@oh-my-pi/pi-coding-agent 16.4.2 → 16.4.3

package/src/web/search/providers/public.ts

@@ -0,0 +1,201 @@
+import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import { formatSearchProviderFailures, getSearchProvider, isSearchProviderExcluded } from "../provider";
+import type { SearchProviderId, SearchResponse, SearchSource } from "../types";
+import { SearchProviderError } from "../types";
+import { clampNumResults } from "../utils";
+import type { SearchParams } from "./base";
+import { SearchProvider } from "./base";
+import { withHardTimeout } from "./utils";
+
+/**
+ * Credential-free engines the Public Web aggregate fans out to. Order is the
+ * tiebreak for merged ranking (earlier engines win equal consensus/rank), so
+ * engines with the best ranking quality when they answer come first:
+ * Google-index engines (startpage, google) lead, Bing-backed scrapers follow,
+ * and Mojeek's independent index breaks remaining ties (measured 2026-07).
+ */
+const PUBLIC_ENGINE_IDS = [
+	"startpage",
+	"google",
+	"duckduckgo",
+	"bing",
+	"yahoo",
+	"ecosia",
+	"mojeek",
+] as const satisfies readonly SearchProviderId[];
+
+/** Aggregates get a wider default window than single engines: consensus needs breadth. */
+const DEFAULT_NUM_RESULTS = 15;
+const MAX_NUM_RESULTS = 30;
+
+/**
+ * Soft deadline for the fan-out: past this point the aggregate returns as
+ * soon as it has at least one engine's results. Fast HTML engines answer
+ * well under this; browser-backed engines (google, ecosia, mojeek) routinely
+ * exceed it and are treated as bonus coverage rather than latency floor.
+ */
+const SOFT_DEADLINE_MS = 5_000;
+
+/**
+ * Hard deadline for the fan-out: the aggregate returns whatever it has, even
+ * nothing, so one pathologically slow engine can never pin the tool call to
+ * the per-request 60s ceiling.
+ */
+const HARD_DEADLINE_MS = 30_000;
+
+/** Deadline overrides — test seam; production callers use the defaults. */
+export interface PublicWebDeadlines {
+	softMs?: number;
+	hardMs?: number;
+}
+
+/** Accumulator for one deduplicated URL across engines. */
+interface MergedSource {
+	source: SearchSource;
+	/** Number of engines that returned this URL — the primary ranking signal. */
+	engines: number;
+	/** Best (lowest) per-engine rank observed. */
+	bestRank: number;
+	/** First-seen insertion index; final tiebreak keeps ordering deterministic. */
+	order: number;
+}
+
+/**
+ * Canonical dedup key for a result URL: case-normalized host without a
+ * leading `www.`, path without a trailing slash, query preserved, fragment
+ * dropped. Engines disagree on exactly these variations for the same page.
+ */
+function dedupKey(rawUrl: string): string {
+	try {
+		const url = new URL(rawUrl);
+		const host = url.hostname.toLowerCase().replace(/^www\./, "");
+		let path = url.pathname;
+		if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1);
+		return `${host}${path}${url.search}`;
+	} catch {
+		return rawUrl;
+	}
+}
+
+/** Merge one engine's ranked sources into the accumulator map. */
+function mergeSources(merged: Map<string, MergedSource>, sources: readonly SearchSource[]): void {
+	for (const [rank, source] of sources.entries()) {
+		const key = dedupKey(source.url);
+		const existing = merged.get(key);
+		if (!existing) {
+			merged.set(key, { source: { ...source }, engines: 1, bestRank: rank, order: merged.size });
+			continue;
+		}
+		existing.engines += 1;
+		if (rank < existing.bestRank) {
+			existing.bestRank = rank;
+			existing.source.title = source.title;
+			existing.source.url = source.url;
+		}
+		// Keep the most informative snippet regardless of which engine ranked it best.
+		if (source.snippet && source.snippet.length > (existing.source.snippet?.length ?? 0)) {
+			existing.source.snippet = source.snippet;
+		}
+		existing.source.publishedDate ??= source.publishedDate;
+		existing.source.ageSeconds ??= source.ageSeconds;
