@oh-my-pi/pi-coding-agent 15.10.6 → 15.10.8

package/src/mcp/oauth-flow.ts

@@ -8,6 +8,7 @@
 import type { OAuthCallbackFlowOptions } from "@oh-my-pi/pi-ai/oauth/callback-server";
 import { OAuthCallbackFlow } from "@oh-my-pi/pi-ai/oauth/callback-server";
 import type { OAuthController, OAuthCredentials } from "@oh-my-pi/pi-ai/oauth/types";
+import type { FetchImpl } from "@oh-my-pi/pi-ai/types";
 
 const DEFAULT_PORT = 3000;
 const CALLBACK_PATH = "/callback";
@@ -114,6 +115,8 @@ export interface MCPOAuthConfig {
 	callbackPort?: number;
 	/** Custom callback path (default: /callback or redirectUri pathname) */
 	callbackPath?: string;
+	/** Fetch implementation for token exchange and discovery requests. */
+	fetch?: FetchImpl;
 }
 
 /**
@@ -124,6 +127,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 	#resolvedClientId?: string;
 	#registeredClientSecret?: string;
 	#codeVerifier?: string;
+	#fetch: FetchImpl;
 
 	constructor(
 		private config: MCPOAuthConfig,
@@ -131,6 +135,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 	) {
 		super(ctrl, resolveCallbackOptions(config));
 		this.#resolvedClientId = this.#resolveClientId(config);
+		this.#fetch = config.fetch ?? ctrl.fetch ?? fetch;
 	}
 
 	/**
@@ -212,7 +217,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			params.set("client_secret", clientSecret);
 		}
 
-		const response = await fetch(this.config.tokenUrl, {
+		const response = await this.#fetch(this.config.tokenUrl, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/x-www-form-urlencoded",
@@ -289,7 +294,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		if (!registrationEndpoint) return;
 
 		try {
-			const response = await fetch(registrationEndpoint, {
+			const response = await this.#fetch(registrationEndpoint, {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
@@ -357,7 +362,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 
 	async #tryWellKnownForRegistration(wellKnownUrl: string): Promise<string | null> {
 		try {
-			const response = await fetch(wellKnownUrl, {
+			const response = await this.#fetch(wellKnownUrl, {
 				method: "GET",
 				headers: { Accept: "application/json" },
 			});
@@ -374,7 +379,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 
 	async #assertClientIdNotRequired(authorizationUrl: string): Promise<void> {
 		try {
-			const response = await fetch(authorizationUrl, {
+			const response = await this.#fetch(authorizationUrl, {
 				method: "GET",
 				redirect: "manual",
 				headers: { Accept: "text/plain,text/html,application/json" },
@@ -402,7 +407,9 @@ export async function refreshMCPOAuthToken(
 	refreshToken: string,
 	clientId?: string,
 	clientSecret?: string,
+	opts?: { fetch?: FetchImpl },
 ): Promise<OAuthCredentials> {
+	const fetchImpl: FetchImpl = opts?.fetch ?? fetch;
 	const params = new URLSearchParams({
 		grant_type: "refresh_token",
 		refresh_token: refreshToken,
@@ -410,7 +417,7 @@ export async function refreshMCPOAuthToken(
 	if (clientId) params.set("client_id", clientId);
 	if (clientSecret) params.set("client_secret", clientSecret);
 
-	const response = await fetch(tokenUrl, {
+	const response = await fetchImpl(tokenUrl, {
 		method: "POST",
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: params.toString(),

package/src/modes/components/assistant-message.ts

@@ -5,7 +5,16 @@ import { settings } from "../../config/settings";
 import type { AssistantThinkingRenderer } from "../../extensibility/extensions/types";
 import { getMarkdownTheme, theme } from "../../modes/theme/theme";
 import { resolveAbortLabel, shouldRenderAbortReason } from "../../session/messages";
-import { resolveImageOptions } from "../../tools/render-utils";
+import { getPreviewLines, resolveImageOptions, TRUNCATE_LENGTHS } from "../../tools/render-utils";
+
+/**
+ * Max lines of a turn-ending provider error rendered inline in the transcript.
+ * Bounds pathological error bodies — e.g. a proxy 502 whose body is a full HTML
+ * page — so they can't flood the scrollback. Blank lines are dropped and each
+ * line is width-truncated by {@link getPreviewLines}. Full text is still kept in
+ * the persisted session.
+ */
+const MAX_TRANSCRIPT_ERROR_LINES = 8;
 
