@herbertgao/pi-extensions 2026.9.20 → 2026.10.1

package/node_modules/pi-web-access/keenable.ts

@@ -0,0 +1,221 @@
+import { existsSync, readFileSync } from "node:fs";
+import { activityMonitor } from "./activity.ts";
+import { normalizeDomain } from "./domain-filter-normalization.ts";
+import type { SearchOptions, SearchResponse } from "./perplexity.ts";
+import { formatSearchResultsAsAnswer } from "./search-answer-formatting.ts";
+import { normalizeSearchResultCount } from "./search-result-count-normalization.ts";
+import { redactCredential, resolveCredential } from "./credential-source.ts";
+import { fetchWithCredentialRedirects, getWebSearchConfigPath } from "./utils.ts";
+
+const KEENABLE_SEARCH_URL = "https://api.keenable.ai/v1/search";
+// Without a key the request goes to the public endpoint, which identifies the caller
+// by X-Keenable-Title instead of a credential and answers 400 when the header is missing.
+const KEENABLE_PUBLIC_SEARCH_URL = "https://api.keenable.ai/v1/search/public";
+const KEENABLE_CLIENT_TITLE = "pi-web-access";
+const CONFIG_PATH = getWebSearchConfigPath();
+const SEARCH_TIMEOUT_MS = 30_000;
+const MAX_REQUEST_RESULTS = 50;
+const MAX_SNIPPET_CHARS = 500;
+const RECENCY_DAYS: Record<NonNullable<SearchOptions["recencyFilter"]>, number> = {
+	day: 1,
+	week: 7,
+	month: 30,
+	year: 365,
+};
+
+interface WebSearchConfig {
+	keenableApiKey?: unknown;
+}
+
+interface KeenableResult {
+	title?: unknown;
+	url?: unknown;
+	snippet?: unknown;
+	description?: unknown;
+}
+
+let cachedConfig: WebSearchConfig | null = null;
+
+function loadConfig(): WebSearchConfig {
+	if (cachedConfig) return cachedConfig;
+	if (!existsSync(CONFIG_PATH)) {
+		cachedConfig = {};
+		return cachedConfig;
+	}
+	const raw = readFileSync(CONFIG_PATH, "utf-8");
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse ${CONFIG_PATH}: ${message}`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+		throw new Error(`Invalid config in ${CONFIG_PATH}: expected a JSON object`);
+	}
+	cachedConfig = parsed as WebSearchConfig;
+	return cachedConfig;
+}
+
+async function getApiKey(signal?: AbortSignal): Promise<string | null> {
+	return resolveCredential({
+		provider: "Keenable",
+		configuredValue: loadConfig().keenableApiKey,
+		environmentValue: process.env.KEENABLE_API_KEY,
+		signal,
+	});
+}
+
+interface DomainFilters {
+	include: string[];
+	exclude: string[];
+}
+
+function parseDomainFilter(domainFilter: string[] | undefined): DomainFilters {
+	const filters: DomainFilters = { include: [], exclude: [] };
+	for (const raw of domainFilter ?? []) {
+		const domain = normalizeDomain(raw);
+		if (!domain) continue;
+		const target = raw.trim().startsWith("-") ? filters.exclude : filters.include;
+		if (!target.includes(domain)) target.push(domain);
+	}
+	return filters;
+}
+
+function passesDomainFilters(url: URL, filters: DomainFilters): boolean {
+	if (filters.include.length === 0 && filters.exclude.length === 0) return true;
+	const hostname = url.hostname.toLowerCase();
+	const matches = (domain: string) => hostname === domain || hostname.endsWith(`.${domain}`);
+	if (filters.exclude.some(matches)) return false;
+	return filters.include.length === 0 || filters.include.some(matches);
+}
+
+// One domain uses the API's `site` field; the query syntax covers the rest, so no ranked
+// window has to be filtered down locally to find in-domain pages.
+function buildQuery(query: string, filters: DomainFilters, site: string | undefined): string {
+	const parts = [query];
+	if (!site && filters.include.length > 1) parts.push(`(${filters.include.map(domain => `site:${domain}`).join(" OR ")})`);
+	for (const domain of filters.exclude) parts.push(`-site:${domain}`);
+	return parts.join(" ");
+}
+
+function publishedAfter(recency: NonNullable<SearchOptions["recencyFilter"]>): string {
+	return new Date(Date.now() - RECENCY_DAYS[recency] * 86_400_000).toISOString().slice(0, 10);
+}
+
+function text(value: unknown): string {
+	return typeof value === "string" ? value.replace(/\s+/g, " ").trim() : "";
+}
+
+function errorMessage(err: unknown): string {
+	return err instanceof Error ? err.message : String(err);
+}
+
+function invalidResponse(message: string): Error {
+	return new Error(`Keenable returned invalid response: ${message}`);
+}
+
+function parseResponse(value: unknown): KeenableResult[] {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw invalidResponse("expected an object envelope");
