@causyne/agent 1.10.13 → 1.10.18

package/src/tools/webFetch.js

@@ -1,74 +1,189 @@
-import fs from 'fs/promises';
-import path from 'path';
-import os from 'os';
-
-// Phase 3 AGI Upgrade: HTML Cleanup to Markdown
-function htmlToText(html) {
-  // AGI Optimization: Aggressively strip scripts, styles, svg, and tags
-  let text = html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
-  text = text.replace(/<style\b[^<]*(?:(?!<\/style>)<[^<]*)*<\/style>/gi, '');
-  text = text.replace(/<svg\b[^<]*(?:(?!<\/svg>)<[^<]*)*<\/svg>/gi, '');
-  text = text.replace(/<[^>]+>/g, ' '); // Strip HTML tags
-  text = text.replace(/&nbsp;/g, ' '); // Decode basic entities
-  text = text.replace(/\s{2,}/g, ' '); // Normalize spaces
-  text = text.replace(/\n\s*\n/g, '\n\n'); // Normalize line breaks
-  return text.trim();
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { BrowserCapabilityError, causyneBrowser } from '../browser/causyneBrowser.js';
+import { assertPublicWebUrl } from '../browser/urlPolicy.js';
+const MAX_REDIRECTS = 5;
+const MAX_RESPONSE_BYTES = 50 * 1024 * 1024;
+const MAX_OUTPUT_CHARS = 80_000;
+const REQUEST_TIMEOUT_MS = 30_000;
+function decodeEntities(text) {
+    const named = { amp: '&', apos: "'", gt: '>', lt: '<', nbsp: ' ', quot: '"' };
+    return text.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (full, entity) => {
+        if (entity.startsWith('#x'))
+            return String.fromCodePoint(Number.parseInt(entity.slice(2), 16));
+        if (entity.startsWith('#'))
+            return String.fromCodePoint(Number.parseInt(entity.slice(1), 10));
+        return named[entity.toLowerCase()] ?? full;
+    });
 }
-
-export const webFetch = {
-  schema: {
-    name: 'web.fetch',
-    description: 'Make HTTP requests. Automatically strips raw HTML into clean text to protect Context Window.',
-    parameters: {
-      type: 'object',
-      properties: {
-        url: { type: 'string' },
-        method: { type: 'string' },
-        headers: { type: 'object' },
-        body: { type: 'string' },
-        outputFile: { type: 'string', description: 'If provided, saves as a binary file instead of returning text' }
-      },
-      required: ['url']
+export function htmlToReadableText(html) {
+    return decodeEntities(String(html ?? ''))
+        .replace(/<(script|style|svg|noscript)\b[^>]*>[\s\S]*?<\/\1>/gi, ' ')
+        .replace(/<\s*br\s*\/?>/gi, '\n')
+        .replace(/<\/(p|div|article|section|li|h[1-6]|tr)>/gi, '\n')
+        .replace(/<[^>]+>/g, ' ')
+        .replace(/[ \t]+/g, ' ')
+        .replace(/ *\n */g, '\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+function validatedHeaders(value) {
+    if (value === undefined)
+        return {};
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('headers must be an object');
+    const result = {};
+    for (const [key, item] of Object.entries(value)) {
+        if (typeof item !== 'string' || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(key) || /[\r\n]/.test(item)) {
+            throw new Error('headers contain an invalid name or value');
+        }
+        result[key] = item;
     }
-  },
-  async execute(args) {
+    return result;
+}
+async function fetchFollowingSafeRedirects(urlValue, options) {
+    let url = await assertPublicWebUrl(urlValue);
+    let request = { ...options };
+    for (let redirect = 0; redirect <= MAX_REDIRECTS; redirect++) {
+        const response = await fetch(url, { ...request, redirect: 'manual' });
+        if (![301, 302, 303, 307, 308].includes(response.status))
+            return { response, finalUrl: url };
+        if (redirect === MAX_REDIRECTS)
+            throw new Error(`Too many redirects (maximum ${MAX_REDIRECTS})`);
+        const location = response.headers.get('location');
+        if (!location)
+            throw new Error(`HTTP ${response.status} redirect has no Location header`);
+        await response.body?.cancel().catch(() => { });
+        url = await assertPublicWebUrl(new URL(location, url).href);
+        if (response.status === 303 || ([301, 302].includes(response.status) && request.method === 'POST')) {
+            const redirectedHeaders = new Headers(request.headers);
+            redirectedHeaders.delete('content-length');
+            redirectedHeaders.delete('content-type');
+            const { body: _discardedBody, ...redirectedRequest } = request;
