@cruxy/cli 0.21.0 → 0.22.1

package/dist/approval/classify.js

@@ -62,7 +62,7 @@ function shellRequest(action, root) {
     // scope is the program token. Complex commands get `none` (approve-once only).
     const tokens = commandTokens(command);
     const scope = tokens
-        ? { kind: "shell-prefix", token: tokens[0] }
+        ? { kind: "shell-prefix", token: tokens[0], root }
         : { kind: "none" };
     return {
         action,
@@ -86,7 +86,9 @@ function testRequest(action, root) {
     return {
         action,
         tier: "destructive",
-        scope: command === "" ? { kind: "none" } : { kind: "shell-exact", command },
+        scope: command === ""
+            ? { kind: "none" }
+            : { kind: "shell-exact", command, root },
         summary: `run tests: ${command}`,
         targets: [],
         cwd: root,
@@ -150,7 +152,9 @@ function mcpRequest(action, root) {
     return {
         action,
         tier: "destructive",
-        scope: grantable ? { kind: "mcp-tool", server, tool } : { kind: "none" },
+        scope: grantable
+            ? { kind: "mcp-tool", server, tool, root }
+            : { kind: "none" },
         summary: `call MCP tool ${tool || "(unknown)"} on server ${server || "(unknown)"}`,
         targets: [],
         cwd: root,

package/dist/approval/policy.d.ts

@@ -20,6 +20,12 @@ export declare class SessionAllowlist {
  * ({@link commandTokens}) and its program token must equal the granted token —
  * so a `git` grant never matches `git push && rm -rf /`. File: every target must
  * resolve inside the granted subtree.
+ *
+ * Multi-repo (C.26): `shell-prefix`, `shell-exact`, and `mcp-tool` grants are
+ * additionally **bound to the root they were taken in** — the grant only covers a
+ * request whose `cwd` is the same root. So "allow `git` this session" in repo A
+ * never auto-approves `git` in repo B. `file-subtree` needs no such check: it is
+ * an absolute path, so a different root is already a different subtree.
  */
 export declare function scopeCovers(scope: Exclude<Scope, {
     kind: "none";

package/dist/approval/policy.js

@@ -30,28 +30,40 @@ export class SessionAllowlist {
  * ({@link commandTokens}) and its program token must equal the granted token —
  * so a `git` grant never matches `git push && rm -rf /`. File: every target must
  * resolve inside the granted subtree.
+ *
+ * Multi-repo (C.26): `shell-prefix`, `shell-exact`, and `mcp-tool` grants are
+ * additionally **bound to the root they were taken in** — the grant only covers a
+ * request whose `cwd` is the same root. So "allow `git` this session" in repo A
+ * never auto-approves `git` in repo B. `file-subtree` needs no such check: it is
+ * an absolute path, so a different root is already a different subtree.
  */
 export function scopeCovers(scope, request) {
     if (scope.kind === "shell-prefix") {
         if (request.action.kind !== "shell")
             return false;
+        if (scope.root !== request.cwd)
+            return false; // C.26: same root only
         const tokens = commandTokens(request.action.command ?? "");
         return tokens !== null && tokens[0] === scope.token;
     }
     if (scope.kind === "shell-exact") {
         // Test grants (C.13): the exact command string, test actions only — a
-        // grant for `pnpm test` can never cover run_command or any other command.
+        // grant for `pnpm test` can never cover run_command or any other command,
+        // and (C.26) never a test in a different root.
         return (request.action.kind === "test" &&
+            scope.root === request.cwd &&
             (request.action.command ?? "").trim() === scope.command);
     }
     if (scope.kind === "mcp-tool") {
         // MCP grants (C.27): the exact server+tool pair, mcp actions only — a grant
-        // for one server's tool can never cover another tool or another server.
+        // for one server's tool can never cover another tool, another server, or
+        // (C.26) the same tool invoked from a different root.
         return (request.action.kind === "mcp" &&
+            scope.root === request.cwd &&
             request.action.server === scope.server &&
             request.action.tool === scope.tool);
     }
-    // file-subtree
+    // file-subtree — absolute path, inherently root-scoped.
     return (request.targets.length > 0 &&
         request.targets.every((t) => isInside(scope.root, t)));
 }

