clauderipple 0.2.0 → 0.3.0

package/dist/router/src/requestlog.js

@@ -5,7 +5,7 @@ import path from "node:path";
 const DEFAULT_MAX_BYTES = 20 * 1024 * 1024;
 const MAX_CARRY = 64 * 1024;
 function emptyBucket() {
-    return { count: 0, ok: 0, failed: 0, input: 0, cached: 0, output: 0, cacheHitPercent: 0, avgMs: 0 };
+    return { count: 0, ok: 0, failed: 0, input: 0, cached: 0, cacheWrite: 0, output: 0, cacheHitPercent: 0, avgMs: 0 };
 }
 function isRecord(value) {
     if (!value || typeof value !== "object")
@@ -75,8 +75,11 @@ export class RequestLog {
             if (record.usage) {
                 bucket.input += record.usage.input;
                 bucket.cached += record.usage.cached;
+                bucket.cacheWrite += record.usage.cacheWrite ?? 0;
                 bucket.output += record.usage.output;
-                cacheBases.set(bucket, (cacheBases.get(bucket) ?? 0) + record.usage.input + record.usage.cached);
+                // A cache write is input the model read fresh, so it counts against the hit rate. Leaving it
+                // out read a turn that wrote 2,218 tokens and uncached 2 as a 100% hit (2026-09-23).
+                cacheBases.set(bucket, (cacheBases.get(bucket) ?? 0) + record.usage.input + record.usage.cached + (record.usage.cacheWrite ?? 0));
             }
         };
         for (const record of this.records) {

package/dist/router/src/routing.js

@@ -3,11 +3,19 @@
 //   "claude-opus-4-8"            → routes["claude-opus-4-8"]           (picker-slot alias)
 //   "gpt-5.6-sol"                → direct rule by prefix, model unchanged
 //   "gpt-5.6-sol@medium"         → same, effort forced to medium
-//   "[[ripple: sol@xhigh]]" or "[[gpt: sol@xhigh]]" at the top of the first user
-//   message overrides model/effort for direct-rule models only (subagent prompts).
+//   "kimi-k3"                    → the one provider whose `models` carries it, model unchanged
+//                                  (only when no rule matched and exactly one provider claims it)
+//   "[[ripple: sol@xhigh]]" or "[[gpt: sol@xhigh]]" at the very top of a user
+//   message (a subagent prompt) overrides model/effort; the marker's model is then
+//   placed by its own prefix rule or its one declaring provider. A slot ignores it.
+//   Quoted anywhere else, a marker is prose (issue #13).
 const REMINDER = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
-const MARKER = /\[\[\s*(?:ripple|gpt)\s*:\s*([A-Za-z0-9.\-]+)\s*(?:@\s*([A-Za-z]+))?\s*\]\]/;
-export function markerOverride(body, aliases) {
+// Anchored: the marker is honoured only at the very top of a user message. A subagent prompt starts
+// with it; a compaction summary that *quotes* one does not, and on 2026-09-20 such a quote in a
+// GPT-6 Astra session's summary re-routed the whole session to `muse` on ChatGPT (400 on every turn).
+const MARKER = /^\s*\[\[\s*(?:ripple|gpt)\s*:\s*([A-Za-z0-9.\-]+)\s*(?:@\s*([A-Za-z]+))?\s*\]\]/;
+/** The raw `[[ripple: <name>@<effort>]]` the body carries, name lowercased. Does not resolve it. */
+function scanMarker(body) {
     const messages = body?.messages;
     if (!Array.isArray(messages))
         return null;
@@ -27,11 +35,18 @@ export function markerOverride(body, aliases) {
         if (hit) {
             const name = hit[1].toLowerCase();
             const effort = hit[2]?.toLowerCase();
-            return effort ? { model: aliases[name] ?? name, effort } : { model: aliases[name] ?? name };
+            return effort ? { name, effort } : { name };
         }
     }
     return null;
 }
+export function markerOverride(body, aliases) {
+    const hit = scanMarker(body);
+    if (!hit)
+        return null;
+    const model = aliases[hit.name] ?? hit.name;
+    return hit.effort ? { model, effort: hit.effort } : { model };
+}
 export function resolve(model, body, cfg) {
     if (typeof model !== "string")
         return null;
@@ -42,10 +57,13 @@ export function resolve(model, body, cfg) {
         base = model.slice(0, at);
         effort = model.slice(at + 1) || undefined;
     }
-    // A native `anthropic` provider serves the OpenAI ingress only; it speaks the Messages API with
-    // its own credentials and has nothing to translate for a caller that already speaks it. A rule
-    // naming one is ignored here so the request passes through to Anthropic instead of failing.
