@240xu/dsh-websearch 2.8.3 → 2.8.5

package/lib/backends/anthropic-like.js

@@ -17,6 +17,7 @@
 
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 /** Attribution header; bumped with the package version. */
 const UA = "dsh-websearch/2.3";
@@ -111,7 +112,7 @@ export function createAnthropicLikeBackend(spec) {
 
       let response;
       try {
-        response = await fetch(endpoint, {
+        response = await egressFetch(endpoint, {
           method: "POST",
           redirect: "error",
           headers: {

package/lib/backends/brave.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applyBraveFilters, normalizeFilters, safeSearchParams } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const BRAVE_ENDPOINT = "https://api.search.brave.com/res/v1/web/search";
 
@@ -46,7 +47,7 @@ export const braveBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers: {
           "X-Subscription-Token": apiKey,

package/lib/backends/ddg.js

@@ -8,6 +8,7 @@
 import { searchAborted, isAbortError, throwIfSearchAborted } from "../util/abort.js";
 import { applyDdgFilters, normalizeFilters } from "../util/filters.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 export const DDG_ENDPOINT = "https://html.duckduckgo.com/html/";
 
@@ -29,20 +30,21 @@ export const ddgBackend = {
     throwIfSearchAborted(signal);
     const params = new URLSearchParams({ q: request.query, b: Math.random().toString().slice(2) });
     applyDdgFilters(params, normalizeFilters(request.filters));
-    const body = params.toString();
+    const target = `${DDG_ENDPOINT}?${params.toString()}`;
     hooks.recordRequest?.({ endpoint: DDG_ENDPOINT, toolName: "html", body: { q: request.query }, headers: {} });
 
     let text;
     try {
-      const res = await fetch(DDG_ENDPOINT, {
-        method: "POST",
+      // GET form: DDG's html endpoint still serves the same results page, and
+      // unlike the POST form it is not rejected by the endpoint's bot wall
+      // for non-browser clients (POST is JA3 + method double-gated).
+      const res = await egressFetch(target, {
+        method: "GET",
         redirect: "error",
         headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
           "Accept": "text/html",
           "User-Agent": "dsh-websearch/2.3",
         },
-        body,
         ...(signal !== undefined ? { signal } : {}),
       });
       if (!res.ok) {

package/lib/backends/mojeek.js

@@ -7,6 +7,7 @@
 
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const MOJEEK_ENDPOINT = "https://api.mojeek.com/v1/search";
 
@@ -52,7 +53,7 @@ export const mojeekBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers,
         redirect: "error",

package/lib/backends/openai.js

@@ -12,6 +12,7 @@
 
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const UA = "dsh-websearch/2.3";
 
@@ -67,7 +68,7 @@ export const openaiBackend = {
 
     let response;
     try {
-      response = await fetch(endpoint, {
+      response = await egressFetch(endpoint, {
         method: "POST",
         redirect: "error",
         headers: {

package/lib/backends/searxng.js

@@ -9,6 +9,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applySearxngFilters, normalizeFilters, safeSearchParams } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const DEFAULT_SEARXNG_URL = "https://searx.be";
 
@@ -61,7 +62,7 @@ export const searxngBackend = {
 
     let response;
     try {
-      response = await fetch(url, {
+      response = await egressFetch(url, {
         method: "GET",
         headers,
         redirect: "error",

package/lib/backends/serper.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applySerperFilters, normalizeFilters } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const SERPER_ENDPOINT = "https://google.serper.dev/search";
 
@@ -46,7 +47,7 @@ export const serperBackend = {
 
     let response;
     try {
-      response = await fetch(baseURL, {
+      response = await egressFetch(baseURL, {
         method: "POST",
         headers: {
           "X-API-KEY": apiKey,

package/lib/backends/tavily.js

@@ -8,6 +8,7 @@
 import { WebError } from "@deepseek-ai/dsh-web";
 import { throwIfSearchAborted, searchAborted, isAbortError } from "../util/abort.js";
 import { applyTavilyFilters, normalizeFilters } from "../util/filters.js";
+import { egressFetch } from "../util/egress-fetch.js";
 
 const TAVILY_ENDPOINT = "https://api.tavily.com/search";
 
