deepseek-web-retrieval 0.6.0 → 0.8.0

package/dist/cli.js

@@ -15,11 +15,351 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
-// src/version.ts
+// src/core/constants.ts
+var SEARCH_ENDPOINT = "https://api.deepseek.com/v1/tools/search", FETCH_ENDPOINT = "https://api.deepseek.com/v1/tools/fetch", DEFAULT_SEARCH_COUNT = 10, DEFAULT_MAX_RESULTS = 10, DEFAULT_MIN_RERANK = 0, DEFAULT_MIN_AUTHORITY = 0, DEFAULT_MAX_SUMMARY_CHARS = 1200, DEFAULT_FETCH_MAX_CHARS = 16000, DEFAULT_TIMEOUT_MS = 30000, MIN_TIMEOUT_MS = 1000, MAX_TIMEOUT_MS = 120000, MAX_QUERY_CHARS = 128, MAX_ORI_QUESTION_CHARS = 128, MAX_URL_CHARS = 8192, MAX_ERROR_BODY_CHARS = 2000, MAX_RESPONSE_BYTES, FETCH_TRUNCATION_MARKER = `
+
+[content truncated]`, DEFAULT_API_KEY_SOURCE = "auto", DEFAULT_MAX_RETRIES = 2, MAX_RETRIES = 5, DEFAULT_RETRY_BASE_DELAY_MS = 250, MAX_RETRY_DELAY_MS = 1e4, API_KEY_ENV = "DEEPSEEK_API_KEY", ENABLE_SEARCH_ENV = "DEEPSEEK_ENABLE_SEARCH", ENABLE_FETCH_ENV = "DEEPSEEK_ENABLE_FETCH", SEARCH_LOCALIZATION_ENV = "DEEPSEEK_SEARCH_LOCALIZATION";
+var init_constants = __esm(() => {
+  MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+});
+
+// src/core/domains.ts
+import { isIP } from "node:net";
+function normalizeDomain(value) {
+  const trimmed = value.trim();
+  if (!trimmed || /\s/.test(trimmed))
+    return;
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+  if (hasScheme && !/^https?:\/\//i.test(trimmed))
+    return;
+  let hostname;
+  try {
+    hostname = new URL(hasScheme ? trimmed : `http://${trimmed}`).hostname;
+  } catch {
+    return;
+  }
+  return normalizeHostname(hostname);
+}
+function normalizeHostname(value) {
+  return value.trim().toLowerCase().replace(/^\[/, "").replace(/\]$/, "").replace(/\.+$/, "");
+}
+function domainMatches(hostname, domain) {
+  const host = normalizeHostname(hostname);
+  const target = normalizeHostname(domain);
+  if (!host || !target)
+    return false;
+  return host === target || host.endsWith(`.${target}`);
+}
+function normalizeDomains(values) {
+  if (!Array.isArray(values))
+    return [];
+  const domains = new Set;
+  for (const value of values) {
+    if (typeof value !== "string")
+      continue;
+    const domain = normalizeDomain(value);
+    if (domain)
+      domains.add(domain);
+  }
+  return [...domains];
+}
+function isPrivateHostname(value) {
+  const host = normalizeHostname(value);
+  if (!host)
+    return true;
+  if (host === "localhost" || host === "local")
+    return true;
+  if (host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal") || host.endsWith(".lan") || host.endsWith(".home.arpa")) {
+    return true;
+  }
+  const version = isIP(host);
+  if (version === 4)
+    return isPrivateIpv4(host);
+  if (version === 6)
+    return isPrivateIpv6(host);
+  return false;
+}
+function assertFetchHostPolicy(url, options) {
+  const host = normalizeHostname(url.hostname);
+  if (options.blockPrivateHosts && isPrivateHostname(host)) {
+    throw new Error(`Fetch blocked for ${host}: local/private addresses are not reachable by DeepSeek. ` + "Set fetchBlockPrivateHosts=false only if you really need to send the URL.");
+  }
+  const blocked = options.blockedDomains.find((domain) => domainMatches(host, domain));
+  if (blocked) {
+    throw new Error(`Fetch blocked for ${host}: matched fetchBlockedDomains entry "${blocked}"`);
+  }
+  if (options.allowedDomains.length > 0 && !options.allowedDomains.some((domain) => domainMatches(host, domain))) {
+    throw new Error(`Fetch not allowed for ${host}: add it to fetchAllowedDomains (exact host or subdomain)`);
+  }
+}
+function isPrivateIpv4(host) {
+  const parts = host.split(".").map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+    return true;
+  }
+  const [a, b] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a >= 224;
+}
+function isPrivateIpv6(host) {
+  const value = host.toLowerCase();
+  if (value === "::" || value === "::1")
+    return true;
+  if (value.startsWith("fc") || value.startsWith("fd"))
+    return true;
+  if (/^fe[89ab]/.test(value))
+    return true;
+  const dottedMapped = value.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1];
+  if (dottedMapped)
+    return isPrivateIpv4(dottedMapped);
+  const mapped = ipv4FromIpv6Hextets(value, /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mapped)
+    return isPrivateIpv4(mapped);
+  const compatible = ipv4FromIpv6Hextets(value, /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (compatible)
+    return isPrivateIpv4(compatible);
+  return false;
+}
+function ipv4FromIpv6Hextets(value, pattern) {
+  const match = value.match(pattern);
+  if (!match)
+    return;
+  const high = Number.parseInt(match[1], 16);
+  const low = Number.parseInt(match[2], 16);
+  if (!Number.isFinite(high) || !Number.isFinite(low))
+    return;
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+var init_domains = () => {};
+
+// src/core/options.ts
+import { isIP as isIP2 } from "node:net";
+function resolvePluginOptions(input) {
+  return {
+    search: resolveSearchOptions(input),
+    fetch: resolveFetchOptions(input),
+    auth: resolveAuthOptions(input),
+    retry: resolveRetryOptions(input)
+  };
+}
+function resolveSearchOptions(input) {
+  const count = clampInt(input?.count, DEFAULT_SEARCH_COUNT, 1, 50);
+  return {
+    count,
+    maxResults: clampInt(input?.maxResults, Number.isFinite(input?.count) ? count : DEFAULT_MAX_RESULTS, 0, 50),
+    minRerank: finiteNumber(input?.minRerank, DEFAULT_MIN_RERANK),
+    minAuthority: finiteNumber(input?.minAuthority, DEFAULT_MIN_AUTHORITY),
+    allowUnknownAuthority: input?.allowUnknownAuthority !== false,
+    blockedDomains: normalizeDomains(input?.blockedDomains),
+    includeDomains: normalizeDomains(input?.includeDomains),
+    language: optionalText(input?.language),
+    localization: localizationValue(input?.searchLocalization),
+    maxSummaryChars: clampInt(input?.maxSummaryChars, DEFAULT_MAX_SUMMARY_CHARS, 0, 1e6),
+    timeoutMs: clampInt(input?.searchTimeoutMs, DEFAULT_TIMEOUT_MS, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS),
+    enabled: input?.searchEnabled !== false
+  };
+}
+function resolveFetchOptions(input) {
+  return {
+    maxChars: clampInt(input?.fetchMaxChars, DEFAULT_FETCH_MAX_CHARS, 0, 1e6),
+    allowedDomains: normalizeDomains(input?.fetchAllowedDomains),
+    blockedDomains: normalizeDomains(input?.fetchBlockedDomains),
+    timeoutMs: clampInt(input?.fetchTimeoutMs, DEFAULT_TIMEOUT_MS, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS),
+    blockPrivateHosts: input?.fetchBlockPrivateHosts !== false,
+    enabled: input?.fetchEnabled !== false
+  };
+}
+function resolveAuthOptions(input) {
+  const value = input?.apiKeySource;
+  return {
+    source: value === "opencode" || value === "env" ? value : DEFAULT_API_KEY_SOURCE
+  };
+}
+function resolveRetryOptions(input) {
+  return {
+    maxRetries: clampInt(input?.maxRetries, DEFAULT_MAX_RETRIES, 0, MAX_RETRIES),
+    baseDelayMs: clampInt(input?.retryBaseDelayMs, DEFAULT_RETRY_BASE_DELAY_MS, 0, MAX_RETRY_DELAY_MS)
+  };
+}
+function optionalText(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : undefined;
+}
+function localizationValue(value) {
+  const text = optionalText(value);
+  return text !== undefined && !text.includes("%") && isIP2(text) !== 0 ? text : undefined;
+}
+function finiteNumber(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function clampInt(value, fallback, min, max) {
+  const number = typeof value === "number" && Number.isFinite(value) ? Math.trunc(value) : fallback;
+  return Math.min(max, Math.max(min, number));
+}
+var init_options = __esm(() => {
+  init_constants();
+  init_domains();
+});
+
+// src/core/config-summary.ts
+function configDeviations(resolved) {
+  const defaults = configSummaryValues(resolvePluginOptions({}));
+  const effective = configSummaryValues(resolved);
+  const tokens = [];
+  for (const key of Object.keys(effective)) {
+    const value = effective[key];
+    if (sameValue(value, defaults[key]))
+      continue;
+    tokens.push(`${key}=${formatConfigValue(value, "length")}`);
+  }
+  return tokens.join(" ");
+}
+function configSummaryValues(options) {
+  const values = {};
+  for (const entry of VOCABULARY)
+    values[entry.key] = entry.read(options);
+  return values;
+}
+function formatConfigValue(value, arrays) {
+  if (Array.isArray(value)) {
+    if (arrays === "length")
+      return String(value.length);
+    return value.length > 0 ? value.join(", ") : "[]";
+  }
+  return value === undefined ? "unset" : String(value);
+}
+function sameValue(value, fallback) {
+  if (Array.isArray(value) && Array.isArray(fallback)) {
+    return value.length === fallback.length && value.every((entry, index) => entry === fallback[index]);
+  }
+  return value === fallback;
+}
+var VOCABULARY, CONFIG_KEYS;
+var init_config_summary = __esm(() => {
+  init_options();
+  VOCABULARY = [
+    { key: "count", read: (o) => o.search.count },
+    { key: "maxResults", read: (o) => o.search.maxResults },
+    { key: "minRerank", read: (o) => o.search.minRerank },
+    { key: "minAuthority", read: (o) => o.search.minAuthority },
+    { key: "allowUnknownAuthority", read: (o) => o.search.allowUnknownAuthority },
+    { key: "blockedDomains", read: (o) => o.search.blockedDomains },
+    { key: "includeDomains", read: (o) => o.search.includeDomains },
+    { key: "language", read: (o) => o.search.language },
+    { key: "searchLocalization", read: (o) => o.search.localization },
+    { key: "maxSummaryChars", read: (o) => o.search.maxSummaryChars },
+    { key: "searchTimeoutMs", read: (o) => o.search.timeoutMs },
+    { key: "fetchMaxChars", read: (o) => o.fetch.maxChars },
+    { key: "fetchAllowedDomains", read: (o) => o.fetch.allowedDomains },
+    { key: "fetchBlockedDomains", read: (o) => o.fetch.blockedDomains },
+    { key: "fetchTimeoutMs", read: (o) => o.fetch.timeoutMs },
+    { key: "fetchBlockPrivateHosts", read: (o) => o.fetch.blockPrivateHosts },
+    { key: "maxRetries", read: (o) => o.retry.maxRetries },
+    { key: "retryBaseDelayMs", read: (o) => o.retry.baseDelayMs }
+  ];
+  CONFIG_KEYS = VOCABULARY.map((entry) => entry.key);
+});
+
+// src/core/object.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/config-file.ts
 import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+function joinFor(platform, ...parts) {
+  return (platform === "win32" ? win32 : posix).join(...parts);
+}
+function resolveContext(context = {}) {
+  return {
+    env: context.env ?? process.env,
+    home: context.home ?? homedir(),
+    platform: context.platform ?? process.platform
+  };
+}
+function userConfigHome(context) {
+  const { env, home, platform } = resolveContext(context);
+  const xdg = env.XDG_CONFIG_HOME;
+  if (xdg)
+    return xdg;
+  if (platform === "win32")
+    return env.APPDATA || joinFor(platform, home, "AppData", "Roaming");
+  return joinFor(platform, home, ".config");
+}
+function userConfigDir(context) {
+  const { env, home, platform } = resolveContext(context);
+  return joinFor(platform, userConfigHome({ env, home, platform }), SHARED_CONFIG_DIR);
+}
+function configFilePath(context) {
+  const { env, home, platform } = resolveContext(context);
+  return joinFor(platform, userConfigDir({ env, home, platform }), SHARED_CONFIG_FILE);
+}
+function readFileOptionsReport(file) {
+  let text;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { options: {}, warnings: [], exists: false };
+    }
+    return { options: {}, warnings: [`cannot read ${file} — file ignored`], exists: true };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { options: {}, warnings: [`${file} is not valid JSON — file ignored`], exists: true };
+  }
+  if (!isPlainObject(parsed)) {
+    return { options: {}, warnings: [`${file} is not a JSON object — file ignored`], exists: true };
+  }
+  const options = {};
+  const warnings = [];
+  for (const [key, value] of Object.entries(parsed)) {
+    if (SHARED_KEY_SET.has(key))
+      options[key] = value;
+    else if (HOST_INTEGRATION_KEYS.has(key))
+      warnings.push(`"${key}" is a host-integration key (host config only) — ignored`);
+    else
+      warnings.push(`unknown key "${key}" — ignored`);
+  }
+  return { options, warnings, exists: true };
+}
+function readFileOptions(file) {
+  const report = readFileOptionsReport(file);
+  for (const warning of report.warnings)
+    warn(warning);
+  return report.options;
+}
+function sharedFileOptions(context = {}) {
+  return readFileOptions(configFilePath(context));
+}
+function warn(line) {
+  console.error(`deepseek-web-retrieval config: ${line}`);
+}
+var SHARED_CONFIG_DIR = "deepseek-web-retrieval", SHARED_CONFIG_FILE = "config.json", SHARED_CONFIG_KEYS, SHARED_KEY_SET, HOST_INTEGRATION_KEYS;
+var init_config_file = __esm(() => {
+  init_config_summary();
+  SHARED_CONFIG_KEYS = CONFIG_KEYS;
+  SHARED_KEY_SET = new Set(SHARED_CONFIG_KEYS);
+  HOST_INTEGRATION_KEYS = new Set([
+    "searchEnabled",
+    "fetchEnabled",
+    "setDefaultWebsearch",
+    "fetchOverrideWebfetch",
+    "fetchRegisterTool",
+    "apiKeySource"
+  ]);
+});
+
+// src/version.ts
+import { readFileSync as readFileSync2 } from "node:fs";
 var TOOL_VERSION;
 var init_version = __esm(() => {
-  TOOL_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+  TOOL_VERSION = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8")).version;
 });
 
 // src/installer/persistence.ts
@@ -31,7 +371,7 @@ import {
   lstatSync,
   mkdirSync,
   openSync,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   realpathSync,
   renameSync,
   rmSync,
@@ -65,7 +405,7 @@ function atomicWrite(file, text, mode) {
   try {
     fd = openSync(temporary, "wx", 384);
     writeFileSync(fd, text);
-    if (readFileSync2(temporary, "utf8") !== text)
+    if (readFileSync3(temporary, "utf8") !== text)
       throw new Error(`Incomplete write to ${file}`);
     fchmodSync(fd, mode ?? existingMode ?? 438 & ~process.umask());
     fsyncSync(fd);
@@ -1447,11 +1787,6 @@ var init_jsonc = __esm(() => {
   init_main();
 });
 
-// src/core/object.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 // src/installer/formats/value.ts
 function deepEqual(a, b) {
   if (a === b)
@@ -1505,11 +1840,11 @@ function appendEntries(existing, entries, path) {
 var init_value = () => {};
 
 // src/installer/formats/json.ts
-import { existsSync, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync, readFileSync as readFileSync4 } from "node:fs";
 function loadJson(file) {
   if (!existsSync(file))
     return { exists: false, text: "", value: {}, lossy: false };
-  const text = readFileSync3(file, "utf8");
+  const text = readFileSync4(file, "utf8");
   try {
     return { exists: true, text, value: parseJsonc(text), lossy: false };
   } catch (error) {
@@ -1641,7 +1976,7 @@ var init_json = __esm(() => {
 });
 
 // src/installer/formats/rules.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "node:fs";
 function rulesMarkers(host) {
   return {
     begin: `<!-- deepseek-web-retrieval:${host}:rules:begin -->`,
@@ -1696,7 +2031,7 @@ function rulesCodec(host) {
     format: "rules",
     load: (file) => {
       const exists = existsSync2(file);
-      const text = exists ? readFileSync4(file, "utf8") : "";
+      const text = exists ? readFileSync5(file, "utf8") : "";
       try {
         blockRange(host, text);
         return { exists, text, value: {}, lossy: false };
@@ -2904,11 +3239,11 @@ var init_dist = __esm(() => {
 });
 
 // src/installer/formats/toml.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
 function loadToml(file) {
   if (!existsSync3(file))
     return { exists: false, text: "", value: {}, lossy: false };
-  const text = readFileSync5(file, "utf8");
+  const text = readFileSync6(file, "utf8");
   try {
     return { exists: true, text, value: parse3(text), lossy: hasTomlComment(text) };
   } catch (error) {
@@ -3081,7 +3416,7 @@ var init_formats = __esm(() => {
 });
 
 // src/installer/revert.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, rmdirSync, unlinkSync } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync7, rmdirSync, unlinkSync } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 function pruneEmptyDir(dir) {
   try {
@@ -3095,7 +3430,7 @@ function revertRecordedFile(file, host, opts) {
     return lines;
   }
   const codec = codecFor(file.format, host);
-  const text = readFileSync6(file.file, "utf8");
+  const text = readFileSync7(file.file, "utf8");
   if (file.format === "rules") {
     const edit2 = { file: file.file, format: "rules", block: file.blockApplied ?? "" };
     if (!codec.verify(text, edit2)) {
@@ -3144,16 +3479,29 @@ function stateDir(roots, scope) {
 var init_paths = () => {};
 
 // src/installer/state.ts
-import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync, readFileSync as readFileSync7, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync, readFileSync as readFileSync8, rmSync as rmSync2 } from "node:fs";
 import { isAbsolute, join as join3 } from "node:path";
 import { z } from "zod/v4";
 function statePathFor(input) {
   return join3(stateDir(input, input.scope), `install.${input.host}.json`);
 }
+function platformOf(roots) {
+  return roots.platform ?? process.platform;
+}
+function legacyGlobalStateDir(roots) {
+  return join3(roots.home, ".config", "deepseek-web-retrieval");
+}
+function recordReadPath(input, platform = platformOf(input)) {
+  const canonical = statePathFor(input);
+  if (platform !== "win32" || input.scope !== "global" || existsSync5(canonical))
+    return canonical;
+  const legacy = join3(legacyGlobalStateDir(input), `install.${input.host}.json`);
+  return existsSync5(legacy) ? legacy : canonical;
+}
 function readRecordFile(file, host, scope) {
   let text;
   try {
-    text = readFileSync7(file, "utf8");
+    text = readFileSync8(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       try {
@@ -3181,7 +3529,7 @@ function readRecordFile(file, host, scope) {
   return result.data;
 }
 function readRecord(input) {
-  return readRecordFile(statePathFor(input), input.host, input.scope);
+  return readRecordFile(recordReadPath(input), input.host, input.scope);
 }
 function claimedByOtherScope(input, files) {
   const other = input.scope === "global" ? "project" : "global";
@@ -3210,32 +3558,49 @@ function appendedByPrevious(record, path) {
   return entries;
 }
 function deleteRecord(input) {
-  const file = statePathFor(input);
+  const file = recordReadPath(input);
   if (existsSync5(file))
     rmSync2(file);
 }
-function listRecords(roots) {
+function readRecordsFromDir(dir, scope) {
   const records = [];
-  for (const scope of ["global", "project"]) {
-    const dir = stateDir(roots, scope);
-    let names;
-    try {
-      names = readdirSync(dir);
-    } catch (error) {
-      if (error.code === "ENOENT")
-        continue;
-      throw new InstallRecordError(dir, "unreadable", error.code ?? "list failed");
-    }
-    for (const name of names) {
-      if (!name.startsWith("install.") || !name.endsWith(".json"))
-        continue;
-      const record = readRecordFile(join3(dir, name), name.slice("install.".length, -".json".length), scope);
-      if (record !== undefined)
-        records.push(record);
-    }
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return records;
+    throw new InstallRecordError(dir, "unreadable", error.code ?? "list failed");
+  }
+  for (const name of names) {
+    if (!name.startsWith("install.") || !name.endsWith(".json"))
+      continue;
+    const record = readRecordFile(join3(dir, name), name.slice("install.".length, -".json".length), scope);
+    if (record !== undefined)
+      records.push(record);
   }
   return records;
 }
+function hasRecordFiles(dir) {
+  try {
+    return readdirSync(dir).some((name) => name.startsWith("install.") && name.endsWith(".json"));
+  } catch {
+    return false;
+  }
+}
+function readingLegacyGlobalRecords(roots) {
+  if (platformOf(roots) !== "win32")
+    return false;
+  if (hasRecordFiles(stateDir(roots, "global")))
+    return false;
+  return hasRecordFiles(legacyGlobalStateDir(roots));
+}
+function listRecords(roots) {
+  const global = readRecordsFromDir(stateDir(roots, "global"), "global");
+  const project = readRecordsFromDir(stateDir(roots, "project"), "project");
+  const legacy = readingLegacyGlobalRecords(roots) ? readRecordsFromDir(legacyGlobalStateDir(roots), "global") : [];
+  return [...global, ...legacy, ...project];
+}
 var keyPath, tier, operation, recordSchema, InstallRecordError;
 var init_state = __esm(() => {
   init_paths();
@@ -3254,7 +3619,7 @@ var init_state = __esm(() => {
   recordSchema = z.object({
     version: z.literal(1),
     installerVersion: z.string().optional(),
-    host: z.enum(["opencode", "pi", "codex"]),
+    host: z.enum(["opencode", "pi", "codex", "claude-code"]),
     scope: z.enum(["global", "project"]),
     tiers: z.object({ search: tier, fetch: tier }),
     createdAt: z.string().refine((value) => Number.isFinite(Date.parse(value))),
@@ -3281,8 +3646,25 @@ var init_state = __esm(() => {
 });
 
 // src/installer/ownership.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync8, realpathSync as realpathSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync9, realpathSync as realpathSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname3, join as join4, resolve } from "node:path";
+function hasVersionSuffix(ref) {
+  const at = ref.lastIndexOf("@");
+  return at > 0 && /^[0-9]/.test(ref.slice(at + 1));
+}
+function stripVersionSuffix(ref) {
+  const at = ref.lastIndexOf("@");
+  return hasVersionSuffix(ref) ? ref.slice(0, at) : ref;
+}
+function samePackageName(a, b) {
+  return stripVersionSuffix(a) === stripVersionSuffix(b);
+}
+function lineageMatcher(refs) {
+  return (candidate) => refs.some((ref) => samePackageName(ref, candidate));
+}
+function pinPackageRef(ref, version) {
+  return hasVersionSuffix(ref) ? ref : `${ref}@${version}`;
+}
 function canonicalPath(file) {
   const absolute = resolve(file);
   if (existsSync6(absolute))
@@ -3304,7 +3686,7 @@ function readOwner(file) {
   if (!existsSync6(file))
     return;
   try {
-    const value = JSON.parse(readFileSync8(file, "utf8"));
+    const value = JSON.parse(readFileSync9(file, "utf8"));
     if (isPlainObject(value) && typeof value.recordPath === "string" && typeof value.cwd === "string" && (value.scope === "project" || value.scope === "global")) {
       return { recordPath: value.recordPath, cwd: value.cwd, scope: value.scope };
     }
@@ -3315,6 +3697,8 @@ function assertOwner(input, claim) {
   const owner = readOwner(claim);
   if (owner === undefined || owner.recordPath === ownerOf(input).recordPath)
     return;
+  if (owner.recordPath === canonicalPath(recordReadPath(input)))
+    return;
   throw new Error(`A ${input.host} install is already recorded at the ${owner.scope} scope (${owner.recordPath}) and claims the same config file. ` + `Uninstall it first: deepseek-web-retrieval uninstall --host ${input.host} --scope ${owner.scope} --cwd ${JSON.stringify(owner.cwd)}. ` + "Two install records must not edit one file.");
 }
 function assertFileOwnership(input, files) {
@@ -3418,7 +3802,7 @@ var init_operation_lock = __esm(() => {
 });
 
