@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-web-access/source-check.js

@@ -89,54 +89,18 @@ export function buildPassages(sources, fetched = [], hint = "") {
   }
   return passages;
 }
-const CONTRADICTION_MARKERS = ["not true", "false", "incorrect", "debunked", "retracted", "no longer", "never", "denied", "contrary", "misleading"];
-const SUPPORT_MARKERS = ["yes", "true", "correct", "confirmed", "according to", "shows that", "demonstrates", "reported", "verified", "established"];
-function containsPhrase(value, phrase) {
-  const escaped = phrase.trim().toLowerCase().split(/\s+/).map((term) => term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("\\s+");
-  return new RegExp(`(?:^|[^a-z0-9])${escaped}(?=$|[^a-z0-9])`, "i").test(value);
-}
-function markerIsNegated(value, marker) {
-  const escaped = marker.trim().toLowerCase().split(/\s+/).map((term) => term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("\\s+");
-  const markerPattern = new RegExp(`(?:^|[^a-z0-9])${escaped}(?=$|[^a-z0-9])`, "i");
-  const match = markerPattern.exec(value);
-  if (!match || match.index === undefined)
-    return false;
-  const matchedMarker = match[0].replace(/^[^a-z0-9]+/i, "");
-  const beforeMarker = value.slice(0, match.index + match[0].length - matchedMarker.length);
-  return /(?:^|[^a-z0-9])(?:not|no|never|without)\s+$/i.test(beforeMarker);
-}
-function hasPolarityMarker(value, markers, allowNegated = false) {
-  return markers.some((marker) => containsPhrase(value, marker) && (allowNegated || !markerIsNegated(value, marker)));
-}
 export function assessClaim(claim, passages) {
-  const terms = tokenize(claim);
-  if (terms.length === 0 || passages.length === 0) {
-    return { claim, status: "missing-evidence", supporting_passages: [], contradicting_passages: [], rationale: "No passages available that discuss the claim's terms.", confidence: 0.2 };
-  }
-  const supporting = [];
-  const contradicting = [];
-  for (const passage of passages) {
-    const lower = passage.text.toLowerCase();
-    const overlap = terms.filter((term) => containsPhrase(lower, term)).length;
-    if (overlap < Math.max(2, Math.ceil(terms.length / 4)))
-      continue;
-    const contra = hasPolarityMarker(lower, CONTRADICTION_MARKERS);
-    const support = hasPolarityMarker(lower, SUPPORT_MARKERS);
-    if (contra && !support)
-      contradicting.push(passage.passage_id);
-    else if (support && !contra)
-      supporting.push(passage.passage_id);
+  if (passages.length === 0) {
+    return { claim, status: "missing-evidence", supporting_passages: [], contradicting_passages: [], rationale: "No passages were retrieved for the claim.", confidence: 0.2 };
   }
-  if (contradicting.length > 0 && supporting.length === 0) {
-    return { claim, status: "contradicted", supporting_passages: [], contradicting_passages: contradicting, rationale: `${contradicting.length} passage(s) contradict the claim; none support it.`, confidence: Math.min(0.85, 0.5 + contradicting.length * 0.1) };
-  }
-  if (supporting.length > 0 && contradicting.length === 0) {
-    return { claim, status: "supported", supporting_passages: supporting, contradicting_passages: [], rationale: `${supporting.length} passage(s) support the claim; none contradict it.`, confidence: Math.min(0.85, 0.5 + supporting.length * 0.1) };
-  }
-  if (supporting.length > 0 || contradicting.length > 0) {
-    return { claim, status: "unclear", supporting_passages: supporting, contradicting_passages: contradicting, rationale: `${supporting.length} supporting and ${contradicting.length} contradicting passage(s); evidence is mixed.`, confidence: 0.4 };
-  }
-  return { claim, status: "unclear", supporting_passages: [], contradicting_passages: [], rationale: "Passages mention the claim's terms but contain no clear support or contradiction markers.", confidence: 0.3 };
+  return {
+    claim,
+    status: "unclear",
+    supporting_passages: [],
+    contradicting_passages: [],
+    rationale: "Passages were retrieved, but automated semantic support or contradiction assessment is unavailable; review the cited passages manually.",
+    confidence: 0.3
+  };
 }
 export function buildResearchArtifact(input) {
   const filters = input.domainFilter ?? [];