@@ -55,7 +56,7 @@ export const tavilyBackend = {
 
     let response;
     try {
-      response = await fetch(baseURL, {
+      response = await egressFetch(baseURL, {
         method: "POST",
         headers: {
           "Authorization": `Bearer ${apiKey}`,

package/lib/client.js

@@ -171,6 +171,78 @@ window.__ModuleLoader__.load({
 			};
 		}
 
+		/**
+		 * Settings bridge for 0.2.x builds where the legacy `settingsScope`
+		 * client service is gone: the same snapshot/subscribe/set/unset surface
+		 * the card controller expects, backed by this plugin's fenced settings
+		 * route. Writes land in the volatile profile entry the host provider
+		 * resolves from on the next call -- no second settings store.
+		 */
+		class SettingsRoutesBridge {
+			constructor() {
+				this.store = createStore({
+					status: "loading",
+					writable: false,
+					value: undefined,
+					base: undefined,
+					user: undefined,
+					revision: undefined,
+					mode: "routes",
+				});
+			}
+
+			getSnapshot() { return this.store.getSnapshot(); }
+			subscribe(listener) { return this.store.subscribe(listener); }
+
+			accept(payload) {
+				if (payload === null || typeof payload !== "object" || payload.ok !== true || payload.writable === false) {
+					// Keep the card rendered (status ready) but read-only, so the section
+					// explains itself instead of showing an endless loading ellipsis.
+					this.store.set({ status: "ready", writable: false, value: {}, base: undefined, user: undefined, revision: undefined, mode: "routes" });
+					return;
+				}
+				this.store.set({
+					status: "ready",
+					writable: true,
+					value: payload.value,
+					base: payload.base,
+					user: payload.user,
+					revision: payload.revision,
+					mode: "routes",
+				});
+			}
+
+			async load() {
+				try {
+				const response = await fetch("/api/unified-search/settings", { credentials: "same-origin", headers: { accept: "application/json" } });
+				const payload = await response.json().catch(() => undefined);
+				this.accept(response.status === 404 ? undefined : payload);
+				} catch (_noRoutes) {
+				this.accept(undefined);
+				}
+			}
+
+			async write(ops) {
+				const expectedRevision = this.store.getSnapshot().revision;
+				const response = await fetch("/api/unified-search/settings", {
+					method: "POST",
+					credentials: "same-origin",
+					headers: { "content-type": "application/json", accept: "application/json" },
+					// eslint-disable-next-line object-shorthand
+					body: JSON.stringify(expectedRevision === undefined ? { ops } : { ops, expectedRevision }),
+				});
+				const payload = await response.json().catch(() => undefined);
+				if (response.status === 409 || (payload !== undefined && payload.code === "SETTINGS_CONFLICT")) throw new Error("SETTINGS_CONFLICT");
+				if (!response.ok || payload === undefined || payload.ok !== true) {
+					throw new Error(payload !== undefined && payload.error !== undefined ? String(payload.error) : "settings request failed (" + response.status + ")");
+				}
+				this.accept(payload);
+			}
+
+			set(field, value) { return this.write([{ op: "set", path: [field], value }]); }
+			unset(field) { return this.write([{ op: "unset", path: [field] }]); }
+		}
+
 		/**
 		 * Card state machine: reads the bound settings scope snapshot, stages edits,
 		 * writes section fields through scope.set/unset and secrets via credentials.
@@ -247,14 +319,37 @@ window.__ModuleLoader__.load({
 