 /**
  * Component that renders a complete assistant message
@@ -78,6 +87,22 @@ export class AssistantMessageComponent extends Container {
 		this.#transcriptBlockFinalized = true;
 	}
 
+	/**
+	 * Render a turn-ending provider error inline. Drops blank lines, clamps the
+	 * line count to {@link MAX_TRANSCRIPT_ERROR_LINES}, and width-truncates each
+	 * line so a pathological body — e.g. the HTML page a proxy returns on a 502 —
+	 * can't flood the transcript. Mirrors {@link ErrorBannerComponent}.
+	 */
+	#appendErrorBlock(message: string): void {
+		const lines = getPreviewLines(message, MAX_TRANSCRIPT_ERROR_LINES, TRUNCATE_LENGTHS.LINE);
+		if (lines.length === 0) lines.push("Unknown error");
+		this.#contentContainer.addChild(new Spacer(1));
+		this.#contentContainer.addChild(new Text(theme.fg("error", `Error: ${lines[0]}`), 1, 0));
+		for (const line of lines.slice(1)) {
+			this.#contentContainer.addChild(new Text(theme.fg("error", `  ${line}`), 1, 0));
+		}
+	}
+
 	setToolResultImages(toolCallId: string, images: ImageContent[]): void {
 		if (!toolCallId) return;
 		const validImages = images.filter(img => img.type === "image" && img.data && img.mimeType);
@@ -249,9 +274,7 @@ export class AssistantMessageComponent extends Container {
 				}
 				this.#contentContainer.addChild(new Text(theme.fg("error", abortMessage), 1, 0));
 			} else if (message.stopReason === "error" && !this.#errorPinned) {
-				const errorMsg = message.errorMessage || "Unknown error";
-				this.#contentContainer.addChild(new Spacer(1));
-				this.#contentContainer.addChild(new Text(theme.fg("error", `Error: ${errorMsg}`), 1, 0));
+				this.#appendErrorBlock(message.errorMessage || "Unknown error");
 			}
 		}
 		if (
@@ -260,8 +283,7 @@ export class AssistantMessageComponent extends Container {
 			message.stopReason !== "aborted" &&
 			message.stopReason !== "error"
 		) {
-			this.#contentContainer.addChild(new Spacer(1));
-			this.#contentContainer.addChild(new Text(theme.fg("error", `Error: ${message.errorMessage}`), 1, 0));
+			this.#appendErrorBlock(message.errorMessage);
 		}
 
 		// Token usage metadata

package/src/prompts/tools/read.md

@@ -79,7 +79,6 @@ For `.sqlite`, `.sqlite3`, `.db`, `.db3`:
 <critical>
 - You MUST use `read` for every file, directory, archive, and URL inspection. `cat`, `head`, `tail`, `less`, `more`, `ls`, `tar`, `unzip`, `curl`, `wget` are FORBIDDEN — any such bash call is a bug, regardless of how short or convenient it looks.
 - You MUST prefer `read` over a browser/puppeteer tool for URL content; only reach for a browser when `read` cannot deliver reasonable content.
-- You MUST always include `path`. NEVER call `read` with `{}`.
 - For line ranges, append the selector to `path` (`path="src/foo.ts:50-200"`, `path="src/foo.ts:50+150"`). NEVER substitute `sed -n`, `awk NR`, or `head`/`tail` pipelines.
 - Summary footer says `read <path>:raw …`? Re-issue the exact selector it names. NEVER guess what's inside `..` / `…` markers — they carry no content.
 - You MAY combine selectors with URL reads and internal URIs; both paginate the cached resolved output.