package/extensions/dm-web-access/ssrf-protection.js

@@ -159,6 +159,7 @@ export async function fetchRemoteUrl(url, init = {}, options = {}) {
   const fetchImpl = options.fetch ?? fetch;
   const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
   let current = await validateRemoteUrl(url, options);
+  const configuredOrigin = current.origin;
   let requestInit = init;
   for (let redirects = 0;redirects <= maxRedirects; redirects++) {
     const response = await fetchImpl(current, { ...requestInit, redirect: "manual" });
@@ -170,7 +171,8 @@ export async function fetchRemoteUrl(url, init = {}, options = {}) {
     if (redirects === maxRedirects)
       throw new Error(`Too many redirects fetching ${current.toString()}`);
     const from = current;
-    current = await validateRemoteUrl(new URL(location, current), options);
+    const next = new URL(location, current);
+    current = await validateRemoteUrl(next, next.origin === configuredOrigin ? options : { ...options, allowLoopback: false });
     if (response.status === 303 || (response.status === 301 || response.status === 302) && requestInit.method?.toUpperCase() === "POST") {
       const { body: _body, ...nextInit } = requestInit;
       requestInit = { ...nextInit, method: "GET" };

package/extensions/dm-web-access/storage.js

@@ -362,8 +362,16 @@ function readCachedFetchData(data, now = Date.now()) {
       } catch {}
   }
 }
+function pruneExpiredFetchedResults(now) {
+  for (const [id, data] of storedResults) {
+    if (data.type === "fetch" && now - data.timestamp >= CACHE_TTL_MS) {
+      storedResults.set(id, unavailableFetchData(data, "Cached fetched content is missing or expired"));
+    }
+  }
+}
 export function pruneExpiredFetchCache(now = Date.now(), requestedLimits) {
   const limits = cacheLimits(requestedLimits);
+  pruneExpiredFetchedResults(now);
   try {
     pruneFetchCache(now, limits);
   } catch {}
@@ -372,6 +380,7 @@ export function storeResult(id, data) {
   storedResults.set(id, data);
 }
 export function storeFetchedContentResult(id, data) {
+  pruneExpiredFetchedResults(Date.now());
   let ref = null;
   let cacheError;
   try {

