deepseek-web-retrieval 0.2.0 → 0.3.0

package/src/installer/rulesContent.ts

@@ -0,0 +1,32 @@
+import type { Tier } from "./types"
+
+/** Full MCP tool ids, per the installer design's rules non-negotiables. */
+export const MCP_TOOL_IDS = { search: "mcp__deepseek__deepseek_web_search", fetch: "mcp__deepseek__deepseek_fetch" } as const
+
+/**
+ * Builds the rules block lines for the preferred tier: names the full tool ids,
+ * states trigger conditions rather than unconditional preference, and lists the
+ * private-network exclusion. Only mentions capabilities that are not "off".
+ * Hosts whose tools are named differently pass their own ids.
+ */
+export function rulesLines(ids: { readonly search: string; readonly fetch: string }, search: Tier, fetch: Tier): string[] {
+  const lines: string[] = ["DeepSeek retrieval guidance:"]
+  if (search !== "off") {
+    lines.push(
+      `- Use ${ids.search} when the task needs fresh external information: current docs, version numbers,`,
+      "  changelogs, or anything you cannot know from the repository alone. Do not search for facts already",
+      "  present locally.",
+    )
+  }
+  if (fetch !== "off") {
+    lines.push(
+      `- Use ${ids.fetch} to read a specific public web page as Markdown when its content is needed.`,
+    )
+  }
+  lines.push(
+    "- Never send localhost or private-network URLs to the DeepSeek tools; use local tools for those (the",
+    "  server blocks private hosts by default).",
+    "- DeepSeek requests are billed per successful call; retrieve only what the task needs.",
+  )
+  return lines
+}

package/src/installer/state.ts

@@ -0,0 +1,63 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { stateDir } from "./paths"
+import type { FsRoots, InstallerInput, InstallRecord } from "./types"
+
+export function statePathFor(input: InstallerInput): string {
+  return join(stateDir(input, input.scope), `install.${input.host}.json`)
+}
+
+export function readRecord(input: InstallerInput): InstallRecord | undefined {
+  const file = statePathFor(input)
+  if (!existsSync(file)) return undefined
+  try {
+    return JSON.parse(readFileSync(file, "utf8")) as InstallRecord
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * The one place that knows a file must never be claimed by two scopes of the
+ * same host: returns the subset of `files` the record at the other scope claims.
+ */
+export function claimedByOtherScope(input: InstallerInput, files: readonly string[]): string[] {
+  const other = input.scope === "global" ? "project" : "global"
+  const record = readRecord({ ...input, scope: other })
+  if (record === undefined) return []
+  return files.filter((file) => record.files.some((candidate) => candidate.file === file))
+}
+
+/**
+ * Install records carry snapshots of replaced values, so they are written with
+ * owner-only permissions regardless of umask.
+ */
+export function writeRecord(input: InstallerInput, record: InstallRecord): void {
+  const file = statePathFor(input)
+  mkdirSync(join(file, ".."), { recursive: true })
+  writeFileSync(file, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 })
+  chmodSync(file, 0o600)
+}
+
+export function deleteRecord(input: InstallerInput): void {
+  const file = statePathFor(input)
+  if (existsSync(file)) rmSync(file)
+}
+
+/** Lists install records found in both scope locations for the given roots. */
+export function listRecords(roots: FsRoots): InstallRecord[] {
+  const records: InstallRecord[] = []
+  for (const scope of ["global", "project"] as const) {
+    const dir = stateDir(roots, scope)
+    if (!existsSync(dir)) continue
+    for (const name of readdirSync(dir)) {
+      if (!name.startsWith("install.") || !name.endsWith(".json")) continue
+      try {
+        records.push(JSON.parse(readFileSync(join(dir, name), "utf8")) as InstallRecord)
+      } catch {
+        // Unreadable records are skipped; uninstall reports them as absent.
+      }
+    }
+  }
+  return records
+}

