@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-web-access/anysearch.ts

@@ -103,9 +103,11 @@ function parseResponse(value: unknown): AnySearchResponse {
 		if (typeof title !== "string") throw invalidResponse(`expected data.results[${index}].title string`);
 		if (typeof url !== "string") throw invalidResponse(`expected data.results[${index}].url string`);
 		if (typeof snippet !== "string") throw invalidResponse(`expected data.results[${index}].snippet string`);
-		if (typeof content !== "string") throw invalidResponse(`expected data.results[${index}].content string`);
+		if (content !== undefined && content !== null && typeof content !== "string") {
+			throw invalidResponse(`expected data.results[${index}].content string`);
+		}
 		if (!url) throw invalidResponse(`expected data.results[${index}].url to be non-empty`);
-		results.push({ title, url, snippet, content });
+		results.push({ title, url, snippet, content: typeof content === "string" ? content : "" });
 	}
 
 	return { code: 0, data: { results, metadata: data.metadata as Record<string, unknown> } };

package/node_modules/pi-web-access/auth-fetch.ts

@@ -0,0 +1,148 @@
+import { existsSync, readFileSync } from "node:fs";
+import { getWebSearchConfigPath } from "./utils.ts";
+
+const WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();
+const AUTH_PROFILE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+
+export type AuthFetchRequest = true | string;
+export type AuthFetchCache = "session" | "off";
+
+export interface AuthFetchProfile {
+	name: string;
+	hosts: string[];
+	chromeProfile?: string;
+	redirects: "same-origin";
+	cache: AuthFetchCache;
+}
+
+interface AuthFetchConfigRoot {
+	authFetch?: unknown;
+}
+
+export function resolveAuthFetchProfile(request: AuthFetchRequest): AuthFetchProfile {
+	const profiles = loadAuthFetchProfiles();
+	if (profiles.length === 0) {
+		throw new Error(`auth requires at least one authFetch profile in ${WEB_SEARCH_CONFIG_PATH}`);
+	}
+	if (request === true) {
+		if (profiles.length !== 1) {
+			throw new Error("auth: true requires exactly one authFetch profile; use a profile name instead");
+		}
+		return profiles[0];
+	}
+	const name = request.trim();
+	const profile = profiles.find(candidate => candidate.name === name);
+	if (!profile) throw new Error(`Unknown authFetch profile: ${name}`);
+	return profile;
+}
+
+export function assertAuthFetchUrl(profile: AuthFetchProfile, rawUrl: string): URL {
+	let url: URL;
+	try {
+		url = new URL(rawUrl);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Authenticated fetch requires an HTTPS URL: ${message}`);
+	}
+	if (url.protocol !== "https:") throw new Error("Authenticated fetch requires an HTTPS URL");
+	const hostname = normalizeHostname(url.hostname);
+	if (!profile.hosts.some(host => hostMatches(hostname, host))) {
+		throw new Error(`URL host ${hostname} is not allowed by authFetch profile ${profile.name}`);
+	}
+	return url;
+}
+
+export function authFetchRedirectGuard(profile: AuthFetchProfile, from: URL, to: URL): void {
+	if (profile.redirects === "same-origin" && to.origin !== from.origin) {
+		throw new Error(`Authenticated fetch refused cross-origin redirect: ${from.origin} -> ${to.origin}`);
+	}
+}
+
+function loadAuthFetchProfiles(): AuthFetchProfile[] {
+	if (!existsSync(WEB_SEARCH_CONFIG_PATH)) return [];
+	const raw = readFileSync(WEB_SEARCH_CONFIG_PATH, "utf-8");
+	let parsed: AuthFetchConfigRoot;
+	try {
+		const value: unknown = JSON.parse(raw);
+		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("expected a JSON object");
+		parsed = value as AuthFetchConfigRoot;
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);
+	}
+	if (parsed.authFetch === undefined || parsed.authFetch === null) return [];
+	if (typeof parsed.authFetch !== "object" || Array.isArray(parsed.authFetch)) {
+		throw new Error(`authFetch in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
+	}
+	return Object.entries(parsed.authFetch as Record<string, unknown>).map(([name, value]) => parseProfile(name, value));
+}
+
+function parseProfile(name: string, value: unknown): AuthFetchProfile {
+	if (!AUTH_PROFILE_NAME_PATTERN.test(name)) {
+		throw new Error(`authFetch profile name ${JSON.stringify(name)} must start with a letter and contain only letters, numbers, underscores, or hyphens`);
+	}
+	if (Array.isArray(value)) {
+		return { name, hosts: parseHosts(value, `authFetch.${name}`), redirects: "same-origin", cache: "session" };
+	}
+	if (!value || typeof value !== "object") {
+		throw new Error(`authFetch.${name} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hosts or an object`);
+	}
+	const config = value as Record<string, unknown>;
+	if (!Array.isArray(config.hosts)) {
+		throw new Error(`authFetch.${name}.hosts in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+	}
+	const redirects = config.redirects ?? "same-origin";
+	if (redirects !== "same-origin") {
+		throw new Error(`authFetch.${name}.redirects in ${WEB_SEARCH_CONFIG_PATH} must be "same-origin"`);
+	}
+	const cache = config.cache ?? "session";
+	if (cache !== "session" && cache !== "off") {
+		throw new Error(`authFetch.${name}.cache in ${WEB_SEARCH_CONFIG_PATH} must be "session" or "off"`);
+	}
+	const chromeProfile = parseChromeProfile(config.chromeProfile, `authFetch.${name}.chromeProfile`);
+	return {
+		name,
+		hosts: parseHosts(config.hosts, `authFetch.${name}.hosts`),
+		...(chromeProfile ? { chromeProfile } : {}),
+		redirects,
+		cache,
+	};
+}
+
+function parseHosts(value: unknown[], label: string): string[] {
+	if (value.length === 0) throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+	const hosts = value.map((entry) => {
+		if (typeof entry !== "string") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames`);
+		return parseHost(entry, label);
+	});
+	return [...new Set(hosts)];
+}
+
+function parseHost(value: string, label: string): string {
+	const host = normalizeHostname(value.trim());
+	if (!host || host.startsWith(".") || host.endsWith(".") || /\s|[\\/?:#@*]/.test(host)) {
+		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+	}
+	if (host.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(host)) {
+		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+	}
+	return host;
+}
+
+function parseChromeProfile(value: unknown, label: string): string | undefined {
+	if (value === undefined || value === null) return undefined;
+	if (typeof value !== "string") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a string`);
+	const normalized = value.trim();
+	if (!normalized || normalized === "." || normalized === ".." || normalized.includes("/") || normalized.includes("\\")) {
+		throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a profile directory name, not a path`);
+	}
+	return normalized;
+}
+
+function normalizeHostname(hostname: string): string {
+	return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+
+function hostMatches(hostname: string, allowedHost: string): boolean {
+	return hostname === allowedHost || hostname.endsWith(`.${allowedHost}`);
+}