package/dist/approval/types.d.ts

@@ -17,20 +17,26 @@ export type RiskTier = "read" | "mutate" | "destructive";
  * The tight scope a session grant is keyed by. Never blanket.
  * - `shell-prefix` — a command's leading program token (e.g. `git`); only ever
  *   matches commands we can *positively* prove are simple (no shell features).
+ *   **Bound to `root`** (C.26): a `git` grant in repo A never covers `git` in B.
  * - `shell-exact` — one exact command string, for `test` actions only (C.13):
  *   a grant covers re-runs of precisely that test command, nothing else.
+ *   **Bound to `root`**: a `pnpm test` grant in A never covers B.
  * - `file-subtree` — an absolute directory (or, under the root-cap, an exact
- *   file path); matches targets that resolve inside it.
+ *   file path); matches targets that resolve inside it. Inherently root-safe —
+ *   different roots are different absolute subtrees, so it needs no `root` field.
  * - `mcp-tool` — one exact MCP server+tool pair (C.27): a grant covers re-calls
  *   of precisely that tool on that server, and never any other MCP tool.
+ *   **Bound to `root`**: the same server+tool in another root still prompts.
  * - `none` — nothing safe to grant (e.g. a multi-file patch spanning the root).
  */
 export type Scope = {
     readonly kind: "shell-prefix";
     readonly token: string;
+    readonly root: string;
 } | {
     readonly kind: "shell-exact";
     readonly command: string;
+    readonly root: string;
 } | {
     readonly kind: "file-subtree";
     readonly root: string;
@@ -38,6 +44,7 @@ export type Scope = {
     readonly kind: "mcp-tool";
     readonly server: string;
     readonly tool: string;
+    readonly root: string;
 } | {
     readonly kind: "none";
 };

package/dist/checkpoint/index.d.ts

@@ -4,3 +4,4 @@ export * from "./git-store.js";
 export * from "./shadow-store.js";
 export * from "./restore.js";
 export * from "./service.js";
+export * from "./set.js";

package/dist/checkpoint/index.js

@@ -4,3 +4,4 @@ export * from "./git-store.js";
 export * from "./shadow-store.js";
 export * from "./restore.js";
 export * from "./service.js";
+export * from "./set.js";

package/dist/checkpoint/set.d.ts

@@ -0,0 +1,44 @@
+import type { CheckpointSet, RollbackApplied, SetRollbackApplied } from "./types.js";
+/**
+ * Multi-root rollback sets (C.26). A run that mutates N repos produces one
+ * per-root checkpoint plus a {@link CheckpointSet} that ties them together, so
+ * `cruxy rollback` restores exactly the touched roots as one gated operation.
+ *
+ * Two guarantees live here:
+ *   • **exactly the touched roots** — the applier iterates ONLY `set.members`, so
+ *     an untouched root (absent from the set) is never opened;
+ *   • **stop-and-report, never silent partial** (R3) — validate every member up
+ *     front (missing/corrupt → `CHECKPOINT_SET_INCOMPLETE`), then apply
+ *     sequentially and STOP on the first failure, throwing
+ *     `CHECKPOINT_SET_PARTIAL` with the exact restored-vs-not split.
+ */
+/** `run-<utc-stamp>-<rand>` — sortable, collision-safe enough for a local CLI. */
+export declare function newRunId(): string;
+/** The set-manifest directory under the PRIMARY root (⚖︎#7). */
+export declare function setDir(primaryRoot: string): string;
+/** Persist a set manifest (atomic temp-then-rename), self-ignoring from git. */
+export declare function writeSet(primaryRoot: string, set: CheckpointSet): Promise<void>;
+/** Read a set manifest, or throw `CHECKPOINT_SET_INCOMPLETE` if missing/corrupt. */
+export declare function readSet(primaryRoot: string, runId: string): Promise<CheckpointSet>;
+/** List all set manifests under the primary root, newest first. */
+export declare function listSets(primaryRoot: string): Promise<CheckpointSet[]>;
+/**
+ * One root's rollback, pre-validated (its plan already computed): `restore`
+ * actually applies it. The orchestrator builds one per member.
+ */
+export interface MemberRollback {
+    rootName: string;
+    restore: () => Promise<RollbackApplied>;
+}
+/**
+ * Apply an all-roots rollback: run each member's `restore` in order and STOP on
+ * the first failure (R3). On success, returns the restored-vs-per-root summary.
+ * On failure, throws `CHECKPOINT_SET_PARTIAL` naming the roots restored (before
+ * the failure) and those not restored (the failing one + all not-yet-attempted)
+ * — so a partial rollback can never be reported as success, and re-running (which
+ * recomputes each root from disk) safely finishes the job.
+ *
+ * The applier only ever touches roots present in `rollbacks`; an untouched root
+ * (never added to the set) is structurally impossible to open here.
+ */
+export declare function applySetRollback(runId: string, rollbacks: readonly MemberRollback[]): Promise<SetRollbackApplied>;