 // src/installer/apply.ts
-import { existsSync as existsSync7, readFileSync as readFileSync9, rmSync as rmSync5 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10, rmSync as rmSync5 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 function applyPlan(plan, input) {
   if (plan.errors.length > 0) {
@@ -3516,7 +3900,7 @@ function snapshotTouchedFiles(plan) {
   const snapshots = new Map;
   const touched = [...plan.edits.map((edit2) => edit2.file), ...(plan.reverts ?? []).map((revert) => revert.file)];
   for (const file of new Set(touched)) {
-    snapshots.set(file, existsSync7(file) ? { exists: true, text: readFileSync9(file, "utf8") } : { exists: false, text: "" });
+    snapshots.set(file, existsSync7(file) ? { exists: true, text: readFileSync10(file, "utf8") } : { exists: false, text: "" });
   }
   return snapshots;
 }
@@ -3526,10 +3910,10 @@ function rollbackApply(input, previous, snapshots) {
   for (const [file, snapshot] of [...snapshots.entries()].reverse()) {
     try {
       if (snapshot.exists) {
-        if (existsSync7(file) && readFileSync9(file, "utf8") === snapshot.text)
+        if (existsSync7(file) && readFileSync10(file, "utf8") === snapshot.text)
           continue;
         writeConfig(file, snapshot.text);
-        if (readFileSync9(file, "utf8") !== snapshot.text)
+        if (readFileSync10(file, "utf8") !== snapshot.text)
           throw new Error("restored contents differ from the snapshot");
       } else {
         if (!existsSync7(file))
@@ -3622,7 +4006,7 @@ function verifyEdits(edits, host) {
       continue;
     }
     const codec = codecFor(edit2.format, host);
-    const text = readFileSync9(edit2.file, "utf8");
+    const text = readFileSync10(edit2.file, "utf8");
     if (edit2.format === "rules") {
       const good = codec.verify(text, edit2);
       lines.push(`${good ? "pass" : "FAIL"} ${edit2.file}: rules block ${good ? "present" : "missing"}`);
@@ -3661,1956 +4045,2177 @@ var init_apply = __esm(() => {
   };
 });
 
-// src/core/constants.ts
-var SEARCH_ENDPOINT = "https://api.deepseek.com/v1/tools/search", FETCH_ENDPOINT = "https://api.deepseek.com/v1/tools/fetch", DEFAULT_SEARCH_COUNT = 10, DEFAULT_MAX_RESULTS = 10, DEFAULT_MIN_RERANK = 0, DEFAULT_MIN_AUTHORITY = 0, DEFAULT_MAX_SUMMARY_CHARS = 1200, DEFAULT_FETCH_MAX_CHARS = 16000, DEFAULT_TIMEOUT_MS = 30000, MIN_TIMEOUT_MS = 1000, MAX_TIMEOUT_MS = 120000, MAX_QUERY_CHARS = 128, MAX_URL_CHARS = 8192, MAX_ERROR_BODY_CHARS = 2000, MAX_RESPONSE_BYTES, FETCH_TRUNCATION_MARKER = `
-
-[content truncated]`, DEFAULT_API_KEY_SOURCE = "auto", DEFAULT_MAX_RETRIES = 0, MAX_RETRIES = 5, DEFAULT_RETRY_BASE_DELAY_MS = 250, MAX_RETRY_DELAY_MS = 1e4, API_KEY_ENV = "DEEPSEEK_API_KEY", ENABLE_SEARCH_ENV = "DEEPSEEK_ENABLE_SEARCH", ENABLE_FETCH_ENV = "DEEPSEEK_ENABLE_FETCH";
-var init_constants = __esm(() => {
-  MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+// src/core/auth.ts
+function apiKeyFromEnv(env = process.env) {
+  const key = env[API_KEY_ENV]?.trim();
+  return key ? key : undefined;
+}
+var MISSING_API_KEY_MESSAGE;
+var init_auth = __esm(() => {
+  init_constants();
+  MISSING_API_KEY_MESSAGE = `DeepSeek API key not found. Set ${API_KEY_ENV} in the MCP server's env configuration.`;
 });
 
-// src/installer/detect.ts
-import { existsSync as existsSync8, readFileSync as readFileSync10 } from "node:fs";
-function replacingExistingEntryNote(path) {
-  return `An existing ${path} entry is being replaced; its previous form is recorded for uninstall.`;
+// src/core/format.ts
+function truncate(value, maxChars) {
+  if (maxChars <= 0)
+    return "";
+  if (value.length <= maxChars)
+    return value;
+  return Array.from(value).slice(0, maxChars).join("");
 }
-function othersStayRegisteredNote(others) {
-  return `Other MCP servers stay registered (${others.join(", ")}); routing to DeepSeek is not exclusive while they offer web tools.`;
+function formatFetchedContent(title, content, maxChars) {
+  const document = withTitle(title, content);
+  const length = Array.from(document).length;
+  if (maxChars <= 0)
+    return { content: "", truncated: length > 0 };
+  if (length <= maxChars)
+    return { content: document, truncated: false };
+  const markerLength = Array.from(FETCH_TRUNCATION_MARKER).length;
+  if (maxChars <= markerLength) {
+    return { content: truncate(document, maxChars), truncated: true };
+  }
+  return {
+    content: `${truncate(document, maxChars - markerLength)}${FETCH_TRUNCATION_MARKER}`,
+    truncated: true
+  };
 }
-function looksWebCapable(name, entry) {
-  if (WEB_TOOL_HINT.test(name))
-    return true;
-  if (!isPlainObject(entry))
-    return false;
-  const command = typeof entry.command === "string" ? entry.command : "";
-  const url = typeof entry.url === "string" ? entry.url : "";
-  const args = Array.isArray(entry.args) ? entry.args.filter((arg) => typeof arg === "string").join(" ") : "";
-  return WEB_TOOL_HINT.test(`${command} ${args} ${url}`);
+function withTitle(title, content) {
+  const heading = title.trim();
+  if (!heading)
+    return content;
+  const body = content.trimStart();
+  const lines = body.split(/\r?\n/);
+  const firstHeading = lines[0]?.match(/^\\?#\s+(.+?)\s*$/)?.[1];
+  if (firstHeading && normalizeHeading(firstHeading) === normalizeHeading(heading)) {
+    lines[0] = `# ${heading}`;
+    return lines.join(`
+`);
+  }
+  return `# ${heading}
+
+${content}`;
 }
-function looksLikeOwnPackage(source) {
-  return /(^|[/:@])deepseek-web-retrieval($|[@/]|-\d)/.test(source);
+function normalizeHeading(value) {
+  return value.trim().replace(/\s+/g, " ").replace(/\s+#+\s*$/, "").toLowerCase();
 }
-function findCompetitorSteering(host, file) {
-  if (!existsSync8(file))
-    return [];
-  let text;
-  try {
-    text = readFileSync10(file, "utf8");
-  } catch {
-    return [];
-  }
-  return removeBlock(host, text).split(`
-`).map((line) => line.trim()).filter((line) => line.length > 0 && STEERING_HINT.test(line) && !line.includes("deepseek")).slice(0, 2);
+function redactSecrets(value) {
+  return value.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "sk-***").replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, "Bearer ***");
 }
-function competitorSteeringNote(file, lines) {
-  const quoted = lines.map((line) => `"${line}"`).join(", ");
-  return `Existing rules in ${file} steer toward other web tools (${quoted}); the plan surfaces this conflict — it does not resolve it.`;
+function formatApiError(operation2, status, body) {
+  const detail = redactSecrets(body.trim());
+  const detailChars = Array.from(detail);
+  const text = detail ? detailChars.length > MAX_ERROR_BODY_CHARS ? `${detailChars.slice(0, MAX_ERROR_BODY_CHARS).join("")}…` : detail : "empty response body";
+  const hint = status === 401 ? "invalid API key" : status === 402 ? "insufficient balance" : status === 403 ? "permission denied" : status === 429 ? "rate limited" : undefined;
+  const label = hint ? `${operation2} failed (HTTP ${status}, ${hint})` : `${operation2} failed (HTTP ${status})`;
+  return `${label}: ${text}`;
 }
-function splitCompetitors(servers) {
-  const competitors = [];
-  const bystanders = [];
-  for (const [name, entry] of Object.entries(servers)) {
-    if (name === "deepseek")
-      continue;
-    (looksWebCapable(name, entry) ? competitors : bystanders).push(name);
-  }
-  return { competitors, bystanders };
+function formatTimeoutError(operation2, timeoutMs) {
+  return `${operation2} timed out after ${timeoutMs} ms`;
 }
-var BOTH_CAPABILITIES_OFF = "Both capabilities are off; nothing would be installed.", FORCED_COST_NOTE, WEB_TOOL_HINT, STEERING_HINT;
-var init_detect = __esm(() => {
-  init_rules();
-  init_value();
-  FORCED_COST_NOTE = "Forced routing is deterministic, and Search and Fetch are billed per successful request — " + `see the README's "Privacy and cost" section before applying.`;
-  WEB_TOOL_HINT = /(web[_ -]?(search|fetch)|search|fetch|browse|scrape|crawl|tavily|brave|exa|perplexity|firecrawl|jina|serp|duckduckgo|reader)/i;
-  STEERING_HINT = /(web[_ ]?(search|fetch)|websearch|webfetch|tavily|exa|brave|perplexity|firecrawl|jina|serp|duckduckgo|google|bing)/i;
-});
+function formatSearchResults(results) {
+  if (results.length === 0)
+    return "No results found.";
+  return results.map((result, index) => {
+    const title = result.title?.trim() || result.url;
+    const marker = formatQualityMarker(result);
+    const lines = [`${index + 1}. [${escapeBrackets(title)}](${result.url})${marker ? ` ${marker}` : ""}`];
+    if (result.content) {
+      lines.push(`   ${result.content.replaceAll(`
+`, " ")}`);
+    }
+    if (result.published !== undefined) {
+      lines.push(`   Published: ${formatPublished(result.published)}`);
+    }
+    return lines.join(`
+`);
+  }).join(`
 
-// src/installer/rulesContent.ts
-function rulesLines(ids, search, fetch) {
-  const lines = ["DeepSeek retrieval guidance:"];
-  if (search === "preferred") {
-    lines.push(`- Use ${ids.search} when the task needs fresh external information: current docs, version numbers,`, "  changelogs, or anything you cannot know from the repository alone. Do not search for facts already", "  present locally.");
-  }
-  if (fetch === "preferred") {
-    lines.push(`- Use ${ids.fetch} to read a specific public web page as Markdown when its content is needed.`);
-  }
-  lines.push("- Never send localhost or private-network URLs to the DeepSeek tools; use local tools for those (the", "  server blocks private hosts by default).", "- DeepSeek requests are billed per successful call; retrieve only what the task needs.");
-  return lines;
+`);
 }
-var MCP_TOOL_IDS, RAW_MCP_TOOL_IDS;
-var init_rulesContent = __esm(() => {
-  MCP_TOOL_IDS = {
-    search: "mcp__deepseek__deepseek_web_search",
-    fetch: "mcp__deepseek__deepseek_fetch"
+function formatQualityMarker(result) {
+  const parts = [];
+  if (result.rerankScore !== undefined)
+    parts.push(`rerank ${result.rerankScore}`);
+  if (result.authority !== undefined && result.authority >= 0)
+    parts.push(`authority ${result.authority}`);
+  if (result.siteName)
+    parts.push(result.siteName);
+  return parts.length > 0 ? `[${parts.join(" · ")}]` : "";
+}
+function toStructuredResult(result) {
+  return {
+    url: result.url,
+    ...result.title ? { title: result.title } : {},
+    ...result.content ? { content: result.content } : {},
+    ...result.published !== undefined ? { published: result.published } : {},
+    ...result.rerankScore !== undefined ? { rerankScore: result.rerankScore } : {},
+    ...result.authority !== undefined ? { authority: result.authority } : {},
+    ...result.siteName ? { siteName: result.siteName } : {}
   };
-  RAW_MCP_TOOL_IDS = { search: "deepseek_web_search", fetch: "deepseek_fetch" };
+}
+function escapeBrackets(value) {
+  return value.replaceAll("[", "\\[").replaceAll("]", "\\]");
+}
+function formatPublished(epochMs) {
+  return new Date(epochMs).toISOString().slice(0, 10);
+}
+var init_format2 = __esm(() => {
+  init_constants();
 });
 
-// src/installer/hosts/shared.ts
-function planHeader(input, paths, loaded, dialect) {
-  const notes = [];
-  const errors = [];
-  if (loaded.parseError) {
-    errors.push({ message: `${paths.config} exists but does not parse as ${dialect}: ${loaded.parseError}` });
-    return { notes, errors, abort: true };
+// src/core/url.ts
+function parseFetchUrl(value) {
+  const input = value.trim();
+  if (!input)
+    throw new Error("URL must not be empty");
+  if (input.length > MAX_URL_CHARS) {
+    throw new Error(`URL must be ${MAX_URL_CHARS} characters or fewer`);
   }
-  if (input.search === "off" && input.fetch === "off") {
-    errors.push({ message: BOTH_CAPABILITIES_OFF });
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    throw new Error("URL must be an absolute http:// or https:// URL");
   }
-  const rules = codecFor("rules", input.host).load(paths.rules);
-  if (rules.parseError) {
-    errors.push({ message: `${paths.rules}: ${rules.parseError}` });
-    return { notes, errors, abort: true };
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("URL must use http:// or https://");
   }
-  const steering = findCompetitorSteering(input.host, paths.rules);
-  if (steering.length > 0)
-    notes.push(competitorSteeringNote(paths.rules, steering));
-  return { notes, errors, abort: false };
+  if (!url.hostname || !normalizeHostname(url.hostname)) {
+    throw new Error("URL must include a host");
+  }
+  if (url.username || url.password) {
+    throw new Error("URL must not contain credentials");
+  }
+  return url;
 }
-var init_shared = __esm(() => {
-  init_detect();
-  init_formats();
-});
-
-// src/installer/hosts/codex.ts
-import { spawnSync } from "node:child_process";
-function probeCodexVersion(err) {
-  const result = spawnSync("codex", ["--version"], { timeout: 5000, encoding: "utf8", env: process.env });
-  const version = result.status === 0 ? parseCodexVersion(result.stdout ?? "") : undefined;
-  if (version === undefined) {
-    err("note: codex was not found on PATH or printed no version; the version-drift check was skipped");
+function normalizeResultUrl(value) {
+  if (typeof value !== "string")
+    return;
+  const input = value.trim();
+  if (!input || input.length > MAX_URL_CHARS)
+    return;
+  try {
+    const url = new URL(input);
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+      return;
+    if (!url.hostname || url.username || url.password)
+      return;
+    return url.href;
+  } catch {
+    return;
   }
-  return version;
 }
-function parseCodexVersion(output) {
-  return /\bcodex(?:-cli)?\s+(\d+\.\d+\.\d+)\b/.exec(output)?.[1];
+var init_url = __esm(() => {
+  init_constants();
+  init_domains();
+});
+
+// src/core/search.ts
+function buildQuery(query, options) {
+  const parts = [query.trim()];
+  for (const domain of normalizeDomains(options.blockedDomains))
+    parts.push(`-site:${domain}`);
+  const include = normalizeDomains(options.includeDomains);
+  if (include.length)
+    parts.push(include.map((domain) => `site:${domain}`).join(" OR "));
+  const language = options.language?.trim().replace(/^lang:/i, "");
+  if (language)
+    parts.push(`lang:${language}`);
+  return parts.filter((part) => part.length > 0).join(" ");
 }
-function codexPaths(input) {
-  return {
-    config: join2(input.home, ".codex/config.toml"),
-    rules: input.scope === "global" ? join2(input.home, ".codex/AGENTS.md") : join2(input.cwd, "AGENTS.md")
-  };
+function parsePublished(value) {
+  if (typeof value !== "string" || !value.trim())
+    return;
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? timestamp : undefined;
 }
-function planCodex(input, _previous) {
-  const paths = codexPaths(input);
-  const loaded = codecFor("toml", input.host).load(paths.config);
-  const tiers = { search: input.search, fetch: input.fetch };
-  const header = planHeader(input, paths, loaded, "TOML");
-  if (header.abort) {
-    return { host: "codex", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
-  }
-  const notes = [...header.notes];
-  const errors = [...header.errors];
-  const edits = [];
-  if (input.hostVersion !== undefined && input.hostVersion !== CODEX_TESTED_VERSION) {
-    notes.push(`Codex ${input.hostVersion} is installed, but this installer's Codex facts are verified against ` + `${CODEX_TESTED_VERSION} (the docs/hosts.jsonc lock). Kill-switch and trap behavior may have drifted ` + "between the two — re-verify the tiers if routing misbehaves.");
-  }
-  const tools = loaded.value.tools;
-  if (isPlainObject(tools) && "web_search" in tools) {
-    errors.push({
-      message: `${paths.config} sets [tools] web_search, which is a silent no-op at Codex 0.163.0 (only the top-level ` + "web_search key controls the tool). Remove it first so the config cannot mislead."
-    });
-  }
-  const servers = loaded.value.mcp_servers;
-  if (isPlainObject(servers)) {
-    if ("deepseek" in servers)
-      notes.push(replacingExistingEntryNote("mcp_servers.deepseek"));
-    const { competitors, bystanders } = splitCompetitors(servers);
-    if ((input.search === "forced" || input.fetch === "forced") && competitors.length > 0) {
-      errors.push({
-        message: `Forced cannot deliver exclusive routing: [mcp_servers.${competitors.join("], [mcp_servers.")}] look(s) web-capable, ` + "and Codex offers no per-server kill switch. Remove the server(s), disable their tools by hand via their " + "disabled_tools key, or choose a lower tier."
-      });
+function processResults(raw, options) {
+  const results = [];
+  const seen = new Set;
+  for (const item of raw) {
+    if (results.length >= options.maxResults)
+      break;
+    if (!item || typeof item !== "object")
+      continue;
+    const url = normalizeResultUrl(item.url);
+    if (!url || seen.has(url))
+      continue;
+    const rerank = item.rerank_score;
+    if (typeof rerank === "number" && Number.isFinite(rerank)) {
+      if (rerank < options.minRerank)
+        continue;
+    } else if (options.minRerank > 0) {
+      continue;
     }
-    const stayRegistered = input.search === "forced" || input.fetch === "forced" ? bystanders : [...competitors, ...bystanders];
-    if (stayRegistered.length > 0)
-      notes.push(othersStayRegisteredNote(stayRegistered));
-  }
-  const existingEntry = isPlainObject(servers) ? servers.deepseek : undefined;
-  const rawToolIds = Object.values(RAW_MCP_TOOL_IDS);
-  const keptDisabled = isPlainObject(existingEntry) && Array.isArray(existingEntry.disabled_tools) ? existingEntry.disabled_tools.filter((name) => typeof name === "string" && !rawToolIds.includes(name)) : [];
-  const offDisabled = [
-    ...input.search === "off" ? [RAW_MCP_TOOL_IDS.search] : [],
-    ...input.fetch === "off" ? [RAW_MCP_TOOL_IDS.fetch] : []
-  ];
-  const entry = {
-    command: "npx",
-    args: ["-y", input.packageRef],
-    ...keptDisabled.length > 0 || offDisabled.length > 0 ? { disabled_tools: [...keptDisabled, ...offDisabled] } : {},
-    env_vars: [API_KEY_ENV]
-  };
-  const ops = [{ op: "set", path: ["mcp_servers", "deepseek"], value: entry, previous: existingEntry }];
-  if (offDisabled.length > 0) {
-    notes.push(`Off capabilities use Codex's own disabled_tools key (${offDisabled.join(", ")}): the tools are removed from ` + "the model's context while the server keeps running and stays re-enableable by deleting the entries.");
-  }
-  if (input.search === "forced") {
-    const previous = typeof loaded.value.web_search === "string" ? loaded.value.web_search : undefined;
-    ops.push({ op: "set", path: ["web_search"], value: "disabled", previous });
-    notes.push(previous === undefined ? 'web_search is being set to "disabled" (no previous value existed; the default is "cached").' : `web_search is being set to "disabled"; the previous value "${previous}" is snapshotted for uninstall.`);
-  }
-  edits.push({ file: paths.config, format: "toml", shared: true, ops });
-  notes.push(`Codex stdio children do not inherit the parent environment, so the entry forwards ${API_KEY_ENV} explicitly ` + "via env_vars; the key must be set in the shell that launches Codex.");
-  if (input.scope === "project") {
-    notes.push("Codex config lives in ~/.codex/config.toml only (user level), so the server registration and kill switch are " + "written there even for a project-scope install; the rules file stays project-local.");
-  }
-  if (loaded.lossy) {
-    notes.push(`${paths.config} contains comments; the TOML rewrite will drop them.`);
-  }
-  if (input.search === "forced" || input.fetch === "forced") {
-    notes.push(`Forced search is exclusion: the built-in web_search tool is disabled ("disabled" mode). ${FORCED_COST_NOTE}`);
-  }
-  if (input.search === "optional" || input.fetch === "optional") {
-    notes.push('Note: Codex ships a built-in web_search tool (default "cached" mode, an OpenAI index) that stays available ' + "alongside the DeepSeek tools under the optional tier.");
-  }
-  if (input.search === "preferred" || input.fetch === "preferred") {
-    edits.push({
-      file: paths.rules,
-      format: "rules",
-      block: buildRulesBlock(input.host, rulesLines(MCP_TOOL_IDS, input.search, input.fetch))
+    const authority = item.authority;
+    const knownAuthority = typeof authority === "number" && Number.isFinite(authority) && authority >= 0;
+    if (knownAuthority) {
+      if (authority < options.minAuthority)
+        continue;
+    } else if (!options.allowUnknownAuthority) {
+      continue;
+    }
+    seen.add(url);
+    const content = truncate(optionalText2(item.summary) ?? optionalText2(item.snippet) ?? "", options.maxSummaryChars);
+    const published = parsePublished(item.date);
+    const title = optionalText2(item.title);
+    const rerankScore = typeof rerank === "number" && Number.isFinite(rerank) ? rerank : undefined;
+    const authorityScore = typeof authority === "number" && Number.isFinite(authority) ? authority : undefined;
+    const siteName = optionalText2(item.site_name);
+    results.push({
+      url,
+      ...title ? { title } : {},
+      ...content ? { content } : {},
+      ...published !== undefined ? { published } : {},
+      ...rerankScore !== undefined ? { rerankScore } : {},
+      ...authorityScore !== undefined ? { authority: authorityScore } : {},
+      ...siteName ? { siteName } : {}
     });
-    notes.push(input.scope === "global" ? `Rules block upserted in ${paths.rules}; Codex reads ~/.codex/AGENTS.md plus every AGENTS.md from the project root to the cwd.` : `Rules block upserted in ${paths.rules}; Codex reads every AGENTS.md from the project root to the cwd.`);
   }
-  return { host: "codex", scope: input.scope, tiers, edits, notes, errors };
+  return results;
 }
-var CODEX_TESTED_VERSION = "0.163.0";
-var init_codex = __esm(() => {
-  init_constants();
-  init_detect();
-  init_formats();
-  init_rules();
-  init_value();
-  init_paths();
-  init_rulesContent();
-  init_shared();
+function optionalText2(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : undefined;
+}
+var init_search = __esm(() => {
+  init_domains();
+  init_format2();
+  init_url();
 });
 