+	}
+}
+
+/**
+ * Execute a web search against every credential-free engine in parallel and
+ * consolidate the results: URLs are deduplicated across engines, ranked by
+ * cross-engine consensus (how many engines returned them), then by best
+ * per-engine rank.
+ *
+ * The fan-out races three exits and returns at the earliest: every engine
+ * settled; the soft deadline elapsed with at least one success in hand; the
+ * hard deadline elapsed regardless. If the soft deadline fires before any
+ * engine has delivered, the aggregate keeps waiting (up to the hard cap) for
+ * the first success, so a slow field degrades to fewer engines rather than
+ * an empty answer. Stragglers are aborted once the race resolves. Individual
+ * engine failures (bot challenges, timeouts) are tolerated; the call fails
+ * only when every engine fails.
+ */
+export async function searchPublicWeb(
+	params: SearchParams,
+	deadlines: PublicWebDeadlines = {},
+): Promise<SearchResponse> {
+	const softMs = deadlines.softMs ?? SOFT_DEADLINE_MS;
+	const hardMs = deadlines.hardMs ?? HARD_DEADLINE_MS;
+	const numResults = clampNumResults(params.numSearchResults ?? params.limit, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
+	const engineIds = PUBLIC_ENGINE_IDS.filter(id => !isSearchProviderExcluded(id));
+	if (engineIds.length === 0) {
+		throw new SearchProviderError("public", "Every credential-free engine is excluded by settings.", 400);
+	}
+
+	// Each engine composes its own per-request ceiling on top of the shared
+	// hard deadline; the straggler controller lets the aggregate cancel
+	// still-running engines once it decides to return.
+	const straggler = new AbortController();
+	const signal = AbortSignal.any([withHardTimeout(params.signal), straggler.signal]);
+
+	const responses: (SearchResponse | undefined)[] = new Array(engineIds.length);
+	const failures: { provider: { id: SearchProviderId; label: string }; error: unknown }[] = [];
+	const firstSuccess = Promise.withResolvers<void>();
+	const all = Promise.all(
+		engineIds.map(async (id, index) => {
+			try {
+				const provider = await getSearchProvider(id);
+				responses[index] = await provider.search({ ...params, signal });
+				firstSuccess.resolve();
+			} catch (error) {
+				failures.push({ provider: { id, label: id }, error });
+			}
+		}),
+	);
+
+	await Promise.race([all, Bun.sleep(softMs)]);
+	if (!responses.some(response => response !== undefined) && failures.length < engineIds.length) {
+		await Promise.race([all, firstSuccess.promise, Bun.sleep(Math.max(0, hardMs - softMs))]);
+	}
+	straggler.abort();
+
+	// Merge in engine-priority order (not settlement order) so ranking
+	// tiebreaks stay deterministic.
+	const merged = new Map<string, MergedSource>();
+	for (const response of responses) {
+		if (response) mergeSources(merged, response.sources);
+	}
+
+	if (merged.size === 0 && failures.length === engineIds.length) {
+		throw new SearchProviderError(
+			"public",
+			`All public engines failed: ${formatSearchProviderFailures(failures)}`,
+			503,
+		);
+	}
+
+	const sources = [...merged.values()]
+		.sort((a, b) => b.engines - a.engines || a.bestRank - b.bestRank || a.order - b.order)
+		.slice(0, numResults)
+		.map(entry => entry.source);
+
+	return { provider: "public", sources };
+}
+
+/**
+ * Aggregate meta-provider over every credential-free engine. Explicit-only:
+ * the auto chain already walks the individual engines sequentially, so
+ * fanning out to all of them is a deliberate user choice, not a fallback.
+ */
+export class PublicWebProvider extends SearchProvider {
+	readonly id = "public";
+	readonly label = "Public Web";
+
+	isAvailable(_authStorage: AuthStorage): boolean {
+		return false;
+	}
+
+	isExplicitlyAvailable(_authStorage: AuthStorage): boolean {
+		return true;
+	}
+
+	search(params: SearchParams): Promise<SearchResponse> {
+		return searchPublicWeb(params);
+	}
+}