package/extensions/dm-web-access/summary-review.js

@@ -1,5 +1,4 @@
-import { clampThinkingLevel } from "@duckmind/dm-ai";
-import { complete, completeSimple } from "@duckmind/dm-ai/compat";
+import { openCodeSessionHeaders } from "./opencode-session-headers.js";
 import { findModelWithProviderRouting, loadEnabledModelPatterns, modelMatchesEnabledPatterns, splitThinkingSuffix } from "./summary-model-scope.js";
 const PREFERRED_SUMMARY_MODELS = [
   { provider: "anthropic", id: "claude-haiku-4-5" },
@@ -168,9 +167,10 @@ function parseModelSelector(value) {
     thinkingLevel: selector.thinkingLevel
   };
 }
-function resolveThinkingLevel(model, requested) {
+async function resolveThinkingLevel(model, requested) {
   if (!requested)
     return;
+  const { clampThinkingLevel } = await import("@duckmind/dm-ai");
   return clampThinkingLevel(model, requested);
 }
 async function resolveSummaryModelCandidates(ctx, modelOverride) {
@@ -244,20 +244,20 @@ export async function generateSummaryDraft(results, ctx, signal, modelOverride,
   if (!ctx || !ctx.modelRegistry) {
     throw new Error("Summary generation context unavailable");
   }
+  if (signal?.aborted)
+    throw new Error("Aborted");
   const registry = ctx.modelRegistry;
   const customCompleteFn = completeFn !== undefined;
   const usesRegistryComplete = !customCompleteFn && typeof registry.complete === "function";
-  completeFn ??= usesRegistryComplete ? registry.complete.bind(registry) : complete;
+  let piAiCompat;
   const generationStartedAt = Date.now();
   const deadlineController = new AbortController;
   const deadlineMarker = Symbol("summary-generation-deadline");
   let deadlineTimer;
-  let resolveDeadline;
   const deadlinePromise = new Promise((resolve) => {
-    resolveDeadline = () => resolve(deadlineMarker);
     deadlineTimer = setTimeout(() => {
       deadlineController.abort();
-      resolveDeadline();
+      resolve(deadlineMarker);
     }, deadlineMs);
   });
   let callerAbortListener;
@@ -269,21 +269,26 @@ export async function generateSummaryDraft(results, ctx, signal, modelOverride,
       signal.addEventListener("abort", callerAbortListener, { once: true });
   }) : undefined;
   const completionSignal = signal ? AbortSignal.any([signal, deadlineController.signal]) : deadlineController.signal;
+  function checkSummaryDeadline() {
+    if (signal?.aborted)
+      throw new Error("Aborted");
+    if (deadlineController.signal.aborted || Date.now() - generationStartedAt >= deadlineMs) {
+      deadlineController.abort();
+      throw deadlineMarker;
+    }
+  }
   async function raceSummaryOperation(operation) {
     operation.then(() => {
       return;
     }, () => {
       return;
     });
+    checkSummaryDeadline();
     const contenders = [operation, deadlinePromise];
     if (callerAbortPromise)
       contenders.push(callerAbortPromise);
     const result = await Promise.race(contenders);
-    if (result === deadlineMarker) {
-      if (signal?.aborted)
-        throw new Error("Aborted");
-      throw deadlineMarker;
-    }
+    checkSummaryDeadline();
     return result;
   }
   try {
@@ -292,13 +297,14 @@ export async function generateSummaryDraft(results, ctx, signal, modelOverride,
     const prompt = buildSummaryPrompt(results, feedback);
     let resolved;
     try {
+      checkSummaryDeadline();
+      if (!customCompleteFn && !usesRegistryComplete) {
+        piAiCompat = await raceSummaryOperation(import("@duckmind/dm-ai/compat"));
+      }
+      completeFn ??= usesRegistryComplete ? registry.complete.bind(registry) : piAiCompat.complete;
       resolved = await raceSummaryOperation(resolveSummaryModelCandidates(ctx, modelOverride));
     } catch (err) {
-      if (signal?.aborted)
-        throw new Error("Aborted");
-      if (err === deadlineMarker || deadlineController.signal.aborted) {
-        return buildFallbackSummary(results, "summary-generation-timeout", Date.now() - generationStartedAt);
-      }
+      checkSummaryDeadline();
       const message = err instanceof Error ? err.message : String(err);
       return buildFallbackSummary(results, `summary-model-settings-error: ${message}`, Date.now() - generationStartedAt);
     }
@@ -306,20 +312,22 @@ export async function generateSummaryDraft(results, ctx, signal, modelOverride,
     for (const { model, apiKey, headers, thinkingLevel } of resolved.candidates) {
       const startedAt = Date.now();
       try {
+        const sessionHeaders = openCodeSessionHeaders(model, ctx.sessionManager);
         const userMessage = {
           role: "user",
           content: [{ type: "text", text: prompt }],
           timestamp: Date.now()
         };
-        const requestedThinkingLevel = resolveThinkingLevel(model, thinkingLevel);
+        const requestedThinkingLevel = await raceSummaryOperation(resolveThinkingLevel(model, thinkingLevel));
         const enabledThinkingLevel = requestedThinkingLevel && requestedThinkingLevel !== "off" ? requestedThinkingLevel : undefined;
         const completionOptions = {
-          ...usesRegistryComplete ? {} : { apiKey, headers },
+          ...usesRegistryComplete ? sessionHeaders ? { transformHeaders: (requestHeaders) => ({ ...requestHeaders, ...sessionHeaders }) } : {} : { apiKey, headers: sessionHeaders ? { ...headers, ...sessionHeaders } : headers },
           signal: completionSignal,
           ...requestedThinkingLevel ? { reasoning: requestedThinkingLevel } : {},
           ...enabledThinkingLevel ? { reasoningEffort: enabledThinkingLevel } : {}
         };
-        const completion = thinkingLevel !== undefined && !customCompleteFn && !usesRegistryComplete ? completeSimple(model, { messages: [userMessage] }, { apiKey, headers, signal: completionSignal, ...enabledThinkingLevel ? { reasoning: enabledThinkingLevel } : {} }) : completeFn(model, { messages: [userMessage] }, completionOptions);
+        checkSummaryDeadline();
+        const completion = thinkingLevel !== undefined && !customCompleteFn && !usesRegistryComplete ? piAiCompat.completeSimple(model, { messages: [userMessage] }, { apiKey, headers: sessionHeaders ? { ...headers, ...sessionHeaders } : headers, signal: completionSignal, ...enabledThinkingLevel ? { reasoning: enabledThinkingLevel } : {} }) : completeFn(model, { messages: [userMessage] }, completionOptions);
         const response = await raceSummaryOperation(Promise.resolve(completion));
         if (response.stopReason === "aborted") {
           throw new Error("Aborted");
@@ -344,17 +352,20 @@ export async function generateSummaryDraft(results, ctx, signal, modelOverride,
           }
         };
       } catch (err) {
-        if (signal?.aborted)
-          throw new Error("Aborted");
-        if (err === deadlineMarker || deadlineController.signal.aborted) {
-          return buildFallbackSummary(results, "summary-generation-timeout", Date.now() - generationStartedAt);
-        }
+        checkSummaryDeadline();
         if (isAbortError(err))
           throw err;
         lastError = err instanceof Error ? err.message : String(err);
       }
     }
     return buildFallbackSummary(results, lastError ? `summary-model-unavailable: ${lastError}` : "summary-model-unavailable", Date.now() - generationStartedAt);
+  } catch (err) {
+    if (signal?.aborted)
+      throw new Error("Aborted");
+    if (err === deadlineMarker) {
+      return buildFallbackSummary(results, "summary-generation-timeout", Date.now() - generationStartedAt);
+    }
+    throw err;
   } finally {
     if (deadlineTimer)
       clearTimeout(deadlineTimer);