+            request = { ...redirectedRequest, method: 'GET', headers: redirectedHeaders };
+        }
+    }
+    throw new Error('Redirect handling failed');
+}
+async function readBoundedBody(response) {
+    if (!response.body)
+        return Buffer.alloc(0);
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
     try {
-      const options = {
-        method: args.method || 'GET',
-        headers: {
-          'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/120.0.0.0 Safari/537.36',
-          ...args.headers
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_RESPONSE_BYTES) {
+                await reader.cancel(`Response exceeds ${MAX_RESPONSE_BYTES} bytes`).catch(() => { });
+                throw new Error(`Response exceeds ${MAX_RESPONSE_BYTES} bytes`);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks.map(chunk => Buffer.from(chunk)), size);
+}
+async function browserFallback(url) {
+    try {
+        const results = await causyneBrowser().run([{ type: 'goto', url }, { type: 'extract', selector: 'body' }]);
+        const output = results.find(result => result.action === 'extract')?.output;
+        return output ? { success: true, output } : { success: false, error: 'Browser loaded the page but extracted no readable content' };
+    }
+    catch (error) {
+        if (error instanceof BrowserCapabilityError) {
+            return { success: false, error: error.message, requiresConsent: error.requiresConsent };
+        }
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export const webFetch = {
+    schema: {
+        name: 'web.fetch',
+        description: 'Fetch a public HTTP(S) resource with redirect-by-redirect SSRF checks, bounded output, browser fallback for blocked HTML, and atomic workspace-scoped downloads.',
+        parameters: {
+            type: 'object',
+            properties: {
+                url: { type: 'string' },
+                method: { type: 'string', enum: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'] },
+                headers: { type: 'object', additionalProperties: { type: 'string' } },
+                body: { type: 'string' },
+                outputFile: { type: 'string', description: 'File destination inside the selected workspace.' }
+            },
+            required: ['url'],
+            additionalProperties: false
+        }
+    },
+    async execute(args) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+        try {
+            if (!args.url)
+                return { success: false, error: 'url is required' };
+            const method = (args.method ?? 'GET').toUpperCase();
+            const headers = {
+                'User-Agent': 'Causyne-Agent/1.10 (+https://causyne.com)',
+                Accept: 'text/html,application/xhtml+xml,application/json,text/plain,*/*;q=0.8',
+                ...validatedHeaders(args.headers)
+            };
+            const request = { method, headers, signal: controller.signal };
+            if (args.body !== undefined && method !== 'GET' && method !== 'HEAD')
+                request.body = args.body;
+            const { response, finalUrl } = await fetchFollowingSafeRedirects(args.url, request);
+            const contentType = response.headers.get('content-type')?.toLowerCase() ?? '';
+            if (!response.ok && !args.outputFile && contentType.includes('text/html') && [401, 403, 429, 503].includes(response.status)) {
+                const fallback = await browserFallback(finalUrl.href);
+                if (fallback.success)
+                    return { ...fallback, status: response.status, finalUrl: finalUrl.href, via: 'causyne-browser' };
+                return { success: false, error: `HTTP ${response.status}; browser fallback failed: ${fallback.error}`, requiresConsent: fallback.requiresConsent };
+            }
+            if (!response.ok)
+                return { success: false, error: `HTTP ${response.status} ${response.statusText}`.trim(), status: response.status, finalUrl: finalUrl.href };
+            const declaredLength = Number(response.headers.get('content-length') ?? '0');
+            if (Number.isFinite(declaredLength) && declaredLength > MAX_RESPONSE_BYTES) {
+                return { success: false, error: `Response exceeds ${MAX_RESPONSE_BYTES} bytes` };
+            }
+            const bytes = await readBoundedBody(response);
+            if (args.outputFile) {
+                const workspace = path.resolve(process.cwd());
