fix(web): enforce native search constraints before fallback

Apply domain constraints before accepting a provider-native attempt, keep generated answers behind the surviving citation boundary, and preserve an independent configured-search timeout.\n\nRefs Hmbown#5681.

Signed-off-by: hexin <372726039@qq.com>

Author: h3c-hexin

CHANGELOG.md

@@ -86,6 +86,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Provider-native web search now applies domain constraints before accepting an
+  attempt, discards generated answers when returned citations violate those
+  constraints, and preserves the caller's configured/local timeout as an
+  independent fallback budget (#5681).
 - Idle session metrics omit zero facts (`0 turns`, `LLM 0s`) until the
   runtime has evidence. Working chrome says `in the current` instead of a
   generic `working`.

crates/tui/src/tools/web/backend.rs

@@ -138,13 +138,21 @@ impl<'a> SearchBackendChain<'a> {
         query: &SearchQuery,
         deadline: Instant,
         first_attempt_budget: Option<Duration>,
+        fallback_budget_after_first: Option<Duration>,
     ) -> Result<ChainedSearch, ToolError> {
         let backends = self
             .backends
             .iter()
             .map(|backend| backend.as_ref())
             .collect::<Vec<_>>();
-        run_backend_chain(&backends, query, deadline, first_attempt_budget).await
+        run_backend_chain(
+            &backends,
+            query,
+            deadline,
+            first_attempt_budget,
+            fallback_budget_after_first,
+        )
+        .await
     }
 }
 
@@ -165,14 +173,20 @@ const fn provider_native_is_available(capability_supported: bool, client_present
 async fn run_backend_chain(
     backends: &[&dyn SearchBackend],
     query: &SearchQuery,
-    deadline: Instant,
+    mut deadline: Instant,
     first_attempt_budget: Option<Duration>,
+    fallback_budget_after_first: Option<Duration>,
 ) -> Result<ChainedSearch, ToolError> {
     let mut degraded = Vec::new();
     let mut last_empty = None;
     let mut attempted = Vec::new();
 
     for (index, backend) in backends.iter().enumerate() {
+        if index == 1
+            && let Some(fallback_budget) = fallback_budget_after_first
+        {
+            deadline = Instant::now() + fallback_budget.max(Duration::from_millis(1));
+        }
         let remaining = deadline.saturating_duration_since(Instant::now());
         if remaining.is_zero() {
             break;
@@ -208,20 +222,19 @@ async fn run_backend_chain(
             .and_then(std::convert::identity);
 
         match result {
-            Ok(mut raw) if !raw.results.is_empty() => {
-                degraded.append(&mut raw.degraded);
-                raw.degraded = degraded;
-                return Ok(ChainedSearch {
-                    raw,
-                    capabilities: backend.capabilities(),
-                });
-            }
             Ok(mut raw) => {
+                let capabilities = backend.capabilities();
+                crate::tools::web_search::apply_domain_constraints(query, capabilities, &mut raw);
+                if !raw.results.is_empty() {
+                    degraded.append(&mut raw.degraded);
+                    raw.degraded = degraded;
+                    return Ok(ChainedSearch { raw, capabilities });
+                }
                 degraded.push(DegradedReason::NoUsableResults {
                     backend: backend_id,
                 });
                 degraded.append(&mut raw.degraded);
-                last_empty = Some((raw, backend.capabilities()));
+                last_empty = Some((raw, capabilities));
             }
             Err(error) if is_fail_closed(&error) => return Err(error),
             Err(error) if backends.len() == 1 => return Err(error),
@@ -403,6 +416,12 @@ mod tests {
         result: Result<Vec<super::super::contract::SearchResult>, ToolError>,
     }
 
+    struct DeadlineBackend {
+        id: BackendId,
+        observed_budget: Arc<Mutex<Option<Duration>>>,
+        delay: Duration,
+    }
+
     #[async_trait]
     impl SearchBackend for FakeBackend {
         fn id(&self) -> BackendId {
@@ -429,6 +448,35 @@ mod tests {
         }
     }
 
+    #[async_trait]
+    impl SearchBackend for DeadlineBackend {
+        fn id(&self) -> BackendId {
+            self.id
+        }
+
+        fn capabilities(&self) -> QueryCapabilities {
+            QueryCapabilities::count_only()
+        }
+
+        async fn search(
+            &self,
+            _query: &SearchQuery,
+            deadline: Instant,
+        ) -> Result<BackendSearch, ToolError> {
+            *self.observed_budget.lock().expect("budget lock") =
+                Some(deadline.saturating_duration_since(Instant::now()));
+            tokio::time::sleep(self.delay).await;
+            Ok(BackendSearch {
+                backend: self.id,
+                source: self.id.as_str().to_string(),
+                backend_detail: None,
+                results: vec![result()],
+                degraded: Vec::new(),
+                note: None,
+            })
+        }
+    }
+
     fn query() -> SearchQuery {
         SearchQuery::new("bounded chain".to_string(), 5, None, Vec::new(), None)
     }
@@ -495,6 +543,7 @@ mod tests {
             &query(),
             Instant::now() + Duration::from_secs(1),
             None,
+            None,
         )
         .await
         .expect("fallback should succeed");
@@ -534,6 +583,7 @@ mod tests {
             &query(),
             Instant::now() + Duration::from_secs(1),
             None,
+            None,
         )
         .await
         .expect("final scrape fallback should succeed");
@@ -562,41 +612,11 @@ mod tests {
 
