@oh-my-pi/pi-coding-agent 17.1.1 → 17.1.2

package/src/web/search/providers/kimi.ts

@@ -12,6 +12,7 @@ import { $env } from "@oh-my-pi/pi-utils";
 
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
+import { formatQuery, parseSearchQuery, type QuerySyntax, type StructuredQuery } from "../query";
 import { clampNumResults, dateToAgeSeconds } from "../utils";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -25,8 +26,19 @@ const DEFAULT_NUM_RESULTS = 10;
 const MAX_NUM_RESULTS = 20;
 const DEFAULT_TIMEOUT_SECONDS = 30;
 
+/** Kimi Code search is Bing-flavored: re-emit the operators Bing parses; dates/lang stay with the central filter. */
+const KIMI_QUERY_SYNTAX: QuerySyntax = {
+	phrases: true,
+	negation: true,
+	site: true,
+	inTitle: true,
+	inUrl: true,
+	filetype: true,
+};
+
 export interface KimiSearchParams {
 	query: string;
+	parsedQuery?: StructuredQuery;
 	num_results?: number;
 	include_content?: boolean;
 	signal?: AbortSignal;
@@ -138,12 +150,14 @@ export async function searchKimi(params: KimiSearchParams): Promise<SearchRespon
 		);
 	}
 
+	const parsed = params.parsedQuery ?? parseSearchQuery(params.query);
+	const query = parsed.hasDirectives ? formatQuery(parsed, KIMI_QUERY_SYNTAX) : params.query;
 	const limit = clampNumResults(params.num_results, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
 	const { response, requestId } = await withAuth(
 		keyOrResolver,
 		key =>
 			callKimiSearch(key, {
-				query: params.query,
+				query,
 				limit,
 				includeContent: params.include_content ?? false,
 				signal: params.signal,
@@ -192,6 +206,7 @@ export class KimiProvider extends SearchProvider {
 
 		return searchKimi({
 			query: params.query,
+			parsedQuery: params.parsedQuery,
 			num_results: params.numSearchResults ?? params.limit,
 			signal: params.signal,
 			authStorage: params.authStorage,

package/src/web/search/providers/mojeek.ts

@@ -4,6 +4,7 @@ import { parseHTML } from "linkedom";
 import type { Page } from "puppeteer-core";
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
+import { formatScraperQuery, type QuerySyntax } from "../query";
 import { clampNumResults } from "../utils";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -81,9 +82,21 @@ function parseHtmlResults(html: string): ParsedResult[] {
 	return results;
 }
 
+/**
+ * Syntax re-emitted to Mojeek for directive-carrying queries. Mojeek's
+ * support page (mojeek.com/support/search-operators.html) confirms `site:`,
+ * and the community docs confirm quoted phrases and `-` exclusions. Mojeek
+ * also parses `in*:` operators and its own date syntax (`since:`/`before:`
+ * with YYYYMMDD), but the latter differs from Google's `after:`/`before:`
+ * ISO form and `since` is already claimed by `recency`, so date bounds and
+ * `in*` constraints are conservatively left to the pipeline's lenient
+ * post-filter instead.
+ */
+const MOJEEK_QUERY_SYNTAX: QuerySyntax = { phrases: true, negation: true, site: true };
+
 function buildSearchUrl(params: SearchParams, numResults: number): string {
 	const url = new URL(MOJEEK_SEARCH_URL);
-	url.searchParams.set("q", params.query);
+	url.searchParams.set("q", formatScraperQuery(params.query, params.parsedQuery, MOJEEK_QUERY_SYNTAX));
 	url.searchParams.set("t", String(numResults));
 	url.searchParams.set("arc", "none");
 	url.searchParams.set("lang", "en");

package/src/web/search/providers/parallel.ts

@@ -9,6 +9,7 @@ import {
 	parseParallelErrorResponse,
 	parseParallelSearchPayload,
 } from "../../parallel";
+import { formatQuery, parseSearchQuery, type StructuredQuery } from "../query";
 import { clampNumResults } from "../utils";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -17,6 +18,42 @@ import { classifyProviderHttpError, toSearchSources, withHardTimeout } from "./u
 const DEFAULT_NUM_RESULTS = 10;
 const MAX_NUM_RESULTS = 40;
 