package/src/web/search/providers/startpage.ts

@@ -0,0 +1,213 @@
+import type { AuthStorage, FetchImpl } from "@oh-my-pi/pi-ai";
+import { parseHTML } from "linkedom";
+import type { SearchResponse, SearchSource } from "../../../web/search/types";
+import { SearchProviderError } from "../../../web/search/types";
+import { clampNumResults } from "../utils";
+import type { SearchParams } from "./base";
+import { SearchProvider } from "./base";
+import type { LoadedHtmlPage } from "./browser-page";
+import { browserFetch } from "./browser-page";
+import { classifyProviderHttpError, withHardTimeout } from "./utils";
+
+/**
+ * Startpage proxies Google's index behind a privacy frontend and serves fully
+ * server-rendered result pages — no JS challenge on the happy path. Its bot
+ * defense keys on requests that skip the homepage handshake: the search form
+ * carries a session token (`sc`) plus sibling hidden inputs, and posting the
+ * form with a stale/absent token 302s to the `/en/errors/` CAPTCHA shell.
+ * The robust flow is therefore the same dance a real browser performs: GET
+ * the homepage, lift the form's hidden inputs, POST them back with the query.
+ */
+const STARTPAGE_HOME_URL = "https://www.startpage.com/";
+const STARTPAGE_SEARCH_URL = "https://www.startpage.com/sp/search";
+const DEFAULT_NUM_RESULTS = 10;
+const MAX_NUM_RESULTS = 20;
+
+/**
+ * Recency → Startpage `with_date` param. Accepts single letters; an absent
+ * value returns the unfiltered default.
+ */
+const RECENCY_TO_STARTPAGE_WITH_DATE: Record<NonNullable<SearchParams["recency"]>, string> = {
+	day: "d",
+	week: "w",
+	month: "m",
+	year: "y",
+};
+
+/** One organic result lifted from the Startpage results page. */
+interface ParsedResult {
+	title: string;
+	url: string;
+	snippet?: string;
+}
+
+function normalizeText(value: string | null | undefined): string {
+	return (value ?? "").replace(/\s+/g, " ").trim();
+}
+
+/**
+ * `true` when Startpage answered with its CAPTCHA/error shell instead of
+ * results. Rejected requests 302 to `/en/errors/` (legacy: `/sp/captcha`), a
+ * Gatsby SPA whose chunk map names the captcha page components; the body
+ * marker matters because mocked fetch responses carry no final URL. A bare
+ * "captcha" substring is deliberately not used — result snippets for
+ * captcha-related queries would false-positive.
+ */
+function isChallengeResponse(page: LoadedHtmlPage): boolean {
+	if (/\/(?:errors|captcha)\//.test(page.url) || page.url.includes("/sp/captcha")) return true;
+	return page.html.includes("component---src-pages-captcha") || page.html.includes("/sp/captcha");
+}
+
+/**
+ * Lift the hidden inputs from the homepage's `/sp/search` form. Returns
+ * `undefined` when the form or its `sc` anti-bot token cannot be found so the
+ * caller can degrade to a tokenless GET instead of posting a doomed form.
+ */
+function parseSearchFormInputs(html: string): Record<string, string> | undefined {
+	const { document } = parseHTML(html);
+	const form = document.querySelector('form[action="/sp/search"]');
+	if (!form) return undefined;
+	const inputs: Record<string, string> = {};
+	for (const input of form.querySelectorAll('input[type="hidden"]')) {
+		const name = input.getAttribute("name");
+		if (name) inputs[name] = input.getAttribute("value") ?? "";
+	}
+	return inputs.sc ? inputs : undefined;
+}
+
+/** Accept only http(s) result targets that point away from Startpage itself. */
+function sanitizeResultUrl(href: string | null | undefined): string | undefined {
+	if (!href) return undefined;
+	let url: URL;
+	try {
+		url = new URL(href, STARTPAGE_HOME_URL);
+	} catch {
+		return undefined;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return undefined;
+	if (url.hostname === "startpage.com" || url.hostname.endsWith(".startpage.com")) return undefined;
+	return url.href;
+}
+
+/**
+ * Walk the server-rendered results page in document order.
+ *
+ * Each organic hit lives in a `div.result` container holding the title
+ * anchor `a.result-link` (with an `h2.wgl-title` heading) and an optional
+ * `p.description` snippet. Hrefs are direct target URLs — Startpage does not
+ * wrap outbound clicks. The offscreen adblock-honeypot div uses the class
+ * token `a-bg-result`, which a CSS class selector correctly ignores, and
