@omnicross/daemon 0.2.1 → 0.3.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Sayo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Sayo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,19 +1,19 @@
-# @omnicross/daemon
-
-The omnicross standalone daemon — a bare-Node embedder of `@omnicross/core` with an admin HTTP API + dashboard. Ships the `omnicross` CLI for managing keys, providers, subscription OAuth login, and launching Code CLIs against an in-process proxy.
-
-Part of the [omnicross](https://github.com/Dumoedss/omnicross) monorepo — see the root README for the full overview.
-
-```bash
-npm install -g @omnicross/daemon
-omnicross --help
-```
-
-```bash
-# Boot the daemon (BYO-key serving)
-omnicross start --config ./omnicross.config.json
-```
-
-## License
-
-[MIT](LICENSE) 
+# @omnicross/daemon
+
+The omnicross standalone daemon — a bare-Node embedder of `@omnicross/core` with an admin HTTP API + dashboard. Ships the `omnicross` CLI for managing keys, providers, subscription OAuth login, and launching Code CLIs against an in-process proxy.
+
+Part of the [omnicross](https://github.com/Dumoedss/omnicross) monorepo — see the root README for the full overview.
+
+```bash
+npm install -g @omnicross/daemon
+omnicross --help
+```
+
+```bash
+# Boot the daemon (BYO-key serving)
+omnicross start --config ./omnicross.config.json
+```
+
+## License
+
+[MIT](LICENSE) 

package/dist/cli.cjs

@@ -1163,7 +1163,7 @@ var import_node_util2 = require("util");
 var import_outbound_api12 = require("@omnicross/core/outbound-api");
 var import_api4 = require("@omnicross/core/search/api");
 var import_http4 = require("@omnicross/core/search/http");
-var import_search2 = require("@omnicross/core/search");
+var import_search3 = require("@omnicross/core/search");
 
 // src/bootstrap.ts
 var import_node_fs35 = require("fs");
@@ -1178,7 +1178,7 @@ var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subs
 var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
 var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
@@ -1984,7 +1984,7 @@ var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_image_generation_types = require("@omnicross/contracts/image-generation-types");
 var import_AccountAllowanceScheduling2 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/image-generation/imagesConfigValidation.ts
 var import_outbound_api = require("@omnicross/core/outbound-api");
@@ -4509,6 +4509,7 @@ async function handleDashboard(deps) {
 var import_outbound_api2 = require("@omnicross/core/outbound-api");
 var import_api3 = require("@omnicross/core/search/api");
 var import_http3 = require("@omnicross/core/search/http");
+var import_search2 = require("@omnicross/core/search");
 
 // src/search/searchDoctorProjection.ts
 var import_search_types = require("@omnicross/contracts/search-types");
@@ -4569,7 +4570,7 @@ function buildSearchDoctorSnapshot(contributions = (0, import_http.builtinHttpSe
   }
   return rows;
 }
-var SEARCH_DOCTOR_QUERY = "mozilla developer network http headers";
+var SEARCH_DOCTOR_QUERY = "MDN HTTP headers documentation";
 function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
   if (outcome.kind === "results") {
     if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
@@ -4628,6 +4629,7 @@ async function runSearchLiveChecks(contributions, now = () => (/* @__PURE__ */ n
 }
 
