@herbertgao/pi-extensions 2026.8.11 → 2026.8.13

package/node_modules/pi-web-access/kimi-search.ts

@@ -0,0 +1,234 @@
+import { randomUUID } from "node:crypto";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { activityMonitor } from "./activity.ts";
+import { redactCredential } from "./credential-source.ts";
+import type { SearchOptions, SearchResponse, SearchResult } from "./perplexity.ts";
+
+const KIMI_SEARCH_URL = "https://api.kimi.com/coding/v1/search";
+const KIMI_PROVIDERS = ["kimi-coding", "kimi-code"] as const;
+const SEARCH_TIMEOUT_MS = 30_000;
+
+type ProviderHeaders = Record<string, string | null>;
+
+interface KimiAuth {
+	apiKey: string;
+	headers: ProviderHeaders;
+}
+
+interface NormalizedDomainFilters {
+	allowed: string[];
+	blocked: string[];
+}
+
+function buildRequestHeaders(auth: KimiAuth): Headers {
+	const headers = new Headers();
+	for (const [name, value] of Object.entries(auth.headers)) {
+		if (value !== null) headers.set(name, value);
+	}
+	headers.set("Authorization", `Bearer ${auth.apiKey}`);
+	headers.set("Content-Type", "application/json");
+	headers.set("X-Msh-Tool-Call-Id", randomUUID());
+	return headers;
+}
+
+function bearerToken(headers: ProviderHeaders): string | undefined {
+	for (const [name, value] of Object.entries(headers)) {
+		if (name.toLowerCase() !== "authorization" || typeof value !== "string") continue;
+		const match = /^Bearer\s+(.+)$/i.exec(value.trim());
+		if (match?.[1]) return match[1];
+	}
+	return undefined;
+}
+
+async function resolveKimiAuth(ctx?: ExtensionContext): Promise<KimiAuth | undefined> {
+	if (!ctx) return undefined;
+
+	const models = ctx.modelRegistry.getAll();
+	let firstError: unknown;
+
+	for (const provider of KIMI_PROVIDERS) {
+		for (const model of models) {
+			if (model.provider !== provider) continue;
+			let resolved: Awaited<ReturnType<typeof ctx.modelRegistry.getApiKeyAndHeaders>>;
+			try {
+				resolved = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+			} catch (err) {
+				firstError ??= err;
+				continue;
+			}
+			if (!resolved.ok) continue;
+			const headers = resolved.headers ?? {};
+			const apiKey = resolved.apiKey || bearerToken(headers);
+			if (apiKey) return { apiKey, headers };
+		}
+	}
+	if (firstError) throw firstError;
+	return undefined;
+}
+
+function normalizeCount(value: number | undefined): number {
+	if (typeof value !== "number" || !Number.isFinite(value)) return 5;
+	return Math.max(1, Math.min(Math.floor(value), 20));
+}
+
+function normalizeDomain(value: string): string | null {
+	let input = value.trim().toLowerCase();
+	if (!input) return null;
+	if (input.startsWith("-")) input = input.slice(1).trim();
+	if (!input) return null;
+	try {
+		const parsed = input.includes("://") ? new URL(input) : new URL(`https://${input}`);
+		input = parsed.hostname;
+	} catch {
+		input = input.split("/")[0]?.split(":")[0] ?? "";
+	}
+	input = input.replace(/^\.+|\.+$/g, "");
+	return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(input) ? input : null;
+}
+
+function normalizeDomainFilters(domainFilter: string[] | undefined): NormalizedDomainFilters {
+	const filters: NormalizedDomainFilters = { allowed: [], blocked: [] };
+	if (!domainFilter?.length) return filters;
+
+	for (const raw of domainFilter) {
+		const domain = normalizeDomain(raw);
+		if (!domain) continue;
+		const target = raw.trim().startsWith("-") ? filters.blocked : filters.allowed;
+		if (!target.includes(domain)) target.push(domain);
+	}
+	return filters;
+}
+
+function hostMatchesDomain(hostname: string, domain: string): boolean {
+	return hostname === domain || hostname.endsWith(`.${domain}`);
+}
+
+function matchesDomainFilters(url: string, filters: NormalizedDomainFilters): boolean {
+	if (filters.allowed.length === 0 && filters.blocked.length === 0) return true;
+
+	let hostname = "";
+	try {
+		hostname = new URL(url).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (filters.allowed.length > 0 && !filters.allowed.some((domain) => hostMatchesDomain(hostname, domain))) {
+		return false;
+	}
+	return !filters.blocked.some((domain) => hostMatchesDomain(hostname, domain));