+ * sponsored placements render outside `div.result` containers.
+ */
+function parseHtmlResults(html: string): ParsedResult[] {
+	const { document } = parseHTML(html);
+	const results: ParsedResult[] = [];
+	for (const block of document.querySelectorAll("div.result")) {
+		const anchor = block.querySelector("a.result-link");
+		if (!anchor) continue;
+		const url = sanitizeResultUrl(anchor.getAttribute("href"));
+		if (!url) continue;
+		const title = normalizeText(anchor.querySelector("h2, h3")?.textContent ?? anchor.textContent);
+		if (!title) continue;
+		const snippet = normalizeText(block.querySelector("p.description")?.textContent);
+		results.push({ title, url, snippet: snippet || undefined });
+	}
+	return results;
+}
+
+/**
+ * Fetch the homepage and lift the search form's hidden inputs. Best effort:
+ * any failure (network, non-OK status, challenge shell, markup drift) yields
+ * `undefined` and the caller falls back to a direct GET.
+ */
+async function fetchFormInputs(fetchImpl: FetchImpl, signal: AbortSignal): Promise<Record<string, string> | undefined> {
+	let page: LoadedHtmlPage;
+	try {
+		page = await browserFetch(STARTPAGE_HOME_URL, { fetch: fetchImpl, signal });
+	} catch (error) {
+		if (signal.aborted) throw error;
+		return undefined;
+	}
+	if (page.status < 200 || page.status >= 300 || isChallengeResponse(page)) return undefined;
+	return parseSearchFormInputs(page.html);
+}
+
+async function callStartpageHtml(params: SearchParams): Promise<string> {
+	const fetchImpl = params.fetch ?? fetch;
+	const signal = withHardTimeout(params.signal);
+	const withDate = params.recency ? RECENCY_TO_STARTPAGE_WITH_DATE[params.recency] : undefined;
+
+	const formInputs = await fetchFormInputs(fetchImpl, signal);
+	let page: LoadedHtmlPage;
+	if (formInputs) {
+		const form = new URLSearchParams(formInputs);
+		form.set("query", params.query);
+		if (withDate) form.set("with_date", withDate);
+		page = await browserFetch(STARTPAGE_SEARCH_URL, {
+			fetch: fetchImpl,
+			signal,
+			referer: STARTPAGE_HOME_URL,
+			init: { method: "POST", body: form.toString() },
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		});
+	} else {
+		const url = new URL(STARTPAGE_SEARCH_URL);
+		url.searchParams.set("query", params.query);
+		if (withDate) url.searchParams.set("with_date", withDate);
+		page = await browserFetch(url.href, {
+			fetch: fetchImpl,
+			signal,
+			referer: STARTPAGE_HOME_URL,
+		});
+	}
+
+	if (isChallengeResponse(page)) {
+		throw new SearchProviderError(
+			"startpage",
+			"Startpage blocked the request with a CAPTCHA challenge. Startpage rate-limits automated searches from datacenter/shared-egress IPs; try another provider such as DuckDuckGo or Mojeek, or retry later.",
+			429,
+		);
+	}
+	if (page.status < 200 || page.status >= 300) {
+		const classified = classifyProviderHttpError("startpage", page.status, page.html);
+		if (classified) throw classified;
+		throw new SearchProviderError("startpage", `Startpage HTML error (${page.status})`, page.status);
+	}
+	return page.html;
+}
+
+/** Execute a Startpage web search via the homepage-token form flow. */
+export async function searchStartpage(params: SearchParams): Promise<SearchResponse> {
+	const numResults = clampNumResults(params.numSearchResults ?? params.limit, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
+	const html = await callStartpageHtml(params);
+	const parsed = parseHtmlResults(html);
+
+	const sources: SearchSource[] = [];
+	const seen = new Set<string>();
+	for (const result of parsed) {
+		if (seen.has(result.url)) continue;
+		seen.add(result.url);
+		sources.push({ title: result.title, url: result.url, snippet: result.snippet });
+		if (sources.length >= numResults) break;
+	}
+
+	return { provider: "startpage", sources };
+}
+
+/** Search provider for Startpage (no API key required). */
+export class StartpageProvider extends SearchProvider {
+	readonly id = "startpage";
+	readonly label = "Startpage";
+
+	isAvailable(_authStorage: AuthStorage): boolean {
+		return true;
+	}
+
+	isExplicitlyAvailable(_authStorage: AuthStorage): boolean {
+		return true;
+	}
+
+	search(params: SearchParams): Promise<SearchResponse> {
+		return searchStartpage(params);
+	}
+}