package/node_modules/pi-web-access/brave.ts

@@ -2,14 +2,15 @@ import { existsSync, readFileSync } from "node:fs";
 import { activityMonitor } from "./activity.ts";
 import type { SearchOptions, SearchResult, SearchResponse } from "./perplexity.ts";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.ts";
-import { getWebSearchConfigPath } from "./utils.ts";
+import { fetchWithCredentialRedirects, getWebSearchConfigPath, resolveApiBaseUrl } from "./utils.ts";
 
-const BRAVE_API_URL = "https://api.search.brave.com/res/v1/web/search";
+const BRAVE_API_BASE_URL = "https://api.search.brave.com/res/v1";
 const CONFIG_PATH = getWebSearchConfigPath();
 const SEARCH_TIMEOUT_MS = 30_000;
 
 interface WebSearchConfig {
 	braveApiKey?: unknown;
+	braveBaseUrl?: unknown;
 }
 
 interface NormalizedDomainFilters {
@@ -45,6 +46,16 @@ async function getApiKey(signal?: AbortSignal): Promise<string | null> {
 	});
 }
 
+function getApiUrl(): string {
+	return `${resolveApiBaseUrl({
+		configKey: "braveBaseUrl",
+		configuredValue: loadConfig().braveBaseUrl,
+		defaultValue: BRAVE_API_BASE_URL,
+		environmentKey: "BRAVE_BASE_URL",
+		environmentValue: process.env.BRAVE_BASE_URL,
+	})}/web/search`;
+}
+
 function normalizeCount(value: number | undefined): number {
 	if (typeof value !== "number" || !Number.isFinite(value)) return 5;
 	return Math.max(1, Math.min(Math.floor(value), 20));
@@ -129,6 +140,7 @@ export async function searchWithBrave(
 	query: string,
 	options: SearchOptions = {},
 ): Promise<SearchResponse> {
+	const apiUrl = getApiUrl();
 	const apiKey = await getApiKey(options.signal);
 	if (!apiKey) {
 		throw new Error(
@@ -160,7 +172,7 @@ export async function searchWithBrave(
 	}
 