-    const ingressOnly = (name) => cfg.providers[name]?.type === "anthropic";
+    // Native Anthropic stays ingress-only unless the operator explicitly enables its OAuth account
+    // pool. That opt-in is what makes routing useful: the same Messages body goes to Anthropic under a
+    // selected account, with affinity and failover. Existing configs keep byte-for-byte passthrough.
+    const ingressOnly = (name) => {
+        const provider = cfg.providers[name];
+        return provider?.type === "anthropic" && !provider.accountPool;
+    };
     const direct = cfg.direct.find((d) => base.startsWith(d.prefix));
     if (direct && ingressOnly(direct.provider))
         return null;
@@ -53,19 +71,135 @@ export function resolve(model, body, cfg) {
         const ov = markerOverride(body, cfg.aliases);
         const finalModel = ov?.model ?? base;
         const finalEffort = ov?.effort ?? effort;
-        return { provider: direct.provider, model: finalModel, effort: finalEffort, tag: `${model}->${finalModel}` };
+        // The provider follows the model the marker names, not the model the session runs on. A
+        // `gpt-6-astra` session delegating to `muse` used to keep `chatgpt` as the provider and send
+        // it `muse-spark-1.3-contributor`, which ChatGPT refuses (2026-09-20). The marker's model is
+        // placed the way any requested model is: its own prefix rule, else its one declaring provider.
+        if (finalModel !== base) {
+            const ownDirect = cfg.direct.find((d) => finalModel.startsWith(d.prefix));
+            const provider = ownDirect ? ownDirect.provider : soleOwner(finalModel, cfg);
+            if (!provider || ingressOnly(provider))
+                return null;
+            return { provider, model: finalModel, effort: finalEffort, tag: `${model}->${finalModel} (marker)` };
+        }
+        // The log says when a marker decided: `claude-sonnet-5->gpt-6-astra` with no hint of why cost a
+        // reporter twenty minutes (issue #13).
+        return { provider: direct.provider, model: finalModel, effort: finalEffort, tag: `${model}->${finalModel}${ov ? " (marker)" : ""}` };
     }
     // The app sends some slots with a dated id (`claude-haiku-4-5-20251001`) and others without
     // (`claude-opus-5`), while the GUI only ever offers the undated form. Match either.
     const route = cfg.routes[base] ?? cfg.routes[base.replace(/-\d{8}$/, "")];
-    if (!route || ingressOnly(route.provider))
+    if (route) {
+        if (ingressOnly(route.provider))
+            return null;
+        return {
+            provider: route.provider,
+            model: route.model,
+            effort: effort ?? route.effort,
+            tag: `${model}->${route.model}`,
+            // Only a slot has somewhere else to go. A direct rule names one provider on purpose.
+            ...(route.fallbacks?.length ? { fallbacks: route.fallbacks } : {}),
+        };
+    }
+    // No rule names this model. A provider that carries it in its own `models` list names it just as
+    // plainly: that list is what the probe read from the vendor's `/models` and what the GUI ticked.
+    // Not using it was why ticking a model in the GUI did nothing until a `direct` rule was also
+    // written by hand, and why one config had eighteen of them (2026-09-19: seventeen of those
+    // eighteen are exactly this case). Rules keep their priority — this only fills the gap they
+    // leave, so nothing that routes today routes differently.