+/** Query-string caps for Parallel: natural-language objective, no field operators. */
+const PARALLEL_QUERY_SYNTAX = { phrases: true, negation: true, or: true } as const;
+
+/** Parallel `source_policy` (beta Search API): bare-host allow/deny lists + freshness floor. */
+interface ParallelSourcePolicy {
+	include_domains?: string[];
+	exclude_domains?: string[];
+	after_date?: string;
+}
+
+/** Site values may carry paths (`github.com/anthropics`); Parallel takes bare hosts. */
+function toHosts(sites: readonly string[]): string[] {
+	const hosts = new Set<string>();
+	for (const site of sites) {
+		const host = site.split("/", 1)[0];
+		if (host) hosts.add(host);
+	}
+	return [...hosts];
+}
+
+/**
+ * Map parsed `site:`/`-site:`/`after:` directives onto Parallel's
+ * `source_policy`. Per Parallel docs, `exclude_domains` is ignored when
+ * `include_domains` is set, so exclusions are only sent without an allow
+ * list (the central lenient filter enforces them regardless).
+ */
+function toSourcePolicy(parsed: StructuredQuery): ParallelSourcePolicy | undefined {
+	const policy: ParallelSourcePolicy = {};
+	const include = toHosts(parsed.sites);
+	const exclude = toHosts(parsed.excludedSites);
+	if (include.length) policy.include_domains = include;
+	else if (exclude.length) policy.exclude_domains = exclude;
+	if (parsed.after) policy.after_date = parsed.after;
+	return Object.keys(policy).length ? policy : undefined;
+}
+
 async function searchWithAuthStorage(
 	objective: string,
 	queries: string[],
@@ -26,6 +63,7 @@ async function searchWithAuthStorage(
 	},
 	authStorage: AuthStorage,
 	sessionId?: string,
+	sourcePolicy?: ParallelSourcePolicy,
 ): Promise<ParallelSearchResult> {
 	const apiKey = await authStorage.getApiKey("parallel", sessionId, { signal: params.signal });
 	if (!apiKey) {
@@ -57,6 +95,7 @@ async function searchWithAuthStorage(
 					excerpts: {
 						max_chars_per_result: 10_000,
 					},
+					...(sourcePolicy && { source_policy: sourcePolicy }),
 				}),
 				signal: withHardTimeout(params.signal),
 			});
@@ -78,22 +117,28 @@ export async function searchParallel(
 		num_results?: number;
 		signal?: AbortSignal;
 		fetch?: FetchImpl;
+		parsedQuery?: StructuredQuery;
 	},
 	authStorage: AuthStorage,
 	sessionId?: string,
 ): Promise<SearchResponse> {
 	const numResults = clampNumResults(params.num_results, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
+	const parsed = params.parsedQuery ?? parseSearchQuery(params.query);
+	// Back-compat: without directives the upstream request is byte-identical.
+	const query = parsed.hasDirectives ? formatQuery(parsed, PARALLEL_QUERY_SYNTAX) : params.query;
+	const sourcePolicy = parsed.hasDirectives ? toSourcePolicy(parsed) : undefined;
 
 	try {
 		const result = await searchWithAuthStorage(
-			params.query,
-			[params.query],
+			query,
+			[query],
 			{
 				signal: params.signal,
 				fetch: params.fetch,
 			},
 			authStorage,
 			sessionId,
+			sourcePolicy,
 		);
 
 		return {
@@ -128,6 +173,7 @@ export class ParallelProvider extends SearchProvider {
 				num_results: params.numSearchResults ?? params.limit,
 				signal: params.signal,
 				fetch: params.fetch,
+				parsedQuery: params.parsedQuery,
 			},
 			params.authStorage,
 			params.sessionId,

package/src/web/search/providers/perplexity.ts

@@ -30,6 +30,7 @@ import type {
 	SearchSource,
 } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
+import { formatQuery, parseSearchQuery, type QuerySyntax, type StructuredQuery } from "../query";
 import { dateToAgeSeconds } from "../utils";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -46,6 +47,71 @@ const OAUTH_USER_AGENT = "Perplexity/641 CFNetwork/1568 Darwin/25.2.0";
 const ANONYMOUS_USER_AGENT =
 	"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36";
 