 	try {
-		const response = await fetch(`${BRAVE_API_URL}?${params.toString()}`, {
+		const response = await fetchWithCredentialRedirects(`${apiUrl}?${params.toString()}`, {
 			method: "GET",
 			headers: {
 				"X-Subscription-Token": apiKey,
@@ -170,7 +182,7 @@ export async function searchWithBrave(
 			signal: options.signal
 				? AbortSignal.any([AbortSignal.timeout(SEARCH_TIMEOUT_MS), options.signal])
 				: AbortSignal.timeout(SEARCH_TIMEOUT_MS),
-		});
+		}, ["X-Subscription-Token"]);
 
 		if (!response.ok) {
 			activityMonitor.logError(activityId, `HTTP ${response.status}`);

package/node_modules/pi-web-access/chrome-cookies.ts

@@ -1,7 +1,7 @@
 import { execFile } from "node:child_process";
 import { pbkdf2Sync, createDecipheriv } from "node:crypto";
 import { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from "node:fs";
-import { tmpdir, homedir, platform } from "node:os";
+import { tmpdir, homedir } from "node:os";
 import { isAbsolute, join, sep } from "node:path";
 import { isBrowserCookieAccessAllowed } from "./gemini-web-config.ts";
 
@@ -18,6 +18,12 @@ interface BrowserConfig {
 type SqliteRow = Record<string, unknown>;
 type SqliteFailure = "unavailable" | "query";
 
+interface BrowserCookieEntry {
+	name: string;
+	value: string;
+	path: string;
+}
+
 const GOOGLE_ORIGINS = [
 	"https://gemini.google.com",
 	"https://accounts.google.com",
@@ -33,6 +39,7 @@ const ALL_COOKIE_NAMES = new Set([
 const MACOS_BROWSER_CONFIGS: BrowserConfig[] = [
 	{ name: "Helium", baseDir: "Library/Application Support/net.imput.helium", keychainService: "Helium Storage Key", keychainAccount: "Helium" },
 	{ name: "Chrome", baseDir: "Library/Application Support/Google/Chrome", keychainService: "Chrome Safe Storage", keychainAccount: "Chrome" },
+	{ name: "Brave", baseDir: "Library/Application Support/BraveSoftware/Brave-Browser", keychainService: "Brave Safe Storage", keychainAccount: "Brave" },
 	{ name: "Arc", baseDir: "Library/Application Support/Arc/User Data", keychainService: "Arc Safe Storage", keychainAccount: "Arc" },
 ];
 
@@ -50,16 +57,32 @@ export function getLastGoogleCookieDiagnostic(): string | null {
 	return lastCookieDiagnostic;
 }
 
+export function getLastBrowserCookieDiagnostic(): string | null {
+	return lastCookieDiagnostic;
+}
+
 export async function getGoogleCookies(
 	options?: { profile?: string; requiredCookies?: string[] },
 ): Promise<{ cookies: CookieMap; warnings: string[] } | null> {
+	return getBrowserCookiesForHosts({
+		hosts: GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname),
+		profile: options?.profile,
+		requiredCookies: options?.requiredCookies,
+		cookieNames: ALL_COOKIE_NAMES,
+		requiredLabel: "Gemini",
+	});
+}
+
+export async function getBrowserCookiesForHosts(
+	options: { hosts: string[]; profile?: string; requiredCookies?: string[]; cookieNames?: Iterable<string>; requiredLabel?: string; requestUrl?: URL },
+): Promise<{ cookies: CookieMap; warnings: string[]; cookieHeader?: string } | null> {
 	lastCookieDiagnostic = null;
 	if (!isBrowserCookieAccessAllowed()) {
-		lastCookieDiagnostic = "Browser cookie access is disabled; enable allowBrowserCookies to use Gemini Web cookies.";
+		lastCookieDiagnostic = "Browser cookie access is disabled; enable allowBrowserCookies to use browser cookies.";
 		return null;
 	}
 
