feat(search): explore bounded agentic search in the web UI

[jiashuoz]

Context

The deterministic global-search work should remain the immediate priority: an account-scoped, active-resource search API over inboxes, messages, domains, webhooks, and API keys, backed by the structured filter engine from #734/#735.

A future web experience could place a bounded Gemini-powered search agent above that API so users describe what they want without learning q or filter syntax.

This is not critical for the first global-search release and must not block it.

Product direction to explore

• One global search box in the web dashboard.
• Nothing is submitted until Enter.
• Natural-language requests may perform a small bounded number of read-only searches, refine results, or ask one clarification.
• Render structured resource cards and removable plain-language scope chips; never show filter syntax to dashboard users.
• Removing a chip immediately reruns deterministic search without invoking Gemini again.
• Keep the original natural-language input visible for editing and resubmission.
• Retain the deterministic search API as the trusted tool and as the direct SDK/CLI/MCP surface.

Proposed safety boundary

• Read-only search tools only; no create/update/delete/send operations.
• Every tool independently enforces authenticated account scope, active-resource predicates, result limits, and timeouts.
• No arbitrary SQL or arbitrary API access.
• Never expose message bodies, MIME, attachments, API-key material, webhook signing secrets, or other secrets to the model.
• Cap tool calls per submission and suppress stale/canceled runs.
• Validate every model-produced query through the deterministic query registry before execution.
• Do not log raw requests, compiled queries, or result values.
• Feature must be independently disableable.

Privacy decision required before implementation

A genuinely iterative search agent may need to receive the endpoint’s safe projected metadata—such as subjects, senders, inbox names, domains, webhook descriptions/URLs, and API-key names—to judge and refine results. Decide whether that data may be sent to Gemini, how it is disclosed, and whether account-level opt-in is required.

If result metadata cannot be sent, constrain the feature to query compilation rather than calling it agentic search.

Questions to resolve

• One-shot bounded runs versus conversational sessions.
• Whether filter-only requests such as “messages from last week” are supported.
• Failure behavior when Gemini is disabled, unavailable, or returns invalid output.
• Exact safe-result projection available to the model.
• Retention, disclosure, consent, and provider configuration.
• Latency, cost, rate limits, and maximum tool-call budget.
• Evaluation corpus and quality threshold before rollout.

Non-goals

• Replacing deterministic search or its test suite.
• Exposing query syntax in the web UI.
• General-purpose account administration.
• Mutating resources from the search experience.
• Sending message content or secrets to Gemini.

Dependency

Revisit only after the deterministic global-search API and web result experience are shipped and measured.