 			async readCredential(ref) {
 				try {
-					const res = await this.connection.api.credentials.describe({ refs: [ref] });
-					if (!res.result.ok) return;
-					const view = res.result.value.credentials[ref];
-					this.keyState.set(ref, { configured: view?.configured ?? false, writable: view?.writable !== false });
+					let view;
+					if (this.remote !== undefined && this.remote.credentials !== undefined && typeof this.remote.credentials.describe === "function") {
+						// 0.2.x remote face: Record<ref, {configured, writable, source}> behind {ok, value}.
+						const res = await this.remote.credentials.describe([ref]);
+						const record = res !== null && typeof res === "object" && res.value !== undefined ? res.value : res;
+						const byRef = record !== null && typeof record === "object" && record.credentials !== undefined ? record.credentials : record;
+						view = byRef !== null && typeof byRef === "object" ? byRef[ref] : undefined;
+					}
+					if (view === undefined && this.connection !== undefined && this.connection.api !== undefined && this.connection.api.credentials !== undefined) {
+						// Older line: the connection controller's credentials API.
+						const res = await this.connection.api.credentials.describe({ refs: [ref] });
+						if (res?.result?.ok) view = res.result.value.credentials[ref];
+					}
+					if (view === undefined) return;
+					this.keyState.set(ref, { configured: view.configured === true, writable: view.writable !== false });
 				} catch { /* ignore */ }
 				this.republish();
 			}
 
+			async writeCredential(ref, value) {
+				if (this.remote !== undefined && this.remote.credentials !== undefined && typeof this.remote.credentials.set === "function") {
+					await this.remote.credentials.set(ref, value);
+					return;
+				}
+				if (this.connection !== undefined && this.connection.api !== undefined && this.connection.api.credentials !== undefined && typeof this.connection.api.credentials.set === "function") {
+					await this.connection.api.credentials.set({ ref, value });
+					return;
+				}
+				throw new Error("credentials service unavailable");
+			}
+
 			refreshAllCredentials() {
 				for (const b of BACKENDS) if (b.keyEnv) this.readCredential(b.keyEnv);
 			}
@@ -291,7 +386,7 @@ window.__ModuleLoader__.load({
 								backendTimeoutMs: [1000, 120000],
 							};
 							const [lo, hi] = BOUNDS[field] ?? [-Infinity, Infinity];
-							{ this.failed = true; this.failedFields.add(field); continue; }
+							if (!Number.isFinite(num) || num < lo || num > hi) { this.failed = true; this.failedFields.add(field); continue; }
 							await this.scope.set(field, num);
 							doneFields.push(field);
 						} else {
@@ -303,7 +398,7 @@ window.__ModuleLoader__.load({
 						const value = staged.text.trim();
 						if (value !== "") {
 							try {
-								await this.connection.api.credentials.set({ ref, value });
+								await this.writeCredential(ref, value);
 								this.keyState.set(ref, { configured: true, writable: true });
 								doneKeys.push(ref);
 								this.failedKeys.delete(ref);
@@ -424,6 +519,7 @@ window.__ModuleLoader__.load({
 						backend: b,
 						value: state.value[toggleField(b.id)],
 						keyConfigured: true,
+						t: props.t,
 						onChange: (checked) => card.setToggle(b.id, checked),
 					}, b.id)
 				) }),
@@ -433,6 +529,7 @@ window.__ModuleLoader__.load({
 						backend: b,
 						value: state.value[toggleField(b.id)],
 						keyConfigured: !!state.keyState[b.keyEnv]?.configured,
+						t: props.t,
 						onChange: (checked) => card.setToggle(b.id, checked),
 					}, b.id)
 				) }),
@@ -545,27 +642,49 @@ window.__ModuleLoader__.load({
 
