feat: render private semantic service endpoints

backend/src/config.ts

@@ -30,6 +30,10 @@ export interface AppConfig {
   legacyWorkspaceMode: boolean;
   workspaceDiagnosticTimeoutMs: number;
   workspaceRegistry: WorkspaceRegistryConfig;
+  internalQdrantUrl: string;
+  internalEmbeddingUrl: string;
+  internalEmbeddingModel: string;
+  internalEmbeddingDimensions: number;
 }
 
 export const MAX_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS = 10_000;
@@ -101,6 +105,47 @@ function piManagementTimeout(value: string | undefined): number {
   return timeout;
 }
 
+function loopbackHost(host: string): boolean {
+  return host === "::1"
+    || host === "127.0.0.1"
+    || /^127(?:\.\d{1,3}){3}$/.test(host);
+}
+
+function internalServiceUrl(
+  value: string | undefined,
+  fallback: string,
+  label: string,
+  allowedHosts: readonly string[],
+): string {
+  const raw = value ?? fallback;
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error(`${label} configuration is invalid`);
+  }
+  if (
+    (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    || parsed.username.length > 0
+    || parsed.password.length > 0
+    || parsed.pathname !== "/"
+    || parsed.search.length > 0
+    || parsed.hash.length > 0
+    || (!allowedHosts.includes(parsed.hostname) && !loopbackHost(parsed.hostname))
+  ) {
+    throw new Error(`${label} configuration is invalid`);
+  }
+  return parsed.toString().replace(/\/$/, "");
+}
+
+function positiveDimension(value: string | undefined, fallback: number): number {
+  const parsed = Number(value ?? fallback);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new Error("internal embedding dimensions configuration is invalid");
+  }
+  return parsed;
+}
+
 export function loadConfig(env: Record<string, string | undefined>): AppConfig {
   const authMode = env.AUTH_MODE ?? "none";
   if (!(["none", "mock", "upstream"] as const).includes(authMode as AppConfig["authMode"])) {
@@ -208,6 +253,18 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     maxImportEntries: positiveImportLimit(env.THT_WORKSPACE_MAX_IMPORT_ENTRIES, 32),
   };
   const settingsFile = env.SETTINGS_FILE ?? "data/settings.json";
+  const internalQdrantUrl = internalServiceUrl(
+    env.THT_INTERNAL_QDRANT_URL,
+    "http://qdrant:6333",
+    "internal Qdrant URL",
+    ["qdrant", "localhost"],
+  );
+  const internalEmbeddingUrl = internalServiceUrl(
+    env.THT_INTERNAL_EMBEDDING_URL,
+    "http://embedding:11434",
+    "internal embedding URL",
+    ["embedding", "localhost"],
+  );
   return {
     host: env.HOST ?? "127.0.0.1",
     port: Number(env.PORT ?? 8787),
@@ -231,5 +288,9 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     legacyWorkspaceMode: legacyWorkspaceMode === "local",
     workspaceDiagnosticTimeoutMs: diagnosticTimeout(env.THT_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS),
     workspaceRegistry,
+    internalQdrantUrl,
+    internalEmbeddingUrl,
+    internalEmbeddingModel: env.THT_INTERNAL_EMBEDDING_MODEL ?? "qwen3-embedding:0.6b",
+    internalEmbeddingDimensions: positiveDimension(env.THT_INTERNAL_EMBEDDING_DIMENSIONS, 1024),
   };
 }