@osovv/vv-opencode 1.1.6 → 1.2.0

package/dist/plugins/web-tools/html-markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-markdown.js","sourceRoot":"","sources":["../../../src/plugins/web-tools/html-markdown.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,iBAAiB;AACjB,wBAAwB;AACxB,2FAA2F;AAC3F,8HAA8H;AAC9H,qCAAqC;AACrC,qDAAqD;AACrD,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,kFAAkF;AAClF,oEAAoE;AACpE,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,8GAA8G;AAC9G,qBAAqB;AAErB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,eAAe,MAAM,UAAU,CAAC;AAEvC,uBAAuB;AACvB,IAAI,cAA2C,CAAC;AAEhD,SAAS,WAAW;IAClB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,eAAe,CAAC;YACnC,YAAY,EAAE,KAAK;YACnB,cAAc,EAAE,QAAQ;YACxB,gBAAgB,EAAE,GAAG;SACtB,CAAC,CAAC;QACH,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AACD,qBAAqB;AAErB,mBAAmB;AACnB;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,SAAS,CAAC,IAAI;YACZ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1C,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI;YACT,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,IAAI,IAAI,IAAI,CAAC;YACf,CAAC;QACH,CAAC;QACD,UAAU,CAAC,IAAI;YACb,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;KACF,EACD,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AACD,iBAAiB"}

package/dist/plugins/web-tools/http.d.ts

@@ -0,0 +1,34 @@
+export type WebHttpErrorCode = "NETWORK_ERROR" | "TIMEOUT" | "ABORTED" | "OVERSIZED" | "HTTP_ERROR";
+/** Transport-level failure. status is set only for HTTP_ERROR. Messages never include credentials. */
+export declare class WebHttpError extends Error {
+    readonly code: WebHttpErrorCode;
+    readonly status?: number;
+    constructor(code: WebHttpErrorCode, message: string, status?: number);
+}
+export type BoundedHttpRequest = {
+    url: string;
+    method?: "GET" | "POST";
+    headers?: Record<string, string>;
+    body?: string;
+    /** Wall-clock timeout in milliseconds. */
+    timeoutMs: number;
+    /** Hard response body cap in bytes. */
+    maxBytes: number;
+    /** Optional caller abort signal; combined with the internal timeout controller. */
+    abort?: AbortSignal;
+};
+export type BoundedHttpResponse = {
+    status: number;
+    headers: Headers;
+    bytes: Uint8Array;
+    finalUrl: string;
+};
+/** Minimal fetch-compatible callable; avoids Bun-specific fetch properties for injectable mocks. */
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/** Default cap for textual responses (5 MiB). */
+export declare const DEFAULT_TEXT_MAX_BYTES: number;
+/** Default cap for media responses (20 MiB). */
+export declare const DEFAULT_MEDIA_MAX_BYTES: number;
+/** Default request timeout (30 seconds). */
+export declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
+export declare function requestBounded(request: BoundedHttpRequest, fetchImpl?: FetchLike): Promise<BoundedHttpResponse>;