 		/**
 		 * Plugin entry: register the card into the settings plugins page.
-		 * Compatibility (compat-audit P0): the settingsScope client service was
-		 * removed in DSH 0.1.7. It stays in `inject` so the fiber still
-		 * activates when the shim supplies it; every access is feature-detected.
+		 * Compatibility: the legacy `settingsScope` client service was removed on
+		 * the 0.2.x line; the card binds whichever data source the build offers
+		 * (see selectBridge) and registers the section unconditionally.
 		 */
-		const inject = ["slots", "locale", "connection", "remote", "settingsScope"];
+		const inject = ["slots", "locale", "connection", "remote"];
+		/**
+		 * Resolve the settings data source for this build, in order:
+		 *  1. the legacy `settingsScope` service (DSH <= 0.1.6 line, or a shim);
+		 *  2. this plugin's own fenced settings routes (0.2.x line, where the
+		 *     client service was removed and the settings shell renders client
+		 *     slot sections only);
+		 *  3. an unavailable bridge -- the section still registers and the card
+		 *     explains itself through its read-only banner.
+		 */
+		function selectBridge(ctx) {
+			try {
+			const scope = ctx.get("settingsScope");
+			if (scope !== undefined && typeof scope.bind === "function") return scope.bind({ namespace: PLUGIN_NS });
+			} catch (_noSettingsScope) { /* fall through to the routes bridge */ }
+			return new SettingsRoutesBridge();
+		}
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register(NS, { zh, en }), "websearch: copy dictionaries");
-			const hasSettingsScope = ctx.get("settingsScope") !== undefined && typeof ctx.settingsScope?.bind === "function";
-			if (!hasSettingsScope) {
-				// DSH >= 0.1.7 without dsh-settings-scope-shim: the settings card
-				// cannot bind its scope. Stop wiring the card instead of hard-
-				// crashing the client fiber; the breadcrumb aids diagnosis.
-				console.warn("[dsh-websearch] settingsScope service unavailable (DSH >= 0.1.7); unified-search settings card disabled. Configure via server settings/cordis config or install dsh-settings-scope-shim.");
-				return;
-			}
+			const bridge = selectBridge(ctx);
+			if (typeof bridge.load === "function") void bridge.load();
 			const controller = new UnifiedSearchCardController(
-				ctx.settingsScope.bind({ namespace: PLUGIN_NS }),
+				bridge,
 				ctx.get("connection"),
 				ctx.get("remote"),
 			);
-			ctx.effect(() => ctx.remote.$on("credentials/updated", () => controller.refreshAllCredentials()), "websearch: credential invalidations");
+			// Credential invalidations: 0.2.x forwards `credentials/reference-updated`;
+			// older lines forwarded `credentials/updated`. Subscribe to whichever
+			// event face this build exposes; a missing face must not abort apply().
+			for (const event of ["credentials/reference-updated", "credentials/updated"]) {
+				try {
+				ctx.effect(() => ctx.remote.$on(event, () => controller.refreshAllCredentials()), "websearch: credential invalidations");
+				} catch (_noEventFace) { /* this build does not forward that event */ }
+			}
+			// Re-read when another client saves this namespace (settings document
+			// revisions travel through the remote event face on 0.2.x).
+			try {
+				ctx.effect(() => ctx.remote.$on("settings/document-updated", () => { if (typeof bridge.load === "function") void bridge.load(); }), "websearch: settings document invalidations");
+			} catch (_noSettingsEvent) { /* settings events unavailable */ }
 			ctx.slots.inject("settings.section", () => ctx.slots.register({
 				name: "settings.section",
 				id: "websearch",

package/lib/health.js

@@ -7,6 +7,8 @@
 // provider's own telemetry truncation) and run through a defensive redaction
 // pass for token-like fragments.
 
+import { rejectionFor } from "./trust.js";
+
 const MAX_ERROR_CHARS = 120;
 
 /** Token-like fragments that must never appear in a health payload. */
@@ -89,6 +91,11 @@ export function registerHealthRoute(ws, deps) {
         res.writeHead(code, { "content-type": "application/json" });
         res.end(JSON.stringify(body));
       };
+      const rejection = rejectionFor(req, typeof deps.getConnection === "function" ? deps.getConnection() : undefined);
+      if (rejection !== undefined) {
+        send(rejection, { ok: false, error: rejection === 503 ? "admission unavailable" : "untrusted request" });
+        return;
+      }
       if (req.method !== "GET" && req.method !== "HEAD") {
         send(405, { ok: false, error: "method not allowed (GET only)" });
         return;

package/lib/history.js

@@ -8,6 +8,7 @@
 
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { rejectionFor } from "./trust.js";
 
