@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-subagents/src/workflows/workflow-resources.js

@@ -0,0 +1,226 @@
+import { randomUUID } from "node:crypto";
+import { stableJsonDigest } from "../shared/launch-contract.js";
+import {
+  createWorkflowResourcePermit
+} from "../shared/workflow-child-permit.js";
+const RESOURCE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const MAX_ARGS_BYTES = 16 * 1024;
+const MAX_STRING_BYTES = 16 * 1024;
+function registry() {
+  const key = Symbol.for("dm-subagents.workflow-resources.v1");
+  const globalObject = globalThis;
+  const existing = globalObject[key];
+  if (existing === undefined) {
+    const created = { version: 1, bySession: new Map };
+    globalObject[key] = created;
+    return created;
+  }
+  if (!isPlainRecord(existing) || existing.version !== 1 || !(existing.bySession instanceof Map))
+    throw new Error("Malformed or unsupported workflow resource registry.");
+  return existing;
+}
+export function registerWorkflowResource(input) {
+  if (!isPlainRecord(input) || Object.keys(input).some((key) => key !== "sessionId" && key !== "definition"))
+    throw new Error("Workflow registration requires only sessionId and definition.");
+  const { sessionId, definition } = input;
+  if (typeof sessionId !== "string" || !sessionId || sessionId.trim() !== sessionId || sessionId.length > 256 || sessionId.includes("\x00"))
+    throw new Error("Workflow registration requires a non-empty trimmed sessionId of at most 256 characters without NUL.");
+  if (!isPlainRecord(definition) || Object.keys(definition).some((key) => !["name", "version", "resolve"].includes(key)))
+    throw new Error("Workflow definition requires only name, version and resolve.");
+  const { name, version, resolve } = definition;
+  if (typeof name !== "string" || !RESOURCE_NAME_PATTERN.test(name))
+    throw new Error("Workflow definition requires a safe resource name.");
+  if (!Number.isSafeInteger(version) || version < 1)
+    throw new Error("Workflow definition version must be a positive safe integer.");
+  if (typeof resolve !== "function")
+    throw new Error("Workflow definition requires a synchronous resolve function.");
+  if (findWorkflowResource(name))
+    throw new Error(`Workflow resource '${name}' is a protected builtin.`);
+  const current = registry();
+  const bucket = current.bySession.get(sessionId) ?? new Map;
+  if (!(bucket instanceof Map))
+    throw new Error("Malformed workflow resource session registry.");
+  if (bucket.has(name))
+    throw new Error(`Workflow resource '${name}' is already registered in this session; dispose it first.`);
+  const snapshot = Object.freeze({ name, version, resolve });
+  bucket.set(name, snapshot);
+  current.bySession.set(sessionId, bucket);
+  let disposed = false;
+  return {
+    dispose() {
+      if (disposed)
+        return;
+      disposed = true;
+      if (bucket.get(name) === snapshot)
+        bucket.delete(name);
+      if (bucket.size === 0 && current.bySession.get(sessionId) === bucket)
+        current.bySession.delete(sessionId);
+    }
+  };
+}
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function jsonByteLength(value) {
+  try {
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined)
+      throw new Error("must contain JSON data");
+    return Buffer.byteLength(encoded, "utf8");
+  } catch (error) {
+    throw new Error(`must contain plain JSON data: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function validatePlainJson(value, path, depth = 0) {
+  if (depth > 8)
+    throw new Error(`${path} is too deeply nested.`);
+  if (value === null || typeof value === "boolean")
+    return;
+  if (typeof value === "string") {
+    if (!value.trim())
+      throw new Error(`${path} must not be empty.`);
+    if (Buffer.byteLength(value, "utf8") > MAX_STRING_BYTES)
+      throw new Error(`${path} exceeds ${MAX_STRING_BYTES} bytes.`);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new Error(`${path} must be finite.`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 64)
+      throw new Error(`${path} contains too many items.`);
+    for (const [index, entry] of value.entries())
+      validatePlainJson(entry, `${path}[${index}]`, depth + 1);
+    return;
+  }
+  if (!isPlainRecord(value))
+    throw new Error(`${path} must contain plain JSON data.`);
+  if (Object.keys(value).length > 16)
+    throw new Error(`${path} contains too many fields.`);
+  for (const [key, entry] of Object.entries(value)) {
+    if (!key.trim())
+      throw new Error(`${path} contains an empty field name.`);
+    validatePlainJson(entry, `${path}.${key}`, depth + 1);
+  }
+}
+export function normalizeWorkflowArgs(value) {
+  if (value === undefined)
+    return { args: {} };
+  if (!isPlainRecord(value))
+    return { error: "workflow args must be a plain JSON object." };
+  try {
+    validatePlainJson(value, "workflow args");
+    if (jsonByteLength(value) > MAX_ARGS_BYTES)
+      return { error: `workflow args exceed ${MAX_ARGS_BYTES} bytes.` };
