@demigodmode/pi-web-agent 1.4.0 → 1.5.1

package/CHANGELOG.md

@@ -7,13 +7,43 @@ The format is intentionally simple and release-oriented.
 ## Unreleased
 
 ### Added
-- Nothing yet.
+- None.
+
+### Changed
+- None.
+
+### Fixed
+- None.
+
+### Breaking
+- None.
+
+## [1.5.1] - 2026-06-22
+### Added
+- None.
+
+### Changed
+- None.
+
+### Fixed
+- Updated vulnerable dependency paths reported by `npm audit`, including Vitest, Pi dev tooling, `undici`, `ws`, `protobufjs`, `postcss`, and the Vite docs toolchain override.
+
+### Breaking
+- None.
+
+## [1.5.0] - 2026-06-16
+### Added
+- Added Brave Search as the first hosted search backend for `web_explore`, giving users a high-quality API-backed discovery option without running their own SearXNG instance.
+- Added optional Brave → DuckDuckGo fallback so hosted search can degrade gracefully instead of failing hard when the Brave API is unavailable or misconfigured.
+- Added a dedicated Brave search adapter that feeds the existing `web_explore` research pipeline, so Brave improves source discovery while the package still handles fetching, ranking, evidence quality, synthesis, and caveats.
 
 ### Changed
-- Nothing yet.
+- `/web-agent settings` now treats Brave as a first-class search backend while keeping API keys out of config files; users configure `PI_WEB_AGENT_BRAVE_API_KEY` in their environment instead.
+- `/web-agent doctor` now reports Brave setup status, warns when `PI_WEB_AGENT_BRAVE_API_KEY` is missing, and validates configured Brave access when a key is present.
+- Backend config validation and fallback metadata now understand Brave, including clear `fallbackFrom: 'brave'` reporting when DuckDuckGo fallback is used.
 
 ### Fixed
-- Nothing yet.
+- None.
 
 ### Breaking
 - None.
@@ -27,7 +57,7 @@ The format is intentionally simple and release-oriented.
 - Partial research caveats are now more specific when evidence is community-only, low-diversity, blocked, or cautionary.
 
 ### Fixed
-- Nothing yet.
+- None.
 
 ### Breaking
 - None.
@@ -54,10 +84,10 @@ The format is intentionally simple and release-oriented.
 - Added interactive URL prompts for SearXNG and Firecrawl backend setup.
 
 ### Changed
-- Nothing yet.
+- None.
 
 ### Fixed
-- Nothing yet.
+- None.
 
 ### Breaking
 - None.
@@ -72,7 +102,7 @@ The format is intentionally simple and release-oriented.
 - `/web-agent show` and `/web-agent doctor` now report configured backend fallback/options.
 
 ### Fixed
-- Nothing yet.
+- None.
 
 ### Breaking
 - None.
@@ -85,7 +115,7 @@ The format is intentionally simple and release-oriented.
 - Migrated Pi package imports to `@earendil-works/*` after the upstream Pi scope move.
 
 ### Fixed
-- Nothing yet.
+- None.
 
 ### Breaking
 - This release requires Pi 0.74+. Users on older Pi versions should stay on `@demigodmode/pi-web-agent@0.6.x` until they update Pi.
@@ -109,10 +139,10 @@ The format is intentionally simple and release-oriented.
 
 ## [0.5.1] - 2026-05-04
 ### Added
-- Nothing yet.
+- None.
 
 ### Changed
-- Nothing yet.
+- None.
 
 ### Fixed
 - Fixed the Windows browser-resolution test so it is deterministic on Linux CI.
@@ -157,7 +187,7 @@ The format is intentionally simple and release-oriented.
 
 ## [0.3.1] - 2026-04-22
 ### Added
-- Nothing yet.
+- None.
 
 ### Changed
 - Stopped self-upgrading npm inside the publish workflow before install and publish steps.
@@ -205,10 +235,10 @@ The format is intentionally simple and release-oriented.
 
 ## [0.2.1] - 2026-04-20
 ### Added
-- Nothing yet.
+- None.
 
 ### Changed
-- Nothing yet.
+- None.
 
 ### Fixed
 - Added the missing npm `--provenance` flag to the publish workflow so Trusted Publishing can exchange the GitHub OIDC token correctly.

package/README.md

@@ -8,9 +8,9 @@
 
 Most agent web tools blur search, fetch, browser rendering, and research into one vague thing. `pi-web-agent` exposes one public research tool, `web_explore`, and keeps search/fetch/headless work inside that bounded workflow.
 
