Merge remote-tracking branch 'upstream/main' into fix/autonomy-settings-patch-test-init

# Conflicts:
#	src/openhuman/inference/provider/factory_test.rs
#	src/openhuman/memory/chat.rs

Author: oxoxDev

app/src/components/settings/panels/SearchPanel.test.tsx

@@ -0,0 +1,173 @@
+/**
+ * Tests for SearchPanel — the "Allowed websites" (unified web-access firewall)
+ * section.
+ *
+ * Covers the tri-state access mode (Allow all / Custom / Block all):
+ *  - deriving the initial mode from the loaded settings,
+ *  - "Allow all"  → persists `allow_all: true`,
+ *  - "Block all"  → persists `allowed_domains: []` + `allow_all: false`,
+ *  - "Custom"     → reveals the host editor and saving persists the list.
+ */
+import { fireEvent, screen, waitFor } from '@testing-library/react';
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+
+import { renderWithProviders } from '../../../test/test-utils';
+import SearchPanel from './SearchPanel';
+
+// ---------------------------------------------------------------------------
+// Hoisted mocks
+// ---------------------------------------------------------------------------
+const hoisted = vi.hoisted(() => ({ getSearchSettings: vi.fn(), updateSearchSettings: vi.fn() }));
+
+vi.mock('../../../utils/tauriCommands/config', () => ({
+  openhumanGetSearchSettings: (...a: unknown[]) => hoisted.getSearchSettings(...a),
+  openhumanUpdateSearchSettings: (...a: unknown[]) => hoisted.updateSearchSettings(...a),
+}));
+
+// Identity translator so we can query by the stable i18n keys.
+vi.mock('../../../lib/i18n/I18nContext', () => ({ useT: () => ({ t: (key: string) => key }) }));
+
+vi.mock('../hooks/useSettingsNavigation', () => ({
+  useSettingsNavigation: () => ({ navigateBack: vi.fn(), breadcrumbs: [] }),
+}));
+
+// Authed (non-local) session so the panel behaves normally.
+vi.mock('../../../utils/localSession', () => ({ isLocalSessionToken: () => false }));
+
+function settings(overrides: Record<string, unknown> = {}) {
+  return {
+    engine: 'managed',
+    effective_engine: 'managed',
+    max_results: 5,
+    timeout_secs: 15,
+    parallel_configured: false,
+    brave_configured: false,
+    allowed_domains: ['reuters.com'],
+    allow_all: false,
+    ...overrides,
+  };
+}
+
+const PLACEHOLDER = 'settings.search.allowedSitesPlaceholder';
+const ALLOW_ALL = 'settings.search.accessAllowAll';
+const CUSTOM = 'settings.search.accessCustom';
+const BLOCK_ALL = 'settings.search.accessBlockAll';
+
+const radio = (name: string) => screen.getByRole('radio', { name });
+
+describe('SearchPanel — unified web-access modes', () => {
+  beforeEach(() => {
+    hoisted.getSearchSettings.mockReset();
+    hoisted.updateSearchSettings.mockReset();
+    hoisted.getSearchSettings.mockResolvedValue({ result: settings() });
+    hoisted.updateSearchSettings.mockResolvedValue({ result: {} });
+  });
+
+  test('explicit host list → starts in Custom mode with the editor populated', async () => {
+    renderWithProviders(<SearchPanel embedded />);
+    // The textarea mounts empty, then a one-time sync effect fills it from
+    // settings on the next tick — wait for the value rather than asserting now.
+    await waitFor(() => {
+      const ta = screen.getByPlaceholderText(PLACEHOLDER) as HTMLTextAreaElement;
+      expect(ta.value).toBe('reuters.com');
+    });
+    expect(radio(CUSTOM)).toHaveAttribute('aria-checked', 'true');
+    expect(radio(ALLOW_ALL)).toHaveAttribute('aria-checked', 'false');
+  });
+
+  test('selecting "Allow all" persists allow_all: true and hides the editor', async () => {
+    renderWithProviders(<SearchPanel embedded />);
+    await screen.findByPlaceholderText(PLACEHOLDER);
+
+    fireEvent.click(radio(ALLOW_ALL));
+