package/src/installer/types.ts

@@ -0,0 +1,126 @@
+/** Hosts the installer supports. */
+export type HostName = "opencode" | "pi" | "codex"
+
+/** Install scope, a first-class user choice. */
+export type Scope = "project" | "global"
+
+/**
+ * The filesystem roots path resolution needs; InstallerInput satisfies this structurally.
+ * Each host module owns the mapping from an input to its config and rules files.
+ */
+export interface FsRoots {
+  readonly home: string
+  readonly cwd: string
+  /** Explicit config home; the CLI edge resolves XDG once and passes it down. */
+  readonly configHome?: string
+}
+
+/** The files a host edit touches for a given scope. */
+export interface HostPaths {
+  /** Main host config file the installer edits. */
+  readonly config: string
+  /** Rules file receiving the marked block for the preferred tier. */
+  readonly rules: string
+}
+
+/** Control tier per capability; "off" skips the tool entirely. */
+export type Tier = "optional" | "preferred" | "forced" | "off"
+
+/** Everything the installer needs to build a plan. */
+export interface InstallerInput {
+  readonly host: HostName
+  readonly scope: Scope
+  readonly search: Tier
+  readonly fetch: Tier
+  /** npm package reference written into host config; defaults to the published name. */
+  readonly packageRef: string
+  readonly home: string
+  readonly cwd: string
+  readonly configHome?: string
+}
+
+/** A mutation on a parsed config object, addressed by a dotted path. */
+export interface ConfigOp {
+  readonly op: "set" | "append-array"
+  readonly path: readonly string[]
+  readonly value?: unknown
+  readonly entries?: readonly unknown[]
+  /** Plan-preview metadata: the value the set replaces (undefined when absent). */
+  readonly previous?: unknown
+  /** Plan-preview metadata: entries already present at an append-array path. */
+  readonly existingCount?: number
+}
+
+/** A JSON file edit: comment-preserving ops on JSONC text. */
+export interface JsonEdit {
+  readonly file: string
+  readonly format: "json"
+  readonly ops: readonly ConfigOp[]
+}
+
+/** A TOML file edit: ops on the parsed value, serialized on write. */
+export interface TomlEdit {
+  readonly file: string
+  readonly format: "toml"
+  readonly ops: readonly ConfigOp[]
+}
+
+/** A rules file edit: upserts the host's marked block; it carries no ops. */
+export interface RulesEdit {
+  readonly file: string
+  readonly format: "rules"
+  readonly block: string
+}
+
+/** One file the plan touches, discriminated by config format. */
+export type FileEdit = JsonEdit | TomlEdit | RulesEdit
+
+/** A plan that refuses to proceed (for example a structurally unavailable tier). */
+export interface PlanError {
+  readonly message: string
+}
+
+export interface InstallPlan {
+  readonly host: HostName
+  readonly scope: Scope
+  readonly tiers: { readonly search: Tier; readonly fetch: Tier }
+  readonly edits: readonly FileEdit[]
+  readonly notes: readonly string[]
+  readonly errors: readonly PlanError[]
+  /**
+   * Artifacts from a previous init that this plan no longer wants (for example the
+   * web_search kill switch after a forced → optional tier change). They are shown in
+   * the plan, reverted during apply, and then gone from the record — so uninstall
+   * still restores exactly what this install applied.
+   */
+  readonly reverts?: readonly RecordedFile[]
+}
+
+/** An op as it was actually applied, with the previous value for surgical undo. */
+export interface RecordedOp {
+  readonly op: "set" | "append-array"
+  readonly path: readonly string[]
+  readonly applied: unknown
+  readonly previous: unknown
+}
+
+/** A file as it was actually written, for surgical uninstall. */
+export interface RecordedFile {
+  readonly file: string
+  readonly format: "json" | "toml" | "rules"
+  readonly created: boolean
+  readonly ops: readonly RecordedOp[]
+  readonly blockApplied?: string
+  /** Path prefixes the apply step had to create; uninstall removes them when left empty. */
+  readonly createdParents?: readonly (readonly string[])[]
+}
+
+/** Persisted install state; one record per host and scope. */
+export interface InstallRecord {
+  readonly version: 1
+  readonly host: HostName
+  readonly scope: Scope
+  readonly tiers: { readonly search: Tier; readonly fetch: Tier }
+  readonly createdAt: string
+  readonly files: readonly RecordedFile[]
+}