package/src/tools/fetch.ts

@@ -3,7 +3,7 @@ import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
-import type { ImageContent, TextContent } from "@oh-my-pi/pi-ai";
+import type { FetchImpl, ImageContent, TextContent } from "@oh-my-pi/pi-ai";
 import { htmlToMarkdown } from "@oh-my-pi/pi-natives";
 import { type Component, Text } from "@oh-my-pi/pi-tui";
 import { $which, ptree, truncate } from "@oh-my-pi/pi-utils";
@@ -637,6 +637,7 @@ export async function renderHtmlToText(
 	settings: Settings,
 	userSignal: AbortSignal | undefined,
 	storage: AgentStorage | null,
+	fetchOverride?: FetchImpl,
 ): Promise<{ content: string; ok: boolean; method: string }> {
 	const overallSignal = ptree.combineSignals(userSignal, timeout * 1000);
 	const execOptions = {
@@ -650,6 +651,7 @@ export async function renderHtmlToText(
 	// Per-attempt budget for remote endpoints so one stall cannot consume the
 	// whole reader-mode budget and starve the local fallbacks.
 	const remoteSignal = () => ptree.combineSignals(userSignal, remoteBudgetMs);
+	const fetchImpl = fetchOverride ?? fetch;
 
 	const runners: Record<FetchProvider, () => Promise<string | null>> = {
 		// Purely local, no network/subprocess: still works on already-loaded HTML
@@ -670,14 +672,20 @@ export async function renderHtmlToText(
 			if (!findParallelApiKey(storage)) return null;
 			const parallelResult = await extractWithParallel(
 				[url],
-				{ objective: "Extract the main content", excerpts: true, fullContent: false, signal: remoteSignal() },
+				{
+					objective: "Extract the main content",
+					excerpts: true,
+					fullContent: false,
+					signal: remoteSignal(),
+					fetch: fetchImpl,
+				},
 				storage,
 			);
 			const firstDocument = parallelResult.results[0];
 			return firstDocument ? getParallelExtractContent(firstDocument) : null;
 		},
 		jina: async () => {
-			const response = await fetch(`https://r.jina.ai/${url}`, {
+			const response = await fetchImpl(`https://r.jina.ai/${url}`, {
 				headers: { Accept: "text/markdown" },
 				signal: remoteSignal(),
 			});
@@ -1052,6 +1060,7 @@ async function renderUrl(
 	settings: Settings,
 	signal: AbortSignal | undefined,
 	storage: AgentStorage | null,
+	fetchOverride?: FetchImpl,
 ): Promise<FetchRenderResult> {
 	const notes: string[] = [];
 	const fetchedAt = new Date().toISOString();
@@ -1425,7 +1434,15 @@ async function renderUrl(
 		}
 
 		// 5E: Render HTML via the reader-backend chain (native/trafilatura/lynx/parallel/jina)
-		const htmlResult = await renderHtmlToText(finalUrl, rawContent, timeout, settings, signal, storage);
+		const htmlResult = await renderHtmlToText(
+			finalUrl,
+			rawContent,
+			timeout,
+			settings,
+			signal,
+			storage,
+			fetchOverride,
+		);
 		if (!htmlResult.ok) {
 			notes.push("html rendering failed (no reader backend produced usable output)");
 
@@ -1626,7 +1643,7 @@ async function buildReadUrlCacheEntry(
 	}
 
 	const storage = session.settings.getStorage();
-	const result = await renderUrl(url, effectiveTimeout, raw, session.settings, signal, storage);
+	const result = await renderUrl(url, effectiveTimeout, raw, session.settings, signal, storage, session.fetch);
 	const output = buildUrlReadOutput(result, result.content);
 	const artifactId = options?.ensureArtifact ? await persistReadUrlArtifact(session, output) : undefined;
 

package/src/tools/image-gen.ts

@@ -1,6 +1,13 @@
 import * as os from "node:os";
 import * as path from "node:path";
-import { type ApiKey, getAntigravityUserAgent, getEnvApiKey, type Model, withAuth } from "@oh-my-pi/pi-ai";
+import {
+	type ApiKey,
+	type FetchImpl,
+	getAntigravityUserAgent,
+	getEnvApiKey,
+	type Model,
+	withAuth,
+} from "@oh-my-pi/pi-ai";
 import {
 	CODEX_BASE_URL,
 	getCodexAccountId,
@@ -366,7 +373,11 @@ function toDataUrl(image: InlineImageData): string {
 	return `data:${image.mimeType};base64,${image.data}`;
 }
 