+/**
+ * Query-string operators Perplexity's search backend tolerates as text signal.
+ * `site:`/date/`lang:` directives are excluded: they map onto native request
+ * fields (`search_domain_filter`, `search_*_date_filter`,
+ * `search_language_filter`) and must be stripped from the query so the engine
+ * is not double-constrained.
+ */
+const PERPLEXITY_QUERY_SYNTAX: QuerySyntax = {
+	phrases: true,
+	negation: true,
+	or: true,
+	inUrl: true,
+	inTitle: true,
+	filetype: true,
+};
+
+/** Native Perplexity search filters derived from parsed query directives. */
+interface PerplexityNativeFilters {
+	/** Query rebuilt without natively-mapped directives. */
+	query: string;
+	/** `search_domain_filter`: allow entries as bare hosts, deny entries as `-host`. */
+	domainFilter?: string[];
+	/** `search_after_date_filter`, `%m/%d/%Y`. */
+	afterDate?: string;
+	/** `search_before_date_filter`, `%m/%d/%Y`. */
+	beforeDate?: string;
+	/** `search_language_filter`: ISO 639-1 two-letter codes. */
+	languageFilter?: string[];
+}
+
+/**
+ * Bare host of a `site:` value (`github.com/anthropics` → `github.com`);
+ * Perplexity's domain filter takes hosts only, the path part is enforced by
+ * the central lenient post-filter.
+ */
+function siteHost(site: string): string {
+	const slash = site.indexOf("/");
+	return slash === -1 ? site : site.slice(0, slash);
+}
+
+/** ISO `YYYY-MM-DD` → Perplexity's documented `%m/%d/%Y` date-filter format (e.g. `3/1/2025`). */
+function toPerplexityDate(iso: string): string {
+	const [year, month, day] = iso.split("-");
+	return `${Number(month)}/${Number(day)}/${year}`;
+}
+
+/** Map parsed query directives onto native Perplexity search filters. */
+function buildNativeFilters(parsed: StructuredQuery, rawQuery: string): PerplexityNativeFilters {
+	if (!parsed.hasDirectives) return { query: rawQuery };
+	// Allow + deny share one array; the API caps it at 20 entries.
+	const domains = [
+		...new Set([...parsed.sites.map(siteHost), ...parsed.excludedSites.map(site => `-${siteHost(site)}`)]),
+	].slice(0, 20);
+	// search_language_filter takes ISO 639-1 two-letter codes; pass `en-us` as
+	// `en`, and leave anything else to the central post-filter.
+	const langCode = parsed.lang ? /^([a-z]{2})(?:[-_]|$)/.exec(parsed.lang)?.[1] : undefined;
+	return {
+		query: formatQuery(parsed, PERPLEXITY_QUERY_SYNTAX),
+		domainFilter: domains.length > 0 ? domains : undefined,
+		afterDate: parsed.after ? toPerplexityDate(parsed.after) : undefined,
+		beforeDate: parsed.before ? toPerplexityDate(parsed.before) : undefined,
+		languageFilter: langCode ? [langCode] : undefined,
+	};
+}
+
 interface PerplexityOAuthStreamMarkdownBlock {
 	answer?: string;
 	chunks?: string[];
@@ -258,6 +324,8 @@ export interface PerplexitySearchParams {
 	signal?: AbortSignal;
 	query: string;
 	system_prompt?: string;
+	/** Pre-parsed view of `query` from the search pipeline; parsed locally when absent. */
+	parsedQuery?: StructuredQuery;
 	search_recency_filter?: "hour" | "day" | "week" | "month" | "year";
 	num_results?: number;
 	/** Maximum output tokens. Defaults to 8192. */
@@ -352,6 +420,10 @@ function buildPerplexityExtraBody(request: PerplexityRequest): Record<string, un
 		language_preference: request.language_preference,
 		return_related_questions: request.return_related_questions,
 		search_recency_filter: request.search_recency_filter,
+		search_domain_filter: request.search_domain_filter,
+		search_after_date_filter: request.search_after_date_filter,
+		search_before_date_filter: request.search_before_date_filter,
+		search_language_filter: request.search_language_filter,
 	};
 }
 