-	const currentPlatform = platform();
+	const currentPlatform = process.platform;
 	const configs = currentPlatform === "darwin" ? MACOS_BROWSER_CONFIGS : currentPlatform === "linux" ? LINUX_BROWSER_CONFIGS : [];
 	if (configs.length === 0) {
 		lastCookieDiagnostic = "Chromium cookie extraction is unsupported on this platform.";
@@ -67,17 +90,23 @@ export async function getGoogleCookies(
 	}
 
 	const warningSet = new Set<string>();
-	const rawProfile = typeof options?.profile === "string" ? options.profile.trim() : "";
-	const requestedProfile = normalizeProfileName(options?.profile);
+	const rawProfile = typeof options.profile === "string" ? options.profile.trim() : "";
+	const requestedProfile = normalizeProfileName(options.profile);
 	if (rawProfile && !requestedProfile) {
 		lastCookieDiagnostic = "Configured Chromium profile must be a profile directory name, not a path.";
 		return null;
 	}
-	const requiredCookies = normalizeCookieNames(options?.requiredCookies);
-	const hosts = GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname);
+	const requiredCookies = normalizeCookieNames(options.requiredCookies);
+	const cookieNames = normalizeCookieNames(options.cookieNames ? [...options.cookieNames] : undefined);
+	const hosts = normalizeHosts(options.hosts);
+	if (hosts.length === 0) {
+		lastCookieDiagnostic = "No valid cookie hosts were requested.";
+		return null;
+	}
 	const home = homedir();
 	let sawCookieDatabase = false;
 	let sawRequiredCookies = false;
+	let sawAnyHostCookie = false;
 	let sawBackendFailure: SqliteFailure | undefined;
 	let sawUnsafeProfilePath = false;
 
@@ -117,25 +146,36 @@ export async function getGoogleCookies(
 				const metaVersion = await readMetaVersion(tempDb);
 				if (metaVersion.failure) sawBackendFailure = metaVersion.failure;
 				if (metaVersion.value === null) continue;
-				const rowsResult = await queryCookieRows(tempDb, hosts, ALL_COOKIE_NAMES);
+				const rowsResult = await queryCookieRows(tempDb, hosts, cookieNames ?? null, Boolean(options.requestUrl));
 				if (rowsResult.status === "failure") {
 					sawBackendFailure = rowsResult.failure;
 					continue;
 				}
 
+				const entries: BrowserCookieEntry[] = [];
 				const cookies: CookieMap = {};
 				for (const row of rowsResult.rows) {
 					const name = typeof row.name === "string" ? row.name : "";
-					if (!ALL_COOKIE_NAMES.has(name) || cookies[name]) continue;
+					if (!name) continue;
 					let value = typeof row.value === "string" && row.value.length > 0 ? row.value : null;
 					if (!value && typeof row.encrypted_value_hex === "string" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {
 						value = decryptCookieValue(Buffer.from(row.encrypted_value_hex, "hex"), key, metaVersion.value >= 24);
 					}
-					if (value) cookies[name] = value;
+					if (!value) continue;
+					const path = typeof row.path === "string" && row.path.startsWith("/") ? row.path : "/";
+					if (options.requestUrl && !pathMatches(options.requestUrl.pathname || "/", path)) continue;
+					entries.push({ name, value, path });
+					if (!cookies[name]) cookies[name] = value;
 				}
 
+				if (entries.length > 0) sawAnyHostCookie = true;
 				if (requiredCookies?.length && !requiredCookies.every((name) => Boolean(cookies[name]))) continue;
-				return { cookies, warnings: [...warningSet] };
+				if (entries.length === 0) continue;
+				return {
+					cookies,
+					warnings: [...warningSet],
+					...(options.requestUrl ? { cookieHeader: buildCookieHeader(entries) } : {}),
+				};
 			} finally {
 				rmSync(tempDir, { recursive: true, force: true });
 			}
@@ -153,7 +193,11 @@ export async function getGoogleCookies(
 			? `Chromium profile '${requestedProfile}' does not contain a cookie database.`
 			: "No detected Chromium profile contains a cookie database.";
 	} else if (requiredCookies?.length && !sawRequiredCookies) {
-		lastCookieDiagnostic = "No detected Chromium profile contains the required Gemini cookies.";
+		lastCookieDiagnostic = `No detected Chromium profile contains the required ${options.requiredLabel ?? "browser"} cookies.`;
+	} else if (!sawAnyHostCookie) {
+		lastCookieDiagnostic = options.requestUrl
+			? "No detected Chromium profile contains cookies for the requested URL."
+			: "No detected Chromium profile contains cookies for the requested host.";
 	} else if (warningSet.size > 0) {
 		lastCookieDiagnostic = [...warningSet][0];
 	} else {
@@ -193,6 +237,10 @@ function normalizeCookieNames(names: string[] | undefined): string[] | undefined
 	return normalized.length > 0 ? [...new Set(normalized)] : undefined;
 }
 