-async function loadImageFromUrl(imageUrl: string, signal?: AbortSignal): Promise<InlineImageData> {
+async function loadImageFromUrl(
+	imageUrl: string,
+	fetchImpl: FetchImpl,
+	signal?: AbortSignal,
+): Promise<InlineImageData> {
 	if (imageUrl.startsWith("data:")) {
 		const normalized = normalizeDataUrl(imageUrl.trim());
 		if (!normalized.mimeType) {
@@ -378,7 +389,7 @@ async function loadImageFromUrl(imageUrl: string, signal?: AbortSignal): Promise
 		return { data: normalized.data, mimeType: normalized.mimeType };
 	}
 
-	const response = await fetch(imageUrl, { signal });
+	const response = await fetchImpl(imageUrl, { signal });
 	if (!response.ok) {
 		const rawText = await response.text();
 		throw new Error(`Image download failed (${response.status}): ${rawText}`);
@@ -850,13 +861,14 @@ async function generateOpenAIHostedImage(
 	model: Model,
 	params: ImageGenParams,
 	inputImages: InlineImageData[],
+	fetchImpl: FetchImpl,
 	signal: AbortSignal | undefined,
 	sessionId: string | undefined,
 ): Promise<OpenAIHostedImageResult> {
 	const promptText = assemblePrompt(params);
 	const stream = model.api === "openai-codex-responses" || model.provider === "openai-codex";
 	const requestBody = buildOpenAIHostedImageRequest(model, promptText, params, inputImages, stream);
-	const response = await fetch(getOpenAIResponsesUrl(model), {
+	const response = await fetchImpl(getOpenAIResponsesUrl(model), {
 		method: "POST",
 		headers: buildOpenAIImageHeaders(model, apiKey, sessionId),
 		body: JSON.stringify(requestBody),
@@ -1035,6 +1047,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 			}
 
 			const requestSignal = ptree.combineSignals(signal, IMAGE_TIMEOUT);
+			const fetchImpl = ctx.fetch ?? fetch;
 
 			if (provider === "openai" || provider === "openai-codex") {
 				if (!apiKey.model) {
@@ -1049,7 +1062,16 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 
 				const parsed = await withAuth(
 					hostedKey,
-					key => generateOpenAIHostedImage(key, hostedModel, params, resolvedImages, requestSignal, sessionId),
+					key =>
+						generateOpenAIHostedImage(
+							key,
+							hostedModel,
+							params,
+							resolvedImages,
+							fetchImpl,
+							requestSignal,
+							sessionId,
+						),
 					{ signal: requestSignal },
 				);
 
@@ -1117,7 +1139,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 							resolvedImages,
 						);
 
-						const resp = await fetch(`${ANTIGRAVITY_ENDPOINT}/v1internal:streamGenerateContent?alt=sse`, {
+						const resp = await fetchImpl(`${ANTIGRAVITY_ENDPOINT}/v1internal:streamGenerateContent?alt=sse`, {
 							method: "POST",
 							headers: {
 								Authorization: `Bearer ${bearer}`,
@@ -1225,7 +1247,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 				const xaiRawText = await withAuth(
 					xaiKey,
 					async key => {
-						const resp = await fetch(`${xaiCreds.baseURL}${xaiEndpoint}`, {
+						const resp = await fetchImpl(`${xaiCreds.baseURL}${xaiEndpoint}`, {
 							method: "POST",
 							headers: {
 								Authorization: `Bearer ${key}`,
@@ -1263,7 +1285,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 						const mimeType = parseImageMetadata(bytes)?.mimeType ?? "image/png";
 						xaiInlineImages.push({ data: entry.b64_json, mimeType });
 					} else if (entry.url) {
-						xaiInlineImages.push(await loadImageFromUrl(entry.url, requestSignal));
+						xaiInlineImages.push(await loadImageFromUrl(entry.url, fetchImpl, requestSignal));
 					}
 				}
 
