@240xu/dsh-websearch 2.8.3 → 2.8.4

package/lib/backends/anthropic-like.js

@@ -17,6 +17,7 @@
 
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 /** Attribution header; bumped with the package version. */
 const UA = "dsh-websearch/2.3";
@@ -111,7 +112,7 @@ export function createAnthropicLikeBackend(spec) {
 
       let response;
       try {
-        response = await fetch(endpoint, {
+        response = await egressFetch(endpoint, {
           method: "POST",
           redirect: "error",
           headers: {

package/lib/backends/brave.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applyBraveFilters, normalizeFilters, safeSearchParams } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const BRAVE_ENDPOINT = "https://api.search.brave.com/res/v1/web/search";
 
@@ -46,7 +47,7 @@ export const braveBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers: {
           "X-Subscription-Token": apiKey,

package/lib/backends/ddg.js

@@ -8,6 +8,7 @@
 import { searchAborted, isAbortError, throwIfSearchAborted } from "../util/abort.js";
 import { applyDdgFilters, normalizeFilters } from "../util/filters.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 export const DDG_ENDPOINT = "https://html.duckduckgo.com/html/";
 
@@ -34,7 +35,7 @@ export const ddgBackend = {
 
     let text;
     try {
-      const res = await fetch(DDG_ENDPOINT, {
+      const res = await egressFetch(DDG_ENDPOINT, {
         method: "POST",
         redirect: "error",
         headers: {

package/lib/backends/mojeek.js

@@ -7,6 +7,7 @@
 
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const MOJEEK_ENDPOINT = "https://api.mojeek.com/v1/search";
 
@@ -52,7 +53,7 @@ export const mojeekBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers,
         redirect: "error",

package/lib/backends/openai.js

@@ -12,6 +12,7 @@
 
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const UA = "dsh-websearch/2.3";
 
@@ -67,7 +68,7 @@ export const openaiBackend = {
 
     let response;
     try {
-      response = await fetch(endpoint, {
+      response = await egressFetch(endpoint, {
         method: "POST",
         redirect: "error",
         headers: {

package/lib/backends/searxng.js

@@ -9,6 +9,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applySearxngFilters, normalizeFilters, safeSearchParams } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const DEFAULT_SEARXNG_URL = "https://searx.be";
 
@@ -61,7 +62,7 @@ export const searxngBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers,
         redirect: "error",

package/lib/backends/serper.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applySerperFilters, normalizeFilters } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const SERPER_ENDPOINT = "https://google.serper.dev/search";
 
@@ -46,7 +47,7 @@ export const serperBackend = {
 
     let response;
     try {
-      response = await fetch(baseURL, {
+      response = await egressFetch(baseURL, {
         method: "POST",
         headers: {
           "X-API-KEY": apiKey,

package/lib/backends/tavily.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applyTavilyFilters, normalizeFilters } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const TAVILY_ENDPOINT = "https://api.tavily.com/search";
 
@@ -55,7 +56,7 @@ export const tavilyBackend = {
 
     let response;
     try {
-      response = await fetch(baseURL, {
+      response = await egressFetch(baseURL, {
         method: "POST",
         headers: {
           "Authorization": `Bearer ${apiKey}`,

package/lib/client.js

@@ -171,6 +171,78 @@ window.__ModuleLoader__.load({
 			};
 		}
 
+		/**
+		 * Settings bridge for 0.2.x builds where the legacy `settingsScope`
+		 * client service is gone: the same snapshot/subscribe/set/unset surface
+		 * the card controller expects, backed by this plugin's fenced settings
+		 * route. Writes land in the volatile profile entry the host provider
+		 * resolves from on the next call -- no second settings store.
+		 */
+		class SettingsRoutesBridge {
+			constructor() {
+				this.store = createStore({
+					status: "loading",
+					writable: false,
+					value: undefined,
+					base: undefined,
+					user: undefined,
+					revision: undefined,
+					mode: "routes",
+				});
+			}
+
+			getSnapshot() { return this.store.getSnapshot(); }
+			subscribe(listener) { return this.store.subscribe(listener); }
+
+			accept(payload) {
+				if (payload === null || typeof payload !== "object" || payload.ok !== true || payload.writable === false) {
+					// Keep the card rendered (status ready) but read-only, so the section
+					// explains itself instead of showing an endless loading ellipsis.
+					this.store.set({ status: "ready", writable: false, value: {}, base: undefined, user: undefined, revision: undefined, mode: "routes" });
+					return;
+				}
+				this.store.set({
+					status: "ready",
+					writable: true,
+					value: payload.value,
+					base: payload.base,
+					user: payload.user,
+					revision: payload.revision,
+					mode: "routes",
+				});
+			}
+
+			async load() {
+				try {
+				const response = await fetch("/api/unified-search/settings", { credentials: "same-origin", headers: { accept: "application/json" } });
+				const payload = await response.json().catch(() => undefined);
+				this.accept(response.status === 404 ? undefined : payload);
+				} catch (_noRoutes) {
+				this.accept(undefined);
+				}
+			}
+
+			async write(ops) {
+				const expectedRevision = this.store.getSnapshot().revision;
+				const response = await fetch("/api/unified-search/settings", {
+					method: "POST",
+					credentials: "same-origin",
+					headers: { "content-type": "application/json", accept: "application/json" },
+					// eslint-disable-next-line object-shorthand
+					body: JSON.stringify(expectedRevision === undefined ? { ops } : { ops, expectedRevision }),
+				});
+				const payload = await response.json().catch(() => undefined);
+				if (response.status === 409 || (payload !== undefined && payload.code === "SETTINGS_CONFLICT")) throw new Error("SETTINGS_CONFLICT");
+				if (!response.ok || payload === undefined || payload.ok !== true) {
+					throw new Error(payload !== undefined && payload.error !== undefined ? String(payload.error) : "settings request failed (" + response.status + ")");
+				}
+				this.accept(payload);
+			}
+
+			set(field, value) { return this.write([{ op: "set", path: [field], value }]); }
+			unset(field) { return this.write([{ op: "unset", path: [field] }]); }
+		}
+
 		/**
 		 * Card state machine: reads the bound settings scope snapshot, stages edits,
 		 * writes section fields through scope.set/unset and secrets via credentials.
@@ -247,14 +319,37 @@ window.__ModuleLoader__.load({
 