package/dist/plugins/web-tools/http.js

@@ -0,0 +1,154 @@
+// FILE: src/plugins/web-tools/http.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Provide shared bounded HTTP execution for the web tools providers and media loader.
+//   SCOPE: Timeout enforcement, caller abort propagation, a hard response-size cap, redirect following, and a transport error taxonomy.
+//   DEPENDS: [none]
+//   LINKS: [M-WEB-HTTP, M-WEB-EXA, M-WEB-BRAVE, M-WEB-NATIVE-FETCH, M-WEB-SPIDER, M-WEB-MEDIA-LOADER]
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   WebHttpErrorCode - Transport error codes.
+//   WebHttpError - Transport-level error carrying a code and optional HTTP status.
+//   BoundedHttpRequest - Request input with timeout, size cap, and optional caller abort.
+//   BoundedHttpResponse - Response with status, headers, bytes, and final URL.
+//   FetchLike - Minimal fetch-compatible callable for injectable mocks.
+//   DEFAULT_TEXT_MAX_BYTES - Default cap for textual responses.
+//   DEFAULT_MEDIA_MAX_BYTES - Default cap for media responses.
+//   DEFAULT_REQUEST_TIMEOUT_MS - Default request timeout.
+//   requestBounded - Execute one bounded HTTP request.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.0.0 - Initial bounded HTTP transport and error taxonomy for the unified web tools.]
+// END_CHANGE_SUMMARY
+/** Transport-level failure. status is set only for HTTP_ERROR. Messages never include credentials. */
+export class WebHttpError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.name = "WebHttpError";
+        this.code = code;
+        this.status = status;
+    }
+}
+/** Default cap for textual responses (5 MiB). */
+export const DEFAULT_TEXT_MAX_BYTES = 5 * 1024 * 1024;
+/** Default cap for media responses (20 MiB). */
+export const DEFAULT_MEDIA_MAX_BYTES = 20 * 1024 * 1024;
+/** Default request timeout (30 seconds). */
+export const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+// START_BLOCK_HELPERS
+function safeMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function mapTransportError(error, controller, timedOut, timeoutMs) {
+    if (controller.signal.aborted) {
+        if (timedOut) {
+            return new WebHttpError("TIMEOUT", `request timed out after ${timeoutMs}ms`);
+        }
+        return new WebHttpError("ABORTED", "request aborted by caller");
+    }
+    return new WebHttpError("NETWORK_ERROR", `network error: ${safeMessage(error)}`);
+}
+async function readBodyWithCap(response, maxBytes, controller) {
+    const body = response.body;
+    if (!body) {
+        return new Uint8Array(0);
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                controller.abort();
+                throw new WebHttpError("OVERSIZED", `response body exceeded ${maxBytes} bytes`);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+}
+// END_BLOCK_HELPERS
+// START_CONTRACT: requestBounded
+//   PURPOSE: Execute one bounded HTTP request.
+//   INPUTS: { request: BoundedHttpRequest; fetchImpl: injectable fetch implementation for tests }
+//   OUTPUTS: { BoundedHttpResponse - status, headers, bytes, and finalUrl }
+//   SIDE_EFFECTS: performs network I/O through fetchImpl; rejects with WebHttpError on failure
+//   LINKS: M-WEB-EXA, M-WEB-BRAVE, M-WEB-NATIVE-FETCH, M-WEB-SPIDER, M-WEB-MEDIA-LOADER
+// END_CONTRACT: requestBounded
+export async function requestBounded(request, fetchImpl = fetch) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, request.timeoutMs);
+    const onCallerAbort = () => controller.abort();
+    if (request.abort) {
+        if (request.abort.aborted) {
+            controller.abort();
+        }
+        else {
+            request.abort.addEventListener("abort", onCallerAbort, { once: true });
+        }
+    }
+    try {
+        let response;
+        try {
+            response = await fetchImpl(request.url, {
+                method: request.method ?? "GET",
+                headers: request.headers,
+                body: request.body,
+                signal: controller.signal,
+                redirect: "follow",
+            });
+        }
+        catch (error) {
+            throw mapTransportError(error, controller, timedOut, request.timeoutMs);
+        }
+        if (!response.ok) {
+            throw new WebHttpError("HTTP_ERROR", `HTTP ${response.status} for ${request.url}`, response.status);
+        }
+        let bytes;
+        try {
+            bytes = await readBodyWithCap(response, request.maxBytes, controller);
+        }
+        catch (error) {
+            if (error instanceof WebHttpError) {
+                throw error;
+            }
+            throw mapTransportError(error, controller, timedOut, request.timeoutMs);
+        }
+        return {
+            status: response.status,
+            headers: response.headers,
+            bytes,
+            finalUrl: response.url || request.url,
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+        request.abort?.removeEventListener("abort", onCallerAbort);
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/plugins/web-tools/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/plugins/web-tools/http.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iBAAiB;AACjB,wBAAwB;AACxB,iGAAiG;AACjG,wIAAwI;AACxI,oBAAoB;AACpB,sGAAsG;AACtG,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,8CAA8C;AAC9C,mFAAmF;AACnF,0FAA0F;AAC1F,+EAA+E;AAC/E,wEAAwE;AACxE,gEAAgE;AAChE,+DAA+D;AAC/D,0DAA0D;AAC1D,uDAAuD;AACvD,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,yGAAyG;AACzG,qBAAqB;AAIrB,sGAAsG;AACtG,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IACvB,MAAM,CAAU;IAEzB,YAAY,IAAsB,EAAE,OAAe,EAAE,MAAe;QAClE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAyBD,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,gDAAgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAEjD,sBAAsB;AACtB,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,UAA2B,EAC3B,QAAiB,EACjB,SAAiB;IAEjB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,YAAY,CAAC,SAAS,EAAE,2BAA2B,SAAS,IAAI,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,eAAe,EAAE,kBAAkB,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAkB,EAClB,QAAgB,EAChB,UAA2B;IAE3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,0BAA0B,QAAQ,QAAQ,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,oBAAoB;AAEpB,iCAAiC;AACjC,+CAA+C;AAC/C,kGAAkG;AAClG,4EAA4E;AAC5E,+FAA+F;AAC/F,wFAAwF;AACxF,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA2B,EAC3B,YAAuB,KAAK;IAE5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,QAAQ,QAAQ,CAAC,MAAM,QAAQ,OAAO,CAAC,GAAG,EAAE,EAC5C,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;SACtC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC"}

