capture: honour AIUI web-search setting in node-delegated chat

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.planning/todos/pending/2026-08-06-web-search-through-node-chat.md

@@ -0,0 +1,31 @@
+---
+captured: 2026-08-06
+source: operator, during 13-14 on-device testing
+area: aiui bridge + core assistant backends + egress
+---
+
+# Honour AIUI's "web search" setting in embedded (node-delegated) chat
+
+Today, `chatStore.webSearchEnabled` only affects AIUI's DIRECT-to-Claude path
+(`streamClaude(..., proxyWebSearch, ...)`). Embedded mode delegates the whole turn to the node
+(`streamViaArchy` -> `archyBridge.sendChat` -> `assistant.chat`) and never forwards the flag, so
+the node's Claude backend answers purely from model knowledge and never searches.
+
+Operator intent: recommendations/answers should use web search **when the user has enabled it in
+AIUI settings**, and stay knowledge-only when they haven't.
+
+Work:
+- Plumb the flag: `chat:request` payload -> `assistant.chat` params -> backend call.
+- Node-side: enable Anthropic's web_search tool on the Claude leg when the flag is set. Ollama
+  leg has no web search — decide whether the flag is simply ignored there (likely) or surfaces a
+  notice.
+- **Egress/privacy review is mandatory**: a web search sends the user's query text off-node to a
+  third party. That is a NEW egress path and must go through `screen_outbound`-equivalent
+  scrutiny plus a clear owner-visible statement of what leaves. D-04's local-first posture means
+  the default stays OFF.
+- Consider whether an injected instruction could weaponise search (exfiltration via crafted
+  query) — the untrusted-content delimiters (13-12) cover the prompt, but a search query built
+  from peer content is a new sink worth a threat-model line.
+
+Related: the operator-persona fix (2026-08-06) that lets the assistant answer general questions
+and give recommendations at all — without it, content surfaces render empty in embedded mode.