 			async readCredential(ref) {
 				try {
-					const res = await this.connection.api.credentials.describe({ refs: [ref] });
-					if (!res.result.ok) return;
-					const view = res.result.value.credentials[ref];
-					this.keyState.set(ref, { configured: view?.configured ?? false, writable: view?.writable !== false });
+					let view;
+					if (this.remote !== undefined && this.remote.credentials !== undefined && typeof this.remote.credentials.describe === "function") {
+						// 0.2.x remote face: Record<ref, {configured, writable, source}> behind {ok, value}.
+						const res = await this.remote.credentials.describe([ref]);
+						const record = res !== null && typeof res === "object" && res.value !== undefined ? res.value : res;
+						const byRef = record !== null && typeof record === "object" && record.credentials !== undefined ? record.credentials : record;
+						view = byRef !== null && typeof byRef === "object" ? byRef[ref] : undefined;
+					}
+					if (view === undefined && this.connection !== undefined && this.connection.api !== undefined && this.connection.api.credentials !== undefined) {
+						// Older line: the connection controller's credentials API.
+						const res = await this.connection.api.credentials.describe({ refs: [ref] });
+						if (res?.result?.ok) view = res.result.value.credentials[ref];
+					}
+					if (view === undefined) return;
+					this.keyState.set(ref, { configured: view.configured === true, writable: view.writable !== false });
 				} catch { /* ignore */ }
 				this.republish();
 			}
 
+			async writeCredential(ref, value) {
+				if (this.remote !== undefined && this.remote.credentials !== undefined && typeof this.remote.credentials.set === "function") {
+					await this.remote.credentials.set(ref, value);
+					return;
+				}
+				if (this.connection !== undefined && this.connection.api !== undefined && this.connection.api.credentials !== undefined && typeof this.connection.api.credentials.set === "function") {
+					await this.connection.api.credentials.set({ ref, value });
+					return;
+				}
+				throw new Error("credentials service unavailable");
+			}
+
 			refreshAllCredentials() {
 				for (const b of BACKENDS) if (b.keyEnv) this.readCredential(b.keyEnv);
 			}
@@ -291,7 +386,7 @@ window.__ModuleLoader__.load({
 								backendTimeoutMs: [1000, 120000],
 							};
 							const [lo, hi] = BOUNDS[field] ?? [-Infinity, Infinity];
-							{ this.failed = true; this.failedFields.add(field); continue; }
+							if (!Number.isFinite(num) || num < lo || num > hi) { this.failed = true; this.failedFields.add(field); continue; }
 							await this.scope.set(field, num);
 							doneFields.push(field);
 						} else {
@@ -303,7 +398,7 @@ window.__ModuleLoader__.load({
 						const value = staged.text.trim();
 						if (value !== "") {
 							try {
-								await this.connection.api.credentials.set({ ref, value });
+								await this.writeCredential(ref, value);
 								this.keyState.set(ref, { configured: true, writable: true });
 								doneKeys.push(ref);
 								this.failedKeys.delete(ref);
@@ -424,6 +519,7 @@ window.__ModuleLoader__.load({
 						backend: b,
 						value: state.value[toggleField(b.id)],
 						keyConfigured: true,
+						t: props.t,
 						onChange: (checked) => card.setToggle(b.id, checked),
 					}, b.id)
 				) }),
@@ -433,6 +529,7 @@ window.__ModuleLoader__.load({
 						backend: b,
 						value: state.value[toggleField(b.id)],
 						keyConfigured: !!state.keyState[b.keyEnv]?.configured,
+						t: props.t,
 						onChange: (checked) => card.setToggle(b.id, checked),
 					}, b.id)
 				) }),
@@ -545,27 +642,49 @@ window.__ModuleLoader__.load({
 
 		/**
 		 * Plugin entry: register the card into the settings plugins page.
-		 * Compatibility (compat-audit P0): the settingsScope client service was
-		 * removed in DSH 0.1.7. It stays in `inject` so the fiber still
-		 * activates when the shim supplies it; every access is feature-detected.
+		 * Compatibility: the legacy `settingsScope` client service was removed on
+		 * the 0.2.x line; the card binds whichever data source the build offers
+		 * (see selectBridge) and registers the section unconditionally.
 		 */
-		const inject = ["slots", "locale", "connection", "remote", "settingsScope"];
+		const inject = ["slots", "locale", "connection", "remote"];
+		/**
+		 * Resolve the settings data source for this build, in order:
+		 *  1. the legacy `settingsScope` service (DSH <= 0.1.6 line, or a shim);
+		 *  2. this plugin's own fenced settings routes (0.2.x line, where the
+		 *     client service was removed and the settings shell renders client
+		 *     slot sections only);
+		 *  3. an unavailable bridge -- the section still registers and the card
+		 *     explains itself through its read-only banner.
+		 */
+		function selectBridge(ctx) {
+			try {
+			const scope = ctx.get("settingsScope");
+			if (scope !== undefined && typeof scope.bind === "function") return scope.bind({ namespace: PLUGIN_NS });
+			} catch (_noSettingsScope) { /* fall through to the routes bridge */ }
+			return new SettingsRoutesBridge();
+		}
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register(NS, { zh, en }), "websearch: copy dictionaries");
-			const hasSettingsScope = ctx.get("settingsScope") !== undefined && typeof ctx.settingsScope?.bind === "function";
-			if (!hasSettingsScope) {
-				// DSH >= 0.1.7 without dsh-settings-scope-shim: the settings card
-				// cannot bind its scope. Stop wiring the card instead of hard-
-				// crashing the client fiber; the breadcrumb aids diagnosis.
-				console.warn("[dsh-websearch] settingsScope service unavailable (DSH >= 0.1.7); unified-search settings card disabled. Configure via server settings/cordis config or install dsh-settings-scope-shim.");
-				return;
-			}
+			const bridge = selectBridge(ctx);
+			if (typeof bridge.load === "function") void bridge.load();
 			const controller = new UnifiedSearchCardController(
-				ctx.settingsScope.bind({ namespace: PLUGIN_NS }),
+				bridge,
 				ctx.get("connection"),
 				ctx.get("remote"),
 			);
-			ctx.effect(() => ctx.remote.$on("credentials/updated", () => controller.refreshAllCredentials()), "websearch: credential invalidations");
+			// Credential invalidations: 0.2.x forwards `credentials/reference-updated`;
+			// older lines forwarded `credentials/updated`. Subscribe to whichever
+			// event face this build exposes; a missing face must not abort apply().
+			for (const event of ["credentials/reference-updated", "credentials/updated"]) {
+				try {
+				ctx.effect(() => ctx.remote.$on(event, () => controller.refreshAllCredentials()), "websearch: credential invalidations");
+				} catch (_noEventFace) { /* this build does not forward that event */ }
+			}
+			// Re-read when another client saves this namespace (settings document
+			// revisions travel through the remote event face on 0.2.x).
+			try {
+				ctx.effect(() => ctx.remote.$on("settings/document-updated", () => { if (typeof bridge.load === "function") void bridge.load(); }), "websearch: settings document invalidations");
+			} catch (_noSettingsEvent) { /* settings events unavailable */ }
 			ctx.slots.inject("settings.section", () => ctx.slots.register({
 				name: "settings.section",
 				id: "websearch",

package/lib/health.js

@@ -7,6 +7,8 @@
 // provider's own telemetry truncation) and run through a defensive redaction
 // pass for token-like fragments.
 