+    const ov = markerOverride(body, cfg.aliases);
+    const finalModel = ov?.model ?? base;
+    const owners = declaredBy(finalModel, cfg);
+    // Two providers offering the same id is a question only the operator can answer (one config has
+    // `deepseek-v4-pro` on both a direct DeepSeek mapping and OpenCode Go, and they are not the same
+    // deal). Guessing would route someone's traffic to a vendor they did not choose, so an ambiguous
+    // id keeps requiring the explicit rule it requires today.
+    if (owners.length !== 1)
         return null;
-    return {
-        provider: route.provider,
-        model: route.model,
-        effort: effort ?? route.effort,
-        tag: `${model}->${route.model}`,
-    };
+    const owner = owners[0];
+    // An ingress-only provider declaring a model does not make it a target: it serves the OpenAI
+    // ingress with its own credentials (see `ingressOnly` above). This matters more here than
+    // anywhere else — a native `anthropic` provider lists the Claude models, and auto-routing those
+    // would hijack every Claude request in the session into a provider that answers 400 (ARCHITECTURE
+    // §5). Counting it as an owner rather than skipping it is deliberate: if some other provider also
+    // offered `claude-opus-5`, that is an ambiguity to be asked about, not a silent redirection of
+    // Claude traffic to a third party.
+    if (ingressOnly(owner))
+        return null;
+    return { provider: owner, model: finalModel, effort: ov?.effort ?? effort, tag: `${model}->${finalModel}${ov ? " (marker)" : ""}` };
+}
+/**
+ * Providers whose own `models` list carries this id. Dated and undated forms match each other, the
+ * same way a slot lookup does. Ingress-only providers are included on purpose — see the call site.
+ */
+/** The one provider declaring this id, or null when none or several do. */
+function soleOwner(id, cfg) {
+    const owners = declaredBy(id, cfg);
+    return owners.length === 1 ? owners[0] : null;
+}
+export function declaredBy(id, cfg) {
+    const undated = id.replace(/-\d{8}$/, "");
+    const owners = [];
+    for (const [name, provider] of Object.entries(cfg.providers)) {
+        const models = provider.models;
+        if (!models?.length)
+            continue;
+        if (models.some((m) => m.id === id || m.id === undated || m.id.replace(/-\d{8}$/, "") === undated))
+            owners.push(name);
+    }
+    return owners;
+}
+/**
+ * Why `resolve` returned null, named, or null when the request is not ours to refuse.
+ *
+ * A model that resolves needs no explanation. A native Claude id is deliberately unrouted — it
+ * passes through to Anthropic — so it is never a refusal either. Everything else reaching here is a
+ * request that would otherwise be forwarded to Anthropic and come back 404, which is what happened
+ * to a whole session on 2026-09-20: an agent file named `deepseek` resolved (through a missing
+ * alias) to a model no provider declared, and `PASS` sent thirty of them to Anthropic.
+ *
+ * Pure: it decides and explains, it does not send.
+ */
+export function unroutableReason(model, body, cfg) {
+    if (typeof model !== "string")
+        return null;
+    if (model.startsWith("claude-"))
+        return null;
+    const at = model.indexOf("@");
+    const base = at > 0 ? model.slice(0, at) : model;
+    const marker = scanMarker(body);
+    const aliased = marker ? cfg.aliases[marker.name] : undefined;
+    const effective = aliased ?? (marker ? marker.name : base);
+    const hasDirect = (id) => cfg.direct.some((d) => id.startsWith(d.prefix));
+    // Mirror `resolve`. A prefix rule on the requested model honours the marker: the marker's model is
+    // then placed by its own prefix rule or its one declaring provider, and a null from `resolve` there
+    // is a real "nowhere to send this". Without a marker, a prefix rule or a slot on the requested model
+    // decided, and a null can only be the ingress-only drop — pass through, do not refuse. A slot ignores
+    // the marker entirely.
