@240xu/dsh-websearch 2.8.1 → 2.8.2

package/README.md

@@ -253,3 +253,16 @@ v2.7.0 缓存/熔断/历史三项的依据与刻意取舍（含查证过的反
 ## License | 许可
 
 MIT © 2026 240xu
+
+## 2.8.2 · Bug 猎场修复（P1×3 + 回归测试）
+
+- **[P1] 零结果伪造失败**：所有后端成功但 0 命中时，原实现落进 `all enabled
+  backends failed (0) - `（计数自相矛盾、detail 空）并丢弃 mergedContent（Tavily
+  直答）。成功即空 → 正常返回 `{sources:[]}` + history 记录。
+- **[P1] limiter 死锁**：`Promise.resolve(fn())` 先执行 fn——同步抛出（如 baseURL
+  校验在建 timeout 前）逃出后 `running` 永不递减，泄漏 ≥ concurrency 后所有任务
+  永久排队且超时机制未武装（实测 HUNG exit=13）。改 `Promise.resolve().then(fn)`。
+- **[P1] exa category 漏门控**：tavily/searxng 的 deepCoverage 增强都门控，唯独
+  exa 漏了——默认关 deepCoverage 也注入 category 收窄结果，与 README 承诺相反。
+- 回归测试 3 条（零结果/limiter 不死锁带 HUNG 超时护栏/exa 双态门控）；
+  `createLimiter` 导出供测试。89/89。

package/lib/backends/exa.js

@@ -42,10 +42,14 @@ export const exaBackend = {
       query: request.query,
       numResults: request.maxResults ?? 8,
     };
-    // v2.8.0: category inference (feature-detect — only sent when confident;
-    // if the endpoint rejects it the fan-out demotes softly).
-    const category = inferExaCategory(request.query);
-    if (category) args.category = category;
+    // v2.8.0: category inference — deepCoverage-gated like tavily (searchDepth
+    // advanced) and searxng (category sweep): 2.8.1 审计发现此处漏了门控，
+    // 默认关着 deepCoverage 也注入 category，把结果悄悄收窄到单类目，与 README
+    // 「deepCoverage 深度覆盖」承诺相反。
+    if (request.deepCoverage === true) {
+      const category = inferExaCategory(request.query);
+      if (category) args.category = category;
+    }
     hooks.recordRequest?.({
       endpoint: EXA_ENDPOINT,
       toolName: EXA_TOOL,

package/lib/provider.js

@@ -82,7 +82,8 @@ export function getBackendBreaker(id) {
  * Simple concurrency limiter using a semaphore pattern.
  * No external dependency needed.
  */
-function createLimiter(concurrency) {
+// 2.8.2: exported for P1 regression tests (limiter sync-throw deadlock)
+export function createLimiter(concurrency) {
   const queue = [];
   let running = 0;
   
@@ -95,7 +96,12 @@ function createLimiter(concurrency) {
         while (running < concurrency && queue.length > 0) {
           const { fn, resolve, reject } = queue.shift();
           running++;
-          Promise.resolve(fn()).then(resolve).catch(reject).finally(() => {
+          // 2.8.2（P1）：必须 .then(fn) 而非 Promise.resolve(fn())——后者先执行
+          // fn()，同步抛出（如 runBackend 的 baseURL 校验在创建 timeout 之前 throw）
+          // 会逃出本函数：running 已 ++ 却永不 --（finally 没挂上），leaked 计数
+          // ≥ concurrency 后所有后续任务永久排队，且 timeoutId 未创建 → 超时也救不了
+          // （实测全挂起 exit=13）。.then(fn) 把同步抛出转为 rejection 落进 finally。
+          Promise.resolve().then(fn).then(resolve).catch(reject).finally(() => {
             running--;
             process();
           });
@@ -435,6 +441,31 @@ export function createUnifiedSearchProvider({ ctx, resolveOptions, backends, cac
         };
       }
 
+      // 2.8.2（P1）：零结果 ≠ 全部失败。所有后端成功但确实 0 条命中（冷僻查询/
+      // 过滤后为空）时，原实现无条件落入下面的 throw，模型端拿到
+      // `all enabled backends failed (0) - `（detail 空、计数自相矛盾），且丢弃已
+      // 拿到的 mergedContent（如 Tavily 直答）。成功即空 → 正常返回空结果。
+      if (allFailures.length === 0) {
+        let emptyContent = perVariant.find((v) => v.mergedContent !== undefined)?.mergedContent;
+        if (opts.resultHeader !== false && emptyContent !== undefined) {
+          const header = resultHeader(typeof request?.query === "string" && /[\u4e00-\u9fff]/.test(request.query) ? "zh" : "en");
+          emptyContent = header + "\n\n" + emptyContent;
+        }
+        history?.record({
+          query: request?.query,
+          time: Date.now(),
+          resultCount: 0,
+          backendsOk: allTelemetry.filter((t) => t.ok).length,
+          backendsTotal: allTelemetry.length,
+        });
+        if (cacheKey && cache) cache.set(cacheKey, { sources: [], content: emptyContent, truncated: false });
+        return {
+          sources: [],
+          ...(emptyContent !== undefined ? { content: emptyContent } : {}),
+          truncated: false,
+        };
+      }
+
       // All enabled backends failed - synthesize one meaningful error that
       // names each backend's own reason so the caller (model or user) can act.
       const detail = allFailures.slice(0, 4)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@240xu/dsh-websearch",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "description": "Unified web search provider for DeepSeek Harness (ctx.web): 11 backends — Exa + Parallel + DDG + SearXNG (keyless), DeepSeek + Anthropic + OpenAI + Brave + Tavily + Serper + Mojeek (key-gated via Settings credentials). Registers provider id \"unified\" for zero-config web_search. 统一网页搜索聚合：11 后端并发扇出、去重合并，零依赖。See CHANGELOG.md for version history.",
   "type": "module",
   "main": "lib/index.js",