unique-search-proxy 2026.44.0.dev12__tar.gz → 2026.44.0.dev14__tar.gz

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: unique-search-proxy
-Version: 2026.44.0.dev12
+Version: 2026.44.0.dev14
 Summary: Web Search Proxy implementation
 Author: ThePhilAz
 Author-email: ThePhilAz <rami.azouz@philico.com>
@@ -20,8 +20,8 @@ Requires-Dist: certifi>=2025.11.12,<2027
 Requires-Dist: google-genai>=1.73.0,<2
 Requires-Dist: google-auth>=2.43.0,<3
 Requires-Dist: jinja2>=3.1.6,<4
-Requires-Dist: unique-toolkit[monitoring]>=2026.44.0.dev9,<2026.44.0rc0
-Requires-Dist: unique-search-proxy-core>=2026.44.0.dev9,<2026.44.0rc0
+Requires-Dist: unique-toolkit[monitoring]>=2026.44.0.dev10,<2026.44.0rc0
+Requires-Dist: unique-search-proxy-core>=2026.44.0.dev10,<2026.44.0rc0
 Requires-Dist: openai>=1.105.0,<3
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
@@ -116,11 +116,11 @@ Built-in providers register in `register_builtin_providers()` during `create_app
 | `GET /ready` | Readiness (httpx pool + registered providers) |
 | `GET /v1/configuration/providers` | Registered search engine, agent engine, and crawler ids |
 | `POST /v1/search` | Standard search (flat body: `engine`, `query`, provider params, `timeout`) |
-| `POST /v1/agent-search` | Grounded agent search — opaque `answer` + `raw` |
+| `POST /v1/agent-search` | Grounded agent search — opaque `answer` + provider `citations` + `raw` |
 | `POST /v1/agent-search/stream` | Same, streamed as SSE (`delta` + `done`) |
 | `POST /v1/crawl` | Crawl URLs (flat body: `crawler`, `urls`, `timeout`, …) |
 | `GET /metrics` | Prometheus (when enabled) |
-| `/docs` | Swagger UI with preset examples |
+| `/docs` | Swagger UI with preset examples (only when `EXPOSE_DOCS=true`) |
 
 OpenAPI spec: `openapi.json` (input for [SDK codegen](../unique_search_proxy_sdk/README.md)).
 
@@ -191,7 +191,7 @@ Each result requires `url`, `title`, and `snippet`; `content` is optional.
 
 ### 5.3 Agent search (`POST /v1/agent-search`)
 
-Thin egress — proxy returns opaque agent text; callers own parsing and citation extraction:
+Thin egress — proxy returns opaque agent text and the citations the provider attached to it (Bing: Foundry `url_citation` annotations, with offsets into the answer); callers own parsing:
 
 ```json
 {
@@ -310,7 +310,7 @@ uv run python scripts/generate_sdk.py
 ## 8. Dev testing
 
 1. Start the server and configure `.env` (`.env.example` sets `REQUIRE_CONTEXT_HEADERS=false` for local use; production keeps enforcement enabled).
-2. **Swagger** — `/docs` → **Try it out** on `/v1/search` or `/v1/crawl` → pick an **Examples** preset. Context headers default to `local` in the UI.
+2. **Swagger** (if `EXPOSE_DOCS=true`) — `/docs` → **Try it out** on `/v1/search` or `/v1/crawl` → pick an **Examples** preset. Context headers default to `local` in the UI.
 3. **CLI** — same presets from the terminal (`scripts/try_presets.py` sends the same local context headers):
 
 ```bash

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/README.md

@@ -88,11 +88,11 @@ Built-in providers register in `register_builtin_providers()` during `create_app
 | `GET /ready` | Readiness (httpx pool + registered providers) |
 | `GET /v1/configuration/providers` | Registered search engine, agent engine, and crawler ids |
 | `POST /v1/search` | Standard search (flat body: `engine`, `query`, provider params, `timeout`) |
-| `POST /v1/agent-search` | Grounded agent search — opaque `answer` + `raw` |
+| `POST /v1/agent-search` | Grounded agent search — opaque `answer` + provider `citations` + `raw` |
 | `POST /v1/agent-search/stream` | Same, streamed as SSE (`delta` + `done`) |
 | `POST /v1/crawl` | Crawl URLs (flat body: `crawler`, `urls`, `timeout`, …) |
 | `GET /metrics` | Prometheus (when enabled) |
-| `/docs` | Swagger UI with preset examples |
+| `/docs` | Swagger UI with preset examples (only when `EXPOSE_DOCS=true`) |
 
 OpenAPI spec: `openapi.json` (input for [SDK codegen](../unique_search_proxy_sdk/README.md)).
 