+    return { args: JSON.parse(JSON.stringify(value)) };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error) };
+  }
+}
+export function deepFreezeWorkflowArgs(args) {
+  deepFreezeWorkflowValue(args);
+  return args;
+}
+function deepFreezeWorkflowValue(value) {
+  if (!Array.isArray(value) && !isPlainRecord(value))
+    return;
+  for (const entry of Object.values(value))
+    deepFreezeWorkflowValue(entry);
+  Object.freeze(value);
+}
+function resolveRunCi(args) {
+  const allowed = new Set(["command", "timeoutMs"]);
+  const unsupported = Object.keys(args).filter((key) => !allowed.has(key));
+  if (unsupported.length > 0)
+    return { error: `workflow 'run-ci' args contain unsupported fields: ${unsupported.join(", ")}.` };
+  const command = args.command === undefined ? "npm test" : args.command;
+  if (command !== "npm test" && command !== "npm run typecheck")
+    return { error: "workflow 'run-ci' args.command must be 'npm test' or 'npm run typecheck'." };
+  const timeoutMs = args.timeoutMs === undefined ? 120000 : args.timeoutMs;
+  if (typeof timeoutMs !== "number" || !Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 86400000)
+    return { error: "workflow 'run-ci' args.timeoutMs must be an integer from 1 to 86400000." };
+  const params = { kind: "command", command, timeoutMs, role: "ci" };
+  return {
+    script: `return await runs.host("ci", ${JSON.stringify(params)});`,
+    hostCommands: [{ key: "ci", command }]
+  };
+}
+function resolveReview(args) {
+  const unsupported = Object.keys(args).filter((key) => key !== "task");
+  if (unsupported.length > 0)
+    return { error: `workflow 'review' args contain unsupported fields: ${unsupported.join(", ")}.` };
+  const task = args.task;
+  if (typeof task !== "string" || !task.trim())
+    return { error: "workflow 'review' requires a non-empty string args.task." };
+  return {
+    script: `return (await runs.run("review", { agent: "reviewer", task: ${JSON.stringify(task.trim())} })).output;`
+  };
+}
+const WORKFLOW_RESOURCES = [
+  { name: "review", version: 1, resolve: resolveReview },
+  { name: "run-ci", version: 1, resolve: resolveRunCi }
+];
+function findWorkflowResource(name) {
+  return WORKFLOW_RESOURCES.find((resource) => resource.name === name);
+}
+function listWorkflowResourceNames() {
+  return WORKFLOW_RESOURCES.map((resource) => resource.name);
+}
+export function resolveWorkflowResource(nameValue, argsValue, sessionId) {
+  try {
+    const result = resolveResource(nameValue, argsValue, sessionId);
+    return result.ok ? result : { ok: false, error: result.error.slice(0, 4096) };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message.slice(0, 4096) : "Workflow resource resolution failed." };
+  }
+}
+function resolveResource(nameValue, argsValue, sessionId) {
+  if (typeof nameValue !== "string" || !nameValue.trim())
+    return { ok: false, error: "workflow must be a non-empty resource name." };
+  const name = nameValue.trim();
+  if (!RESOURCE_NAME_PATTERN.test(name))
+    return { ok: false, error: "workflow must use a safe resource name." };
+  const resource = findWorkflowResource(name) ?? (sessionId ? registry().bySession.get(sessionId)?.get(name) : undefined);
+  if (!resource)
+    return { ok: false, error: `Unknown workflow resource '${name}'. Available resources: ${listWorkflowResourceNames().join(", ")}.` };
+  const normalizedArgs = normalizeWorkflowArgs(argsValue);
+  if ("error" in normalizedArgs)
+    return { ok: false, error: normalizedArgs.error };
+  const resolved = resource.resolve(normalizedArgs.args);
+  if (resolved && typeof resolved.then === "function") {
+    Promise.resolve(resolved).catch(() => {});
+    throw new Error("Workflow resource resolve must be synchronous.");
+  }
+  if (!isPlainRecord(resolved))
+    throw new Error("Workflow resource resolve must return an expansion or error object.");
+  if ("error" in resolved) {
+    if (Object.keys(resolved).some((key) => key !== "error") || typeof resolved.error !== "string" || !resolved.error.trim())
+      throw new Error("Workflow resource returned an invalid error.");
+    return { ok: false, error: resolved.error };
+  }
+  const { script, hostCommands } = resolved;
+  if (Object.keys(resolved).some((key) => key !== "script" && key !== "hostCommands") || typeof script !== "string" || !script.trim())
+    throw new Error("Workflow resource returned an invalid expansion.");
+  const resourceId = randomUUID();
+  const permit = createWorkflowResourcePermit({
+    resourceName: resource.name,
+    resourceVersion: resource.version,
+    resourceId,
+    scriptDigest: stableJsonDigest(script),
+    authority: { host: hostCommands }
+  });
+  const provenance = Object.freeze({
+    kind: "workflow",
+    name: resource.name,
+    version: resource.version,
+    invocation: "named",
+    expansion: "resolved",
+    id: resourceId
+  });
+  return { ok: true, resource: { script, permit, provenance } };
+}

