@mercury-fw/plugin-web-search 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @mercury-fw/plugin-web-search
 
+## 0.1.1
+
+### Patch Changes
+
+- 4431285: - plugin-web-search README: the minimum core (0.53), the Italian labels the person reads, where a person's list lives and how to edit it, and a config example matching the app `mfw create` writes.
+  - channel-google-chat README: the confirmation card has a button per choice, and a choice whose result goes back to the model runs the turn again.
+
 ## 0.1.0
 
 ### Minor Changes

package/README.md

@@ -13,7 +13,7 @@ import { searxngBackend } from "@mercury-fw/web-search-searxng";
 export default defineMercuryConfig({
   plugins: [
     webSearchPlugin({
-      backend: searxngBackend({ url: process.env.SEARXNG_URL! }),
+      backend: searxngBackend({ url: process.env.SEARXNG_URL || "http://searxng:8080" }),
       allowedHosts: ["bun.sh", "developer.mozilla.org"],
     }),
   ],
@@ -22,7 +22,9 @@ export default defineMercuryConfig({
 
 The model gets two tools. `web_search` returns title, URL and snippet of each result, and `web_fetch` reads a page and returns its title and text (the main content, found by Readability; menus, footers and scripts are left out). An answer built on pages ends with a `Fonti:` list of what was read, written by the plugin and not by the model, so it can't be left out or made up (a title is the site's text, so it shows up cut at 120 characters and stripped of links and formatting).
 
-The plugin acts as no one (`actsAs: "anyone"`): there's no login, everyone gets it, and `access.plugins` in the config restricts it to some roles like any other plugin.
+The plugin acts as no one (`actsAs: "anyone"`): there's no login, everyone gets it, and `access.plugins` in the config restricts it to some roles like any other plugin. That needs `@mercury-fw/core` 0.53 or later: an older core doesn't know `"anyone"`, reads it as `"mercury"`, and offers the plugin only to whoever holds `mercury.act-as-self`.
+
+What the person reads in its own words is fixed Italian text, whatever language the assistant speaks: the two choices ("Solo questa volta", "Sempre per \<host\>"), the `Fonti:` heading and the status lines while a tool runs ("Cerco sul web", "Leggo \<host\>").
 
 ## Which pages it reads
 
@@ -35,6 +37,8 @@ For any other host the plugin asks the person, through the same confirmation Mer
 
 Either way the page goes back to the model, which answers on it in the same conversation. A person's list is theirs alone (nobody else's reads change), and it lives in the plugin's folder on the vault's volume, so it survives a restart; with a core that gives the plugin no folder, only the first choice is offered.
 
+The list is one JSON file per person, `<vault>/.mercury/plugins/web-search/allowlist/<user key>.json`, the user key URL-encoded (`google-chat:users/42` becomes `google-chat%3Ausers%2F42.json`), holding `{ "hosts": [...] }`. No command lists or edits it yet ([#259](https://github.com/lucabro81/mercury-fw/issues/259)): to take a host back, open a shell in the container (`mfw shell`) and edit the file, whose folder is under `WIKI_VAULT_PATH`. A file the plugin can't read as a list is copied aside (`<file>.corrupt-<time>-<id>`) before the next host replaces it, so a hand edit gone wrong loses nothing.
+
 Why not let the model read anything it finds? Because Mercury also reads private data (Jira, the wiki), and a page can carry instructions for the model: an open `web_fetch` would let a hostile page make it send that data out inside a URL. Asking the person for every new host closes that, and the allowlist keeps it from getting in the way on the sites a team actually uses.
 
 A host nobody allowed isn't even looked up in DNS before the person answers: a host name can carry data, and its DNS server would hear it. Some addresses are never read, allowlist or not: anything that isn't http or https, a URL with credentials in it, and every host that resolves to a loopback, private, link-local or otherwise internal address (the app's own Qdrant, the model's endpoint, a cloud's metadata address). The check runs on the first URL and again on every redirect, and a redirect to a host that isn't allowed stops the read. It can't catch a host that resolves to a public address at the check and to an internal one a moment later, when the page downloads (DNS rebinding), since Bun's `fetch` takes no resolved address. A proxy set for the container (`HTTP_PROXY`, `HTTPS_PROXY`) resolves names itself, past this check, so don't give the app one unless it enforces the same rules. Allowing a host, even for one page, means trusting whoever runs it: when the app's network holds something that must stay unreachable whatever happens, block the container's outgoing traffic to it at the network level as well.

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * for the person's permission, given once or for good (see `tools.ts`).
  *
  * ```ts
- * webSearchPlugin({ backend: searxngBackend({ url: process.env.SEARXNG_URL! }), allowedHosts: ["bun.sh"] })
+ * webSearchPlugin({ backend: searxngBackend({ url: process.env.SEARXNG_URL || "http://searxng:8080" }), allowedHosts: ["bun.sh"] })
  * ```
  */
 import { type Plugin } from "@mercury-fw/plugin-types";

package/index.ts

@@ -7,7 +7,7 @@
  * for the person's permission, given once or for good (see `tools.ts`).
  *
  * ```ts
- * webSearchPlugin({ backend: searxngBackend({ url: process.env.SEARXNG_URL! }), allowedHosts: ["bun.sh"] })
+ * webSearchPlugin({ backend: searxngBackend({ url: process.env.SEARXNG_URL || "http://searxng:8080" }), allowedHosts: ["bun.sh"] })
  * ```
  */
 import { PLUGIN_API_VERSION, type Plugin } from "@mercury-fw/plugin-types";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercury-fw/plugin-web-search",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "license": "MIT",
   "repository": {
     "type": "git",