+}
+
+function normalizeResultUrl(value: unknown): string | null {
+	if (typeof value !== "string") return null;
+	const input = value.trim();
+	if (!input) return null;
+	try {
+		const url = new URL(input);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+		return url.href;
+	} catch {
+		return null;
+	}
+}
+
+function parseResults(value: unknown, options: SearchOptions): SearchResult[] {
+	if (!value || typeof value !== "object" || !Array.isArray((value as { search_results?: unknown }).search_results)) {
+		throw new Error("Kimi Code search API returned an invalid response: search_results must be an array");
+	}
+
+	const filters = normalizeDomainFilters(options.domainFilter);
+	const numResults = normalizeCount(options.numResults);
+	const results: SearchResult[] = [];
+	for (const item of (value as { search_results: unknown[] }).search_results) {
+		if (!item || typeof item !== "object") continue;
+		const record = item as Record<string, unknown>;
+		const url = normalizeResultUrl(record.url);
+		if (!url || !matchesDomainFilters(url, filters)) continue;
+		results.push({
+			title: typeof record.title === "string" && record.title.trim() ? record.title : url,
+			url,
+			snippet: typeof record.snippet === "string" ? record.snippet : "",
+		});
+		if (results.length >= numResults) break;
+	}
+	return results;
+}
+
+function formatAnswer(results: SearchResult[]): string {
+	return results
+		.map((result) => result.snippet
+			? `${result.snippet}\nSource: ${result.title} (${result.url})`
+			: `Source: ${result.title} (${result.url})`)
+		.join("\n\n");
+}
+
+export async function isKimiSearchAvailable(ctx?: ExtensionContext): Promise<boolean> {
+	try {
+		return !!(await resolveKimiAuth(ctx));
+	} catch {
+		return false;
+	}
+}
+
+export async function searchWithKimi(
+	query: string,
+	options: SearchOptions = {},
+	ctx?: ExtensionContext,
+): Promise<SearchResponse> {
+	const auth = await resolveKimiAuth(ctx);
+	if (!auth) {
+		throw new Error("Kimi Code web search unavailable. Run /login kimi-coding to authenticate a Kimi Code Plan account.");
+	}
+
+	const activityId = activityMonitor.logStart({ type: "api", query });
+	const timeoutSignal = AbortSignal.timeout(SEARCH_TIMEOUT_MS);
+	const requestSignal = options.signal
+		? AbortSignal.any([timeoutSignal, options.signal])
+		: timeoutSignal;
+	try {
+		const response = await fetch(KIMI_SEARCH_URL, {
+			method: "POST",
+			headers: buildRequestHeaders(auth),
+			body: JSON.stringify({ text_query: query }),
+			signal: requestSignal,
+		});
+
+		if (!response.ok) {
+			activityMonitor.logError(activityId, `HTTP ${response.status}`);
+			const errorText = redactCredential(await response.text(), auth.apiKey);
+			throw new Error(`Kimi Code search API error ${response.status}: ${errorText.slice(0, 300)}`);
+		}
+
+		let parsed: unknown;
+		try {
+			parsed = await response.json();
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(`Kimi Code search API returned invalid JSON: ${message}`);
+		}
+		const results = parseResults(parsed, options);
+		if (results.length === 0) {
+			throw new Error("Kimi Code search API returned no results");
+		}
+
+		activityMonitor.logComplete(activityId, response.status);
+		return { answer: formatAnswer(results), results };
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		const redactedMessage = redactCredential(message, auth.apiKey);
+		if (options.signal?.aborted) {
+			activityMonitor.logComplete(activityId, 0);
+		} else if (timeoutSignal.aborted || (err instanceof Error && err.name === "TimeoutError")) {
+			activityMonitor.logError(activityId, "Kimi Code search API timed out");
+			throw new Error("Kimi Code search API timed out");
+		} else if (redactedMessage.toLowerCase().includes("abort")) {
+			activityMonitor.logComplete(activityId, 0);
+		} else {
+			activityMonitor.logError(activityId, redactedMessage);
+		}
+		if (redactedMessage === message) throw err;
+		const redactedError = new Error(redactedMessage);
+		if (err instanceof Error) redactedError.name = err.name;
+		throw redactedError;
+	}
+}