package/extensions/dm-web-access/tavily.js

@@ -1,5 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.js";
+import { normalizeDomain } from "./domain-filter-normalization.js";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.js";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.js";
 import { fetchWithCredentialRedirects, getWebSearchConfigPath, resolveApiBaseUrl } from "./utils.js";
 const TAVILY_API_BASE_URL = "https://api.tavily.com";
@@ -49,28 +51,6 @@ async function requireApiKey(signal) {
   }
   return apiKey;
 }
-function normalizeCount(value) {
-  if (typeof value !== "number" || !Number.isFinite(value))
-    return 5;
-  return Math.max(1, Math.min(Math.floor(value), 20));
-}
-function normalizeDomain(value) {
-  let input = value.trim().toLowerCase();
-  if (!input)
-    return null;
-  if (input.startsWith("-"))
-    input = input.slice(1).trim();
-  if (!input)
-    return null;
-  try {
-    const parsed = input.includes("://") ? new URL(input) : new URL(`https://${input}`);
-    input = parsed.hostname;
-  } catch {
-    input = input.split("/")[0]?.split(":")[0] ?? "";
-  }
-  input = input.replace(/^\.+|\.+$/g, "");
-  return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(input) ? input : null;
-}
 function mapDomainFilter(domainFilter) {
   if (!domainFilter?.length)
     return {};
@@ -137,7 +117,7 @@ export function isTavilyAvailable() {
 export async function searchWithTavily(query, options = {}) {
   const apiUrl = getApiUrl();
   const apiKey = await requireApiKey(options.signal);
-  const numResults = normalizeCount(options.numResults);
+  const numResults = normalizeSearchResultCount(options.numResults);
   const body = {
     query,
     search_depth: "basic",

