feat: prepare deep search production runtime

mindsearch.test.mjs

@@ -7,11 +7,15 @@ import {
   probeMindSearchService,
   resolveMindSearchService,
 } from './mindsearch-config.mjs';
-import { buildAgentExtensionPolicy, DEFAULT_USER_CAPABILITIES } from './capabilities.mjs';
+import {
+  buildAgentExtensionPolicy,
+  DEFAULT_USER_CAPABILITIES,
+} from './capabilities.mjs';
 import {
   cancelResearchTask,
   getResearchTask,
   searchGithubCode,
+  searchGithubGateway,
   searchResearchService,
   searchSearxng,
   startResearchTask,
@@ -102,12 +106,40 @@ test('MindSearch never changes legacy web extension and is gated by capability/c
       enabled: true,
       mode: 'assist',
       providers: {},
-      services: [{ id: 'deep-search', enabled: true, adapter: 'research-http' }],
+      settings: { searxngEndpoint: 'http://127.0.0.1:20080/search' },
+      services: [
+        {
+          id: 'searxng',
+          enabled: true,
+          adapter: 'searxng',
+          endpoint: 'http://127.0.0.1:20080/search',
+        },
+        {
+          id: 'deep-search',
+          enabled: true,
+          adapter: 'research-http',
+          endpoint: 'http://127.0.0.1:20100',
+        },
+      ],
       routes: { research: 'deep-search' },
     },
   });
   const extension = policy.extensionOverrides.find((ext) => ext.name === 'tkmind-search');
   assert.equal(extension.envs.TKMIND_SEARCH_USER_ID, 'user-123');
+  assert.equal(
+    extension.envs.TKMIND_SEARCH_SEARXNG_URL,
+    'http://host.docker.internal:20080/search',
+  );
+  assert.equal(
+    extension.envs.TKMIND_SEARCH_GITHUB_GATEWAY_URL,
+    'http://host.docker.internal:20100/',
+  );
+  assert.equal(extension.envs.GITHUB_TOKEN, undefined);
+  const mcpServices = JSON.parse(extension.envs.TKMIND_SEARCH_SERVICES_JSON);
+  assert.equal(
+    mcpServices.find((service) => service.id === 'deep-search').endpoint,
+    'http://host.docker.internal:20100/',
+  );
   assert.ok(extension.available_tools.includes('tkmind_research_status'));
   assert.ok(extension.available_tools.includes('tkmind_research_cancel'));
 });
@@ -125,6 +157,31 @@ test('GitHub code adapter sends bounded queries and normalizes results', async (
   assert.equal(result[0].source, 'github');
 });
 
+test('GitHub gateway keeps the provider token outside the MCP process', async () => {
+  let requested;
+  const result = await searchGithubGateway('repo:openai goose', {
+    endpoint: 'http://deep-search.local:20100',
+    secret: 'gateway-secret',
+    fetchImpl: async (url, options) => {
+      requested = { url: String(url), options };
+      return {
+        ok: true,
+        json: async () => ({
+          results: [{
+            title: 'openai/goose:src/goose.rs',
+            url: 'https://github.com/openai/goose/blob/main/src/goose.rs',
+            snippet: 'agent',
+          }],
+        }),
+      };
+    },
+  });
+  assert.equal(requested.url, 'http://deep-search.local:20100/v1/providers/github/search');
+  assert.equal(requested.options.headers['x-secret-key'], 'gateway-secret');
+  assert.equal(requested.options.headers.authorization, undefined);
+  assert.equal(result[0].source, 'github');
+});
+
 test('Research service adapter uses the stable HTTP contract', async () => {
   const requests = [];
   const fetchImpl = async (url, options) => {