+	const envelope = value as Record<string, unknown>;
+	if (!Array.isArray(envelope.results)) throw invalidResponse("expected results array");
+	return envelope.results as KeenableResult[];
+}
+
+// The public endpoint needs no key, so the provider is always usable once selected.
+export function isKeenableAvailable(): boolean {
+	return true;
+}
+
+export async function searchWithKeenable(query: string, options: SearchOptions = {}): Promise<SearchResponse> {
+	const apiKey = await getApiKey(options.signal);
+	const numResults = normalizeSearchResultCount(options.numResults);
+	const filters = parseDomainFilter(options.domainFilter);
+	const site = filters.include.length === 1 ? filters.include[0] : undefined;
+	// Results are reapplied to the domain filters locally, so leave a little headroom.
+	const hasDomainClauses = filters.include.length > 1 || filters.exclude.length > 0;
+	const body = {
+		query: buildQuery(query, filters, site),
+		max_results: hasDomainClauses ? Math.min(MAX_REQUEST_RESULTS, numResults + 5) : numResults,
+		snippet_max_length: MAX_SNIPPET_CHARS,
+		...(site ? { site } : {}),
+		...(options.recencyFilter ? { published_after: publishedAfter(options.recencyFilter) } : {}),
+	};
+	const headers: Record<string, string> = {
+		Accept: "application/json",
+		"Content-Type": "application/json",
+		"X-Keenable-Title": KEENABLE_CLIENT_TITLE,
+		...(apiKey ? { "X-API-Key": apiKey } : {}),
+	};
+	const activityId = activityMonitor.logStart({ type: "api", query });
+	const timeoutSignal = AbortSignal.timeout(SEARCH_TIMEOUT_MS);
+	let response: Response;
+	let entries: KeenableResult[];
+	try {
+		response = await fetchWithCredentialRedirects(apiKey ? KEENABLE_SEARCH_URL : KEENABLE_PUBLIC_SEARCH_URL, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(body),
+			signal: options.signal ? AbortSignal.any([timeoutSignal, options.signal]) : timeoutSignal,
+		}, ["X-API-Key"]);
+		if (!response.ok) {
+			const errorText = redactCredential(await response.text(), apiKey).slice(0, 300);
+			const hint = response.status === 429 && !apiKey
+				? ` (keyless rate limit; set keenableApiKey or KEENABLE_API_KEY to raise it)`
+				: "";
+			throw new Error(`Keenable error ${response.status}: ${errorText}${hint}`);
+		}
+		let rawData: unknown;
+		try {
+			rawData = await response.json();
+		} catch (err) {
+			if (err instanceof Error && err.name === "TimeoutError") throw err;
+			throw new Error(`Keenable returned invalid JSON: ${errorMessage(err)}`);
+		}
+		entries = parseResponse(rawData);
+	} catch (err) {
+		if (options.signal?.aborted) {
+			activityMonitor.logComplete(activityId, 0);
+			throw new Error("Aborted");
+		}
+		const message = errorMessage(err);
+		const providerTimeout = timeoutSignal.aborted || (err instanceof Error && err.name === "TimeoutError");
+		const outgoing = providerTimeout
+			? new Error(`Keenable request timed out after ${Math.round(SEARCH_TIMEOUT_MS / 1000)}s`)
+			: (() => {
+				const redactedMessage = redactCredential(message, apiKey);
+				if (redactedMessage === message && err instanceof Error) return err;
+				const redactedError = new Error(redactedMessage);
+				if (err instanceof Error) redactedError.name = err.name;
+				return redactedError;
+			})();
+		activityMonitor.logError(activityId, redactCredential(errorMessage(outgoing), apiKey));
+		throw outgoing;
+	}
+	activityMonitor.logComplete(activityId, response.status);
+	const results: SearchResponse["results"] = [];
+	const seen = new Set<string>();
+	for (const entry of entries) {
+		if (!entry || typeof entry !== "object") continue;
+		if (typeof entry.url !== "string" || !entry.url) continue;
+		let resultUrl: URL;
+		try {
+			resultUrl = new URL(entry.url);
+		} catch {
+			continue;
+		}
+		if (resultUrl.protocol !== "http:" && resultUrl.protocol !== "https:") continue;
+		if (!passesDomainFilters(resultUrl, filters)) continue;
+		if (seen.has(resultUrl.href)) continue;
+		seen.add(resultUrl.href);
+		// The page text lives in `snippet`; `description` is usually empty and only a fallback.
+		const snippet = text(entry.snippet) || text(entry.description);
+		results.push({
+			title: text(entry.title) || `Source ${results.length + 1}`,
+			url: resultUrl.href,
+			snippet: snippet.slice(0, MAX_SNIPPET_CHARS),
+		});
+		if (results.length >= numResults) break;
+	}
+	return { answer: formatSearchResultsAsAnswer(results), results };
+}