package/dist/plugins/web-tools/index.d.ts

@@ -0,0 +1,18 @@
+import { type Config, type Plugin } from "@opencode-ai/plugin";
+/** Built-in permission ids suppressed at runtime while web-tools is enabled. */
+export declare const SUPPRESSED_BUILTIN_PERMISSIONS: readonly ["webfetch", "websearch"];
+/**
+ * Hide the built-in web tools by denying their permission keys in the merged runtime config.
+ * Skips any key the user configured explicitly so explicit user policy always wins.
+ * Mutates only the in-memory config object; no files are written.
+ */
+export declare function applyBuiltinSuppression(config: Config): void;
+/**
+ * WebToolsPlugin entry.
+ * Disabled toggle: returns empty hooks and injects nothing.
+ * Enabled: returns a config hook applying suppression and a tool map with exactly
+ * web_search and web_fetch. Startup logs include provider names and credential sources
+ * and never credential values; a git-tracked project config with an apiKey logs a warning
+ * naming the file without the value.
+ */
+export declare const WebToolsPlugin: Plugin;

package/dist/plugins/web-tools/index.js

@@ -0,0 +1,93 @@
+// FILE: src/plugins/web-tools/index.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Register the canonical web_search and web_fetch tools and suppress OpenCode built-ins at runtime while the web-tools plugin is enabled.
+//   SCOPE: Startup vvoc snapshot use, plugin toggle handling, runtime permission suppression, tool registration, and credential-safe diagnostics.
+//   DEPENDS: [@opencode-ai/plugin, src/lib/config-layers.ts, src/lib/plugin-toggle-config.ts, src/plugins/web-tools/config.ts, src/plugins/web-tools/search-service.ts, src/plugins/web-tools/fetch-service.ts]
+//   LINKS: [M-PLUGIN-WEB-TOOLS, M-WEB-CONFIG, M-WEB-SEARCH-SERVICE, M-WEB-FETCH-SERVICE]
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   SUPPRESSED_BUILTIN_PERMISSIONS - Built-in permission ids hidden while the plugin is enabled.
+//   applyBuiltinSuppression - Add runtime-only deny rules unless the user configured a key explicitly.
+//   WebToolsPlugin - Public plugin entry registering web_search and web_fetch.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [C-ZAI-DIRECT-WEB-PROVIDERS - Added credential-safe direct Z.AI region diagnostics while preserving the canonical tool surface.]
+//   LAST_CHANGE: [v1.0.0 - Initial WebToolsPlugin with runtime built-in suppression and credential-safe startup diagnostics.]
+// END_CHANGE_SUMMARY
+import { loadVvocConfig } from "../../lib/config-layers.js";
+import { isVvocPluginEnabled } from "../../lib/plugin-toggle-config.js";
+import { resolveWebRuntimeConfig, warnIfSecretBearingProjectConfigTracked } from "./config.js";
+import { createWebFetchTool } from "./fetch-service.js";
+import { createWebSearchTool } from "./search-service.js";
+/** Built-in permission ids suppressed at runtime while web-tools is enabled. */
+export const SUPPRESSED_BUILTIN_PERMISSIONS = ["webfetch", "websearch"];
+/**
+ * Hide the built-in web tools by denying their permission keys in the merged runtime config.
+ * Skips any key the user configured explicitly so explicit user policy always wins.
+ * Mutates only the in-memory config object; no files are written.
+ */
+export function applyBuiltinSuppression(config) {
+    config.permission ??= {};
+    const permission = config.permission;
+    for (const key of SUPPRESSED_BUILTIN_PERMISSIONS) {
+        if (permission[key] === undefined) {
+            permission[key] = "deny";
+        }
+    }
+}
+/**
+ * WebToolsPlugin entry.
+ * Disabled toggle: returns empty hooks and injects nothing.
+ * Enabled: returns a config hook applying suppression and a tool map with exactly
+ * web_search and web_fetch. Startup logs include provider names and credential sources
+ * and never credential values; a git-tracked project config with an apiKey logs a warning
+ * naming the file without the value.
+ */
+export const WebToolsPlugin = async ({ client, directory }) => {
+    const vvoc = await loadVvocConfig({ cwd: directory });
+    if (!isVvocPluginEnabled(vvoc.config, "web-tools")) {
+        return {};
+    }
+    const resolved = resolveWebRuntimeConfig(vvoc);
+    await client.app.log({
+        body: {
+            service: "web-tools",
+            level: "info",
+            message: "web tools configuration loaded",