package/node_modules/pi-web-access/openai-search.ts

@@ -47,6 +47,47 @@ interface OpenAIAuth {
 	model: string;
 	headers: ProviderHeaders;
 	responsesUrl: string;
+	useCodexEndpoint?: boolean;
+}
+
+type CurrentModel = NonNullable<ExtensionContext["model"]>;
+
+interface CurrentModelSearchTarget {
+	responsesUrl: string;
+	useCodexEndpoint: boolean;
+}
+
+function resolveCurrentModelSearchTarget(model: CurrentModel): CurrentModelSearchTarget {
+	const url = new URL(model.baseUrl);
+	if (url.protocol !== "https:") throw new Error("Current model base URL must use HTTPS");
+
+	if (model.provider === "openai" && model.api === "openai-responses" && url.hostname.toLowerCase() === "api.openai.com") {
+		const pathname = url.pathname.replace(/\/+$/u, "");
+		url.pathname = `${pathname}/responses`;
+		return { responsesUrl: url.toString(), useCodexEndpoint: false };
+	}
+
+	if (
+		model.provider === "openai-codex" &&
+		model.api === "openai-codex-responses" &&
+		url.hostname.toLowerCase() === "chatgpt.com" &&
+		url.pathname.replace(/\/+$/u, "") === "/backend-api"
+	) {
+		return { responsesUrl: CODEX_RESPONSES_URL, useCodexEndpoint: true };
+	}
+
+	throw new Error("Current model is not backed by an official OpenAI Responses endpoint");
+}
+
+export function isCurrentModelHostedSearchEligible(ctx?: Pick<ExtensionContext, "model">): boolean {
+	const model = ctx?.model;
+	if (!model || !/^gpt-/iu.test(model.id)) return false;
+	try {
+		resolveCurrentModelSearchTarget(model);
+		return true;
+	} catch {
+		return false;
+	}
 }
 
 interface NormalizedDomainFilters {
@@ -240,6 +281,26 @@ export async function isOpenAISearchAvailable(ctx?: ExtensionContext): Promise<b
 	});
 }
 
+async function resolveCurrentModelAuth(ctx: ExtensionContext, signal?: AbortSignal): Promise<OpenAIAuth> {
+	const model = ctx.model;
+	if (!model || !isCurrentModelHostedSearchEligible(ctx)) {
+		throw new Error("Current model is not eligible for official OpenAI Hosted web search");
+	}
+	const target = resolveCurrentModelSearchTarget(model);
+	const resolved = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+	if (signal?.aborted) signal.throwIfAborted();
+	if (!resolved.ok) throw new Error(`OpenAI current model authentication failed: ${resolved.error}`);
+	if (!resolved.apiKey) throw new Error("OpenAI current model authentication failed: API key unavailable");
+	return {
+		provider: "openai",
+		apiKey: resolved.apiKey,
+		model: model.id,
+		headers: resolved.headers ?? {},
+		responsesUrl: target.responsesUrl,
+		useCodexEndpoint: target.useCodexEndpoint,
+	};
+}
+
 function buildInstructions(options: SearchOptions): string {
 	const lines = [
 		"Search the web and return a concise answer grounded only in the web results.",
@@ -279,14 +340,26 @@ function buildWebSearchTool(options: SearchOptions): Record<string, unknown> {
 	return tool;
 }
 
