feat(search): commercial-parity features and privacy hardening from Android 26.07.03#100
Merged
Merged
Conversation
…ndroid 26.07.03 Port of the Android parity sweep (SearchMob PR #103) to the desktop app: New features, all computed on-device with no new third parties: - Instant answers: calculator (2+2, sqrt(9)*3), unit conversions (10 km to miles, 72 f to c), number-base conversions (0xff in decimal), and percentages (15% of 80), shown as an answer card on the served page and in the GUI. Date/phone-shaped input is guarded so the card never mis-fires. - DuckDuckGo-style !bangs (!w, !gh, !yt, ...) resolved from a curated on-device table: the served /search 302s to the site's own search and the GUI opens the browser directly; the terms never enter the metasearch fan-out, and unknown tags (!important) are never hijacked. - Search-as-you-type on the served pages: an ARIA-listbox dropdown over /suggest with debounce, stale-fetch aborts, and keyboard support; '/' focuses the search box. The served meta line shows result count and elapsed time, a favicon is served, and the topbar/sort/did-you-mean controls carry the active vertical and sort instead of resetting them. Privacy hardening: - The Wikipedia summary thumbnail is re-served through a new loopback /img proxy (SSRF-scoped to upload.wikimedia.org, image-only, size-capped) so the browser never fetches from Wikimedia directly; CSP tightens from img-src https: to img-src 'self' data: plus connect-src 'self'. - One User-Agent per logical search (a client pins its UA; fresh searches still rotate), refreshed UA pool, process-wide thread-safe per-host politeness spacing, and a whole-call HTTP deadline so a byte-trickling upstream cannot hold a search open. - The OpenSearch descriptor uses the request Host for network-mode visitors and never embeds the access token. Correctness fixes: - Vertical scoping no longer poisons engines without site:/OR syntax (Wikipedia/Marginalia/Mwmbl get the operator-free query; constraints stay locally enforced). - Dedup key folds http/https and mobile-host variants; merged results backfill a blank title; domain rules resolve most-specific-first; slash dates with day>12 parse day-first; before:/after: accept single-digit months/days. - GUI: stale searches can no longer overwrite fresh results or flash their error; the engine-status diagnostic renders on empty served pages; the search field takes focus explicitly on launch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
The code-quality bot flagged the mixed 'import ... as' + 'from ... import' of the same module; the module alias stays (the monkeypatching needs it) and MainWindow is reached through it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Brings the desktop app to feature parity with Android v26.07.03 (SearchMob PR #103): instant answers, !bangs, search-as-you-type on the served pages, the Wikipedia-thumbnail privacy proxy, User-Agent pinning + per-host politeness + whole-call HTTP deadline, and the cross-layer ranking/parsing fixes.
New (all on-device, no new third parties)
/search302s to the site's own search, the GUI opens the browser directly. Terms never enter the metasearch fan-out; unknown tags fall through./suggest, debounced, aborts stale fetches,/focuses the box), result count + elapsed time meta line, a favicon, and the topbar/sort/did-you-mean controls now carry the active vertical and sort.Privacy
/imgproxy (scoped toupload.wikimedia.org, image-only, size-capped); CSP tightens toimg-src 'self' data:+connect-src 'self'.Fixes
site:clauses their indexes cannot parse.after:dates parse.24 new tests (instant answers, bangs, parity fixes, route-level parity features, GUI parity) plus updated proxy/descriptor tests;
ruff+mypy --strict+ full suite green locally (818 passed).Release chore for 26.07.02 follows after merge.
🤖 Generated with Claude Code