package/src/installer/uninstall.ts

@@ -0,0 +1,33 @@
+import { stateDir } from "./paths"
+import { pruneEmptyDir, revertRecordedFile } from "./revert"
+import { claimedByOtherScope, deleteRecord, readRecord } from "./state"
+import type { InstallerInput } from "./types"
+
+/**
+ * Reverses exactly what the plan applied: overwritten values restore their
+ * snapshots (only when the current value still matches what the installer
+ * wrote — user edits win), merged arrays lose only the installer's entries,
+ * rules blocks are removed, and files the installer created are deleted.
+ */
+export function uninstall(input: InstallerInput): string[] {
+  const record = readRecord(input)
+  if (record === undefined) {
+    throw new Error(`No ${input.host} install is recorded for the ${input.scope} scope.`)
+  }
+  const other = input.scope === "global" ? "project" : "global"
+  const overlap = claimedByOtherScope(input, record.files.map((file) => file.file))
+  if (overlap.length > 0) {
+    throw new Error(
+      `A ${input.host} install is also recorded at the ${other} scope and claims the same file(s): ${overlap.join(", ")}. ` +
+        `Uninstall the ${other}-scope install first so this rollback cannot clobber its entries.`,
+    )
+  }
+  const lines: string[] = []
+  for (const file of [...record.files].reverse()) {
+    lines.push(...revertRecordedFile(file, record.host, { label: "", whole: true }))
+  }
+  deleteRecord(input)
+  pruneEmptyDir(stateDir(input, input.scope))
+  lines.push(`removed install record (${input.host}, ${input.scope})`)
+  return lines
+}

package/src/mcp/auth.ts

@@ -1,8 +1,9 @@
+import { API_KEY_ENV } from "../core/constants"
 import { apiKeyFromEnv } from "../core/auth"
 import type { Env } from "./config"
 
 export const MISSING_API_KEY_MESSAGE =
-  "DeepSeek API key not found. Set DEEPSEEK_API_KEY in the MCP server's env configuration."
+  `DeepSeek API key not found. Set ${API_KEY_ENV} in the MCP server's env configuration.`
 
 /** Resolves the API key from the environment or fails with shared guidance. */
 export function requireApiKey(env: Env): string {

package/src/mcp/cli.ts

@@ -3,7 +3,15 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio"
 import { apiKeyFromEnv } from "../core/auth"
 import { MISSING_API_KEY_MESSAGE } from "./auth"
 import { resolveEnvOptions } from "./config"
-import { createDeepSeekServer } from "./server"
+import { createDeepSeekServer, servePrecheck } from "./server"
+
+// Installer subcommands run before the server path; MCP clients spawn this bin
+// with no arguments, so the default stdio behavior is unchanged.
+const subcommand = process.argv[2]
+if (subcommand === "init" || subcommand === "uninstall" || subcommand === "list") {
+  const { runInstallerCli } = await import("../installer/cli")
+  process.exit(await runInstallerCli(process.argv.slice(2)))
+}
 
 // stdout is the JSON-RPC channel; all diagnostics must go to stderr.
 const env = process.env
@@ -13,11 +21,19 @@ if (!apiKeyFromEnv(env)) {
 }
 
 const config = resolveEnvOptions(env)
+const precheck = servePrecheck(config)
+if (precheck) {
+  console.error(precheck)
+  process.exit(1)
+}
 const handle = serveStdio(() => createDeepSeekServer(config, env))
-console.error(
-  `deepseek-web-retrieval MCP server on stdio ` +
-    `(search: max ${config.search.maxResults} results, fetch: max ${config.fetch.maxChars} chars)`,
-)
+const tools = [
+  config.search.enabled ? `search (max ${config.search.maxResults} results)` : null,
+  config.fetch.enabled ? `fetch (max ${config.fetch.maxChars} chars)` : null,
+]
+  .filter(Boolean)
+  .join(", ")
+console.error(`deepseek-web-retrieval MCP server on stdio (${tools})`)
 
 process.on("SIGINT", () => void handle.close())
 process.on("SIGTERM", () => void handle.close())

package/src/mcp/config.ts

@@ -1,9 +1,46 @@
+import { ENABLE_FETCH_ENV, ENABLE_SEARCH_ENV } from "../core/constants"
 import { resolvePluginOptions } from "../core/options"
 import type { PluginOptions, ResolvedOptions } from "../core/types"
 