-// src/installer/hosts/opencode.ts
-function opencodePaths(input) {
-  return input.scope === "global" ? {
-    config: join2(configHome(input), "opencode/opencode.jsonc"),
-    rules: join2(configHome(input), "opencode/AGENTS.md")
-  } : { config: join2(input.cwd, "opencode.jsonc"), rules: join2(input.cwd, "AGENTS.md") };
-}
-function planOpenCode(input, previous) {
-  const paths = opencodePaths(input);
-  const loaded = codecFor("json", input.host).load(paths.config);
-  const tiers = { search: input.search, fetch: input.fetch };
-  const header = planHeader(input, paths, loaded, "JSONC");
-  if (header.abort) {
-    return { host: "opencode", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
-  }
-  const notes = [...header.notes];
-  const errors = [...header.errors];
-  const edits = [];
-  if (input.search === "preferred") {
-    errors.push({
-      message: "OpenCode search has no preferred tier: the websearch provider is host-level config, so the model never " + "chooses between engines. Use --search optional (provider registered, built-in stays default), " + "--search forced (replace the engine), or --search off."
-    });
-  }
-  const plugins = Array.isArray(loaded.value.plugins) ? loaded.value.plugins : [];
-  const trackedPackages = new Set(appendedByPrevious(previous, ["plugins"]).filter((entry) => isPlainObject(entry) && typeof entry.package === "string").map((entry) => entry.package));
-  const pluginPackages = plugins.filter((entry) => isPlainObject(entry) && typeof entry.package === "string");
-  const excused = previous === undefined ? new Set : new Set([...trackedPackages, input.packageRef]);
-  const foreignOwn = pluginPackages.filter((entry) => looksLikeOwnPackage(entry.package) && !excused.has(entry.package));
-  if (foreignOwn.length > 0) {
-    errors.push({
-      message: `${paths.config} already has a plugins entry referencing deepseek-web-retrieval that this installer did not ` + "write. Remove it (or run uninstall if it came from a previous init), then retry."
-    });
-  }
-  if (previous !== undefined && pluginPackages.some((entry) => excused.has(entry.package))) {
-    notes.push("A previous init wrote the plugins entry; re-applying keeps it the only entry (a changed package ref or tier " + "options replace it, an unchanged one is a no-op) and the original snapshots carry over.");
-  }
-  if (errors.length > 0) {
-    return { host: "opencode", scope: input.scope, tiers, edits, notes, errors };
-  }
-  const options = {};
-  if (input.search === "forced")
-    options.setDefaultWebsearch = true;
-  if (input.search === "off")
-    options.searchEnabled = false;
-  if (input.fetch === "forced")
-    options.fetchOverrideWebfetch = true;
-  if (input.fetch === "off")
-    options.fetchEnabled = false;
-  const ops = [
-    {
-      op: "append-array",
-      path: ["plugins"],
-      entries: [{ package: input.packageRef, options }],
-      existingCount: plugins.length
+// src/core/transport.ts
+async function postJson(endpoint, body, operation2, opts) {
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const attempts = opts.retry.maxRetries + 1;
+  let lastError;
+  for (let attempt = 0;attempt < attempts; attempt++) {
+    try {
+      return await requestOnce(endpoint, body, operation2, opts, fetchImpl);
+    } catch (error) {
+      lastError = error;
+      if (!(error instanceof DeepSeekApiError) || !error.retryable || attempt === attempts - 1) {
+        throw error;
+      }
+      await sleep(retryDelay(error.retryAfterMs, opts.retry.baseDelayMs, attempt), opts.signal);
     }
-  ];
-  const permissions = [];
-  if (input.search !== "off")
-    permissions.push({ action: "websearch", resource: "*", effect: "allow" });
-  if (input.fetch !== "off")
-    permissions.push({ action: "deepseek_fetch", resource: "*", effect: "allow" });
-  if (input.fetch === "forced")
-    permissions.push({ action: "webfetch", resource: "*", effect: "allow" });
-  const existingPermissions = Array.isArray(loaded.value.permissions) ? loaded.value.permissions.length : 0;
-  if (permissions.length > 0) {
-    ops.push({ op: "append-array", path: ["permissions"], entries: permissions, existingCount: existingPermissions });
-  }
-  if (input.search === "forced") {
-    const currentProvider = isPlainObject(loaded.value.websearch) ? loaded.value.websearch.provider : undefined;
-    ops.push({ op: "set", path: ["websearch", "provider"], value: "deepseek", previous: currentProvider });
-    notes.push(currentProvider === undefined ? "websearch.provider is being set to deepseek (no previous value existed)." : `websearch.provider is being set to deepseek; the previous value "${String(currentProvider)}" is snapshotted for uninstall.`);
-  }
-  edits.push({ file: paths.config, format: "json", ops });
-  notes.push("The plugin entry uses the object form so options are honored; auto-discovered plugins cannot receive options.");
-  if (input.search === "optional") {
-    notes.push("Search tier optional: the deepseek provider is registered but the built-in provider stays the default engine; " + "set websearch.provider to deepseek (or rerun with --search forced) to route search through DeepSeek.");
-  }
-  if (input.search === "forced" || input.fetch === "forced") {
-    notes.push(`Forced tier replaces built-in routing. ${FORCED_COST_NOTE}`);
-  }
-  if (input.fetch === "preferred") {
-    edits.push({
-      file: paths.rules,
-      format: "rules",
-      block: buildRulesBlock(input.host, rulesLines(OPENCODE_TOOL_IDS, input.search, input.fetch))
-    });
-    notes.push(`Rules block upserted in ${paths.rules}; OpenCode loads AGENTS.md only (no CLAUDE.md fallback in v2).`);
   }
-  return { host: "opencode", scope: input.scope, tiers, edits, notes, errors };
-}
-var OPENCODE_TOOL_IDS;
-var init_opencode = __esm(() => {
-  init_detect();
-  init_formats();
-  init_rules();
-  init_value();
-  init_paths();
-  init_rulesContent();
-  init_state();
-  init_shared();
-  OPENCODE_TOOL_IDS = { search: "websearch (provider deepseek)", fetch: "deepseek_fetch" };
-});
-
-// src/pi/settings.ts
-var SETTINGS_NAMESPACE = "deepseekWebRetrieval";
-var init_settings = () => {};
-
-// src/installer/hosts/pi.ts
-function piPaths(input) {
-  const mcp = input.scope === "global" ? join2(input.home, ".pi/agent/mcp.json") : join2(input.cwd, ".pi/mcp.json");
-  const settings = input.scope === "global" ? join2(input.home, ".pi/agent/settings.json") : join2(input.cwd, ".pi/settings.json");
-  const rules = input.scope === "global" ? join2(input.home, ".pi/agent/AGENTS.md") : join2(input.cwd, "AGENTS.md");
-  return { config: input.path === "mcp" ? mcp : settings, rules };
-}
-function piSourceRef(packageRef) {
-  return packageRef.startsWith("npm:") ? packageRef : `npm:${packageRef}`;
-}
-function planPi(input, previous) {
-  return input.path === "mcp" ? planPiMcp(input) : planPiExtension(input, previous);
+  throw lastError;
 }
-function planPiExtension(input, previous) {
-  const paths = piPaths(input);
-  const loaded = codecFor("json", input.host).load(paths.config);
-  const tiers = { search: input.search, fetch: input.fetch };
-  const header = planHeader(input, paths, loaded, "JSON");
-  if (header.abort) {
-    return { host: "pi", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
-  }
-  const notes = [...header.notes];
-  const errors = [...header.errors];
-  const edits = [];
-  const packages = Array.isArray(loaded.value.packages) ? loaded.value.packages : [];
-  const source = piSourceRef(input.packageRef);
-  const trackedSources = appendedByPrevious(previous, ["packages"]).filter((entry) => typeof entry === "string");
-  const excused = previous === undefined ? new Set : new Set([...trackedSources, source]);
-  const sources = packages.filter((entry) => typeof entry === "string");
-  const foreignOwn = sources.filter((entry) => looksLikeOwnPackage(entry) && !excused.has(entry));
-  if (foreignOwn.length > 0) {
-    errors.push({
-      message: `${paths.config} already lists ${foreignOwn.join(", ")} — this package (or a fork of it) that this installer did not ` + "write. Remove it (pi remove <source>, or uninstall if it came from a previous init), then retry."
-    });
-  }
-  if (previous !== undefined && sources.some((entry) => excused.has(entry))) {
-    notes.push("A previous init wrote the packages entry; re-applying reuses it (an unchanged source deduplicates, a changed " + "--package ref replaces the old source) and the original snapshots carry over.");
-  }
-  const forced = input.search === "forced" || input.fetch === "forced";
-  if (forced) {
-    const ownSources = new Set([...trackedSources, source]);
-    const unexcludable = [...collectSources(loaded.value.packages), ...collectSources(loaded.value.extensions)].filter((entry) => !ownSources.has(entry) && looksWebCapable(entry, undefined));
-    if (unexcludable.length > 0) {
-      errors.push({
-        message: `Forced cannot deliver exclusive routing: settings sources ${unexcludable.join(", ")} look web-capable, ` + "and Pi offers no per-package kill switch. Remove them (pi remove <source>) or choose a lower tier."
+async function requestOnce(endpoint, body, operation2, opts, fetchImpl) {
+  return fetchWithTimeout(endpoint, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${opts.auth.apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  }, opts.signal, opts.timeoutMs, operation2, fetchImpl, async (response) => {
+    if (!response.ok) {
+      const text2 = await readBoundedText(response, MAX_ERROR_BODY_CHARS);
+      throw new DeepSeekApiError({
+        operation: operation2,
+        status: response.status,
+        body: text2,
+        retryAfterMs: parseRetryAfter(response.headers.get("retry-after"))
       });
     }
+    const text = await readResponseText(response, MAX_RESPONSE_BYTES, operation2);
+    if (!text.trim())
+      throw new Error(`${operation2} returned an empty response body`);
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new Error(`${operation2} returned invalid JSON: ${truncate(redactSecrets(text), 500)}`);
+    }
+  });
+}
+async function fetchWithTimeout(endpoint, init, signal, timeoutMs, operation2, fetchImpl, handleResponse) {
+  const controller = new AbortController;
+  let timedOut = false;
+  const forwardAbort = () => controller.abort(signal.reason);
+  if (signal.aborted)
+    forwardAbort();
+  else
+    signal.addEventListener("abort", forwardAbort, { once: true });
+  const timer = signal.aborted ? undefined : setTimeout(() => {
+    timedOut = true;
+    controller.abort(new Error("timeout"));
+  }, timeoutMs);
+  try {
+    const response = await fetchImpl(endpoint, { ...init, signal: controller.signal });
+    return await handleResponse(response);
+  } catch (error) {
+    if (timedOut)
+      throw new Error(formatTimeoutError(operation2, timeoutMs));
+    if (signal.aborted)
+      throw abortReason(signal, operation2);
+    throw error;
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+    signal.removeEventListener("abort", forwardAbort);
   }
-  if (errors.length > 0) {
-    return { host: "pi", scope: input.scope, tiers, edits: [], notes, errors };
-  }
-  const ops = [
-    { op: "append-array", path: ["packages"], entries: [source], existingCount: packages.length }
-  ];
-  const namespace = isPlainObject(loaded.value[SETTINGS_NAMESPACE]) ? loaded.value[SETTINGS_NAMESPACE] : {};
-  if (input.search === "off") {
-    ops.push({
-      op: "set",
-      path: [SETTINGS_NAMESPACE, "enableSearch"],
-      value: false,
-      previous: typeof namespace.enableSearch === "boolean" ? namespace.enableSearch : undefined
-    });
-  }
-  if (input.fetch === "off") {
-    ops.push({
-      op: "set",
-      path: [SETTINGS_NAMESPACE, "enableFetch"],
-      value: false,
-      previous: typeof namespace.enableFetch === "boolean" ? namespace.enableFetch : undefined
-    });
-  }
-  edits.push({ file: paths.config, format: "json", ops });
-  notes.push("Pi resolves the packages source at session start; the first launch after apply fetches the package from npm " + "(pi update --extensions refreshes it later).");
-  notes.push(`The extension reads ${API_KEY_ENV} from the Pi process environment; no env forwarding is needed. ` + "Set it in the shell that launches Pi.");
-  if (input.search === "off" || input.fetch === "off") {
-    notes.push(`Off capability switches are written into the "${SETTINGS_NAMESPACE}" settings namespace; the extension ` + "reads them at load (they outrank the DEEPSEEK_ENABLE_* environment variables).");
-  }
-  notes.push(`Extension tools are declared to the model with exposure "direct" by Pi's own default; no exposure key is needed.`);
-  if (forced) {
-    edits.push(...planMcpCompetitorDisables(input, notes, errors));
-  }
-  if (errors.length > 0) {
-    return { host: "pi", scope: input.scope, tiers, edits: [], notes, errors };
-  }
-  if (input.search === "preferred" || input.fetch === "preferred") {
-    edits.push({
-      file: paths.rules,
-      format: "rules",
-      block: buildRulesBlock(input.host, rulesLines(RAW_MCP_TOOL_IDS, input.search, input.fetch))
-    });
-    notes.push(`Rules block upserted in ${paths.rules}; Pi loads AGENTS.md context files from the working directory and its parents.`);
-  }
-  if (forced) {
-    notes.push("Forced tier: Pi 1.3.0 ships no built-in web tool, so the registered tools are the only web path (de-facto). " + FORCED_COST_NOTE);
+}
+function parseRetryAfter(value) {
+  if (!value)
+    return;
+  const trimmed = value.trim();
+  if (!trimmed)
+    return;
+  if (/^\d+$/.test(trimmed)) {
+    return Math.min(MAX_RETRY_DELAY_MS, Number(trimmed) * 1000);
   }
-  return { host: "pi", scope: input.scope, tiers, edits, notes, errors };
+  const timestamp = Date.parse(trimmed);
+  if (!Number.isFinite(timestamp))
+    return;
+  return Math.min(MAX_RETRY_DELAY_MS, Math.max(0, timestamp - Date.now()));
 }
-function planCompetitorDisables(servers, competitors, notes, errors) {
-  const ops = [];
-  const excluded = [];
-  const unexcludable = [];
-  for (const name of competitors) {
-    const current = servers[name];
-    if (!isPlainObject(current)) {
-      unexcludable.push(name);
-      continue;
+function retryDelay(retryAfterMs, baseDelayMs, attempt) {
+  if (retryAfterMs !== undefined)
+    return retryAfterMs;
+  return Math.min(MAX_RETRY_DELAY_MS, baseDelayMs * 2 ** attempt);
+}
+function sleep(ms, signal) {
+  if (ms <= 0)
+    return Promise.resolve();
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve2();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortReason(signal, "DeepSeek request"));
+    };
+    if (signal.aborted) {
+      clearTimeout(timer);
+      reject(abortReason(signal, "DeepSeek request"));
+      return;
     }
-    const previous = typeof current.enabled === "boolean" ? current.enabled : undefined;
-    ops.push({ op: "set", path: ["mcpServers", name, "enabled"], value: false, previous });
-    excluded.push(name);
-  }
-  if (excluded.length > 0) {
-    notes.push(`Forced tier: web-capable MCP servers are disabled so DeepSeek routing is exclusive (${excluded.join(", ")}; ` + "prior enabled values are snapshotted for uninstall).");
-  }
-  if (unexcludable.length > 0) {
-    errors.push({
-      message: `Forced cannot deliver exclusive routing: mcpServers entries ${unexcludable.join(", ")} look web-capable ` + "but are not objects, so the plan cannot set their enabled key. Fix or remove them, or choose a lower tier."
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function abortReason(signal, operation2) {
+  return signal.reason instanceof Error ? signal.reason : new Error(`${operation2} request aborted`);
+}
+async function readBoundedText(response, maxChars) {
+  if (!response.body)
+    return truncate(await response.text(), maxChars + 1);
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  const limit = maxChars + 1;
+  let text = "";
+  let chars = 0;
+  try {
+    while (chars < limit) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      const chunk = decoder.decode(value, { stream: true });
+      text += chunk;
+      chars += Array.from(chunk).length;
+    }
+    text += decoder.decode();
+  } finally {
+    await reader.cancel().catch(() => {
+      return;
     });
+    reader.releaseLock();
   }
-  return ops;
+  return truncate(text, limit);
 }
-function planMcpCompetitorDisables(input, notes, errors) {
-  const mcpFile = input.scope === "global" ? join2(input.home, ".pi/agent/mcp.json") : join2(input.cwd, ".pi/mcp.json");
-  const loaded = codecFor("json", input.host).load(mcpFile);
-  if (loaded.parseError) {
-    errors.push({ message: `${mcpFile} does not parse: ${loaded.parseError}` });
-    return [];
+async function readResponseText(response, maxBytes, operation2) {
+  if (!response.body) {
+    const text2 = await response.text();
+    if (new TextEncoder().encode(text2).byteLength > maxBytes) {
+      throw new Error(`${operation2} response exceeded ${maxBytes} bytes`);
+    }
+    return text2;
   }
-  const servers = isPlainObject(loaded.value.mcpServers) ? loaded.value.mcpServers : undefined;
-  if (!isPlainObject(servers))
-    return [];
-  const { competitors, bystanders } = splitCompetitors(servers);
-  const edits = [];
-  if (competitors.length > 0) {
-    const ops = planCompetitorDisables(servers, competitors, notes, errors);
-    if (ops.length > 0)
-      edits.push({ file: mcpFile, format: "json", ops });
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  let text = "";
+  let bytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      bytes += value.byteLength;
+      if (bytes > maxBytes) {
+        throw new Error(`${operation2} response exceeded ${maxBytes} bytes`);
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+  } finally {
+    await reader.cancel().catch(() => {
+      return;
+    });
+    reader.releaseLock();
   }
-  if (bystanders.length > 0)
-    notes.push(othersStayRegisteredNote(bystanders));
-  return edits;
+  return text;
 }
-function planPiMcp(input) {
-  const paths = piPaths(input);
-  const loaded = codecFor("json", input.host).load(paths.config);
-  const tiers = { search: input.search, fetch: input.fetch };
-  const header = planHeader(input, paths, loaded, "JSON");
-  if (header.abort) {
-    return { host: "pi", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
-  }
-  const notes = [...header.notes];
-  const errors = [...header.errors];
-  const edits = [];
-  const env = { [API_KEY_ENV]: `\${${API_KEY_ENV}}` };
-  if (input.search === "off")
-    env[ENABLE_SEARCH_ENV] = "false";
-  if (input.fetch === "off")
-    env[ENABLE_FETCH_ENV] = "false";
-  const entry = {
-    command: "npx",
-    args: ["-y", input.packageRef],
-    env,
-    exposure: "direct",
-    enabled: true
-  };
-  const servers = loaded.value.mcpServers;
-  const existingEntry = isPlainObject(servers) ? servers.deepseek : undefined;
-  const ops = [{ op: "set", path: ["mcpServers", "deepseek"], value: entry, previous: existingEntry }];
-  edits.push({ file: paths.config, format: "json", ops });
-  if (isPlainObject(servers)) {
-    if (servers.deepseek !== undefined)
-      notes.push(replacingExistingEntryNote("mcpServers.deepseek"));
-    const { competitors, bystanders } = splitCompetitors(servers);
-    const forced = input.search === "forced" || input.fetch === "forced";
-    if (forced) {
-      ops.push(...planCompetitorDisables(servers, competitors, notes, errors));
+var DeepSeekApiError;
+var init_transport = __esm(() => {
+  init_constants();
+  init_format2();
+  DeepSeekApiError = class DeepSeekApiError extends Error {
+    operation;
+    status;
+    body;
+    retryable;
+    retryAfterMs;
+    constructor(input) {
+      const body = redactSecrets(input.body);
+      super(formatApiError(input.operation, input.status, body));
+      this.name = "DeepSeekApiError";
+      this.operation = input.operation;
+      this.status = input.status;
+      this.body = body;
+      this.retryable = input.status === 408 || input.status === 425 || input.status === 429 || input.status >= 500 && input.status <= 599;
+      this.retryAfterMs = input.retryAfterMs;
     }
-    const stayRegistered = forced ? bystanders : [...competitors, ...bystanders];
-    if (stayRegistered.length > 0)
-      notes.push(othersStayRegisteredNote(stayRegistered));
+  };
+});
+
+// src/core/client.ts
+function effectiveTimeout(configuredMs, perCallMs) {
+  return perCallMs === undefined ? configuredMs : Math.min(configuredMs, perCallMs);
+}
+function oriQuestionValue(oriQuestion) {
+  const trimmed = oriQuestion?.trim();
+  return trimmed ? truncate(trimmed, MAX_ORI_QUESTION_CHARS) : undefined;
+}
+async function searchWeb(query, options, request) {
+  const trimmed = query.trim();
+  if (!trimmed)
+    throw new Error("DeepSeek search query must not be empty");
+  if (Array.from(trimmed).length > MAX_QUERY_CHARS) {
+    throw new Error(`DeepSeek search query must be ${MAX_QUERY_CHARS} characters or fewer`);
   }
-  notes.push('"exposure": "direct" is required: Pi 1.3.0 defaults MCP tools to codemode, which hides them from the model.');
-  notes.push(`\`${API_KEY_ENV}\` is written as "\${${API_KEY_ENV}}" so the key expands from the shell that launches Pi and stays out of the file.`);
-  if (input.search === "preferred" || input.fetch === "preferred") {
-    edits.push({
-      file: paths.rules,
-      format: "rules",
-      block: buildRulesBlock(input.host, rulesLines(MCP_TOOL_IDS, input.search, input.fetch))
-    });
-    notes.push(`Rules block upserted in ${paths.rules}; Pi loads AGENTS.md context files from the working directory and its parents.`);
+  const builtQuery = buildQuery(trimmed, options);
+  const builtQueryLength = Array.from(builtQuery).length;
+  if (builtQueryLength > MAX_QUERY_CHARS) {
+    throw new Error(`DeepSeek search query must be ${MAX_QUERY_CHARS} characters or fewer after applying ` + `blockedDomains, includeDomains, and language ` + `(built query is ${builtQueryLength} characters)`);
   }
-  if (input.search === "forced" || input.fetch === "forced") {
-    notes.push("Forced tier: Pi 1.3.0 ships no built-in web tool, so the registered tools are the only web path (de-facto). " + FORCED_COST_NOTE);
+  const timeout = effectiveTimeout(options.timeoutMs, request.timeoutMs);
+  const oriQuestion = oriQuestionValue(request.oriQuestion);
+  const payload = await postJson(SEARCH_ENDPOINT, {
+    query: builtQuery,
+    count: options.count,
+    need_content: false,
+    ...oriQuestion === undefined ? {} : { ori_question: oriQuestion },
+    ...options.localization === undefined ? {} : { localization: options.localization }
+  }, "DeepSeek Search", { ...request, timeoutMs: timeout });
+  if (!Array.isArray(payload.results)) {
+    throw new Error("DeepSeek Search returned a response without a results array");
   }
-  return { host: "pi", scope: input.scope, tiers, edits, notes, errors };
-}
-function collectSources(value) {
-  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+  return processResults(payload.results, options);
 }
-var init_pi = __esm(() => {
-  init_constants();
-  init_settings();
-  init_detect();
-  init_formats();
-  init_rules();
-  init_value();
-  init_paths();
-  init_rulesContent();
-  init_state();
-  init_shared();
-});
-
-// src/installer/hosts/index.ts
-function planForHost(host, input) {
-  try {
-    const previous = readRecord(input);
-    const planned = withCrossScopeGuard(HOST_PLANNERS[host](input, previous), input);
-    return {
-      ...withSecretGuard(withOrphanReverts(withLegacySharedConfigGuard(planned, previous), previous)),
-      previousRecord: previous
-    };
-  } catch (error) {
-    if (!(error instanceof InstallRecordError))
-      throw error;
-    return {
-      host,
-      scope: input.scope,
-      tiers: { search: input.search, fetch: input.fetch },
-      edits: [],
-      notes: [],
-      errors: [{ message: error.message }]
-    };
+async function fetchPage(url, options, request) {
+  const target = parseFetchUrl(url.href);
+  assertFetchHostPolicy(target, options);
+  const timeout = effectiveTimeout(options.timeoutMs, request.timeoutMs);
+  const payload = await postJson(FETCH_ENDPOINT, { url: target.href }, "DeepSeek Fetch", {
+    ...request,
+    timeoutMs: timeout
+  });
+  const title = typeof payload.title === "string" ? payload.title.trim() : "";
+  const content = typeof payload.content === "string" ? payload.content : "";
+  if (!content.trim()) {
+    throw new Error("DeepSeek Fetch returned no page content (the page may be empty or unavailable)");
   }
+  return { url: target.href, title, content };
 }
-function withCrossScopeGuard(plan, input) {
-  if (plan.errors.length > 0)
-    return plan;
-  try {
-    assertFileOwnership(input, plan.edits);
-  } catch (error) {
-    return { ...plan, edits: [], reverts: undefined, errors: [{ message: String(error) }] };
-  }
-  const other = input.scope === "global" ? "project" : "global";
-  const overlap = claimedByOtherScope(input, plan.edits.map((edit2) => edit2.file));
-  if (overlap.length === 0)
-    return { ...plan, notes: [...plan.notes, ...fileOwnershipNotes(input, plan.edits)] };
+async function fetchDocument(url, options, request) {
+  if (typeof url !== "string" && !(url instanceof URL))
+    throw new Error('"url" must be a string or URL');
+  const page = await fetchPage(url instanceof URL ? url : parseFetchUrl(url), options, request);
+  const formatted = formatFetchedContent(page.title, page.content, options.maxChars);
   return {
-    ...plan,
-    edits: [],
-    reverts: undefined,
-    errors: [
-      {
-        message: `A ${plan.host} install is already recorded at the ${other} scope and claims the same file(s): ${overlap.join(", ")}. ` + `Uninstall it first (deepseek-web-retrieval uninstall --host ${plan.host} --scope ${other}), ` + `or re-run with --scope ${other} to update it in place — two scopes must not edit one file.`
-      }
-    ]
+    url: page.url,
+    title: page.title,
+    content: formatted.content,
+    truncated: formatted.truncated
   };
 }
-function withLegacySharedConfigGuard(plan, previous) {
-  if (plan.errors.length > 0 || previous !== undefined)
-    return plan;
-  for (const edit2 of plan.edits) {
-    if (edit2.format === "rules" || !edit2.shared)
-      continue;
-    for (const op of edit2.ops) {
-      const old = op.previous;
-      if (op.op !== "set" || !isPlainObject(old) || old.command !== "npx" || !Array.isArray(old.args) || old.args[0] !== "-y" || !Array.isArray(old.env_vars) || !old.env_vars.includes(API_KEY_ENV))
-        continue;
-      return {
-        ...plan,
-        edits: [],
-        reverts: undefined,
-        errors: [
-          {
-            message: `${edit2.file} contains an installer-style registration without an install record for this location. ` + "It may belong to an older install in another project. Re-run init or uninstall from that original project and scope first; " + "if the registration was created manually, remove it before retrying. No existing registration was adopted."
-          }
-        ]
-      };
-    }
-  }
-  return plan;
+function createRetrievalClient(dependencies = {}) {
+  const bind = (request) => ({ ...request, ...dependencies });
+  return {
+    searchWeb: (query, options, request) => searchWeb(query, options, bind(request)),
+    fetchPage: (url, options, request) => fetchPage(url, options, bind(request)),
+    fetchDocument: (url, options, request) => fetchDocument(url, options, bind(request))
+  };
 }
-function withSecretGuard(plan) {
-  for (const edit2 of plan.edits) {
-    if (edit2.format === "rules")
+var retrievalClient;
+var init_client = __esm(() => {
+  init_constants();
+  init_domains();
+  init_format2();
+  init_search();
+  init_transport();
+  init_url();
+  init_transport();
+  retrievalClient = createRetrievalClient();
+});
+
+// src/core/env.ts
+function resolveEnvOptions(env = process.env, fileOptions) {
+  return resolvePluginOptions({ ...fileOptions, ...pluginOptionsFromEnv(env) });
+}
+function envOptionsReport(env = process.env) {
+  const options = {};
+  const warnings = [];
+  putNumber(options, "count", env, warnings);
+  putNumber(options, "maxResults", env, warnings);
+  putNumber(options, "minRerank", env, warnings);
+  putNumber(options, "minAuthority", env, warnings);
+  putFalseOnly(options, "allowUnknownAuthority", env, warnings);
+  putDomains(options, "blockedDomains", env, warnings);
+  putDomains(options, "includeDomains", env, warnings);
+  putText(options, "language", env);
+  putText(options, "searchLocalization", env);
+  putNumber(options, "maxSummaryChars", env, warnings);
+  putNumber(options, "searchTimeoutMs", env, warnings);
+  putNumber(options, "fetchMaxChars", env, warnings);
+  putDomains(options, "fetchAllowedDomains", env, warnings);
+  putDomains(options, "fetchBlockedDomains", env, warnings);
+  putNumber(options, "fetchTimeoutMs", env, warnings);
+  putFalseOnly(options, "fetchBlockPrivateHosts", env, warnings);
+  putFalseOnly(options, "searchEnabled", env, warnings);
+  putFalseOnly(options, "fetchEnabled", env, warnings);
+  putNumber(options, "maxRetries", env, warnings);
+  putNumber(options, "retryBaseDelayMs", env, warnings);
+  const known = new Set(OPTION_ENV_VARS);
+  for (const key of Object.keys(env)) {
+    if (!key.startsWith("DEEPSEEK_") || key === API_KEY_ENV || known.has(key))
       continue;
-    for (const op of edit2.ops) {
-      if (op.op !== "set" || op.previous === undefined)
-        continue;
-      const offender = findSecretLike(op.previous, op.path.join("."));
-      if (offender !== undefined) {
-        return {
-          ...plan,
-          edits: [],
-          reverts: undefined,
-          errors: [
-            {
-              message: `${edit2.file}: the existing value at ${op.path.join(".")} contains a credential-looking key ` + `(${offender}). The installer refuses to snapshot secrets into its state file. Move the key to ` + `environment indirection ("\${${API_KEY_ENV}}" expansion or env_vars) and re-run.`
-            }
-          ]
-        };
-      }
-    }
+    if (!(env[key] ?? "").trim())
+      continue;
+    warnings.push(`unknown DEEPSEEK_* variable ${key} — ignored`);
   }
-  return plan;
+  return { options, warnings };
 }
-function findSecretLike(value, at) {
-  if (typeof value !== "object" || value === null)
+function pluginOptionsFromEnv(env) {
+  return envOptionsReport(env).options;
+}
+function putNumber(target, key, env, warnings) {
+  const value = env[NUMBER_ENV[key]];
+  if (value === undefined)
     return;
-  for (const [key, child] of Object.entries(value)) {
-    const path = `${at}.${key}`;
-    if (/(api[_-]?key|token|secret|password|credential)/i.test(key) && typeof child === "string" && child.length > 0 && !/^\$\{[^}]+\}$/.test(child)) {
-      return path;
-    }
-    const nested = findSecretLike(child, path);
-    if (nested !== undefined)
-      return nested;
-  }
-  return;
+  const trimmed = value.trim();
+  if (!trimmed)
+    return;
+  const parsed = Number(trimmed);
+  if (Number.isFinite(parsed))
+    target[key] = parsed;
+  else
+    warnings.push(`${NUMBER_ENV[key]} is not a number ("${trimmed}") — ignored`);
 }
-function withOrphanReverts(plan, previous) {
-  if (plan.errors.length > 0)
-    return plan;
-  if (previous === undefined)
-    return plan;
-  const reverts = [];
-  for (const file of previous.files) {
-    const edit2 = plan.edits.find((candidate) => candidate.file === file.file);
-    if (edit2 === undefined) {
-      reverts.push(file);
-      continue;
+function putText(target, key, env) {
+  const value = env[TEXT_ENV[key]];
+  if (value === undefined)
+    return;
+  const trimmed = value.trim();
+  if (trimmed)
+    target[key] = trimmed;
+}
+function putFalseOnly(target, key, env, warnings) {
+  const name = FALSE_ONLY_ENV[key];
+  const value = env[name];
+  if (value === undefined || !value.trim())
+    return;
+  if (isFalseValue(value)) {
+    target[key] = false;
+    return;
+  }
+  warnings.push(`${name}="${value.trim()}" changes nothing — only false/0/no/off turns the switch off`);
+}
+function putDomains(target, key, env, warnings) {
+  const name = DOMAINS_ENV[key];
+  const value = env[name];
+  if (value === undefined || !value.trim())
+    return;
+  const domains = value.split(",").map((domain) => domain.trim()).filter((domain) => domain.length > 0);
+  for (const domain of domains) {
+    if (normalizeDomain(domain) === undefined) {
+      warnings.push(`${name} entry "${domain}" is not a domain — ignored`);
     }
-    if (edit2.format === "rules" || file.format === "rules")
-      continue;
-    const orphanOps = file.ops.flatMap((op) => {
-      const claimed = edit2.ops.find((candidate) => candidate.op === op.op && candidate.path.join("\x00") === op.path.join("\x00"));
-      if (op.op !== "append-array" || claimed === undefined || claimed.op !== "append-array") {
-        return claimed === undefined ? [op] : [];
-      }
-      const dropped = (Array.isArray(op.applied) ? op.applied : []).filter((entry) => !(claimed.entries ?? []).some((wanted) => deepEqual(wanted, entry)));
-      return dropped.length > 0 ? [{ ...op, applied: dropped }] : [];
-    });
-    if (orphanOps.length > 0)
-      reverts.push({ ...file, ops: orphanOps });
   }
-  if (reverts.length === 0)
-    return plan;
-  return { ...plan, reverts };
+  if (domains.length > 0)
+    target[key] = domains;
+  else
+    warnings.push(`${name} contains no domains — ignored`);
 }
-var HOST_PLANNERS, HOST_VERSION_PROBES;
-var init_hosts = __esm(() => {
+function isFalseValue(value) {
+  const trimmed = value?.trim().toLowerCase();
+  return trimmed === "false" || trimmed === "0" || trimmed === "no" || trimmed === "off";
+}
+var NUMBER_ENV, TEXT_ENV, DOMAINS_ENV, FALSE_ONLY_ENV, OPTION_ENV_BY_KEY, OPTION_ENV_VARS;
+var init_env = __esm(() => {
   init_constants();
-  init_value();
-  init_ownership();
-  init_state();
-  init_codex();
-  init_opencode();
-  init_pi();
-  HOST_PLANNERS = {
-    opencode: planOpenCode,
-    pi: planPi,
-    codex: planCodex
+  init_domains();
+  init_options();
+  NUMBER_ENV = {
+    count: "DEEPSEEK_SEARCH_COUNT",
+    maxResults: "DEEPSEEK_SEARCH_MAX_RESULTS",
+    minRerank: "DEEPSEEK_SEARCH_MIN_RERANK",
+    minAuthority: "DEEPSEEK_SEARCH_MIN_AUTHORITY",
+    maxSummaryChars: "DEEPSEEK_SEARCH_MAX_SUMMARY_CHARS",
+    searchTimeoutMs: "DEEPSEEK_SEARCH_TIMEOUT_MS",
+    fetchMaxChars: "DEEPSEEK_FETCH_MAX_CHARS",
+    fetchTimeoutMs: "DEEPSEEK_FETCH_TIMEOUT_MS",
+    maxRetries: "DEEPSEEK_MAX_RETRIES",
+    retryBaseDelayMs: "DEEPSEEK_RETRY_BASE_DELAY_MS"
   };
-  HOST_VERSION_PROBES = {
-    codex: probeCodexVersion
+  TEXT_ENV = {
+    language: "DEEPSEEK_SEARCH_LANGUAGE",
+    searchLocalization: SEARCH_LOCALIZATION_ENV
+  };
+  DOMAINS_ENV = {
+    blockedDomains: "DEEPSEEK_SEARCH_BLOCKED_DOMAINS",
+    includeDomains: "DEEPSEEK_SEARCH_INCLUDE_DOMAINS",
+    fetchAllowedDomains: "DEEPSEEK_FETCH_ALLOWED_DOMAINS",
+    fetchBlockedDomains: "DEEPSEEK_FETCH_BLOCKED_DOMAINS"
+  };
+  FALSE_ONLY_ENV = {
+    allowUnknownAuthority: "DEEPSEEK_SEARCH_ALLOW_UNKNOWN_AUTHORITY",
+    fetchBlockPrivateHosts: "DEEPSEEK_FETCH_BLOCK_PRIVATE_HOSTS",
+    searchEnabled: ENABLE_SEARCH_ENV,
+    fetchEnabled: ENABLE_FETCH_ENV
+  };
+  OPTION_ENV_BY_KEY = {
+    ...NUMBER_ENV,
+    ...TEXT_ENV,
+    ...DOMAINS_ENV,
+    ...FALSE_ONLY_ENV
   };
+  OPTION_ENV_VARS = Object.values(OPTION_ENV_BY_KEY);
 });
 