@@ -163,7 +163,7 @@ Each result requires `url`, `title`, and `snippet`; `content` is optional.
 
 ### 5.3 Agent search (`POST /v1/agent-search`)
 
-Thin egress — proxy returns opaque agent text; callers own parsing and citation extraction:
+Thin egress — proxy returns opaque agent text and the citations the provider attached to it (Bing: Foundry `url_citation` annotations, with offsets into the answer); callers own parsing:
 
 ```json
 {
@@ -282,7 +282,7 @@ uv run python scripts/generate_sdk.py
 ## 8. Dev testing
 
 1. Start the server and configure `.env` (`.env.example` sets `REQUIRE_CONTEXT_HEADERS=false` for local use; production keeps enforcement enabled).
-2. **Swagger** — `/docs` → **Try it out** on `/v1/search` or `/v1/crawl` → pick an **Examples** preset. Context headers default to `local` in the UI.
+2. **Swagger** (if `EXPOSE_DOCS=true`) — `/docs` → **Try it out** on `/v1/search` or `/v1/crawl` → pick an **Examples** preset. Context headers default to `local` in the UI.
 3. **CLI** — same presets from the terminal (`scripts/try_presets.py` sends the same local context headers):
 
 ```bash

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "unique-search-proxy"
-version = "2026.44.0.dev12"
+version = "2026.44.0.dev14"
 description = "Web Search Proxy implementation"
 authors = [{ name = "ThePhilAz", email = "rami.azouz@philico.com" }]
 readme = "README.md"
@@ -22,8 +22,8 @@ dependencies = [
     "google-genai>=1.73.0,<2",
     "google-auth>=2.43.0,<3",
     "jinja2>=3.1.6,<4",
-    "unique-toolkit[monitoring]>=2026.44.0.dev9,<2026.44.0rc0",
-    "unique-search-proxy-core>=2026.44.0.dev9,<2026.44.0rc0",
+    "unique-toolkit[monitoring]>=2026.44.0.dev10,<2026.44.0rc0",
+    "unique-search-proxy-core>=2026.44.0.dev10,<2026.44.0rc0",
     "openai>=1.105.0,<3",
 ]
 

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/app.py

@@ -28,6 +28,7 @@ from unique_search_proxy_client.web.logging_config import (
 )
 from unique_search_proxy_client.web.middleware.context import RequestContextMiddleware
 from unique_search_proxy_client.web.monitoring import setup_prometheus
+from unique_search_proxy_client.web.settings.app import app_settings
 from unique_search_proxy_client.web.settings.request_limits import (
     request_limits_settings,
 )
@@ -92,6 +93,9 @@ def create_app() -> FastAPI:
         ),
         version="0.2.0",
         lifespan=lifespan,
+        docs_url="/docs" if app_settings.expose_docs else None,
+        redoc_url="/redoc" if app_settings.expose_docs else None,
+        openapi_url="/openapi.json" if app_settings.expose_docs else None,
         swagger_ui_parameters={
             "defaultModelsExpandDepth": 1,
             "defaultModelExpandDepth": 2,

unique_search_proxy-2026.44.0.dev14/unique_search_proxy_client/web/core/agent_engines/bing/citation_instructions.j2

@@ -0,0 +1,18 @@
+{{ generation_instructions }}
+
+## Source-isolated evidence list
+Use Bing Grounding to select distinct useful sources.
+The complete response must consist only of lines in this form:
+- <a paragraph of facts supported only by one source> <that source's citation>
+
+Each line is a paragraph, not a sentence. Write several sentences per line that report every relevant fact, figure, date, name and quote from that source, with as much detail as the source offers, often 100 to 200 words. Lines can be long; do not shorten them.
+
+Hard requirements:
+1. Exactly one line per distinct source and exactly one distinct source per line.
+2. Every line begins with `- ` and contains exactly one citation marker as its final content.
+3. Never synthesize, compare, or combine facts across sources within a line.
+4. Put all useful facts from a source into that source's one line; never cite it again.
+5. No headings, preface, conclusion, line breaks inside a paragraph, nested bullets, JSON, or uncited claims.
+6. Never invent, reconstruct, type, or guess citation markers or source URLs.
+
+Before responding, silently verify that the number of lines equals the number of distinct cited sources.