+            extra: {
+                searchProvider: resolved.search.provider,
+                ...(resolved.search.provider === "zai" ? { searchRegion: resolved.search.region } : {}),
+                searchCredentialSource: resolved.search.credential?.source ?? "missing",
+                fetchProvider: resolved.fetch.provider,
+                ...(resolved.fetch.provider === "zai" ? { fetchRegion: resolved.fetch.region } : {}),
+                fetchCredentialSource: resolved.fetch.provider === "native"
+                    ? "not-required"
+                    : (resolved.fetch.credential?.source ?? "missing"),
+            },
+        },
+    });
+    for (const warning of resolved.warnings) {
+        await client.app.log({
+            body: { service: "web-tools", level: "warn", message: warning },
+        });
+    }
+    const trackedConfigWarning = warnIfSecretBearingProjectConfigTracked(vvoc);
+    if (trackedConfigWarning) {
+        await client.app.log({
+            body: { service: "web-tools", level: "warn", message: trackedConfigWarning },
+        });
+    }
+    return {
+        config: async (config) => applyBuiltinSuppression(config),
+        tool: {
+            web_search: createWebSearchTool(resolved.search),
+            web_fetch: createWebFetchTool(resolved.fetch),
+        },
+    };
+};
+//# sourceMappingURL=index.js.map

package/dist/plugins/web-tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/web-tools/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,iBAAiB;AACjB,wBAAwB;AACxB,qJAAqJ;AACrJ,kJAAkJ;AAClJ,gNAAgN;AAChN,yFAAyF;AACzF,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,iGAAiG;AACjG,uGAAuG;AACvG,+EAA+E;AAC/E,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,kJAAkJ;AAClJ,8HAA8H;AAC9H,qBAAqB;AAGrB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,uCAAuC,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,gFAAgF;AAChF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,CAAC,UAAU,KAAK,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAqC,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAW,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;IACpE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,IAAI,EAAE;YACJ,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gCAAgC;YACzC,KAAK,EAAE;gBACL,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBACxC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,SAAS;gBACvE,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBACtC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,qBAAqB,EACnB,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;oBAClC,CAAC,CAAC,cAAc;oBAChB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,SAAS,CAAC;aACvD;SACF;KACF,CAAC,CAAC;IAEH,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;SAChE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,oBAAoB,GAAG,uCAAuC,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC;QACzD,IAAI,EAAE;YACJ,UAAU,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChD,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC9C;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/plugins/web-tools/media-loader.d.ts

@@ -0,0 +1,26 @@
+import type { ToolAttachment } from "@opencode-ai/plugin";
+import { type FetchLike } from "./http.js";
+export declare const SUPPORTED_MEDIA_MIME_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "application/pdf"];
+export type SupportedMediaMimeType = (typeof SUPPORTED_MEDIA_MIME_TYPES)[number];
+/** Unsupported-media failure. The message names the detected or declared MIME type and never includes the payload. */
+export declare class WebMediaError extends Error {
+    readonly code: "UNSUPPORTED";
+    readonly mime?: string;
+    constructor(message: string, mime?: string);
+}
+/**
+ * Sniff the media MIME type from leading bytes.
+ * Returns undefined when the signature matches no supported format.
+ */
+export declare function sniffMediaMimeType(bytes: Uint8Array): SupportedMediaMimeType | undefined;
+export declare function mediaAttachmentFromBytes(bytes: Uint8Array, source: {
+    url: string;
+    declaredContentType?: string;
+    maxBytes?: number;
+}): ToolAttachment;
+export declare function loadMediaAttachment(input: {
+    url: string;
+    abort?: AbortSignal;
+    timeoutMs?: number;
+    maxBytes?: number;
+}, fetchImpl?: FetchLike): Promise<ToolAttachment>;