+    if (hasDirect(base)) {
+        if (effective === base || hasDirect(effective))
+            return null;
+    }
+    else if (cfg.routes[base] || cfg.routes[base.replace(/-\d{8}$/, "")]) {
+        return null;
+    }
+    const owners = declaredBy(effective, cfg);
+    if (owners.length > 1) {
+        return `"${effective}" is declared by two providers (${owners.join(", ")}); add a route or direct rule`;
+    }
+    if (owners.length === 1) {
+        const owner = owners[0];
+        const provider = cfg.providers[owner];
+        if (provider?.type === "anthropic" && !provider.accountPool)
+            return `provider "${owner}" is ingress-only`;
+        return null; // resolve() would have routed this; nothing to refuse.
+    }
+    // Nothing declares it. Say which name failed, and whether a marker introduced it.
+    if (marker && !aliased)
+        return `marker alias "${marker.name}" is not an alias and not an agent name`;
+    if (aliased)
+        return `marker alias "${marker.name}" resolves to "${aliased}", which no provider declares`;
+    return `no provider declares "${effective}"`;
 }
 /** Apply a resolution to a parsed Messages request body (mutates and returns it). */
 export function rewriteBody(json, r, effortClamp) {

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.2.0";
+export const VERSION = "0.3.0";

package/dist/router/src/websearch.js

@@ -0,0 +1,307 @@
+// Web search for routed models.
+//
+// Claude Code does not put `web_search` in the main request. `WebSearch` opens a separate side
+// request — system prompt "You are an assistant for performing a web search tool use", one message
+// "Perform a web search for the query: …", one Anthropic `web_search` server tool, `max_uses: 8` —
+// and sends it to `ANTHROPIC_SMALL_FAST_MODEL` when that is set, otherwise to a built-in small
+// model (measured 2026-09-17: an Opus session and a DeepSeek-routed session both landed on
+// `claude-haiku-4-5`).
+//
+// That is why web search costs Anthropic quota no matter which provider answers the session: without
+// a Claude subscription a user on DeepSeek or GPT cannot search at all, which makes a routed setup
+// only half routed. This module answers that side request from the provider's own hosted search —
+// the one the user already pays for.
+//
+// The side request needs no env var to reach us: we terminate TLS for api.anthropic.com, so every
+// request passes through, and the interception happens before routing. Its model id is therefore
+// irrelevant, which is just as well, because it is whatever the CLI picked.
+//
+// The answer must be shaped the way Claude Code parses it: the CLI reads `server_tool_use` blocks
+// to count searches, `web_search_tool_result` blocks for the hits, and `text` blocks for prose,
+// then reports "Did N searches" from `usage.server_tool_use.web_search_requests`. Get the count
+// field wrong and a search that really ran is reported as zero.
+import crypto from "node:crypto";
+const QUERY_PREFIX = "Perform a web search for the query: ";
+function isWebSearchTool(tool) {
+    if (!tool || typeof tool !== "object")
+        return false;
+    const { type, name } = tool;
+    // The type carries a date suffix (`web_search_20250305`) that changes with the tool version.
+    return typeof type === "string" && type.startsWith("web_search") && name === "web_search";
+}
+function textOf(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((b) => (b && typeof b === "object" && b.type === "text" ? String(b.text ?? "") : ""))
+        .filter(Boolean)
+        .join("\n");
+}
+/**
+ * The side request's query, or null when this is an ordinary turn. Recognised by the forced server
+ * tool rather than by the model id, because the model id is whatever the user pointed
+ * `ANTHROPIC_SMALL_FAST_MODEL` at.
+ */
+export function webSearchQuery(json) {
+    const tools = Array.isArray(json.tools) ? json.tools : [];
+    const tool = tools.find(isWebSearchTool);
+    if (!tool)
+        return null;
+    // The side request declares that one tool and nothing else — an ordinary turn carries Read, Edit,
+    // Bash and the rest — and its single user message is the CLI's fixed sentence. Both are required,
+    // because hijacking a turn that wanted a model would be far worse than missing a search.
+    //
+    // What is deliberately NOT required is a forced `tool_choice`. The CLI source passes
+    // `toolChoice: {type:"tool", name:"web_search"}`, but the wire carries `{"type":"auto"}`
+    // (measured 2026-09-17 against the live side request). Read the wire, not the source.