+import { rejectionFor } from "./trust.js";
+
 const MAX_ERROR_CHARS = 120;
 
 /** Token-like fragments that must never appear in a health payload. */
@@ -89,6 +91,11 @@ export function registerHealthRoute(ws, deps) {
         res.writeHead(code, { "content-type": "application/json" });
         res.end(JSON.stringify(body));
       };
+      const rejection = rejectionFor(req, typeof deps.getConnection === "function" ? deps.getConnection() : undefined);
+      if (rejection !== undefined) {
+        send(rejection, { ok: false, error: rejection === 503 ? "admission unavailable" : "untrusted request" });
+        return;
+      }
       if (req.method !== "GET" && req.method !== "HEAD") {
         send(405, { ok: false, error: "method not allowed (GET only)" });
         return;

package/lib/history.js

@@ -8,6 +8,7 @@
 
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { rejectionFor } from "./trust.js";
 
 /** Ring-buffer cap (spec: 50). */
 export const HISTORY_MAX_ENTRIES = 50;
@@ -143,18 +144,19 @@ export function toBackendObservability(healthMap, nowMs = Date.now()) {
  *   backends: per-backend last real outcome/latency/breaker state (v2.8.0),
  *   so fallback redundancy is observable without a separate endpoint.
  * POST /api/websearch/history/clear  -> { ok, cleared: true }
- * Both routes sit behind isTrustedApiRequest (loopback Host + same-site).
+ * Both routes sit behind the host connection admission fence (the same
+ * decision the kernel applies to its own /api routes).
  */
-export function registerHistoryRoutes(ws, { getStore, getBackendHealth }) {
+export function registerHistoryRoutes(ws, { getStore, getBackendHealth, getConnection }) {
   if (!ws || typeof ws.register !== "function") return;
   const send = (res, code, body) => {
     res.writeHead(code, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
   };
   const guarded = (handler) => (req, res) => {
-    const fence = isTrustedApiRequest(req);
-    if (fence) {
-      send(res, 403, { ok: false, error: `untrusted request (${fence})` });
+    const rejection = rejectionFor(req, typeof getConnection === "function" ? getConnection() : undefined);
+    if (rejection !== undefined) {
+      send(res, rejection, { ok: false, error: rejection === 503 ? "admission unavailable" : "untrusted request" });
       return;
     }
     handler(req, res);

package/lib/index.js

@@ -37,6 +37,7 @@ import { createUnifiedSearchProvider, getLatestBackendHealth } from "./provider.
 import { registerHealthRoute } from "./health.js";
 import { createSearchCache, CACHE_DEFAULTS } from "./cache.js";
 import { createHistoryStore, registerHistoryRoutes, HISTORY_MAX_ENTRIES } from "./history.js";
+import { registerSettingsRoutes } from "./settings-api.js";
 import { BREAKER_DEFAULTS } from "./breaker.js";
 import os from "node:os";
 import path from "node:path";
@@ -391,6 +392,8 @@ export function resolveStoreDir(env = process.env, fallbackHome = os.homedir())
  */
 export function apply(ctx, config) {
   let current = () => config;
+  /** 0.2.x SettingsForms instance, captured for the browser settings bridge. */
+  let settingsForms;
 
   ctx.inject(["settings"], (settingsCtx) => {
     const settings = settingsCtx.settings;
@@ -404,10 +407,11 @@ export function apply(ctx, config) {
       });
       return;
     }
-    // 0.2.0 SettingsForms line: no installSection; the settings form is
-    // auto-generated from the volatile-marked Config above — no action and no
-    // warning here (the form IS the section; a warning would contradict the
-    // visible UI). Config values still resolve via cordis config.
+    // 0.2.x SettingsForms line: no installSection. Keep the service so the
+    // browser settings card can read/write this profile entry through the
+    // fenced bridge in ./settings-api.js; values keep resolving via cordis
+    // config (the same volatile entry), so there is no second settings store.
+    if (typeof settings?.describe === "function" && typeof settings?.mutate === "function") settingsForms = settings;
   });
 
   // v2.7.0 stores: disk cache + append-only search history, both under
@@ -449,16 +453,33 @@ export function apply(ctx, config) {
   // only reads the settings snapshot + last per-search telemetry — it never
   // probes backends and never touches credential values.
   ctx.inject(["webServer"], (webCtx) => {
+    const getConnection = () => {
+      try {
+        return ctx.get("connection");
+      } catch {
+        return undefined;
+      }
+    };
     registerHealthRoute(webCtx.webServer, {
       resolveOptions: () => resolveOptions(ctx, current()),
       backends: BACKENDS,
       getBackendHealth: getLatestBackendHealth,
+      getConnection,
     });
     // v2.7.0 search history: read-only GET + explicit clear POST.
     // v2.8.0: GET also carries per-backend last-outcome observability.
     registerHistoryRoutes(webCtx.webServer, {
       getStore: () => historyStore,
       getBackendHealth: getLatestBackendHealth,
+      getConnection,
+    });
+    // Settings bridge for the browser card on 0.2.x builds (no legacy
+    // settingsScope service). Fenced by the host connection admission; writes
+    // land in the volatile config entry above.
+    registerSettingsRoutes(webCtx.webServer, {
+      getSettings: () => settingsForms,
+      getConfig: () => Config,
+      getConnection,
     });
   });
 }