+                const target = path.resolve(workspace, args.outputFile);
+                if (!isWithin(workspace, target))
+                    return { success: false, error: 'Download target must stay inside the selected workspace' };
+                const temporary = `${target}.part-${crypto.randomUUID()}`;
+                await fs.mkdir(path.dirname(target), { recursive: true });
+                try {
+                    await fs.writeFile(temporary, bytes, { mode: 0o600 });
+                    await fs.rename(temporary, target);
+                }
+                finally {
+                    await fs.unlink(temporary).catch(() => { });
+                }
+                return { success: true, output: `Downloaded ${bytes.length} bytes to ${target}`, status: response.status, finalUrl: finalUrl.href };
+            }
+            const decoded = bytes.toString('utf8');
+            const readable = contentType.includes('text/html') ? htmlToReadableText(decoded) : decoded;
+            const output = readable.length > MAX_OUTPUT_CHARS
+                ? `${readable.slice(0, MAX_OUTPUT_CHARS)}\n\n[Web output truncated at ${MAX_OUTPUT_CHARS} characters]`
+                : readable;
+            return { success: true, output, status: response.status, finalUrl: finalUrl.href, contentType };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const timedOut = error instanceof Error && (error.name === 'AbortError' || message === 'This operation was aborted');
+            return { success: false, error: timedOut ? `Request timed out after ${REQUEST_TIMEOUT_MS}ms` : message };
+        }
+        finally {
+            clearTimeout(timer);
         }
-      };
-      
-      if (args.body) options.body = args.body;
-      
-      const response = await fetch(args.url, options);
-      
-      if (args.outputFile) {
-        const target = args.outputFile.replace(/^~\//, os.homedir() + '/');
-        const buffer = await response.arrayBuffer();
-        await fs.writeFile(target, Buffer.from(buffer));
-        return { success: true, output: `Downloaded ${buffer.byteLength} bytes to ${args.outputFile}`, status: response.status };
-      }
-      
-      const text = await response.text();
-      
-      // Phase 3 AGI Upgrade: Clean HTML unless it's an API JSON response
-      let cleanOutput = text;
-      const contentType = response.headers.get('content-type') || '';
-      if (contentType.includes('text/html')) {
-        cleanOutput = htmlToText(text);
-      }
-      
-      // Strict Context Paging Protection
-      if (cleanOutput.length > 50000) {
-        cleanOutput = cleanOutput.substring(0, 50000) + '\n\n[... OUTPUT TRUNCATED TO 50KB ...]';
-      }
-
-      return { success: true, output: cleanOutput, status: response.status };
-    } catch (e) {
-      return { success: false, error: e.message };
     }
-  }
 };

package/src/tools/webFetch.ts

@@ -0,0 +1,185 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+import { BrowserCapabilityError, causyneBrowser } from '../browser/causyneBrowser.js';
+import { assertPublicWebUrl } from '../browser/urlPolicy.js';
+
+const MAX_REDIRECTS = 5;
+const MAX_RESPONSE_BYTES = 50 * 1024 * 1024;
+const MAX_OUTPUT_CHARS = 80_000;
+const REQUEST_TIMEOUT_MS = 30_000;
+
+function decodeEntities(text: string): string {
+  const named: Record<string, string> = { amp: '&', apos: "'", gt: '>', lt: '<', nbsp: ' ', quot: '"' };
+  return text.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (full, entity: string) => {
+    if (entity.startsWith('#x')) return String.fromCodePoint(Number.parseInt(entity.slice(2), 16));
+    if (entity.startsWith('#')) return String.fromCodePoint(Number.parseInt(entity.slice(1), 10));
+    return named[entity.toLowerCase()] ?? full;
+  });
+}
+
+export function htmlToReadableText(html: string): string {
+  return decodeEntities(String(html ?? ''))
+    .replace(/<(script|style|svg|noscript)\b[^>]*>[\s\S]*?<\/\1>/gi, ' ')
+    .replace(/<\s*br\s*\/?>/gi, '\n')
+    .replace(/<\/(p|div|article|section|li|h[1-6]|tr)>/gi, '\n')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/[ \t]+/g, ' ')
+    .replace(/ *\n */g, '\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+}
+
+function isWithin(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+function validatedHeaders(value: unknown): Record<string, string> {
+  if (value === undefined) return {};