 // src/search/SearchAssembly.ts
+var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_search = require("@omnicross/core/search");
 var import_api2 = require("@omnicross/core/search/api");
 var import_http2 = require("@omnicross/core/search/http");
@@ -4644,11 +4646,24 @@ function searchPolicyFrom(config) {
     ...maxAttempts !== void 0 ? { maxAttempts } : {}
   };
 }
+function resolveSearchUpstreamDispatcher(url) {
+  return (0, import_upstreamFetch3.resolveUpstreamDispatcher)({ url });
+}
+var searchUpstreamProxyConfig = createUpstreamProxyResolver();
+function resolveSearchUpstreamProxyConfig(url) {
+  return searchUpstreamProxyConfig({ url });
+}
 function searchContributionsFrom(config) {
   return [
-    ...(0, import_http2.builtinHttpSearchContributions)(),
+    ...(0, import_http2.builtinHttpSearchContributions)(
+      (0, import_http2.createSearchHttpTransport)({
+        resolveProxyDispatcher: resolveSearchUpstreamDispatcher,
+        resolveProxyConfig: resolveSearchUpstreamProxyConfig
+      })
+    ),
     ...(0, import_api2.apiSearchContributions)(config.providers, {
-      egressPolicy: searchEgressPolicyFrom(config)
+      egressPolicy: searchEgressPolicyFrom(config),
+      resolveProxyDispatcher: resolveSearchUpstreamDispatcher
     })
   ];
 }
@@ -4792,6 +4807,18 @@ async function handleSearchDiagnostics(res, deps) {
   };
   return writeJson(res, 200, { diagnostics: snapshot });
 }
+function persistedSearchContributions(search, fetchImpl) {
+  if (fetchImpl) {
+    const egressPolicy = searchEgressPolicyFrom(search);
+    return [
+      ...(0, import_http3.builtinHttpSearchContributions)(
+        (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy })
+      ),
+      ...(0, import_api3.apiSearchContributions)(search.providers, { egressPolicy, fetchImpl })
+    ];
+  }
+  return searchContributionsFrom(search);
+}
 async function handleSearchTest(req, res, deps) {
   const status = deps.searchStatus;
   const body = await readBodyOrReject(req, res);
@@ -4809,16 +4836,8 @@ async function handleSearchTest(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...(0, import_http3.builtinHttpSearchContributions)(transport),
-    ...(0, import_api3.apiSearchContributions)(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
+  const contributions = persistedSearchContributions(search, fetchImpl);
   const contribution = contributions.find((c) => c.id === providerId);
   if (!contribution) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
@@ -4866,41 +4885,42 @@ async function handleSearchQuery(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...(0, import_http3.builtinHttpSearchContributions)(transport),
-    ...(0, import_api3.apiSearchContributions)(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
-  const contribution = contributions.find((c) => c.id === providerId);
-  if (!contribution) {
-    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
-  }
+  const runtime = (0, import_search2.createSearchRuntime)({
+    contributions: persistedSearchContributions(search, fetchImpl),
+    policy: {
+      ...searchPolicyFrom(search),
+      // The panel always walks: it answers "does a search WORK for this
+      // operator", not "does this one provider behave" — that is `/test`'s
+      // job. The persisted policy's allowlist still bounds the walk.
+      fallbackEnabled: true,
+      preferred: providerId
+    }
+  });
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    const results = await contribution.provider.search(query2, { maxResults: 5 });
+    const orchestrated = await runtime.search({ query: query2, options: { maxResults: 5 } });
+    const results = orchestrated.results;
     const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
       title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
       url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
       content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
     }));
-    const diagnostic = sanitized.length === 0 ? { providerId: contribution.id, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
-      contribution.id,
+    const diagnostic = sanitized.length === 0 ? { providerId: orchestrated.providerId, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      orchestrated.providerId,
       { kind: "results", count: sanitized.length },
       checkedAt
     );
     const response = {
       diagnostic,
+      providerUsed: orchestrated.providerId,
+      fallbackCount: orchestrated.fallbackCount,
       resultCount: sanitized.length,
       results: sanitized
     };
     return writeJson(res, 200, { result: response });
   } catch (error) {
-    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
     return writeJson(res, 200, { result: response });
   }
@@ -6534,7 +6554,7 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
+    const response = await (0, import_upstreamFetch4.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -6593,7 +6613,7 @@ async function handleTestModel(req, res, id, cfg) {
   }
   const startedAt = Date.now();
   try {
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(
+    const response = await (0, import_upstreamFetch4.fetchUpstream)(
       url,
       { method: "POST", headers, body: JSON.stringify(payload) },
       { providerId: "byo" }
@@ -8096,7 +8116,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.1" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -15069,7 +15089,7 @@ var import_node_fs27 = require("fs");
 var import_node_path27 = require("path");
 var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore2 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_subscriptions5 = require("@omnicross/subscriptions");
 
@@ -15217,7 +15237,7 @@ var JsonSubscriptionCredentialStore = class {
    * a plaintext token pair into `upstream-trace.jsonl`.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
+    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch5.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
   }
   /**
    * In-flight refresh coalescing. OAuth refresh tokens are
@@ -15775,7 +15795,7 @@ var JsonSubscriptionCredentialStore = class {
 };
 
 // src/AccountHealthProbeScheduler.ts
-var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/probe/CodexGenerationProbe.ts
 var import_codexCliHeaders = require("@omnicross/core/provider-proxy/identity/codexCliHeaders");
@@ -15936,7 +15956,7 @@ var AccountHealthProbeScheduler = class {
     this.logger = logger;
     this.config = config;
     this.now = opts.now ?? Date.now;
-    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch5.fetchUpstream;
+    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch6.fetchUpstream;
     this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.planFor = opts.planFor ?? probePlanFor;
   }
@@ -17092,7 +17112,7 @@ var AuditWriter = class {
 var import_node_fs33 = require("fs");
 var import_node_crypto24 = require("crypto");
 var import_node_path34 = require("path");
-var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
 var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -17115,7 +17135,7 @@ var BillingPublisher = class {
   constructor(billingDir, logger, opts = {}) {
     this.billingDir = billingDir;
     this.logger = logger;
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch6.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
     this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
     this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
     this.now = opts.now ?? Date.now;
@@ -17524,7 +17544,7 @@ function createRouteLeaseSubscriptionPreflight(credentials) {
 