package/dist/plugins/web-tools/media-loader.js

@@ -0,0 +1,178 @@
+// FILE: src/plugins/web-tools/media-loader.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Load supported images and PDFs as base64 file attachments for the web tools fetch path.
+//   SCOPE: MIME and magic-byte identification, base64 data-URL attachment construction, filename derivation, and rejection of unsupported or oversized payloads.
+//   DEPENDS: [src/plugins/web-tools/http.ts, @opencode-ai/plugin]
+//   LINKS: [M-WEB-MEDIA-LOADER, M-WEB-HTTP, M-WEB-NATIVE-FETCH, M-WEB-SPIDER]
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   SUPPORTED_MEDIA_MIME_TYPES - Tuple of supported media MIME types.
+//   SupportedMediaMimeType - Supported media MIME type union.
+//   WebMediaError - Unsupported-media error carrying the detected or declared MIME type.
+//   sniffMediaMimeType - Detect a supported MIME type from leading bytes.
+//   mediaAttachmentFromBytes - Build a base64 data-URL attachment from already-fetched bytes.
+//   loadMediaAttachment - Fetch a URL and return it as an attachment when supported.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.0.0 - Initial direct media attachment loader for the unified web tools.]
+// END_CHANGE_SUMMARY
+import { DEFAULT_MEDIA_MAX_BYTES, DEFAULT_REQUEST_TIMEOUT_MS, requestBounded, WebHttpError, } from "./http.js";
+export const SUPPORTED_MEDIA_MIME_TYPES = [
+    "image/jpeg",
+    "image/png",
+    "image/gif",
+    "image/webp",
+    "application/pdf",
+];
+/** Unsupported-media failure. The message names the detected or declared MIME type and never includes the payload. */
+export class WebMediaError extends Error {
+    code;
+    mime;
+    constructor(message, mime) {
+        super(message);
+        this.name = "WebMediaError";
+        this.code = "UNSUPPORTED";
+        this.mime = mime;
+    }
+}
+const EXTENSION_BY_MIME = {
+    "image/jpeg": ".jpg",
+    "image/png": ".png",
+    "image/gif": ".gif",
+    "image/webp": ".webp",
+    "application/pdf": ".pdf",
+};
+// START_BLOCK_SNIFF
+/**
+ * Sniff the media MIME type from leading bytes.
+ * Returns undefined when the signature matches no supported format.
+ */
+export function sniffMediaMimeType(bytes) {
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+        return "image/jpeg";
+    }
+    if (bytes.length >= 4 &&
+        bytes[0] === 0x89 &&
+        bytes[1] === 0x50 &&
+        bytes[2] === 0x4e &&
+        bytes[3] === 0x47) {
+        return "image/png";
+    }
+    if (bytes.length >= 4 &&
+        bytes[0] === 0x47 &&
+        bytes[1] === 0x49 &&
+        bytes[2] === 0x46 &&
+        bytes[3] === 0x38) {
+        return "image/gif";
+    }
+    if (bytes.length >= 12 &&
+        bytes[0] === 0x52 &&
+        bytes[1] === 0x49 &&
+        bytes[2] === 0x46 &&
+        bytes[3] === 0x46 &&
+        bytes[8] === 0x57 &&
+        bytes[9] === 0x45 &&
+        bytes[10] === 0x42 &&
+        bytes[11] === 0x50) {
+        return "image/webp";
+    }
+    if (bytes.length >= 4 &&
+        bytes[0] === 0x25 &&
+        bytes[1] === 0x50 &&
+        bytes[2] === 0x44 &&
+        bytes[3] === 0x46) {
+        return "application/pdf";
+    }
+    return undefined;
+}
+// END_BLOCK_SNIFF
+// START_BLOCK_HELPERS