@@ -531,6 +603,7 @@ function buildOAuthAnswer(event: PerplexityOAuthStreamEvent): string {
 async function callPerplexityAsk(
 	auth: { type: "oauth"; token: string } | { type: "cookies"; cookies: string } | { type: "anonymous" },
 	params: PerplexitySearchParams,
+	filters: PerplexityNativeFilters,
 ): Promise<{ answer: string; sources: SearchSource[]; model?: string; requestId?: string }> {
 	const requestId = crypto.randomUUID();
 	// The consumer `perplexity_ask` endpoint is itself a research assistant and
@@ -539,7 +612,7 @@ async function callPerplexityAsk(
 	// "I don't have access to web-search tools in this turn", so ask-endpoint
 	// searches send the bare query. (The API-key path still uses system_prompt
 	// as a proper `system` message.)
-	const effectiveQuery = params.query;
+	const effectiveQuery = filters.query;
 
 	const headers: Record<string, string> = {
 		"Content-Type": "application/json",
@@ -578,7 +651,9 @@ async function callPerplexityAsk(
 		version: OAUTH_API_VERSION,
 		language: "en-US",
 		timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
-		search_recency_filter: params.search_recency_filter ?? null,
+		// Recency cannot be combined with absolute date filters; explicit
+		// before:/after: bounds take precedence.
+		search_recency_filter: filters.afterDate || filters.beforeDate ? null : (params.search_recency_filter ?? null),
 		is_incognito: true,
 		use_schematized_api: true,
 		// `true` (the native app's default) lets the backend classifier skip
@@ -603,6 +678,10 @@ async function callPerplexityAsk(
 	if (auth.type === "anonymous") {
 		requestParams.send_back_text_in_streaming_api = true;
 	}
+	if (filters.domainFilter) requestParams.search_domain_filter = filters.domainFilter;
+	if (filters.afterDate) requestParams.search_after_date_filter = filters.afterDate;
+	if (filters.beforeDate) requestParams.search_before_date_filter = filters.beforeDate;
+	if (filters.languageFilter) requestParams.search_language_filter = filters.languageFilter;
 
 	const requestInit = {
 		method: "POST",
@@ -781,12 +860,14 @@ function applySourceLimit(result: SearchResponse, limit?: number): SearchRespons
 
 /** Execute Perplexity web search */
 export async function searchPerplexity(params: PerplexitySearchParams): Promise<SearchResponse> {
+	const parsed = params.parsedQuery ?? parseSearchQuery(params.query);
+	const filters = buildNativeFilters(parsed, params.query);
 	const systemPrompt = params.system_prompt;
 	const messages: PerplexityRequest["messages"] = [];
 	if (systemPrompt) {
 		messages.push({ role: "system", content: systemPrompt });
 	}
-	messages.push({ role: "user", content: params.query });
+	messages.push({ role: "user", content: filters.query });
 
 	const request: PerplexityRequest = {
 		model: "sonar-pro",
@@ -805,7 +886,13 @@ export async function searchPerplexity(params: PerplexitySearchParams): Promise<
 		return_related_questions: true,
 	};
 
-	if (params.search_recency_filter) {
+	if (filters.domainFilter) request.search_domain_filter = filters.domainFilter;
+	if (filters.afterDate) request.search_after_date_filter = filters.afterDate;
+	if (filters.beforeDate) request.search_before_date_filter = filters.beforeDate;
+	if (filters.languageFilter) request.search_language_filter = filters.languageFilter;
+	// The API rejects search_recency_filter combined with absolute date
+	// filters; explicit before:/after: bounds take precedence.
+	if (params.search_recency_filter && !filters.afterDate && !filters.beforeDate) {
 		request.search_recency_filter = params.search_recency_filter;
 	}
 
@@ -830,10 +917,10 @@ export async function searchPerplexity(params: PerplexitySearchParams): Promise<
 						? await withOAuthAccess(
 								params.authStorage,
 								"perplexity",
-								access => callPerplexityAsk({ type: "oauth", token: access.accessToken }, params),
+								access => callPerplexityAsk({ type: "oauth", token: access.accessToken }, params, filters),
 								{ sessionId: params.sessionId, signal: params.signal, seed: auth.access },
 							)
-						: await callPerplexityAsk(auth, params);
+						: await callPerplexityAsk(auth, params, filters);
 				return applySourceLimit(
 					{
 						provider: "perplexity",
@@ -892,6 +979,7 @@ export class PerplexityProvider extends SearchProvider {
 		return searchPerplexity({
 			signal: params.signal,
 			query: params.query,
+			parsedQuery: params.parsedQuery,
 			temperature: params.temperature,
 			max_tokens: params.maxOutputTokens,
 			num_search_results: params.numSearchResults,