 // src/webhook/WebhookDispatcher.ts
 var import_node_crypto25 = require("crypto");
-var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
 var WEBHOOK_MAX_ATTEMPTS = 3;
 var WEBHOOK_QUEUE_MAX = 1e3;
 var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
@@ -17544,7 +17564,7 @@ var WebhookDispatcher = class {
   sleep;
   now;
   constructor(opts = {}) {
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init));
     this.logger = opts.logger;
     this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
     this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
@@ -17806,7 +17826,7 @@ function buildDaemon(config, paths) {
   );
   (0, import_subscriptions6.setSubscriptionProviderRegistry)(subscriptionRegistry);
   setServerProxyConfig(decryptedConfig.server?.proxy);
-  (0, import_upstreamFetch8.setUpstreamProxyResolver)(
+  (0, import_upstreamFetch9.setUpstreamProxyResolver)(
     createUpstreamProxyResolver({
       getAccountProxy: (providerId, accountId) => credentialStore.getAccountProxy(providerId, accountId)
     })
@@ -17829,7 +17849,7 @@ function buildDaemon(config, paths) {
   const pricingEngine = new import_usage2.PricingEngine(pricingStore, logger, {
     // Catalog egress follows the same global/env proxy policy as every other
     // daemon upstream call; no provider/account override applies here.
-    fetchImpl: ((input, init) => (0, import_upstreamFetch8.fetchUpstream)(String(input), init ?? {}))
+    fetchImpl: ((input, init) => (0, import_upstreamFetch9.fetchUpstream)(String(input), init ?? {}))
   });
   const pricingRefreshScheduler = new PricingRefreshScheduler(
     pricingEngine,
@@ -18109,7 +18129,7 @@ function buildDaemon(config, paths) {
     // — `server.proxy.byProvider[...]` was silently skipped — and the call was
     // excluded from the upstream trace, so a failing login left no evidence.
     // `redactBodies` keeps the code/verifier + minted token out of that trace.
-    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init, { providerId, redactBodies: true }),
+    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId, redactBodies: true }),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -18175,7 +18195,7 @@ function buildDaemon(config, paths) {
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
-    fetchImpl: (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)
+    fetchImpl: (url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)());
   const auditWriter = new AuditWriter(auditDir, logger);
@@ -18448,9 +18468,9 @@ async function runSearchDoctor(live, env = process.env, source = {}) {
   ];
   const declarations = source.runtime?.listProviders() ?? contributions;
   console.info("omnicross doctor search \u2014 builtin search contributions (offline, no network)");
-  const modes = source.config?.modes ?? import_search2.DEFAULT_SEARCH_FRONTEND_MODES;
+  const modes = source.config?.modes ?? import_search3.DEFAULT_SEARCH_FRONTEND_MODES;
   console.info(
-    `  [i] frontend modes: ${import_search2.SEARCH_FRONTEND_NAMES.map((name) => `${name}=${modes[name]}`).join(", ")}`
+    `  [i] frontend modes: ${import_search3.SEARCH_FRONTEND_NAMES.map((name) => `${name}=${modes[name]}`).join(", ")}`
   );
   console.info(
     "  [i] codex mode applies immediately; responses/anthropic modes, provider config, egress allowlist and policy apply on daemon restart"
@@ -19040,7 +19060,7 @@ function spawnCliInherit(plan) {
 var import_node_child_process3 = require("child_process");
 var import_node_readline2 = require("readline");
 var import_node_util7 = require("util");
-var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch10 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_subscriptions7 = require("@omnicross/subscriptions");
 var PROVIDERS2 = ["claude", "codex", "gemini"];
 async function runLogin(argv, deps) {
@@ -19072,10 +19092,10 @@ async function runLogin(argv, deps) {
   };
   const box = resolveSecretBox(values["master-key-file"]);
   setSecretBox(box);
-  (0, import_upstreamFetch9.setUpstreamProxyResolver)(createUpstreamProxyResolver());
+  (0, import_upstreamFetch10.setUpstreamProxyResolver)(createUpstreamProxyResolver());
   try {
     const tokensPath = defaultTokensPath(values.config);
-    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
+    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch10.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
     const store = new JsonSubscriptionCredentialStore(tokensPath, box, exchangeFetch);
     const expiresAt = await runProviderLogin(
       provider,
@@ -19088,7 +19108,7 @@ async function runLogin(argv, deps) {
     console.info(`  token: [stored, encrypted]   expiresAt: ${expiresAt ?? "n/a"}`);
   } finally {
     setSecretBox(null);
-    (0, import_upstreamFetch9.setUpstreamProxyResolver)(null);
+    (0, import_upstreamFetch10.setUpstreamProxyResolver)(null);
   }
 }
 async function runProviderLogin(provider, store, deps, exchangeFetch, label) {