package/extensions/dm-subagents/src/workflows/workflow-settlement.js

@@ -152,6 +152,9 @@ export function planWorkflowSettlement(input) {
       resolution = classifyWorkflowSettlement(status);
   }
   const recovery = workflowRecoveryActions(receipt);
+  delete status.workflowReceiptPath;
+  if (receipt && input.receiptPath)
+    status.workflowReceiptPath = input.receiptPath;
   if (receipt) {
     receipt = {
       ...receipt,
@@ -176,6 +179,8 @@ export function planWorkflowSettlement(input) {
     timestamp: now
   };
   const terminal = status.state === "complete" || status.state === "failed" || status.state === "partial" || status.state === "stopped";
+  if (!status.workflowReceiptPath)
+    delete publicResult.workflowReceipt;
   const completionEvent = terminal ? {
     type: "subagent.workflow.completed",
     state: status.state,

package/extensions/dm-web-access/abortable.js

@@ -0,0 +1,19 @@
+export async function awaitWithAbort(operation, signal) {
+  if (!signal)
+    return operation;
+  let onAbort = () => {};
+  const aborted = new Promise((_resolve, reject) => {
+    onAbort = () => reject(new Error("Aborted"));
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted)
+      onAbort();
+  });
+  try {
+    const result = await Promise.race([operation, aborted]);
+    if (signal.aborted)
+      throw new Error("Aborted");
+    return result;
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}

package/extensions/dm-web-access/anysearch.js

@@ -1,5 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.js";
+import { formatSearchResultsAsAnswer } from "./search-answer-formatting.js";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.js";
 import { redactCredential, resolveCredential } from "./credential-source.js";
 import { getWebSearchConfigPath } from "./utils.js";
 const ANYSEARCH_API_URL = "https://api.anysearch.com/v1/search";
@@ -35,11 +37,6 @@ async function getApiKey(signal) {
     signal
   });
 }
-function normalizeCount(value) {
-  if (typeof value !== "number" || !Number.isFinite(value))
-    return 5;
-  return Math.max(1, Math.min(Math.floor(value), 20));
-}
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -84,18 +81,12 @@ function parseResponse(value) {
   }
   return { code: 0, data: { results, metadata: data.metadata } };
 }
-function buildAnswer(results) {
-  return results.map((result) => result.snippet ? `${result.snippet}
-Source: ${result.title} (${result.url})` : `Source: ${result.title} (${result.url})`).join(`
-
-`);
-}
 export function isAnySearchAvailable() {
   return true;
 }
 export async function searchWithAnySearch(query, options = {}) {
   const apiKey = await getApiKey(options.signal);
-  const numResults = normalizeCount(options.numResults);
+  const numResults = normalizeSearchResultCount(options.numResults);
   const body = { query, max_results: numResults };
   const activityId = activityMonitor.logStart({ type: "api", query });
   let response;
@@ -148,7 +139,7 @@ export async function searchWithAnySearch(query, options = {}) {
     url: result.url,
     snippet: result.snippet
   }));
-  const mapped = { answer: buildAnswer(results), results };
+  const mapped = { answer: formatSearchResultsAsAnswer(results), results };
   if (options.includeContent) {
     const inlineContent = data.data.results.slice(0, numResults).filter((result) => result.content.length > 0).map((result) => ({ url: result.url, title: result.title, content: result.content, error: null }));
     if (inlineContent.length > 0)