package/src/web/search/providers/yahoo.ts

@@ -0,0 +1,179 @@
+import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import { parseHTML } from "linkedom";
+import type { SearchResponse, SearchSource } from "../../../web/search/types";
+import { SearchProviderError } from "../../../web/search/types";
+import { clampNumResults } from "../utils";
+import type { SearchParams } from "./base";
+import { SearchProvider } from "./base";
+import { browserFetch } from "./browser-page";
+import { classifyProviderHttpError, withHardTimeout } from "./utils";
+
+/**
+ * Yahoo Search's server-rendered results page. A plain GET with browser
+ * navigation headers returns the full SERP without any JavaScript challenge,
+ * so no headless-browser fallback is needed (verified live 2026-07).
+ */
+const YAHOO_HOME_URL = "https://search.yahoo.com/";
+const YAHOO_SEARCH_URL = "https://search.yahoo.com/search";
+const DEFAULT_NUM_RESULTS = 10;
+const MAX_NUM_RESULTS = 20;
+
+/**
+ * Recency → Yahoo `btf` query param. Yahoo's time filter only offers
+ * day/week/month; `year` has no equivalent and is silently dropped per the
+ * {@link SearchParams.recency} contract.
+ */
+const RECENCY_TO_YAHOO_BTF: Partial<Record<NonNullable<SearchParams["recency"]>, string>> = {
+	day: "d",
+	week: "w",
+	month: "m",
+};
+
+interface ParsedResult {
+	title: string;
+	url: string;
+	snippet?: string;
+}
+
+/**
+ * Resolve a Yahoo result href back to the underlying target URL.
+ *
+ * Organic hrefs are wrapped through the click tracker
+ * `https://r.search.yahoo.com/_ylt=…/RU=<percent-encoded-target>/RK=…/RS=…`;
+ * the `/RU=` path segment carries the destination. Older layouts emit plain
+ * absolute hrefs, so both shapes are handled. Tracker links without a
+ * recoverable target and Yahoo-internal navigation are rejected.
+ */
+function unwrapResultUrl(href: string): string | undefined {
+	let url: URL;
+	try {
+		url = new URL(href, YAHOO_HOME_URL);
+	} catch {
+		return undefined;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return undefined;
+
+	const wrapped = /\/RU=([^/]+)/.exec(url.pathname);
+	if (wrapped) {
+		let target: string;
+		try {
+			target = decodeURIComponent(wrapped[1]);
+		} catch {
+			return undefined;
+		}
+		return target.startsWith("http://") || target.startsWith("https://") ? target : undefined;
+	}
+	// A tracker link without an RU segment has no recoverable destination.
+	if (url.hostname === "r.search.yahoo.com") return undefined;
+	// Relative hrefs resolve against the search host: internal navigation.
+	if (url.hostname === "search.yahoo.com") return undefined;
+	return url.href;
+}
+
+/**
+ * Walk the SERP and pull organic result blocks in document order.
+ *
+ * Organics render as `<div class="… algo …">` blocks (inside `#web`'s
+ * `<ol>`): the title `<h3>` sits inside the tracker `<a>` in the current
+ * layout, while legacy layouts nested the `<a>` inside `<h3 class="title">`
+ * — both are handled. The preview text lives in a sibling
+ * `<div class="compText">`. Module headers ("Videos", "People also ask")
+ * carry `<h3>`s outside `.algo` blocks and are excluded by construction.
+ */
+function parseHtmlResults(html: string): ParsedResult[] {
+	const { document } = parseHTML(html);
+	const results: ParsedResult[] = [];
+	for (const block of document.querySelectorAll("div.algo")) {
+		const heading = block.querySelector("h3");
