Merge remote-tracking branch 'origin/master' into feat/decomp-hook-points

# Conflicts:
#	nextcloud_mcp_server/vector/scanner.py

nextcloud_mcp_server/search/semantic.py

@@ -9,6 +9,7 @@ from nextcloud_mcp_server.acl_hash import accessible_hash_set
 from nextcloud_mcp_server.config import get_settings
 from nextcloud_mcp_server.embedding import get_embedding_service
 from nextcloud_mcp_server.observability.metrics import record_qdrant_operation
+from nextcloud_mcp_server.search.access_filter import build_ownership_filter
 from nextcloud_mcp_server.search.algorithms import (
     SearchAlgorithm,
     SearchResult,
@@ -50,6 +51,8 @@ class SemanticSearchAlgorithm(SearchAlgorithm):
         user_id: str,
         limit: int = 10,
         doc_type: str | None = None,
+        *,
+        accessible_owners: list[str] | None = None,
         **kwargs: Any,
     ) -> list[SearchResult]:
         """Execute semantic search using vector similarity.
@@ -67,7 +70,11 @@ class SemanticSearchAlgorithm(SearchAlgorithm):
             user_id: User ID for filtering
             limit: Maximum results to return
             doc_type: Optional document type filter
-            **kwargs: Additional parameters (score_threshold override)
+            accessible_owners: Owner UIDs the user can read (self + share
+                senders), pre-computed by the caller from the OCS Sharing API.
+                Defaults to ``[user_id]`` (self-only) when ``None``.
+            **kwargs:
+                - score_threshold (float): override the instance default
 
         Returns:
             List of unverified SearchResult objects ranked by similarity score
@@ -99,10 +106,7 @@ class SemanticSearchAlgorithm(SearchAlgorithm):
         # Build Qdrant filter
         filter_conditions = [
             get_placeholder_filter(),  # Always exclude placeholders from user-facing queries
-            FieldCondition(
-                key="user_id",
-                match=MatchValue(value=user_id),
-            ),
+            build_ownership_filter(user_id, accessible_owners),
         ]
 
         # Add doc_type filter if specified
@@ -175,12 +179,10 @@ class SemanticSearchAlgorithm(SearchAlgorithm):
             if len(results) >= limit:
                 break
 
+        # Log the count only — NOT titles. These results are unverified: with
+        # owner-level share expansion the candidate set can include other users'
+        # documents that verify-on-read will drop, so titles must not be logged
+        # until after verification (the verifying callers log verified titles).
         logger.info("Returning %s unverified results after deduplication", len(results))
-        if results:
-            result_details = [
-                f"{r.doc_type}_{r.id} (score={r.score:.3f}, title='{r.title}')"
-                for r in results[:5]  # Show top 5
-            ]
-            logger.debug("Top results: %s", ", ".join(result_details))
 
         return results