package/dist/cli.js

@@ -4599,7 +4599,8 @@ async function handleDashboard(deps) {
 // src/admin/searchAdminApi.ts
 import { DEFAULT_SEARCH_SERVER_CONFIG, loadServerConfig } from "@omnicross/core/outbound-api";
 import { apiSearchContributions as apiSearchContributions2 } from "@omnicross/core/search/api";
-import { builtinHttpSearchContributions as builtinHttpSearchContributions3, createSearchHttpTransport } from "@omnicross/core/search/http";
+import { builtinHttpSearchContributions as builtinHttpSearchContributions3, createSearchHttpTransport as createSearchHttpTransport2 } from "@omnicross/core/search/http";
+import { createSearchRuntime as createSearchRuntime2 } from "@omnicross/core/search";
 
 // src/search/searchDoctorProjection.ts
 import { toSearchErrorShape } from "@omnicross/contracts/search-types";
@@ -4665,7 +4666,7 @@ function buildSearchDoctorSnapshot(contributions = builtinHttpSearchContribution
   }
   return rows;
 }
-var SEARCH_DOCTOR_QUERY = "mozilla developer network http headers";
+var SEARCH_DOCTOR_QUERY = "MDN HTTP headers documentation";
 function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
   if (outcome.kind === "results") {
     if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
@@ -4724,9 +4725,13 @@ async function runSearchLiveChecks(contributions, now = () => (/* @__PURE__ */ n
 }
 
 // src/search/SearchAssembly.ts
+import { resolveUpstreamDispatcher } from "@omnicross/core/pipeline/upstreamFetch";
 import { createSearchRuntime } from "@omnicross/core/search";
 import { apiSearchContributions } from "@omnicross/core/search/api";
-import { builtinHttpSearchContributions as builtinHttpSearchContributions2 } from "@omnicross/core/search/http";
+import {
+  builtinHttpSearchContributions as builtinHttpSearchContributions2,
+  createSearchHttpTransport
+} from "@omnicross/core/search/http";
 function searchEgressPolicyFrom(config) {
   const hosts = config.egress.allowedPrivateHosts;
   return hosts.length > 0 ? { allowedPrivateHosts: [...hosts] } : {};
@@ -4740,11 +4745,24 @@ function searchPolicyFrom(config) {
     ...maxAttempts !== void 0 ? { maxAttempts } : {}
   };
 }
+function resolveSearchUpstreamDispatcher(url) {
+  return resolveUpstreamDispatcher({ url });
+}
+var searchUpstreamProxyConfig = createUpstreamProxyResolver();
+function resolveSearchUpstreamProxyConfig(url) {
+  return searchUpstreamProxyConfig({ url });
+}
 function searchContributionsFrom(config) {
   return [
-    ...builtinHttpSearchContributions2(),
+    ...builtinHttpSearchContributions2(
+      createSearchHttpTransport({
+        resolveProxyDispatcher: resolveSearchUpstreamDispatcher,
+        resolveProxyConfig: resolveSearchUpstreamProxyConfig
+      })
+    ),
     ...apiSearchContributions(config.providers, {
-      egressPolicy: searchEgressPolicyFrom(config)
+      egressPolicy: searchEgressPolicyFrom(config),
+      resolveProxyDispatcher: resolveSearchUpstreamDispatcher
     })
   ];
 }
@@ -4888,6 +4906,18 @@ async function handleSearchDiagnostics(res, deps) {
   };
   return writeJson(res, 200, { diagnostics: snapshot });
 }
+function persistedSearchContributions(search, fetchImpl) {
+  if (fetchImpl) {
+    const egressPolicy = searchEgressPolicyFrom(search);
+    return [
+      ...builtinHttpSearchContributions3(
+        createSearchHttpTransport2({ fetch: fetchImpl, egressPolicy })
+      ),
+      ...apiSearchContributions2(search.providers, { egressPolicy, fetchImpl })
+    ];
+  }
+  return searchContributionsFrom(search);
+}
 async function handleSearchTest(req, res, deps) {
   const status = deps.searchStatus;
   const body = await readBodyOrReject(req, res);
@@ -4905,16 +4935,8 @@ async function handleSearchTest(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? createSearchHttpTransport({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...builtinHttpSearchContributions3(transport),
-    ...apiSearchContributions2(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
+  const contributions = persistedSearchContributions(search, fetchImpl);
   const contribution = contributions.find((c) => c.id === providerId);
   if (!contribution) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
@@ -4962,41 +4984,42 @@ async function handleSearchQuery(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? createSearchHttpTransport({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...builtinHttpSearchContributions3(transport),
-    ...apiSearchContributions2(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
-  const contribution = contributions.find((c) => c.id === providerId);
-  if (!contribution) {
-    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
-  }
+  const runtime = createSearchRuntime2({
+    contributions: persistedSearchContributions(search, fetchImpl),
+    policy: {
+      ...searchPolicyFrom(search),
+      // The panel always walks: it answers "does a search WORK for this
+      // operator", not "does this one provider behave" — that is `/test`'s
+      // job. The persisted policy's allowlist still bounds the walk.
+      fallbackEnabled: true,
+      preferred: providerId
+    }
+  });
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    const results = await contribution.provider.search(query2, { maxResults: 5 });
+    const orchestrated = await runtime.search({ query: query2, options: { maxResults: 5 } });
+    const results = orchestrated.results;
     const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
       title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
       url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
       content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
     }));
-    const diagnostic = sanitized.length === 0 ? { providerId: contribution.id, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
-      contribution.id,
+    const diagnostic = sanitized.length === 0 ? { providerId: orchestrated.providerId, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      orchestrated.providerId,
       { kind: "results", count: sanitized.length },
       checkedAt
     );
     const response = {
       diagnostic,
+      providerUsed: orchestrated.providerId,
+      fallbackCount: orchestrated.fallbackCount,
       resultCount: sanitized.length,
       results: sanitized
     };
     return writeJson(res, 200, { result: response });
   } catch (error) {
-    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
     return writeJson(res, 200, { result: response });
   }
@@ -8206,7 +8229,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.1" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";

