feat(search): enable MindSearch defaults and sanitize user-facing search language.

Grant search_external and network egress for default users, enable search-enhanced skill, redact internal architecture terms from assistant UI text, and neutralize search skill prompts so chats use dual-engine web search without exposing vendor names.

Co-authored-by: Cursor <cursoragent@cursor.com>

user-auth.mjs

@@ -1737,6 +1737,28 @@ export function createUserAuth(pool, options = {}) {
     );
   };
 
+  /** Enable MindSearch (tkmind_search via SearXNG) for existing role defaults. */
+  const upgradeSearchExternalCapability = async () => {
+    const now = Date.now();
+    await pool.query(
+      `INSERT INTO h5_capability_grants (subject_type, subject_id, capability_key, allowed, updated_at)
+       VALUES ('role', 'user', 'search_external', 1, ?)
+       ON DUPLICATE KEY UPDATE allowed = 1, updated_at = VALUES(updated_at)`,
+      [now],
+    );
+  };
+
+  /** Allow network egress so platform/web and MindSearch MCP can run searches. */
+  const upgradeSearchNetworkEgress = async () => {
+    const now = Date.now();
+    await pool.query(
+      `INSERT INTO h5_user_policies (subject_type, subject_id, policy_key, policy_value, updated_at)
+       VALUES ('role', 'user', 'network_egress', 'allow', ?)
+       ON DUPLICATE KEY UPDATE policy_value = 'allow', updated_at = VALUES(updated_at)`,
+      [now],
+    );
+  };
+
   /** Enable platform skill loading + chat recall for existing role defaults. */
   const upgradeDefaultUserCapabilities = async () => {
     const now = Date.now();
@@ -2236,6 +2258,8 @@ export function createUserAuth(pool, options = {}) {
     await seedRoleCapabilityDefaults();
     await upgradeMemoryStoreCapability();
     await upgradeWebCapability();
+    await upgradeSearchExternalCapability();
+    await upgradeSearchNetworkEgress();
     await upgradeDefaultUserCapabilities();
     await seedRolePolicyDefaults();
     await seedRoleSkillDefaults();