package/src/web/search/providers/searxng.ts

@@ -14,6 +14,9 @@
  *   searxng.basicUsername - Optional RFC 7617 Basic auth username
  *   searxng.basicPassword - Optional RFC 7617 Basic auth password
  *   searxng.categories    - Optional comma-separated categories filter
+ *   searxng.engines       - Optional comma-separated engine names or shortcuts
+ *                           (e.g. "duckduckgo, br, sp"); shortcuts resolve via
+ *                           the instance's /config endpoint
  *   searxng.language      - Optional language code (e.g. en, zh-CN)
  *
  * Environment variable fallbacks:
@@ -22,6 +25,11 @@
  *   SEARXNG_BASIC_USERNAME - Optional RFC 7617 Basic auth username
  *   SEARXNG_BASIC_PASSWORD - Optional RFC 7617 Basic auth password
  *
+ * Bang syntax in queries is passed through: `!ddg foo` selects an engine or
+ * category server-side and the bang token is stripped from the upstream query.
+ * External bangs (`!!g`) are removed client-side because SearXNG answers them
+ * with an HTTP redirect even for JSON requests.
+ *
  * Reference: https://docs.searxng.org/dev/search_api.html
  */
 
@@ -30,6 +38,8 @@ import type { AuthStorage, FetchImpl } from "@oh-my-pi/pi-ai";
 import { settings } from "../../../config/settings";
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
+import type { StructuredQuery } from "../query";
+import { formatScraperQuery, parseSearchQuery } from "../query";
 import { clampNumResults, dateToAgeSeconds } from "../utils";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -73,6 +83,11 @@ interface SearXNGAuth {
 	value: string;
 }
 
+/** Subset of the SearXNG /config payload used for engine shortcut resolution. */
+interface SearXNGConfig {
+	engines?: Array<{ name?: string; shortcut?: string }>;
+}
+
 /** Find SearXNG endpoint from settings or environment. */
 function findEndpoint(): string | null {
 	try {
@@ -150,6 +165,110 @@ function findAuth(): SearXNGAuth | null {
 	return token ? { type: "bearer", value: token } : null;
 }
 