+function normalizeDeclaredContentType(declared) {
+    if (!declared) {
+        return undefined;
+    }
+    const mime = declared.split(";")[0]?.trim().toLowerCase();
+    return mime || undefined;
+}
+function filenameFromUrl(url, mime) {
+    const extension = EXTENSION_BY_MIME[mime];
+    try {
+        const base = new URL(url).pathname.split("/").pop() ?? "";
+        if (base && base.includes(".")) {
+            return base;
+        }
+        if (base) {
+            return `${base}${extension}`;
+        }
+        return `resource${extension}`;
+    }
+    catch {
+        return `resource${extension}`;
+    }
+}
+function resolveMimeType(bytes, declaredContentType) {
+    const sniffed = sniffMediaMimeType(bytes);
+    if (sniffed) {
+        return sniffed;
+    }
+    const declared = normalizeDeclaredContentType(declaredContentType);
+    if (declared && SUPPORTED_MEDIA_MIME_TYPES.includes(declared)) {
+        return declared;
+    }
+    return undefined;
+}
+// END_BLOCK_HELPERS
+// START_CONTRACT: mediaAttachmentFromBytes
+//   PURPOSE: Build a base64 data-URL file attachment from already-fetched bytes.
+//   INPUTS: { bytes: payload; source: url, declaredContentType, optional maxBytes }
+//   OUTPUTS: { ToolAttachment - type file, mime, data URL, filename }
+//   SIDE_EFFECTS: none; performs no network I/O
+//   LINKS: M-WEB-NATIVE-FETCH, M-WEB-SPIDER
+// END_CONTRACT: mediaAttachmentFromBytes
+export function mediaAttachmentFromBytes(bytes, source) {
+    const maxBytes = source.maxBytes ?? DEFAULT_MEDIA_MAX_BYTES;
+    if (bytes.byteLength > maxBytes) {
+        throw new WebHttpError("OVERSIZED", `media payload exceeded ${maxBytes} bytes`);
+    }
+    const mime = resolveMimeType(bytes, source.declaredContentType);
+    if (!mime) {
+        const detail = sniffMediaMimeType(bytes) ??
+            normalizeDeclaredContentType(source.declaredContentType) ??
+            "unknown";
+        throw new WebMediaError(`unsupported media type: ${detail}`, detail === "unknown" ? undefined : detail);
+    }
+    const base64 = Buffer.from(bytes).toString("base64");
+    return {
+        type: "file",
+        mime,
+        url: `data:${mime};base64,${base64}`,
+        filename: filenameFromUrl(source.url, mime),
+    };
+}
+// START_CONTRACT: loadMediaAttachment
+//   PURPOSE: Fetch a URL through the bounded transport and return it as an attachment when supported.
+//   INPUTS: { input: url, optional abort, timeoutMs, maxBytes; fetchImpl: injectable fetch }
+//   OUTPUTS: { ToolAttachment }
+//   SIDE_EFFECTS: performs network I/O through fetchImpl
+//   LINKS: M-WEB-HTTP
+// END_CONTRACT: loadMediaAttachment
+export async function loadMediaAttachment(input, fetchImpl) {
+    const maxBytes = input.maxBytes ?? DEFAULT_MEDIA_MAX_BYTES;
+    const response = await requestBounded({
+        url: input.url,
+        timeoutMs: input.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
+        maxBytes,
+        abort: input.abort,
+    }, fetchImpl);
+    return mediaAttachmentFromBytes(response.bytes, {
+        url: response.finalUrl,
+        declaredContentType: response.headers.get("content-type") ?? undefined,
+        maxBytes,
+    });
+}
+//# sourceMappingURL=media-loader.js.map