+		if (!heading) continue;
+		const anchor = heading.querySelector("a") ?? heading.closest("a");
+		const href = anchor?.getAttribute("href");
+		if (!href) continue;
+		const url = unwrapResultUrl(href);
+		if (!url) continue;
+		const title = (heading.textContent ?? "").replace(/\s+/g, " ").trim();
+		if (!title) continue;
+		const snippet = (block.querySelector(".compText")?.textContent ?? "").replace(/\s+/g, " ").trim() || undefined;
+		results.push({ title, url, snippet });
+	}
+	return results;
+}
+
+/**
+ * `true` when Yahoo answered with its EU consent interstitial instead of
+ * results: either the request was redirected to consent.yahoo.com /
+ * guce.yahoo.com, or the body carries the consent form. The normal SERP
+ * mentions guce.yahoo.com only in a meta tag, so detection keys on the
+ * consent-host redirect and the `collectConsent` form action.
+ */
+function isConsentInterstitial(finalUrl: string, html: string): boolean {
+	if (/^https?:\/\/(?:[^/]*\.)?(?:consent|guce)\.yahoo\.com\//i.test(finalUrl)) return true;
+	return html.includes("consent.yahoo.com") || html.includes("collectConsent");
+}
+
+async function callYahooHtml(params: SearchParams, numResults: number): Promise<string> {
+	const url = new URL(YAHOO_SEARCH_URL);
+	url.searchParams.set("p", params.query);
+	url.searchParams.set("n", String(numResults));
+	const btf = params.recency ? RECENCY_TO_YAHOO_BTF[params.recency] : undefined;
+	if (btf) url.searchParams.set("btf", btf);
+
+	const page = await browserFetch(url.href, {
+		fetch: params.fetch ?? fetch,
+		signal: withHardTimeout(params.signal),
+		referer: YAHOO_HOME_URL,
+	});
+
+	const body = page.html;
+	if (page.status < 200 || page.status >= 300) {
+		const classified = classifyProviderHttpError("yahoo", page.status, body);
+		if (classified) throw classified;
+		throw new SearchProviderError("yahoo", `Yahoo HTML error (${page.status})`, page.status);
+	}
+
+	if (isConsentInterstitial(page.url, body)) {
+		throw new SearchProviderError(
+			"yahoo",
+			"Yahoo served its GDPR consent interstitial instead of search results. This typically affects EU egress IPs; use another web search provider such as DuckDuckGo, Brave, or Mojeek.",
+			429,
+		);
+	}
+
+	return body;
+}
+
+/** Execute a Yahoo web search via the server-rendered HTML results page. */
+export async function searchYahoo(params: SearchParams): Promise<SearchResponse> {
+	const numResults = clampNumResults(params.numSearchResults ?? params.limit, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
+	const html = await callYahooHtml(params, numResults);
+	const parsed = parseHtmlResults(html);
+
+	const sources: SearchSource[] = [];
+	const seen = new Set<string>();
+	for (const result of parsed) {
+		if (seen.has(result.url)) continue;
+		seen.add(result.url);
+		sources.push({ title: result.title, url: result.url, snippet: result.snippet });
+		if (sources.length >= numResults) break;
+	}
+
+	return { provider: "yahoo", sources };
+}
+
+/** Search provider for Yahoo (no API key required). */
+export class YahooProvider extends SearchProvider {
+	readonly id = "yahoo";
+	readonly label = "Yahoo";
+
+	isAvailable(_authStorage: AuthStorage): boolean {
+		return true;
+	}
+
+	isExplicitlyAvailable(_authStorage: AuthStorage): boolean {
+		return true;
+	}
+
+	search(params: SearchParams): Promise<SearchResponse> {
+		return searchYahoo(params);
+	}
+}

