}, kind=${row.kind}, ${formatCapabilities(row.capabilities)}${suffix}`
+    );
+  }
+  if (!live) return 0;
+  console.info(
+    `  [\u26A0] live search sends ONE fixed public query per provider ("${SEARCH_DOCTOR_QUERY}") to the engine itself`
+  );
+  let hardFailure = false;
+  for (const diagnostic of await runSearchLiveChecks(contributions)) {
+    const mark = diagnostic.status === "healthy" ? "\u2713" : diagnostic.status === "failed" ? "\u2717" : "\u26A0";
+    if (diagnostic.status === "failed") hardFailure = true;
+    console.info(`  [${mark}] ${diagnostic.providerId}: ${formatDiagnostic(diagnostic)}`);
+  }
+  return hardFailure ? 1 : 0;
+}
 async function runLiveProbe(url, key, fetchImpl = fetch) {
   try {
     const res = await fetchImpl(`${url.replace(/\/+$/, "")}/v1/messages/count_tokens`, {
@@ -18116,11 +18786,12 @@ async function runDoctor(argv, fetchImpl = fetch) {
     allowPositionals: true
   });
   const subject = positionals[0] ?? "claude";
-  if (subject !== "claude" && subject !== "images") {
-    throw new Error(`doctor: unknown subject '${subject}' (supported: 'claude', 'images')`);
+  if (subject !== "claude" && subject !== "images" && subject !== "search") {
+    throw new Error(`doctor: unknown subject '${subject}' (supported: 'claude', 'images', 'search')`);
   }
   const configPath = values.config;
   if (!configPath) {
+    if (subject === "search") return runSearchDoctor(values.live === true);
     throw new Error("doctor: --config <path> is required (the same config `omnicross start` uses)");
   }
   const config = loadConfig(configPath);
@@ -18132,7 +18803,13 @@ async function runDoctor(argv, fetchImpl = fetch) {
   };
   const daemon = await buildDaemon(config, paths);
   try {
-    const serverConfig = await loadServerConfig3(daemon.settingsStore);
+    const serverConfig = await loadServerConfig4(daemon.settingsStore);
+    if (subject === "search") {
+      return await runSearchDoctor(values.live === true, process.env, {
+        ...serverConfig.search ? { config: serverConfig.search } : {},
+        runtime: daemon.searchRuntime
+      });
+    }
     const checks = subject === "images" ? buildImagesDoctorChecks(await daemon.imageDoctor.inspectLocal(
       serverConfig.images ?? DEFAULT_IMAGES_SERVER_CONFIG2
     )) : buildClaudeDoctorChecks(serverConfig);
@@ -19209,7 +19886,7 @@ function tokensSuffix(configPath) {
 
 // src/commands/start.ts
 import { parseArgs as parseArgs10 } from "util";
-import { loadServerConfig as loadServerConfig4 } from "@omnicross/core/outbound-api";
+import { loadServerConfig as loadServerConfig5 } from "@omnicross/core/outbound-api";
 import { getSharedAccountHealth as getSharedAccountHealth5 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
 import { getSharedAccountAllowanceScheduling as getSharedAccountAllowanceScheduling6 } from "@omnicross/core/pipeline/AccountAllowanceScheduling";
 
@@ -19271,7 +19948,7 @@ async function runStart(argv) {
   await daemon.llmConfig.ready();
   await daemon.migrateUsageStore();
   await daemon.providerProxy.start();
-  const serverConfig = await loadServerConfig4(daemon.settingsStore);
+  const serverConfig = await loadServerConfig5(daemon.settingsStore);
   await daemon.imageCleanupService.runOnce();
   daemon.imageCleanupService.start();
   getSharedAccountHealth5().configure({
@@ -19294,7 +19971,9 @@ async function runStart(argv) {
     voucher: serverConfig.voucher,
     // claude-api-protocol-fidelity (§10): count_tokens strategy/budget,
     // /v1/models shape, synthetic-ping heartbeat (hot-applied inside applyConfig).
-    anthropic: serverConfig.anthropic
+    anthropic: serverConfig.anthropic,
+    // plan 阶段5: the Codex frontend mode is read live per request from here.
+    search: serverConfig.search
   });
   let dashboardUrl = null;
   if (!values["no-dashboard"]) {
@@ -19409,6 +20088,16 @@ Usage:
                                            Check local Images config, roots, stores, permissions,
                                            account and cached evidence. --live warns, then consumes
                                            at most one minimal subscription image request.
+  omnicross doctor search [--live]          List the builtin search providers and their declared
+                                           capabilities (offline, no config needed). --live sends ONE
+                                           fixed public query per provider and reports healthy /
+                                           degraded / blocked / failed.
+                                           Keyed API providers show as unconfigured unless enabled
+                                           through the DIAGNOSTIC-ONLY environment variables
+                                           OMNICROSS_SEARCH_{TAVILY,JINA,SEARXNG,ZHIPU,Z_AI}_API_KEY
+                                           / _API_HOST (plus SEARXNG_BASIC_AUTH_USERNAME/_PASSWORD).
+                                           These are read only by this command and are not the
+                                           configuration system.
 `;
 async function main() {
   const [, , subcommand, ...rest] = process.argv;