package/lib/settings-api.js

@@ -0,0 +1,277 @@
+/**
+ * Fenced settings bridge for the browser settings card.
+ *
+ * The card needs three things from the host: the resolved value of every
+ * field, the revision that guards concurrent saves, and a way to write path
+ * ops back into the same profile entry the provider reads. On the 0.2.x
+ * settings line there is no `settingsScope` client service and the settings
+ * shell renders client slot sections only — so this module servers that data
+ * over the plugin's own HTTP surface instead.
+ *
+ * Data flow: the host keeps plugin config in its `settings` service
+ * (`SettingsForms.describe` / `mutate`, keyed by the profile entry id). This
+ * route is a thin bridge to it: writes land in the volatile config entry the
+ * provider resolves from on the next call, so there is no second store and no
+ * out-of-band state. Mutations are validated against the plugin's own schema
+ * here because the host only checks the volatile path, not the value shape.
+ *
+ * Both routes sit behind the host connection admission fence (the same
+ * decision the kernel applies to its own `/api` routes, including the browser
+ * auth cookie), so a LAN or tunnel page holding a valid session can save
+ * settings, and nothing weaker than the app can.
+ *
+ *   GET  /api/unified-search/settings -> { ok, namespace, writable, revision,
+ *                                          value, base, user, reason? }
+ *   POST /api/unified-search/settings -> { ok } + fresh payload on success,
+ *                                        409 { code: 'SETTINGS_CONFLICT' },
+ *                                        400 invalid op value/field,
+ *                                        503 settings service unavailable.
+ *
+ * Headless / CI profiles never mount `webServer`, so registration is skipped
+ * and nothing here runs.
+ *
+ * @module lib/settings-api.js
+ */
+import { rejectionFor } from "./trust.js";
+
+const SETTINGS_PATH = "/api/unified-search/settings";
+const MAX_BODY_BYTES = 64 * 1024;
+const MAX_OPS = 64;
+/**
+ * Field names the card owns. Used only to find the profile entry in
+ * `describe()` output — never as a whitelist; the whitelist is the live
+ * `Config.dict`, so schema growth is picked up without touching this file.
+ */
+const DISCOVERY_FIELDS = ["numResults", "backendTimeoutMs", "enabledBackends", "enableExa"];
+
+/**
+ * Register the (exact) settings route on the late-mounted webServer.
+ * @param {{ register?: (route: { kind: string, path: string, handler: Function }) => void }} ws
+ * @param {{ getSettings: () => unknown, getConfig: () => unknown, getConnection?: () => unknown }} deps
+ */
+export function registerSettingsRoutes(ws, deps) {
+  if (!ws || typeof ws.register !== "function") return;
+  ws.register({
+    kind: "exact",
+    path: SETTINGS_PATH,
+    handler: guarded(deps, (req, res) => {
+      const url = new URL(String(req.url ?? "/"), "http://localhost");
+      if (url.pathname !== SETTINGS_PATH) {
+        sendJson(res, 404, { ok: false, error: "not found" });
+        return;
+      }
+      if (req.method === "GET" || req.method === "HEAD") {
+        const payload = describe(deps);
+        sendJson(res, payload.ok ? 200 : 503, payload);
+        return;
+      }
+      if (req.method === "POST") {
+        void write(req, res, deps);
+        return;
+      }
+      res.setHeader("allow", "GET, POST");
+      sendJson(res, 405, { ok: false, error: "method not allowed (GET/POST)" });
+    }),
+  });
+}
+
+/* ------------------------------------------------------------------ */
+/* handlers                                                            */
+/* ------------------------------------------------------------------ */
+
+function guarded(deps, handler) {
+  return (req, res) => {
+    const rejection = rejectionFor(req, typeof deps.getConnection === "function" ? deps.getConnection() : undefined);
+    if (rejection !== undefined) {
+      sendJson(res, rejection, { ok: false, error: rejection === 503 ? "admission unavailable" : "untrusted request" });
+      return;
+    }
+    Promise.resolve()
+      .then(() => handler(req, res))
+      .catch((err) => {
+        const status = err && Number.isInteger(err.status) ? err.status : 500;
+        sendJson(res, status, { ok: false, error: sanitize(err) });
+      });
+  };
+}
+
+/** Read the plugin's volatile form snapshot from the host settings service. */
+function describe(deps) {
+  const settings = typeof deps.getSettings === "function" ? deps.getSettings() : undefined;
+  if (settings === undefined || settings === null || typeof settings.describe !== "function") {
+    return { ok: false, writable: false, reason: "settings-unavailable" };
+  }
+  let descriptors;
+  try {
+    descriptors = settings.describe();
+  } catch {
+    return { ok: false, writable: false, reason: "settings-unavailable" };
+  }
+  const view = findNamespace(descriptors);
+  if (view === undefined) return { ok: false, writable: false, reason: "namespace-not-found" };
+  return {
+    ok: true,
+    namespace: view.ns,
+    writable: true,
+    applies: view.applies,
+    revision: view.revision,
+    value: view.value,
+    base: view.base,
+    user: view.user,
+  };
+}
+
+/**
+ * Locate this plugin's descriptor: first by shape (the card's own fields
+ * present in the resolved value), then by the profile entry id this package's
+ * bundle patch inserts. Shape-first survives a renamed insert id; the literal
+ * survives a host that reports an empty value.
+ */
+function findNamespace(descriptors) {
+  if (!Array.isArray(descriptors)) return undefined;
+  const rows = descriptors.filter((row) => row !== null && typeof row === "object" && typeof row.ns === "string");
+  return rows.find((row) => row.value !== undefined && row.value !== null
+      && typeof row.value === "object" && DISCOVERY_FIELDS.some((key) => Object.hasOwn(row.value, key)))
+    ?? rows.find((row) => row.ns === "dsh-websearch");
+}
+
+async function write(req, res, deps) {
+  const type = String(req.headers["content-type"] ?? "").toLowerCase();
+  if (!type.includes("application/json")) {
+    sendJson(res, 400, { ok: false, error: "content-type must be application/json" });
+    return;
+  }
+  let body;
+  try {
+    body = JSON.parse(await readBody(req));
+  } catch (err) {
+    sendJson(res, err && Number.isInteger(err.status) ? err.status : 400, { ok: false, error: sanitize(err) || "request body is not valid JSON" });
+    return;
+  }
+  if (body === null || typeof body !== "object" || Array.isArray(body)) {
+    sendJson(res, 400, { ok: false, error: "request body must be a JSON object" });
+    return;
+  }
+  const wanted = Array.isArray(body.ops) ? body.ops : undefined;
+  if (wanted === undefined || wanted.length === 0 || wanted.length > MAX_OPS) {
+    sendJson(res, 400, { ok: false, error: `ops must be a non-empty array of at most ${MAX_OPS} entries` });
+    return;
+  }
+  const settings = typeof deps.getSettings === "function" ? deps.getSettings() : undefined;
+  if (settings === undefined || settings === null || typeof settings.mutate !== "function") {
+    sendJson(res, 503, { ok: false, error: "settings service unavailable" });
+    return;
+  }
+  const config = typeof deps.getConfig === "function" ? deps.getConfig() : undefined;
+  const fields = config !== undefined && config !== null && config.dict !== undefined && config.dict !== null
+    ? config.dict
+    : {};
+  const ops = [];
+  for (const raw of wanted) {
+    const parsed = validateOp(raw, fields);
+    if (typeof parsed === "string") {
+      sendJson(res, 400, { ok: false, error: parsed });
+      return;
+    }
+    ops.push(parsed);
+  }
+  const view = findNamespace(safeDescribe(settings));
+  if (view === undefined) {
+    sendJson(res, 503, { ok: false, error: "settings namespace unavailable" });
+    return;
+  }
+  const expected = Number.isInteger(body.expectedRevision) ? body.expectedRevision : undefined;
+  try {
+    await settings.mutate(view.ns, ops, expected);
+  } catch (err) {
+    if (isConflict(err)) {
+      sendJson(res, 409, { ok: false, code: "SETTINGS_CONFLICT", error: "settings changed elsewhere; reload and retry" });
+      return;
+    }
+    sendJson(res, 400, { ok: false, error: sanitize(err) || "settings write failed" });
+    return;
+  }
+  const payload = describe(deps);
+  sendJson(res, payload.ok ? 200 : 503, payload);
+}
+
+/**
+ * Shape-check one path op against the live schema. The host validates only
+ * that the path is inside the volatile subtree; a wrong-typed value would be
+ * written into the profile patch and break the entry's next reload, so the
+ * value must be validated here.
+ * @returns {object|string} the op to forward, or a fixed reason string
+ */
+function validateOp(raw, fields) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return "ops entries must be objects";
+  const op = raw.op === "set" || raw.op === "unset" ? raw.op : undefined;
+  if (op === undefined) return "unsupported op (expected set|unset)";
+  const path = Array.isArray(raw.path) ? raw.path : undefined;
+  if (path === undefined || path.length !== 1 || typeof path[0] !== "string" || path[0] === "") {
+    return "path must be a one-element array holding a field name";
+  }
+  const field = path[0];
+  if (!Object.hasOwn(fields, field)) return `unknown settings field "${field}"`;
+  if (op === "unset") return { op, path: [field] };
+  if (!Object.hasOwn(raw, "value")) return `op "set" on "${field}" requires a value`;
+  const schema = fields[field];
+  if (typeof schema !== "function") return `field "${field}" is not writable`;
+  let checked;
+  try {
+    checked = schema(raw.value);
+  } catch {
+    return `invalid value for "${field}"`;
+  }
+  return { op, path: [field], value: checked };
+}
+
+function isConflict(err) {
+  if (err === null || err === undefined) return false;
+  if (typeof err === "object" && typeof err.code === "string" && err.code === "SETTINGS_CONFLICT") return true;
+  const message = typeof err === "object" && "message" in err ? String(err.message) : String(err);
+  return /SETTINGS_CONFLICT/.test(message);
+}
+
+function safeDescribe(settings) {
+  try {
+    return settings.describe();
+  } catch {
+    return undefined;
+  }
+}
+
+/* ------------------------------------------------------------------ */
+/* plumbing                                                            */
+/* ------------------------------------------------------------------ */
+
+function readBody(req) {
+  return new Promise((resolveBody, rejectBody) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        const oversize = new Error("request body too large");
+        oversize.status = 413;
+        rejectBody(oversize);
+        req.removeAllListeners("data");
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolveBody(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", rejectBody);
+  });
+}
+
+function sendJson(res, status, payload) {
+  if (res.writableEnded === true) return;
+  res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+  res.end(JSON.stringify(payload));
+}
+
+/** Fixed-shape diagnostics only: never echo header text or raw error details. */
+function sanitize(err) {
+  const raw = err === null || err === undefined ? "" : String(err && err.message ? err.message : err);
+  return raw.replace(/\s+/g, " ").trim().slice(0, 160);
+}