package/extensions/dm-web-access/tinyfish.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.js";
+import { normalizeDomain } from "./domain-filter-normalization.js";
+import { formatSearchResultsAsAnswer } from "./search-answer-formatting.js";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.js";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.js";
 import { getWebSearchConfigPath } from "./utils.js";
 const TINYFISH_SEARCH_URL = "https://api.search.tinyfish.ai";
@@ -58,23 +61,6 @@ function requestSignal(signal, timeoutMs) {
   const timeout = AbortSignal.timeout(timeoutMs);
   return signal ? AbortSignal.any([signal, timeout]) : timeout;
 }
-function normalizeDomain(value) {
-  let input = value.trim().toLowerCase();
-  if (!input)
-    return null;
-  if (input.startsWith("-"))
-    input = input.slice(1).trim();
-  if (!input)
-    return null;
-  try {
-    const parsed = input.includes("://") ? new URL(input) : new URL(`https://${input}`);
-    input = parsed.hostname;
-  } catch {
-    input = input.split("/")[0]?.split(":")[0] ?? "";
-  }
-  input = input.replace(/^\.+|\.+$/g, "");
-  return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(input) ? input : null;
-}
 function mapDomainFilter(domainFilter) {
   const includeDomains = [];
   const excludeDomains = [];
@@ -99,11 +85,6 @@ function recencyMinutes(filter) {
   };
   return minutes[filter];
 }
-function normalizeNumResults(value) {
-  if (typeof value !== "number" || !Number.isFinite(value))
-    return 5;
-  return Math.max(1, Math.min(Math.floor(value), 20));
-}
 function buildSearchUrl(query, options, page) {
   const params = new URLSearchParams({ query });
   const { includeDomains, excludeDomains } = mapDomainFilter(options.domainFilter);
@@ -177,16 +158,6 @@ function deduplicateResults(results, limit) {
   }
   return unique;
 }
-function buildAnswer(results) {
-  return results.map((result) => {
-    if (result.snippet)
-      return `${result.snippet}
-Source: ${result.title} (${result.url})`;
-    return `Source: ${result.title} (${result.url})`;
-  }).join(`
-
-`);
-}
 function fetchPerUrlTimeout(value) {
   if (typeof value !== "number" || !Number.isFinite(value))
     return MAX_FETCH_PER_URL_TIMEOUT_MS;
@@ -250,7 +221,7 @@ async function fetchInlineContent(urls, apiKey, signal) {
 }
 export async function searchWithTinyFish(query, options = {}) {
   const apiKey = await getApiKey(options.signal);
-  const numResults = normalizeNumResults(options.numResults);
+  const numResults = normalizeSearchResultCount(options.numResults);
   const activityId = activityMonitor.logStart({ type: "api", query });
   try {
     const combined = [];
@@ -264,7 +235,7 @@ export async function searchWithTinyFish(query, options = {}) {
         break;
     }
     const results = deduplicateResults(combined, numResults);
-    const response = { answer: buildAnswer(results), results };
+    const response = { answer: formatSearchResultsAsAnswer(results), results };
     if (options.includeContent && results.length > 0) {
       const inlineContent = await fetchInlineContent(results.map((result) => result.url), apiKey, options.signal);
       if (inlineContent.length > 0)