 /** The environment an MCP server reads its key and options from. */
 export type Env = Readonly<Record<string, string | undefined>>
 
+/** Each supported option mapped onto its DEEPSEEK_* variable, grouped by value type. */
+const NUMBER_ENV = {
+  count: "DEEPSEEK_SEARCH_COUNT",
+  maxResults: "DEEPSEEK_SEARCH_MAX_RESULTS",
+  minRerank: "DEEPSEEK_SEARCH_MIN_RERANK",
+  minAuthority: "DEEPSEEK_SEARCH_MIN_AUTHORITY",
+  maxSummaryChars: "DEEPSEEK_SEARCH_MAX_SUMMARY_CHARS",
+  searchTimeoutMs: "DEEPSEEK_SEARCH_TIMEOUT_MS",
+  fetchMaxChars: "DEEPSEEK_FETCH_MAX_CHARS",
+  fetchTimeoutMs: "DEEPSEEK_FETCH_TIMEOUT_MS",
+  maxRetries: "DEEPSEEK_MAX_RETRIES",
+  retryBaseDelayMs: "DEEPSEEK_RETRY_BASE_DELAY_MS",
+} as const
+
+const TEXT_ENV = {
+  language: "DEEPSEEK_SEARCH_LANGUAGE",
+} as const
+
+const DOMAINS_ENV = {
+  blockedDomains: "DEEPSEEK_SEARCH_BLOCKED_DOMAINS",
+  includeDomains: "DEEPSEEK_SEARCH_INCLUDE_DOMAINS",
+  fetchAllowedDomains: "DEEPSEEK_FETCH_ALLOWED_DOMAINS",
+  fetchBlockedDomains: "DEEPSEEK_FETCH_BLOCKED_DOMAINS",
+} as const
+
+const FLAG_ENV = {
+  allowUnknownAuthority: "DEEPSEEK_SEARCH_ALLOW_UNKNOWN_AUTHORITY",
+} as const
+
+/** Shared defaults are true; only an explicit false value disables them. */
+const FALSE_ONLY_ENV = {
+  fetchBlockPrivateHosts: "DEEPSEEK_FETCH_BLOCK_PRIVATE_HOSTS",
+  searchEnabled: ENABLE_SEARCH_ENV,
+  fetchEnabled: ENABLE_FETCH_ENV,
+} as const
+
 /**
  * Maps `DEEPSEEK_*` environment variables onto the shared plugin option keys and
  * resolves them through the same pipeline as the OpenCode adapter, so defaults
@@ -17,33 +54,33 @@ export function resolveEnvOptions(env: Env = process.env): ResolvedOptions {
 export function pluginOptionsFromEnv(env: Env): PluginOptions {
   const options: Record<string, unknown> = {}
 