package/lib/trust.js

@@ -0,0 +1,179 @@
+/**
+ * Request trust fence for the plugin's HTTP surface.
+ *
+ * The plugin registers a prefix *longer* than the kernel's `/api`, and webServer
+ * dispatch is longest-prefix-wins — so these routes run before the connection
+ * service's own admission check and would otherwise answer any loopback caller.
+ * That was measured and documented as an open boundary; this module closes it.
+ *
+ * Two layers, tried in order:
+ *
+ * 1. the composition's own `connection` service when present — the exact
+ *    admission decision the kernel applies to its `/api` routes (trust fence
+ *    plus browser-auth cookie), so the plugin is never weaker than the app;
+ * 2. a structural replica of that fence for compositions without the service:
+ *    loopback host only, no cross-site fetches, and an `Origin`/`Referer` that
+ *    matches the `Host` authority whenever the client supplies one, with a
+ *    narrow exception for the desktop's dsh-app://app relay Referer.
+ *
+ * @module src/trust.js
+ */
+
+/** Hostnames a same-machine caller can legitimately use. */
+const LOOPBACK_NAMES = new Set(['127.0.0.1', '[::1]', '::1', 'localhost'])
+
+/**
+ * Is this address one a same-machine caller can reach — i.e. may the forward
+ * listener bind it? The lanes are keyed to this machine's egress and priced
+ * against whoever shares it, so binding a routable interface would hand the
+ * quota to the whole subnet on the strength of a string in a settings file.
+ */
+export function isLoopbackHost(value) {
+  const authority = authorityOf(String(value ?? ''), 'http')
+  return authority !== null && LOOPBACK_NAMES.has(authority.hostname)
+}
+
+/**
+ * The fence's view of one connection service, keyed under `admit` (issue #89).
+ *
+ * The composition may publish `connection` long after plugins have loaded, so
+ * index.js reads it per request through this late-binding view. Hosts before
+ * dsh 0.1.7 carry the same decision as `requestRejection`: the view maps that
+ * method onto `admit` instead of wrapping a property that does not exist —
+ * the wrapping call used to throw inside the fence and read as 503 admission
+ * unavailable on every request. A bare status travels as the `{rejection}`
+ * envelope `rejectionFor` unwraps: handed through bare, an object-shaped
+ * return reads as "no rejection" and switches the host's authentication off.
+ *
+ * Exported so the tests exercise the real view rather than a replica that can
+ * drift from it.
+ *
+ * @param {object|(() => object|undefined)} service - the harness `connection`
+ *   service, or a thunk resolving it per request (the composition may publish
+ *   it long after plugins have loaded)
+ * @returns {{admit: (req: object) => ({rejection: number}|undefined)|undefined}|{admit: undefined}}
+ */
+export function connectionAdmissionView(service) {
+  return {
+    get admit() {
+      const current = typeof service === 'function' ? service() : service
+      if (current === undefined) return undefined
+      if (typeof current.admit !== 'function' && typeof current.requestRejection === 'function') {
+        return req => {
+          const status = current.requestRejection(req)
+          return status === undefined ? undefined : { rejection: status }
+        }
+      }
+      return req => current.admit(req)
+    },
+  }
+}
+
+/**
+ * Decide one request. Returns an HTTP status to reject with, or `undefined` to
+ * let the handler run.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {object|undefined} connection - the harness `connection` service, when the composition mounts one
+ * @param {(decision: {status: number, source: string, reason: string}) => void} [onRejection]
+ *   fixed diagnostic fields only; never request headers or error text
+ * @returns {number|undefined}
+ */
+export function rejectionFor(req, connection, onRejection) {
+  let decision
+  try {
+    // Hosts before dsh 0.1.7 publish the same decision under the older name
+    // `requestRejection` (issue #89): `admit` is undefined there, and the
+    // service *exists*, so an empty read must fall through to that method —
+    // treating it as a fault turned every request into 503 admission
+    // unavailable. The return value is a bare status on that spelling and an
+    // `{rejection}` envelope on `admit`.
+    const admit = connection?.admit
+    if (typeof admit === 'function') {
+      const admission = admit.call(connection, req)
+      const status = admission && typeof admission === 'object' ? admission.rejection : undefined
+      if (status === undefined) return undefined
+      decision = { status, source: 'connection', reason: 'host-rejected' }
+    } else {
+      const reject = connection?.requestRejection
+      if (typeof reject === 'function') {
+        const status = reject.call(connection, req)
+        if (status === undefined) return undefined
+        decision = { status, source: 'connection', reason: 'host-rejected' }
+      }
+    }
+  } catch {
+    // Never bypass browser authentication when a mounted Host service fails.
+    decision = { status: 503, source: 'connection', reason: 'admission-error' }
+  }
+  if (decision === undefined) {
+    const reason = structuralReason(req)
+    if (reason === undefined) return undefined
+    decision = { status: 403, source: 'structural', reason }
+  }
+  try {
+    onRejection?.(decision)
+  } catch {
+    // Diagnostics are observational; a logger cannot change the HTTP decision.
+  }
+  return decision.status
+}
+
+/**
+ * The replica fence. Same shape as the kernel's `isTrustedApiRequest`: DNS
+ * rebinding defence via the Host header, cross-site fetch refusal, and an
+ * Origin/Referer authority match.
+ */
+export function structuralRejection(req) {
+  return structuralReason(req) === undefined ? undefined : 403
+}
+
+/** Return a fixed reason without exposing caller-supplied strings. */
+function structuralReason(req) {
+  const host = authorityOf(req.headers.host, 'http')
+  if (host === null || !LOOPBACK_NAMES.has(host.hostname)) return 'host-not-loopback'
+  const site = String(req.headers['sec-fetch-site'] ?? '').toLowerCase()
+  if (site === 'cross-site') return 'cross-site'
+  for (const header of ['origin', 'referer']) {
+    const raw = req.headers[header]
+    if (typeof raw !== 'string' || raw.trim() === '') continue
+    if (header === 'referer' && isDesktopRelayReferer(raw)) {
+      // Desktop forwardWebRequest strips both browser markers before relaying
+      // to HTTP loopback, but retains this Referer. It is not an Origin grant
+      // and never overrides a mounted Host's authentication decision.
+      if (req.headers.origin !== undefined || req.headers['sec-fetch-site'] !== undefined) return 'desktop-relay-markers'
+      continue
+    }
+    const authority = authorityOf(raw.trim())
+    if (authority === null) return `${header}-invalid`
+    // The web server speaks plain http on a loopback bind, so an Origin that
+    // claims https — or any other scheme — is not this page.
+    if (authority.scheme !== host.scheme || authority.hostname !== host.hostname || authority.port !== host.port) return `${header}-mismatch`
+  }
+  return undefined
+}
+
+/** Only the owned application page, never arbitrary custom-protocol pages. */
+function isDesktopRelayReferer(value) {
+  try {
+    const url = new URL(value)
+    return url.protocol === 'dsh-app:' && url.hostname === 'app' && url.port === ''
+      && url.username === '' && url.password === ''
+  } catch {
+    return false
+  }
+}
+
+/** Split a Host/Origin/Referer value into {scheme, hostname, port}, defaulting the port. */
+function authorityOf(value, defaultScheme) {
+  if (typeof value !== 'string' || value.trim() === '') return null
+  let url
+  try {
+    url = new URL(value.includes('://') ? value.trim() : `${defaultScheme ?? 'http'}://${value.trim()}`)
+  } catch {
+    return null
+  }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') return null
+  const port = url.port === '' ? (url.protocol === 'https:' ? '443' : '80') : url.port
+  return { scheme: url.protocol.replace(':', ''), hostname: url.hostname.toLowerCase(), port }
+}