package/extensions/dm-web-access/tool-activation.js

@@ -0,0 +1,112 @@
+import { buildSessionContext } from "@duckmind/dm-coding-agent";
+import { dirname, join } from "node:path";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Type } from "typebox";
+const LOADER_NAME = "web_enable";
+const CAPABILITY_LABELS = {
+  search: "web search",
+  "source-check": "source checking",
+  fetch: "content fetching",
+  "stored-content": "stored-result retrieval"
+};
+function supportsDynamicTools(pi) {
+  if (typeof pi.getAllTools !== "function" || typeof pi.getActiveTools !== "function" || typeof pi.setActiveTools !== "function")
+    return false;
+  try {
+    const packagePath = join(dirname(fileURLToPath(import.meta.resolve("@duckmind/dm-coding-agent"))), "..", "package.json");
+    const [major, minor, patch] = JSON.parse(readFileSync(packagePath, "utf8")).version.split(".").map(Number);
+    return major > 0 || minor > 86 || minor === 86 && patch >= 1;
+  } catch {
+    return false;
+  }
+}
+function hasToolDeclarations(messages) {
+  return messages.some((message) => message && typeof message === "object" && (("toolsAdded" in message) || ("toolsRemoved" in message)));
+}
+async function currentTranscriptToolNames(messages) {
+  const moduleName = "@duckmind/dm-ai/utils/transcript";
+  const { getCurrentTools } = await import(moduleName);
+  return getCurrentTools(messages).map((tool) => tool.name);
+}
+export function registerWebToolActivation(pi, tools) {
+  if (tools.length === 0)
+    return;
+  if (!supportsDynamicTools(pi)) {
+    console.warn("[dm-web-access] Dynamic tool activation requires DM 0.86.1 or newer; web tools remain eagerly available.");
+    return;
+  }
+  const names = tools.map((tool) => tool.name);
+  const capabilities = tools.map((tool) => CAPABILITY_LABELS[tool.capability]).join(", ");
+  const parameters = Type.Object({}, { additionalProperties: false });
+  pi.registerTool({
+    name: LOADER_NAME,
+    label: "Enable Web Access",
+    description: "Enable configured dm-web-access tools for web research and content retrieval. Does not search or fetch. Enabled tools are available on the next model request; disabled capabilities remain unavailable.",
+    promptSnippet: `dm-web-access is configured for ${capabilities}. Call web_enable to activate these tools; use them on the next model request.`,
+    parameters,
+    async execute() {
+      const registered = new Set(pi.getAllTools().map((tool) => tool.name));
+      const unavailable = names.filter((name) => !registered.has(name));
+      if (unavailable.length > 0) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Cannot enable unavailable tools: ${unavailable.join(", ")}.` }],
+          details: { unavailable }
+        };
+      }
+      try {
+        pi.setActiveTools([...new Set([...pi.getActiveTools(), ...names])]);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Activation failed: ${message}.` }],
+          details: { error: message }
+        };
+      }
+      const active = new Set(pi.getActiveTools());
+      const missing = names.filter((name) => !active.has(name));
+      return missing.length > 0 ? {
+        isError: true,
+        content: [{ type: "text", text: `Tools still inactive after activation: ${missing.join(", ")}.` }],
+        details: { missing }
+      } : {
+        content: [{ type: "text", text: `Enabled: ${names.join(", ")}.` }],
+        details: { enabled: names }
+      };
+    }
+  });
+  function loaderAvailable() {
+    return pi.getAllTools().some((tool) => tool.name === LOADER_NAME);
+  }
+  let warned = false;
+  async function selectFromSession(ctx) {
+    if (!loaderAvailable())
+      return;
+    try {
+      const messages = buildSessionContext(ctx.sessionManager.getBranch()).messages;
+      const recorded = hasToolDeclarations(messages) ? new Set(await currentTranscriptToolNames(messages)) : messages.length > 0 ? new Set(names) : new Set;
+      const heavy = new Set(names);
+      const active = pi.getActiveTools().filter((name) => !heavy.has(name));
+      for (const name of names)
+        if (recorded.has(name))
+          active.push(name);
+      pi.setActiveTools([...new Set([...active, LOADER_NAME])]);
+    } catch (error) {
+      if (!warned) {
+        warned = true;
+        console.warn(`[dm-web-access] Keeping web tools eagerly available because activation setup failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+  }
+  pi.on("session_start", (_event, ctx) => selectFromSession(ctx));
+  pi.on("session_tree", (_event, ctx) => selectFromSession(ctx));
+  pi.on("before_agent_start", () => {
+    if (!loaderAvailable() || pi.getActiveTools().includes(LOADER_NAME))
+      return;
+    try {
+      pi.setActiveTools([...pi.getActiveTools(), LOADER_NAME]);
+    } catch {}
+  });
+}