+    await waitFor(() =>
+      expect(hoisted.updateSearchSettings).toHaveBeenCalledWith({ allow_all: true })
+    );
+    expect(screen.queryByPlaceholderText(PLACEHOLDER)).toBeNull();
+  });
+
+  test('selecting "Block all" persists an empty allowlist and hides the editor', async () => {
+    renderWithProviders(<SearchPanel embedded />);
+    await screen.findByPlaceholderText(PLACEHOLDER);
+
+    fireEvent.click(radio(BLOCK_ALL));
+
+    await waitFor(() =>
+      expect(hoisted.updateSearchSettings).toHaveBeenCalledWith({
+        allowed_domains: [],
+        allow_all: false,
+      })
+    );
+    expect(screen.queryByPlaceholderText(PLACEHOLDER)).toBeNull();
+  });
+
+  test('Custom: saving an edited host list persists allowed_domains + allow_all: false', async () => {
+    renderWithProviders(<SearchPanel embedded />);
+    const textarea = await screen.findByPlaceholderText(PLACEHOLDER);
+
+    fireEvent.change(textarea, { target: { value: 'github.com\n  apnews.com  \n\n' } });
+    fireEvent.click(screen.getByText('settings.search.allowedSitesSave'));
+
+    await waitFor(() =>
+      expect(hoisted.updateSearchSettings).toHaveBeenCalledWith({
+        allowed_domains: ['github.com', 'apnews.com'],
+        allow_all: false,
+      })
+    );
+  });
+
+  test('Custom: pasted URLs are normalized to bare hosts before persisting', async () => {
+    renderWithProviders(<SearchPanel embedded />);
+    const textarea = await screen.findByPlaceholderText(PLACEHOLDER);
+
+    // Users paste full URLs; url_guard matches on host, so a scheme/path entry
+    // would never match. The editor strips both down to the bare host.
+    fireEvent.change(textarea, {
+      target: { value: 'https://reuters.com/markets\nhttp://apnews.com/\ngithub.com' },
+    });
+    fireEvent.click(screen.getByText('settings.search.allowedSitesSave'));
+
+    await waitFor(() =>
+      expect(hoisted.updateSearchSettings).toHaveBeenCalledWith({
+        allowed_domains: ['reuters.com', 'apnews.com', 'github.com'],
+        allow_all: false,
+      })
+    );
+  });
+
+  test('allow_all settings → starts in Allow-all mode with no editor', async () => {
+    hoisted.getSearchSettings.mockResolvedValue({
+      result: settings({ allowed_domains: ['*'], allow_all: true }),
+    });
+    renderWithProviders(<SearchPanel embedded />);
+
+    await waitFor(() => expect(radio(ALLOW_ALL)).toHaveAttribute('aria-checked', 'true'));
+    expect(screen.queryByPlaceholderText(PLACEHOLDER)).toBeNull();
+  });
+
+  test('empty allowlist → starts in Block-all mode with no editor', async () => {
+    hoisted.getSearchSettings.mockResolvedValue({
+      result: settings({ allowed_domains: [], allow_all: false }),
+    });
+    renderWithProviders(<SearchPanel embedded />);
+
+    await waitFor(() => expect(radio(BLOCK_ALL)).toHaveAttribute('aria-checked', 'true'));
+    expect(screen.queryByPlaceholderText(PLACEHOLDER)).toBeNull();
+  });
+
+  test('switching Block → Custom keeps the previously typed hosts', async () => {
+    renderWithProviders(<SearchPanel embedded />);
+    const textarea = (await screen.findByPlaceholderText(PLACEHOLDER)) as HTMLTextAreaElement;
+    fireEvent.change(textarea, { target: { value: 'example.com' } });
+
+    // Block all (persists empty list) then back to Custom — the editor text is
+    // local state and must survive the round trip so the user doesn't lose it.
+    fireEvent.click(radio(BLOCK_ALL));
+    await waitFor(() => expect(screen.queryByPlaceholderText(PLACEHOLDER)).toBeNull());
+    fireEvent.click(radio(CUSTOM));
+
+    const reopened = (await screen.findByPlaceholderText(PLACEHOLDER)) as HTMLTextAreaElement;
+    expect(reopened.value).toBe('example.com');
+  });
+});