package/lib/util/egress-fetch.js

@@ -0,0 +1,338 @@
+// util/egress-fetch.js — proxy-aware fetch for kill-switched egress environments.
+//
+// Node's global fetch ignores HTTP_PROXY / HTTPS_PROXY. Containerized
+// deployments commonly rely on those env vars AND block direct connections
+// (egress kill-switch), so every outbound backend request must tunnel through
+// the proxy. This module provides the fetch subset the plugin uses — ok,
+// status, headers.get(), text(), json(), body.cancel(), abort signals,
+// redirect:"error" plus bounded redirect:"follow" — backed by node:http(s)
+// with a proxy CONNECT tunnel and zero dependencies.
+//
+// When no matching proxy env is set, or the target host sits in NO_PROXY, it
+// defers to the native fetch, so behavior everywhere else is unchanged.
+
+import http from "node:http";
+import https from "node:https";
+
+const REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);
+const MAX_REDIRECTS = 5;
+
+/** fetch-compatible entry: tunnels via HTTPS_PROXY/HTTP_PROXY when configured. */
+export function egressFetch(url, init = {}) {
+  const proxy = proxyFor(url);
+  if (proxy === undefined) return fetch(url, init);
+  return tunneledFetch(String(url), init, proxy, 0);
+}
+
+/** Resolve the proxy URL for a request target (NO_PROXY aware). */
+function proxyFor(url) {
+  let target;
+  try {
+    target = new URL(String(url));
+  } catch {
+    return undefined;
+  }
+  if (target.protocol !== "https:" && target.protocol !== "http:") return undefined;
+  const env = process.env;
+  const proxy = target.protocol === "https:"
+    ? env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy
+    : env.HTTP_PROXY || env.http_proxy;
+  if (proxy === undefined || proxy === "") return undefined;
+  if (inNoProxy(target, env.NO_PROXY || env.no_proxy)) return undefined;
+  return proxy;
+}
+
+/** NO_PROXY matching: "*", bare hosts, leading-dot suffixes, optional :port. */
+function inNoProxy(target, raw) {
+  if (raw === undefined || raw === "") return false;
+  const host = target.hostname.toLowerCase();
+  const port = target.port !== "" ? target.port : target.protocol === "https:" ? "443" : "80";
+  for (const piece of String(raw).split(",")) {
+    const item = piece.trim().toLowerCase();
+    if (item === "") continue;
+    if (item === "*") return true;
+    const [name, itemPort] = splitHostPort(item);
+    if (itemPort !== "" && itemPort !== port) continue;
+    const bare = name.replace(/^\./, "");
+    if (bare === "" ) continue;
+    if (host === bare || host.endsWith("." + bare)) return true;
+  }
+  return false;
+}
+
+function splitHostPort(item) {
+  if (item.startsWith("[")) {
+    const close = item.indexOf("]");
+    if (close === -1) return [item.replace(/^\[/, ""), ""];
+    const rest = item.slice(close + 1);
+    return [item.slice(1, close), rest.startsWith(":") ? rest.slice(1) : ""];
+  }
+  const colon = item.lastIndexOf(":");
+  if (colon === -1) return [item, ""];
+  return [item.slice(0, colon), item.slice(colon + 1)];
+}
+
+async function tunneledFetch(url, init, proxy, depth) {
+  const target = new URL(url);
+  const secure = target.protocol === "https:";
+  const method = String(init.method ?? "GET").toUpperCase();
+  const headers = normalizeHeaders(init.headers);
+  const body = normalizeBody(init.body);
+  if (body !== undefined && headers["content-length"] === undefined && headers["transfer-encoding"] === undefined) {
+    headers["content-length"] = String(body.length);
+  }
+  const signal = init.signal;
+  throwIfAborted(signal);
+
+  const response = secure
+    ? await httpsViaConnect(target, proxy, method, headers, body, signal)
+    : await httpViaProxy(target, proxy, method, headers, body, signal);
+
+  if (REDIRECT_STATUS.has(response.status)) {
+    const location = response.headers.get("location");
+    if (location !== null && location !== "") {
+      if (init.redirect === "error") {
+        await drain(response);
+        throw new TypeError(`fetch failed: redirect mode is set to error (${response.status})`);
+      }
+      if (init.redirect !== "manual" && depth < MAX_REDIRECTS) {
+        const next = new URL(location, target);
+        const dropBody = response.status === 303
+          || ((response.status === 301 || response.status === 302) && method === "POST");
+        const nextInit = dropBody
+          ? { ...init, method: "GET", body: undefined, headers: withoutBodyHeaders(init.headers) }
+          : { ...init };
+        await drain(response);
+        return egressFetch(next.href, nextInit);
+      }
+    }
+  }
+  return response;
+}
+
+/* ------------------------------------------------------------------ */
+/* transports                                                          */
+/* ------------------------------------------------------------------ */
+
+function httpsViaConnect(target, proxyUrl, method, headers, body, signal) {
+  const proxy = new URL(proxyUrl);
+  const port = target.port !== "" ? Number(target.port) : 443;
+  return new Promise((resolve, reject) => {
+    const open = [];
+    let settled = false;
+    const cleanup = () => {
+      if (signal !== undefined && typeof signal.removeEventListener === "function") {
+        signal.removeEventListener("abort", onAbort);
+      }
+    };
+    const onAbort = () => {
+      for (const handle of open) handle.destroy?.();
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(signal?.aborted === true ? abortReason(signal) : error);
+    };
+    const done = (response) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(response);
+    };
+    if (signal !== undefined && typeof signal.addEventListener === "function") {
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+
+    const connectHeaders = { host: `${target.hostname}:${port}` };
+    const proxyAuth = basicProxyAuth(proxy);
+    if (proxyAuth !== undefined) connectHeaders["proxy-authorization"] = proxyAuth;
+    const connectReq = http.request({
+      host: proxy.hostname,
+      port: proxy.port !== "" ? Number(proxy.port) : 80,
+      method: "CONNECT",
+      path: `${target.hostname}:${port}`,
+      headers: connectHeaders,
+      signal,
+    });
+    open.push(connectReq);