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('headers must be an object');
+  const result: Record<string, string> = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (typeof item !== 'string' || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(key) || /[\r\n]/.test(item)) {
+      throw new Error('headers contain an invalid name or value');
+    }
+    result[key] = item;
+  }
+  return result;
+}
+
+async function fetchFollowingSafeRedirects(urlValue: string, options: RequestInit): Promise<{ response: Response; finalUrl: URL }> {
+  let url = await assertPublicWebUrl(urlValue);
+  let request = { ...options };
+  for (let redirect = 0; redirect <= MAX_REDIRECTS; redirect++) {
+    const response = await fetch(url, { ...request, redirect: 'manual' });
+    if (![301, 302, 303, 307, 308].includes(response.status)) return { response, finalUrl: url };
+    if (redirect === MAX_REDIRECTS) throw new Error(`Too many redirects (maximum ${MAX_REDIRECTS})`);
+    const location = response.headers.get('location');
+    if (!location) throw new Error(`HTTP ${response.status} redirect has no Location header`);
+    await response.body?.cancel().catch(() => {});
+    url = await assertPublicWebUrl(new URL(location, url).href);
+    if (response.status === 303 || ([301, 302].includes(response.status) && request.method === 'POST')) {
+      const redirectedHeaders = new Headers(request.headers);
+      redirectedHeaders.delete('content-length');
+      redirectedHeaders.delete('content-type');
+      const { body: _discardedBody, ...redirectedRequest } = request;
+      request = { ...redirectedRequest, method: 'GET', headers: redirectedHeaders };
+    }
+  }
+  throw new Error('Redirect handling failed');
+}
+
+async function readBoundedBody(response: Response): Promise<Buffer> {
+  if (!response.body) return Buffer.alloc(0);
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_RESPONSE_BYTES) {
+        await reader.cancel(`Response exceeds ${MAX_RESPONSE_BYTES} bytes`).catch(() => {});
+        throw new Error(`Response exceeds ${MAX_RESPONSE_BYTES} bytes`);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks.map(chunk => Buffer.from(chunk)), size);
+}
+
+async function browserFallback(url: string): Promise<{ success: boolean; output?: string; error?: string; requiresConsent?: boolean }> {
+  try {
+    const results = await causyneBrowser().run([{ type: 'goto', url }, { type: 'extract', selector: 'body' }]);
+    const output = results.find(result => result.action === 'extract')?.output;
+    return output ? { success: true, output } : { success: false, error: 'Browser loaded the page but extracted no readable content' };
+  } catch (error) {
+    if (error instanceof BrowserCapabilityError) {
+      return { success: false, error: error.message, requiresConsent: error.requiresConsent };
+    }
+    return { success: false, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+export const webFetch = {
+  schema: {
+    name: 'web.fetch',
+    description: 'Fetch a public HTTP(S) resource with redirect-by-redirect SSRF checks, bounded output, browser fallback for blocked HTML, and atomic workspace-scoped downloads.',
+    parameters: {
+      type: 'object',
+      properties: {
+        url: { type: 'string' },
+        method: { type: 'string', enum: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'] },
+        headers: { type: 'object', additionalProperties: { type: 'string' } },
+        body: { type: 'string' },
+        outputFile: { type: 'string', description: 'File destination inside the selected workspace.' }
+      },
+      required: ['url'],
+      additionalProperties: false
+    }
+  },
+
+  async execute(args: { url?: string; method?: string; headers?: unknown; body?: string; outputFile?: string }) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      if (!args.url) return { success: false, error: 'url is required' };
+      const method = (args.method ?? 'GET').toUpperCase();
+      const headers = {
+        'User-Agent': 'Causyne-Agent/1.10 (+https://causyne.com)',
+        Accept: 'text/html,application/xhtml+xml,application/json,text/plain,*/*;q=0.8',
+        ...validatedHeaders(args.headers)
+      };
+      const request: RequestInit = { method, headers, signal: controller.signal };
+      if (args.body !== undefined && method !== 'GET' && method !== 'HEAD') request.body = args.body;