+    if (tools.length !== 1)
+        return null;
+    const messages = Array.isArray(json.messages) ? json.messages : [];
+    if (messages.length !== 1)
+        return null;
+    const asked = textOf(messages[0].content).trim();
+    if (!asked.startsWith(QUERY_PREFIX))
+        return null;
+    const query = asked.slice(QUERY_PREFIX.length).trim();
+    if (!query)
+        return null;
+    const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string") && v.length > 0 ? v : undefined;
+    const allowed = strings(tool.allowed_domains);
+    const blocked = strings(tool.blocked_domains);
+    return {
+        query,
+        ...(allowed ? { allowedDomains: allowed } : {}),
+        ...(blocked ? { blockedDomains: blocked } : {}),
+        ...(typeof tool.max_uses === "number" ? { maxUses: tool.max_uses } : {}),
+    };
+}
+/**
+ * Hits out of an OpenAI-shaped Chat Completions reply that used a web plugin. OpenRouter returns
+ * them as `message.annotations[].url_citation` (verified live 2026-09-17: four citations with title
+ * and url, plus prose, for `plugins: [{id:"web"}]`). Vendors that answer the same schema without
+ * annotations simply yield no hits, and the caller falls back rather than pretending.
+ */
+export function hitsFromAnnotations(message) {
+    const m = (message ?? {});
+    const annotations = Array.isArray(m.annotations) ? m.annotations : [];
+    const hits = [];
+    for (const a of annotations) {
+        if (!a || typeof a !== "object")
+            continue;
+        const cite = a.url_citation;
+        if (a.type !== "url_citation" || !cite || typeof cite.url !== "string")
+            continue;
+        hits.push({ title: typeof cite.title === "string" ? cite.title : cite.url, url: cite.url });
+    }
+    const text = typeof m.content === "string" ? m.content : "";
+    return { hits, ...(text ? { text } : {}) };
+}
+/** Same-host duplicates waste the model's attention; the CLI does not de-duplicate for us. */
+export function dedupeHits(hits, limit = 10) {
+    const seen = new Set();
+    const out = [];
+    for (const hit of hits) {
+        if (!hit?.url || typeof hit.url !== "string")
+            continue;
+        const key = hit.url.replace(/[#?].*$/, "").replace(/\/+$/, "");
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ title: typeof hit.title === "string" && hit.title ? hit.title : hit.url, url: hit.url });
+        if (out.length >= limit)
+            break;
+    }
+    return out;
+}
+/**
+ * The content blocks Claude Code's own parser expects: a `server_tool_use` it counts, a
+ * `web_search_tool_result` it reads hits from, and any prose as `text`.
+ */
+export function webSearchBlocks(q, outcome) {
+    const toolUseId = `srvtoolu_${crypto.randomBytes(12).toString("hex")}`;
+    const hits = dedupeHits(outcome.hits);
+    const blocks = [
+        { type: "server_tool_use", id: toolUseId, name: "web_search", input: { query: q.query } },
+        {
+            type: "web_search_tool_result",
+            tool_use_id: toolUseId,
+            content: hits.map((h) => ({ type: "web_search_result", title: h.title, url: h.url })),
+        },
+    ];
+    const text = outcome.text?.trim();
+    if (text)
+        blocks.push({ type: "text", text });
+    return { blocks, toolUseId };
+}
+/** The error shape the CLI recognises: it prints `Web search error: <code>` rather than showing nothing. */
+export function webSearchErrorBlocks(q, errorCode) {
+    const toolUseId = `srvtoolu_${crypto.randomBytes(12).toString("hex")}`;
+    return [
+        { type: "server_tool_use", id: toolUseId, name: "web_search", input: { query: q.query } },
+        { type: "web_search_tool_result", tool_use_id: toolUseId, content: { type: "web_search_tool_result_error", error_code: errorCode } },
+    ];
+}
+/**
+ * A complete non-streaming Messages response. `usage.server_tool_use.web_search_requests` is what
+ * the CLI turns into "Did N searches"; omitting it reports zero for a search that ran.