-The point is keeping the model-facing boundary simple: ask `web_explore` to research a question, and it handles direct links, discovery, HTTP reads, targeted browser rendering, source ranking, and caveats internally.
+The point is keeping the model-facing boundary simple: ask `web_explore` to research a question, and it handles direct links, discovery, HTTP reads, targeted browser rendering, source ranking, source-quality checks, and caveats internally.
 
-That sounds obvious, but a lot of agent tooling gets fuzzy right there. This package is meant to be stricter about what it actually did and more willing to say when a read was not good enough to trust.
+That sounds obvious, but a lot of agent tooling gets fuzzy right there. This package is meant to be stricter about what it actually did and more willing to say when a read was not good enough to trust. Bot-check pages, narrow source sets, unreadable threads, and cautionary/conflicting evidence should show up as caveats instead of fake confidence.
 
 ## Install
 
@@ -109,7 +109,7 @@ Example:
 }
 ```
 
-Backend config is also supported. Defaults remain DuckDuckGo search, plain HTTP fetch, and local-browser headless fallback with managed Chromium fallback configured.
+Backend config is also supported. Defaults remain DuckDuckGo search, plain HTTP fetch, and local-browser headless fallback with managed Chromium fallback configured. If you have a Brave Search API key, Brave can be selected as a hosted search backend while `web_explore` still handles page reading, ranking, and caveats itself.
 
 Backend settings can be changed from:
 
@@ -117,9 +117,9 @@ Backend settings can be changed from:
 /web-agent settings
 ```
 
-Choose **Backends** to edit search/fetch providers, fallback behavior, and SearXNG or Firecrawl base URLs interactively. Firecrawl API keys should stay in environment variables rather than being written into config files.
+Choose **Backends** to edit search/fetch providers, fallback behavior, and SearXNG or Firecrawl base URLs interactively. Brave Search uses `PI_WEB_AGENT_BRAVE_API_KEY`. Firecrawl API keys should also stay in environment variables rather than being written into config files.
 
-If you already run SearXNG or Firecrawl, see the self-hosted backend guide:
+For the full backend config shape, including SearXNG, Brave, Firecrawl, and fallback behavior, see:
 
 - https://demigodmode.github.io/pi-web-agent/self-hosted-backends
 

package/dist/backends/config.d.ts

@@ -8,7 +8,7 @@ export type FirecrawlOptions = {
     onlyMainContent?: boolean;
 };
 export type SearchBackendConfig = {
-    provider: 'duckduckgo' | 'searxng';
+    provider: 'duckduckgo' | 'searxng' | 'brave';
     baseUrl?: string;
     fallback?: 'duckduckgo';
     options?: SearxngOptions;

package/dist/backends/config.js

@@ -38,17 +38,21 @@ function extractFirecrawlOptions(value) {
 export function extractBackendConfigOverride(file) {
     const backends = file?.backends;
     const override = {};
-    if (backends?.search?.provider === 'duckduckgo' || backends?.search?.provider === 'searxng') {
+    if (backends?.search?.provider === 'duckduckgo' ||
+        backends?.search?.provider === 'searxng' ||
+        backends?.search?.provider === 'brave') {
         override.search = { provider: backends.search.provider };
-        if (typeof backends.search.baseUrl === 'string') {
+        if (backends.search.provider === 'searxng' && typeof backends.search.baseUrl === 'string') {
             override.search.baseUrl = backends.search.baseUrl;
         }
         if (backends.search.fallback === 'duckduckgo') {
             override.search.fallback = 'duckduckgo';
         }
-        const options = extractSearxngOptions(backends.search.options);
-        if (options) {
-            override.search.options = options;
+        if (backends.search.provider === 'searxng') {
+            const options = extractSearxngOptions(backends.search.options);
+            if (options) {
+                override.search.options = options;
+            }
         }
     }
     if (backends?.fetch?.provider === 'http' || backends?.fetch?.provider === 'firecrawl') {
@@ -80,8 +84,8 @@ export function validateBackendConfig(config) {
     if (config.fetch.provider === 'firecrawl' && !config.fetch.baseUrl) {
         issues.push('fetch provider firecrawl requires backends.fetch.baseUrl');
     }
-    if (config.search.fallback === 'duckduckgo' && config.search.provider !== 'searxng') {
-        issues.push('search fallback duckduckgo is only supported when search provider is searxng');
+    if (config.search.fallback === 'duckduckgo' && config.search.provider !== 'searxng' && config.search.provider !== 'brave') {
+        issues.push('search fallback duckduckgo is only supported when search provider is searxng or brave');
     }
     if (config.fetch.fallback === 'http' && config.fetch.provider !== 'firecrawl') {
         issues.push('fetch fallback http is only supported when fetch provider is firecrawl');