+    connectReq.on("error", (error) => fail(new TypeError(`fetch failed: proxy CONNECT ${sanitize(error)}`, { cause: error })));
+    connectReq.on("response", (res) => {
+      res.resume();
+      fail(new TypeError(`fetch failed: proxy CONNECT rejected with ${res.statusCode}`));
+    });
+    connectReq.on("connect", (connectRes, socket) => {
+      if (connectRes.statusCode !== 200) {
+        socket.destroy();
+        fail(new TypeError(`fetch failed: proxy CONNECT rejected with ${connectRes.statusCode}`));
+        return;
+      }
+      const request = https.request({
+        socket,
+        agent: false,
+        servername: target.hostname,
+        method,
+        path: pathWithQuery(target),
+        headers,
+      });
+      open.push(request);
+      request.on("error", (error) => fail(new TypeError(`fetch failed: ${sanitize(error)}`, { cause: error })));
+      request.on("response", (res) => {
+        collect(res).then(done, (error) => fail(error));
+      });
+      if (signal?.aborted === true) {
+        request.destroy();
+        fail(abortReason(signal));
+        return;
+      }
+      request.end(body);
+    });
+    connectReq.end();
+  });
+}
+
+function httpViaProxy(target, proxyUrl, method, headers, body, signal) {
+  const proxy = new URL(proxyUrl);
+  return new Promise((resolve, reject) => {
+    const request = http.request({
+      host: proxy.hostname,
+      port: proxy.port !== "" ? Number(proxy.port) : 80,
+      method,
+      path: target.href,
+      headers: { ...headers, host: headers.host ?? target.host },
+      signal,
+    });
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      reject(signal?.aborted === true ? abortReason(signal) : error);
+    };
+    let settled = false;
+    const proxyAuth = basicProxyAuth(proxy);
+    if (proxyAuth !== undefined) request.setHeader("proxy-authorization", proxyAuth);
+    request.on("error", (error) => fail(new TypeError(`fetch failed: ${sanitize(error)}`, { cause: error })));
+    request.on("response", (res) => {
+      collect(res).then((response) => {
+        if (settled) return;
+        settled = true;
+        resolve(response);
+      }, fail);
+    });
+    if (signal?.aborted === true) {
+      request.destroy();
+      fail(abortReason(signal));
+      return;
+    }
+    request.end(body);
+  });
+}
+
+/* ------------------------------------------------------------------ */
+/* plumbing                                                            */
+/* ------------------------------------------------------------------ */
+
+function collect(res) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    res.on("data", (chunk) => chunks.push(chunk));
+    res.on("end", () => {
+      // Null-body statuses (204/304) and empty streams must construct a
+      // bodiless Response; an empty Buffer is not null and would throw.
+      const payload = chunks.length === 0 ? null : Buffer.concat(chunks);
+      resolve(new Response(payload, {
+        status: res.statusCode ?? 502,
+        headers: headersFromRaw(res),
+      }));
+    });
+    res.on("error", reject);
+  });
+}
+
+function headersFromRaw(res) {
+  const pairs = [];
+  const raw = res.rawHeaders ?? [];
+  for (let i = 0; i + 1 < raw.length; i += 2) pairs.push([raw[i], raw[i + 1]]);
+  return new Headers(pairs);
+}
+
+function pathWithQuery(target) {
+  return target.pathname + target.search;
+}
+
+function normalizeHeaders(raw) {
+  const headers = {};
+  if (raw === undefined || raw === null) return headers;
+  if (typeof raw.forEach === "function" && typeof raw.get === "function") {
+    raw.forEach((value, key) => { headers[String(key).toLowerCase()] = String(value); });
+  } else if (Array.isArray(raw)) {
+    for (const entry of raw) {
+      if (Array.isArray(entry) && entry.length >= 2) headers[String(entry[0]).toLowerCase()] = String(entry[1]);
+    }
+  } else if (typeof raw === "object") {
+    for (const [key, value] of Object.entries(raw)) {
+      if (value !== undefined) headers[String(key).toLowerCase()] = String(value);
+    }
+  }
+  delete headers["host"];
+  return headers;
+}
+
+function withoutBodyHeaders(raw) {
+  if (raw === undefined || raw === null) return raw;
+  const drop = new Set(["content-type", "content-length", "content-encoding"]);
+  if (typeof raw.forEach === "function" && typeof raw.get === "function") {
+    const copy = new Headers();
+    raw.forEach((value, key) => {
+      if (!drop.has(String(key).toLowerCase())) copy.append(key, value);
+    });
+    return copy;
+  }
+  const copy = {};
+  if (Array.isArray(raw)) {
+    for (const entry of raw) {
+      if (Array.isArray(entry) && entry.length >= 2 && !drop.has(String(entry[0]).toLowerCase())) copy[entry[0]] = entry[1];
+    }
+  } else if (typeof raw === "object") {
+    for (const [key, value] of Object.entries(raw)) {
+      if (!drop.has(String(key).toLowerCase())) copy[key] = value;
+    }
+  }
+  return copy;
+}
+
+function normalizeBody(body) {
+  if (body === undefined || body === null) return undefined;
+  if (typeof body === "string") return Buffer.from(body);
+  if (Buffer.isBuffer(body)) return body;
+  if (body instanceof Uint8Array) return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+  if (typeof URLSearchParams !== "undefined" && body instanceof URLSearchParams) return Buffer.from(body.toString());
+  return Buffer.from(String(body));
+}
+
+function basicProxyAuth(proxy) {
+  if (proxy.username === "" && proxy.password === "") return undefined;
+  const user = decodeURIComponent(proxy.username);
+  const pass = decodeURIComponent(proxy.password);
+  return "Basic " + Buffer.from(`${user}:${pass}`).toString("base64");
+}
+
+function throwIfAborted(signal) {
+  if (signal?.aborted === true) throw abortReason(signal);
+}
+
+function abortReason(signal) {
+  return signal?.reason !== undefined ? signal.reason : new DOMException("This operation was aborted", "AbortError");
+}
+
+function sanitize(error) {
+  const raw = error && error.message ? String(error.message) : String(error);
+  return raw.replace(/\s+/g, " ").slice(0, 140);
+}
+
+async function drain(response) {
+  try {
+    await response.body?.cancel?.();
+  } catch {
+    /* already consumed */
+  }
+}