package/dist/checkpoint/set.js

@@ -0,0 +1,142 @@
+import { randomBytes } from "node:crypto";
+import { promises as fsp } from "node:fs";
+import path from "node:path";
+import { checkpointSetIncomplete, checkpointSetPartial, } from "../errors/index.js";
+/**
+ * Multi-root rollback sets (C.26). A run that mutates N repos produces one
+ * per-root checkpoint plus a {@link CheckpointSet} that ties them together, so
+ * `cruxy rollback` restores exactly the touched roots as one gated operation.
+ *
+ * Two guarantees live here:
+ *   • **exactly the touched roots** — the applier iterates ONLY `set.members`, so
+ *     an untouched root (absent from the set) is never opened;
+ *   • **stop-and-report, never silent partial** (R3) — validate every member up
+ *     front (missing/corrupt → `CHECKPOINT_SET_INCOMPLETE`), then apply
+ *     sequentially and STOP on the first failure, throwing
+ *     `CHECKPOINT_SET_PARTIAL` with the exact restored-vs-not split.
+ */
+/** `run-<utc-stamp>-<rand>` — sortable, collision-safe enough for a local CLI. */
+export function newRunId() {
+    const stamp = new Date()
+        .toISOString()
+        .replace(/[-:]/g, "")
+        .replace(/\..+$/, "");
+    return `run-${stamp}-${randomBytes(2).toString("hex")}`;
+}
+/** The set-manifest directory under the PRIMARY root (⚖︎#7). */
+export function setDir(primaryRoot) {
+    return path.join(primaryRoot, ".cruxy", "checkpoints", "sets");
+}
+/** Persist a set manifest (atomic temp-then-rename), self-ignoring from git. */
+export async function writeSet(primaryRoot, set) {
+    const dir = setDir(primaryRoot);
+    await fsp.mkdir(dir, { recursive: true });
+    // The parent checkpoints/ dir already carries a `*` .gitignore; add one here
+    // too so a set manifest is never seen by git even if the layout changes.
+    const ignoreFile = path.join(dir, ".gitignore");
+    try {
+        await fsp.access(ignoreFile);
+    }
+    catch {
+        await fsp.writeFile(ignoreFile, "*\n");
+    }
+    const file = path.join(dir, `${set.runId}.json`);
+    const tmp = `${file}.tmp-${process.pid}`;
+    await fsp.writeFile(tmp, `${JSON.stringify(set, null, 2)}\n`);
+    await fsp.rename(tmp, file);
+}
+/** Read a set manifest, or throw `CHECKPOINT_SET_INCOMPLETE` if missing/corrupt. */
+export async function readSet(primaryRoot, runId) {
+    const file = path.join(setDir(primaryRoot), `${runId}.json`);
+    let raw;
+    try {
+        raw = await fsp.readFile(file, "utf8");
+    }
+    catch {
+        throw checkpointSetIncomplete(runId, `the set manifest is missing or unreadable (${file})`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw checkpointSetIncomplete(runId, "the set manifest is not valid JSON");
+    }
+    if (!isSetShape(parsed)) {
+        throw checkpointSetIncomplete(runId, "the set manifest is malformed");
+    }
+    return parsed;
+}
+/** List all set manifests under the primary root, newest first. */
+export async function listSets(primaryRoot) {
+    const dir = setDir(primaryRoot);
+    let names;
+    try {
+        names = await fsp.readdir(dir);
+    }
+    catch {
+        return [];
+    }
+    const sets = [];
+    for (const name of names) {
+        if (!name.endsWith(".json"))
+            continue;
+        try {
+            const parsed = JSON.parse(await fsp.readFile(path.join(dir, name), "utf8"));
+            if (isSetShape(parsed))
+                sets.push(parsed);
+        }
+        catch {
+            // A corrupt individual manifest is skipped in a listing (it fails loud
+            // only when that specific run is rolled back).
+        }
+    }
+    return sets.sort((a, b) => b.runId.localeCompare(a.runId));
+}
+/**
+ * Apply an all-roots rollback: run each member's `restore` in order and STOP on
+ * the first failure (R3). On success, returns the restored-vs-per-root summary.
+ * On failure, throws `CHECKPOINT_SET_PARTIAL` naming the roots restored (before
+ * the failure) and those not restored (the failing one + all not-yet-attempted)
+ * — so a partial rollback can never be reported as success, and re-running (which
+ * recomputes each root from disk) safely finishes the job.
+ *
+ * The applier only ever touches roots present in `rollbacks`; an untouched root
+ * (never added to the set) is structurally impossible to open here.
+ */
+export async function applySetRollback(runId, rollbacks) {
+    const restored = [];
+    const perRoot = {};
+    for (let i = 0; i < rollbacks.length; i++) {
+        const { rootName, restore } = rollbacks[i];
+        try {
+            perRoot[rootName] = await restore();
+            restored.push(rootName);
+        }
+        catch (err) {
+            const notRestored = rollbacks.slice(i).map((r) => r.rootName);
+            throw checkpointSetPartial(runId, restored, notRestored, err);
+        }
+    }
+    return { runId, restored, perRoot };
+}
+/** Structural check for a parsed set manifest — enough to fail loud on corruption. */
+function isSetShape(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    if (typeof v.runId !== "string" ||
+        typeof v.createdAt !== "string" ||
+        typeof v.runSummary !== "string" ||
+        !Array.isArray(v.members)) {
+        return false;
+    }
+    return v.members.every((m) => {
+        if (typeof m !== "object" || m === null)
+            return false;
+        const mm = m;
+        return (typeof mm.rootName === "string" &&
+            typeof mm.rootPath === "string" &&
+            typeof mm.checkpointId === "string");
+    });
+}