package/dist/plugins/web-tools/media-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-loader.js","sourceRoot":"","sources":["../../../src/plugins/web-tools/media-loader.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,iBAAiB;AACjB,wBAAwB;AACxB,qGAAqG;AACrG,iKAAiK;AACjK,kEAAkE;AAClE,8EAA8E;AAC9E,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,sEAAsE;AACtE,8DAA8D;AAC9D,yFAAyF;AACzF,0EAA0E;AAC1E,8FAA8F;AAC9F,qFAAqF;AACrF,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,8FAA8F;AAC9F,qBAAqB;AAGrB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,cAAc,EACd,YAAY,GAEb,MAAM,WAAW,CAAC;AAEnB,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,iBAAiB;CACT,CAAC;AAIX,sHAAsH;AACtH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAgB;IACpB,IAAI,CAAU;IAEvB,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,iBAAiB,GAA2C;IAChE,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,OAAO;IACrB,iBAAiB,EAAE,MAAM;CAC1B,CAAC;AAEF,oBAAoB;AACpB;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IACE,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EACjB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EACjB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI;QAClB,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IACE,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EACjB,CAAC;QACD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,kBAAkB;AAElB,sBAAsB;AACtB,SAAS,4BAA4B,CAAC,QAAiB;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,IAA4B;IAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,WAAW,SAAS,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAiB,EACjB,mBAA4B;IAE5B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;IACnE,IAAI,QAAQ,IAAK,0BAAgD,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,OAAO,QAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,oBAAoB;AAEpB,2CAA2C;AAC3C,iFAAiF;AACjF,oFAAoF;AACpF,sEAAsE;AACtE,gDAAgD;AAChD,4CAA4C;AAC5C,yCAAyC;AACzC,MAAM,UAAU,wBAAwB,CACtC,KAAiB,EACjB,MAAwE;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,uBAAuB,CAAC;IAC5D,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,0BAA0B,QAAQ,QAAQ,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GACV,kBAAkB,CAAC,KAAK,CAAC;YACzB,4BAA4B,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACxD,SAAS,CAAC;QACZ,MAAM,IAAI,aAAa,CACrB,2BAA2B,MAAM,EAAE,EACnC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,GAAG,EAAE,QAAQ,IAAI,WAAW,MAAM,EAAE;QACpC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,sCAAsC;AACtC,sGAAsG;AACtG,6FAA6F;AAC7F,gCAAgC;AAChC,yDAAyD;AACzD,sBAAsB;AACtB,oCAAoC;AACpC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkF,EAClF,SAAqB;IAErB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,uBAAuB,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC;QACE,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,0BAA0B;QACxD,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,EACD,SAAS,CACV,CAAC;IACF,OAAO,wBAAwB,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC9C,GAAG,EAAE,QAAQ,CAAC,QAAQ;QACtB,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;QACtE,QAAQ;KACT,CAAC,CAAC;AACL,CAAC"}