+ */
+export function webSearchMessage(model, blocks, searches) {
+    return {
+        id: `msg_${crypto.randomBytes(12).toString("hex")}`,
+        type: "message",
+        role: "assistant",
+        model,
+        content: blocks,
+        stop_reason: "end_turn",
+        stop_sequence: null,
+        usage: {
+            input_tokens: 0,
+            output_tokens: 0,
+            cache_read_input_tokens: 0,
+            cache_creation_input_tokens: 0,
+            server_tool_use: { web_search_requests: searches },
+        },
+    };
+}
+/**
+ * The same message as a stream. Claude Code assembles the final content from these events and only
+ * then parses it, so what matters is that the assembled message matches `webSearchMessage`; the
+ * events also drive the "Searching…" progress line.
+ */
+export function webSearchSse(model, blocks, searches) {
+    const message = webSearchMessage(model, blocks, searches);
+    const frames = [
+        { event: "message_start", data: { type: "message_start", message: { ...message, content: [] } } },
+    ];
+    blocks.forEach((block, index) => {
+        if (block.type === "text") {
+            frames.push({ event: "content_block_start", data: { type: "content_block_start", index, content_block: { type: "text", text: "" } } });
+            frames.push({ event: "content_block_delta", data: { type: "content_block_delta", index, delta: { type: "text_delta", text: String(block.text ?? "") } } });
+        }
+        else {
+            // A server tool block carries no deltas: it is complete the moment it opens.
+            frames.push({ event: "content_block_start", data: { type: "content_block_start", index, content_block: block } });
+        }
+        frames.push({ event: "content_block_stop", data: { type: "content_block_stop", index } });
+    });
+    frames.push({ event: "message_delta", data: { type: "message_delta", delta: { stop_reason: "end_turn", stop_sequence: null }, usage: message.usage } });
+    frames.push({ event: "message_stop", data: { type: "message_stop" } });
+    return frames.map((f) => `event: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`).join("");
+}
+/**
+ * A backend that asks an OpenAI-compatible provider to search with its own hosted web plugin.
+ * OpenRouter takes `plugins: [{id:"web"}]` and answers with `url_citation` annotations; `:online`
+ * on the model id is the same thing, and is not used here because the plugin form carries the
+ * domain filters and result count the side request asked for.
+ */
+export function webPluginBackend(opts) {
+    return {
+        name: opts.name,
+        async search(q, signal) {
+            const plugin = { id: "web", max_results: opts.maxResults ?? 5 };
+            if (q.allowedDomains)
+                plugin.include_domains = q.allowedDomains;
+            else if (q.blockedDomains)
+                plugin.exclude_domains = q.blockedDomains;
+            const body = {
+                model: opts.model,
+                plugins: [plugin],
+                messages: [{ role: "user", content: `${QUERY_PREFIX}${q.query}` }],
+                max_tokens: 700,
+            };
+            const doFetch = opts.fetchImpl ?? fetch;
+            const res = await doFetch(`${opts.url.replace(/\/+$/, "")}/v1/chat/completions`, {
+                method: "POST",
+                headers: { "content-type": "application/json", ...opts.headers },
+                body: JSON.stringify(body),
+                ...(signal ? { signal } : {}),
+            });
+            if (!res.ok)
+                throw new Error(`${opts.name} web search: HTTP ${res.status}`);
+            const json = await res.json();
+            const outcome = hitsFromAnnotations(json.choices?.[0]?.message);
+            // No citations means the plugin did not run. Say so rather than handing back a confident
+            // summary with nothing behind it.
+            if (outcome.hits.length === 0)
+                throw new Error(`${opts.name} web search: no citations returned`);
+            return outcome;
+        },
+    };
+}
+/** Hits out of an Anthropic `web_search_tool_result` block's content. */
+export function hitsFromServerToolResult(content) {
+    const hits = [];
+    for (const block of Array.isArray(content) ? content : []) {
+        if (!block || typeof block !== "object")
+            continue;
+        const { type, title, url } = block;
+        if (type !== "web_search_result" || typeof url !== "string")
+            continue;
+        hits.push({ title: typeof title === "string" && title ? title : url, url });
+    }
+    return hits;
+}
+/**
+ * A provider that runs Anthropic's `web_search` server tool itself, asked in Anthropic's own shape.