package/src/web/search/types.ts

@@ -43,11 +43,46 @@ export const SEARCH_PROVIDER_OPTIONS = [
 	{ value: "parallel", label: "Parallel", description: "Requires PARALLEL_API_KEY" },
 	{ value: "synthetic", label: "Synthetic", description: "Requires SYNTHETIC_API_KEY" },
 	{ value: "searxng", label: "SearXNG", description: "Requires SEARXNG_ENDPOINT or searxng.endpoint" },
+	{
+		value: "startpage",
+		label: "Startpage",
+		description: "Credential-free scrape of Startpage (Google-backed) results; may be bot-challenged",
+	},
 	{
 		value: "duckduckgo",
 		label: "DuckDuckGo",
 		description: "Credential-free best-effort fallback; may be bot-challenged on datacenter/shared-egress IPs",
 	},
+	{
+		value: "bing",
+		label: "Bing",
+		description: "Credential-free HTML scrape of Bing results; may be bot-challenged",
+	},
+	{
+		value: "yahoo",
+		label: "Yahoo",
+		description: "Credential-free HTML scrape of Yahoo (Bing-backed) results",
+	},
+	{
+		value: "ecosia",
+		label: "Ecosia",
+		description: "Credential-free browser-backed scrape of Ecosia (Google-backed) results",
+	},
+	{
+		value: "google",
+		label: "Google",
+		description: "Credential-free browser-backed fallback; slower and may be bot-challenged",
+	},
+	{
+		value: "mojeek",
+		label: "Mojeek",
+		description: "Credential-free browser-backed scrape of Mojeek's independent index",
+	},
+	{
+		value: "public",
+		label: "Public Web",
+		description: "Queries every credential-free engine in parallel and consolidates deduplicated results",
+	},
 ] as const;
 
 /** Supported web search providers (every option except `auto`). */

package/dist/types/extensibility/plugins/legacy-pi-bundled-keys.d.ts

@@ -1,10 +0,0 @@
-/**
- * Canonical keys served by the `omp-legacy-pi-bundled:` virtual namespace.
- * Mirrors `Object.keys(BUNDLED_PI_REGISTRY)` from
- * `legacy-pi-bundled-keys.ts`'s sibling registry file. `legacy-pi-compat.ts`
- * statically imports this set to seed `LEGACY_PI_PACKAGE_ROOT_OVERRIDES` in
- * compiled-binary mode without dragging the heavy registry's transitive
- * graph into dev/test runs (the registry itself stays behind a dynamic
- * import — see `ensureBundledRegistryLoaded` in `legacy-pi-compat.ts`).
- */
-export declare const BUNDLED_PI_REGISTRY_KEYS: ReadonlySet<string>;

package/dist/types/extensibility/plugins/legacy-pi-bundled-registry.d.ts

@@ -1,10 +0,0 @@
-/**
- * Canonical specifier → live module namespace. Keys MUST match the right-hand
- * side of `bundledRegistryVirtualSpecifier(...)` calls in
- * `legacy-pi-compat.ts`; the synthesizer enumerates each namespace's own
- * enumerable exports at extension load time. The companion
- * `legacy-pi-bundled-keys.ts` mirrors `Object.keys(BUNDLED_PI_REGISTRY)` and
- * is statically imported by `legacy-pi-compat.ts` to seed the override map
- * without paying the cascade above.
- */
-export declare const BUNDLED_PI_REGISTRY: Readonly<Record<string, Readonly<Record<string, unknown>>>>;