package/dist/index.cjs

@@ -70,7 +70,7 @@ var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subs
 var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
 var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
@@ -883,7 +883,7 @@ var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_image_generation_types = require("@omnicross/contracts/image-generation-types");
 var import_AccountAllowanceScheduling2 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/image-generation/imagesConfigValidation.ts
 var import_outbound_api = require("@omnicross/core/outbound-api");
@@ -3743,6 +3743,7 @@ async function handleDashboard(deps) {
 var import_outbound_api2 = require("@omnicross/core/outbound-api");
 var import_api3 = require("@omnicross/core/search/api");
 var import_http3 = require("@omnicross/core/search/http");
+var import_search2 = require("@omnicross/core/search");
 
 // src/search/searchDoctorProjection.ts
 var import_search_types = require("@omnicross/contracts/search-types");
@@ -3803,7 +3804,7 @@ function buildSearchDoctorSnapshot(contributions = (0, import_http.builtinHttpSe
   }
   return rows;
 }
-var SEARCH_DOCTOR_QUERY = "mozilla developer network http headers";
+var SEARCH_DOCTOR_QUERY = "MDN HTTP headers documentation";
 function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
   if (outcome.kind === "results") {
     if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
@@ -3848,6 +3849,7 @@ function classifySearchFailure(stage, code) {
 }
 