package/extensions/dm-web-access/utils.js

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { isIP } from "node:net";
 import { homedir, hostname, tmpdir } from "node:os";
 import { join } from "node:path";
 let cachedWebSearchConfigDir;
@@ -13,7 +14,7 @@ export function getWebSearchConfigDir() {
     return cachedWebSearchConfigDir = explicitDir;
   const xdgConfigHome = process.env.XDG_CONFIG_HOME;
   if (xdgConfigHome) {
-    const xdgDir = join(xdgConfigHome, "pi");
+    const xdgDir = join(xdgConfigHome, "dm");
     if (existsSync(join(xdgDir, "web-search.json")))
       return cachedWebSearchConfigDir = xdgDir;
     const legacyDir = join(homedir(), ".dm");
@@ -21,11 +22,21 @@ export function getWebSearchConfigDir() {
       return cachedWebSearchConfigDir = legacyDir;
     return cachedWebSearchConfigDir = xdgDir;
   }
-  return cachedWebSearchConfigDir = join(homedir(), ".dm");
+  const agentDir = join(homedir(), ".dm", "agent");
+  if (existsSync(join(agentDir, "web-search.json")))
+    return cachedWebSearchConfigDir = agentDir;
+  const legacyDir = join(homedir(), ".dm");
+  if (existsSync(join(legacyDir, "web-search.json")))
+    return cachedWebSearchConfigDir = legacyDir;
+  return cachedWebSearchConfigDir = agentDir;
 }
 export function getWebSearchConfigPath() {
   return join(getWebSearchConfigDir(), "web-search.json");
 }
+export function isLoopbackHostname(hostnameValue) {
+  const normalized = hostnameValue.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+  return normalized === "localhost" || normalized === "::1" || isIP(normalized) === 4 && normalized.split(".", 1)[0] === "127";
+}
 export function resolveApiBaseUrl(options) {
   const fromEnvironment = options.environmentValue !== undefined;
   const value = fromEnvironment ? options.environmentValue : options.configuredValue;
@@ -41,7 +52,7 @@ export function resolveApiBaseUrl(options) {
   } catch {
     throw new Error(`${source} must be an absolute HTTP(S) URL`);
   }
-  if (url.protocol !== "https:") {
+  if (url.protocol !== "https:" && (url.protocol !== "http:" || !isLoopbackHostname(url.hostname))) {
     throw new Error(`${source} must be an absolute HTTPS URL`);
   }
   if (url.username || url.password) {
@@ -171,7 +182,7 @@ export function normalizeProxyUrl(value, source) {
   if (value === undefined || value === null)
     return null;
   if (typeof value !== "string")
-    throw new Error(`${source} must be an http(s) proxy URL string`);
+    throw new Error(`${source} must be an http(s) or socks proxy URL string`);
   const trimmed = value.trim();
   if (!trimmed)
     return null;
@@ -181,8 +192,8 @@ export function normalizeProxyUrl(value, source) {
   } catch {
     throw new Error(`${source} must be a valid proxy URL: ${JSON.stringify(trimmed)}`);
   }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`${source} must use the http:// or https:// scheme: ${trimmed}`);
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:" && parsed.protocol !== "socks4:" && parsed.protocol !== "socks4a:" && parsed.protocol !== "socks5:" && parsed.protocol !== "socks5h:") {
+    throw new Error(`${source} must use the http://, https://, or socks scheme: ${trimmed}`);
   }
   if (!parsed.hostname)
     throw new Error(`${source} must include a proxy host: ${trimmed}`);
@@ -217,14 +228,20 @@ function loadConfiguredProxy() {
   return normalizeProxyUrl(configured, `proxy in ${getWebSearchConfigPath()}`);
 }
 export function runWithProxy(proxy, fn) {
-  if (proxy === undefined)
-    return fn();
+  if (proxy === undefined) {
+    const configured = loadConfiguredProxy();
+    if (configured === null)
+      return fn();
+    installGlobalProxyFetch();
+    return proxyStorage.run(configured, fn);
+  }
   const normalized = normalizeProxyUrl(proxy, "proxy");
+  if (normalized !== null)
+    installGlobalProxyFetch();
   return proxyStorage.run(normalized, fn);
 }
 export function getActiveProxy() {
-  const scoped = proxyStorage.getStore();
-  return scoped !== undefined ? scoped : loadConfiguredProxy();
+  return proxyStorage.getStore() ?? null;
 }
 export function hasScopedProxyDecision() {
   return proxyStorage.getStore() !== undefined;