package/node_modules/pi-web-access/mcp-cli.ts

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+// pi-web-access-mcp: serves the web tools over MCP stdio. stdout carries only
+// JSON-RPC, so every diagnostic goes to stderr.
+
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import pkg from "./package.json" with { type: "json" };
+import { createMcpServer } from "./mcp-server.ts";
+import { createStandaloneWebToolCore } from "./web-tool-core.ts";
+
+// Keep stray console output from dependencies off the JSON-RPC stream.
+console.log = console.info = console.debug = console.error;
+
+const core = createStandaloneWebToolCore();
+const server = createMcpServer(core, { name: "pi-web-access", version: pkg.version }, core.enabledToolNames);
+const transport = new StdioServerTransport();
+
+let closing = false;
+async function shutdown(code: number): Promise<void> {
+	if (closing) return;
+	closing = true;
+	try {
+		// Closing aborts in-flight tool calls through their request signals.
+		await server.close();
+	} catch (error) {
+		console.error("pi-web-access-mcp: error during shutdown:", error);
+	}
+	process.exit(code);
+}
+
+process.stdin.once("end", () => void shutdown(0));
+process.stdin.once("close", () => void shutdown(0));
+process.once("SIGINT", () => void shutdown(0));
+process.once("SIGTERM", () => void shutdown(0));
+
+try {
+	await server.connect(transport);
+} catch (error) {
+	console.error("pi-web-access-mcp: failed to start:", error);
+	process.exit(1);
+}