 // src/search/SearchAssembly.ts
+var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_search = require("@omnicross/core/search");
 var import_api2 = require("@omnicross/core/search/api");
 var import_http2 = require("@omnicross/core/search/http");
@@ -3864,11 +3866,24 @@ function searchPolicyFrom(config) {
     ...maxAttempts !== void 0 ? { maxAttempts } : {}
   };
 }
+function resolveSearchUpstreamDispatcher(url) {
+  return (0, import_upstreamFetch3.resolveUpstreamDispatcher)({ url });
+}
+var searchUpstreamProxyConfig = createUpstreamProxyResolver();
+function resolveSearchUpstreamProxyConfig(url) {
+  return searchUpstreamProxyConfig({ url });
+}
 function searchContributionsFrom(config) {
   return [
-    ...(0, import_http2.builtinHttpSearchContributions)(),
+    ...(0, import_http2.builtinHttpSearchContributions)(
+      (0, import_http2.createSearchHttpTransport)({
+        resolveProxyDispatcher: resolveSearchUpstreamDispatcher,
+        resolveProxyConfig: resolveSearchUpstreamProxyConfig
+      })
+    ),
     ...(0, import_api2.apiSearchContributions)(config.providers, {
-      egressPolicy: searchEgressPolicyFrom(config)
+      egressPolicy: searchEgressPolicyFrom(config),
+      resolveProxyDispatcher: resolveSearchUpstreamDispatcher
     })
   ];
 }
@@ -4012,6 +4027,18 @@ async function handleSearchDiagnostics(res, deps) {
   };
   return writeJson(res, 200, { diagnostics: snapshot });
 }
+function persistedSearchContributions(search, fetchImpl) {
+  if (fetchImpl) {
+    const egressPolicy = searchEgressPolicyFrom(search);
+    return [
+      ...(0, import_http3.builtinHttpSearchContributions)(
+        (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy })
+      ),
+      ...(0, import_api3.apiSearchContributions)(search.providers, { egressPolicy, fetchImpl })
+    ];
+  }
+  return searchContributionsFrom(search);
+}
 async function handleSearchTest(req, res, deps) {
   const status = deps.searchStatus;
   const body = await readBodyOrReject(req, res);
@@ -4029,16 +4056,8 @@ async function handleSearchTest(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...(0, import_http3.builtinHttpSearchContributions)(transport),
-    ...(0, import_api3.apiSearchContributions)(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
+  const contributions = persistedSearchContributions(search, fetchImpl);
   const contribution = contributions.find((c) => c.id === providerId);
   if (!contribution) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
@@ -4086,41 +4105,42 @@ async function handleSearchQuery(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...(0, import_http3.builtinHttpSearchContributions)(transport),
-    ...(0, import_api3.apiSearchContributions)(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
-  const contribution = contributions.find((c) => c.id === providerId);
-  if (!contribution) {
-    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
-  }
+  const runtime = (0, import_search2.createSearchRuntime)({
+    contributions: persistedSearchContributions(search, fetchImpl),
+    policy: {
+      ...searchPolicyFrom(search),
+      // The panel always walks: it answers "does a search WORK for this
+      // operator", not "does this one provider behave" — that is `/test`'s
+      // job. The persisted policy's allowlist still bounds the walk.
+      fallbackEnabled: true,
+      preferred: providerId
+    }
+  });
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    const results = await contribution.provider.search(query2, { maxResults: 5 });
+    const orchestrated = await runtime.search({ query: query2, options: { maxResults: 5 } });
+    const results = orchestrated.results;
     const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
       title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
       url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
       content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
     }));
-    const diagnostic = sanitized.length === 0 ? { providerId: contribution.id, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
-      contribution.id,
+    const diagnostic = sanitized.length === 0 ? { providerId: orchestrated.providerId, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      orchestrated.providerId,
       { kind: "results", count: sanitized.length },
       checkedAt
     );
     const response = {
       diagnostic,
+      providerUsed: orchestrated.providerId,
+      fallbackCount: orchestrated.fallbackCount,
       resultCount: sanitized.length,
       results: sanitized
     };
     return writeJson(res, 200, { result: response });
   } catch (error) {
-    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
     return writeJson(res, 200, { result: response });
   }
@@ -5770,7 +5790,7 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
+    const response = await (0, import_upstreamFetch4.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -5829,7 +5849,7 @@ async function handleTestModel(req, res, id, cfg) {
   }
   const startedAt = Date.now();
   try {
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(
+    const response = await (0, import_upstreamFetch4.fetchUpstream)(
       url,
       { method: "POST", headers, body: JSON.stringify(payload) },
       { providerId: "byo" }
@@ -7332,7 +7352,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.1" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -14338,7 +14358,7 @@ var import_node_fs23 = require("fs");
 var import_node_path24 = require("path");
 var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore2 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_subscriptions5 = require("@omnicross/subscriptions");
 
@@ -14486,7 +14506,7 @@ var JsonSubscriptionCredentialStore = class {
    * a plaintext token pair into `upstream-trace.jsonl`.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
+    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch5.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
   }
   /**
    * In-flight refresh coalescing. OAuth refresh tokens are
@@ -15044,7 +15064,7 @@ var JsonSubscriptionCredentialStore = class {
 };
 
 // src/AccountHealthProbeScheduler.ts
-var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/probe/CodexGenerationProbe.ts
 var import_codexCliHeaders = require("@omnicross/core/provider-proxy/identity/codexCliHeaders");
@@ -15205,7 +15225,7 @@ var AccountHealthProbeScheduler = class {
     this.logger = logger;
     this.config = config;
     this.now = opts.now ?? Date.now;
-    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch5.fetchUpstream;
+    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch6.fetchUpstream;
     this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.planFor = opts.planFor ?? probePlanFor;
   }
@@ -16903,7 +16923,7 @@ var AuditWriter = class {
 var import_node_fs32 = require("fs");
 var import_node_crypto24 = require("crypto");
 var import_node_path33 = require("path");
-var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
 var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -16926,7 +16946,7 @@ var BillingPublisher = class {
   constructor(billingDir, logger, opts = {}) {
     this.billingDir = billingDir;
     this.logger = logger;
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch6.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
     this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
     this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
     this.now = opts.now ?? Date.now;
@@ -17335,7 +17355,7 @@ function createRouteLeaseSubscriptionPreflight(credentials) {
 