-// src/installer/render.ts
-function renderPlan(plan) {
-  const lines = [];
-  lines.push(`Install plan: ${plan.host} (${plan.scope} scope)`);
-  lines.push(`Tiers: search=${plan.tiers.search}, fetch=${plan.tiers.fetch}`);
-  lines.push("");
-  lines.push("Files:");
-  for (const edit2 of plan.edits) {
-    lines.push(`  ${edit2.file}`);
-    if (edit2.format === "rules") {
-      lines.push("    upsert marked rules block");
-      continue;
-    }
-    for (const op of edit2.ops) {
-      if (op.op === "set") {
-        const was = op.previous === undefined ? "(absent)" : preview(op.previous);
-        lines.push(`    set ${op.path.join(".")} = ${preview(op.value)} (was ${was})`);
-      } else {
-        const count = (op.entries ?? []).length;
-        const kept = op.existingCount !== undefined ? ` (${op.existingCount} existing kept)` : "";
-        lines.push(`    append ${count} entr${count === 1 ? "y" : "ies"} to ${op.path.join(".")}${kept}`);
-        for (const entry of op.entries ?? [])
-          lines.push(`      + ${preview(entry)}`);
-      }
-    }
+// src/installer/config-command.ts
+async function runConfigCommand(query, io, deps = {}) {
+  if (query !== undefined && !query.trim()) {
+    io.err('error: --search requires a query (for example: config --search "deepseek mcp")');
+    return EXIT_USAGE;
   }
-  if (plan.reverts && plan.reverts.length > 0) {
-    lines.push("");
-    lines.push("Reverts (artifacts from the previous init that this plan no longer wants):");
-    for (const revert of plan.reverts) {
-      lines.push(`  ${revert.file}`);
-      if (revert.format === "rules") {
-        lines.push("    remove rules block");
-        continue;
-      }
-      for (const op of revert.ops) {
-        if (op.op === "set") {
-          lines.push(op.previous === undefined ? `    remove ${op.path.join(".")} (was not set before this install)` : `    restore ${op.path.join(".")} = ${preview(op.previous)}`);
-        } else {
-          const count = Array.isArray(op.applied) ? op.applied.length : 0;
-          lines.push(`    remove ${count} appended entr${count === 1 ? "y" : "ies"} from ${op.path.join(".")}`);
-        }
-      }
-    }
+  const env = deps.env ?? process.env;
+  const file = configFilePath({ env });
+  const report = readFileOptionsReport(file);
+  for (const warning of report.warnings)
+    io.err(`warning: ${warning}`);
+  const envReport = envOptionsReport(env);
+  for (const warning of envReport.warnings)
+    io.err(`warning: ${warning}`);
+  const resolved = resolveEnvOptions(env, report.options);
+  if (query === undefined) {
+    printConfigReport(file, report.exists, report.options, envReport.options, resolved, io);
+    return report.warnings.length > 0 || envReport.warnings.length > 0 ? EXIT_CONFIG_PROBLEMS : 0;
   }
-  if (plan.notes.length > 0) {
-    lines.push("");
-    lines.push("Notes:");
-    for (const note of plan.notes)
-      lines.push(`  - ${note}`);
+  const apiKey = apiKeyFromEnv(env);
+  if (!apiKey) {
+    io.err(MISSING_API_KEY_MESSAGE);
+    return EXIT_CONFIG_PROBLEMS;
+  }
+  const client = deps.client ?? createRetrievalClient();
+  const startedAt = Date.now();
+  try {
+    const results = await client.searchWeb(query, resolved.search, {
+      signal: new AbortController().signal,
+      auth: { apiKey },
+      retry: resolved.retry
+    });
+    const elapsedMs = Date.now() - startedAt;
+    io.out(`search "${query.trim()}" — ${results.length} ${results.length === 1 ? "result" : "results"} in ${elapsedMs} ms`);
+    io.out("");
+    for (const line of formatSearchResults(results).split(`
+`))
+      io.out(line);
+    return 0;
+  } catch (error) {
+    io.err(error instanceof Error ? error.message : String(error));
+    return EXIT_CONFIG_PROBLEMS;
   }
-  return lines.join(`
-`);
 }
-function preview(value) {
-  const text = JSON.stringify(value) ?? String(value);
-  return text.length > 100 ? `${text.slice(0, 97)}...` : text;
+function printConfigReport(file, exists, fileOptions, envOptions, resolved, io) {
+  io.out(`Config file: ${file} (${exists ? "exists" : "missing"})`);
+  io.out("");
+  const effective = configSummaryValues(resolved);
+  const fileKeys = new Set(Object.keys(fileOptions));
+  const envKeys = new Set(Object.keys(envOptions));
+  for (const name of Object.keys(effective)) {
+    let source = envKeys.has(name) ? "env" : fileKeys.has(name) ? "file" : "default";
+    if (name === "maxResults" && source === "default" && (envKeys.has("count") || fileKeys.has("count"))) {
+      source = "count";
+    }
+    io.out(`${name} = ${formatConfigValue(effective[name], "join")} (${source})`);
+  }
+  io.out("");
+  io.out(HOST_OVERRIDE_NOTE);
 }
+var EXIT_CONFIG_PROBLEMS = 1, EXIT_USAGE = 2, HOST_OVERRIDE_NOTE = "Host-native layers (OpenCode options, Pi settings) may override file and env values per host.";
+var init_config_command = __esm(() => {
+  init_auth();
+  init_client();
+  init_config_file();
+  init_config_summary();
+  init_env();
+  init_format2();
+});
 
-// src/installer/uninstall.ts
-function uninstall(input) {
-  return withOperationLock([statePathFor(input)], () => {
-    const record = readRecord(input);
-    if (record === undefined) {
-      throw new Error(`No ${input.host} install is recorded for the ${input.scope} scope.`);
-    }
-    return withOperationLock(record.files.map((file) => file.file), () => uninstallLocked(input, record));
-  });
+// src/installer/detect.ts
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
+function replacingExistingEntryNote(path) {
+  return `An existing ${path} entry is being replaced; its previous form is recorded for uninstall.`;
 }
-function uninstallLocked(input, record) {
-  assertFileOwnership(input, record.files);
-  const other = input.scope === "global" ? "project" : "global";
-  const overlap = claimedByOtherScope(input, record.files.map((file) => file.file));
-  if (overlap.length > 0) {
-    throw new Error(`A ${input.host} install is also recorded at the ${other} scope and claims the same file(s): ${overlap.join(", ")}. ` + `Uninstall the ${other}-scope install first so this rollback cannot clobber its entries.`);
+function othersStayRegisteredNote(others) {
+  return `Other MCP servers stay registered (${others.join(", ")}); routing to DeepSeek is not exclusive while they offer web tools.`;
+}
+function looksWebCapable(name, entry) {
+  if (WEB_TOOL_HINT.test(name))
+    return true;
+  if (!isPlainObject(entry))
+    return false;
+  const command = typeof entry.command === "string" ? entry.command : "";
+  const url = typeof entry.url === "string" ? entry.url : "";
+  const args = Array.isArray(entry.args) ? entry.args.filter((arg) => typeof arg === "string").join(" ") : "";
+  return WEB_TOOL_HINT.test(`${command} ${args} ${url}`);
+}
+function looksLikeOwnPackage(source) {
+  return /(^|[/:@])deepseek-web-retrieval($|[@/]|-\d)/.test(source);
+}
+function findCompetitorSteering(host, file) {
+  if (!existsSync8(file))
+    return [];
+  let text;
+  try {
+    text = readFileSync11(file, "utf8");
+  } catch {
+    return [];
   }
-  const lines = [];
-  for (const file of record.files) {
-    if (file.format !== "rules")
+  return removeBlock(host, text).split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0 && STEERING_HINT.test(line) && !line.includes("deepseek")).slice(0, 2);
+}
+function competitorSteeringNote(file, lines) {
+  const quoted = lines.map((line) => `"${line}"`).join(", ");
+  return `Existing rules in ${file} steer toward other web tools (${quoted}); the plan surfaces this conflict — it does not resolve it.`;
+}
+function splitCompetitors(servers) {
+  const competitors = [];
+  const bystanders = [];
+  for (const [name, entry] of Object.entries(servers)) {
+    if (name === "deepseek")
       continue;
-    const loaded = codecFor("rules", record.host).load(file.file);
-    if (loaded.parseError)
-      throw new Error(`${file.file}: ${loaded.parseError}`);
+    (looksWebCapable(name, entry) ? competitors : bystanders).push(name);
   }
-  for (const file of [...record.files].reverse()) {
-    lines.push(...revertRecordedFile(file, record.host, { label: "", whole: true }));
+  return { competitors, bystanders };
+}
+var BOTH_CAPABILITIES_OFF = "Both capabilities are off; nothing would be installed.", FORCED_COST_NOTE, WEB_TOOL_HINT, STEERING_HINT;
+var init_detect = __esm(() => {
+  init_rules();
+  init_value();
+  FORCED_COST_NOTE = "Forced routing is deterministic, and Search and Fetch are billed per successful request — " + `see the README's "Privacy and cost" section before applying.`;
+  WEB_TOOL_HINT = /(web[_ -]?(search|fetch)|search|fetch|browse|scrape|crawl|tavily|brave|exa|perplexity|firecrawl|jina|serp|duckduckgo|reader)/i;
+  STEERING_HINT = /(web[_ ]?(search|fetch)|websearch|webfetch|tavily|exa|brave|perplexity|firecrawl|jina|serp|duckduckgo|google|bing)/i;
+});
+
+// src/installer/rulesContent.ts
+function rulesLines(ids, search, fetch) {
+  const lines = ["DeepSeek retrieval guidance:"];
+  if (search === "preferred") {
+    lines.push(`- Use ${ids.search} when the task needs fresh external information: current docs, version numbers,`, "  changelogs, or anything you cannot know from the repository alone. Do not search for facts already", "  present locally.");
   }
-  deleteRecord(input);
-  releaseFileOwnership(input, record.files);
-  pruneEmptyDir(stateDir(input, input.scope));
-  lines.push(`removed install record (${input.host}, ${input.scope})`);
+  if (fetch === "preferred") {
+    lines.push(`- Use ${ids.fetch} to read a specific public web page as Markdown when its content is needed.`);
+  }
+  lines.push("- Never send localhost or private-network URLs to the DeepSeek tools; use local tools for those (the", "  server blocks private hosts by default).", "- DeepSeek requests are billed per successful call; retrieve only what the task needs.");
   return lines;
 }
-var init_uninstall = __esm(() => {
-  init_formats();
-  init_operation_lock();
-  init_ownership();
-  init_paths();
-  init_revert();
-  init_state();
+var MCP_TOOL_IDS, RAW_MCP_TOOL_IDS;
+var init_rulesContent = __esm(() => {
+  MCP_TOOL_IDS = {
+    search: "mcp__deepseek__deepseek_web_search",
+    fetch: "mcp__deepseek__deepseek_fetch"
+  };
+  RAW_MCP_TOOL_IDS = { search: "deepseek_web_search", fetch: "deepseek_fetch" };
 });
 