@@ -1309,7 +1331,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 				};
 
 				const rawText = await withAuth(apiKey.apiKey, async key => {
-					const resp = await fetch("https://openrouter.ai/api/v1/chat/completions", {
+					const resp = await fetchImpl("https://openrouter.ai/api/v1/chat/completions", {
 						method: "POST",
 						headers: {
 							"Content-Type": "application/json",
@@ -1343,7 +1365,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 				const imageUrls = extractOpenRouterImageUrls(message);
 				const inlineImages: InlineImageData[] = [];
 				for (const imageUrl of imageUrls) {
-					inlineImages.push(await loadImageFromUrl(imageUrl, requestSignal));
+					inlineImages.push(await loadImageFromUrl(imageUrl, fetchImpl, requestSignal));
 				}
 
 				if (inlineImages.length === 0) {
@@ -1404,7 +1426,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 			};
 
 			const rawText = await withAuth(apiKey.apiKey, async key => {
-				const resp = await fetch(
+				const resp = await fetchImpl(
 					`https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(model)}:generateContent`,
 					{
 						method: "POST",

package/src/tools/index.ts

@@ -1,6 +1,6 @@
 import type { InMemorySnapshotStore } from "@oh-my-pi/hashline";
 import type { AgentTelemetryConfig, AgentTool } from "@oh-my-pi/pi-agent-core";
-import type { ToolChoice } from "@oh-my-pi/pi-ai";
+import type { FetchImpl, ToolChoice } from "@oh-my-pi/pi-ai";
 import { logger } from "@oh-my-pi/pi-utils";
 import type { AsyncJobManager } from "../async/job-manager";
 import type { PromptTemplate } from "../config/prompt-templates";
@@ -142,6 +142,8 @@ export interface ToolSession {
 	cwd: string;
 	/** Whether UI is available */
 	hasUI: boolean;
+	/** Optional fetch implementation injected into the URL read pipeline (tests, proxies). Defaults to global fetch. */
+	fetch?: FetchImpl;
 	/** Skip Python kernel availability check and warmup */
 	skipPythonPreflight?: boolean;
 	/** Pre-loaded context files (AGENTS.md, etc) */
@@ -492,7 +494,7 @@ export async function createTools(session: ToolSession, toolNames?: string[]): P
 	const isToolAllowed = (name: string) => {
 		if (name === "goal") return goalEnabled && goalModeActive;
 		if (name === "lsp") return enableLsp && session.settings.get("lsp.enabled");
-		if (name === "bash") return true;
+		if (name === "bash") return session.settings.get("bash.enabled");
 		if (name === "eval") return allowEval;
 		if (name === "debug") return session.settings.get("debug.enabled");
 		if (name === "todo") return !includeYield && session.settings.get("todo.enabled");

package/src/tools/report-tool-issue.ts

@@ -22,6 +22,7 @@
 import { Database } from "bun:sqlite";
 import path from "node:path";
 import type { AgentTool } from "@oh-my-pi/pi-agent-core";
+import type { FetchImpl } from "@oh-my-pi/pi-ai";
 import { $env, $flag, getAgentDir, getInstallId, logger, VERSION } from "@oh-my-pi/pi-utils";
 import * as z from "zod/v4";
 import type { Settings } from "..";
@@ -260,6 +261,10 @@ export interface FlushOptions {
 	 * future debug recipes); never set from the tool's auto-flush path.
 	 */
 	bypassConsent?: boolean;
+	/**
+	 * Fetch implementation for the push POST. Defaults to global fetch.
+	 */
+	fetch?: FetchImpl;
 	/**
 	 * Fires once at the start of the loop with the snapshot count of
 	 * unpushed rows. Subsequent inserts won't be reflected (the count is
@@ -345,6 +350,7 @@ async function performFlush(db: Database, config: PushConfig, options: FlushOpti
 		const totalRow = db.prepare("SELECT COUNT(*) AS n FROM grievances WHERE pushed = 0").get() as { n: number };
 		options.onStart(totalRow.n);
 	}
+	const fetchImpl = options.fetch ?? fetch;
 	let totalPushed = 0;
 	for (;;) {
 		const rows = selectStmt.all(FLUSH_BATCH_SIZE) as GrievanceRow[];
@@ -366,7 +372,7 @@ async function performFlush(db: Database, config: PushConfig, options: FlushOpti
 