package/dist/checkpoint/types.d.ts

@@ -115,3 +115,50 @@ export interface RollbackApplied {
     reverted: number;
     deleted: number;
 }
+/**
+ * One touched root inside a {@link CheckpointSet}: the declared root's name (for
+ * attribution in the preview), its absolute path, and the id of the per-root
+ * checkpoint that protects it. There is exactly ONE member per root the run
+ * mutated — an untouched root has no member and is never opened at rollback.
+ */
+export interface CheckpointSetMember {
+    /** Declared workspace-root name (shown in the grouped preview). */
+    rootName: string;
+    /** Absolute path of the root (where its `.cruxy/checkpoints/` live). */
+    rootPath: string;
+    /** The checkpoint id within that root. */
+    checkpointId: string;
+}
+/**
+ * A run's rollback unit across N repos (C.26). `cruxy rollback` restores **all
+ * members** of a set as one gated operation — exactly the roots the run touched,
+ * no more (untouched roots are absent) and no less (a touched root missing its
+ * member is a loud `CRUXY_E_CHECKPOINT_SET_INCOMPLETE`, never a silent partial).
+ *
+ * The set manifest lives under the PRIMARY root's `.cruxy/checkpoints/sets/`, so
+ * it travels with the workspace and survives `rm -rf ~/.cruxy`. The member
+ * checkpoints themselves live in each root, exactly as in the single-root case.
+ */
+export interface CheckpointSet {
+    /** Stable run id, e.g. `run-20260708T031500-a4f2`. */
+    runId: string;
+    /** ISO-8601 creation time (of the set, i.e. the run's first mutation). */
+    createdAt: string;
+    /** One line describing the run this set protects. */
+    runSummary: string;
+    /** One entry per TOUCHED root. */
+    members: CheckpointSetMember[];
+}
+/**
+ * The outcome of a successful all-roots rollback: which roots were restored and
+ * what each did. On a mid-apply failure this is NOT returned — a
+ * `CRUXY_E_CHECKPOINT_SET_PARTIAL` is thrown instead, carrying the restored-vs-not
+ * split (R3), so a partial can never read as success.
+ */
+export interface SetRollbackApplied {
+    runId: string;
+    /** Root names restored, in apply order. */
+    restored: string[];
+    /** Per-root counts, keyed by root name. */
+    perRoot: Record<string, RollbackApplied>;
+}