+function normalizeHosts(hosts: string[]): string[] {
+	return [...new Set(hosts.map(host => host.trim().toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "")).filter(Boolean))];
+}
+
 function listBrowserProfiles(home: string, config: BrowserConfig): string[] {
 	const basePath = join(home, config.baseDir);
 	if (!existsSync(basePath)) return ["Default"];
@@ -246,7 +294,7 @@ function removePkcs7Padding(buf: Buffer): Buffer {
 	return !padding || padding > 16 ? buf : buf.subarray(0, buf.length - padding);
 }
 
-function readBrowserPassword(config: BrowserConfig, currentPlatform: ReturnType<typeof platform>): Promise<string | null> {
+function readBrowserPassword(config: BrowserConfig, currentPlatform: typeof process.platform): Promise<string | null> {
 	const cacheKey = `${currentPlatform}:${config.name}`;
 	const cached = browserPasswordCache.get(cacheKey);
 	if (cached) return cached;
@@ -386,19 +434,58 @@ async function hasCookieNames(dbPath: string, hosts: string[], names: string[]):
 	return { present: names.every((name) => present.has(name)) };
 }
 
-async function queryCookieRows(dbPath: string, hosts: string[], names: Iterable<string>): Promise<QueryResult> {
-	return runSqliteQuery(dbPath, `SELECT name, value, host_key, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names)} ORDER BY expires_utc DESC`);
+async function queryCookieRows(dbPath: string, hosts: string[], names: Iterable<string> | null, filterExpired: boolean): Promise<QueryResult> {
+	const columns = await readCookieColumns(dbPath);
+	if (columns.status === "failure") return columns;
+	const pathExpr = columns.columns.has("path") ? "path" : "'/' AS path";
+	const expiresExpr = columns.columns.has("expires_utc") ? "expires_utc" : "0 AS expires_utc";
+	const expiryFilter = filterExpired && columns.columns.has("expires_utc") ? ` AND (expires_utc = 0 OR expires_utc > ${chromeExpiryNowMicros()})` : "";
+	const partitionFilter = filterExpired ? unpartitionedCookieFilter(columns.columns) : "";
+	return runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr}, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, expires_utc ASC`);
+}
+
+async function readCookieColumns(dbPath: string): Promise<{ status: "success"; columns: Set<string> } | { status: "failure"; failure: SqliteFailure }> {
+	const result = await runSqliteQuery(dbPath, "PRAGMA table_info(cookies)");
+	if (result.status === "failure") return result;
+	return { status: "success", columns: new Set(result.rows.map(row => typeof row.name === "string" ? row.name : "")) };
+}
+
+function chromeExpiryNowMicros(): number {
+	return (Date.now() + 11644473600000) * 1000;
+}
+
+function unpartitionedCookieFilter(columns: Set<string>): string {
+	const clauses: string[] = [];
+	if (columns.has("top_frame_site_key")) clauses.push("(top_frame_site_key IS NULL OR top_frame_site_key = '')");
+	if (columns.has("partition_key")) clauses.push("(partition_key IS NULL OR partition_key = '')");
+	if (columns.has("is_partitioned")) clauses.push("(is_partitioned IS NULL OR is_partitioned = 0)");
+	return clauses.length > 0 ? ` AND ${clauses.join(" AND ")}` : "";
+}
+
+function buildCookieHeader(entries: BrowserCookieEntry[]): string {
+	return entries
+		.sort((a, b) => b.path.length - a.path.length)
+		.map(({ name, value }) => `${name}=${value}`)
+		.join("; ");
+}
+
+function pathMatches(requestPath: string, cookiePath: string): boolean {
+	if (requestPath === cookiePath) return true;
+	if (!requestPath.startsWith(cookiePath)) return false;
+	if (cookiePath.endsWith("/")) return true;
+	return requestPath[cookiePath.length] === "/";
 }
 