+/** Find configured engine names/shortcuts from settings. */
+function findEngines(): string | null {
+	try {
+		const engines = settings.get("searxng.engines");
+		if (engines) return engines;
+	} catch {
+		// Settings not initialized yet
+	}
+	return null;
+}
+
+/** Build request headers including authentication. */
+function buildHeaders(auth: SearXNGAuth | null): Record<string, string> {
+	const headers: Record<string, string> = { Accept: "application/json" };
+	if (auth?.type === "basic") {
+		headers.Authorization = `Basic ${auth.value}`;
+	} else if (auth?.type === "bearer") {
+		headers.Authorization = `Bearer ${auth.value}`;
+	}
+	return headers;
+}
+
+/** Per-endpoint cache of shortcut/name → canonical engine name maps. */
+const engineNameMapCache = new Map<string, Promise<Map<string, string> | null>>();
+
+/** Fetch the instance's /config and build a lookup of lowercased engine names
+ *  and shortcuts to canonical engine names. Returns null on any failure. */
+async function fetchEngineNameMap(
+	base: string,
+	auth: SearXNGAuth | null,
+	fetchImpl: FetchImpl | undefined,
+	signal: AbortSignal | undefined,
+): Promise<Map<string, string> | null> {
+	try {
+		const response = await (fetchImpl ?? fetch)(`${base}/config`, {
+			headers: buildHeaders(auth),
+			signal: withHardTimeout(signal),
+		});
+		if (!response.ok) return null;
+		const config = (await response.json()) as SearXNGConfig;
+		const map = new Map<string, string>();
+		for (const engine of config.engines ?? []) {
+			if (!engine.name) continue;
+			map.set(engine.name.toLowerCase(), engine.name);
+			if (engine.shortcut) map.set(engine.shortcut.toLowerCase(), engine.name);
+		}
+		return map.size ? map : null;
+	} catch {
+		return null;
+	}
+}
+
+/** Get the engine name map for an endpoint, cached for the process lifetime.
+ *  Failures are not cached so a transient error retries on the next search. */
+function getEngineNameMap(
+	endpoint: string,
+	auth: SearXNGAuth | null,
+	fetchImpl: FetchImpl | undefined,
+	signal: AbortSignal | undefined,
+): Promise<Map<string, string> | null> {
+	const base = endpoint.replace(/\/+$/, "");
+	let cached = engineNameMapCache.get(base);
+	if (!cached) {
+		cached = fetchEngineNameMap(base, auth, fetchImpl, signal).then(map => {
+			if (!map) engineNameMapCache.delete(base);
+			return map;
+		});
+		engineNameMapCache.set(base, cached);
+	}
+	return cached;
+}
+
+/** Resolve configured engine entries (canonical names or shortcuts like `ddg`)
+ *  to canonical names for SearXNG's `engines=` parameter, which accepts names
+ *  only — shortcuts resolve exclusively through bang syntax. Unknown entries
+ *  pass through verbatim; the server drops them and falls back to categories. */
+async function resolveEngineNames(
+	raw: string,
+	endpoint: string,
+	auth: SearXNGAuth | null,
+	fetchImpl: FetchImpl | undefined,
+	signal: AbortSignal | undefined,
+): Promise<string | undefined> {
+	const entries = raw
+		.split(",")
+		.map(entry => entry.trim())
+		.filter(Boolean);
+	if (!entries.length) return undefined;
+	const map = await getEngineNameMap(endpoint, auth, fetchImpl, signal);
+	if (!map) return entries.join(",");
+	return entries.map(entry => map.get(entry.toLowerCase()) ?? entry).join(",");
+}
+
+/** Strip external bang tokens (`!!g`, bare `!!`): SearXNG answers them with an
+ *  HTTP redirect even for JSON requests, which breaks response parsing.
+ *  Single-bang engine/category selectors (`!ddg`, `!images`) are kept — the
+ *  instance resolves and removes them server-side. */
+function stripExternalBangs(query: string): string {
+	return query
+		.split(/\s+/)
+		.filter(part => !part.startsWith("!!"))
+		.join(" ");
+}
+
 /** Build the search URL and headers for a SearXNG request */
 function buildRequest(
 	endpoint: string,
@@ -158,6 +277,7 @@ function buildRequest(
 		num_results?: number;
 		recency?: "day" | "week" | "month" | "year";
 		categories?: string;
+		engines?: string;
 		language?: string;
 		signal?: AbortSignal;
 	},
@@ -181,19 +301,15 @@ function buildRequest(
 		url.searchParams.set("categories", params.categories);
 	}
 
+	if (params.engines) {
+		url.searchParams.set("engines", params.engines);
+	}
+
 	if (params.language) {
 		url.searchParams.set("language", params.language);
 	}
 
-	const headers: Record<string, string> = {
-		Accept: "application/json",
-	};
-
-	if (auth?.type === "basic") {
-		headers.Authorization = `Basic ${auth.value}`;
-	} else if (auth?.type === "bearer") {
-		headers.Authorization = `Bearer ${auth.value}`;
-	}
+	const headers = buildHeaders(auth);
 
 	return { url, headers };
 }
@@ -205,6 +321,7 @@ async function callSearXNGSearch(
 		num_results?: number;
 		recency?: "day" | "week" | "month" | "year";
 		categories?: string;
+		engines?: string;
 		language?: string;
 		signal?: AbortSignal;
 		fetch?: FetchImpl;
@@ -231,6 +348,7 @@ async function callSearXNGSearch(
 /** Execute SearXNG web search. */
 export async function searchSearXNG(params: {
 	query: string;
+	parsedQuery?: StructuredQuery;
 	num_results?: number;
 	recency?: "day" | "week" | "month" | "year";
 	signal?: AbortSignal;
@@ -255,12 +373,29 @@ export async function searchSearXNG(params: {
 	} catch {
 		// Settings not initialized yet
 	}
+	const configuredEngines = findEngines();
+
+	// SearXNG forwards `q` to downstream engines, so build it with the shared
+	// scraper formatter: operators are canonicalized and scraper-hostile ones
+	// (path-carrying `site:`, `inurl:`) are structurally demoted to plain
+	// terms before formatting, so paren-grouped `site:` filters are covered
+	// too. `lang:` maps onto the native `language` param (overriding the
+	// configured default).
+	const parsed = params.parsedQuery ?? parseSearchQuery(params.query);
+	const query = formatScraperQuery(params.query, parsed);
+	if (parsed.lang) language = parsed.lang;
+
+	const engines = configuredEngines
+		? await resolveEngineNames(configuredEngines, endpoint, auth, params.fetch, params.signal)
+		: undefined;
 
