host
b72a2abae4
Worker --websearch-mcp (default off) seeds tenant codex-home with websearch MCP on _tenant_dirs (container path); old tenants merge on next task. Autoscaler unit gains the flag. Tinyproxy filter adds Perplexity/Exa/Tavily/Brave/DuckDuckGo + exact searx.diante.me (no diante.me wildcard, control plane stays out). Tests: test_websearch_worker 4 + websearch_mcp 12 + tenant 7 = 23 OK. Not pushed, not merged, not deployed; SearXNG host/DNS/nginx and tinyproxy reload are host steps.
34 lines
1.5 KiB
Plaintext
34 lines
1.5 KiB
Plaintext
# Tinyproxy Filter: ONE regex per line, matched against the bare
|
|
# domain for CONNECT requests (the log shows e.g. filtered domain
|
|
# "xcmapi.org" -- no scheme, no :port suffix).
|
|
#
|
|
# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
|
|
# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
|
|
# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
|
|
# verified on 2026-10-26 to deny even xcmapi.org itself, while the
|
|
# basic-syntax equivalent below allows it. In basic regex, groups
|
|
# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
|
|
# literal characters. Do NOT "modernize" these patterns.
|
|
#
|
|
# Each entry is anchored (^...$) to the domain and its subdomains
|
|
# only: a bare substring "github.com" would also match
|
|
# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
|
|
# "label." segments, so xcmapi.org and api.xcmapi.org match, while
|
|
# notxcmapi.org and xcmapi.org.evil.com do not.
|
|
^\(.*\.\)*xcmapi\.org$
|
|
^\(.*\.\)*github\.com$
|
|
^\(.*\.\)*githubusercontent\.com$
|
|
^\(.*\.\)*pypi\.org$
|
|
^\(.*\.\)*pythonhosted\.org$
|
|
^\(.*\.\)*npmjs\.org$
|
|
# Web search MCP v1 (see docs/web-search-mcp.md). Each line is the
|
|
# API host's domain, subdomains included, in the same BASIC form.
|
|
# searx.diante.me is exact-only on purpose: a \(.*\.\)*diante.me$
|
|
# line would also let tasks reach api.diante.me (the control plane).
|
|
^\(.*\.\)*perplexity\.ai$
|
|
^\(.*\.\)*exa\.ai$
|
|
^\(.*\.\)*tavily\.com$
|
|
^\(.*\.\)*search\.brave\.com$
|
|
^\(.*\.\)*duckduckgo\.com$
|
|
^searx\.diante\.me$
|