 // src/webhook/WebhookDispatcher.ts
 var import_node_crypto25 = require("crypto");
-var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
 var WEBHOOK_MAX_ATTEMPTS = 3;
 var WEBHOOK_QUEUE_MAX = 1e3;
 var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
@@ -17355,7 +17375,7 @@ var WebhookDispatcher = class {
   sleep;
   now;
   constructor(opts = {}) {
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init));
     this.logger = opts.logger;
     this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
     this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
@@ -17622,7 +17642,7 @@ function buildDaemon(config, paths) {
   );
   (0, import_subscriptions6.setSubscriptionProviderRegistry)(subscriptionRegistry);
   setServerProxyConfig(decryptedConfig.server?.proxy);
-  (0, import_upstreamFetch8.setUpstreamProxyResolver)(
+  (0, import_upstreamFetch9.setUpstreamProxyResolver)(
     createUpstreamProxyResolver({
       getAccountProxy: (providerId, accountId) => credentialStore.getAccountProxy(providerId, accountId)
     })
@@ -17645,7 +17665,7 @@ function buildDaemon(config, paths) {
   const pricingEngine = new import_usage2.PricingEngine(pricingStore, logger, {
     // Catalog egress follows the same global/env proxy policy as every other
     // daemon upstream call; no provider/account override applies here.
-    fetchImpl: ((input, init) => (0, import_upstreamFetch8.fetchUpstream)(String(input), init ?? {}))
+    fetchImpl: ((input, init) => (0, import_upstreamFetch9.fetchUpstream)(String(input), init ?? {}))
   });
   const pricingRefreshScheduler = new PricingRefreshScheduler(
     pricingEngine,
@@ -17925,7 +17945,7 @@ function buildDaemon(config, paths) {
     // — `server.proxy.byProvider[...]` was silently skipped — and the call was
     // excluded from the upstream trace, so a failing login left no evidence.
     // `redactBodies` keeps the code/verifier + minted token out of that trace.
-    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init, { providerId, redactBodies: true }),
+    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId, redactBodies: true }),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -17991,7 +18011,7 @@ function buildDaemon(config, paths) {
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
-    fetchImpl: (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)
+    fetchImpl: (url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)());
   const auditWriter = new AuditWriter(auditDir, logger);
@@ -18073,7 +18093,7 @@ function resetDaemonSingletonsForTests() {
   (0, import_subscriptionRegistryPort.setSubscriptionRegistryForOutbound)(null);
   (0, import_subscriptions6.setSubscriptionProviderRegistry)(null);
   (0, import_subscriptions6.setSubscriptionAccountService)(null);
-  (0, import_upstreamFetch8.setUpstreamProxyResolver)(null);
+  (0, import_upstreamFetch9.setUpstreamProxyResolver)(null);
   setServerProxyConfig(void 0);
   (0, import_gemini_code_assist_resolver.setGeminiCodeAssistResolver)(null);
   setSecretBox(null);

package/dist/index.js

@@ -3789,7 +3789,8 @@ async function handleDashboard(deps) {
 // src/admin/searchAdminApi.ts
 import { DEFAULT_SEARCH_SERVER_CONFIG, loadServerConfig } from "@omnicross/core/outbound-api";
 import { apiSearchContributions as apiSearchContributions2 } from "@omnicross/core/search/api";
-import { builtinHttpSearchContributions as builtinHttpSearchContributions3, createSearchHttpTransport } from "@omnicross/core/search/http";
+import { builtinHttpSearchContributions as builtinHttpSearchContributions3, createSearchHttpTransport as createSearchHttpTransport2 } from "@omnicross/core/search/http";
+import { createSearchRuntime as createSearchRuntime2 } from "@omnicross/core/search";
 
 // src/search/searchDoctorProjection.ts
 import { toSearchErrorShape } from "@omnicross/contracts/search-types";
@@ -3855,7 +3856,7 @@ function buildSearchDoctorSnapshot(contributions = builtinHttpSearchContribution
   }
   return rows;
 }
-var SEARCH_DOCTOR_QUERY = "mozilla developer network http headers";
+var SEARCH_DOCTOR_QUERY = "MDN HTTP headers documentation";
 function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
   if (outcome.kind === "results") {
     if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
@@ -3900,9 +3901,13 @@ function classifySearchFailure(stage, code) {
 }
 
