Let General Chat search the web, and only General Chat

Search is the one capability that fits the profile holding none: every other capability either reads this installation or changes it, and chat's whole contract is that it can do neither. The assistant deliberately does not get it — its contract is that answers come from this install's own documents, and a web result there is an answer that looks sourced and is not. A chat question about this machine hands off to the assistant before the search would run, so it never reaches the internet even with the box ticked. Off by default, and not because it is dangerous: searching sends the operator's question outside the house, which is theirs to decide. Asked for per turn as well as enabled in conf. Provider-agnostic, as asked — searxng, brave, tavily. Only whichever is configured here can be verified; all three read every field by name, so a shape that changes underneath yields no results rather than wrong ones. The explain fixtures asserted chat holds no capabilities at all, which is exactly the guarantee worth keeping. caps=only: now states the set rather than its emptiness, so the check still fails the day something else is granted there.
2026-08-09 22:42:43 -04:00
parent 47861b0dc3
commit 613634473a
10 changed files with 405 additions and 12 deletions
@@ -440,7 +440,10 @@ if ($action === 'ask') {
         . escapeshellarg($kind) . ' '
         . escapeshellarg(($_POST['think'] ?? '1') === '1' ? '1' : '0') . ' '
         . escapeshellarg($profile) . ' '
-         . escapeshellarg($scope)
+         . escapeshellarg($scope) . ' '
+         // Asked for per turn. Only meaningful on a profile holding web_search — the worker
+         // checks that, so a crafted web=1 against any other profile changes nothing.
+         . escapeshellarg(($_POST['web'] ?? '') === '1' ? '1' : '0')
         . ' >/dev/null 2>&1 </dev/null &';
    $out = []; $rc = 0;
    exec($cmd, $out, $rc);