     #[tokio::test]
     async fn first_attempt_budget_overrides_the_default_fair_share() {
-        struct DeadlineBackend {
-            observed_budget: Arc<Mutex<Option<Duration>>>,
-        }
-
-        #[async_trait]
-        impl SearchBackend for DeadlineBackend {
-            fn id(&self) -> BackendId {
-                BackendId::Volcengine
-            }
-
-            fn capabilities(&self) -> QueryCapabilities {
-                QueryCapabilities::count_only()
-            }
-
-            async fn search(
-                &self,
-                _query: &SearchQuery,
-                deadline: Instant,
-            ) -> Result<BackendSearch, ToolError> {
-                *self.observed_budget.lock().expect("budget lock") =
-                    Some(deadline.saturating_duration_since(Instant::now()));
-                Ok(BackendSearch {
-                    backend: BackendId::Volcengine,
-                    source: "volcengine".to_string(),
-                    backend_detail: None,
-                    results: vec![result()],
-                    degraded: Vec::new(),
-                    note: None,
-                })
-            }
-        }
-
         let observed_budget = Arc::new(Mutex::new(None));
         let volcengine = DeadlineBackend {
+            id: BackendId::Volcengine,
             observed_budget: Arc::clone(&observed_budget),
+            delay: Duration::ZERO,
         };
         let fallback = FakeBackend {
             id: BackendId::DuckDuckGo,
@@ -608,6 +628,7 @@ mod tests {
             &query(),
             Instant::now() + Duration::from_secs(2),
             Some(first_attempt_budget),
+            None,
         )
         .await
         .expect("the first backend should complete inside its dedicated budget");
@@ -624,6 +645,37 @@ mod tests {
         assert!(observed <= first_attempt_budget);
     }
 
+    #[tokio::test]
+    async fn provider_native_unused_budget_does_not_extend_fallback_deadline() {
+        let native = FakeBackend {
+            id: BackendId::ProviderNative,
+            result: Err(ToolError::execution_failed("native unavailable")),
+        };
+        let observed_budget = Arc::new(Mutex::new(None));
+        let fallback = DeadlineBackend {
+            id: BackendId::DuckDuckGo,
+            observed_budget: Arc::clone(&observed_budget),
+            delay: Duration::from_millis(200),
+        };
+        let fallback_budget = Duration::from_millis(30);
+        let error = run_backend_chain(
+            &[&native, &fallback],
+            &query(),
+            Instant::now() + Duration::from_millis(500),
+            Some(Duration::from_millis(500)),
+            Some(fallback_budget),
+        )
+        .await
+        .expect_err("blocking fallback must stop at its own budget");
+
+        assert!(matches!(error, ToolError::NotAvailable { .. }));
+        let observed = observed_budget
+            .lock()
+            .expect("budget lock")
+            .expect("fallback must observe a deadline");
+        assert!(observed <= fallback_budget);
+    }
+
     #[tokio::test]
     async fn all_unavailable_returns_typed_error_with_backend_ids_only() {
         let private_error = "secret provider response";
@@ -640,6 +692,7 @@ mod tests {
             &query(),
             Instant::now() + Duration::from_secs(1),
             None,
+            None,
         )
         .await
         .expect_err("all-down chain must fail");
@@ -689,6 +742,7 @@ mod tests {
             &query(),
             Instant::now() + Duration::from_secs(1),
             None,
+            None,
         )
         .await
         .expect_err("policy error must fail closed");
@@ -712,6 +766,7 @@ mod tests {
             &query(),
             Instant::now() + Duration::from_secs(1),
             None,
+            None,
         )
         .await
         .expect("empty API response should fall back");
@@ -729,4 +784,61 @@ mod tests {
             ]
         );
     }
+
+    #[tokio::test]
+    async fn domain_filtered_results_fall_back_before_chain_success() {
+        let native = FakeBackend {
+            id: BackendId::ProviderNative,
+            result: Ok(vec![SearchResult::new(
+                1,
+                "Outside source".to_string(),
+                "https://outside.test/result".to_string(),
+                None,
+                None,
+            )]),
+        };
+        let configured = FakeBackend {
+            id: BackendId::Searxng,
+            result: Ok(vec![SearchResult::new(
+                1,
+                "Matching source".to_string(),
+                "https://docs.rs/example/latest/example/".to_string(),
+                None,
+                None,
+            )]),
+        };
+        let constrained = SearchQuery::new(
+            "example docs".to_string(),
+            5,
+            None,
+            vec!["docs.rs".to_string()],
+            None,
+        );
+
+        let response = run_backend_chain(
+            &[&native, &configured],
+            &constrained,
+            Instant::now() + Duration::from_secs(1),
+            None,
+            None,
+        )
+        .await
+        .expect("configured backend should satisfy the domain constraint");
+
+        assert_eq!(response.raw.backend, BackendId::Searxng);
+        assert_eq!(response.raw.results.len(), 1);
+        assert!(response.raw.degraded.iter().any(|reason| matches!(
+            reason,
+            DegradedReason::NoUsableResults {
+                backend: BackendId::ProviderNative
+            }
+        )));
+        assert!(response.raw.degraded.iter().any(|reason| matches!(
+            reason,
+            DegradedReason::BackendFallback {
+                from: BackendId::ProviderNative,
+                to: BackendId::Searxng
+            }
+        )));
+    }
 }