package/extensions/dm-web-access/baizhi.js

@@ -0,0 +1,123 @@
+import { existsSync, readFileSync } from "node:fs";
+import { isIP } from "node:net";
+import { activityMonitor } from "./activity.js";
+import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.js";
+import { normalizeDomain } from "./domain-filter-normalization.js";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.js";
+import { getWebSearchConfigPath } from "./utils.js";
+const MCP_URL = "https://agent-toolkit.app.baizhi.cloud/mcp";
+const SEARCH_TIMEOUT_MS = 60000;
+const CONFIG_PATH = getWebSearchConfigPath();
+function credentialOptions() {
+  let config = {};
+  if (existsSync(CONFIG_PATH)) {
+    try {
+      const parsed = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error;
+      config = parsed;
+    } catch {
+      throw new Error(`Invalid configuration in ${CONFIG_PATH}: expected a JSON object`);
+    }
+  }
+  return { provider: "Baizhi", configuredValue: config.baizhiApiKey, environmentValue: process.env.BAIZHI_API_KEY };
+}
+export function isBaizhiAvailable() {
+  return hasCredentialSource(credentialOptions());
+}
+function searchArguments(query, options) {
+  if (!query.trim())
+    throw new Error("Baizhi search query must not be empty");
+  const domains = [];
+  const excludeDomains = [];
+  for (const raw of options.domainFilter ?? []) {
+    const bare = raw.trim().replace(/^-/, "").trim();
+    const domain = isIP(bare) ? bare : normalizeDomain(raw);
+    if (!domain)
+      throw new Error("Baizhi domain filter must contain a valid domain");
+    const target = raw.trim().startsWith("-") ? excludeDomains : domains;
+    if (!target.includes(domain))
+      target.push(domain);
+  }
+  return {
+    query: query.trim(),
+    count: normalizeSearchResultCount(options.numResults),
+    need_summary: false,
+    time_range: options.recencyFilter ?? "month",
+    ...domains.length || excludeDomains.length ? { filter: {
+      ...domains.length ? { domains } : {},
+      ...excludeDomains.length ? { exclude_domains: excludeDomains } : {}
+    } } : {}
+  };
+}
+export async function searchWithBaizhi(query, options = {}) {
+  const args = searchArguments(query, options);
+  const timeoutSignal = AbortSignal.timeout(SEARCH_TIMEOUT_MS);
+  const signal = options.signal ? AbortSignal.any([timeoutSignal, options.signal]) : timeoutSignal;
+  if (signal.aborted)
+    throw new Error("Aborted");
+  const apiKey = await resolveCredential({ ...credentialOptions(), signal });
+  if (!apiKey)
+    throw new Error("Baizhi API key not found. Set BAIZHI_API_KEY or baizhiApiKey in web-search.json. Get your own key at https://agent-toolkit.app.baizhi.cloud/");
+  let headers;
+  try {
+    headers = new Headers({ Authorization: `Bearer ${apiKey}` });
+  } catch {
+    throw new Error("Baizhi credential resolution failed: invalid-header-value");
+  }
+  const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([
+    import("@modelcontextprotocol/sdk/client/index.js"),
+    import("@modelcontextprotocol/sdk/client/streamableHttp.js")
+  ]);
+  let cleaningUp = false;
+  const transport = new StreamableHTTPClientTransport(new URL(MCP_URL), {
+    requestInit: { headers },
+    fetch: async (url, init) => {
+      if (String(url) !== MCP_URL)
+        throw new Error("Baizhi endpoint changed unexpectedly");
+      const requestSignal = cleaningUp ? AbortSignal.timeout(1500) : signal;
+      return fetch(url, { ...init, redirect: "error", signal: !cleaningUp && init?.signal ? AbortSignal.any([init.signal, requestSignal]) : requestSignal });
+    },
+    reconnectionOptions: { maxRetries: 0, initialReconnectionDelay: 1000, maxReconnectionDelay: 1000, reconnectionDelayGrowFactor: 1 }
+  });
+  const client = new Client({ name: "dm-web-access-baizhi", version: "1.0.0" });
+  const activityId = activityMonitor.logStart({ type: "api", query });
+  try {
+    await client.connect(transport, { signal, timeout: SEARCH_TIMEOUT_MS });
+    const result = await client.callTool({ name: "websearch_search", arguments: args }, undefined, { signal, timeout: SEARCH_TIMEOUT_MS });
+    if (result.isError)
+      throw new Error("Baizhi search tool returned an error");
+    const parts = [];
+    if (result.structuredContent !== undefined)
+      parts.push(JSON.stringify(result.structuredContent, null, 2));
+    for (const item of Array.isArray(result.content) ? result.content : []) {
+      if (item.type === "text" && typeof item.text === "string" && item.text.trim())
+        parts.push(item.text);
+    }
+    if (!parts.length)
+      throw new Error("Baizhi returned invalid response: no search text or structured content");
+    const answer = redactCredential(redactCredential(parts.join(`
+
+`), apiKey), JSON.stringify(apiKey).slice(1, -1));
+    activityMonitor.logComplete(activityId, 200);
+    return { answer, results: [] };
+  } catch (err) {
+    let message;
+    if (options.signal?.aborted)
+      message = "Aborted";
+    else if (timeoutSignal.aborted)
+      message = "Baizhi request timed out after 60s";
+    else {
+      const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
+      message = typeof code === "number" && Number.isInteger(code) && code >= 400 && code <= 599 ? `Baizhi HTTP ${code} request failed; check your API key, account and service status` : err instanceof TypeError ? "Baizhi network request failed" : err instanceof SyntaxError || code === -32700 || code === -32602 ? "Baizhi returned invalid response" : err instanceof Error && /^Baizhi (search tool returned an error|returned invalid response:)/.test(err.message) ? err.message : "Baizhi MCP request failed; check your connection, API key and account status";
+    }
+    activityMonitor.logError(activityId, message);
+    throw new Error(message);
+  } finally {
+    cleaningUp = true;
+    try {
+      await transport.terminateSession();
+    } catch {}
+    await client.close();
+  }
+}