package/dist/backends/doctor.js

@@ -6,6 +6,12 @@ function withTimeout(timeoutMs) {
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }
+function braveDoctorUrl() {
+    const url = new URL('https://api.search.brave.com/res/v1/web/search');
+    url.searchParams.set('q', 'pi-web-agent-doctor');
+    url.searchParams.set('count', '1');
+    return url.toString();
+}
 function searxngDoctorUrl(baseUrl, options = {}) {
     const url = new URL('/search', baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`);
     url.searchParams.set('q', 'pi-web-agent-doctor');
@@ -30,6 +36,39 @@ export async function checkBackendHealth(config, { fetchImpl = fetch, timeoutMs
     if (config.search.provider === 'duckduckgo') {
         lines.push('search backend: duckduckgo');
     }
+    else if (config.search.provider === 'brave') {
+        const apiKey = process.env.PI_WEB_AGENT_BRAVE_API_KEY;
+        if (!apiKey?.trim()) {
+            lines.push('search backend: brave warning (missing PI_WEB_AGENT_BRAVE_API_KEY)');
+        }
+        else {
+            const timeout = withTimeout(timeoutMs);
+            try {
+                const response = await fetchImpl(braveDoctorUrl(), {
+                    headers: {
+                        Accept: 'application/json',
+                        'X-Subscription-Token': apiKey
+                    },
+                    signal: timeout.signal
+                });
+                if (!response.ok) {
+                    lines.push(`search backend: brave warning (HTTP ${response.status})`);
+                }
+                else {
+                    const json = (await response.json());
+                    lines.push(Array.isArray(json.web?.results)
+                        ? 'search backend: brave ok'
+                        : 'search backend: brave warning (unexpected response)');
+                }
+            }
+            catch (error) {
+                lines.push(`search backend: brave warning (${message(error)})`);
+            }
+            finally {
+                timeout.done();
+            }
+        }
+    }
     else if (!config.search.baseUrl) {
         lines.push('search backend: searxng warning (missing baseUrl)');
     }

package/dist/backends/factory.d.ts

@@ -1,4 +1,5 @@
 import { createFirecrawlFetcher } from '../fetch/firecrawl-fetch.js';
+import { createBraveSearchTool } from '../search/brave.js';
 import { createSearxngSearchTool } from '../search/searxng.js';
 import { createWebFetchHeadlessTool } from '../tools/web-fetch-headless.js';
 import { createWebFetchTool } from '../tools/web-fetch.js';
@@ -19,6 +20,7 @@ export type BackendSet = {
 export type BackendFactoryDeps = {
     createDuckDuckGoSearch?: typeof createWebSearchTool;
     createSearxngSearch?: typeof createSearxngSearchTool;
+    createBraveSearch?: typeof createBraveSearchTool;
     createHttpFetch?: typeof createWebFetchTool;
     createFirecrawlFetch?: typeof createFirecrawlFetcher;
     createHeadlessFetch?: typeof createWebFetchHeadlessTool;