-// src/installer/cli.ts
-var exports_cli = {};
-__export(exports_cli, {
-  runInstallerCli: () => runInstallerCli,
-  exitCodeForError: () => exitCodeForError
+// src/installer/hosts/shared.ts
+function planHeader(input, paths, loaded, dialect) {
+  const notes = [];
+  const errors = [];
+  if (loaded.parseError) {
+    errors.push({ message: `${paths.config} exists but does not parse as ${dialect}: ${loaded.parseError}` });
+    return { notes, errors, abort: true };
+  }
+  if (input.search === "off" && input.fetch === "off") {
+    errors.push({ message: BOTH_CAPABILITIES_OFF });
+  }
+  const rules = codecFor("rules", input.host).load(paths.rules);
+  if (rules.parseError) {
+    errors.push({ message: `${paths.rules}: ${rules.parseError}` });
+    return { notes, errors, abort: true };
+  }
+  const steering = findCompetitorSteering(input.host, paths.rules);
+  if (steering.length > 0)
+    notes.push(competitorSteeringNote(paths.rules, steering));
+  return { notes, errors, abort: false };
+}
+var init_shared = __esm(() => {
+  init_detect();
+  init_formats();
 });
-import { homedir } from "node:os";
-import { resolve as resolve2 } from "node:path";
-function parseFlags(args) {
-  const values = new Map;
-  const booleans = new Set;
-  const problems = [];
-  for (let i = 0;i < args.length; i += 1) {
-    const arg = args[i];
-    if (!arg.startsWith("--")) {
-      problems.push(`unexpected argument "${arg}" (flags only)`);
-      continue;
-    }
-    const eq = arg.indexOf("=");
-    const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
-    if (BOOLEAN_FLAGS.has(name)) {
-      if (eq !== -1) {
-        problems.push(`--${name} does not accept a value; use --${name} to enable it or omit it`);
-        continue;
-      }
-      if (booleans.has(name)) {
-        problems.push(`--${name} was given more than once`);
-        continue;
-      }
-      booleans.add(name);
-      continue;
-    }
-    if (!VALUE_FLAGS.has(name)) {
-      problems.push(`unknown flag --${name}`);
-      continue;
-    }
-    if (values.has(name)) {
-      problems.push(`--${name} was given more than once`);
-      continue;
-    }
-    if (eq !== -1) {
-      values.set(name, arg.slice(eq + 1));
-      continue;
-    }
-    const next = args[i + 1];
-    if (next === undefined || next.startsWith("--")) {
-      problems.push(`--${name} requires a value`);
-      continue;
-    }
-    values.set(name, next);
-    i += 1;
+
+// src/installer/hosts/claude-code.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync9 } from "node:fs";
+function valueKind(value) {
+  return Array.isArray(value) ? "an array" : `a ${typeof value}`;
+}
+function probeClaudeCodeVersion(err) {
+  const result = spawnSync("claude", ["--version"], { timeout: 5000, encoding: "utf8", env: process.env, shell: true });
+  const version = result.status === 0 ? parseClaudeCodeVersion(result.stdout ?? "") : undefined;
+  if (version === undefined) {
+    err("note: claude was not found on PATH or printed no version; the version-drift check was skipped");
   }
-  return { values, booleans, problems };
+  return version;
 }
-async function runInstallerCli(argv, io = {}) {
-  const out = io.out ?? ((line) => console.log(line));
-  const err = io.err ?? ((line) => console.error(line));
-  const [command, ...rest] = argv;
-  if (command === "version" || command === "--version") {
-    out(TOOL_VERSION);
-    return 0;
+function parseClaudeCodeVersion(output) {
+  return [...output.matchAll(/\b\d+\.\d+\.\d+\b/g)].map((match) => match[0]).at(-1);
+}
+function claudeCodePaths(input) {
+  return input.scope === "global" ? {
+    config: join2(input.home, ".claude.json"),
+    settings: join2(input.home, ".claude", "settings.json"),
+    rules: join2(input.home, ".claude", "CLAUDE.md")
+  } : {
+    config: join2(input.cwd, ".mcp.json"),
+    settings: join2(input.cwd, ".claude", "settings.json"),
+    rules: join2(input.cwd, "CLAUDE.md")
+  };
+}
+function managedSettingsPath(input) {
+  const platform = input.platform ?? process.platform;
+  if (platform === "darwin")
+    return "/Library/Application Support/ClaudeCode/managed-settings.json";
+  if (platform === "win32")
+    return "C:\\Program Files\\ClaudeCode\\managed-settings.json";
+  return "/etc/claude-code/managed-settings.json";
+}
+function planClaudeCode(input, _previous) {
+  const paths = claudeCodePaths(input);
+  const loaded = codecFor("json", input.host).load(paths.config);
+  const tiers = { search: input.search, fetch: input.fetch };
+  const header = planHeader(input, paths, loaded, "JSON");
+  if (header.abort) {
+    return { host: "claude-code", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
   }
-  if (command === undefined) {
-    err(USAGE);
-    return EXIT_USAGE;
+  const notes = [...header.notes];
+  const errors = [...header.errors];
+  const edits = [];
+  if (input.hostVersion !== undefined && input.hostVersion !== CLAUDE_CODE_TESTED_VERSION) {
+    notes.push(`Claude Code ${input.hostVersion} is installed, but this installer's Claude Code facts are verified against ` + `${CLAUDE_CODE_TESTED_VERSION} (the docs/hosts.jsonc lock). Deny-rule and tool-visibility behavior may have ` + "drifted between the two — re-verify the tiers if routing misbehaves.");
   }
-  if (command === "help" || command === "--help") {
-    out(USAGE);
-    return 0;
+  const managed = managedSettingsPath(input);
+  if (existsSync9(managed)) {
+    notes.push(`${managed} exists: the managed policy layer outranks every settings file this plan writes, so a deny or allow ` + "there overrides these changes. Check with your administrator if routing does not take effect.");
   }
-  const flags = parseFlags(rest);
-  if (flags.problems.length > 0) {
-    for (const problem of flags.problems)
-      err(`error: ${problem}`);
-    err(`
-${USAGE}`);
-    return EXIT_USAGE;
+  const servers = loaded.value.mcpServers;
+  if (servers !== undefined && !isPlainObject(servers)) {
+    errors.push({
+      message: `${paths.config}: mcpServers is ${valueKind(servers)}, not an object; fix it before installing.`
+    });
   }
-  const cwd = resolve2(flags.values.get("cwd") ?? process.cwd());
-  const home = process.env.HOME ?? homedir();
-  const configHome2 = resolveConfigHome(home);
-  if (command === "list") {
-    let records;
+  const existingEntry = isPlainObject(servers) ? servers.deepseek : undefined;
+  const entry = {
+    command: "npx",
+    args: ["-y", input.packageRef],
+    env: { [API_KEY_ENV]: `\${${API_KEY_ENV}}` }
+  };
+  const ops = [{ op: "set", path: ["mcpServers", "deepseek"], value: entry, previous: existingEntry }];
+  edits.push({
+    file: paths.config,
+    format: "json",
+    ...input.scope === "global" ? { shared: true } : {},
+    ops
+  });
+  if (isPlainObject(servers)) {
+    if ("deepseek" in servers)
+      notes.push(replacingExistingEntryNote("mcpServers.deepseek"));
+  }
+  notes.push(`\`${API_KEY_ENV}\` is written as "\${${API_KEY_ENV}}" in the server's env block, so the key expands from the ` + "environment that launches Claude Code and stays out of the file.");
+  if (input.scope === "project") {
+    notes.push("Claude Code asks once per project whether to use servers from .mcp.json; approve the deepseek server when " + "prompted (or via the /mcp menu), or its tools will not load in that project.");
+  } else {
+    notes.push(`User-scope servers live in the mcpServers key of ${paths.config} — Claude Code's own user-level store, where ` + "`claude mcp add --scope user` writes too; every other key in the file is left untouched.");
+  }
+  const forced = input.search === "forced" || input.fetch === "forced";
+  const scanned = {};
+  if (isPlainObject(servers))
+    Object.assign(scanned, servers);
+  const otherFile = input.scope === "project" ? join2(input.home, ".claude.json") : join2(input.cwd, ".mcp.json");
+  if (forced && existsSync9(otherFile)) {
+    let otherLoaded;
     try {
-      records = listRecords({ home, cwd, configHome: configHome2 });
+      otherLoaded = codecFor("json", input.host).load(otherFile);
     } catch (error) {
-      err(error instanceof Error ? error.message : String(error));
-      return 1;
-    }
-    if (records.length === 0) {
-      out("No installs recorded.");
-      return 0;
+      errors.push({
+        message: `${otherFile} exists but cannot be read (${error instanceof Error ? error.message : String(error)}); the forced-tier competitor scan requires it. Fix the file or its permissions, or choose a lower tier.`
+      });
     }
-    for (const record of records) {
-      const by = record.installerVersion ? ` by v${record.installerVersion}` : "";
-      out(`${record.host} (${record.scope}) — search=${record.tiers.search}, fetch=${record.tiers.fetch}, installed ${record.createdAt}${by}`);
-      for (const file of record.files)
-        out(`  ${file.created ? "created" : "modified"} ${file.file}`);
+    if (otherLoaded?.parseError) {
+      errors.push({ message: `${otherFile} exists but does not parse as JSON: ${otherLoaded.parseError}` });
+    } else if (otherLoaded !== undefined && otherLoaded.value.mcpServers !== undefined && !isPlainObject(otherLoaded.value.mcpServers)) {
+      errors.push({
+        message: `${otherFile}: mcpServers is ${valueKind(otherLoaded.value.mcpServers)}, not an object; the forced-tier competitor scan cannot read it. Fix the file or choose a lower tier.`
+      });
+    } else if (otherLoaded !== undefined && isPlainObject(otherLoaded.value.mcpServers)) {
+      const otherServers = otherLoaded.value.mcpServers;
+      Object.assign(scanned, otherServers);
+      if ("deepseek" in otherServers) {
+        notes.push(`A deepseek server is also registered in ${otherFile}; Claude Code resolves the name local first, then ` + "project, then user scope, so consider uninstalling the other scope to keep one registration.");
+      }
     }
-    return 0;
   }
-  if (command === "uninstall") {
-    const required2 = requireInput(flags, cwd, home, configHome2, false);
-    if (!required2.ok)
-      return usageError(required2.problems, err);
-    try {
-      for (const line of uninstall(required2.input))
-        out(line);
-      return 0;
-    } catch (error) {
-      err(error instanceof Error ? error.message : String(error));
-      return 1;
+  const denyEntries = [];
+  const { competitors, bystanders } = splitCompetitors(scanned);
+  if (forced && competitors.length > 0) {
+    const rules = competitors.map((name) => `mcp__${name}`);
+    denyEntries.push(...rules);
+    notes.push(`Forced tier: web-capable MCP servers are denied by server-level rules (${rules.join(", ")}), so DeepSeek ` + "routing is exclusive while the entries stay." + (input.scope === "global" ? " These denies apply in every project on this machine and match by server name, so a same-named server in another project is denied too." : ""));
+  }
+  const stayRegistered = forced ? bystanders : [...competitors, ...bystanders];
+  if (stayRegistered.length > 0)
+    notes.push(othersStayRegisteredNote(stayRegistered));
+  if (input.search === "forced")
+    denyEntries.push(BUILTIN_TOOL_IDS.search);
+  if (input.fetch === "forced")
+    denyEntries.push(BUILTIN_TOOL_IDS.fetch);
+  if (input.search === "off")
+    denyEntries.push(MCP_TOOL_IDS.search);
+  if (input.fetch === "off")
+    denyEntries.push(MCP_TOOL_IDS.fetch);
+  if (denyEntries.length > 0) {
+    const settingsLoaded = codecFor("json", input.host).load(paths.settings);
+    if (settingsLoaded.parseError) {
+      errors.push({ message: `${paths.settings} exists but does not parse as JSON: ${settingsLoaded.parseError}` });
+    } else {
+      const permissions = settingsLoaded.value.permissions;
+      const deny = isPlainObject(permissions) ? permissions.deny : undefined;
+      if (permissions !== undefined && !isPlainObject(permissions)) {
+        errors.push({
+          message: `${paths.settings}: the permissions key is ${valueKind(permissions)}, not an object; fix it before installing.`
+        });
+      } else if (deny !== undefined && !Array.isArray(deny)) {
+        errors.push({
+          message: `${paths.settings}: permissions.deny is ${valueKind(deny)}, not an array; fix it before installing.`
+        });
+      } else {
+        const existingCount = Array.isArray(deny) ? deny.length : 0;
+        const existingDeny = Array.isArray(deny) ? deny.filter((item) => typeof item === "string") : [];
+        const denyOps = [
+          {
+            op: "append-array",
+            path: ["permissions", "deny"],
+            entries: denyEntries,
+            existingCount
+          }
+        ];
+        edits.push({
+          file: paths.settings,
+          format: "json",
+          ...input.scope === "global" ? { shared: true } : {},
+          ops: denyOps
+        });
+        if (existingCount > 0) {
+          notes.push(`permissions.deny already holds ${existingCount} ${existingCount === 1 ? "entry" : "entries"}; ` + "the plan appends only its own and never removes yours.");
+        }
+        const preexisting = denyEntries.filter((name) => existingDeny.includes(name));
+        if (preexisting.length > 0) {
+          notes.push(`${preexisting.join(", ")} ${preexisting.length === 1 ? "is" : "are"} already present in permissions.deny — present entries are not duplicated.`);
+        }
+      }
     }
   }
-  if (command !== "init") {
-    err(`Unknown command "${command}".
-
-${USAGE}`);
-    return EXIT_USAGE;
+  if (errors.length > 0) {
+    return { host: "claude-code", scope: input.scope, tiers, edits: [], notes, errors };
   }
-  const required = requireInput(flags, cwd, home, configHome2, true);
-  if (!required.ok)
-    return usageError(required.problems, err);
-  const { input } = required;
-  const probe = HOST_VERSION_PROBES[input.host];
-  const hostVersion = probe?.(err);
-  const plan = planForHost(input.host, hostVersion === undefined ? input : { ...input, hostVersion });
-  if (plan.errors.length > 0) {
-    for (const error of plan.errors)
-      err(`error: ${error.message}`);
-    err("Nothing was written.");
-    return 1;
+  const forcedIds = [
+    ...input.search === "forced" ? [BUILTIN_TOOL_IDS.search] : [],
+    ...input.fetch === "forced" ? [BUILTIN_TOOL_IDS.fetch] : []
+  ];
+  if (forcedIds.length > 0) {
+    notes.push(`Forced is exclusion: bare deny rules (${forcedIds.join(", ")}) in permissions.deny remove the built-in tool ` + "from the model's context entirely — deny outranks allow at every settings level and cannot be carved out, so " + `the exclusion also applies to every other workflow that relied on the tool ${input.scope === "global" ? "in every project on this machine" : "in this project"}. ` + FORCED_COST_NOTE);
   }
-  out(renderPlan(plan));
-  if (!flags.booleans.has("apply")) {
-    out(`
-Plan only — re-run with --apply to write these changes.`);
-    return 0;
+  const offIds = [
+    ...input.search === "off" ? [MCP_TOOL_IDS.search] : [],
+    ...input.fetch === "off" ? [MCP_TOOL_IDS.fetch] : []
+  ];
+  if (offIds.length > 0) {
+    notes.push(`Off capabilities are written as their full tool ids (${offIds.join(", ")}) in permissions.deny: the tool ` + "leaves the model's context while the server keeps running; delete the entry to re-enable it.");
   }
-  try {
-    const result = applyPlan(plan, input);
-    for (const line of result.lines)
-      out(line);
-    return 0;
-  } catch (error) {
-    err(error instanceof Error ? error.message : String(error));
-    return exitCodeForError(error);
+  if (input.search === "optional" || input.fetch === "optional") {
+    notes.push("Claude Code ships built-in WebSearch and WebFetch tools; under the optional tier they stay available " + "alongside the DeepSeek tools.");
   }
+  if (input.search === "preferred" || input.fetch === "preferred") {
+    if (input.scope === "project" && !existsSync9(paths.rules) && existsSync9(join2(input.cwd, "AGENTS.md"))) {
+      notes.push(`This plan creates ${paths.rules} where none exists, and ${join2(input.cwd, "AGENTS.md")} is present: Claude ` + "Code reads AGENTS.md only when no CLAUDE.md exists above the cwd, so the new CLAUDE.md takes precedence — " + "merge anything you rely on from AGENTS.md before applying.");
+    }
+    edits.push({
+      file: paths.rules,
+      format: "rules",
+      block: buildRulesBlock(input.host, rulesLines(MCP_TOOL_IDS, input.search, input.fetch))
+    });
+    notes.push(input.scope === "global" ? `Rules block upserted in ${paths.rules}; Claude Code loads the user CLAUDE.md plus every CLAUDE.md from the cwd up the directory tree, concatenating the levels.` : `Rules block upserted in ${paths.rules}; Claude Code loads every CLAUDE.md from the cwd up the directory tree, concatenating the levels.`);
+  }
+  return { host: "claude-code", scope: input.scope, tiers, edits, notes, errors };
 }
-function exitCodeForError(error) {
-  return error instanceof ApplyError && error.status === "recovery_required" ? EXIT_RECOVERY : EXIT_FAILURE;
+var CLAUDE_CODE_TESTED_VERSION = "2.1.303", BUILTIN_TOOL_IDS;
+var init_claude_code = __esm(() => {
+  init_constants();
+  init_detect();
+  init_formats();
+  init_rules();
+  init_value();
+  init_paths();
+  init_rulesContent();
+  init_shared();
+  BUILTIN_TOOL_IDS = { search: "WebSearch", fetch: "WebFetch" };
+});
+
+// src/installer/hosts/codex.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+function probeCodexVersion(err) {
+  const result = spawnSync2("codex", ["--version"], { timeout: 5000, encoding: "utf8", env: process.env, shell: true });
+  const version = result.status === 0 ? parseCodexVersion(result.stdout ?? "") : undefined;
+  if (version === undefined) {
+    err("note: codex was not found on PATH or printed no version; the version-drift check was skipped");
+  }
+  return version;
 }
-function usageError(problems, err) {
-  for (const problem of problems)
-    err(`error: ${problem}`);
-  err(`
-${USAGE}`);
-  return EXIT_USAGE;
+function parseCodexVersion(output) {
+  return /\bcodex(?:-cli)?\s+(\d+\.\d+\.\d+)\b/.exec(output)?.[1];
 }
-function resolveConfigHome(home) {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  if (xdg && home === (process.env.HOME ?? ""))
-    return xdg;
-  return;
+function codexPaths(input) {
+  return {
+    config: join2(input.home, ".codex/config.toml"),
+    rules: input.scope === "global" ? join2(input.home, ".codex/AGENTS.md") : join2(input.cwd, "AGENTS.md")
+  };
 }
-function requireInput(flags, cwd, home, configHome2, needsTiers) {
-  const problems = [];
-  const host = flags.values.get("host");
-  const scope = flags.values.get("scope");
-  const search = needsTiers ? flags.values.get("search") ?? "" : "optional";
-  const fetch = needsTiers ? flags.values.get("fetch") ?? "" : "optional";
-  const path = flags.values.get("path");
-  if (host === undefined)
-    problems.push(`--host is required (one of: ${HOSTS.join(", ")})`);
-  else if (!HOSTS.includes(host))
-    problems.push(`invalid --host value "${host}" (one of: ${HOSTS.join(", ")})`);
-  if (scope === undefined)
-    problems.push(`--scope is required (one of: ${SCOPES.join(", ")})`);
-  else if (!SCOPES.includes(scope))
-    problems.push(`invalid --scope value "${scope}" (one of: ${SCOPES.join(", ")})`);
-  if (path !== undefined) {
-    if (host !== "pi") {
-      problems.push(`--path is only supported for host pi (${host ?? "no host"} has a single integration path)`);
-    } else if (!PATH_CHOICES.includes(path)) {
-      problems.push(`invalid --path value "${path}" (one of: ${PATH_CHOICES.join(", ")})`);
-    }
+function planCodex(input, _previous) {
+  const paths = codexPaths(input);
+  const loaded = codecFor("toml", input.host).load(paths.config);
+  const tiers = { search: input.search, fetch: input.fetch };
+  const header = planHeader(input, paths, loaded, "TOML");
+  if (header.abort) {
+    return { host: "codex", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
   }
-  if (needsTiers) {
-    if (!TIERS.includes(search)) {
-      problems.push(flags.values.has("search") ? `invalid --search value "${search}" (one of: ${TIERS.join(", ")})` : `--search is required (one of: ${TIERS.join(", ")})`);
-    }
-    if (!TIERS.includes(fetch)) {
-      problems.push(flags.values.has("fetch") ? `invalid --fetch value "${fetch}" (one of: ${TIERS.join(", ")})` : `--fetch is required (one of: ${TIERS.join(", ")})`);
-    }
+  const notes = [...header.notes];
+  const errors = [...header.errors];
+  const edits = [];
+  if (input.hostVersion !== undefined && input.hostVersion !== CODEX_TESTED_VERSION) {
+    notes.push(`Codex ${input.hostVersion} is installed, but this installer's Codex facts are verified against ` + `${CODEX_TESTED_VERSION} (the docs/hosts.jsonc lock). Kill-switch and trap behavior may have drifted ` + "between the two — re-verify the tiers if routing misbehaves.");
   }
-  if (home === "")
-    problems.push("HOME is not set and the user home cannot be resolved; cannot proceed");
-  if (problems.length > 0)
-    return { ok: false, problems };
-  return {
-    ok: true,
-    input: {
-      host,
-      scope,
-      search,
-      fetch,
-      packageRef: flags.values.get("package") ?? "deepseek-web-retrieval",
-      home,
-      cwd,
-      configHome: configHome2,
-      ...path !== undefined ? { path } : {}
+  const tools = loaded.value.tools;
+  if (isPlainObject(tools) && "web_search" in tools) {
+    errors.push({
+      message: `${paths.config} sets [tools] web_search, which is a silent no-op at Codex 0.163.0 (only the top-level ` + "web_search key controls the tool). Remove it first so the config cannot mislead."
+    });
+  }
+  const servers = loaded.value.mcp_servers;
+  if (isPlainObject(servers)) {
+    if ("deepseek" in servers)
+      notes.push(replacingExistingEntryNote("mcp_servers.deepseek"));
+    const { competitors, bystanders } = splitCompetitors(servers);
+    if ((input.search === "forced" || input.fetch === "forced") && competitors.length > 0) {
+      errors.push({
+        message: `Forced cannot deliver exclusive routing: [mcp_servers.${competitors.join("], [mcp_servers.")}] look(s) web-capable, ` + "and Codex offers no per-server kill switch. Remove the server(s), disable their tools by hand via their " + "disabled_tools key, or choose a lower tier."
+      });
     }
+    const stayRegistered = input.search === "forced" || input.fetch === "forced" ? bystanders : [...competitors, ...bystanders];
+    if (stayRegistered.length > 0)
+      notes.push(othersStayRegisteredNote(stayRegistered));
+  }
+  const existingEntry = isPlainObject(servers) ? servers.deepseek : undefined;
+  const rawToolIds = Object.values(RAW_MCP_TOOL_IDS);
+  const keptDisabled = isPlainObject(existingEntry) && Array.isArray(existingEntry.disabled_tools) ? existingEntry.disabled_tools.filter((name) => typeof name === "string" && !rawToolIds.includes(name)) : [];
+  const offDisabled = [
+    ...input.search === "off" ? [RAW_MCP_TOOL_IDS.search] : [],
+    ...input.fetch === "off" ? [RAW_MCP_TOOL_IDS.fetch] : []
+  ];
+  const entry = {
+    command: "npx",
+    args: ["-y", input.packageRef],
+    ...keptDisabled.length > 0 || offDisabled.length > 0 ? { disabled_tools: [...keptDisabled, ...offDisabled] } : {},
+    env_vars: [API_KEY_ENV, ...OPTION_ENV_VARS]
   };
+  const ops = [{ op: "set", path: ["mcp_servers", "deepseek"], value: entry, previous: existingEntry }];
+  if (offDisabled.length > 0) {
+    notes.push(`Off capabilities use Codex's own disabled_tools key (${offDisabled.join(", ")}): the tools are removed from ` + "the model's context while the server keeps running and stays re-enableable by deleting the entries.");
+  }
+  if (input.search === "forced") {
+    const previous = typeof loaded.value.web_search === "string" ? loaded.value.web_search : undefined;
+    ops.push({ op: "set", path: ["web_search"], value: "disabled", previous });
+    notes.push(previous === undefined ? 'web_search is being set to "disabled" (no previous value existed; the default is "cached").' : `web_search is being set to "disabled"; the previous value "${previous}" is snapshotted for uninstall.`);
+  }
+  edits.push({ file: paths.config, format: "toml", shared: true, ops });
+  notes.push(`Codex stdio children do not inherit the parent environment, so the entry forwards ${API_KEY_ENV} and every ` + "DEEPSEEK_* option variable explicitly via env_vars; shell-set knobs reach the server without hand-editing " + "config.toml (the shared config file works without any forwarding).");
+  if (input.scope === "project") {
+    notes.push("Codex config lives in ~/.codex/config.toml only (user level), so the server registration and kill switch are " + "written there even for a project-scope install; the rules file stays project-local.");
+  }
+  if (loaded.lossy) {
+    notes.push(`${paths.config} contains comments; the TOML rewrite will drop them.`);
+  }
+  if (input.search === "forced" || input.fetch === "forced") {
+    notes.push(`Forced search is exclusion: the built-in web_search tool is disabled ("disabled" mode). ${FORCED_COST_NOTE}`);
+  }
+  if (input.search === "optional" || input.fetch === "optional") {
+    notes.push('Note: Codex ships a built-in web_search tool (default "cached" mode, an OpenAI index) that stays available ' + "alongside the DeepSeek tools under the optional tier.");
+  }
+  if (input.search === "preferred" || input.fetch === "preferred") {
+    edits.push({
+      file: paths.rules,
+      format: "rules",
+      block: buildRulesBlock(input.host, rulesLines(MCP_TOOL_IDS, input.search, input.fetch))
+    });
+    notes.push(input.scope === "global" ? `Rules block upserted in ${paths.rules}; Codex reads ~/.codex/AGENTS.md plus every AGENTS.md from the project root to the cwd.` : `Rules block upserted in ${paths.rules}; Codex reads every AGENTS.md from the project root to the cwd.`);
+  }
+  return { host: "codex", scope: input.scope, tiers, edits, notes, errors };
 }
-var HOSTS, HOST_CHOICES, SCOPES, TIERS, EXIT_FAILURE = 1, EXIT_USAGE = 2, EXIT_RECOVERY = 3, USAGE, VALUE_FLAGS, BOOLEAN_FLAGS, PATH_CHOICES;
-var init_cli = __esm(() => {
-  init_version();
-  init_apply();
-  init_hosts();
-  init_state();
-  init_uninstall();
-  HOSTS = Object.keys(HOST_PLANNERS);
-  HOST_CHOICES = `<${HOSTS.join("|")}>`;
-  SCOPES = ["project", "global"];
-  TIERS = ["optional", "preferred", "forced", "off"];
-  USAGE = `Usage:
-  deepseek-web-retrieval init --host ${HOST_CHOICES} --scope <project|global> --search <optional|preferred|forced|off> --fetch <optional|preferred|forced|off> [--path <extension|mcp>] [--package <npm ref>] [--cwd <dir>] [--apply]
-  deepseek-web-retrieval uninstall --host ${HOST_CHOICES} --scope <project|global> [--cwd <dir>]
-  deepseek-web-retrieval list [--cwd <dir>]
-  deepseek-web-retrieval version
-
-init prints the full plan (every file, old value → new value) and writes nothing
-until --apply is passed. uninstall restores what the plan applied. --path picks
-the integration mechanism for hosts with more than one (Pi: extension by
-default, mcp for the stdio MCP server). --package overrides the package ref
-written into host config; the Pi extension path turns it into the packages
-source (a bare name is prefixed with npm:, a ref that already starts with npm:
-is written as-is).
-
-Exit codes: 0 success; 1 refused or failed with nothing written (a failed apply
-is fully rolled back); 2 invalid command line; 3 recovery required — a failed
-apply could not roll back completely, follow the reported guidance before
-re-running.`;
-  VALUE_FLAGS = new Set(["host", "scope", "search", "fetch", "path", "package", "cwd"]);
-  BOOLEAN_FLAGS = new Set(["apply"]);
-  PATH_CHOICES = ["extension", "mcp"];
-});
-
-// src/core/auth.ts
-function apiKeyFromEnv(env = process.env) {
-  const key = env[API_KEY_ENV]?.trim();
-  return key ? key : undefined;
-}
-var init_auth = __esm(() => {
+var CODEX_TESTED_VERSION = "0.163.0";
+var init_codex = __esm(() => {
   init_constants();
+  init_env();
+  init_detect();
+  init_formats();
+  init_rules();
+  init_value();
+  init_paths();
+  init_rulesContent();
+  init_shared();
 });
 