package/extensions/dm-web-access/valyu.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.js";
+import { normalizeDomain } from "./domain-filter-normalization.js";
+import { formatSearchResultsAsAnswer } from "./search-answer-formatting.js";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.js";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.js";
 import { getWebSearchConfigPath } from "./utils.js";
 const VALYU_SEARCH_URL = "https://api.valyu.ai/v1/search";
@@ -47,28 +50,6 @@ async function requireApiKey(signal) {
   }
   return apiKey;
 }
-function normalizeCount(value) {
-  if (typeof value !== "number" || !Number.isFinite(value))
-    return 5;
-  return Math.max(1, Math.min(Math.floor(value), 20));
-}
-function normalizeDomain(value) {
-  let input = value.trim().toLowerCase();
-  if (!input)
-    return null;
-  if (input.startsWith("-"))
-    input = input.slice(1).trim();
-  if (!input)
-    return null;
-  try {
-    const parsed = input.includes("://") ? new URL(input) : new URL(`https://${input}`);
-    input = parsed.hostname;
-  } catch {
-    input = input.split("/")[0]?.split(":")[0] ?? "";
-  }
-  input = input.replace(/^\.+|\.+$/g, "");
-  return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(input) ? input : null;
-}
 function mapDomainFilter(domainFilter) {
   if (!domainFilter?.length)
     return {};
@@ -112,18 +93,12 @@ function parseResponse(value) {
     throw invalidResponse("expected results array");
   return envelope.results;
 }
-function buildAnswer(results) {
-  return results.map((result) => result.snippet ? `${result.snippet}
-Source: ${result.title} (${result.url})` : `Source: ${result.title} (${result.url})`).join(`
-
-`);
-}
 export function isValyuAvailable() {
   return hasCredentialSource({ provider: "Valyu", configuredValue: loadConfig().valyuApiKey, environmentValue: process.env.VALYU_API_KEY });
 }
 export async function searchWithValyu(query, options = {}) {
   const apiKey = await requireApiKey(options.signal);
-  const numResults = normalizeCount(options.numResults);
+  const numResults = normalizeSearchResultCount(options.numResults);
   const startDate = recencyToStartDate(options.recencyFilter);
   const activityId = activityMonitor.logStart({ type: "api", query });
   let response;
@@ -185,5 +160,5 @@ export async function searchWithValyu(query, options = {}) {
     if (results.length >= numResults)
       break;
   }
-  return { answer: buildAnswer(results), results, ...inlineContent.length > 0 ? { inlineContent } : {} };
+  return { answer: formatSearchResultsAsAnswer(results), results, ...inlineContent.length > 0 ? { inlineContent } : {} };
 }