package/dist/backends/factory.js

@@ -1,4 +1,5 @@
 import { createFirecrawlFetcher } from '../fetch/firecrawl-fetch.js';
+import { createBraveSearchTool } from '../search/brave.js';
 import { createSearxngSearchTool } from '../search/searxng.js';
 import { buildFetchPresentation } from '../presentation/fetch-presentation.js';
 import { buildSearchPresentation } from '../presentation/search-presentation.js';
@@ -34,7 +35,7 @@ function invalidFirecrawlFetch() {
         return { ...result, presentation: buildFetchPresentation(result) };
     };
 }
-function withSearchFallback(primary, fallback) {
+function withSearchFallback(primary, fallback, fallbackFrom) {
     return async (input) => {
         const first = await primary(input);
         if (first.status !== 'error')
@@ -44,8 +45,8 @@ function withSearchFallback(primary, fallback) {
             ...second,
             metadata: {
                 ...second.metadata,
-                fallbackFrom: 'searxng',
-                fallbackReason: first.error?.message ?? 'SearXNG search failed.'
+                fallbackFrom,
+                fallbackReason: first.error?.message ?? `${fallbackFrom} search failed.`
             }
         };
         return { ...result, presentation: buildSearchPresentation(result) };
@@ -71,6 +72,7 @@ function withFetchFallback(primary, fallback) {
 export function createBackendSet(config = DEFAULT_BACKEND_CONFIG, deps = {}) {
     const createDuckDuckGoSearch = deps.createDuckDuckGoSearch ?? createWebSearchTool;
     const createSearxngSearch = deps.createSearxngSearch ?? createSearxngSearchTool;
+    const createBraveSearch = deps.createBraveSearch ?? createBraveSearchTool;
     const createHttpFetch = deps.createHttpFetch ?? createWebFetchTool;
     const createFirecrawlFetch = deps.createFirecrawlFetch ?? createFirecrawlFetcher;
     const createHeadlessFetch = deps.createHeadlessFetch ?? createWebFetchHeadlessTool;
@@ -78,9 +80,14 @@ export function createBackendSet(config = DEFAULT_BACKEND_CONFIG, deps = {}) {
         ? config.search.baseUrl
             ? createSearxngSearch({ baseUrl: config.search.baseUrl, options: config.search.options })
             : invalidSearxngSearch()
-        : createDuckDuckGoSearch();
+        : config.search.provider === 'brave'
+            ? createBraveSearch({ apiKey: process.env.PI_WEB_AGENT_BRAVE_API_KEY })
+            : createDuckDuckGoSearch();
     if (config.search.provider === 'searxng' && config.search.fallback === 'duckduckgo') {
-        search = withSearchFallback(search, createDuckDuckGoSearch());
+        search = withSearchFallback(search, createDuckDuckGoSearch(), 'searxng');
+    }
+    if (config.search.provider === 'brave' && config.search.fallback === 'duckduckgo') {
+        search = withSearchFallback(search, createDuckDuckGoSearch(), 'brave');
     }
     const httpFetch = createHttpFetch();
     let fetchPage = config.fetch.provider === 'firecrawl'

package/dist/commands/web-agent-config.js

@@ -124,7 +124,7 @@ function buildBackendSettingsItems(scope, backends) {
             id: 'backend:search:provider',
             label: 'Search backend',
             currentValue: backends.search.provider,
-            values: ['duckduckgo', 'searxng']
+            values: ['duckduckgo', 'searxng', 'brave']
         },
         {
             id: 'backend:search:baseUrl',
@@ -134,9 +134,15 @@ function buildBackendSettingsItems(scope, backends) {
         },
         {
             id: 'backend:search:fallback',
-            label: 'SearXNG fallback',
-            currentValue: backends.search.provider === 'searxng' ? backends.search.fallback ?? 'off' : 'off',
-            values: backends.search.provider === 'searxng' ? ['off', 'duckduckgo'] : ['off']
+            label: 'Search fallback',
+            currentValue: backends.search.provider === 'searxng' || backends.search.provider === 'brave' ? backends.search.fallback ?? 'off' : 'off',
+            values: backends.search.provider === 'searxng' || backends.search.provider === 'brave' ? ['off', 'duckduckgo'] : ['off']
+        },
+        {
+            id: 'backend:secret:brave',
+            label: 'Brave API key',
+            currentValue: 'env var',
+            values: ['env var']
         },
         {
             id: 'backend:fetch:provider',
@@ -249,22 +255,26 @@ export function applySettingsValue(state, id, newValue) {
         }
         currentDraft.tools = nextTools;
     }
-    if (id === 'backend:search:provider' && (newValue === 'duckduckgo' || newValue === 'searxng')) {
+    if (id === 'backend:search:provider' && (newValue === 'duckduckgo' || newValue === 'searxng' || newValue === 'brave')) {
         currentBackends.search.provider = newValue;
+        if (newValue !== 'searxng') {
+            delete currentBackends.search.baseUrl;
+            delete currentBackends.search.options;
+        }
         if (newValue === 'duckduckgo') {
             delete currentBackends.search.fallback;
         }
     }
     if (id === 'backend:search:fallback') {
-        if (newValue === 'duckduckgo' && currentBackends.search.provider === 'searxng') {
+        if (newValue === 'duckduckgo' && (currentBackends.search.provider === 'searxng' || currentBackends.search.provider === 'brave')) {
             currentBackends.search.fallback = 'duckduckgo';
         }
-        else if (newValue === 'off' || currentBackends.search.provider !== 'searxng') {
+        else {
             delete currentBackends.search.fallback;
         }
     }
     if (id === 'backend:search:baseUrl') {
-        if (newValue.trim()) {
+        if (currentBackends.search.provider === 'searxng' && newValue.trim()) {
             currentBackends.search.baseUrl = newValue.trim();
         }
         else {