package/node_modules/pi-web-access/mcp-server.ts

@@ -0,0 +1,81 @@
+// MCP server exposing the web tools over any transport. Tool behavior lives in
+// the WebToolCore; this module only lists tools, validates arguments at the
+// boundary, forwards cancellation, and maps results to MCP content.
+
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import {
+	CallToolRequestSchema,
+	type CallToolResult,
+	ErrorCode,
+	ListToolsRequestSchema,
+	McpError,
+} from "@modelcontextprotocol/sdk/types.js";
+import { MCP_TOOL_DEFINITIONS, validateMcpToolArguments } from "./mcp-tool-definitions.ts";
+import type {
+	FetchContentCallParams,
+	GetSearchContentCallParams,
+	SourceCheckCallParams,
+	WebSearchCallParams,
+	WebToolCore,
+	WebToolResult,
+} from "./web-tool-contract.ts";
+
+export interface McpServerInfo {
+	name: string;
+	version: string;
+}
+
+type ToolRunner = (core: WebToolCore, args: Record<string, unknown>, signal: AbortSignal) => Promise<WebToolResult>;
+type ToolInputSchema = { type: "object"; [key: string]: unknown };
+
+// Arguments are validated against the matching MCP schema before these casts run.
+const TOOL_RUNNERS: Record<string, ToolRunner> = {
+	web_search: (core, args, signal) => core.webSearch(args as WebSearchCallParams, signal),
+	fetch_content: (core, args, signal) => core.fetchContent(args as FetchContentCallParams, signal),
+	get_search_content: (core, args, signal) => core.getSearchContent(args as unknown as GetSearchContentCallParams, signal),
+	source_check: (core, args, signal) => core.sourceCheck(args as unknown as SourceCheckCallParams, signal),
+};
+
+function errorResult(text: string): CallToolResult {
+	return { content: [{ type: "text", text }], isError: true };
+}
+
+// details stays off the wire: clients such as Codex show the model structuredContent
+// instead of content, and details holds host metadata rather than the results.
+function toCallToolResult(result: WebToolResult): CallToolResult {
+	return { content: result.content, ...(result.isError && { isError: true }) };
+}
+
+/** Serves the tools named in enabledTools (default: all four MCP tools). */
+export function createMcpServer(core: WebToolCore, info: McpServerInfo, enabledTools?: readonly string[]): Server {
+	const server = new Server(info, { capabilities: { tools: {} } });
+	const tools = enabledTools ? MCP_TOOL_DEFINITIONS.filter((tool) => enabledTools.includes(tool.name)) : MCP_TOOL_DEFINITIONS;
+
+	server.setRequestHandler(ListToolsRequestSchema, async () => ({
+		tools: tools.map((tool) => ({
+			name: tool.name,
+			description: tool.description,
+			inputSchema: tool.inputSchema as ToolInputSchema,
+			annotations: tool.annotations,
+		})),
+	}));
+
+	server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+		const { name } = request.params;
+		const tool = tools.find((candidate) => candidate.name === name);
+		const run = TOOL_RUNNERS[name];
+		if (!tool || !run) throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${name}`);
+
+		const args = request.params.arguments ?? {};
+		const problems = validateMcpToolArguments(tool, args);
+		if (problems.length > 0) return errorResult(`Invalid arguments for ${name}:\n- ${problems.join("\n- ")}`);
+
+		try {
+			return toCallToolResult(await run(core, args, extra.signal));
+		} catch (error) {
+			return errorResult(error instanceof Error ? error.message : String(error));
+		}
+	});
+
+	return server;
+}