package/extensions/dm-web-access/bocha.js

@@ -1,5 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.js";
+import { normalizeDomain } from "./domain-filter-normalization.js";
+import { formatSearchResultsAsAnswer } from "./search-answer-formatting.js";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.js";
 import { getWebSearchConfigPath } from "./utils.js";
 const BOCHA_SEARCH_URL = "https://api.bochaai.com/v1/web-search";
@@ -64,23 +66,6 @@ function mapFreshness(value) {
       return "noLimit";
   }
 }
-function normalizeDomain(value) {
-  let input = value.trim().toLowerCase();
-  if (!input)
-    return null;
-  if (input.startsWith("-"))
-    input = input.slice(1).trim();
-  if (!input)
-    return null;
-  try {
-    const parsed = input.includes("://") ? new URL(input) : new URL(`https://${input}`);
-    input = parsed.hostname;
-  } catch {
-    input = input.split("/")[0]?.split(":")[0] ?? "";
-  }
-  input = input.replace(/^\.+|\.+$/g, "");
-  return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(input) ? input : null;
-}
 function parseDomainFilter(domainFilter) {
   const filters = { include: [], exclude: [] };
   for (const raw of domainFilter ?? []) {
@@ -146,12 +131,6 @@ function parseSearchResponse(value) {
   }
   return { results };
 }
-function buildAnswer(results) {
-  return results.map((result) => result.snippet ? `${result.snippet}
-Source: ${result.title} (${result.url})` : `Source: ${result.title} (${result.url})`).join(`
-
-`);
-}
 export function isBochaAvailable() {
   return hasCredentialSource({ provider: "Bocha", configuredValue: loadConfig().bochaApiKey, environmentValue: process.env.BOCHA_API_KEY });
 }
@@ -210,5 +189,5 @@ export async function searchWithBocha(query, options = {}) {
   }
   activityMonitor.logComplete(activityId, response.status);
   const results = parsed.results.filter((result) => passesDomainFilters(result.url, filters)).slice(0, numResults);
-  return { answer: buildAnswer(results), results };
+  return { answer: formatSearchResultsAsAnswer(results), results };
 }