package/dist/search/brave.d.ts

@@ -0,0 +1,7 @@
+import type { WebSearchResponse } from '../types.js';
+export declare function createBraveSearchTool({ apiKey, fetchImpl }: {
+    apiKey?: string;
+    fetchImpl?: typeof fetch;
+}): ({ query }: {
+    query: string;
+}) => Promise<WebSearchResponse>;

package/dist/search/brave.js

@@ -0,0 +1,83 @@
+import { buildSearchPresentation } from '../presentation/search-presentation.js';
+const BRAVE_WEB_SEARCH_URL = 'https://api.search.brave.com/res/v1/web/search';
+function resultWithPresentation(result) {
+    return { ...result, presentation: buildSearchPresentation(result) };
+}
+function normalizeResults(response) {
+    return (response.web?.results ?? []).flatMap((item) => {
+        if (typeof item.title !== 'string' || typeof item.url !== 'string') {
+            return [];
+        }
+        return [
+            {
+                title: item.title,
+                url: item.url,
+                snippet: typeof item.description === 'string' ? item.description : ''
+            }
+        ];
+    });
+}
+function buildBraveUrl(query) {
+    const url = new URL(BRAVE_WEB_SEARCH_URL);
+    url.searchParams.set('q', query);
+    return url.toString();
+}
+export function createBraveSearchTool({ apiKey, fetchImpl = fetch }) {
+    return async function braveSearch({ query }) {
+        const normalizedQuery = query.trim();
+        if (!normalizedQuery) {
+            return resultWithPresentation({
+                status: 'error',
+                results: [],
+                metadata: { backend: 'brave', cacheHit: false },
+                error: { code: 'INVALID_QUERY', message: 'Query must not be empty.' }
+            });
+        }
+        if (!apiKey?.trim()) {
+            return resultWithPresentation({
+                status: 'error',
+                results: [],
+                metadata: { backend: 'brave', cacheHit: false },
+                error: {
+                    code: 'BACKEND_CONFIG_INVALID',
+                    message: 'Brave search requires PI_WEB_AGENT_BRAVE_API_KEY.'
+                }
+            });
+        }
+        try {
+            const response = await fetchImpl(buildBraveUrl(normalizedQuery), {
+                headers: {
+                    Accept: 'application/json',
+                    'X-Subscription-Token': apiKey
+                }
+            });
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}`);
+            }
+            const parsed = (await response.json());
+            const results = normalizeResults(parsed);
+            if (results.length === 0) {
+                return resultWithPresentation({
+                    status: 'error',
+                    results: [],
+                    metadata: { backend: 'brave', cacheHit: false },
+                    error: { code: 'NO_RESULTS', message: 'Brave returned no usable results for this query.' }
+                });
+            }
+            return resultWithPresentation({
+                status: 'ok',
+                results,
+                metadata: { backend: 'brave', cacheHit: false }
+            });
+        }
+        catch (error) {
+            const rawMessage = error instanceof Error ? error.message : String(error);
+            return resultWithPresentation({
+                status: 'error',
+                results: [],
+                metadata: { backend: 'brave', cacheHit: false },
+                error: { code: 'FETCH_FAILED', message: `Brave search request failed: ${rawMessage}` }
+            });
+        }
+    };
+}

package/dist/types.d.ts

@@ -11,9 +11,9 @@ export type ToolError = {
     message: string;
 };
 export type SearchMetadata = {
-    backend: 'duckduckgo' | 'searxng';
+    backend: 'duckduckgo' | 'searxng' | 'brave';
     cacheHit: boolean;
-    fallbackFrom?: 'searxng';
+    fallbackFrom?: 'searxng' | 'brave';
     fallbackReason?: string;
 };
 export type FetchMetadata = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@demigodmode/pi-web-agent",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "Pi package for reliable web access with explicit search, fetch, and headless boundaries.",
   "type": "module",
   "main": "./dist/extension.js",
@@ -61,17 +61,20 @@
     "typebox": "^1.1.37"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.74.0",
-    "@earendil-works/pi-tui": "^0.74.0",
+    "@earendil-works/pi-coding-agent": "^0.79.10",
+    "@earendil-works/pi-tui": "^0.79.10",
     "@types/jsdom": "^21.1.7",
     "@types/node": "^24.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.6",
     "typescript": "^5.8.0",
     "vitepress": "^1.6.4",
-    "vitest": "^3.2.0"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*",
     "@earendil-works/pi-tui": "*"
+  },
+  "overrides": {
+    "vite": "6.4.3"
   }
 }