-// src/core/domains.ts
-import { isIP } from "node:net";
-function normalizeDomain(value) {
-  const trimmed = value.trim();
-  if (!trimmed || /\s/.test(trimmed))
-    return;
-  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
-  if (hasScheme && !/^https?:\/\//i.test(trimmed))
-    return;
-  let hostname;
-  try {
-    hostname = new URL(hasScheme ? trimmed : `http://${trimmed}`).hostname;
-  } catch {
-    return;
-  }
-  return normalizeHostname(hostname);
-}
-function normalizeHostname(value) {
-  return value.trim().toLowerCase().replace(/^\[/, "").replace(/\]$/, "").replace(/\.+$/, "");
-}
-function domainMatches(hostname, domain) {
-  const host = normalizeHostname(hostname);
-  const target = normalizeHostname(domain);
-  if (!host || !target)
-    return false;
-  return host === target || host.endsWith(`.${target}`);
-}
-function normalizeDomains(values) {
-  if (!Array.isArray(values))
-    return [];
-  const domains = new Set;
-  for (const value of values) {
-    if (typeof value !== "string")
-      continue;
-    const domain = normalizeDomain(value);
-    if (domain)
-      domains.add(domain);
-  }
-  return [...domains];
+// src/installer/hosts/opencode.ts
+function opencodePaths(input) {
+  return input.scope === "global" ? {
+    config: join2(configHome(input), "opencode/opencode.jsonc"),
+    rules: join2(configHome(input), "opencode/AGENTS.md")
+  } : { config: join2(input.cwd, "opencode.jsonc"), rules: join2(input.cwd, "AGENTS.md") };
 }
-function isPrivateHostname(value) {
-  const host = normalizeHostname(value);
-  if (!host)
-    return true;
-  if (host === "localhost" || host === "local")
-    return true;
-  if (host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal") || host.endsWith(".lan") || host.endsWith(".home.arpa")) {
-    return true;
+function planOpenCode(input, previous) {
+  const paths = opencodePaths(input);
+  const loaded = codecFor("json", input.host).load(paths.config);
+  const tiers = { search: input.search, fetch: input.fetch };
+  const header = planHeader(input, paths, loaded, "JSONC");
+  if (header.abort) {
+    return { host: "opencode", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
   }
-  const version = isIP(host);
-  if (version === 4)
-    return isPrivateIpv4(host);
-  if (version === 6)
-    return isPrivateIpv6(host);
-  return false;
-}
-function assertFetchHostPolicy(url, options) {
-  const host = normalizeHostname(url.hostname);
-  if (options.blockPrivateHosts && isPrivateHostname(host)) {
-    throw new Error(`Fetch blocked for ${host}: local/private addresses are not reachable by DeepSeek. ` + "Set fetchBlockPrivateHosts=false only if you really need to send the URL.");
+  const notes = [...header.notes];
+  const errors = [...header.errors];
+  const edits = [];
+  if (input.search === "preferred") {
+    errors.push({
+      message: "OpenCode search has no preferred tier: the websearch provider is host-level config, so the model never " + "chooses between engines. Use --search optional (provider registered, built-in stays default), " + "--search forced (replace the engine), or --search off."
+    });
   }
-  const blocked = options.blockedDomains.find((domain) => domainMatches(host, domain));
-  if (blocked) {
-    throw new Error(`Fetch blocked for ${host}: matched fetchBlockedDomains entry "${blocked}"`);
+  const plugins = Array.isArray(loaded.value.plugins) ? loaded.value.plugins : [];
+  const trackedPackages = new Set(appendedByPrevious(previous, ["plugins"]).filter((entry) => isPlainObject(entry) && typeof entry.package === "string").map((entry) => entry.package));
+  const pluginPackages = plugins.filter((entry) => isPlainObject(entry) && typeof entry.package === "string");
+  const excusedRefs = previous === undefined ? [] : [...trackedPackages, input.packageRef];
+  const isExcusedRef = lineageMatcher(excusedRefs);
+  const foreignOwn = pluginPackages.filter((entry) => looksLikeOwnPackage(entry.package) && !isExcusedRef(entry.package));
+  if (foreignOwn.length > 0) {
+    errors.push({
+      message: `${paths.config} already has a plugins entry referencing deepseek-web-retrieval that this installer did not ` + "write. Remove it (or run uninstall if it came from a previous init), then retry."
+    });
   }
-  if (options.allowedDomains.length > 0 && !options.allowedDomains.some((domain) => domainMatches(host, domain))) {
-    throw new Error(`Fetch not allowed for ${host}: add it to fetchAllowedDomains (exact host or subdomain)`);
+  if (previous !== undefined && pluginPackages.some((entry) => isExcusedRef(entry.package))) {
+    notes.push("A previous init wrote the plugins entry; re-applying keeps it the only entry (a changed package ref or tier " + "options replace it, an unchanged one is a no-op) and the original snapshots carry over.");
   }
-}
-function isPrivateIpv4(host) {
-  const parts = host.split(".").map((part) => Number(part));
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-    return true;
+  if (errors.length > 0) {
+    return { host: "opencode", scope: input.scope, tiers, edits, notes, errors };
   }
-  const [a, b] = parts;
-  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a >= 224;
-}
-function isPrivateIpv6(host) {
-  const value = host.toLowerCase();
-  if (value === "::" || value === "::1")
-    return true;
-  if (value.startsWith("fc") || value.startsWith("fd"))
-    return true;
-  if (/^fe[89ab]/.test(value))
-    return true;
-  const dottedMapped = value.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1];
-  if (dottedMapped)
-    return isPrivateIpv4(dottedMapped);
-  const mapped = ipv4FromIpv6Hextets(value, /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-  if (mapped)
-    return isPrivateIpv4(mapped);
-  const compatible = ipv4FromIpv6Hextets(value, /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-  if (compatible)
-    return isPrivateIpv4(compatible);
-  return false;
-}
-function ipv4FromIpv6Hextets(value, pattern) {
-  const match = value.match(pattern);
-  if (!match)
-    return;
-  const high = Number.parseInt(match[1], 16);
-  const low = Number.parseInt(match[2], 16);
-  if (!Number.isFinite(high) || !Number.isFinite(low))
-    return;
-  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
-}
-var init_domains = () => {};
-
-// src/core/options.ts
-function resolvePluginOptions(input) {
-  return {
-    search: resolveSearchOptions(input),
-    fetch: resolveFetchOptions(input),
-    auth: resolveAuthOptions(input),
-    retry: resolveRetryOptions(input)
-  };
-}
-function resolveSearchOptions(input) {
-  return {
-    count: clampInt(input?.count, DEFAULT_SEARCH_COUNT, 1, 50),
-    maxResults: clampInt(input?.maxResults, DEFAULT_MAX_RESULTS, 0, 50),
-    minRerank: finiteNumber(input?.minRerank, DEFAULT_MIN_RERANK),
-    minAuthority: finiteNumber(input?.minAuthority, DEFAULT_MIN_AUTHORITY),
-    allowUnknownAuthority: input?.allowUnknownAuthority !== false,
-    blockedDomains: normalizeDomains(input?.blockedDomains),
-    includeDomains: normalizeDomains(input?.includeDomains),
-    language: optionalText(input?.language),
-    maxSummaryChars: clampInt(input?.maxSummaryChars, DEFAULT_MAX_SUMMARY_CHARS, 0, 1e6),
-    timeoutMs: clampInt(input?.searchTimeoutMs, DEFAULT_TIMEOUT_MS, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS),
-    enabled: input?.searchEnabled !== false
-  };
-}
-function resolveFetchOptions(input) {
-  return {
-    maxChars: clampInt(input?.fetchMaxChars, DEFAULT_FETCH_MAX_CHARS, 0, 1e6),
-    allowedDomains: normalizeDomains(input?.fetchAllowedDomains),
-    blockedDomains: normalizeDomains(input?.fetchBlockedDomains),
-    timeoutMs: clampInt(input?.fetchTimeoutMs, DEFAULT_TIMEOUT_MS, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS),
-    blockPrivateHosts: input?.fetchBlockPrivateHosts !== false,
-    enabled: input?.fetchEnabled !== false
-  };
-}
-function resolveAuthOptions(input) {
-  const value = input?.apiKeySource;
-  return {
-    source: value === "opencode" || value === "env" ? value : DEFAULT_API_KEY_SOURCE
-  };
-}
-function resolveRetryOptions(input) {
-  return {
-    maxRetries: clampInt(input?.maxRetries, DEFAULT_MAX_RETRIES, 0, MAX_RETRIES),
-    baseDelayMs: clampInt(input?.retryBaseDelayMs, DEFAULT_RETRY_BASE_DELAY_MS, 0, MAX_RETRY_DELAY_MS)
-  };
-}
-function optionalText(value) {
-  if (typeof value !== "string")
-    return;
-  const trimmed = value.trim();
-  return trimmed ? trimmed : undefined;
-}
-function finiteNumber(value, fallback) {
-  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
-}
-function clampInt(value, fallback, min, max) {
-  const number = typeof value === "number" && Number.isFinite(value) ? Math.trunc(value) : fallback;
-  return Math.min(max, Math.max(min, number));
-}
-var init_options = __esm(() => {
-  init_constants();
-  init_domains();
-});
-
-// src/core/env.ts
-function resolveEnvOptions(env = process.env) {
-  return resolvePluginOptions(pluginOptionsFromEnv(env));
-}
-function pluginOptionsFromEnv(env) {
   const options = {};
-  putNumber(options, "count", env);
-  putNumber(options, "maxResults", env);
-  putNumber(options, "minRerank", env);
-  putNumber(options, "minAuthority", env);
-  putFalseOnly(options, "allowUnknownAuthority", env);
-  putDomains(options, "blockedDomains", env);
-  putDomains(options, "includeDomains", env);
-  putText(options, "language", env);
-  putNumber(options, "maxSummaryChars", env);
-  putNumber(options, "searchTimeoutMs", env);
-  putNumber(options, "fetchMaxChars", env);
-  putDomains(options, "fetchAllowedDomains", env);
-  putDomains(options, "fetchBlockedDomains", env);
-  putNumber(options, "fetchTimeoutMs", env);
-  putFalseOnly(options, "fetchBlockPrivateHosts", env);
-  putFalseOnly(options, "searchEnabled", env);
-  putFalseOnly(options, "fetchEnabled", env);
-  putNumber(options, "maxRetries", env);
-  putNumber(options, "retryBaseDelayMs", env);
-  return options;
-}
-function putNumber(target, key, env) {
-  const value = env[NUMBER_ENV[key]];
-  if (value === undefined)
-    return;
-  const trimmed = value.trim();
-  if (!trimmed)
-    return;
-  const parsed = Number(trimmed);
-  if (Number.isFinite(parsed))
-    target[key] = parsed;
-}
-function putText(target, key, env) {
-  const value = env[TEXT_ENV[key]];
-  if (value === undefined)
-    return;
-  const trimmed = value.trim();
-  if (trimmed)
-    target[key] = trimmed;
-}
-function putFalseOnly(target, key, env) {
-  if (isFalseValue(env[FALSE_ONLY_ENV[key]]))
-    target[key] = false;
-}
-function putDomains(target, key, env) {
-  const value = env[DOMAINS_ENV[key]];
-  if (value === undefined || !value.trim())
-    return;
-  const domains = value.split(",").map((domain) => domain.trim()).filter((domain) => domain.length > 0);
-  if (domains.length > 0)
-    target[key] = domains;
-}
-function isFalseValue(value) {
-  const trimmed = value?.trim().toLowerCase();
-  return trimmed === "false" || trimmed === "0" || trimmed === "no" || trimmed === "off";
+  if (input.search === "forced")
+    options.setDefaultWebsearch = true;
+  if (input.search === "off")
+    options.searchEnabled = false;
+  if (input.fetch === "forced")
+    options.fetchOverrideWebfetch = true;
+  if (input.fetch === "off")
+    options.fetchEnabled = false;
+  const ops = [
+    {
+      op: "append-array",
+      path: ["plugins"],
+      entries: [{ package: input.packageRef, options }],
+      existingCount: plugins.length
+    }
+  ];
+  const permissions = [];
+  if (input.search !== "off")
+    permissions.push({ action: "websearch", resource: "*", effect: "allow" });
+  if (input.fetch !== "off")
+    permissions.push({ action: "deepseek_fetch", resource: "*", effect: "allow" });
+  if (input.fetch === "forced")
+    permissions.push({ action: "webfetch", resource: "*", effect: "allow" });
+  const existingPermissions = Array.isArray(loaded.value.permissions) ? loaded.value.permissions.length : 0;
+  if (permissions.length > 0) {
+    ops.push({ op: "append-array", path: ["permissions"], entries: permissions, existingCount: existingPermissions });
+  }
+  if (input.search === "forced") {
+    const currentProvider = isPlainObject(loaded.value.websearch) ? loaded.value.websearch.provider : undefined;
+    ops.push({ op: "set", path: ["websearch", "provider"], value: "deepseek", previous: currentProvider });
+    notes.push(currentProvider === undefined ? "websearch.provider is being set to deepseek (no previous value existed)." : `websearch.provider is being set to deepseek; the previous value "${String(currentProvider)}" is snapshotted for uninstall.`);
+  }
+  edits.push({ file: paths.config, format: "json", ops });
+  notes.push("The plugin entry uses the object form so options are honored; auto-discovered plugins cannot receive options.");
+  if (input.search === "optional") {
+    notes.push("Search tier optional: the deepseek provider is registered but the built-in provider stays the default engine; " + "set websearch.provider to deepseek (or rerun with --search forced) to route search through DeepSeek.");
+  }
+  if (input.search === "forced" || input.fetch === "forced") {
+    notes.push(`Forced tier replaces built-in routing. ${FORCED_COST_NOTE}`);
+  }
+  if (input.fetch === "preferred") {
+    edits.push({
+      file: paths.rules,
+      format: "rules",
+      block: buildRulesBlock(input.host, rulesLines(OPENCODE_TOOL_IDS, input.search, input.fetch))
+    });
+    notes.push(`Rules block upserted in ${paths.rules}; OpenCode loads AGENTS.md only (no CLAUDE.md fallback in v2).`);
+  }
+  return { host: "opencode", scope: input.scope, tiers, edits, notes, errors };
 }
-var NUMBER_ENV, TEXT_ENV, DOMAINS_ENV, FALSE_ONLY_ENV;
-var init_env = __esm(() => {
-  init_constants();
-  init_options();
-  NUMBER_ENV = {
-    count: "DEEPSEEK_SEARCH_COUNT",
-    maxResults: "DEEPSEEK_SEARCH_MAX_RESULTS",
-    minRerank: "DEEPSEEK_SEARCH_MIN_RERANK",
-    minAuthority: "DEEPSEEK_SEARCH_MIN_AUTHORITY",
-    maxSummaryChars: "DEEPSEEK_SEARCH_MAX_SUMMARY_CHARS",
-    searchTimeoutMs: "DEEPSEEK_SEARCH_TIMEOUT_MS",
-    fetchMaxChars: "DEEPSEEK_FETCH_MAX_CHARS",
-    fetchTimeoutMs: "DEEPSEEK_FETCH_TIMEOUT_MS",
-    maxRetries: "DEEPSEEK_MAX_RETRIES",
-    retryBaseDelayMs: "DEEPSEEK_RETRY_BASE_DELAY_MS"
-  };
-  TEXT_ENV = {
-    language: "DEEPSEEK_SEARCH_LANGUAGE"
-  };
-  DOMAINS_ENV = {
-    blockedDomains: "DEEPSEEK_SEARCH_BLOCKED_DOMAINS",
-    includeDomains: "DEEPSEEK_SEARCH_INCLUDE_DOMAINS",
-    fetchAllowedDomains: "DEEPSEEK_FETCH_ALLOWED_DOMAINS",
-    fetchBlockedDomains: "DEEPSEEK_FETCH_BLOCKED_DOMAINS"
-  };
-  FALSE_ONLY_ENV = {
-    allowUnknownAuthority: "DEEPSEEK_SEARCH_ALLOW_UNKNOWN_AUTHORITY",
-    fetchBlockPrivateHosts: "DEEPSEEK_FETCH_BLOCK_PRIVATE_HOSTS",
-    searchEnabled: ENABLE_SEARCH_ENV,
-    fetchEnabled: ENABLE_FETCH_ENV
-  };
+var OPENCODE_TOOL_IDS;
+var init_opencode = __esm(() => {
+  init_detect();
+  init_formats();
+  init_rules();
+  init_value();
+  init_ownership();
+  init_paths();
+  init_rulesContent();
+  init_state();
+  init_shared();
+  OPENCODE_TOOL_IDS = { search: "websearch (provider deepseek)", fetch: "deepseek_fetch" };
 });
 
-// src/mcp/auth.ts
-function requireApiKey(env) {
-  const apiKey = apiKeyFromEnv(env);
-  if (!apiKey)
-    throw new Error(MISSING_API_KEY_MESSAGE);
-  return apiKey;
-}
-var MISSING_API_KEY_MESSAGE;
-var init_auth2 = __esm(() => {
-  init_auth();
-  init_constants();
-  MISSING_API_KEY_MESSAGE = `DeepSeek API key not found. Set ${API_KEY_ENV} in the MCP server's env configuration.`;
-});
+// src/pi/settings.ts
+var SETTINGS_NAMESPACE = "deepseekWebRetrieval";
+var init_settings = () => {};
 
-// src/mcp/client.ts
-import { CLIENT_INFO_META_KEY } from "@modelcontextprotocol/server";
-function clientNameOf(server, ctx) {
-  const envelope = ctx.mcpReq.envelope;
-  const name = envelope?.[CLIENT_INFO_META_KEY];
-  if (typeof name === "object" && name !== null && "name" in name && typeof name.name === "string") {
-    return name.name;
-  }
-  return server.server.getClientVersion()?.name;
+// src/installer/hosts/pi.ts
+function piPaths(input) {
+  const mcp = input.scope === "global" ? join2(input.home, ".pi/agent/mcp.json") : join2(input.cwd, ".pi/mcp.json");
+  const settings = input.scope === "global" ? join2(input.home, ".pi/agent/settings.json") : join2(input.cwd, ".pi/settings.json");
+  const rules = input.scope === "global" ? join2(input.home, ".pi/agent/AGENTS.md") : join2(input.cwd, "AGENTS.md");
+  return { config: input.path === "mcp" ? mcp : settings, rules };
 }
-function isJsonReplacingClient(name) {
-  return name !== undefined && JSON_REPLACING_CLIENT_NAMES.has(name);
+function piSourceRef(packageRef) {
+  return packageRef.startsWith("npm:") ? packageRef : `npm:${packageRef}`;
 }
-function omitStructuredContent(server, ctx) {
-  return isJsonReplacingClient(clientNameOf(server, ctx));
+function planPi(input, previous) {
+  return input.path === "mcp" ? planPiMcp(input) : planPiExtension(input, previous);
 }
-var JSON_REPLACING_CLIENT_NAMES;
-var init_client = __esm(() => {
-  JSON_REPLACING_CLIENT_NAMES = new Set(["codex-mcp-client"]);
-});
-
-// package.json
-var package_default;
-var init_package = __esm(() => {
-  package_default = {
-    $schema: "https://json.schemastore.org/package.json",
-    name: "deepseek-web-retrieval",
-    version: "0.6.0",
-    description: "Token-efficient DeepSeek Search and Fetch for coding agents, starting with OpenCode v2.",
-    type: "module",
-    license: "MIT",
-    repository: {
-      type: "git",
-      url: "git+https://github.com/gwokhou/deepseek-web-retrieval.git"
-    },
-    homepage: "https://github.com/gwokhou/deepseek-web-retrieval#readme",
-    bugs: "https://github.com/gwokhou/deepseek-web-retrieval/issues",
-    keywords: [
-      "opencode",
-      "opencode-plugin",
-      "pi",
-      "pi-extension",
-      "deepseek",
-      "websearch",
-      "webfetch",
-      "coding-agent",
-      "mcp"
-    ],
-    exports: {
-      ".": "./index.ts",
-      "./core": "./src/core/index.ts",
-      "./mcp": "./src/mcp/server.ts",
-      "./pi": "./src/pi/extension.ts"
-    },
-    pi: {
-      extensions: [
-        "./src/pi/extension.ts"
-      ]
-    },
-    bin: {
-      "deepseek-web-retrieval": "dist/cli.js"
-    },
-    files: [
-      "index.ts",
-      "src",
-      "dist",
-      "docs",
-      "README.md",
-      "LICENSE",
-      "CHANGELOG.md",
-      "examples"
-    ],
-    scripts: {
-      lint: "biome check --error-on-warnings .",
-      "lint:ci": "biome ci --error-on-warnings .",
-      "lint:fix": "biome check --write --error-on-warnings .",
-      format: "biome format --write .",
-      typecheck: "tsc --noEmit",
-      build: "bun build src/mcp/cli.ts --target=node --format=esm --outdir=dist --external @modelcontextprotocol/server --external @modelcontextprotocol/server/stdio --external zod --external zod/v4",
-      prepublishOnly: "bun run check:release",
-      test: "bun test",
-      "test:package": "node scripts/test-package.mjs",
-      "test:e2e:keyless": "bun run test:e2e pi pi-extension installer reinit upgrade pkg capability-off",
-      "check:release": "bun run check && bun run test:package && bun run test:e2e:keyless",
-      "test:e2e": "bun run test/e2e/run.ts",
-      "docs:matrix": "bun run scripts/render-matrix.ts",
-      "test:coverage": "bun test --coverage",
-      check: "bun run lint && bun run typecheck && bun run docs:matrix --check && bun run build && bun test"
-    },
-    peerDependencies: {
-      "@earendil-works/pi-ai": "^1.3.0",
-      "@earendil-works/pi-coding-agent": "^1.3.0",
-      "@opencode/plugin": "^2.0.32"
-    },
-    peerDependenciesMeta: {
-      "@earendil-works/pi-ai": {
-        optional: true
-      },
-      "@earendil-works/pi-coding-agent": {
-        optional: true
-      },
-      "@opencode/plugin": {
-        optional: true
-      }
-    },
-    devDependencies: {
-      "@biomejs/biome": "2.5.15",
-      "@earendil-works/pi-ai": "1.3.0",
-      "@earendil-works/pi-coding-agent": "1.3.0",
-      "@modelcontextprotocol/client": "^2.3.1",
-      "@opencode/plugin": "2.0.32",
-      "@types/bun": "1.4.0",
-      "@types/node": "^26.6.5",
-      typescript: "5.9.3"
-    },
-    engines: {
-      bun: ">=1.3.0",
-      node: ">=20"
-    },
-    dependencies: {
-      "@modelcontextprotocol/server": "^2.3.1",
-      "jsonc-parser": "^3.3.1",
-      "smol-toml": "^1.9.1",
-      zod: "^4"
+function planPiExtension(input, previous) {
+  const paths = piPaths(input);
+  const loaded = codecFor("json", input.host).load(paths.config);
+  const tiers = { search: input.search, fetch: input.fetch };
+  const header = planHeader(input, paths, loaded, "JSON");
+  if (header.abort) {
+    return { host: "pi", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
+  }
+  const notes = [...header.notes];
+  const errors = [...header.errors];
+  const edits = [];
+  const packages = Array.isArray(loaded.value.packages) ? loaded.value.packages : [];
+  const source = piSourceRef(input.packageRef);
+  const trackedSources = appendedByPrevious(previous, ["packages"]).filter((entry) => typeof entry === "string");
+  const sources = packages.filter((entry) => typeof entry === "string");
+  const excusedSources = previous === undefined ? [] : [...trackedSources, source];
+  const isExcusedSource = lineageMatcher(excusedSources);
+  const foreignOwn = sources.filter((entry) => looksLikeOwnPackage(entry) && !isExcusedSource(entry));
+  if (foreignOwn.length > 0) {
+    errors.push({
+      message: `${paths.config} already lists ${foreignOwn.join(", ")} — this package (or a fork of it) that this installer did not ` + "write. Remove it (pi remove <source>, or uninstall if it came from a previous init), then retry."
+    });
+  }
+  if (previous !== undefined && sources.some((entry) => isExcusedSource(entry))) {
+    notes.push("A previous init wrote the packages entry; re-applying reuses it (an unchanged source deduplicates, a changed " + "--package ref replaces the old source) and the original snapshots carry over.");
+  }
+  const forced = input.search === "forced" || input.fetch === "forced";
+  if (forced) {
+    const isOwnSource = lineageMatcher([...trackedSources, source]);
+    const unexcludable = [...collectSources(loaded.value.packages), ...collectSources(loaded.value.extensions)].filter((entry) => !isOwnSource(entry) && looksWebCapable(entry, undefined));
+    if (unexcludable.length > 0) {
+      errors.push({
+        message: `Forced cannot deliver exclusive routing: settings sources ${unexcludable.join(", ")} look web-capable, ` + "and Pi offers no per-package kill switch. Remove them (pi remove <source>) or choose a lower tier."
+      });
     }
+  }
+  if (errors.length > 0) {
+    return { host: "pi", scope: input.scope, tiers, edits: [], notes, errors };
+  }
+  const ops = [
+    { op: "append-array", path: ["packages"], entries: [source], existingCount: packages.length }
+  ];
+  const namespace = isPlainObject(loaded.value[SETTINGS_NAMESPACE]) ? loaded.value[SETTINGS_NAMESPACE] : {};
+  if (input.search === "off") {
+    ops.push({
+      op: "set",
+      path: [SETTINGS_NAMESPACE, "enableSearch"],
+      value: false,
+      previous: typeof namespace.enableSearch === "boolean" ? namespace.enableSearch : undefined
+    });
+  }
+  if (input.fetch === "off") {
+    ops.push({
+      op: "set",
+      path: [SETTINGS_NAMESPACE, "enableFetch"],
+      value: false,
+      previous: typeof namespace.enableFetch === "boolean" ? namespace.enableFetch : undefined
+    });
+  }
+  edits.push({
+    file: paths.config,
+    format: "json",
+    ...input.scope === "global" ? { shared: true } : {},
+    ops
+  });
+  notes.push("Pi resolves the packages source at session start; the first launch after apply fetches the package from npm " + "(pi update --extensions refreshes it later).");
+  notes.push(`The extension reads ${API_KEY_ENV} from the Pi process environment; no env forwarding is needed. ` + "Set it in the shell that launches Pi.");
+  if (input.search === "off" || input.fetch === "off") {
+    notes.push(`Off capability switches are written into the "${SETTINGS_NAMESPACE}" settings namespace; the extension ` + "reads them at load (they outrank the DEEPSEEK_ENABLE_* environment variables).");
+  }
+  notes.push(`Extension tools are declared to the model with exposure "direct" by Pi's own default; no exposure key is needed.`);
+  if (forced) {
+    edits.push(...planMcpCompetitorDisables(input, notes, errors));
+  }
+  if (errors.length > 0) {
+    return { host: "pi", scope: input.scope, tiers, edits: [], notes, errors };
+  }
+  if (input.search === "preferred" || input.fetch === "preferred") {
+    edits.push({
+      file: paths.rules,
+      format: "rules",
+      block: buildRulesBlock(input.host, rulesLines(RAW_MCP_TOOL_IDS, input.search, input.fetch))
+    });
+    notes.push(`Rules block upserted in ${paths.rules}; Pi loads AGENTS.md context files from the working directory and its parents.`);
+  }
+  if (forced) {
+    notes.push("Forced tier: Pi 1.3.0 ships no built-in web tool, so the registered tools are the only web path (de-facto). " + FORCED_COST_NOTE);
+  }
+  return { host: "pi", scope: input.scope, tiers, edits, notes, errors };
+}
+function planCompetitorDisables(servers, competitors, notes, errors) {
+  const ops = [];
+  const excluded = [];
+  const unexcludable = [];
+  for (const name of competitors) {
+    const current = servers[name];
+    if (!isPlainObject(current)) {
+      unexcludable.push(name);
+      continue;
+    }
+    const previous = typeof current.enabled === "boolean" ? current.enabled : undefined;
+    ops.push({ op: "set", path: ["mcpServers", name, "enabled"], value: false, previous });
+    excluded.push(name);
+  }
+  if (excluded.length > 0) {
+    notes.push(`Forced tier: web-capable MCP servers are disabled so DeepSeek routing is exclusive (${excluded.join(", ")}; ` + "prior enabled values are snapshotted for uninstall).");
+  }
+  if (unexcludable.length > 0) {
+    errors.push({
+      message: `Forced cannot deliver exclusive routing: mcpServers entries ${unexcludable.join(", ")} look web-capable ` + "but are not objects, so the plan cannot set their enabled key. Fix or remove them, or choose a lower tier."
+    });
+  }
+  return ops;
+}
+function planMcpCompetitorDisables(input, notes, errors) {
+  const mcpFile = input.scope === "global" ? join2(input.home, ".pi/agent/mcp.json") : join2(input.cwd, ".pi/mcp.json");
+  const loaded = codecFor("json", input.host).load(mcpFile);
+  if (loaded.parseError) {
+    errors.push({ message: `${mcpFile} does not parse: ${loaded.parseError}` });
+    return [];
+  }
+  const servers = isPlainObject(loaded.value.mcpServers) ? loaded.value.mcpServers : undefined;
+  if (!isPlainObject(servers))
+    return [];
+  const { competitors, bystanders } = splitCompetitors(servers);
+  const edits = [];
+  if (competitors.length > 0) {
+    const ops = planCompetitorDisables(servers, competitors, notes, errors);
+    if (ops.length > 0) {
+      edits.push({
+        file: mcpFile,
+        format: "json",
+        ...input.scope === "global" ? { shared: true } : {},
+        ops
+      });
+    }
+  }
+  if (bystanders.length > 0)
+    notes.push(othersStayRegisteredNote(bystanders));
+  return edits;
+}
+function planPiMcp(input) {
+  const paths = piPaths(input);
+  const loaded = codecFor("json", input.host).load(paths.config);
+  const tiers = { search: input.search, fetch: input.fetch };
+  const header = planHeader(input, paths, loaded, "JSON");
+  if (header.abort) {
+    return { host: "pi", scope: input.scope, tiers, edits: [], notes: header.notes, errors: header.errors };
+  }
+  const notes = [...header.notes];
+  const errors = [...header.errors];
+  const edits = [];
+  const env = { [API_KEY_ENV]: `\${${API_KEY_ENV}}` };
+  if (input.search === "off")
+    env[ENABLE_SEARCH_ENV] = "false";
+  if (input.fetch === "off")
+    env[ENABLE_FETCH_ENV] = "false";
+  const entry = {
+    command: "npx",
+    args: ["-y", input.packageRef],
+    env,
+    exposure: "direct",
+    enabled: true
   };
+  const servers = loaded.value.mcpServers;
+  const existingEntry = isPlainObject(servers) ? servers.deepseek : undefined;
+  const ops = [{ op: "set", path: ["mcpServers", "deepseek"], value: entry, previous: existingEntry }];
+  edits.push({
+    file: paths.config,
+    format: "json",
+    ...input.scope === "global" ? { shared: true } : {},
+    ops
+  });
+  if (isPlainObject(servers)) {
+    if (servers.deepseek !== undefined)
+      notes.push(replacingExistingEntryNote("mcpServers.deepseek"));
+    const { competitors, bystanders } = splitCompetitors(servers);
+    const forced = input.search === "forced" || input.fetch === "forced";
+    if (forced) {
+      ops.push(...planCompetitorDisables(servers, competitors, notes, errors));
+    }
+    const stayRegistered = forced ? bystanders : [...competitors, ...bystanders];
+    if (stayRegistered.length > 0)
+      notes.push(othersStayRegisteredNote(stayRegistered));
+  }
+  notes.push('"exposure": "direct" is required: Pi 1.3.0 defaults MCP tools to codemode, which hides them from the model.');
+  notes.push(`\`${API_KEY_ENV}\` is written as "\${${API_KEY_ENV}}" so the key expands from the shell that launches Pi and stays out of the file.`);
+  if (input.search === "preferred" || input.fetch === "preferred") {
+    edits.push({
+      file: paths.rules,
+      format: "rules",
+      block: buildRulesBlock(input.host, rulesLines(MCP_TOOL_IDS, input.search, input.fetch))
+    });
+    notes.push(`Rules block upserted in ${paths.rules}; Pi loads AGENTS.md context files from the working directory and its parents.`);
+  }
+  if (input.search === "forced" || input.fetch === "forced") {
+    notes.push("Forced tier: Pi 1.3.0 ships no built-in web tool, so the registered tools are the only web path (de-facto). " + FORCED_COST_NOTE);
+  }
+  return { host: "pi", scope: input.scope, tiers, edits, notes, errors };
+}
+function collectSources(value) {
+  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+var init_pi = __esm(() => {
+  init_constants();
+  init_settings();
+  init_detect();
+  init_formats();
+  init_rules();
+  init_value();
+  init_ownership();
+  init_paths();
+  init_rulesContent();
+  init_state();
+  init_shared();
 });
 