-  putNumber(options, "count", env.DEEPSEEK_SEARCH_COUNT)
-  putNumber(options, "maxResults", env.DEEPSEEK_SEARCH_MAX_RESULTS)
-  putNumber(options, "minRerank", env.DEEPSEEK_SEARCH_MIN_RERANK)
-  putNumber(options, "minAuthority", env.DEEPSEEK_SEARCH_MIN_AUTHORITY)
-  putBoolean(options, "allowUnknownAuthority", env.DEEPSEEK_SEARCH_ALLOW_UNKNOWN_AUTHORITY)
-  putDomains(options, "blockedDomains", env.DEEPSEEK_SEARCH_BLOCKED_DOMAINS)
-  putDomains(options, "includeDomains", env.DEEPSEEK_SEARCH_INCLUDE_DOMAINS)
-  putText(options, "language", env.DEEPSEEK_SEARCH_LANGUAGE)
-  putNumber(options, "maxSummaryChars", env.DEEPSEEK_SEARCH_MAX_SUMMARY_CHARS)
-  putNumber(options, "searchTimeoutMs", env.DEEPSEEK_SEARCH_TIMEOUT_MS)
-
-  putNumber(options, "fetchMaxChars", env.DEEPSEEK_FETCH_MAX_CHARS)
-  putDomains(options, "fetchAllowedDomains", env.DEEPSEEK_FETCH_ALLOWED_DOMAINS)
-  putDomains(options, "fetchBlockedDomains", env.DEEPSEEK_FETCH_BLOCKED_DOMAINS)
-  putNumber(options, "fetchTimeoutMs", env.DEEPSEEK_FETCH_TIMEOUT_MS)
-  // Shared default is true; only an explicit false value disables it.
-  if (isFalseValue(env.DEEPSEEK_FETCH_BLOCK_PRIVATE_HOSTS)) {
-    options.fetchBlockPrivateHosts = false
-  }
-
-  putNumber(options, "maxRetries", env.DEEPSEEK_MAX_RETRIES)
-  putNumber(options, "retryBaseDelayMs", env.DEEPSEEK_RETRY_BASE_DELAY_MS)
+  putNumber(options, "count", env)
+  putNumber(options, "maxResults", env)
+  putNumber(options, "minRerank", env)
+  putNumber(options, "minAuthority", env)
+  putBoolean(options, "allowUnknownAuthority", env)
+  putDomains(options, "blockedDomains", env)
+  putDomains(options, "includeDomains", env)
+  putText(options, "language", env)
+  putNumber(options, "maxSummaryChars", env)
+  putNumber(options, "searchTimeoutMs", env)
+
+  putNumber(options, "fetchMaxChars", env)
+  putDomains(options, "fetchAllowedDomains", env)
+  putDomains(options, "fetchBlockedDomains", env)
+  putNumber(options, "fetchTimeoutMs", env)
+  putFalseOnly(options, "fetchBlockPrivateHosts", env)
+  putFalseOnly(options, "searchEnabled", env)
+  putFalseOnly(options, "fetchEnabled", env)
+
+  putNumber(options, "maxRetries", env)
+  putNumber(options, "retryBaseDelayMs", env)
 
   return options
 }
 
-function putNumber(target: Record<string, unknown>, key: string, value: string | undefined): void {
+function putNumber(target: Record<string, unknown>, key: keyof typeof NUMBER_ENV, env: Env): void {
+  const value = env[NUMBER_ENV[key]]
   if (value === undefined) return
   const trimmed = value.trim()
   if (!trimmed) return
@@ -51,17 +88,23 @@ function putNumber(target: Record<string, unknown>, key: string, value: string |
   if (Number.isFinite(parsed)) target[key] = parsed
 }
 
-function putText(target: Record<string, unknown>, key: string, value: string | undefined): void {
+function putText(target: Record<string, unknown>, key: keyof typeof TEXT_ENV, env: Env): void {
+  const value = env[TEXT_ENV[key]]
   if (value === undefined) return
   const trimmed = value.trim()
   if (trimmed) target[key] = trimmed
 }
 
-function putBoolean(target: Record<string, unknown>, key: string, value: string | undefined): void {
-  if (isTrueValue(value)) target[key] = true
+function putBoolean(target: Record<string, unknown>, key: keyof typeof FLAG_ENV, env: Env): void {
+  if (isTrueValue(env[FLAG_ENV[key]])) target[key] = true
+}
+
+function putFalseOnly(target: Record<string, unknown>, key: keyof typeof FALSE_ONLY_ENV, env: Env): void {
+  if (isFalseValue(env[FALSE_ONLY_ENV[key]])) target[key] = false
 }
 
-function putDomains(target: Record<string, unknown>, key: string, value: string | undefined): void {
+function putDomains(target: Record<string, unknown>, key: keyof typeof DOMAINS_ENV, env: Env): void {
+  const value = env[DOMAINS_ENV[key]]
   if (value === undefined || !value.trim()) return
   const domains = value
     .split(",")