 		let response: Response;
 		try {
-			response = await fetch(config.endpoint, {
+			response = await fetchImpl(config.endpoint, {
 				method: "POST",
 				headers,
 				body,

package/src/web/kagi.ts

@@ -6,7 +6,7 @@
  * through the shared {@link AuthStorage} broker (Bearer token), and responses
  * are categorized result buckets rather than the legacy flat object array.
  */
-import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import type { AuthStorage, FetchImpl } from "@oh-my-pi/pi-ai";
 import { withHardTimeout } from "./search/providers/utils";
 
 const KAGI_SEARCH_URL = "https://kagi.com/api/v1/search";
@@ -156,6 +156,7 @@ export interface KagiSearchOptions {
 	recency?: "day" | "week" | "month" | "year";
 	sessionId?: string;
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 }
 
 export interface KagiSearchSource {
@@ -251,7 +252,9 @@ export async function searchWithKagi(
 		throw new KagiApiError("Kagi credentials not found. Set KAGI_API_KEY or login with 'omp /login kagi'.");
 	}
 
-	const response = await fetch(KAGI_SEARCH_URL, {
+	const fetchImpl = options.fetch ?? fetch;
+
+	const response = await fetchImpl(KAGI_SEARCH_URL, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${apiKey}`,

package/src/web/parallel.ts

@@ -1,4 +1,4 @@
-import { getEnvApiKey } from "@oh-my-pi/pi-ai";
+import { type FetchImpl, getEnvApiKey } from "@oh-my-pi/pi-ai";
 import type { AgentStorage } from "../session/agent-storage";
 import { findCredential, withHardTimeout } from "./search/providers/utils";
 
@@ -54,6 +54,7 @@ export interface ParallelSearchOptions {
 	mode?: "fast" | "research";
 	maxCharsPerResult?: number;
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 }
 
 export interface ParallelExtractOptions {
@@ -62,6 +63,7 @@ export interface ParallelExtractOptions {
 	excerpts?: boolean;
 	fullContent?: boolean;
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 }
 
 export class ParallelApiError extends Error {
@@ -295,7 +297,8 @@ export async function searchWithParallel(
 		);
 	}
 
-	const response = await fetch(PARALLEL_SEARCH_URL, {
+	const fetchImpl = options.fetch ?? fetch;
+	const response = await fetchImpl(PARALLEL_SEARCH_URL, {
 		method: "POST",
 		headers: getAuthHeaders(apiKey),
 		body: JSON.stringify({
@@ -328,7 +331,8 @@ export async function extractWithParallel(
 		);
 	}
 
-	const response = await fetch(PARALLEL_EXTRACT_URL, {
+	const fetchImpl = options.fetch ?? fetch;
+	const response = await fetchImpl(PARALLEL_EXTRACT_URL, {
 		method: "POST",
 		headers: getAuthHeaders(apiKey),
 		body: JSON.stringify({

package/src/web/search/providers/anthropic.ts

@@ -13,6 +13,7 @@ import {
 	buildAnthropicSearchHeaders,
 	buildAnthropicSystemBlocks,
 	buildAnthropicUrl,
+	type FetchImpl,
 	stripClaudeToolPrefix,
 	withAuth,
 } from "@oh-my-pi/pi-ai";
@@ -40,6 +41,7 @@ export interface AnthropicSearchParams {
 	max_tokens?: number;
 	temperature?: number;
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 }
 
 /**
@@ -89,6 +91,7 @@ async function callSearch(
 	maxTokens?: number,
 	temperature?: number,
 	signal?: AbortSignal,
+	fetchImpl: FetchImpl = fetch,
 ): Promise<AnthropicApiResponse> {
 	const url = buildAnthropicUrl(auth);
 	const headers = buildAnthropicSearchHeaders(auth);
@@ -115,7 +118,7 @@ async function callSearch(
 		body.system = systemBlocks;
 	}
 