app/src/components/settings/panels/SearchPanel.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 
 import { useT } from '../../../lib/i18n/I18nContext';
 import { useCoreState } from '../../../providers/CoreStateProvider';
@@ -8,6 +8,7 @@ import {
   openhumanUpdateSearchSettings,
   type SearchEngineId,
   type SearchSettings,
+  type SearchSettingsUpdate,
 } from '../../../utils/tauriCommands/config';
 import SettingsHeader from '../components/SettingsHeader';
 import { useSettingsNavigation } from '../hooks/useSettingsNavigation';
@@ -19,13 +20,38 @@ type Status =
   | { kind: 'saved' }
   | { kind: 'error'; message: string };
 
+/**
+ * Tri-state web-access mode for the unified fetch + browser allowlist.
+ * - `all`    → `allow_all: true` (the `"*"` wildcard)
+ * - `custom` → `allow_all: false` + an explicit host list (textarea)
+ * - `block`  → `allow_all: false` + an empty host list (no web access)
+ *
+ * `block` and an empty `custom` are indistinguishable once persisted (both are
+ * `allow_all: false` + `[]`); the distinction only matters locally while
+ * editing.
+ */
+type AccessMode = 'all' | 'custom' | 'block';
+
 interface EngineOption {
   id: SearchEngineId;
   label: string;
   description: string;
   requiresKey: boolean;
 }
 
+/**
+ * Normalize a user-entered allowed-site entry down to a bare host so it
+ * matches `url_guard`'s host-based comparison. Strips a leading scheme and any
+ * path/query/fragment — e.g. `https://reuters.com/markets` → `reuters.com` —
+ * and trims surrounding whitespace. The `*` allow-all wildcard is preserved.
+ */
+const normalizeAllowedHost = (raw: string): string =>
+  raw
+    .trim()
+    .replace(/^[a-z][a-z0-9+.-]*:\/\//i, '')
+    .replace(/\/.*$/, '')
+    .trim();
+
 const SearchPanel = ({ embedded = false }: { embedded?: boolean }) => {
   const { t } = useT();
   const { navigateBack, breadcrumbs } = useSettingsNavigation();
@@ -38,6 +64,15 @@ const SearchPanel = ({ embedded = false }: { embedded?: boolean }) => {
   const [braveKey, setBraveKey] = useState<string>('');
   const [showParallel, setShowParallel] = useState(false);
   const [showBrave, setShowBrave] = useState(false);
+  // Editor text for the allowed-websites host list (one host per line). The
+  // "*" wildcard is represented by the access mode, not shown here.
+  const [allowedText, setAllowedText] = useState<string>('');
+  // Tri-state web-access mode for the unified fetch + browser allowlist.
+  const [mode, setMode] = useState<AccessMode>('all');
+  // Sync editor + mode from settings exactly once, so a later settings refresh
+  // (e.g. after saving an engine change) can't clobber the user's in-progress
+  // host edits or chosen mode.
+  const initializedRef = useRef(false);
 
   const ENGINES: EngineOption[] = [
     {
@@ -80,6 +115,15 @@ const SearchPanel = ({ embedded = false }: { embedded?: boolean }) => {
     };
   }, []);
 
+  // Reflect the loaded allowlist into the editor + mode, exactly once.
+  useEffect(() => {
+    if (!settings || initializedRef.current) return;
+    initializedRef.current = true;
+    const explicit = settings.allowed_domains.filter(d => d !== '*');
+    setAllowedText(explicit.join('\n'));
+    setMode(settings.allow_all ? 'all' : explicit.length > 0 ? 'custom' : 'block');
+  }, [settings]);
+
   const selectedEngine = (settings?.engine as SearchEngineId | undefined) ?? 'managed';
 
   const persistEngine = async (next: SearchEngineId) => {
@@ -115,6 +159,38 @@ const SearchPanel = ({ embedded = false }: { embedded?: boolean }) => {
     }
   };
 
+  const persistSearchUpdate = async (update: SearchSettingsUpdate) => {
+    if (!settings || status.kind === 'saving') return;
+    setStatus({ kind: 'saving' });
+    try {
+      await openhumanUpdateSearchSettings(update);
+      const refreshed = await openhumanGetSearchSettings();
+      setSettings(refreshed.result);
+      setStatus({ kind: 'saved' });
+    } catch (err) {
+      setStatus({ kind: 'error', message: err instanceof Error ? err.message : String(err) });
+    }
+  };
+
+  // Switch web-access mode. "Allow all" / "Block all" persist immediately;
+  // "Custom" only reveals the host editor (its Save button persists the list),
+  // and we keep whatever the user has already typed.
+  const selectMode = (next: AccessMode) => {
+    if (status.kind === 'saving') return;
+    setMode(next);
+    if (next === 'all') {
+      void persistSearchUpdate({ allow_all: true });
+    } else if (next === 'block') {
+      void persistSearchUpdate({ allowed_domains: [], allow_all: false });
+    }
+  };
+
+  const persistAllowedDomains = () => {
+    const domains = allowedText.split('\n').map(normalizeAllowedHost).filter(Boolean);
+    // Editing the explicit host list implies "not allow-all".
+    void persistSearchUpdate({ allowed_domains: domains, allow_all: false });
+  };
+
   const isConfigured = (engine: SearchEngineId): boolean => {
     if (!settings) return false;
     if (engine === 'managed') return true;
@@ -260,6 +336,75 @@ const SearchPanel = ({ embedded = false }: { embedded?: boolean }) => {
               />
             </div>
 