unique_search_proxy-2026.44.0.dev14/unique_search_proxy_client/web/core/agent_engines/bing/instructions.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from importlib.resources import files
+
+from jinja2 import StrictUndefined, Template
+
+# Describes the output format we want from the agent. Models do not always
+# follow it, so downstream parsing should tolerate deviations and keep what it
+# can rather than reject the whole answer.
+_CITATION_INSTRUCTIONS = Template(
+    files(__package__)
+    .joinpath("citation_instructions.j2")
+    .read_text(encoding="utf-8")
+    .strip(),
+    undefined=StrictUndefined,
+)
+
+
+def build_bing_citation_instructions(generation_instructions: str) -> str:
+    """Add citation-safe output rules without suppressing Foundry annotations."""
+    return _CITATION_INSTRUCTIONS.render(
+        generation_instructions=generation_instructions.rstrip()
+    )
+
+
+__all__ = ["build_bing_citation_instructions"]

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/core/agent_engines/bing/runner.py

@@ -2,7 +2,8 @@ from __future__ import annotations
 
 import logging
 import time
-from collections.abc import AsyncIterator
+from collections.abc import AsyncIterator, Sequence
+from typing import NamedTuple
 
 import openai
 from azure.ai.projects.aio import AIProjectClient
@@ -14,10 +15,8 @@ from azure.ai.projects.models import (
 )
 from httpx import AsyncClient
 from openai.types.responses import ResponseStreamEvent
+from openai.types.responses.response import Response
 from openai.types.responses.response_completed_event import ResponseCompletedEvent
-from openai.types.responses.response_output_item_done_event import (
-    ResponseOutputItemDoneEvent,
-)
 from openai.types.responses.response_output_message import ResponseOutputMessage
 from openai.types.responses.response_output_text import (
     AnnotationURLCitation,
@@ -28,6 +27,7 @@ from unique_search_proxy_core.agent_engines.bing.grounding import (
     BingGroundingConfiguration,
     bing_agent_name,
 )
+from unique_search_proxy_core.schema import AnswerSpanCitation
 
 from unique_search_proxy_client.web.core.agent_engines.bing.client import (
     get_openai_client,
@@ -38,6 +38,7 @@ from unique_search_proxy_client.web.settings.secret_str import NOT_PROVIDED, rea
 _LOGGER = logging.getLogger(__name__)
 
 __all__ = [
+    "BingStreamChunk",
     "create_bing_agent",
     "get_bing_grounding_tool",
     "resolve_bing_agent_name",
@@ -45,6 +46,19 @@ __all__ = [
 ]
 
 
+class BingStreamChunk(NamedTuple):
+    """One step of a Bing Responses stream.
+
+    ``answer`` and ``citations`` are set only for the completed response, and
+    the citation offsets point into ``answer``.
+    """
+
+    delta: str
+    raw_event: dict
+    answer: str | None = None
+    citations: Sequence[AnswerSpanCitation] = ()
+
+
 def resolve_bing_agent_name(
     *,
     model: str,
@@ -147,8 +161,8 @@ async def stream_bing_grounding_agent(
     instructions: str,
     grounding: BingGroundingConfiguration,
     timeout: float,
-) -> AsyncIterator[tuple[str, dict]]:
-    """Stream Bing-grounded Responses events as ``(delta_text, raw_event)`` pairs.
+) -> AsyncIterator[BingStreamChunk]:
+    """Stream Bing-grounded Responses events as :class:`BingStreamChunk` items.
 