 function buildCookieWhere(hosts: string[], cookieNames?: Iterable<string>): string {
 	const hostClauses: string[] = [];
 	for (const host of hosts) {
-		for (const candidate of expandHosts(host)) {
-			const escaped = escapeSqlString(candidate);
-			hostClauses.push(`host_key = '${escaped}'`, `host_key = '.${escaped}'`, `host_key LIKE '%.${escaped}'`);
+		const escapedHost = escapeSqlString(host);
+		hostClauses.push(`host_key = '${escapedHost}'`);
+		for (const candidate of domainCookieHosts(host)) {
+			hostClauses.push(`host_key = '.${escapeSqlString(candidate)}'`);
 		}
 	}
-	let where = `(${hostClauses.join(" OR ")})`;
+	let where = `(${[...new Set(hostClauses)].join(" OR ")})`;
 	const names = cookieNames ? [...cookieNames].filter(Boolean) : [];
 	if (names.length) where += ` AND name IN (${names.map((name) => `'${escapeSqlString(name)}'`).join(", ")})`;
 	return where;
@@ -408,11 +495,11 @@ function escapeSqlString(value: string): string {
 	return value.replaceAll("'", "''");
 }
 
-function expandHosts(host: string): string[] {
+function domainCookieHosts(host: string): string[] {
 	const parts = host.split(".").filter(Boolean);
-	if (parts.length <= 1) return [host];
-	const candidates = new Set([host]);
-	for (let i = 1; i <= parts.length - 2; i++) candidates.add(parts.slice(i).join("."));
+	if (parts.length <= 1) return [];
+	const candidates = new Set<string>();
+	for (let i = 0; i <= parts.length - 2; i++) candidates.add(parts.slice(i).join("."));
 	return [...candidates];
 }
 

package/node_modules/pi-web-access/curator-page.ts

@@ -8,7 +8,7 @@ function safeInlineJSON(data: unknown): string {
 }
 
 function buildProviderButtons(
-	available: { all: boolean; openai: boolean; brave: boolean; parallel: boolean; tinyfish: boolean; search1api: boolean; searchinfinity: boolean; querit: boolean; tavily: boolean; jina: boolean; serpdive: boolean; kagi: boolean; bocha: boolean; ollama: boolean; searxng: boolean; duckduckgo: boolean; perplexity: boolean; exa: boolean; gemini: boolean; anysearch: boolean; xai: boolean; brightdata: boolean; serpbase: boolean },
+	available: { all: boolean; openai: boolean; brave: boolean; parallel: boolean; "parallel-mcp": boolean; tinyfish: boolean; search1api: boolean; searchinfinity: boolean; querit: boolean; tavily: boolean; firecrawl: boolean; jina: boolean; serpdive: boolean; kagi: boolean; bocha: boolean; ollama: boolean; searxng: boolean; duckduckgo: boolean; perplexity: boolean; exa: boolean; gemini: boolean; anysearch: boolean; xai: boolean; brightdata: boolean; serpbase: boolean; serper: boolean; valyu: boolean },
 	selected: string,
 	hasInitialQueries: boolean,
 ): string {
@@ -18,11 +18,13 @@ function buildProviderButtons(
 		{ value: "exa", label: "Exa", available: available.exa },
 		{ value: "brave", label: "Brave", available: available.brave },
 		{ value: "parallel", label: "Parallel", available: available.parallel },
+		{ value: "parallel-mcp", label: "Parallel MCP", available: available["parallel-mcp"] },
 		{ value: "tinyfish", label: "TinyFish", available: available.tinyfish },
 		{ value: "search1api", label: "Search1API", available: available.search1api },
 		{ value: "searchinfinity", label: "Searchinfinity", available: available.searchinfinity },
 		{ value: "querit", label: "Querit", available: available.querit },
 		{ value: "tavily", label: "Tavily", available: available.tavily },
+		{ value: "firecrawl", label: "Firecrawl", available: available.firecrawl },
 		{ value: "jina", label: "Jina", available: available.jina },
 		{ value: "serpdive", label: "SERPdive", available: available.serpdive },
 		{ value: "kagi", label: "Kagi", available: available.kagi },
@@ -36,6 +38,8 @@ function buildProviderButtons(
 		{ value: "xai", label: "xAI", available: available.xai },
 		{ value: "brightdata", label: "Bright Data", available: available.brightdata },
 		{ value: "serpbase", label: "SerpBase", available: available.serpbase },
+		{ value: "serper", label: "Serper", available: available.serper },
+		{ value: "valyu", label: "Valyu", available: available.valyu },
 	];
 