package/src/mcp/server.ts

@@ -1,15 +1,20 @@
 import { McpServer } from "@modelcontextprotocol/server"
 import type { CallToolResult } from "@modelcontextprotocol/server"
 import * as z from "zod/v4"
-import { fetchPage, searchWeb } from "../core/client"
-import { assertFetchHostPolicy } from "../core/domains"
-import { formatFetchedContent } from "../core/format"
-import type { ResolvedOptions, WebSearchResult } from "../core/types"
-import { parseFetchUrl } from "../core/url"
+import { fetchDocument, searchWeb } from "../core/client"
+import { ENABLE_FETCH_ENV, ENABLE_SEARCH_ENV } from "../core/constants"
+import {
+  FETCH_OUTPUT_TRUNCATED,
+  FETCH_SERVICE_LIMITS,
+  SEARCH_EMPTY_IS_NORMAL,
+  SEARCH_QUERY_OPERATORS,
+  SEARCH_RANKED_FILTERED,
+} from "../core/descriptions"
+import { formatSearchResults } from "../core/format"
+import type { ResolvedOptions, SearchResult } from "../core/types"
 import pkg from "../../package.json"
 import { requireApiKey } from "./auth"
 import type { Env } from "./config"
-import { formatSearchResults } from "./format"
 
 export const MCP_SERVER_NAME = "deepseek-web-retrieval"
 
@@ -46,15 +51,16 @@ const FETCH_OUTPUT = z.object({
 
 const SEARCH_DESCRIPTION =
   "Search the web with DeepSeek's in-house search engine and return a short, filtered result " +
-    "list (title, URL, summary). Results are ranked by relevance and source authority, deduplicated " +
-    "by URL, and capped at the configured maximum. An empty result list is normal, not an error. " +
-    "Use site:/-site: operators in the query to include or exclude domains; the full query must stay " +
-    "within 128 characters. To read a full page, pass a result URL to the deepseek_fetch tool."
+    "list (title, URL, summary). " +
+    `${SEARCH_RANKED_FILTERED} ` +
+    `${SEARCH_EMPTY_IS_NORMAL} ` +
+    `${SEARCH_QUERY_OPERATORS} ` +
+    "To read a full page, pass a result URL to the deepseek_fetch tool."
 
 const FETCH_DESCRIPTION =
-  "Fetch one web page as clean Markdown through DeepSeek's Fetch API. DeepSeek does not render " +
-    "JavaScript and cannot reach private networks; PDFs, images, and other binary files are " +
-    "unsupported. Output is truncated to the configured size."
+  "Fetch one web page as clean Markdown through DeepSeek's Fetch API. " +
+    `${FETCH_SERVICE_LIMITS} ` +
+    `${FETCH_OUTPUT_TRUNCATED}`
 
 /**
  * Builds the host-agnostic MCP server exposing the two DeepSeek retrieval tools.
@@ -63,59 +69,60 @@ const FETCH_DESCRIPTION =
 export function createDeepSeekServer(config: ResolvedOptions, env: Env = process.env): McpServer {
   const server = new McpServer({ name: MCP_SERVER_NAME, version: pkg.version })
 
-  server.registerTool(
-    "deepseek_web_search",
-    {
-      title: "DeepSeek Web Search",
-      description: SEARCH_DESCRIPTION,
-      inputSchema: SEARCH_INPUT,
-      outputSchema: SEARCH_OUTPUT,
-      annotations: { readOnlyHint: true },
-    },
-    async ({ query }, ctx) => {
-      try {
-        const request = requestContext(config, env, ctx.mcpReq.signal)
-        const results = await searchWeb(query, config.search, request)
-        return {
-          content: [{ type: "text", text: formatSearchResults(results) }],
-          structuredContent: { results: results.map(toStructuredResult) },
+  if (config.search.enabled) {
+    server.registerTool(
+      "deepseek_web_search",
+      {
+        title: "DeepSeek Web Search",
+        description: SEARCH_DESCRIPTION,
+        inputSchema: SEARCH_INPUT,
+        outputSchema: SEARCH_OUTPUT,
+        annotations: { readOnlyHint: true },
+      },
+      async ({ query }, ctx) => {
+        try {
+          const request = requestContext(config, env, ctx.mcpReq.signal)
+          const results = await searchWeb(query, config.search, request)
+          return {
+            content: [{ type: "text", text: formatSearchResults(results) }],
+            structuredContent: { results: results.map(toStructuredResult) },
+          }
+        } catch (error) {
+          return toErrorResult(error)
         }
-      } catch (error) {
-        return toErrorResult(error)
-      }
-    },
-  )
+      },
+    )
+  }
 