package/extensions/dm-web-access/brave.js

@@ -1,5 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.js";
+import { normalizeDomain } from "./domain-filter-normalization.js";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.js";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.js";
 import { fetchWithCredentialRedirects, getWebSearchConfigPath, resolveApiBaseUrl } from "./utils.js";
 const BRAVE_API_BASE_URL = "https://api.search.brave.com/res/v1";
@@ -39,28 +41,6 @@ function getApiUrl() {
     environmentValue: process.env.BRAVE_BASE_URL
   })}/web/search`;
 }
-function normalizeCount(value) {
-  if (typeof value !== "number" || !Number.isFinite(value))
-    return 5;
-  return Math.max(1, Math.min(Math.floor(value), 20));
-}
-function normalizeDomain(value) {
-  let input = value.trim().toLowerCase();
-  if (!input)
-    return null;
-  if (input.startsWith("-"))
-    input = input.slice(1).trim();
-  if (!input)
-    return null;
-  try {
-    const parsed = input.includes("://") ? new URL(input) : new URL(`https://${input}`);
-    input = parsed.hostname;
-  } catch {
-    input = input.split("/")[0]?.split(":")[0] ?? "";
-  }
-  input = input.replace(/^\.+|\.+$/g, "");
-  return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(input) ? input : null;
-}
 function normalizeDomainFilters(domainFilter) {
   const filters = { allowed: [], blocked: [] };
   if (!domainFilter?.length)
@@ -121,7 +101,7 @@ export async function searchWithBrave(query, options = {}) {
 ` + `  2. Set BRAVE_API_KEY environment variable
 ` + "Get a key at https://brave.com/search/api/");
   }
-  const numResults = normalizeCount(options.numResults);
+  const numResults = normalizeSearchResultCount(options.numResults);
   const domainFilters = normalizeDomainFilters(options.domainFilter);
   const searchQuery = buildBraveQuery(query, options.domainFilter);
   const activityId = activityMonitor.logStart({ type: "api", query: searchQuery });

package/extensions/dm-web-access/brightdata.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.js";
+import { normalizeDomain } from "./domain-filter-normalization.js";
+import { formatSearchResultsAsAnswer } from "./search-answer-formatting.js";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.js";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.js";
 import { getWebSearchConfigPath } from "./utils.js";
 const BRIGHTDATA_API_URL = "https://api.brightdata.com/request";
@@ -92,28 +95,6 @@ function requireSerpZone() {
 ` + `  2. Set BRIGHTDATA_SERP_ZONE environment variable
 ` + "The zone must be of Bright Data type `serp`; a Web Unlocker zone is a different product and does not return SERP JSON.\n" + "Create one at https://brightdata.com/cp/zones");
 }
-function normalizeCount(value) {
-  if (typeof value !== "number" || !Number.isFinite(value))
-    return 5;
-  return Math.max(1, Math.min(Math.floor(value), 20));
-}
-function normalizeDomain(value) {
-  let input = value.trim().toLowerCase();
-  if (!input)
-    return null;
-  if (input.startsWith("-"))
-    input = input.slice(1).trim();
-  if (!input)
-    return null;
-  try {
-    const parsed = input.includes("://") ? new URL(input) : new URL(`https://${input}`);
-    input = parsed.hostname;
-  } catch {
-    input = input.split("/")[0]?.split(":")[0] ?? "";
-  }
-  input = input.replace(/^\.+|\.+$/g, "");
-  return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(input) ? input : null;
-}
 function parseDomainFilter(domainFilter) {
   const filters = { include: [], exclude: [] };
   if (!domainFilter?.length)
@@ -246,12 +227,6 @@ function mapResults(organic, numResults, filters) {
   }
   return mapped;
 }
-function buildAnswer(results) {
-  return results.map((result) => result.snippet ? `${result.snippet}
-Source: ${result.title} (${result.url})` : `Source: ${result.title} (${result.url})`).join(`
-
-`);
-}
 export function isBrightDataAvailable() {
   try {
     if (getSerpZone() === null)
@@ -268,7 +243,7 @@ export function isBrightDataAvailable() {
 export async function searchWithBrightData(query, options = {}) {
   const zone = requireSerpZone();
   const apiKey = await requireApiKey(options.signal);
-  const numResults = normalizeCount(options.numResults);
+  const numResults = normalizeSearchResultCount(options.numResults);
   const filters = parseDomainFilter(options.domainFilter);
   const searchQuery = buildSearchQuery(query, filters);
   const body = {
@@ -330,5 +305,5 @@ export async function searchWithBrightData(query, options = {}) {
   }
   activityMonitor.logComplete(activityId, response.status);
   const results = mapResults(data.organic, numResults, filters);
-  return { answer: buildAnswer(results), results };
+  return { answer: formatSearchResultsAsAnswer(results), results };
 }