-async function parseOpenAIResponse(response: Response): Promise<Record<string, unknown>> {
+interface ParsedOpenAIResponse {
+	payload: Record<string, unknown>;
+	webSearchCallSeen: boolean;
+}
+
+function isWebSearchCall(item: unknown): boolean {
+	return !!item && typeof item === "object" && (item as { type?: unknown }).type === "web_search_call";
+}
+
+async function parseOpenAIResponse(response: Response): Promise<ParsedOpenAIResponse> {
 	const text = await response.text();
 	const trimmed = text.trim();
 	if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
 		try {
 			const parsed = JSON.parse(trimmed);
-			if (Array.isArray(parsed)) return { output: parsed };
-			return parsed && typeof parsed === "object" ? parsed as Record<string, unknown> : { output: [] };
+			const payload = Array.isArray(parsed)
+				? { output: parsed }
+				: parsed && typeof parsed === "object" ? parsed as Record<string, unknown> : { output: [] };
+			const output = Array.isArray(payload.output) ? payload.output : [];
+			return { payload, webSearchCallSeen: output.some(isWebSearchCall) };
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
 			throw new Error(`OpenAI API returned invalid JSON: ${message}`);
@@ -295,13 +368,18 @@ async function parseOpenAIResponse(response: Response): Promise<Record<string, u
 
 	const outputItems: unknown[] = [];
 	let completedResponse: Record<string, unknown> | null = null;
+	let webSearchCallSeen = false;
 	for (const line of text.split("\n")) {
 		if (!line.startsWith("data: ")) continue;
 		const data = line.slice(6).trim();
 		if (!data || data === "[DONE]") continue;
 		try {
 			const parsed = JSON.parse(data) as Record<string, unknown>;
-			if (parsed.type === "response.output_item.done" && parsed.item) outputItems.push(parsed.item);
+			if (typeof parsed.type === "string" && parsed.type.startsWith("response.web_search_call")) webSearchCallSeen = true;
+			if (parsed.type === "response.output_item.done" && parsed.item) {
+				outputItems.push(parsed.item);
+				webSearchCallSeen ||= isWebSearchCall(parsed.item);
+			}
 			if ((parsed.type === "response.done" || parsed.type === "response.completed") && parsed.response && typeof parsed.response === "object") {
 				completedResponse = parsed.response as Record<string, unknown>;
 			}
@@ -311,9 +389,10 @@ async function parseOpenAIResponse(response: Response): Promise<Record<string, u
 
 	if (completedResponse) {
 		const output = Array.isArray(completedResponse.output) ? completedResponse.output : [];
-		return output.length > 0 ? completedResponse : { ...completedResponse, output: outputItems };
+		const payload = output.length > 0 ? completedResponse : { ...completedResponse, output: outputItems };
+		return { payload, webSearchCallSeen: webSearchCallSeen || output.some(isWebSearchCall) };
 	}
-	if (outputItems.length > 0) return { output: outputItems };
+	if (outputItems.length > 0) return { payload: { output: outputItems }, webSearchCallSeen: webSearchCallSeen || outputItems.some(isWebSearchCall) };
 	throw new Error("OpenAI API returned no parseable response output");
 }
 
@@ -411,21 +490,11 @@ function extractAnswer(output: unknown[]): string {
 	return parts.join("\n").trim();
 }
 
-export async function searchWithOpenAI(
+async function runOpenAISearch(
 	query: string,
-	options: SearchOptions = {},
-	ctx?: ExtensionContext,
+	options: SearchOptions,
+	auth: OpenAIAuth,
 ): Promise<SearchResponse> {
-	const auth = await resolveOpenAIAuth(ctx, options.signal);
-	if (!auth) {
-		throw new Error(
-			"OpenAI web search unavailable. Either:\n" +
-			"  1. Use /login to sign in with a Codex subscription\n" +
-			`  2. Create ${CONFIG_PATH} with { "openaiApiKey": "your-key" }\n` +
-			"  3. Set OPENAI_API_KEY environment variable",
-		);
-	}
-
 	const activityId = activityMonitor.logStart({ type: "api", query });
 	const headers: Record<string, string> = {
 		...toRequestHeaders(auth.headers),
@@ -433,7 +502,7 @@ export async function searchWithOpenAI(
 		"Content-Type": "application/json",
 		"OpenAI-Beta": "responses=experimental",
 	};
-	const useCodexEndpoint = auth.provider === "openai-codex" || isCodexJwt(auth.apiKey);
+	const useCodexEndpoint = auth.useCodexEndpoint ?? (auth.provider === "openai-codex" || isCodexJwt(auth.apiKey));
 	if (useCodexEndpoint) {
 		const accountId = extractAccountId(auth.apiKey);
 		if (accountId) headers["chatgpt-account-id"] = accountId;
@@ -469,7 +538,8 @@ export async function searchWithOpenAI(
 		}
 
 		const parsed = await parseOpenAIResponse(response);
-		const output = Array.isArray(parsed.output) ? parsed.output : [];
+		const output = Array.isArray(parsed.payload.output) ? parsed.payload.output : [];
+		if (!parsed.webSearchCallSeen) throw new Error("OpenAI web_search returned no web_search_call");
 		const answer = extractAnswer(output);
 		const results = extractSearchResults(output, options.numResults);
 