     Optimistically calls Responses with a hash-derived agent name. If the agent
     is missing, creates it once and retries.
@@ -181,13 +195,23 @@ async def stream_bing_grounding_agent(
             resolved_name,
             exc,
         )
-        await create_bing_agent(
-            project_client,
-            agent_name=resolved_name,
-            model=model,
-            instructions=instructions,
-            grounding=grounding,
-        )
+        try:
+            await create_bing_agent(
+                project_client,
+                agent_name=resolved_name,
+                model=model,
+                instructions=instructions,
+                grounding=grounding,
+            )
+        except UnicodeDecodeError:
+            # Foundry can persist the agent but return a compressed create response
+            # that azure-core fails to decode. The Responses retry below verifies
+            # whether creation actually succeeded.
+            _LOGGER.warning(
+                "Could not decode create response for Bing agent %s; "
+                "verifying creation through Responses",
+                resolved_name,
+            )
         stream = await _create_responses_stream(
             openai_client,
             agent_name=resolved_name,
@@ -201,21 +225,13 @@ async def stream_bing_grounding_agent(
             if isinstance(event, ResponseTextDeltaEvent):
                 if event.delta:
                     emitted_text = True
-                    yield event.delta, event.model_dump(mode="json", warnings="none")
-            elif isinstance(event, ResponseOutputItemDoneEvent):
-                citations = _extract_url_citations(event)
-                if citations:
-                    yield (
-                        "",
-                        {
-                            "type": event.type,
-                            "citations": citations,
-                            "event": event.model_dump(mode="json", warnings="none"),
-                        },
+                    yield BingStreamChunk(
+                        event.delta, event.model_dump(mode="json", warnings="none")
                     )
             elif isinstance(event, ResponseCompletedEvent):
                 response = event.response
                 output_text = response.output_text
+                citations = _extract_response_url_citations(response)
                 raw_completed = {
                     "type": event.type,
                     "response": response.model_dump(mode="json", warnings="none"),
@@ -223,9 +239,16 @@ async def stream_bing_grounding_agent(
                 # Foundry sometimes delivers the full answer only on completion.
                 if output_text and not emitted_text:
                     emitted_text = True
-                    yield output_text, raw_completed
+                    yield BingStreamChunk(
+                        output_text,
+                        raw_completed,
+                        answer=output_text,
+                        citations=citations,
+                    )
                 else:
-                    yield "", raw_completed
+                    yield BingStreamChunk(
+                        "", raw_completed, answer=output_text, citations=citations
+                    )
 
 
 async def _create_responses_stream(
@@ -258,15 +281,76 @@ async def _create_responses_stream(
     return stream
 
 
-def _extract_url_citations(event: ResponseOutputItemDoneEvent) -> list[str]:
-    item = event.item
-    if not isinstance(item, ResponseOutputMessage) or not item.content:
-        return []
-    text_content = item.content[-1]
-    if not isinstance(text_content, ResponseOutputText):
+def _extract_message_url_citations(
+    item: ResponseOutputMessage,
+    *,
+    start_index_offset: int = 0,
+) -> list[AnswerSpanCitation]:
+    """Turn the URL annotations on one output message into citations.
+
+    Args:
+        item: A completed assistant message. Its text can be split across
+            several ``output_text`` parts, and each annotation's offsets are
+            relative to the part it is attached to.
+        start_index_offset: Length of the answer text before this message, so
+            the returned offsets point into the full answer.
+
+    Returns:
+        One citation per URL annotation, carrying the marker text the
+        annotation spans and its offsets into the full answer. Annotations
+        without a URL or with an empty span are skipped.
+    """
+    if not item.content:
         return []
-    return [
-        annotation.url
-        for annotation in text_content.annotations
-        if isinstance(annotation, AnnotationURLCitation) and annotation.url
-    ]
+
+    citations: list[AnswerSpanCitation] = []
+    text_offset = start_index_offset
+    for text_content in item.content:
+        if not isinstance(text_content, ResponseOutputText):
+            continue
+        for annotation in text_content.annotations or []:
+            if not isinstance(annotation, AnnotationURLCitation):
+                continue
+            marker = text_content.text[annotation.start_index : annotation.end_index]
+            if annotation.url and marker:
+                citations.append(
+                    AnswerSpanCitation(
+                        url=annotation.url,
+                        title=annotation.title,
+                        marker=marker,
+                        start_index=text_offset + annotation.start_index,
+                        end_index=text_offset + annotation.end_index,
+                        output_item_id=item.id,
+                    )
+                )
+        text_offset += len(text_content.text)
+    return citations
+
+
+def _extract_response_url_citations(
+    response: Response,
+) -> list[AnswerSpanCitation]:
+    """Extract citations with offsets into ``response.output_text``."""
+    citations: list[AnswerSpanCitation] = []
+    text_offset = 0
+    for item in response.output or []:
+        if not isinstance(item, ResponseOutputMessage):
+            continue
+        citations.extend(
+            _extract_message_url_citations(
+                item,
+                start_index_offset=text_offset,
+            )
+        )
+        text_offset += sum(
+            len(content.text)
+            for content in item.content or []
+            if isinstance(content, ResponseOutputText)
+        )
+
+    _LOGGER.info(
+        "Foundry Bing citation annotations response_id=%s citation_count=%d",
+        response.id,
+        len(citations),
+    )
+    return citations