+      const { response, finalUrl } = await fetchFollowingSafeRedirects(args.url, request);
+      const contentType = response.headers.get('content-type')?.toLowerCase() ?? '';
+
+      if (!response.ok && !args.outputFile && contentType.includes('text/html') && [401, 403, 429, 503].includes(response.status)) {
+        const fallback = await browserFallback(finalUrl.href);
+        if (fallback.success) return { ...fallback, status: response.status, finalUrl: finalUrl.href, via: 'causyne-browser' };
+        return { success: false, error: `HTTP ${response.status}; browser fallback failed: ${fallback.error}`, requiresConsent: fallback.requiresConsent };
+      }
+      if (!response.ok) return { success: false, error: `HTTP ${response.status} ${response.statusText}`.trim(), status: response.status, finalUrl: finalUrl.href };
+
+      const declaredLength = Number(response.headers.get('content-length') ?? '0');
+      if (Number.isFinite(declaredLength) && declaredLength > MAX_RESPONSE_BYTES) {
+        return { success: false, error: `Response exceeds ${MAX_RESPONSE_BYTES} bytes` };
+      }
+      const bytes = await readBoundedBody(response);
+
+      if (args.outputFile) {
+        const workspace = path.resolve(process.cwd());
+        const target = path.resolve(workspace, args.outputFile);
+        if (!isWithin(workspace, target)) return { success: false, error: 'Download target must stay inside the selected workspace' };
+        const temporary = `${target}.part-${crypto.randomUUID()}`;
+        await fs.mkdir(path.dirname(target), { recursive: true });
+        try {
+          await fs.writeFile(temporary, bytes, { mode: 0o600 });
+          await fs.rename(temporary, target);
+        } finally {
+          await fs.unlink(temporary).catch(() => {});
+        }
+        return { success: true, output: `Downloaded ${bytes.length} bytes to ${target}`, status: response.status, finalUrl: finalUrl.href };
+      }
+
+      const decoded = bytes.toString('utf8');
+      const readable = contentType.includes('text/html') ? htmlToReadableText(decoded) : decoded;
+      const output = readable.length > MAX_OUTPUT_CHARS
+        ? `${readable.slice(0, MAX_OUTPUT_CHARS)}\n\n[Web output truncated at ${MAX_OUTPUT_CHARS} characters]`
+        : readable;
+      return { success: true, output, status: response.status, finalUrl: finalUrl.href, contentType };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const timedOut = error instanceof Error && (error.name === 'AbortError' || message === 'This operation was aborted');
+      return { success: false, error: timedOut ? `Request timed out after ${REQUEST_TIMEOUT_MS}ms` : message };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};

package/src/tools/webSearch.js

@@ -1,82 +1,57 @@
+import { BrowserCapabilityError, causyneBrowser } from '../browser/causyneBrowser.js';
+import { searchPublicWeb } from '../browser/searchProviders.js';
+function renderResults(query, results) {
+    const lines = [`Search results for "${query}"`, ''];
+    for (const [index, result] of results.entries()) {
+        lines.push(`${index + 1}. ${result.title}`, `   URL: ${result.url}`);
+        if (result.snippet)
+            lines.push(`   ${result.snippet}`);
+        lines.push('');
+    }
+    lines.push(`Search engine used: ${results[0]?.engine ?? 'unknown'}`);
+    return lines.join('\n').trim();
+}
 export const webSearch = {
-  schema: {
-    name: 'web_search',
-    description: 'High-Precision SERP Router. Searches the web and extracts top organic results.',
-    parameters: {
-      type: 'object',
-      properties: {
-        query: {
-          type: 'string',
-          description: 'The search query.'
+    schema: {
+        name: 'web_search',
+        description: 'Search the public web through lightweight providers, with the optional Causyne Browser as a rendered-page fallback. No browser binary is downloaded automatically.',
+        parameters: {
+            type: 'object',
+            properties: {
+                query: { type: 'string', description: 'Search query, 1-1000 characters.' }
+            },
+            required: ['query'],
+            additionalProperties: false
         }
-      },
-      required: ['query']
-    }
-  },
-  
-  execute: async (args) => {
-    try {
-      // Phase 7 AGI Upgrade: Zero-Dependency Native Fetch Scraper
-      // Skipping Google's aggressive 429 Blocks by utilizing Yahoo Search HTML parsing.