@@ -493,3 +563,30 @@ export async function searchWithOpenAI(
 		throw redactedError;
 	}
 }
+
+export async function searchWithOpenAI(
+	query: string,
+	options: SearchOptions = {},
+	ctx?: ExtensionContext,
+): Promise<SearchResponse> {
+	const auth = await resolveOpenAIAuth(ctx, options.signal);
+	if (!auth) {
+		throw new Error(
+			"OpenAI web search unavailable. Either:\n" +
+			"  1. Use /login to sign in with a Codex subscription\n" +
+			`  2. Create ${CONFIG_PATH} with { "openaiApiKey": "your-key" }\n` +
+			"  3. Set OPENAI_API_KEY environment variable",
+		);
+	}
+	return runOpenAISearch(query, options, auth);
+}
+
+export async function searchWithCurrentModelOpenAI(
+	query: string,
+	options: SearchOptions = {},
+	ctx?: ExtensionContext,
+): Promise<SearchResponse> {
+	if (!ctx) throw new Error("OpenAI current-model search requires an extension context");
+	const auth = await resolveCurrentModelAuth(ctx, options.signal);
+	return runOpenAISearch(query, options, auth);
+}

package/node_modules/pi-web-access/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-web-access",
-  "version": "0.24.2",
-  "description": "Web search, URL fetching, GitHub repo cloning, PDF extraction, YouTube video understanding, and local video analysis for Pi coding agent. Supports OpenAI, Brave, Parallel, TinyFish, Search1API, Searchinfinity, Querit, Tavily, Firecrawl, Jina, SERPdive, Kagi, Ollama, AnySearch, Bright Data SERP, SerpBase, SearXNG, Exa, Perplexity, and Gemini.",
+  "version": "0.25.0",
+  "description": "Web search, URL fetching, GitHub repo cloning, PDF extraction, YouTube video understanding, and local video analysis for Pi coding agent. Supports OpenAI, Brave, Parallel, TinyFish, Search1API, Searchinfinity, Querit, Tavily, Firecrawl, Jina, SERPdive, Kagi, Ollama, AnySearch, Bright Data SERP, SerpBase, SearXNG, Exa, Perplexity, Gemini, and Kimi.",
   "type": "module",
   "scripts": {
     "test": "node --test",
@@ -45,6 +45,7 @@
   },
   "dependencies": {
     "@mozilla/readability": "^0.6.0",
+    "defuddle": "0.19.3",
     "linkedom": "^0.16.0",
     "p-limit": "^6.1.0",
     "promise.try": "^2.0.1",

package/node_modules/pi-web-access/ssrf-protection.ts

@@ -1,7 +1,7 @@
 import { lookup as dnsLookup } from "node:dns/promises";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import net from "node:net";
-import { getWebSearchConfigPath } from "./utils.ts";
+import { getActiveProxy, getWebSearchConfigPath, hasScopedProxyDecision, isProxyBypassedUrl } from "./utils.ts";
 
 const DEFAULT_MAX_REDIRECTS = 5;
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
@@ -329,6 +329,9 @@ function hostnameMatchesNoProxy(hostname: string, port: string, entry: string):
 
 function shouldTrustEnvProxy(url: URL, enabled: boolean): boolean {
 	if (!enabled || !getProxyForProtocol(url.protocol)) return false;
+	if (hasScopedProxyDecision()) return false;
+	const activeProxy = getActiveProxy();
+	if (activeProxy && !isProxyBypassedUrl(url)) return false;
 	const hostname = normalizeHostname(url.hostname);
 	const port = url.port || (url.protocol === "https:" ? "443" : "80");
 	const noProxy = process.env.NO_PROXY || process.env.no_proxy || "";