package/dist/cli/session-factory.js

@@ -10,6 +10,7 @@ import { PlanExecutionPolicy, runPlanSession } from "../plan/index.js";
 import { routerForConfig } from "../routing/index.js";
 import { MemoryService, rememberTool } from "../memory/index.js";
 import { findDefinitionTool, findReferencesTool, getDiagnosticsTool, hoverTool, } from "../lsp/index.js";
+import { createWebSearchTool, createWebFetchTool } from "../web/index.js";
 import { appendRun } from "../usage/index.js";
 import { SubagentOrchestrator, makeSpawnSubagentTool, } from "../subagent/index.js";
 /**
@@ -148,6 +149,16 @@ export function buildAgentSession(config, apiKey, cwd, ttyInteractive, planMode
         execRegistry.register(getDiagnosticsTool);
         execRegistry.register(hoverTool);
     }
+    // Web search + fetch (C.20): register the two read-only web tools only when
+    // enabled. They reach the PUBLIC internet and inject attacker-controllable data
+    // (results/pages are demarcated as untrusted and never persisted), so — like
+    // LSP and MCP — the feature is opt-in; when off, neither tool is registered and
+    // no search provider is ever constructed. Read-only (no approval), so they
+    // bypass the U.3 gate like search_codebase.
+    if (config.web.enabled) {
+        execRegistry.register(createWebSearchTool());
+        execRegistry.register(createWebFetchTool());
+    }
     // MCP servers (C.27): the caller connected + trusted the servers and produced
     // these tools through the single adapter seam BEFORE building the session, so
     // registration here is a plain hand-off — every one is destructive-gated,