package/node_modules/pi-web-access/mcp-tool-definitions.ts

@@ -0,0 +1,117 @@
+// MCP-only tool definitions: names, descriptions, and input schemas for the
+// standalone MCP server. Deliberately independent of the Pi tool schemas in
+// index.ts so MCP changes never touch Pi's provider-facing definitions.
+// Pi-only parameters (workflow/curator, prompt, answerModel, timestamp, frames,
+// model, auth) are not exposed; unknown properties are rejected.
+
+import { Type, type TSchema } from "typebox";
+import { Value } from "typebox/value";
+import { RESOLVED_SEARCH_PROVIDERS } from "./gemini-search.ts";
+
+function stringEnum(values: readonly string[], description: string) {
+	return Type.Unsafe<string>({ type: "string", enum: [...values], description });
+}
+
+// Kimi authenticates only through Pi's login, so it is never offered here.
+const MCP_SEARCH_PROVIDERS = RESOLVED_SEARCH_PROVIDERS.filter((provider) => provider !== "kimi");
+
+const providerSchema = Type.Union([
+	stringEnum(["auto", "all", ...MCP_SEARCH_PROVIDERS], "Single provider."),
+	Type.Array(stringEnum(MCP_SEARCH_PROVIDERS, "Provider."), { minItems: 1 }),
+], { description: "Search provider, or a non-empty list of providers to search simultaneously. Omit or use auto for the configured provider; all searches every eligible provider. Providers without credentials return an error." });
+
+const recencySchema = stringEnum(["day", "week", "month", "year"], "Filter results by recency.");
+const domainFilterSchema = Type.Array(Type.String(), { description: "Limit to domains; prefix with - to exclude." });
+const numResultsSchema = Type.Integer({ minimum: 1, maximum: 20, description: "Results per query (default: 5, max: 20)." });
+const proxySchema = Type.String({ description: "http(s) or socks proxy URL for this call's outbound requests; empty string forces direct access." });
+// Page fetches write a page cache and clone GitHub URLs into a temp directory,
+// including the fetches behind includeContent and fetchContent.
+const fetchingAnnotations = { readOnlyHint: false, destructiveHint: false, openWorldHint: true };
+
+export interface McpToolDefinition {
+	name: string;
+	description: string;
+	inputSchema: TSchema;
+	annotations: { readOnlyHint: boolean; destructiveHint?: boolean; openWorldHint: boolean };
+}
+
+export const MCP_TOOL_DEFINITIONS: readonly McpToolDefinition[] = [
+	{
+		name: "web_search",
+		description: "Search the web and return bounded, source-linked results or provider answers. Full results are stored for retrieval with get_search_content using the returned responseId.",
+		inputSchema: Type.Object({
+			query: Type.Optional(Type.String({ description: "Single search query." })),
+			queries: Type.Optional(Type.Array(Type.String(), { description: "Multiple queries searched concurrently; vary angles for broader coverage." })),
+			numResults: Type.Optional(numResultsSchema),
+			includeContent: Type.Optional(Type.Boolean({ description: "Also fetch full page content for the results, retrievable with get_search_content." })),
+			recencyFilter: Type.Optional(recencySchema),
+			domainFilter: Type.Optional(domainFilterSchema),
+			category: Type.Optional(Type.String({ description: "Exa only: result category, e.g. news, research paper." })),
+			provider: Type.Optional(providerSchema),
+			proxy: Type.Optional(proxySchema),
+		}, { additionalProperties: false }),
+		annotations: fetchingAnnotations,
+	},
+	{
+		name: "fetch_content",
+		description: "Fetch URL(s) and return bounded content. Supports web pages, GitHub repositories, and PDFs. Full content is stored for retrieval with get_search_content using the returned responseId.",
+		inputSchema: Type.Object({
+			url: Type.Optional(Type.String({ description: "Single URL to fetch." })),
+			urls: Type.Optional(Type.Array(Type.String(), { description: "Multiple URLs fetched in parallel." })),