-// src/core/format.ts
-function truncate(value, maxChars) {
-  if (maxChars <= 0)
-    return "";
-  if (value.length <= maxChars)
-    return value;
-  return Array.from(value).slice(0, maxChars).join("");
+// src/installer/hosts/index.ts
+function planForHost(host, input) {
+  try {
+    const previous = readRecord(input);
+    const planned = withCrossScopeGuard(HOST_PLANNERS[host](input, previous), input);
+    return {
+      ...withSecretGuard(withOrphanReverts(withLegacySharedConfigGuard(planned, previous), previous)),
+      previousRecord: previous
+    };
+  } catch (error) {
+    if (!(error instanceof InstallRecordError))
+      throw error;
+    return {
+      host,
+      scope: input.scope,
+      tiers: { search: input.search, fetch: input.fetch },
+      edits: [],
+      notes: [],
+      errors: [{ message: error.message }]
+    };
+  }
 }
-function formatFetchedContent(title, content, maxChars) {
-  const document = withTitle(title, content);
-  const length = Array.from(document).length;
-  if (maxChars <= 0)
-    return { content: "", truncated: length > 0 };
-  if (length <= maxChars)
-    return { content: document, truncated: false };
-  const markerLength = Array.from(FETCH_TRUNCATION_MARKER).length;
-  if (maxChars <= markerLength) {
-    return { content: truncate(document, maxChars), truncated: true };
+function withCrossScopeGuard(plan, input) {
+  if (plan.errors.length > 0)
+    return plan;
+  try {
+    assertFileOwnership(input, plan.edits);
+  } catch (error) {
+    return { ...plan, edits: [], reverts: undefined, errors: [{ message: String(error) }] };
   }
+  const other = input.scope === "global" ? "project" : "global";
+  const overlap = claimedByOtherScope(input, plan.edits.map((edit2) => edit2.file));
+  if (overlap.length === 0)
+    return { ...plan, notes: [...plan.notes, ...fileOwnershipNotes(input, plan.edits)] };
   return {
-    content: `${truncate(document, maxChars - markerLength)}${FETCH_TRUNCATION_MARKER}`,
-    truncated: true
+    ...plan,
+    edits: [],
+    reverts: undefined,
+    errors: [
+      {
+        message: `A ${plan.host} install is already recorded at the ${other} scope and claims the same file(s): ${overlap.join(", ")}. ` + `Uninstall it first (deepseek-web-retrieval uninstall --host ${plan.host} --scope ${other}), ` + `or re-run with --scope ${other} to update it in place — two scopes must not edit one file.`
+      }
+    ]
   };
 }
-function withTitle(title, content) {
-  const heading = title.trim();
-  if (!heading)
-    return content;
-  const body = content.trimStart();
-  const lines = body.split(/\r?\n/);
-  const firstHeading = lines[0]?.match(/^\\?#\s+(.+?)\s*$/)?.[1];
-  if (firstHeading && normalizeHeading(firstHeading) === normalizeHeading(heading)) {
-    lines[0] = `# ${heading}`;
-    return lines.join(`
-`);
+function withLegacySharedConfigGuard(plan, previous) {
+  if (plan.errors.length > 0 || previous !== undefined)
+    return plan;
+  for (const edit2 of plan.edits) {
+    if (edit2.format === "rules" || !edit2.shared)
+      continue;
+    for (const op of edit2.ops) {
+      const old = op.previous;
+      if (op.op !== "set" || !isPlainObject(old) || old.command !== "npx" || !Array.isArray(old.args) || old.args[0] !== "-y" || !Array.isArray(old.env_vars) || !old.env_vars.includes(API_KEY_ENV))
+        continue;
+      return {
+        ...plan,
+        edits: [],
+        reverts: undefined,
+        errors: [
+          {
+            message: `${edit2.file} contains an installer-style registration without an install record for this location. ` + "It may belong to an older install in another project. Re-run init or uninstall from that original project and scope first; " + "if the registration was created manually, remove it before retrying. No existing registration was adopted."
+          }
+        ]
+      };
+    }
   }
-  return `# ${heading}
-
-${content}`;
-}
-function normalizeHeading(value) {
-  return value.trim().replace(/\s+/g, " ").replace(/\s+#+\s*$/, "").toLowerCase();
+  return plan;
 }
-function redactSecrets(value) {
-  return value.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "sk-***").replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, "Bearer ***");
+function withSecretGuard(plan) {
+  for (const edit2 of plan.edits) {
+    if (edit2.format === "rules")
+      continue;
+    for (const op of edit2.ops) {
+      if (op.op !== "set" || op.previous === undefined)
+        continue;
+      const offender = findSecretLike(op.previous, op.path.join("."));
+      if (offender !== undefined) {
+        return {
+          ...plan,
+          edits: [],
+          reverts: undefined,
+          errors: [
+            {
+              message: `${edit2.file}: the existing value at ${op.path.join(".")} contains a credential-looking key ` + `(${offender}). The installer refuses to snapshot secrets into its state file. Move the key to ` + `environment indirection ("\${${API_KEY_ENV}}" expansion or env_vars) and re-run.`
+            }
+          ]
+        };
+      }
+    }
+  }
+  return plan;
 }
-function formatApiError(operation2, status, body) {
-  const detail = redactSecrets(body.trim());
-  const detailChars = Array.from(detail);
-  const text = detail ? detailChars.length > MAX_ERROR_BODY_CHARS ? `${detailChars.slice(0, MAX_ERROR_BODY_CHARS).join("")}…` : detail : "empty response body";
-  const hint = status === 401 ? "invalid API key" : status === 402 ? "insufficient balance" : status === 403 ? "permission denied" : status === 429 ? "rate limited" : undefined;
-  const label = hint ? `${operation2} failed (HTTP ${status}, ${hint})` : `${operation2} failed (HTTP ${status})`;
-  return `${label}: ${text}`;
+function findSecretLike(value, at) {
+  if (typeof value !== "object" || value === null)
+    return;
+  for (const [key, child] of Object.entries(value)) {
+    const path = `${at}.${key}`;
+    if (/(api[_-]?key|token|secret|password|credential)/i.test(key) && typeof child === "string" && child.length > 0 && !/^\$\{[^}]+\}$/.test(child)) {
+      return path;
+    }
+    const nested = findSecretLike(child, path);
+    if (nested !== undefined)
+      return nested;
+  }
+  return;
 }
-function formatTimeoutError(operation2, timeoutMs) {
-  return `${operation2} timed out after ${timeoutMs} ms`;
+function withOrphanReverts(plan, previous) {
+  if (plan.errors.length > 0)
+    return plan;
+  if (previous === undefined)
+    return plan;
+  const reverts = [];
+  for (const file of previous.files) {
+    const edit2 = plan.edits.find((candidate) => candidate.file === file.file);
+    if (edit2 === undefined) {
+      reverts.push(file);
+      continue;
+    }
+    if (edit2.format === "rules" || file.format === "rules")
+      continue;
+    const orphanOps = file.ops.flatMap((op) => {
+      const claimed = edit2.ops.find((candidate) => candidate.op === op.op && candidate.path.join("\x00") === op.path.join("\x00"));
+      if (op.op !== "append-array" || claimed === undefined || claimed.op !== "append-array") {
+        return claimed === undefined ? [op] : [];
+      }
+      const dropped = (Array.isArray(op.applied) ? op.applied : []).filter((entry) => !(claimed.entries ?? []).some((wanted) => deepEqual(wanted, entry)));
+      return dropped.length > 0 ? [{ ...op, applied: dropped }] : [];
+    });
+    if (orphanOps.length > 0)
+      reverts.push({ ...file, ops: orphanOps });
+  }
+  if (reverts.length === 0)
+    return plan;
+  return { ...plan, reverts };
 }
-function formatSearchResults(results) {
-  if (results.length === 0)
-    return "No results found.";
-  return results.map((result, index) => {
-    const title = result.title?.trim() || result.url;
-    const lines = [`${index + 1}. [${escapeBrackets(title)}](${result.url})`];
-    if (result.content) {
-      lines.push(`   ${result.content.replaceAll(`
-`, " ")}`);
+var HOST_PLANNERS, HOST_VERSION_PROBES;
+var init_hosts = __esm(() => {
+  init_constants();
+  init_value();
+  init_ownership();
+  init_state();
+  init_claude_code();
+  init_codex();
+  init_opencode();
+  init_pi();
+  HOST_PLANNERS = {
+    opencode: planOpenCode,
+    pi: planPi,
+    codex: planCodex,
+    "claude-code": planClaudeCode
+  };
+  HOST_VERSION_PROBES = {
+    codex: probeCodexVersion,
+    "claude-code": probeClaudeCodeVersion
+  };
+});
+
+// src/installer/render.ts
+function renderPlan(plan) {
+  const lines = [];
+  lines.push(`Install plan: ${plan.host} (${plan.scope} scope)`);
+  lines.push(`Tiers: search=${plan.tiers.search}, fetch=${plan.tiers.fetch}`);
+  lines.push("");
+  lines.push("Files:");
+  for (const edit2 of plan.edits) {
+    lines.push(`  ${edit2.file}`);
+    if (edit2.format === "rules") {
+      lines.push("    upsert marked rules block");
+      continue;
     }
-    if (result.published !== undefined) {
-      lines.push(`   Published: ${formatPublished(result.published)}`);
+    for (const op of edit2.ops) {
+      if (op.op === "set") {
+        const was = op.previous === undefined ? "(absent)" : preview(op.previous);
+        lines.push(`    set ${op.path.join(".")} = ${preview(op.value)} (was ${was})`);
+      } else {
+        const count = (op.entries ?? []).length;
+        const kept = op.existingCount !== undefined ? ` (${op.existingCount} existing kept)` : "";
+        lines.push(`    append ${count} entr${count === 1 ? "y" : "ies"} to ${op.path.join(".")}${kept}`);
+        for (const entry of op.entries ?? [])
+          lines.push(`      + ${preview(entry)}`);
+      }
+    }
+  }
+  if (plan.reverts && plan.reverts.length > 0) {
+    lines.push("");
+    lines.push("Reverts (artifacts from the previous init that this plan no longer wants):");
+    for (const revert of plan.reverts) {
+      lines.push(`  ${revert.file}`);
+      if (revert.format === "rules") {
+        lines.push("    remove rules block");
+        continue;
+      }
+      for (const op of revert.ops) {
+        if (op.op === "set") {
+          lines.push(op.previous === undefined ? `    remove ${op.path.join(".")} (was not set before this install)` : `    restore ${op.path.join(".")} = ${preview(op.previous)}`);
+        } else {
+          const count = Array.isArray(op.applied) ? op.applied.length : 0;
+          lines.push(`    remove ${count} appended entr${count === 1 ? "y" : "ies"} from ${op.path.join(".")}`);
+        }
+      }
     }
-    return lines.join(`
-`);
-  }).join(`
-
+  }
+  if (plan.notes.length > 0) {
+    lines.push("");
+    lines.push("Notes:");
+    for (const note of plan.notes)
+      lines.push(`  - ${note}`);
+  }
+  return lines.join(`
 `);
 }
-function toStructuredResult(result) {
-  return {
-    url: result.url,
-    ...result.title ? { title: result.title } : {},
-    ...result.content ? { content: result.content } : {},
-    ...result.published !== undefined ? { published: result.published } : {}
-  };
-}
-function escapeBrackets(value) {
-  return value.replaceAll("[", "\\[").replaceAll("]", "\\]");
-}
-function formatPublished(epochMs) {
-  return new Date(epochMs).toISOString().slice(0, 10);
+function preview(value) {
+  const text = JSON.stringify(value) ?? String(value);
+  return text.length > 100 ? `${text.slice(0, 97)}...` : text;
 }
-var init_format2 = __esm(() => {
-  init_constants();
-});
 
-// src/core/url.ts
-function parseFetchUrl(value) {
-  const input = value.trim();
-  if (!input)
-    throw new Error("URL must not be empty");
-  if (input.length > MAX_URL_CHARS) {
-    throw new Error(`URL must be ${MAX_URL_CHARS} characters or fewer`);
-  }
-  let url;
-  try {
-    url = new URL(input);
-  } catch {
-    throw new Error("URL must be an absolute http:// or https:// URL");
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error("URL must use http:// or https://");
-  }
-  if (!url.hostname || !normalizeHostname(url.hostname)) {
-    throw new Error("URL must include a host");
+// src/installer/uninstall.ts
+function uninstall(input) {
+  return withOperationLock([statePathFor(input)], () => {
+    const record = readRecord(input);
+    if (record === undefined) {
+      throw new Error(`No ${input.host} install is recorded for the ${input.scope} scope.`);
+    }
+    return withOperationLock(record.files.map((file) => file.file), () => uninstallLocked(input, record));
+  });
+}
+function uninstallLocked(input, record) {
+  assertFileOwnership(input, record.files);
+  const other = input.scope === "global" ? "project" : "global";
+  const overlap = claimedByOtherScope(input, record.files.map((file) => file.file));
+  if (overlap.length > 0) {
+    throw new Error(`A ${input.host} install is also recorded at the ${other} scope and claims the same file(s): ${overlap.join(", ")}. ` + `Uninstall the ${other}-scope install first so this rollback cannot clobber its entries.`);
   }
-  if (url.username || url.password) {
-    throw new Error("URL must not contain credentials");
+  const lines = [];
+  for (const file of record.files) {
+    if (file.format !== "rules")
+      continue;
+    const loaded = codecFor("rules", record.host).load(file.file);
+    if (loaded.parseError)
+      throw new Error(`${file.file}: ${loaded.parseError}`);
   }
-  return url;
-}
-function normalizeResultUrl(value) {
-  if (typeof value !== "string")
-    return;
-  const input = value.trim();
-  if (!input || input.length > MAX_URL_CHARS)
-    return;
-  try {
-    const url = new URL(input);
-    if (url.protocol !== "http:" && url.protocol !== "https:")
-      return;
-    if (!url.hostname || url.username || url.password)
-      return;
-    return url.href;
-  } catch {
-    return;
+  for (const file of [...record.files].reverse()) {
+    lines.push(...revertRecordedFile(file, record.host, { label: "", whole: true }));
   }
+  releaseFileOwnership(input, record.files);
+  deleteRecord(input);
+  pruneEmptyDir(stateDir(input, input.scope));
+  lines.push(`removed install record (${input.host}, ${input.scope})`);
+  return lines;
 }
-var init_url = __esm(() => {
-  init_constants();
-  init_domains();
+var init_uninstall = __esm(() => {
+  init_formats();
+  init_operation_lock();
+  init_ownership();
+  init_paths();
+  init_revert();
+  init_state();
 });
 