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/core/agent_engines/bing/service.py

@@ -12,15 +12,13 @@ from unique_search_proxy_core.agent_engines.bing.grounding import (
 )
 from unique_search_proxy_core.agent_engines.bing.schema import BingAgentSearchRequest
 from unique_search_proxy_core.agent_engines.bing.settings import resolve_market
-from unique_search_proxy_core.agent_engines.resolve import (
-    resolve_output_schema_for_engine,
-)
 from unique_search_proxy_core.errors import UpstreamError
 from unique_search_proxy_core.schema import (
     AgentSearchDelta,
     AgentSearchDone,
     AgentSearchResponse,
     AgentSearchStreamEvent,
+    AnswerSpanCitation,
 )
 
 from unique_search_proxy_client.web.core.agent_engines.bing.client import (
@@ -28,15 +26,15 @@ from unique_search_proxy_client.web.core.agent_engines.bing.client import (
     get_credentials,
     get_project_client,
 )
+from unique_search_proxy_client.web.core.agent_engines.bing.instructions import (
+    build_bing_citation_instructions,
+)
 from unique_search_proxy_client.web.core.agent_engines.bing.runner import (
     stream_bing_grounding_agent,
 )
 from unique_search_proxy_client.web.core.agent_engines.service_base import (
     AgentSearchEngineService,
 )
-from unique_search_proxy_client.web.core.agent_engines.structured_output import (
-    build_agent_instructions,
-)
 from unique_search_proxy_client.web.core.provider_response import transport_error_raw
 from unique_search_proxy_client.web.settings.providers.bing_agent import (
     bing_agent_credentials,
@@ -110,12 +108,12 @@ class BingAgentSearchService(AgentSearchEngineService[BingAgentSearchRequest]):
             raise RuntimeError("HTTP client is required for Bing")
 
         answer_parts: list[str] = []
+        completed_answer: str | None = None
         raw_chunks: list[dict] = []
+        citations: list[AnswerSpanCitation] = []
 
-        output_schema = resolve_output_schema_for_engine(request.engine)
-        instructions = build_agent_instructions(
-            generation_instructions=request.generation_instructions,
-            output_schema=output_schema,
+        instructions = build_bing_citation_instructions(
+            request.generation_instructions,
         )
         grounding = BingGroundingConfiguration(
             fetch_size=request.fetch_size,
@@ -132,10 +130,7 @@ class BingAgentSearchService(AgentSearchEngineService[BingAgentSearchRequest]):
                             endpoint=read_secret(creds.endpoint),
                             transport=azure_transport,
                         ) as project_client:
-                            async for (
-                                delta,
-                                raw_event,
-                            ) in stream_bing_grounding_agent(
+                            async for chunk in stream_bing_grounding_agent(
                                 project_client,
                                 http_client=http_client,
                                 query=request.query,
@@ -144,11 +139,14 @@ class BingAgentSearchService(AgentSearchEngineService[BingAgentSearchRequest]):
                                 grounding=grounding,
                                 timeout=request.timeout,
                             ):
-                                if delta:
-                                    answer_parts.append(delta)
-                                    yield AgentSearchDelta(text=delta)
-                                if raw_event:
-                                    raw_chunks.append(raw_event)
+                                if chunk.delta:
+                                    answer_parts.append(chunk.delta)
+                                    yield AgentSearchDelta(text=chunk.delta)
+                                if chunk.raw_event:
+                                    raw_chunks.append(chunk.raw_event)
+                                if chunk.answer is not None:
+                                    completed_answer = chunk.answer
+                                    citations = list(chunk.citations)
                 break
             except Exception as exc:
                 retryable = (
@@ -163,6 +161,8 @@ class BingAgentSearchService(AgentSearchEngineService[BingAgentSearchRequest]):
                     ) from exc
 
                 raw_chunks.clear()
+                completed_answer = None
+                citations = []
                 retry_delay = _STREAM_RETRY_DELAYS_SECONDS[attempt - 1]
                 _LOGGER.warning(
                     "Bing response failed before output; retrying attempt %d/%d "
@@ -175,11 +175,14 @@ class BingAgentSearchService(AgentSearchEngineService[BingAgentSearchRequest]):
                 )
                 await asyncio.sleep(retry_delay)
 