+			mode: Type.Optional(stringEnum(["readable", "raw"], "readable = extract readable content as markdown (default); raw = return the exact textual body using direct HTTP only.")),
+			forceClone: Type.Optional(Type.Boolean({ description: "Force cloning GitHub repositories that exceed the size threshold." })),
+			proxy: Type.Optional(proxySchema),
+		}, { additionalProperties: false }),
+		annotations: fetchingAnnotations,
+	},
+	{
+		name: "get_search_content",
+		description: "Retrieve bounded pages of stored search results or fetched content from a previous web_search, fetch_content, or source_check call, or find matching passages with findText.",
+		inputSchema: Type.Object({
+			responseId: Type.String({ description: "The responseId from web_search, fetch_content, or source_check." }),
+			query: Type.Optional(Type.String({ description: "Select stored results for this search query." })),
+			queryIndex: Type.Optional(Type.Integer({ minimum: 0, description: "Select stored results for the query at this index." })),
+			url: Type.Optional(Type.String({ description: "Select stored content for this URL." })),
+			urlIndex: Type.Optional(Type.Integer({ minimum: 0, description: "Select stored content for the URL at this index." })),
+			offset: Type.Optional(Type.Integer({ minimum: 0, description: "Character offset into the stored content (default 0). Ignored when findText is supplied." })),
+			limit: Type.Optional(Type.Integer({ minimum: 1, description: "Maximum characters to return. Ignored when findText is supplied." })),
+			findText: Type.Optional(Type.Union([
+				Type.String({ minLength: 1, maxLength: 500 }),
+				Type.Array(Type.String({ minLength: 1, maxLength: 500 }), { minItems: 1, maxItems: 10 }),
+			], { description: "Text or texts to find in the selected stored content." })),
+			findMode: Type.Optional(stringEnum(["exact", "case-insensitive", "fuzzy"], "Matching mode for findText (default: case-insensitive).")),
+		}, { additionalProperties: false }),
+		annotations: { readOnlyHint: true, openWorldHint: false },
+	},
+	{
+		name: "source_check",
+		description: "Gather web sources for a claim and return a bounded machine-readable research artifact with exact passage citations for manual review.",
+		inputSchema: Type.Object({
+			claim: Type.String({ description: "The assertion to gather web sources for." }),
+			queries: Type.Optional(Type.Array(Type.String(), { description: "Search queries (default: the claim)." })),
+			numResults: Type.Optional(numResultsSchema),
+			fetchContent: Type.Optional(Type.Boolean({ description: "Fetch up to 5 result pages for exact passage extraction." })),
+			recencyFilter: Type.Optional(recencySchema),
+			domainFilter: Type.Optional(domainFilterSchema),
+			provider: Type.Optional(providerSchema),
+			proxy: Type.Optional(proxySchema),
+		}, { additionalProperties: false }),
+		annotations: fetchingAnnotations,
+	},
+];
+
+/** Returns human-readable validation problems; an empty array means the arguments are valid. */
+export function validateMcpToolArguments(tool: McpToolDefinition, args: unknown): string[] {
+	if (Value.Check(tool.inputSchema, args)) return [];
+	const problems = new Set<string>();
+	for (const error of Value.Errors(tool.inputSchema, args)) {
+		// additionalProperties also reports a per-property "schema is false"; the summary below names the property.
+		if (error.keyword === "boolean") continue;
+		const path = error.instancePath || "arguments";
+		const unknown = error.keyword === "additionalProperties"
+			? (error.params as { additionalProperties?: string[] }).additionalProperties
+			: undefined;
+		problems.add(unknown?.length ? `${path}: unknown properties ${unknown.join(", ")}` : `${path}: ${error.message}`);
+	}
+	return problems.size > 0 ? [...problems] : ["arguments do not match the input schema"];
+}

