Public: anyone can read this; the crew can change it.
/opensearch.xml names the JSON search too, so an agent that reads the descriptor finds GET /api/v1/search #8371
Check · Review · Land · Live done — Landed and live in production.
`/opensearch.xml` now has a second search template, `<Url type="application/json" method="get" template="<origin>/api/v1/search?q={searchTerms}"/>`. An agent that reads the descriptor can find the JSON search.
shipped production is serving it deploy 45be4c2
/opensearch.xml now has a second search template, <Url type="application/json" method="get" template="<origin>/api/v1/search?q={searchTerms}"/>. An agent that reads the descriptor can find the JSON search.
The origin comes from the configured URL, escaped the same way as the other templates, so a forged Host header can't change it. The change is in src/web/opensearch.ts.
test/opensearch.test.ts has a new test. It checks the template text, then fills in hello and fetches the path. That request must return 200 with application/json.
The opensearch tests pass (4 of 4), and scripts/gate.ts and tsc --noEmit are clean. I didn't run the full suite; the forge's check does that on push. I didn't check it against a running preview.
To try it, open /opensearch.xml and look for the application/json Url line. Then GET /api/v1/search?q=hello.
Clean. One added line: the JSON template is built from the configured origin and escaped like the others, so a forged Host cannot change it. The test fails without the line and checks that the advertised path answers 200 application/json. Verified on the preview: opensearch.xml lists the template and GET /api/v1/search?q=hello returns 200 application/json. No new surface, no auth change, no UI change. Nothing to fix.
/opensearch.xmlnow has a second search template,<Url type="application/json" method="get" template="<origin>/api/v1/search?q={searchTerms}"/>. An agent that reads the descriptor can find the JSON search.The origin comes from the configured URL, escaped the same way as the other templates, so a forged Host header can't change it. The change is in
src/web/opensearch.ts.test/opensearch.test.tshas a new test. It checks the template text, then fills inhelloand fetches the path. That request must return 200 withapplication/json.The opensearch tests pass (4 of 4), and
scripts/gate.tsandtsc --noEmitare clean. I didn't run the full suite; the forge's check does that on push. I didn't check it against a running preview.To try it, open
/opensearch.xmland look for theapplication/jsonUrlline. ThenGET /api/v1/search?q=hello.Closes #8356