-        answer = "".join(answer_parts)
+        answer = (
+            completed_answer if completed_answer is not None else "".join(answer_parts)
+        )
         response = AgentSearchResponse(
             engine=AgentEngineType.BING.value,
             query=request.query,
             answer=answer,
+            citations=citations,
             raw=raw_chunks if len(raw_chunks) != 1 else raw_chunks[0],
         )
         yield AgentSearchDone(response=response)

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/helm/generator/schema.py

@@ -129,6 +129,16 @@ def build_additional_schema(groups: tuple[HelmSettingsGroup, ...]) -> dict[str,
         for group in groups
         if group.helm_key is not None
     }
+    properties["networkPolicy"] = {
+        "properties": {
+            "enabled": {"type": "boolean", "default": True},
+            "allowDisabled": {
+                "type": "boolean",
+                "default": False,
+                "description": "Allow networkPolicy.enabled=false. Set only if another control restricts who can reach search-proxy.",
+            },
+        }
+    }
     return {
         "$schema": "https://json-schema.org/draft-07/schema#",
         "properties": properties,

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/helm/generator/template.py

@@ -7,6 +7,7 @@ from unique_search_proxy_client.web.helm.generator.introspect import (
 from unique_search_proxy_client.web.helm.metadata import (
     EgressDomainWildcard,
     EgressEndpointField,
+    EgressProxyHost,
 )
 from unique_search_proxy_client.web.helm.registry import HelmSettingsGroup
 
@@ -199,25 +200,83 @@ def _emit_domain_wildcard_egress(
     ]
 
 
+def _proxy_values_paths(
+    group: HelmSettingsGroup, egress: EgressProxyHost
+) -> tuple[str, str] | None:
+    host = _find_helm_field(group, egress.host_field)
+    port = _find_helm_field(group, egress.port_field)
+    if host is None or port is None:
+        return None
+    root = f".Values.{group.helm_key}"
+    return (
+        f"{root}.{host.section}.{host.helm_name}",
+        f"{root}.{port.section}.{port.helm_name}",
+    )
+
+
+def _emit_proxy_host_egress(
+    group: HelmSettingsGroup,
+    egress: EgressProxyHost,
+) -> list[str]:
+    paths = _proxy_values_paths(group, egress)
+    if paths is None:
+        return []
+
+    host, port = paths
+    ipv4_octet = r"(25[0-5]|2[0-4][0-9]|1?[0-9]{1,2})"
+    return [
+        f"{{{{ if and {host} {port} }}}}",
+        f"{{{{- $host := {host} -}}}}",
+        f"{{{{- $port := {port} -}}}}",
+        r'{{- if not (and (kindIs "string" $host) (regexMatch "^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$" $host)) -}}',
+        '{{- fail "httpClient.connection.proxyHost must be a plain hostname or IPv4 address (no scheme, port, path or IPv6 literal)." -}}',
+        "{{- end -}}",
+        '{{- if not (regexMatch "^[0-9]+$" (toString $port)) -}}',
+        '{{- fail "httpClient.connection.proxyPort must be a number." -}}',
+        "{{- else if or (lt (int $port) 1) (gt (int $port) 65535) -}}",
+        '{{- fail "httpClient.connection.proxyPort must be between 1 and 65535." -}}',
+        "{{- end -}}",
+        f'{{{{- if regexMatch "^({ipv4_octet}\\\\.){{3}}{ipv4_octet}$" $host }}}}',
+        "- toCIDR:",
+        '  - {{ printf "%s/32" $host | quote }}',
+        "{{- else }}",
+        '{{- if regexMatch "^[0-9.]+$" $host -}}',
+        '{{- fail "httpClient.connection.proxyHost is not a valid IPv4 address." -}}',
+        "{{- end }}",
+        "- toFQDNs:",
+        "  - matchName: {{ $host | quote }}",
+        "{{- end }}",
+        "  toPorts:",
+        "  - ports:",
+        "    - port: {{ $port | quote }}",
+        "      protocol: TCP",
+        "{{- end }}",
+    ]
+
+
 def _emit_egress_block(group: HelmSettingsGroup) -> list[str]:
     egress = group.egress
     if isinstance(egress, EgressEndpointField):
         return _emit_endpoint_field_egress(group, egress)
     if isinstance(egress, EgressDomainWildcard):
         return _emit_domain_wildcard_egress(group, egress)
+    if isinstance(egress, EgressProxyHost):
+        return _emit_proxy_host_egress(group, egress)
     return []
 