 	return providers
@@ -54,7 +58,7 @@ export function generateCuratorPage(
 	queries: string[],
 	sessionToken: string,
 	timeout: number,
-	availableProviders: { all: boolean; openai: boolean; brave: boolean; parallel: boolean; tinyfish: boolean; search1api: boolean; searchinfinity: boolean; querit: boolean; tavily: boolean; jina: boolean; serpdive: boolean; kagi: boolean; bocha: boolean; ollama: boolean; searxng: boolean; duckduckgo: boolean; perplexity: boolean; exa: boolean; gemini: boolean; anysearch: boolean; xai: boolean; brightdata: boolean; serpbase: boolean },
+	availableProviders: { all: boolean; openai: boolean; brave: boolean; parallel: boolean; "parallel-mcp": boolean; tinyfish: boolean; search1api: boolean; searchinfinity: boolean; querit: boolean; tavily: boolean; firecrawl: boolean; jina: boolean; serpdive: boolean; kagi: boolean; bocha: boolean; ollama: boolean; searxng: boolean; duckduckgo: boolean; perplexity: boolean; exa: boolean; gemini: boolean; anysearch: boolean; xai: boolean; brightdata: boolean; serpbase: boolean; serper: boolean; valyu: boolean },
 	defaultProvider: string,
 	searchProvider: string,
 	summaryModels: Array<{ value: string; label: string }>,
@@ -1455,7 +1459,7 @@ const SCRIPT = `(function() {
   var token = DATA.sessionToken;
   var timeoutSec = DATA.timeout;
   var queries = Array.isArray(DATA.queries) ? DATA.queries : [];
-  var providers = ["all", "openai", "exa", "brave", "parallel", "tinyfish", "search1api", "searchinfinity", "querit", "tavily", "jina", "serpdive", "kagi", "bocha", "ollama", "searxng", "duckduckgo", "perplexity", "gemini", "anysearch", "xai", "brightdata", "serpbase"];
+  var providers = ["all", "openai", "exa", "brave", "parallel", "parallel-mcp", "tinyfish", "search1api", "searchinfinity", "querit", "tavily", "firecrawl", "jina", "serpdive", "kagi", "bocha", "ollama", "searxng", "duckduckgo", "perplexity", "gemini", "anysearch", "xai", "brightdata", "serpbase", "serper", "valyu"];
   var availProviders = DATA.availableProviders && typeof DATA.availableProviders === "object" ? DATA.availableProviders : {};
   var workflow = "summary-review";
   var initialDefaultProvider = typeof DATA.defaultProvider === "string" ? DATA.defaultProvider : "exa";
@@ -1667,6 +1671,7 @@ const SCRIPT = `(function() {
     if (provider === "searchinfinity") return "Searchinfinity";
     if (provider === "querit") return "Querit";
     if (provider === "tavily") return "Tavily";
+    if (provider === "firecrawl") return "Firecrawl";
     if (provider === "jina") return "Jina";
     if (provider === "serpdive") return "SERPdive";
     if (provider === "kagi") return "Kagi";

package/node_modules/pi-web-access/curator-server.ts

@@ -18,7 +18,7 @@ export interface CuratorServerOptions {
 	queries: string[];
 	sessionToken: string;
 	timeout: number;
-	availableProviders: { all: boolean; openai: boolean; brave: boolean; parallel: boolean; tinyfish: boolean; search1api: boolean; searchinfinity: boolean; querit: boolean; tavily: boolean; jina: boolean; serpdive: boolean; kagi: boolean; bocha: boolean; ollama: boolean; searxng: boolean; duckduckgo: boolean; perplexity: boolean; exa: boolean; gemini: boolean; anysearch: boolean; xai: boolean; brightdata: boolean; serpbase: boolean };
+	availableProviders: { all: boolean; openai: boolean; brave: boolean; parallel: boolean; "parallel-mcp": boolean; tinyfish: boolean; search1api: boolean; searchinfinity: boolean; querit: boolean; tavily: boolean; firecrawl: boolean; jina: boolean; serpdive: boolean; kagi: boolean; bocha: boolean; ollama: boolean; searxng: boolean; duckduckgo: boolean; perplexity: boolean; exa: boolean; gemini: boolean; anysearch: boolean; xai: boolean; brightdata: boolean; serpbase: boolean; serper: boolean; valyu: boolean };
 	defaultProvider: string;
 	searchProvider: string;
 	summaryModels: Array<{ value: string; label: string }>;
@@ -275,11 +275,13 @@ export function startCuratorServer(
 		if (provider === "openai") return availableProviders.openai;
 		if (provider === "brave") return availableProviders.brave;
 		if (provider === "parallel") return availableProviders.parallel;
+		if (provider === "parallel-mcp") return availableProviders["parallel-mcp"];
 		if (provider === "tinyfish") return availableProviders.tinyfish;
 		if (provider === "search1api") return availableProviders.search1api;
 		if (provider === "searchinfinity") return availableProviders.searchinfinity;
 		if (provider === "querit") return availableProviders.querit;
 		if (provider === "tavily") return availableProviders.tavily;
+		if (provider === "firecrawl") return availableProviders.firecrawl;
 		if (provider === "jina") return availableProviders.jina;
 		if (provider === "serpdive") return availableProviders.serpdive;
 		if (provider === "kagi") return availableProviders.kagi;
@@ -294,6 +296,8 @@ export function startCuratorServer(
 		if (provider === "xai") return availableProviders.xai;
 		if (provider === "brightdata") return availableProviders.brightdata;
 		if (provider === "serpbase") return availableProviders.serpbase;
+		if (provider === "serper") return availableProviders.serper;
+		if (provider === "valyu") return availableProviders.valyu;
 		return false;
 	}
 