 /** Ring-buffer cap (spec: 50). */
 export const HISTORY_MAX_ENTRIES = 50;
@@ -143,18 +144,19 @@ export function toBackendObservability(healthMap, nowMs = Date.now()) {
  *   backends: per-backend last real outcome/latency/breaker state (v2.8.0),
  *   so fallback redundancy is observable without a separate endpoint.
  * POST /api/websearch/history/clear  -> { ok, cleared: true }
- * Both routes sit behind isTrustedApiRequest (loopback Host + same-site).
+ * Both routes sit behind the host connection admission fence (the same
+ * decision the kernel applies to its own /api routes).
  */
-export function registerHistoryRoutes(ws, { getStore, getBackendHealth }) {
+export function registerHistoryRoutes(ws, { getStore, getBackendHealth, getConnection }) {
   if (!ws || typeof ws.register !== "function") return;
   const send = (res, code, body) => {
     res.writeHead(code, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
   };
   const guarded = (handler) => (req, res) => {
-    const fence = isTrustedApiRequest(req);
-    if (fence) {
-      send(res, 403, { ok: false, error: `untrusted request (${fence})` });
+    const rejection = rejectionFor(req, typeof getConnection === "function" ? getConnection() : undefined);
+    if (rejection !== undefined) {
+      send(res, rejection, { ok: false, error: rejection === 503 ? "admission unavailable" : "untrusted request" });
       return;
     }
     handler(req, res);

package/lib/index.js

@@ -37,6 +37,7 @@ import { createUnifiedSearchProvider, getLatestBackendHealth } from "./provider.
 import { registerHealthRoute } from "./health.js";
 import { createSearchCache, CACHE_DEFAULTS } from "./cache.js";
 import { createHistoryStore, registerHistoryRoutes, HISTORY_MAX_ENTRIES } from "./history.js";
+import { registerSettingsRoutes } from "./settings-api.js";
 import { BREAKER_DEFAULTS } from "./breaker.js";
 import os from "node:os";
 import path from "node:path";
@@ -391,6 +392,8 @@ export function resolveStoreDir(env = process.env, fallbackHome = os.homedir())
  */
 export function apply(ctx, config) {
   let current = () => config;
+  /** 0.2.x SettingsForms instance, captured for the browser settings bridge. */
+  let settingsForms;
 
   ctx.inject(["settings"], (settingsCtx) => {
     const settings = settingsCtx.settings;
@@ -404,10 +407,11 @@ export function apply(ctx, config) {
       });
       return;
     }
-    // 0.2.0 SettingsForms line: no installSection; the settings form is
-    // auto-generated from the volatile-marked Config above — no action and no
-    // warning here (the form IS the section; a warning would contradict the
-    // visible UI). Config values still resolve via cordis config.
+    // 0.2.x SettingsForms line: no installSection. Keep the service so the
+    // browser settings card can read/write this profile entry through the
+    // fenced bridge in ./settings-api.js; values keep resolving via cordis
+    // config (the same volatile entry), so there is no second settings store.
+    if (typeof settings?.describe === "function" && typeof settings?.mutate === "function") settingsForms = settings;
   });
 
   // v2.7.0 stores: disk cache + append-only search history, both under
@@ -449,16 +453,33 @@ export function apply(ctx, config) {
   // only reads the settings snapshot + last per-search telemetry — it never
   // probes backends and never touches credential values.
   ctx.inject(["webServer"], (webCtx) => {
+    const getConnection = () => {
+      try {
+        return ctx.get("connection");
+      } catch {
+        return undefined;
+      }
+    };
     registerHealthRoute(webCtx.webServer, {
       resolveOptions: () => resolveOptions(ctx, current()),
       backends: BACKENDS,
       getBackendHealth: getLatestBackendHealth,
+      getConnection,
     });
     // v2.7.0 search history: read-only GET + explicit clear POST.
     // v2.8.0: GET also carries per-backend last-outcome observability.
     registerHistoryRoutes(webCtx.webServer, {
       getStore: () => historyStore,
       getBackendHealth: getLatestBackendHealth,
+      getConnection,
+    });
+    // Settings bridge for the browser card on 0.2.x builds (no legacy
+    // settingsScope service). Fenced by the host connection admission; writes
+    // land in the volatile config entry above.
+    registerSettingsRoutes(webCtx.webServer, {
+      getSettings: () => settingsForms,
+      getConfig: () => Config,
+      getConnection,
     });
   });
 }