package/dist/plugins/web-tools/providers/brave.d.ts

@@ -0,0 +1,3 @@
+import { type FetchLike } from "../http.js";
+import { type WebSearchInput, type WebSearchResult } from "./exa.js";
+export declare function searchBrave(input: WebSearchInput, fetchImpl?: FetchLike): Promise<WebSearchResult[]>;

package/dist/plugins/web-tools/providers/brave.js

@@ -0,0 +1,101 @@
+// FILE: src/plugins/web-tools/providers/brave.ts
+// VERSION: 1.0.0
+// START_MODULE_CONTRACT
+//   PURPOSE: Call the Brave Web Search endpoint directly and normalize web results for the web_search tool.
+//   SCOPE: Brave request construction with X-Subscription-Token auth, count and freshness mapping, moderate safe search, and web result normalization.
+//   DEPENDS: [src/plugins/web-tools/http.ts, src/plugins/web-tools/providers/exa.ts]
+//   LINKS: [M-WEB-BRAVE, M-WEB-HTTP, M-WEB-SEARCH-SERVICE]
+//   ROLE: RUNTIME
+//   MAP_MODE: EXPORTS
+// END_MODULE_CONTRACT
+//
+// START_MODULE_MAP
+//   searchBrave - Execute one Brave Web Search.
+// END_MODULE_MAP
+//
+// START_CHANGE_SUMMARY
+//   LAST_CHANGE: [v1.0.0 - Initial Brave Web Search adapter.]
+// END_CHANGE_SUMMARY
+import { DEFAULT_TEXT_MAX_BYTES, requestBounded, } from "../http.js";
+import { mapHttpErrorToProviderError, WebProviderError, } from "./exa.js";
+const BRAVE_SEARCH_URL = "https://api.search.brave.com/res/v1/web/search";
+const BRAVE_FRESHNESS = { day: "pd", week: "pw", month: "pm", year: "py" };
+// START_BLOCK_HELPERS
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeBraveResult(item) {
+    if (!isPlainObject(item)) {
+        return undefined;
+    }
+    const url = typeof item.url === "string" ? item.url : undefined;
+    if (!url) {
+        return undefined;
+    }
+    const title = typeof item.title === "string" && item.title.length > 0 ? item.title : url;
+    const snippet = typeof item.description === "string" && item.description.length > 0
+        ? item.description
+        : undefined;
+    const publishedAt = typeof item.page_age === "string" ? item.page_age : undefined;
+    return {
+        title,
+        url,
+        ...(snippet ? { snippet } : {}),
+        ...(publishedAt ? { publishedAt } : {}),
+    };
+}
+function parseBraveResults(bytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        throw new WebProviderError("brave", "BAD_RESPONSE", "malformed JSON response from brave");
+    }
+    const web = isPlainObject(parsed) ? parsed.web : undefined;
+    const results = isPlainObject(web) && Array.isArray(web.results) ? web.results : undefined;
+    if (!results) {
+        throw new WebProviderError("brave", "BAD_RESPONSE", "unexpected brave response envelope");
+    }
+    return results
+        .map(normalizeBraveResult)
+        .filter((result) => result !== undefined);
+}
+// END_BLOCK_HELPERS
+// START_CONTRACT: searchBrave
+//   PURPOSE: GET the Brave Web Search endpoint with X-Subscription-Token auth and normalize web.results.
+//   INPUTS: { input: WebSearchInput; fetchImpl: injectable fetch }
+//   OUTPUTS: { WebSearchResult[] - ranked results, empty array when none }
+//   SIDE_EFFECTS: performs network I/O through fetchImpl; never logs the credential
+//   LINKS: M-WEB-SEARCH-SERVICE
+// END_CONTRACT: searchBrave
+export async function searchBrave(input, fetchImpl) {
+    const params = new URLSearchParams();
+    params.set("q", input.query);
+    params.set("count", String(input.count));
+    params.set("safesearch", "moderate");
+    if (input.freshness) {
+        params.set("freshness", BRAVE_FRESHNESS[input.freshness]);
+    }
+    const url = `${BRAVE_SEARCH_URL}?${params.toString()}`;
+    let response;
+    try {
+        response = await requestBounded({
+            url,
+            method: "GET",
+            headers: {
+                "X-Subscription-Token": input.credential.value,
+                accept: "application/json",
+            },
+            timeoutMs: input.timeoutMs,
+            maxBytes: DEFAULT_TEXT_MAX_BYTES,
+            abort: input.abort,
+        }, fetchImpl);
+    }
+    catch (error) {
+        mapHttpErrorToProviderError(error, "brave");
+        throw error;
+    }
+    return parseBraveResults(response.bytes);
+}
+//# sourceMappingURL=brave.js.map

package/dist/plugins/web-tools/providers/brave.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brave.js","sourceRoot":"","sources":["../../../../src/plugins/web-tools/providers/brave.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iBAAiB;AACjB,wBAAwB;AACxB,4GAA4G;AAC5G,uJAAuJ;AACvJ,qFAAqF;AACrF,2DAA2D;AAC3D,kBAAkB;AAClB,sBAAsB;AACtB,sBAAsB;AACtB,EAAE;AACF,mBAAmB;AACnB,gDAAgD;AAChD,iBAAiB;AACjB,EAAE;AACF,uBAAuB;AACvB,8DAA8D;AAC9D,qBAAqB;AAErB,OAAO,EACL,sBAAsB,EACtB,cAAc,GAGf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,GAGjB,MAAM,UAAU,CAAC;AAElB,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;AAE1E,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAW,CAAC;AAEpF,sBAAsB;AACtB,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAa;IACzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACzF,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,OAAO;QACL,KAAK;QACL,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,oCAAoC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,MAAM,OAAO,GACX,aAAa,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,OAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,oCAAoC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,MAAM,EAA6B,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;AACzE,CAAC;AACD,oBAAoB;AAEpB,8BAA8B;AAC9B,yGAAyG;AACzG,mEAAmE;AACnE,2EAA2E;AAC3E,oFAAoF;AACpF,gCAAgC;AAChC,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAqB,EACrB,SAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEvD,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,cAAc,CAC7B;YACE,GAAG;YACH,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,sBAAsB,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;gBAC9C,MAAM,EAAE,kBAAkB;aAC3B;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,sBAAsB;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC"}