+ *
+ * DeepSeek's own endpoint does this (measured; see `serverTools` in compat.ts), and for such a
+ * provider the side request needs no translation at all — what comes back is already the shape
+ * Claude Code parses. The hits are still read out and rebuilt through the one path every backend
+ * shares, so a provider that answers politely with nothing is caught here rather than by the user.
+ * That is the failure this whole module exists to prevent: a search that returns prose instead of
+ * results looks like an answer.
+ */
+export function anthropicServerToolBackend(opts) {
+    return {
+        name: opts.name,
+        async search(q, signal) {
+            const tool = { type: "web_search_20250305", name: "web_search" };
+            if (q.maxUses)
+                tool.max_uses = q.maxUses;
+            if (q.allowedDomains)
+                tool.allowed_domains = q.allowedDomains;
+            else if (q.blockedDomains)
+                tool.blocked_domains = q.blockedDomains;
+            const body = {
+                model: opts.model,
+                max_tokens: 1024,
+                system: [{ type: "text", text: "You are an assistant for performing a web search tool use" }],
+                messages: [{ role: "user", content: `${QUERY_PREFIX}${q.query}` }],
+                tools: [tool],
+                tool_choice: { type: "tool", name: "web_search" },
+            };
+            const doFetch = opts.fetchImpl ?? fetch;
+            const res = await doFetch(`${opts.url.replace(/\/+$/, "")}/v1/messages`, {
+                method: "POST",
+                headers: { "content-type": "application/json", "anthropic-version": "2023-06-01", ...opts.headers },
+                body: JSON.stringify(body),
+                ...(signal ? { signal } : {}),
+            });
+            if (!res.ok)
+                throw new Error(`${opts.name} web search: HTTP ${res.status}`);
+            const json = await res.json();
+            const hits = [];
+            const prose = [];
+            for (const block of Array.isArray(json.content) ? json.content : []) {
+                if (!block || typeof block !== "object")
+                    continue;
+                const b = block;
+                if (b.type === "web_search_tool_result")
+                    hits.push(...hitsFromServerToolResult(b.content));
+                else if (b.type === "text" && typeof b.text === "string")
+                    prose.push(b.text);
+            }
+            // No result blocks means the provider did not run the tool, whatever else it said. A model
+            // told to search with no tool it can reach will narrate one instead — an OpenCode Go DeepSeek
+            // answered this exact request with its own tool-call markup as plain text and zero searches
+            // (measured 2026-09-18). Treat that as the failure it is.
+            const deduped = dedupeHits(hits).slice(0, opts.maxResults ?? 10);
+            if (deduped.length === 0)
+                throw new Error(`${opts.name} web search: no results returned`);
+            const text = prose.join("").trim();
+            return text ? { hits: deduped, text } : { hits: deduped };
+        },
+    };
+}

package/dist/router/src/x509.js

@@ -128,10 +128,15 @@ function pem(label, der) {
 function newKeyPair() {
     return crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
 }
-/** Serial numbers must be positive and unpredictable; 16 random bytes with the top bit cleared. */
+/**
+ * Serial numbers must be positive and unpredictable: 16 random bytes, top bit cleared and the next
+ * one set. Without that second bit one serial in 128 led with 0x00, which the DER encoding strips
+ * or re-pads, so its length varied and Node reported it without the zero (`8C5C…`) — a positive
+ * serial that read as negative and failed the x509 test at random. 126 random bits remain.
+ */
 function serial() {
     const b = crypto.randomBytes(16);
-    b[0] = b[0] & 0x7f;
+    b[0] = (b[0] & 0x7f) | 0x40;
     return b;
 }
 function signCert(tbs, caKey) {