package/node_modules/pi-web-access/exa.ts

@@ -3,10 +3,9 @@ import { activityMonitor } from "./activity.ts";
 import type { ExtractedContent } from "./extract.ts";
 import type { SearchOptions, SearchResponse } from "./perplexity.ts";
 import { hasCredentialSource, redactCredential, resolveCredential } from "./credential-source.ts";
-import { getWebSearchConfigPath } from "./utils.ts";
+import { fetchWithCredentialRedirects, getWebSearchConfigPath, resolveApiBaseUrl } from "./utils.ts";
 
-const EXA_ANSWER_URL = "https://api.exa.ai/answer";
-const EXA_SEARCH_URL = "https://api.exa.ai/search";
+const EXA_API_BASE_URL = "https://api.exa.ai";
 const EXA_MCP_URL = "https://mcp.exa.ai/mcp";
 const CONFIG_PATH = getWebSearchConfigPath();
 const EXA_MCP_ADVANCED_TOOL = "web_search_advanced_exa";
@@ -14,6 +13,7 @@ const EXA_MCP_BASIC_TOOL = "web_search_exa";
 
 interface WebSearchConfig {
 	exaApiKey?: unknown;
+	exaBaseUrl?: unknown;
 }
 
 interface ExaAnswerResponse {
@@ -80,6 +80,16 @@ async function getApiKey(signal?: AbortSignal): Promise<string | null> {
 	});
 }
 
+function getApiBaseUrl(): string {
+	return resolveApiBaseUrl({
+		configKey: "exaBaseUrl",
+		configuredValue: loadConfig().exaBaseUrl,
+		defaultValue: EXA_API_BASE_URL,
+		environmentKey: "EXA_BASE_URL",
+		environmentValue: process.env.EXA_BASE_URL,
+	});
+}
+
 function exaApiHeaders(apiKey: string): Record<string, string> {
 	return {
 		"x-api-key": apiKey,
@@ -447,6 +457,7 @@ export async function searchWithExa(query: string, options: ExaSearchOptions = {
 		return searchWithExaMcp(query, options);
 	}
 
+	const apiBaseUrl = getApiBaseUrl();
 	const useSearch = options.includeContent
 		|| !!options.recencyFilter
 		|| !!options.domainFilter?.length
@@ -456,12 +467,12 @@ export async function searchWithExa(query: string, options: ExaSearchOptions = {
 
 	try {
 		if (!useSearch) {
-			const response = await fetch(EXA_ANSWER_URL, {
+			const response = await fetchWithCredentialRedirects(`${apiBaseUrl}/answer`, {
 				method: "POST",
 				headers: exaApiHeaders(apiKey),
 				body: JSON.stringify({ query }),
 				signal: requestSignal(options.signal),
-			});
+			}, ["x-api-key"]);
 
 			if (!response.ok) {
 				const errorText = redactCredential(await response.text(), apiKey);
@@ -476,7 +487,7 @@ export async function searchWithExa(query: string, options: ExaSearchOptions = {
 			};
 		}
 
-		const response = await fetch(EXA_SEARCH_URL, {
+		const response = await fetchWithCredentialRedirects(`${apiBaseUrl}/search`, {
 			method: "POST",
 			headers: exaApiHeaders(apiKey),
 			body: JSON.stringify({
@@ -486,7 +497,7 @@ export async function searchWithExa(query: string, options: ExaSearchOptions = {
 					: { highlights: true },
 			}),
 			signal: requestSignal(options.signal),
-		});
+		}, ["x-api-key"]);
 
 		if (!response.ok) {
 			const errorText = redactCredential(await response.text(), apiKey);