-	const response = await fetch(url, {
+	const response = await fetchImpl(url, {
 		method: "POST",
 		headers,
 		body: JSON.stringify(body),
@@ -275,6 +278,7 @@ export async function searchAnthropic(
 				maxTokens,
 				params.temperature,
 				params.signal,
+				params.fetch,
 			),
 		{
 			signal: params.signal,

package/src/web/search/providers/base.ts

@@ -1,4 +1,4 @@
-import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import type { AuthStorage, FetchImpl } from "@oh-my-pi/pi-ai";
 import type { SearchProviderId, SearchResponse } from "../types";
 
 /**
@@ -30,6 +30,7 @@ export interface SearchParams {
 	recency?: "day" | "week" | "month" | "year";
 	systemPrompt: string;
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 	maxOutputTokens?: number;
 	numSearchResults?: number;
 	temperature?: number;

package/src/web/search/providers/brave.ts

@@ -4,7 +4,7 @@
  * Calls Brave's web search REST API and maps results into the unified
  * SearchResponse shape used by the web search tool.
  */
-import { type AuthStorage, getEnvApiKey } from "@oh-my-pi/pi-ai";
+import { type AuthStorage, type FetchImpl, getEnvApiKey } from "@oh-my-pi/pi-ai";
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
 import { clampNumResults, dateToAgeSeconds } from "../utils";
@@ -28,6 +28,7 @@ export interface BraveSearchParams {
 	num_results?: number;
 	recency?: "day" | "week" | "month" | "year";
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 }
 
 interface BraveSearchResult {
@@ -80,7 +81,8 @@ async function callBraveSearch(
 		url.searchParams.set("freshness", RECENCY_MAP[params.recency]);
 	}
 
-	const response = await fetch(url, {
+	const fetchImpl = params.fetch ?? fetch;
+	const response = await fetchImpl(url, {
 		headers: {
 			Accept: "application/json",
 			"X-Subscription-Token": apiKey,
@@ -144,6 +146,7 @@ export class BraveProvider extends SearchProvider {
 			num_results: params.numSearchResults ?? params.limit,
 			recency: params.recency,
 			signal: params.signal,
+			fetch: params.fetch,
 		});
 	}
 }

package/src/web/search/providers/codex.ts

@@ -7,7 +7,7 @@
  * SQLite store, never POSTs the broker sentinel to an OpenAI token endpoint.
  */
 import * as os from "node:os";
-import { type AuthStorage, getBundledModels } from "@oh-my-pi/pi-ai";
+import { type AuthStorage, type FetchImpl, getBundledModels } from "@oh-my-pi/pi-ai";
 import { decodeJwt } from "@oh-my-pi/pi-ai/oauth/openai-codex";
 import { $env, readSseJson } from "@oh-my-pi/pi-utils";
 import packageJson from "../../../../package.json" with { type: "json" };
@@ -66,6 +66,7 @@ function shouldRetryWithNextDefaultModel(error: unknown): boolean {
 
 export interface CodexSearchParams {
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 	query: string;
 	system_prompt?: string;
 	num_results?: number;
@@ -322,6 +323,7 @@ async function callCodexSearch(
 		systemPrompt?: string;
 		searchContextSize?: "low" | "medium" | "high";
 		modelId: string;
+		fetch?: FetchImpl;
 	},
 ): Promise<{
 	answer: string;
@@ -356,7 +358,8 @@ async function callCodexSearch(
 		instructions: options.systemPrompt ?? DEFAULT_INSTRUCTIONS,
 	};
 
-	const response = await fetch(url, {
+	const fetchImpl = options.fetch ?? fetch;
+	const response = await fetchImpl(url, {
 		method: "POST",
 		headers,
 		body: JSON.stringify(body),
@@ -522,6 +525,7 @@ export async function searchCodex(params: SearchParams): Promise<SearchResponse>
 				systemPrompt: params.systemPrompt,
 				searchContextSize: "high",
 				modelId,
+				fetch: params.fetch,
 			});
 			break;
 		} catch (error) {