package/dist/config/schema.d.ts

@@ -44,15 +44,12 @@ export declare const AgentConfigSchema: z.ZodObject<{
 export declare const ToolsConfigSchema: z.ZodObject<{
     fileEdit: z.ZodDefault<z.ZodBoolean>;
     shell: z.ZodDefault<z.ZodBoolean>;
-    webSearch: z.ZodDefault<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
     fileEdit: boolean;
     shell: boolean;
-    webSearch: boolean;
 }, {
     fileEdit?: boolean | undefined;
     shell?: boolean | undefined;
-    webSearch?: boolean | undefined;
 }>;
 export declare const GitConfigSchema: z.ZodObject<{
     autoCommit: z.ZodDefault<z.ZodBoolean>;
@@ -722,6 +719,69 @@ export declare const McpConfigSchema: z.ZodObject<{
     maxSchemaBytes?: number | undefined;
 }>;
 export type McpConfig = z.infer<typeof McpConfigSchema>;
+/**
+ * Web-search + web-fetch subtool (C.20). OFF by default. When enabled, the agent
+ * gets a bounded `web_search` (query → ranked title/url/snippet) and a `web_fetch`
+ * (read one URL as text). Both surface EXTERNAL, attacker-controllable data:
+ * results and fetched pages are wrapped as untrusted data (do-not-follow-instructions
+ * envelope, fence-forgery neutralized) with upstream model names scrubbed, and
+ * are NEVER persisted to memory/index/checkpoint. `web_fetch` refuses non-http(s)
+ * schemes and any host that resolves into a private/loopback/link-local range
+ * (SSRF guard) — the request is never dispatched. No provider is constructed and
+ * no tool is registered while this is off. Search runs through a swappable
+ * `SearchProvider` seam; the direct provider's API key comes from the environment
+ * (`apiKeyEnv`), never from config-in-repo and never logged.
+ */
+export declare const WebConfigSchema: z.ZodObject<{
+    /** Master switch. When false, neither tool is registered and no provider is
+     * constructed (the feature stays fully inert). */
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Which search backend to use behind the `SearchProvider` seam. A gateway
+     * provider slots in here first-class if the backend ever proxies search. */
+    provider: z.ZodDefault<z.ZodEnum<["tavily"]>>;
+    /** Environment variable holding the direct provider's API key. The key is
+     * read at call time, sent only in the provider's auth field, and never
+     * logged or written to the repo. */
+    apiKeyEnv: z.ZodDefault<z.ZodString>;
+    /** Max search results returned to the model (top-N; the rest are dropped). */
+    maxResults: z.ZodDefault<z.ZodNumber>;
+    /** Max characters kept from a single result's snippet; the rest is truncated
+     * with a visible marker. */
+    snippetMaxChars: z.ZodDefault<z.ZodNumber>;
+    /** Max bytes read from a single `web_fetch` page; the rest is truncated with
+     * a visible marker (a hostile/huge page can't blow the context budget). */
+    fetchMaxBytes: z.ZodDefault<z.ZodNumber>;
+    /** Per-request timeout (search and fetch) — a slow host errors, never hangs. */
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+    /** Max HTTP redirects `web_fetch` follows; each hop is re-checked by the SSRF
+     * guard so a 3xx can't bounce the request into a private range. */
+    maxRedirects: z.ZodDefault<z.ZodNumber>;
+    /** Escape hatch: allow `web_fetch` to reach private/loopback/link-local hosts.
+     * OFF by default (SSRF-safe); only set true for a deliberate internal-network
+     * use case. */
+    allowPrivateHosts: z.ZodDefault<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    provider: "tavily";
+    timeoutMs: number;
+    apiKeyEnv: string;
+    enabled: boolean;
+    maxResults: number;
+    snippetMaxChars: number;
+    fetchMaxBytes: number;
+    maxRedirects: number;
+    allowPrivateHosts: boolean;
+}, {
+    provider?: "tavily" | undefined;
+    timeoutMs?: number | undefined;
+    apiKeyEnv?: string | undefined;
+    enabled?: boolean | undefined;
+    maxResults?: number | undefined;
+    snippetMaxChars?: number | undefined;
+    fetchMaxBytes?: number | undefined;
+    maxRedirects?: number | undefined;
+    allowPrivateHosts?: boolean | undefined;
+}>;
+export type WebConfig = z.infer<typeof WebConfigSchema>;
 export declare const CruxyConfigSchema: z.ZodObject<{
     model: z.ZodDefault<z.ZodObject<{
         provider: z.ZodDefault<z.ZodEnum<["cruxy", "anthropic", "openai", "custom"]>>;
@@ -765,15 +825,12 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     tools: z.ZodDefault<z.ZodObject<{
         fileEdit: z.ZodDefault<z.ZodBoolean>;
         shell: z.ZodDefault<z.ZodBoolean>;
-        webSearch: z.ZodDefault<z.ZodBoolean>;
     }, "strict", z.ZodTypeAny, {
         fileEdit: boolean;
         shell: boolean;
-        webSearch: boolean;
     }, {
         fileEdit?: boolean | undefined;
         shell?: boolean | undefined;