-  server.registerTool(
-    "deepseek_fetch",
-    {
-      title: "DeepSeek Fetch",
-      description: FETCH_DESCRIPTION,
-      inputSchema: FETCH_INPUT,
-      outputSchema: FETCH_OUTPUT,
-      annotations: { readOnlyHint: true },
-    },
-    async ({ url }, ctx) => {
-      try {
-        const request = requestContext(config, env, ctx.mcpReq.signal)
-        const target = parseFetchUrl(url)
-        assertFetchHostPolicy(target, config.fetch)
-        const page = await fetchPage(target, config.fetch, request)
-        const formatted = formatFetchedContent(page.title, page.content, config.fetch.maxChars)
-        return {
-          content: [{ type: "text", text: formatted.content }],
-          structuredContent: {
-            url: page.url,
-            title: page.title,
-            content: formatted.content,
-            truncated: formatted.truncated,
-          },
+  if (config.fetch.enabled) {
+    server.registerTool(
+      "deepseek_fetch",
+      {
+        title: "DeepSeek Fetch",
+        description: FETCH_DESCRIPTION,
+        inputSchema: FETCH_INPUT,
+        outputSchema: FETCH_OUTPUT,
+        annotations: { readOnlyHint: true },
+      },
+      async ({ url }, ctx) => {
+        try {
+          const request = requestContext(config, env, ctx.mcpReq.signal)
+          const page = await fetchDocument(url, config.fetch, request)
+          return {
+            content: [{ type: "text", text: page.content }],
+            structuredContent: {
+              url: page.url,
+              title: page.title,
+              content: page.content,
+              truncated: page.truncated,
+            },
+          }
+        } catch (error) {
+          return toErrorResult(error)
         }
-      } catch (error) {
-        return toErrorResult(error)
-      }
-    },
-  )
+      },
+    )
+  }
 
   return server
 }
@@ -124,15 +131,24 @@ function requestContext(config: ResolvedOptions, env: Env, signal: AbortSignal)
   return { signal, auth: { apiKey: requireApiKey(env) }, retry: config.retry }
 }
 
-function toStructuredResult(result: WebSearchResult) {
+function toStructuredResult(result: SearchResult) {
   return {
     url: result.url,
     ...(result.title ? { title: result.title } : {}),
     ...(result.content ? { content: result.content } : {}),
-    ...(result.time.published !== undefined ? { published: result.time.published } : {}),
+    ...(result.published !== undefined ? { published: result.published } : {}),
   }
 }
 
+/** Returns the both-disabled message, or undefined when a tool stays enabled. */
+export function servePrecheck(config: ResolvedOptions): string | undefined {
+  if (config.search.enabled || config.fetch.enabled) return undefined
+  return (
+    `Both tools are disabled (${ENABLE_SEARCH_ENV} and ${ENABLE_FETCH_ENV} are false); ` +
+    "at least one must stay enabled."
+  )
+}
+
 function toErrorResult(error: unknown): CallToolResult {
   const message = error instanceof Error ? error.message : String(error)
   return { content: [{ type: "text", text: message }], isError: true }

package/src/opencode/auth.ts

@@ -1,5 +1,6 @@
 import type { Context } from "@opencode/plugin/promise/plugin"
-import { API_KEY_ENV, apiKeyFromEnv } from "../core/auth"
+import { API_KEY_ENV } from "../core/constants"
+import { apiKeyFromEnv } from "../core/auth"
 import type { ApiKeySource } from "../core/types"
 
 const DEEPSEEK_INTEGRATION_ID = "deepseek"
@@ -61,7 +62,7 @@ export async function resolveApiKey(ctx: Context, source: ApiKeySource): Promise
   if (storedError) {
     throw new Error(
       `DeepSeek API key is not configured, and the OpenCode credential could not be read. ` +
-        `Set DEEPSEEK_API_KEY or run "opencode auth login".`,
+        `Set ${API_KEY_ENV} or run "opencode auth login".`,
       { cause: storedError },
     )
   }