package/node_modules/pi-web-access/openai-search.ts

@@ -91,6 +91,14 @@ function resolveCurrentModelSearchTarget(model: CurrentModel): CurrentModelSearc
 	throw new Error("Current model is not backed by an official OpenAI Responses endpoint");
 }
 
+// The active model draws on a ChatGPT subscription: openai-codex, or openai signed in
+// through Pi's "Sign in with ChatGPT" OAuth rather than an API key.
+export function isOpenAISubscriptionModelSelected(ctx?: Pick<ExtensionContext, "model"> & { modelRegistry?: Pick<ExtensionContext["modelRegistry"], "isUsingOAuth"> }): boolean {
+	const model = ctx?.model;
+	if (model?.provider === "openai-codex") return true;
+	return model?.provider === "openai" && ctx?.modelRegistry?.isUsingOAuth?.(model) === true;
+}
+
 export function isCurrentModelHostedSearchEligible(ctx?: Pick<ExtensionContext, "model">): boolean {
 	const model = ctx?.model;
 	if (!model || !/^gpt-/iu.test(model.id)) return false;
@@ -163,6 +171,15 @@ function isCodexJwt(token: string): boolean {
 	return !!payload?.["https://api.openai.com/auth"];
 }
 
+function isOfficialOpenAIBaseUrl(baseUrl: string | undefined): boolean {
+	if (baseUrl === undefined) return false;
+	try {
+		return new URL(baseUrl).toString().replace(/\/+$/u, "") === "https://api.openai.com/v1";
+	} catch {
+		return false;
+	}
+}
+
 function extractAccountId(token: string): string | undefined {
 	const payload = decodeJwtPayload(token);
 	const auth = payload?.["https://api.openai.com/auth"];
@@ -282,16 +299,12 @@ async function resolvePiAuth(ctx: ExtensionContext, responsesUrl: string, provid
 		// Auth can override the model's base URL. Do not guess Responses/web_search
 		// support from a gateway URL, or pair its credential with the official API.
 		const baseUrl = resolved.baseUrl ?? preferred.baseUrl;
-		const useCodexEndpoint = provider === "openai-codex" || isCodexJwt(resolved.apiKey);
-		if (!hasExplicitResponsesUrl && !useProviderBaseUrl && !useCodexEndpoint && baseUrl !== undefined) {
-			let isOfficial = false;
-			try {
-				isOfficial = new URL(baseUrl).toString().replace(/\/+$/u, "") === "https://api.openai.com/v1";
-			} catch {
-			}
-			if (!isOfficial) {
-				throw new CustomOpenAIBaseUrlError(`OpenAI web search cannot reuse Pi credentials with a custom baseUrl by default. Set openaiResponsesUrl in ${CONFIG_PATH} to the full Responses endpoint for this credential.`);
-			}
+		const isOfficialBaseUrl = isOfficialOpenAIBaseUrl(baseUrl);
+		// Pi sends credentials for the official API base directly to api.openai.com, including
+		// "Sign in with ChatGPT" access tokens, which are ChatGPT JWTs but not Codex credentials.
+		const useCodexEndpoint = provider === "openai-codex" || (!isOfficialBaseUrl && isCodexJwt(resolved.apiKey));
+		if (!hasExplicitResponsesUrl && !useProviderBaseUrl && !useCodexEndpoint && baseUrl !== undefined && !isOfficialBaseUrl) {
+			throw new CustomOpenAIBaseUrlError(`OpenAI web search cannot reuse Pi credentials with a custom baseUrl by default. Set openaiResponsesUrl in ${CONFIG_PATH} to the full Responses endpoint for this credential.`);
 		}
 		let providerResponsesUrl = responsesUrl;
 		if (useProviderBaseUrl) {
@@ -309,6 +322,7 @@ async function resolvePiAuth(ctx: ExtensionContext, responsesUrl: string, provid
 			model: modelOverride ?? preferred.id,
 			headers: resolved.headers ?? {},
 			responsesUrl: providerResponsesUrl,
+			useCodexEndpoint,
 			...(useProviderBaseUrl ? { useProviderBaseUrl: true } : {}),
 		};
 	}
@@ -454,24 +468,57 @@ async function parseOpenAIResponse(response: Response): Promise<ParsedOpenAIResp
 	const outputItems: unknown[] = [];
 	let completedResponse: Record<string, unknown> | null = null;
 	let webSearchCallSeen = false;
+	let streamError: { code?: unknown; type?: unknown; message?: unknown } | null = null;
 	for (const line of text.split("\n")) {
 		if (!line.startsWith("data: ")) continue;
 		const data = line.slice(6).trim();
 		if (!data || data === "[DONE]") continue;
 		try {
 			const parsed = JSON.parse(data) as Record<string, unknown>;
+			// The API can fail mid-stream with HTTP 200: a terminal `error` event and
+			// `response.failed` carry the real error (e.g. quota exhaustion), while no
+			// output items or completed response ever arrive. Surface it faithfully.
+			// `error` events are terminal in the Responses API, so a captured stream
+			// error deliberately takes precedence over any output parsed afterwards.
+			if (parsed.type === "error") {
+				const err = parsed.error;
+				streamError ??= err && typeof err === "object"
+					? err as { code?: unknown; type?: unknown; message?: unknown }
+					: { code: parsed.code, message: typeof err === "string" ? err : (typeof parsed.message === "string" ? parsed.message : undefined) };
+			}
 			if (typeof parsed.type === "string" && parsed.type.startsWith("response.web_search_call")) webSearchCallSeen = true;
 			if (parsed.type === "response.output_item.done" && parsed.item) {
 				outputItems.push(parsed.item);
 				webSearchCallSeen ||= isWebSearchCall(parsed.item);
 			}
-			if ((parsed.type === "response.done" || parsed.type === "response.completed") && parsed.response && typeof parsed.response === "object") {
+			if ((parsed.type === "response.failed" || parsed.type === "response.incomplete" || parsed.type === "response.done" || parsed.type === "response.completed") && parsed.response && typeof parsed.response === "object") {
 				completedResponse = parsed.response as Record<string, unknown>;
+				const responseError = (completedResponse as { error?: unknown }).error;
+				if (responseError && typeof responseError === "object") {
+					streamError ??= responseError as { code?: unknown; type?: unknown; message?: unknown };
+				}
+				// A failed response can carry `error: null`; never let its partial
+				// output pass for a successful search.
+				if (parsed.type === "response.failed") {
+					// Wording keeps "invalid response" so provider routing classifies
+					// this the same as the old "no web_search_call" outcome.
+					streamError ??= { message: "response stream failed with no error payload (invalid response)" };
+				}
 			}
 		} catch {
 		}
 	}
 
