feat(agents): consolidate connectors under mcp_discovery; route web search through google_search

MCP consolidation:
- Route all MCP-capable connectors (Slack, Jira, Linear, ClickUp, Airtable,
  Notion, Confluence, interim Gmail/Calendar, custom MCP) through a single
  `mcp_discovery` subagent. Drive/OneDrive/Dropbox stay native to enrich the KB.
- Deprecate Discord/Teams/Luma: no viable official MCP server.

Google-only web search:
- Remove the main-agent `web_search` tool and the SearXNG platform service;
  all public web search now flows through the `google_search` subagent via task().
- Deprecate the Tavily/SearXNG/Linkup/Baidu search connectors (HTTP 410 on
  create, "Deprecated" badge); guide heavy users to the custom MCP connector.
- Remove web search from anonymous chat (pure Q&A).
- Tear SearXNG out of docker compose + install scripts; drop tavily-python
  and linkup-sdk deps and their config/env vars.

Fix:
- metrics._package_version() now swallows any metadata lookup failure. A
  malformed editable-install distribution with no `Version` field raised
  KeyError deep in importlib.metadata, and since it runs on every
  record_subagent_invoke_duration call it was crashing every task()
  delegation. Verified end-to-end against live GPT-5.4.

Co-authored-by: Cursor <cursoragent@cursor.com>

surfsense_web/lib/connector-telemetry.ts

@@ -112,17 +112,49 @@ const LEGACY_REAUTH_ENDPOINTS: Partial<Record<string, string>> = {
 	[EnumConnectorName.DISCORD_CONNECTOR]: "/api/v1/auth/discord/connector/reauth",
 };
 
+/**
+ * Connector types migrated to hosted MCP, mapped to their MCP service key.
+ * A legacy native row of one of these types (no ``config.server_config``)
+ * re-authenticates through the MCP flow so the reconnect writes an MCP
+ * ``server_config`` and the row starts producing agent tools again.
+ *
+ * Gmail/Calendar/Drive/Dropbox/OneDrive are intentionally absent: they stay
+ * on their native OAuth (Google Workspace MCP is not GA yet; file connectors
+ * remain native for knowledge-base enrichment).
+ */
+const MIGRATED_TYPE_TO_MCP_SERVICE: Partial<Record<string, string>> = {
+	[EnumConnectorName.LINEAR_CONNECTOR]: "linear",
+	[EnumConnectorName.JIRA_CONNECTOR]: "jira",
+	[EnumConnectorName.NOTION_CONNECTOR]: "notion",
+	[EnumConnectorName.CONFLUENCE_CONNECTOR]: "confluence",
+};
+
+/**
+ * True when a row is a migrated connector type still on its legacy native
+ * config (no MCP ``server_config``). Such rows appear "connected" but produce
+ * no agent tools until reconnected via MCP — the UI surfaces a nudge.
+ */
+export function needsMcpReconnect(connector: SearchSourceConnector): boolean {
+	if (!(connector.connector_type in MIGRATED_TYPE_TO_MCP_SERVICE)) return false;
+	return !connector.config?.server_config;
+}
+
 /**
  * Resolve the reauth endpoint for a connector.
  *
  * MCP OAuth connectors (those with ``config.mcp_service``) dynamically build
- * the URL from the service key. Legacy OAuth connectors fall back to the
- * static ``LEGACY_REAUTH_ENDPOINTS`` map.
+ * the URL from the service key. Migrated native rows are routed to the MCP
+ * reauth flow so reconnecting converts them in place. Everything else falls
+ * back to the static ``LEGACY_REAUTH_ENDPOINTS`` map.
  */
 export function getReauthEndpoint(connector: SearchSourceConnector): string | undefined {
 	const mcpService = connector.config?.mcp_service as string | undefined;
 	if (mcpService) {
 		return `/api/v1/auth/mcp/${mcpService}/connector/reauth`;
 	}
+	const migratedService = MIGRATED_TYPE_TO_MCP_SERVICE[connector.connector_type];
+	if (migratedService) {
+		return `/api/v1/auth/mcp/${migratedService}/connector/reauth`;
+	}
 	return LEGACY_REAUTH_ENDPOINTS[connector.connector_type];
 }

surfsense_web/lib/posthog/events.ts

@@ -200,14 +200,12 @@ export function trackAnonymousChatMessageSent(options: {
 	modelSlug: string;
 	messageLength?: number;
 	hasUploadedDoc?: boolean;
-	webSearchEnabled?: boolean;
 	surface?: "free_chat_page" | "free_model_page";
 }) {
 	safeCapture("anonymous_chat_message_sent", {
 		model_slug: options.modelSlug,
 		message_length: options.messageLength,
 		has_uploaded_doc: options.hasUploadedDoc ?? false,
-		web_search_enabled: options.webSearchEnabled,
 		surface: options.surface,
 	});
 }