+            {/* Allowed websites — unified host allowlist shared by web_fetch /
+                curl and (when enabled) the browser tool. Web search is not
+                gated by this list. */}
+            <div className="rounded-xl border border-stone-200 dark:border-neutral-800 bg-white dark:bg-neutral-900 p-3 space-y-2">
+              {/* Section heading, not a form label — use a <p> so screen
+                  readers don't announce an orphan <label> with no htmlFor. */}
+              <p className="text-xs font-semibold text-stone-700 dark:text-neutral-200">
+                {t('settings.search.allowedSitesLabel')}
+              </p>
+              <div
+                role="radiogroup"
+                aria-label={t('settings.search.accessModeAria')}
+                className="flex rounded-lg border border-stone-200 dark:border-neutral-800 overflow-hidden">
+                {(
+                  [
+                    ['all', 'settings.search.accessAllowAll'],
+                    ['custom', 'settings.search.accessCustom'],
+                    ['block', 'settings.search.accessBlockAll'],
+                  ] as const
+                ).map(([value, labelKey], idx) => {
+                  const selected = mode === value;
+                  return (
+                    <button
+                      key={value}
+                      type="button"
+                      role="radio"
+                      aria-checked={selected}
+                      onClick={() => selectMode(value)}
+                      disabled={status.kind === 'saving'}
+                      className={`flex-1 px-3 py-1.5 text-xs font-medium transition-colors disabled:opacity-50 focus:outline-none focus-visible:bg-primary-50 dark:focus-visible:bg-primary-900/30 ${
+                        idx !== 0 ? 'border-l border-stone-200 dark:border-neutral-800' : ''
+                      } ${
+                        selected
+                          ? 'bg-primary-500 text-white'
+                          : 'bg-white dark:bg-neutral-900 text-stone-700 dark:text-neutral-200 hover:bg-stone-50 dark:hover:bg-neutral-800/60'
+                      }`}>
+                      {t(labelKey)}
+                    </button>
+                  );
+                })}
+              </div>
+              <p className="text-[11px] text-stone-500 dark:text-neutral-400 leading-relaxed">
+                {mode === 'all'
+                  ? t('settings.search.allowedSitesAllOn')
+                  : mode === 'block'
+                    ? t('settings.search.accessBlockAllHint')
+                    : t('settings.search.allowedSitesHint')}
+              </p>
+              {mode === 'custom' && (
+                <>
+                  <textarea
+                    value={allowedText}
+                    onChange={e => setAllowedText(e.target.value)}
+                    rows={4}
+                    spellCheck={false}
+                    placeholder={t('settings.search.allowedSitesPlaceholder')}
+                    className="w-full rounded-lg border border-stone-200 dark:border-neutral-800 bg-stone-50 dark:bg-neutral-800/60 px-2 py-1.5 text-xs font-mono text-stone-800 dark:text-neutral-100 focus:outline-none focus-visible:border-primary-400"
+                  />
+                  <button
+                    type="button"
+                    onClick={() => persistAllowedDomains()}
+                    disabled={status.kind === 'saving'}
+                    className="px-3 py-1.5 rounded-lg text-xs font-medium bg-primary-500 text-white hover:bg-primary-600 disabled:opacity-50">
+                    {t('settings.search.allowedSitesSave')}
+                  </button>
+                </>
+              )}
+            </div>
+
             <div
               role="status"
               aria-live="polite"

app/src/lib/i18n/chunks/ar-1.ts

@@ -1319,6 +1319,19 @@ const ar1: TranslationMap = {
   'subconscious.priority.normal': 'عادي',
   'subconscious.durationSeconds': '{seconds}s',
   'subconscious.durationMilliseconds': '{milliseconds}ms',
+  'settings.search.allowedSitesLabel': 'Allowed websites',
+  'settings.search.allowedSitesHint':
+    'Websites the assistant may open and read while researching (one host per line, e.g. reuters.com). A host also covers its subdomains. Leave empty to block all web access.',
+  'settings.search.allowedSitesAllOn':
+    'The assistant can open any public website. Local and private addresses stay blocked.',
+  'settings.search.allowedSitesPlaceholder': 'reuters.com\napnews.com\ngithub.com',
+  'settings.search.allowedSitesSave': 'Save websites',
+  'settings.search.accessModeAria': 'Web access mode',
+  'settings.search.accessAllowAll': 'Allow all',
+  'settings.search.accessCustom': 'Custom',
+  'settings.search.accessBlockAll': 'Block all',
+  'settings.search.accessBlockAllHint':
+    'All web access is blocked — the assistant cannot open or read any website.',
 };
 
 export default ar1;