-        webSearch?: boolean | undefined;
     }>>;
     git: z.ZodDefault<z.ZodObject<{
         autoCommit: z.ZodDefault<z.ZodBoolean>;
@@ -1297,6 +1354,55 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         maxDescriptionChars?: number | undefined;
         maxSchemaBytes?: number | undefined;
     }>>;
+    web: z.ZodDefault<z.ZodObject<{
+        /** Master switch. When false, neither tool is registered and no provider is
+         * constructed (the feature stays fully inert). */
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Which search backend to use behind the `SearchProvider` seam. A gateway
+         * provider slots in here first-class if the backend ever proxies search. */
+        provider: z.ZodDefault<z.ZodEnum<["tavily"]>>;
+        /** Environment variable holding the direct provider's API key. The key is
+         * read at call time, sent only in the provider's auth field, and never
+         * logged or written to the repo. */
+        apiKeyEnv: z.ZodDefault<z.ZodString>;
+        /** Max search results returned to the model (top-N; the rest are dropped). */
+        maxResults: z.ZodDefault<z.ZodNumber>;
+        /** Max characters kept from a single result's snippet; the rest is truncated
+         * with a visible marker. */
+        snippetMaxChars: z.ZodDefault<z.ZodNumber>;
+        /** Max bytes read from a single `web_fetch` page; the rest is truncated with
+         * a visible marker (a hostile/huge page can't blow the context budget). */
+        fetchMaxBytes: z.ZodDefault<z.ZodNumber>;
+        /** Per-request timeout (search and fetch) — a slow host errors, never hangs. */
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        /** Max HTTP redirects `web_fetch` follows; each hop is re-checked by the SSRF
+         * guard so a 3xx can't bounce the request into a private range. */
+        maxRedirects: z.ZodDefault<z.ZodNumber>;
+        /** Escape hatch: allow `web_fetch` to reach private/loopback/link-local hosts.
+         * OFF by default (SSRF-safe); only set true for a deliberate internal-network
+         * use case. */
+        allowPrivateHosts: z.ZodDefault<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        provider: "tavily";
+        timeoutMs: number;
+        apiKeyEnv: string;
+        enabled: boolean;
+        maxResults: number;
+        snippetMaxChars: number;
+        fetchMaxBytes: number;
+        maxRedirects: number;
+        allowPrivateHosts: boolean;
+    }, {
+        provider?: "tavily" | undefined;
+        timeoutMs?: number | undefined;
+        apiKeyEnv?: string | undefined;
+        enabled?: boolean | undefined;
+        maxResults?: number | undefined;
+        snippetMaxChars?: number | undefined;
+        fetchMaxBytes?: number | undefined;
+        maxRedirects?: number | undefined;
+        allowPrivateHosts?: boolean | undefined;
+    }>>;
     logLevel: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error", "silent"]>>;
 }, "strict", z.ZodTypeAny, {
     cruxy: {
@@ -1368,7 +1474,6 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     tools: {
         fileEdit: boolean;
         shell: boolean;
-        webSearch: boolean;
     };
     git: {
         autoCommit: boolean;
@@ -1431,6 +1536,17 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         maxDescriptionChars: number;
         maxSchemaBytes: number;
     };
+    web: {
+        provider: "tavily";
+        timeoutMs: number;
+        apiKeyEnv: string;
+        enabled: boolean;
+        maxResults: number;
+        snippetMaxChars: number;
+        fetchMaxBytes: number;
+        maxRedirects: number;
+        allowPrivateHosts: boolean;
+    };
     logLevel: "debug" | "info" | "warn" | "error" | "silent";
 }, {
     cruxy?: {
@@ -1502,7 +1618,6 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     tools?: {
         fileEdit?: boolean | undefined;
         shell?: boolean | undefined;
-        webSearch?: boolean | undefined;
     } | undefined;
     git?: {
         autoCommit?: boolean | undefined;
@@ -1565,6 +1680,17 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         maxDescriptionChars?: number | undefined;
         maxSchemaBytes?: number | undefined;
     } | undefined;
+    web?: {
+        provider?: "tavily" | undefined;
+        timeoutMs?: number | undefined;
+        apiKeyEnv?: string | undefined;
+        enabled?: boolean | undefined;
+        maxResults?: number | undefined;
+        snippetMaxChars?: number | undefined;
+        fetchMaxBytes?: number | undefined;
+        maxRedirects?: number | undefined;
+        allowPrivateHosts?: boolean | undefined;
+    } | undefined;
     logLevel?: "debug" | "info" | "warn" | "error" | "silent" | undefined;
 }>;
 export type CruxyConfig = z.infer<typeof CruxyConfigSchema>;