-      const url = 'https://search.yahoo.com/search?p=' + encodeURIComponent(args.query);
-      
-      const response = await fetch(url, {
-        headers: {
-          'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36',
-          'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
-          'Accept-Language': 'en-US,en;q=0.5'
+    },
+    async execute(args) {
+        const query = String(args.query ?? '').trim();
+        if (!query || query.length > 1_000)
+            return { success: false, error: 'Search query must contain 1-1000 characters' };
+        let lightweightFailure = '';
+        try {
+            const results = await searchPublicWeb(query);
+            return { success: true, output: renderResults(query, results), results };
+        }
+        catch (error) {
+            lightweightFailure = error instanceof Error ? error.message : String(error);
         }
-      });
-      
-      if (!response.ok) {
-        throw new Error(`HTTP Error ${response.status}`);
-      }
-      
-      const html = await response.text();
-      const results = [];
-      
-      // Robust Regex to extract Yahoo organic results
-      const regex = /<div class=\"compTitle[^>]*>.*?<h3[^>]*>.*?<a[^>]*href=\"([^\"]+)\"[^>]*>(.*?)<\/a>.*?<\/h3>.*?<div class=\"compText[^>]*>(.*?)<\/div>/gs;
-      
-      let match;
-      while ((match = regex.exec(html)) !== null && results.length < 8) {
-        let link = match[1];
-        
-        // Yahoo heavily redirects via RU=..., decode it to get the raw clean URL
-        if (link.includes('RU=')) {
-          const ruMatch = link.match(/RU=([^/]+)\//);
-          if (ruMatch) link = decodeURIComponent(ruMatch[1]);
+        try {
+            const results = await causyneBrowser().search(query);
+            return { success: true, output: renderResults(query, results), results };
         }
-        
-        // Skip sponsored Bing/Yahoo Ads
-        if (link.includes('bing.com/aclick') || link.includes('yahoo.com/yhs/')) {
-          continue;
+        catch (error) {
+            if (error instanceof BrowserCapabilityError) {
+                return {
+                    success: false,
+                    error: `${lightweightFailure}; rendered browser fallback unavailable: ${error.message}`,
+                    requiresConsent: error.requiresConsent
+                };
+            }
+            return {
+                success: false,
+                error: `Web search failed after lightweight and rendered providers: ${lightweightFailure}; ${error instanceof Error ? error.message : String(error)}`
+            };
         }
-        
-        results.push({ 
-          url: link, 
-          title: match[2].replace(/<[^>]+>/g, '').trim(),
-          snippet: match[3].replace(/<[^>]+>/g, '').trim()
-        });
-      }
-      
-      if (results.length === 0) {
-        return { success: true, output: "No organic results found. Try using web.fetch on known direct domains." };
-      }
-      
-      let outputString = `🔍 SERP Results for "${args.query}":\n\n`;
-      outputString += `[TOP WEB RESULTS]\n`;
-      results.forEach((r, idx) => {
-        outputString += `${idx + 1}. ${r.title}\n   URL: ${r.url}\n   Snippet: ${r.snippet}\n\n`;
-      });
-      
-      return { success: true, output: outputString.trim() };
-      
-    } catch (error) {
-      return { 
-        success: false, 
-        error: `Search Engine Blocked Request: ${error.message}. Do NOT guess random API URLs. Instead, use the web_fetch tool directly on known sites (e.g. finance.yahoo.com, coinmarketcap.com, wikipedia.org).` 
-      };
     }
-  }
 };

package/src/tools/webSearch.ts

@@ -0,0 +1,56 @@
+import { BrowserCapabilityError, causyneBrowser } from '../browser/causyneBrowser.js';
+import { searchPublicWeb, type SearchResult } from '../browser/searchProviders.js';
+
+function renderResults(query: string, results: SearchResult[]): string {
+  const lines = [`Search results for "${query}"`, ''];
+  for (const [index, result] of results.entries()) {
+    lines.push(`${index + 1}. ${result.title}`, `   URL: ${result.url}`);
+    if (result.snippet) lines.push(`   ${result.snippet}`);
+    lines.push('');
+  }
+  lines.push(`Search engine used: ${results[0]?.engine ?? 'unknown'}`);
+  return lines.join('\n').trim();
+}
+
+export const webSearch = {
+  schema: {
+    name: 'web_search',
+    description: 'Search the public web through lightweight providers, with the optional Causyne Browser as a rendered-page fallback. No browser binary is downloaded automatically.',
+    parameters: {
+      type: 'object',
+      properties: {
+        query: { type: 'string', description: 'Search query, 1-1000 characters.' }
+      },
+      required: ['query'],
+      additionalProperties: false
+    }
+  },
+
+  async execute(args: { query?: string }) {
+    const query = String(args.query ?? '').trim();
+    if (!query || query.length > 1_000) return { success: false, error: 'Search query must contain 1-1000 characters' };
+    let lightweightFailure = '';
+    try {
+      const results = await searchPublicWeb(query);
+      return { success: true, output: renderResults(query, results), results };
+    } catch (error) {
+      lightweightFailure = error instanceof Error ? error.message : String(error);
+    }
+    try {
+      const results = await causyneBrowser().search(query);
+      return { success: true, output: renderResults(query, results), results };
+    } catch (error) {
+      if (error instanceof BrowserCapabilityError) {
+        return {
+          success: false,
+          error: `${lightweightFailure}; rendered browser fallback unavailable: ${error.message}`,
+          requiresConsent: error.requiresConsent
+        };
+      }
+      return {
+        success: false,
+        error: `Web search failed after lightweight and rendered providers: ${lightweightFailure}; ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  }
+};