 
+def _egress_active_check(group: HelmSettingsGroup) -> str:
+    if isinstance(group.egress, EgressProxyHost):
+        paths = _proxy_values_paths(group, group.egress)
+        if paths is not None:
+            return f"(and {paths[0]} {paths[1]})"
+    return f"(and .Values.{group.helm_key} .Values.{group.helm_key}.enabled)"
+
+
 def _emit_has_rules_block(groups: tuple[HelmSettingsGroup, ...]) -> list[str]:
     checks = [
-        f"(and .Values.{group.helm_key} .Values.{group.helm_key}.enabled)"
-        for group in groups
-        if group.egress is not None
+        _egress_active_check(group) for group in groups if group.egress is not None
     ]
-    if not checks:
-        return ["{{/* no auto egress rules */}}"]
-    if len(checks) == 1:
-        return [f"{{{{- if {checks[0]} -}}}}true{{{{- end -}}}}"]
     joined = " ".join(checks)
     return [f"{{{{- if or {joined} -}}}}true{{{{- end -}}}}"]
 

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/helm/metadata.py

@@ -43,7 +43,15 @@ class EgressDomainWildcard:
     port: str = "443"
 
 
-EgressRule = EgressEndpointField | EgressDomainWildcard
+@dataclass(frozen=True)
+class EgressProxyHost:
+    """Proxy egress when host and port are set: /32 ``toCIDR`` for IPv4, else ``toFQDNs``."""
+
+    host_field: str = "proxy_host"
+    port_field: str = "proxy_port"
+
+
+EgressRule = EgressEndpointField | EgressDomainWildcard | EgressProxyHost
 """How a settings group's outbound egress hosts are derived from its settings."""
 
 _DEFAULT_EGRESS: EgressRule = EgressEndpointField()

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/settings/app.py

@@ -15,6 +15,7 @@ APP_ENV_PREFIX = ""
 )
 class AppSettings(BaseSettings):
     require_context_headers: bool = True
+    expose_docs: bool = False
 
 
 def get_app_settings() -> AppSettings:

{unique_search_proxy-2026.44.0.dev12 → unique_search_proxy-2026.44.0.dev14}/unique_search_proxy_client/web/settings/client.py

@@ -7,7 +7,7 @@ from unique_search_proxy_core.http_client import (
     ProxyUsernameSource,
 )
 
-from unique_search_proxy_client.web.helm.metadata import helm_settings
+from unique_search_proxy_client.web.helm.metadata import EgressProxyHost, helm_settings
 from unique_search_proxy_client.web.settings.base import get_settings
 
 HTTP_CLIENT_ENV_PREFIX = "HTTP_CLIENT_"
@@ -21,7 +21,7 @@ HTTP_CLIENT_ENV_PREFIX = "HTTP_CLIENT_"
     # the proxy fields, not by a chart-only toggle. Gating it would silently drop
     # proxy config from overlays that set it without ``enabled: true``.
     gated=False,
-    egress=None,
+    egress=EgressProxyHost(),
     env_prefix=HTTP_CLIENT_ENV_PREFIX,
     sections={
         "tuning": [

unique_search_proxy-2026.44.0.dev12/unique_search_proxy_client/web/core/agent_engines/structured_output.py

@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-import json
-
-from pydantic import BaseModel
-
-
-def build_json_output_format_rule(output_schema: type[BaseModel]) -> str:
-    """Instruction block that pins agent output to a JSON schema (Bing path)."""
-    schema_json = json.dumps(output_schema.model_json_schema(), indent=2)
-    return (
-        "## Output Format\n"
-        "Respond with a JSON object matching the schema below. "
-        "Do NOT include any text outside the JSON.\n\n"
-        f"JSON Schema:\n```json\n{schema_json}\n```"
-    )
-
-
-def build_agent_instructions(
-    *,
-    generation_instructions: str,
-    output_schema: type[BaseModel],
-) -> str:
-    """Merge generation instructions with structured-output formatting rules."""
-    return (
-        f"{generation_instructions.rstrip()}\n\n"
-        f"{build_json_output_format_rule(output_schema)}"
-    )
-
-
-__all__ = ["build_agent_instructions", "build_json_output_format_rule"]