+	if (streamError) {
+		const code = typeof streamError.code === "string" ? streamError.code : undefined;
+		const type = typeof streamError.type === "string" ? streamError.type : undefined;
+		const message = typeof streamError.message === "string" && streamError.message.trim().length > 0
+			? streamError.message
+			: "OpenAI API stream failed";
+		const detail = [type, code].filter(Boolean).join("/");
+		throw new Error(`OpenAI API stream error${detail ? ` (${detail})` : ""}: ${message}`);
+	}
+
 	if (completedResponse) {
 		const output = Array.isArray(completedResponse.output) ? completedResponse.output : [];
 		const payload = output.length > 0 ? completedResponse : { ...completedResponse, output: outputItems };

package/node_modules/pi-web-access/package.json

@@ -1,8 +1,14 @@
 {
   "name": "pi-web-access",
-  "version": "0.34.0",
-  "description": "Web search, URL fetching, GitHub repo cloning, PDF extraction, YouTube video understanding, and local video analysis for Pi coding agent. Supports OpenAI, Brave, Parallel, TinyFish, Search1API, Searchinfinity, Querit, Tavily, Firecrawl, Crawl4AI, Jina, SERPdive, Kagi, Ollama, AnySearch, Bright Data SERP, SerpBase, SerpApi, Serply, You.com, SearXNG, Exa, Perplexity, Gemini, Kimi, and Mistral.",
+  "version": "0.37.0",
+  "description": "Web search, URL fetching, GitHub repo cloning, PDF extraction, YouTube video understanding, and local video analysis for Pi coding agent. Supports OpenAI, Brave, Parallel, TinyFish, Search1API, Searchinfinity, Querit, Tavily, Firecrawl, Crawl4AI, Jina, SERPdive, Kagi, Ollama, AnySearch, Bright Data SERP, SerpBase, SerpApi, Serply, You.com, SearXNG, degoog, Exa, Perplexity, Gemini, Kimi, and Mistral.",
   "type": "module",
+  "bin": {
+    "pi-web-access-mcp": "dist/mcp-cli.js"
+  },
+  "engines": {
+    "node": ">=22.19.0"
+  },
   "scripts": {
     "test": "node --import ./test/isolate-env.mjs --test",
     "typecheck": "tsc",
@@ -22,6 +28,7 @@
     "search1api",
     "searchinfinity",
     "querit",
+    "degoog",
     "perplexity",
     "fetch",
     "scraping"
@@ -45,9 +52,9 @@
     "pi-web-fetch-demo.mp4"
   ],
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.86.1",
-    "@earendil-works/pi-coding-agent": "0.86.1",
-    "@earendil-works/pi-tui": "0.86.1",
+    "@earendil-works/pi-ai": "1.0.4",
+    "@earendil-works/pi-coding-agent": "1.0.4",
+    "@earendil-works/pi-tui": "1.0.4",
     "@types/turndown": "^5.0.6",
     "esbuild": "^0.28.1",
     "typebox": "1.3.27",
@@ -70,6 +77,17 @@
     "@earendil-works/pi-tui": "*",
     "typebox": "*"
   },
+  "peerDependenciesMeta": {
+    "@earendil-works/pi-ai": {
+      "optional": true
+    },
+    "@earendil-works/pi-coding-agent": {
+      "optional": true
+    },
+    "@earendil-works/pi-tui": {
+      "optional": true
+    }
+  },
   "pi": {
     "extensions": [
       "./dist"