 	const response = await callSearXNGSearch(
 		endpoint,
 		{
 			...params,
+			query: stripExternalBangs(query),
 			categories,
+			engines,
 			language,
 			fetch: params.fetch,
 		},
@@ -315,6 +450,7 @@ export class SearXNGProvider extends SearchProvider {
 
 	search(params: SearchParams): Promise<SearchResponse> {
 		return searchSearXNG({
+			parsedQuery: params.parsedQuery,
 			query: params.query,
 			num_results: params.numSearchResults ?? params.limit,
 			recency: params.recency,

package/src/web/search/providers/startpage.ts

@@ -2,6 +2,7 @@ import type { AuthStorage, FetchImpl } from "@oh-my-pi/pi-ai";
 import { parseHTML } from "linkedom";
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
+import { formatScraperQuery } from "../query";
 import { clampNumResults } from "../utils";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -136,12 +137,17 @@ async function callStartpageHtml(params: SearchParams): Promise<string> {
 	const fetchImpl = params.fetch ?? fetch;
 	const signal = withHardTimeout(params.signal);
 	const withDate = params.recency ? RECENCY_TO_STARTPAGE_WITH_DATE[params.recency] : undefined;
+	// Startpage proxies Google, so the operator set works inline; rebuild via
+	// the shared scraper formatter to canonicalize aliases (domain: → site:,
+	// since: → after:, …) and demote scraper-hostile operators. Directive-free
+	// queries pass through byte-identical.
+	const query = formatScraperQuery(params.query, params.parsedQuery);
 
 	const formInputs = await fetchFormInputs(fetchImpl, signal);
 	let page: LoadedHtmlPage;
 	if (formInputs) {
 		const form = new URLSearchParams(formInputs);
-		form.set("query", params.query);
+		form.set("query", query);
 		if (withDate) form.set("with_date", withDate);
 		page = await browserFetch(STARTPAGE_SEARCH_URL, {
 			fetch: fetchImpl,
@@ -152,7 +158,7 @@ async function callStartpageHtml(params: SearchParams): Promise<string> {
 		});
 	} else {
 		const url = new URL(STARTPAGE_SEARCH_URL);
-		url.searchParams.set("query", params.query);
+		url.searchParams.set("query", query);
 		if (withDate) url.searchParams.set("with_date", withDate);
 		page = await browserFetch(url.href, {
 			fetch: fetchImpl,

package/src/web/search/providers/synthetic.ts

@@ -8,6 +8,7 @@
 import { type ApiKey, type AuthStorage, type FetchImpl, getEnvApiKey, withAuth } from "@oh-my-pi/pi-ai";
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
+import { formatQuery, parseSearchQuery } from "../query";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
 import { classifyProviderHttpError, withHardTimeout } from "./utils";
@@ -73,8 +74,13 @@ export async function searchSynthetic(params: SearchParamsWithFetch): Promise<Se
 		sessionId: params.sessionId,
 	});
 
+	const parsed = params.parsedQuery ?? parseSearchQuery(params.query);
+	const query = parsed.hasDirectives
+		? formatQuery(parsed, { phrases: true, negation: true, site: true })
+		: params.query;
+
 	const fetchImpl = params.fetch;
-	const data = await withAuth(keyOrResolver, key => callSyntheticSearch(key, params.query, params.signal, fetchImpl), {
+	const data = await withAuth(keyOrResolver, key => callSyntheticSearch(key, query, params.signal, fetchImpl), {
 		signal: params.signal,
 		missingKeyMessage: "Synthetic credentials not found. Set SYNTHETIC_API_KEY or login with 'omp /login synthetic'.",
 	});