 // src/search/SearchAssembly.ts
+import { resolveUpstreamDispatcher } from "@omnicross/core/pipeline/upstreamFetch";
 import { createSearchRuntime } from "@omnicross/core/search";
 import { apiSearchContributions } from "@omnicross/core/search/api";
-import { builtinHttpSearchContributions as builtinHttpSearchContributions2 } from "@omnicross/core/search/http";
+import {
+  builtinHttpSearchContributions as builtinHttpSearchContributions2,
+  createSearchHttpTransport
+} from "@omnicross/core/search/http";
 function searchEgressPolicyFrom(config) {
   const hosts = config.egress.allowedPrivateHosts;
   return hosts.length > 0 ? { allowedPrivateHosts: [...hosts] } : {};
@@ -3916,11 +3921,24 @@ function searchPolicyFrom(config) {
     ...maxAttempts !== void 0 ? { maxAttempts } : {}
   };
 }
+function resolveSearchUpstreamDispatcher(url) {
+  return resolveUpstreamDispatcher({ url });
+}
+var searchUpstreamProxyConfig = createUpstreamProxyResolver();
+function resolveSearchUpstreamProxyConfig(url) {
+  return searchUpstreamProxyConfig({ url });
+}
 function searchContributionsFrom(config) {
   return [
-    ...builtinHttpSearchContributions2(),
+    ...builtinHttpSearchContributions2(
+      createSearchHttpTransport({
+        resolveProxyDispatcher: resolveSearchUpstreamDispatcher,
+        resolveProxyConfig: resolveSearchUpstreamProxyConfig
+      })
+    ),
     ...apiSearchContributions(config.providers, {
-      egressPolicy: searchEgressPolicyFrom(config)
+      egressPolicy: searchEgressPolicyFrom(config),
+      resolveProxyDispatcher: resolveSearchUpstreamDispatcher
     })
   ];
 }
@@ -4064,6 +4082,18 @@ async function handleSearchDiagnostics(res, deps) {
   };
   return writeJson(res, 200, { diagnostics: snapshot });
 }
+function persistedSearchContributions(search, fetchImpl) {
+  if (fetchImpl) {
+    const egressPolicy = searchEgressPolicyFrom(search);
+    return [
+      ...builtinHttpSearchContributions3(
+        createSearchHttpTransport2({ fetch: fetchImpl, egressPolicy })
+      ),
+      ...apiSearchContributions2(search.providers, { egressPolicy, fetchImpl })
+    ];
+  }
+  return searchContributionsFrom(search);
+}
 async function handleSearchTest(req, res, deps) {
   const status = deps.searchStatus;
   const body = await readBodyOrReject(req, res);
@@ -4081,16 +4111,8 @@ async function handleSearchTest(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? createSearchHttpTransport({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...builtinHttpSearchContributions3(transport),
-    ...apiSearchContributions2(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
+  const contributions = persistedSearchContributions(search, fetchImpl);
   const contribution = contributions.find((c) => c.id === providerId);
   if (!contribution) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
@@ -4138,41 +4160,42 @@ async function handleSearchQuery(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? createSearchHttpTransport({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...builtinHttpSearchContributions3(transport),
-    ...apiSearchContributions2(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
-  const contribution = contributions.find((c) => c.id === providerId);
-  if (!contribution) {
-    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
-  }
+  const runtime = createSearchRuntime2({
+    contributions: persistedSearchContributions(search, fetchImpl),
+    policy: {
+      ...searchPolicyFrom(search),
+      // The panel always walks: it answers "does a search WORK for this
+      // operator", not "does this one provider behave" — that is `/test`'s
+      // job. The persisted policy's allowlist still bounds the walk.
+      fallbackEnabled: true,
+      preferred: providerId
+    }
+  });
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    const results = await contribution.provider.search(query2, { maxResults: 5 });
+    const orchestrated = await runtime.search({ query: query2, options: { maxResults: 5 } });
+    const results = orchestrated.results;
     const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
       title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
       url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
       content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
     }));
-    const diagnostic = sanitized.length === 0 ? { providerId: contribution.id, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
-      contribution.id,
+    const diagnostic = sanitized.length === 0 ? { providerId: orchestrated.providerId, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      orchestrated.providerId,
       { kind: "results", count: sanitized.length },
       checkedAt
     );
     const response = {
       diagnostic,
+      providerUsed: orchestrated.providerId,
+      fallbackCount: orchestrated.fallbackCount,
       resultCount: sanitized.length,
       results: sanitized
     };
     return writeJson(res, 200, { result: response });
   } catch (error) {
-    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
     return writeJson(res, 200, { result: response });
   }
@@ -7398,7 +7421,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.1" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnicross/daemon",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Omnicross standalone daemon — the bare-Node embedder of @omnicross/core with an admin HTTP API + dashboard.",
   "license": "MIT",
   "author": "Sayo (https://github.com/Dumoedss)",
@@ -54,10 +54,10 @@
     "typecheck": "tsc -p tsconfig.typecheck.json --noEmit"
   },
   "dependencies": {
-    "@omnicross/contracts": "^0.2.1",
-    "@omnicross/core": "^0.2.1",
-    "@omnicross/subscriptions": "^0.2.1",
-    "@omnicross/cli-launcher": "^0.2.1",
-    "@omnicross/ui": "^0.2.1"
+    "@omnicross/contracts": "^0.3.0",
+    "@omnicross/core": "^0.3.0",
+    "@omnicross/subscriptions": "^0.3.0",
+    "@omnicross/cli-launcher": "^0.3.0",
+    "@omnicross/ui": "^0.3.0"
   }
 }