package/lib/util/mcp-client.js

@@ -6,6 +6,7 @@
  */
 
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "./egress-fetch.js";
 
 const UA = "dsh-websearch/2.3";
 const PROTOCOL_VERSION = "2025-06-18";
@@ -41,7 +42,7 @@ async function ensureSession(url, signal) {
 
   let initResponse;
   try {
-    initResponse = await fetch(url, {
+    initResponse = await egressFetch(url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -75,7 +76,7 @@ async function ensureSession(url, signal) {
   };
   
   try {
-    const notifyResponse = await fetch(url, {
+    const notifyResponse = await egressFetch(url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -161,7 +162,7 @@ export async function mcpCall(url, toolName, args, extraHeaders = {}, signal) {
 
   let response;
   try {
-    response = await fetch(url, {
+    response = await egressFetch(url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -186,7 +187,7 @@ export async function mcpCall(url, toolName, args, extraHeaders = {}, signal) {
     // Retry with fresh session
     const newSessionId = await ensureSession(url, signal);
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@240xu/dsh-websearch",
-  "version": "2.8.3",
+  "version": "2.8.4",
   "description": "Unified web search provider for DeepSeek Harness (ctx.web): 11 backends — Exa + Parallel + DDG + SearXNG (keyless), DeepSeek + Anthropic + OpenAI + Brave + Tavily + Serper + Mojeek (key-gated via Settings credentials). Registers provider id \"unified\" for zero-config web_search. 统一网页搜索聚合：11 后端并发扇出、去重合并，零依赖。See CHANGELOG.md for version history.",
   "type": "module",
   "main": "lib/index.js",