-// src/core/search.ts
-function buildQuery(query, options) {
-  const parts = [query.trim()];
-  for (const domain of normalizeDomains(options.blockedDomains))
-    parts.push(`-site:${domain}`);
-  const include = normalizeDomains(options.includeDomains);
-  if (include.length)
-    parts.push(include.map((domain) => `site:${domain}`).join(" OR "));
-  const language = options.language?.trim().replace(/^lang:/i, "");
-  if (language)
-    parts.push(`lang:${language}`);
-  return parts.filter((part) => part.length > 0).join(" ");
-}
-function parsePublished(value) {
-  if (typeof value !== "string" || !value.trim())
-    return;
-  const timestamp = Date.parse(value);
-  return Number.isFinite(timestamp) ? timestamp : undefined;
-}
-function processResults(raw, options) {
-  const results = [];
-  const seen = new Set;
-  for (const item of raw) {
-    if (results.length >= options.maxResults)
-      break;
-    if (!item || typeof item !== "object")
-      continue;
-    const url = normalizeResultUrl(item.url);
-    if (!url || seen.has(url))
+// src/installer/cli.ts
+var exports_cli = {};
+__export(exports_cli, {
+  runInstallerCli: () => runInstallerCli,
+  resolveConfigHome: () => resolveConfigHome,
+  exitCodeForError: () => exitCodeForError
+});
+import { homedir as homedir2 } from "node:os";
+import { resolve as resolve2 } from "node:path";
+function parseFlags(args) {
+  const values = new Map;
+  const booleans = new Set;
+  const problems = [];
+  for (let i = 0;i < args.length; i += 1) {
+    const arg = args[i];
+    if (!arg.startsWith("--")) {
+      problems.push(`unexpected argument "${arg}" (flags only)`);
       continue;
-    const rerank = item.rerank_score;
-    if (typeof rerank === "number" && Number.isFinite(rerank)) {
-      if (rerank < options.minRerank)
+    }
+    const eq = arg.indexOf("=");
+    const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
+    if (BOOLEAN_FLAGS.has(name)) {
+      if (eq !== -1) {
+        problems.push(`--${name} does not accept a value; use --${name} to enable it or omit it`);
         continue;
-    } else if (options.minRerank > 0) {
+      }
+      if (booleans.has(name)) {
+        problems.push(`--${name} was given more than once`);
+        continue;
+      }
+      booleans.add(name);
       continue;
     }
-    const authority = item.authority;
-    const knownAuthority = typeof authority === "number" && Number.isFinite(authority) && authority >= 0;
-    if (knownAuthority) {
-      if (authority < options.minAuthority)
-        continue;
-    } else if (!options.allowUnknownAuthority) {
+    if (!VALUE_FLAGS.has(name)) {
+      problems.push(`unknown flag --${name}`);
       continue;
     }
-    seen.add(url);
-    const content = truncate(optionalText2(item.summary) ?? optionalText2(item.snippet) ?? "", options.maxSummaryChars);
-    const published = parsePublished(item.date);
-    const title = optionalText2(item.title);
-    results.push({
-      url,
-      ...title ? { title } : {},
-      ...content ? { content } : {},
-      ...published !== undefined ? { published } : {}
-    });
+    if (values.has(name)) {
+      problems.push(`--${name} was given more than once`);
+      continue;
+    }
+    if (eq !== -1) {
+      values.set(name, arg.slice(eq + 1));
+      continue;
+    }
+    const next = args[i + 1];
+    if (next === undefined || next.startsWith("--")) {
+      problems.push(`--${name} requires a value`);
+      continue;
+    }
+    values.set(name, next);
+    i += 1;
   }
-  return results;
-}
-function optionalText2(value) {
-  if (typeof value !== "string")
-    return;
-  const trimmed = value.trim();
-  return trimmed ? trimmed : undefined;
+  return { values, booleans, problems };
 }
-var init_search = __esm(() => {
-  init_domains();
-  init_format2();
-  init_url();
-});
-
-// src/core/transport.ts
-async function postJson(endpoint, body, operation2, opts) {
-  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-  const attempts = opts.retry.maxRetries + 1;
-  let lastError;
-  for (let attempt = 0;attempt < attempts; attempt++) {
+async function runInstallerCli(argv, io = {}) {
+  const out = io.out ?? ((line) => console.log(line));
+  const err = io.err ?? ((line) => console.error(line));
+  const [command, ...rest] = argv;
+  if (command === "version" || command === "--version") {
+    out(TOOL_VERSION);
+    return 0;
+  }
+  if (command === undefined) {
+    err(USAGE);
+    return EXIT_USAGE2;
+  }
+  if (command === "help" || command === "--help") {
+    out(USAGE);
+    return 0;
+  }
+  const flags = parseFlags(rest);
+  if (flags.problems.length > 0) {
+    for (const problem of flags.problems)
+      err(`error: ${problem}`);
+    err(`
+${USAGE}`);
+    return EXIT_USAGE2;
+  }
+  const cwd = resolve2(flags.values.get("cwd") ?? process.cwd());
+  const home = process.env.HOME ?? homedir2();
+  const platform = io.platform ?? process.platform;
+  const roots = { home, cwd, platform };
+  const configHome2 = resolveConfigHome(process.env, home, platform);
+  if (command === "list") {
+    let records;
     try {
-      return await requestOnce(endpoint, body, operation2, opts, fetchImpl);
+      records = listRecords({ ...roots, configHome: configHome2 });
     } catch (error) {
-      lastError = error;
-      if (!(error instanceof DeepSeekApiError) || !error.retryable || attempt === attempts - 1) {
-        throw error;
-      }
-      await sleep(retryDelay(error.retryAfterMs, opts.retry.baseDelayMs, attempt), opts.signal);
+      err(error instanceof Error ? error.message : String(error));
+      return 1;
     }
-  }
-  throw lastError;
-}
-async function requestOnce(endpoint, body, operation2, opts, fetchImpl) {
-  return fetchWithTimeout(endpoint, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${opts.auth.apiKey}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  }, opts.signal, opts.timeoutMs, operation2, fetchImpl, async (response) => {
-    if (!response.ok) {
-      const text2 = await readBoundedText(response, MAX_ERROR_BODY_CHARS);
-      throw new DeepSeekApiError({
-        operation: operation2,
-        status: response.status,
-        body: text2,
-        retryAfterMs: parseRetryAfter(response.headers.get("retry-after"))
-      });
+    if (records.length === 0) {
+      out("No installs recorded.");
+      return 0;
     }
-    const text = await readResponseText(response, MAX_RESPONSE_BYTES, operation2);
-    if (!text.trim())
-      throw new Error(`${operation2} returned an empty response body`);
+    if (readingLegacyGlobalRecords({ ...roots, configHome: configHome2 })) {
+      out(`Global install records are being read from the legacy ${legacyGlobalStateDir(roots)} ` + "(written before the Windows config home moved to %APPDATA%).");
+    }
+    for (const record of records) {
+      const by = record.installerVersion ? ` by v${record.installerVersion}` : "";
+      out(`${record.host} (${record.scope}) — search=${record.tiers.search}, fetch=${record.tiers.fetch}, installed ${record.createdAt}${by}`);
+      for (const file of record.files)
+        out(`  ${file.created ? "created" : "modified"} ${file.file}`);
+    }
+    return 0;
+  }
+  if (command === "config") {
+    return runConfigCommand(flags.values.get("search"), { out, err });
+  }
+  if (command === "uninstall") {
+    const required2 = requireInput(flags, cwd, home, configHome2, platform, false);
+    if (!required2.ok)
+      return usageError(required2.problems, err);
     try {
-      return JSON.parse(text);
-    } catch {
-      throw new Error(`${operation2} returned invalid JSON: ${truncate(redactSecrets(text), 500)}`);
+      for (const line of uninstall(required2.input))
+        out(line);
+      return 0;
+    } catch (error) {
+      err(error instanceof Error ? error.message : String(error));
+      return 1;
     }
-  });
-}
-async function fetchWithTimeout(endpoint, init, signal, timeoutMs, operation2, fetchImpl, handleResponse) {
-  const controller = new AbortController;
-  let timedOut = false;
-  const forwardAbort = () => controller.abort(signal.reason);
-  if (signal.aborted)
-    forwardAbort();
-  else
-    signal.addEventListener("abort", forwardAbort, { once: true });
-  const timer = signal.aborted ? undefined : setTimeout(() => {
-    timedOut = true;
-    controller.abort(new Error("timeout"));
-  }, timeoutMs);
+  }
+  if (command !== "init") {
+    err(`Unknown command "${command}".
+
+${USAGE}`);
+    return EXIT_USAGE2;
+  }
+  const required = requireInput(flags, cwd, home, configHome2, platform, true);
+  if (!required.ok)
+    return usageError(required.problems, err);
+  const { input } = required;
+  const probe = HOST_VERSION_PROBES[input.host];
+  const hostVersion = probe?.(err);
+  const plan = planForHost(input.host, hostVersion === undefined ? input : { ...input, hostVersion });
+  if (plan.errors.length > 0) {
+    for (const error of plan.errors)
+      err(`error: ${error.message}`);
+    err("Nothing was written.");
+    return 1;
+  }
+  out(renderPlan(plan));
+  if (!flags.booleans.has("apply")) {
+    out(`
+Plan only — re-run with --apply to write these changes.`);
+    return 0;
+  }
   try {
-    const response = await fetchImpl(endpoint, { ...init, signal: controller.signal });
-    return await handleResponse(response);
+    const result = applyPlan(plan, input);
+    for (const line of result.lines)
+      out(line);
+    return 0;
   } catch (error) {
-    if (timedOut)
-      throw new Error(formatTimeoutError(operation2, timeoutMs));
-    if (signal.aborted)
-      throw abortReason(signal, operation2);
-    throw error;
-  } finally {
-    if (timer !== undefined)
-      clearTimeout(timer);
-    signal.removeEventListener("abort", forwardAbort);
-  }
-}
-function parseRetryAfter(value) {
-  if (!value)
-    return;
-  const trimmed = value.trim();
-  if (!trimmed)
-    return;
-  if (/^\d+$/.test(trimmed)) {
-    return Math.min(MAX_RETRY_DELAY_MS, Number(trimmed) * 1000);
+    err(error instanceof Error ? error.message : String(error));
+    return exitCodeForError(error);
   }
-  const timestamp = Date.parse(trimmed);
-  if (!Number.isFinite(timestamp))
-    return;
-  return Math.min(MAX_RETRY_DELAY_MS, Math.max(0, timestamp - Date.now()));
-}
-function retryDelay(retryAfterMs, baseDelayMs, attempt) {
-  if (retryAfterMs !== undefined)
-    return retryAfterMs;
-  return Math.min(MAX_RETRY_DELAY_MS, baseDelayMs * 2 ** attempt);
 }
-function sleep(ms, signal) {
-  if (ms <= 0)
-    return Promise.resolve();
-  return new Promise((resolve3, reject) => {
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve3();
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(abortReason(signal, "DeepSeek request"));
-    };
-    if (signal.aborted) {
-      clearTimeout(timer);
-      reject(abortReason(signal, "DeepSeek request"));
-      return;
-    }
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
+function exitCodeForError(error) {
+  return error instanceof ApplyError && error.status === "recovery_required" ? EXIT_RECOVERY : EXIT_FAILURE;
 }
-function abortReason(signal, operation2) {
-  return signal.reason instanceof Error ? signal.reason : new Error(`${operation2} request aborted`);
+function usageError(problems, err) {
+  for (const problem of problems)
+    err(`error: ${problem}`);
+  err(`
+${USAGE}`);
+  return EXIT_USAGE2;
 }
-async function readBoundedText(response, maxChars) {
-  if (!response.body)
-    return truncate(await response.text(), maxChars + 1);
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder;
-  const limit = maxChars + 1;
-  let text = "";
-  let chars = 0;
-  try {
-    while (chars < limit) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      const chunk = decoder.decode(value, { stream: true });
-      text += chunk;
-      chars += Array.from(chunk).length;
-    }
-    text += decoder.decode();
-  } finally {
-    await reader.cancel().catch(() => {
-      return;
-    });
-    reader.releaseLock();
-  }
-  return truncate(text, limit);
+function resolveConfigHome(env, home, platform = process.platform) {
+  const xdgTrusted = env.XDG_CONFIG_HOME !== undefined && env.XDG_CONFIG_HOME !== "" && home === (env.HOME ?? "");
+  return userConfigHome({ env: xdgTrusted ? env : { ...env, XDG_CONFIG_HOME: undefined }, home, platform });
 }
-async function readResponseText(response, maxBytes, operation2) {
-  if (!response.body) {
-    const text2 = await response.text();
-    if (new TextEncoder().encode(text2).byteLength > maxBytes) {
-      throw new Error(`${operation2} response exceeded ${maxBytes} bytes`);
-    }
-    return text2;
-  }
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder;
-  let text = "";
-  let bytes = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      bytes += value.byteLength;
-      if (bytes > maxBytes) {
-        throw new Error(`${operation2} response exceeded ${maxBytes} bytes`);
-      }
-      text += decoder.decode(value, { stream: true });
+function requireInput(flags, cwd, home, configHome2, platform, needsTiers) {
+  const problems = [];
+  const host = flags.values.get("host");
+  const scope = flags.values.get("scope");
+  const search = needsTiers ? flags.values.get("search") ?? "" : "optional";
+  const fetch = needsTiers ? flags.values.get("fetch") ?? "" : "optional";
+  const path = flags.values.get("path");
+  if (host === undefined)
+    problems.push(`--host is required (one of: ${HOSTS.join(", ")})`);
+  else if (!HOSTS.includes(host))
+    problems.push(`invalid --host value "${host}" (one of: ${HOSTS.join(", ")})`);
+  if (scope === undefined)
+    problems.push(`--scope is required (one of: ${SCOPES.join(", ")})`);
+  else if (!SCOPES.includes(scope))
+    problems.push(`invalid --scope value "${scope}" (one of: ${SCOPES.join(", ")})`);
+  if (path !== undefined) {
+    if (host !== "pi") {
+      problems.push(`--path is only supported for host pi (${host ?? "no host"} has a single integration path)`);
+    } else if (!PATH_CHOICES.includes(path)) {
+      problems.push(`invalid --path value "${path}" (one of: ${PATH_CHOICES.join(", ")})`);
     }
-    text += decoder.decode();
-  } finally {
-    await reader.cancel().catch(() => {
-      return;
-    });
-    reader.releaseLock();
   }
-  return text;
-}
-var DeepSeekApiError;
-var init_transport = __esm(() => {
-  init_constants();
-  init_format2();
-  DeepSeekApiError = class DeepSeekApiError extends Error {
-    operation;
-    status;
-    body;
-    retryable;
-    retryAfterMs;
-    constructor(input) {
-      const body = redactSecrets(input.body);
-      super(formatApiError(input.operation, input.status, body));
-      this.name = "DeepSeekApiError";
-      this.operation = input.operation;
-      this.status = input.status;
-      this.body = body;
-      this.retryable = input.status === 408 || input.status === 425 || input.status === 429 || input.status >= 500 && input.status <= 599;
-      this.retryAfterMs = input.retryAfterMs;
+  if (needsTiers) {
+    if (!TIERS.includes(search)) {
+      problems.push(flags.values.has("search") ? `invalid --search value "${search}" (one of: ${TIERS.join(", ")})` : `--search is required (one of: ${TIERS.join(", ")})`);
+    }
+    if (!TIERS.includes(fetch)) {
+      problems.push(flags.values.has("fetch") ? `invalid --fetch value "${fetch}" (one of: ${TIERS.join(", ")})` : `--fetch is required (one of: ${TIERS.join(", ")})`);
+    }
+  }
+  if (home === "")
+    problems.push("HOME is not set and the user home cannot be resolved; cannot proceed");
+  if (problems.length > 0)
+    return { ok: false, problems };
+  const packageRef = flags.values.get("package") ?? "deepseek-web-retrieval";
+  return {
+    ok: true,
+    input: {
+      host,
+      scope,
+      search,
+      fetch,
+      packageRef: flags.booleans.has("pin") ? pinPackageRef(packageRef, TOOL_VERSION) : packageRef,
+      home,
+      cwd,
+      configHome: configHome2,
+      platform,
+      ...path !== undefined ? { path } : {}
     }
   };
+}
+var HOSTS, HOST_CHOICES, SCOPES, TIERS, EXIT_FAILURE = 1, EXIT_USAGE2 = 2, EXIT_RECOVERY = 3, USAGE, VALUE_FLAGS, BOOLEAN_FLAGS, PATH_CHOICES;
+var init_cli = __esm(() => {
+  init_config_file();
+  init_version();
+  init_apply();
+  init_config_command();
+  init_hosts();
+  init_ownership();
+  init_state();
+  init_uninstall();
+  HOSTS = Object.keys(HOST_PLANNERS);
+  HOST_CHOICES = `<${HOSTS.join("|")}>`;
+  SCOPES = ["project", "global"];
+  TIERS = ["optional", "preferred", "forced", "off"];
+  USAGE = `Usage:
+  deepseek-web-retrieval init --host ${HOST_CHOICES} --scope <project|global> --search <optional|preferred|forced|off> --fetch <optional|preferred|forced|off> [--path <extension|mcp>] [--package <npm ref>] [--pin] [--cwd <dir>] [--apply]
+  deepseek-web-retrieval uninstall --host ${HOST_CHOICES} --scope <project|global> [--cwd <dir>]
+  deepseek-web-retrieval list [--cwd <dir>]
+  deepseek-web-retrieval config [--search <query>]
+  deepseek-web-retrieval version
+
+init prints the full plan (every file, old value → new value) and writes nothing
+until --apply is passed. uninstall restores what the plan applied. --path picks
+the integration mechanism for hosts with more than one (Pi: extension by
+default, mcp for the stdio MCP server). --package overrides the package ref
+written into host config; the Pi extension path turns it into the packages
+source (a bare name is prefixed with npm:, a ref that already starts with npm:
+is written as-is). --pin appends the running CLI's version to the package ref
+(a ref already ending in a version keeps it), so hosts resolve that exact
+release instead of the latest publish; re-run init --pin to move the pin.
+
+config prints the effective configuration — every knob with its value and its
+source (default, shared file, or environment), resolved the way the MCP server
+resolves it — and exits 1 when the config file or the DEEPSEEK_* environment
+has problems (unknown or rejected keys, unparseable JSON, set-but-unusable
+variable values; a missing file is fine). config --search <query>
+runs one billed search through that configuration to verify the key, config,
+and network end to end; it exits 1 when the key is missing or the search fails.
+
+Exit codes: 0 success; 1 refused or failed with nothing written (a failed apply
+is fully rolled back); 2 invalid command line; 3 recovery required — a failed
+apply could not roll back completely, follow the reported guidance before
+re-running.`;
+  VALUE_FLAGS = new Set(["host", "scope", "search", "fetch", "path", "package", "cwd"]);
+  BOOLEAN_FLAGS = new Set(["apply", "pin"]);
+  PATH_CHOICES = ["extension", "mcp"];
 });
 
-// src/core/client.ts
-function effectiveTimeout(configuredMs, perCallMs) {
-  return perCallMs === undefined ? configuredMs : Math.min(configuredMs, perCallMs);
-}
-async function searchWeb(query, options, request) {
-  const trimmed = query.trim();
-  if (!trimmed)
-    throw new Error("DeepSeek search query must not be empty");
-  if (Array.from(trimmed).length > MAX_QUERY_CHARS) {
-    throw new Error(`DeepSeek search query must be ${MAX_QUERY_CHARS} characters or fewer`);
-  }
-  const builtQuery = buildQuery(trimmed, options);
-  const builtQueryLength = Array.from(builtQuery).length;
-  if (builtQueryLength > MAX_QUERY_CHARS) {
-    throw new Error(`DeepSeek search query must be ${MAX_QUERY_CHARS} characters or fewer after applying ` + `blockedDomains, includeDomains, and language ` + `(built query is ${builtQueryLength} characters)`);
-  }
-  const timeout = effectiveTimeout(options.timeoutMs, request.timeoutMs);
-  const payload = await postJson(SEARCH_ENDPOINT, {
-    query: builtQuery,
-    count: options.count,
-    need_content: false
-  }, "DeepSeek Search", { ...request, timeoutMs: timeout });
-  if (!Array.isArray(payload.results)) {
-    throw new Error("DeepSeek Search returned a response without a results array");
-  }
-  return processResults(payload.results, options);
+// src/mcp/auth.ts
+function requireApiKey(env) {
+  const apiKey = apiKeyFromEnv(env);
+  if (!apiKey)
+    throw new Error(MISSING_API_KEY_MESSAGE);
+  return apiKey;
 }
-async function fetchPage(url, options, request) {
-  const target = parseFetchUrl(url.href);
-  assertFetchHostPolicy(target, options);
-  const timeout = effectiveTimeout(options.timeoutMs, request.timeoutMs);
-  const payload = await postJson(FETCH_ENDPOINT, { url: target.href }, "DeepSeek Fetch", {
-    ...request,
-    timeoutMs: timeout
-  });
-  const title = typeof payload.title === "string" ? payload.title.trim() : "";
-  const content = typeof payload.content === "string" ? payload.content : "";
-  if (!content.trim()) {
-    throw new Error("DeepSeek Fetch returned no page content (the page may be empty or unavailable)");
+var init_auth2 = __esm(() => {
+  init_auth();
+});
+
+// src/mcp/client.ts
+import { CLIENT_INFO_META_KEY } from "@modelcontextprotocol/server";
+function clientNameOf(server, ctx) {
+  const envelope = ctx.mcpReq.envelope;
+  const name = envelope?.[CLIENT_INFO_META_KEY];
+  if (typeof name === "object" && name !== null && "name" in name && typeof name.name === "string") {
+    return name.name;
   }
-  return { url: target.href, title, content };
+  return server.server.getClientVersion()?.name;
 }
-async function fetchDocument(url, options, request) {
-  if (typeof url !== "string" && !(url instanceof URL))
-    throw new Error('"url" must be a string or URL');
-  const page = await fetchPage(url instanceof URL ? url : parseFetchUrl(url), options, request);
-  const formatted = formatFetchedContent(page.title, page.content, options.maxChars);
-  return {
-    url: page.url,
-    title: page.title,
-    content: formatted.content,
-    truncated: formatted.truncated
-  };
+function isJsonReplacingClient(name) {
+  return name !== undefined && JSON_REPLACING_CLIENT_NAMES.has(name);
 }
-function createRetrievalClient(dependencies = {}) {
-  const bind = (request) => ({ ...request, ...dependencies });
-  return {
-    searchWeb: (query, options, request) => searchWeb(query, options, bind(request)),
-    fetchPage: (url, options, request) => fetchPage(url, options, bind(request)),
-    fetchDocument: (url, options, request) => fetchDocument(url, options, bind(request))
-  };
+function omitStructuredContent(server, ctx) {
+  return isJsonReplacingClient(clientNameOf(server, ctx));
 }
-var retrievalClient;
+var JSON_REPLACING_CLIENT_NAMES;
 var init_client2 = __esm(() => {
-  init_constants();
-  init_domains();
-  init_format2();
-  init_search();
-  init_transport();
-  init_url();
-  init_transport();
-  retrievalClient = createRetrievalClient();
+  JSON_REPLACING_CLIENT_NAMES = new Set(["codex-mcp-client"]);
+});
+
+// package.json
+var package_default;
+var init_package = __esm(() => {
+  package_default = {
+    $schema: "https://json.schemastore.org/package.json",
+    name: "deepseek-web-retrieval",
+    version: "0.8.0",
+    description: "Token-efficient DeepSeek Search and Fetch for coding agents, starting with OpenCode v2.",
+    type: "module",
+    license: "MIT",
+    repository: {
+      type: "git",
+      url: "git+https://github.com/gwokhou/deepseek-web-retrieval.git"
+    },
+    homepage: "https://github.com/gwokhou/deepseek-web-retrieval#readme",
+    bugs: "https://github.com/gwokhou/deepseek-web-retrieval/issues",
+    keywords: [
+      "opencode",
+      "opencode-plugin",
+      "pi",
+      "pi-extension",
+      "deepseek",
+      "websearch",
+      "webfetch",
+      "coding-agent",
+      "mcp"
+    ],
+    exports: {
+      ".": "./index.ts",
+      "./core": "./src/core/index.ts",
+      "./mcp": "./src/mcp/server.ts",
+      "./pi": "./src/pi/extension.ts"
+    },
+    pi: {
+      extensions: [
+        "./src/pi/extension.ts"
+      ]
+    },
+    bin: {
+      "deepseek-web-retrieval": "dist/cli.js"
+    },
+    files: [
+      "index.ts",
+      "src",
+      "dist",
+      "docs",
+      "README.md",
+      "LICENSE",
+      "CHANGELOG.md",
+      "examples"
+    ],
+    scripts: {
+      lint: "biome check --error-on-warnings .",
+      clean: "bun run scripts/clean.ts",
+      "lint:ci": "biome ci --error-on-warnings .",
+      "lint:fix": "biome check --write --error-on-warnings .",
+      format: "biome format --write .",
+      typecheck: "tsc --noEmit",
+      build: "bun build src/mcp/cli.ts --target=node --format=esm --outdir=dist --external @modelcontextprotocol/server --external @modelcontextprotocol/server/stdio --external zod --external zod/v4",
+      prepublishOnly: "bun run check:release",
+      test: "bun test",
+      "test:package": "node scripts/test-package.mjs",
+      "test:e2e:keyless": "bun run test:e2e pi pi-extension installer reinit upgrade pkg capability-off",
+      "check:release": "bun run check && bun run test:package && bun run test:e2e:keyless",
+      "test:e2e": "bun run test/e2e/run.ts",
+      "docs:matrix": "bun run scripts/render-matrix.ts",
+      "test:coverage": "bun test --coverage",
+      check: "bun run lint && bun run typecheck && bun run docs:matrix --check && bun run build && bun test"
+    },
+    peerDependencies: {
+      "@earendil-works/pi-ai": "^1.3.0",
+      "@earendil-works/pi-coding-agent": "^1.3.0",
+      "@opencode/plugin": "^2.0.32"
+    },
+    peerDependenciesMeta: {
+      "@earendil-works/pi-ai": {
+        optional: true
+      },
+      "@earendil-works/pi-coding-agent": {
+        optional: true
+      },
+      "@opencode/plugin": {
+        optional: true
+      }
+    },
+    devDependencies: {
+      "@biomejs/biome": "2.5.15",
+      "@earendil-works/pi-ai": "1.3.0",
+      "@earendil-works/pi-coding-agent": "1.3.0",
+      "@modelcontextprotocol/client": "^2.3.1",
+      "@opencode/plugin": "2.0.32",
+      "@types/bun": "1.4.0",
+      "@types/node": "^26.6.5",
+      typescript: "5.9.3"
+    },
+    engines: {
+      bun: ">=1.3.0",
+      node: ">=20"
+    },
+    dependencies: {
+      "@modelcontextprotocol/server": "^2.3.1",
+      "jsonc-parser": "^3.3.1",
+      "smol-toml": "^1.9.1",
+      zod: "^4"
+    }
+  };
 });
 
 // src/core/descriptions.ts
-var FETCH_SERVICE_LIMITS = "DeepSeek does not render JavaScript and cannot reach private networks; PDFs, images, and other binary files are unsupported.", FETCH_OUTPUT_TRUNCATED = "Output is truncated to the configured size.", SEARCH_RANKED_FILTERED = "Results are ranked by relevance and source authority, deduplicated by URL, and capped at the configured maximum.", SEARCH_EMPTY_IS_NORMAL = "An empty result list is normal, not an error.", SEARCH_QUERY_OPERATORS = "Use site:/-site: operators in the query to include or exclude domains; the full query must stay within 128 characters.", SEARCH_TOOL_DESCRIPTION, FETCH_TOOL_DESCRIPTION, SEARCH_QUERY_PARAMETER = "Search query, 128 characters or fewer including operators (site:, -site:, quoted phrases, lang:).", FETCH_URL_PARAMETER = "Absolute http:// or https:// URL to fetch. Credentials are rejected.";
+var FETCH_SERVICE_LIMITS = "DeepSeek does not render JavaScript and cannot reach private networks; PDFs, images, and other binary files are unsupported.", FETCH_OUTPUT_TRUNCATED = "Output is truncated to the configured size.", SEARCH_RANKED_FILTERED = "Results are ranked by relevance and source authority, deduplicated by URL, and capped at the configured maximum.", SEARCH_EMPTY_IS_NORMAL = "An empty result list is normal, not an error.", SEARCH_QUERY_OPERATORS = "Use site:/-site: operators in the query to include or exclude domains, and after:/before: with a year or date (e.g. after:2025-06-01) to filter by publish time; the full query must stay within 128 characters.", SEARCH_TOOL_DESCRIPTION, FETCH_TOOL_DESCRIPTION, SEARCH_QUERY_PARAMETER = "Search query, 128 characters or fewer including operators (site:, -site:, quoted phrases, lang:, after:, before:).", SEARCH_ORI_QUESTION_PARAMETER, FETCH_URL_PARAMETER = "Absolute http:// or https:// URL to fetch. Credentials are rejected.";
 var init_descriptions = __esm(() => {
   SEARCH_TOOL_DESCRIPTION = "Search the web with DeepSeek's in-house search engine and return a short, filtered result " + "list (title, URL, summary). " + `${SEARCH_RANKED_FILTERED} ` + `${SEARCH_EMPTY_IS_NORMAL} ` + `${SEARCH_QUERY_OPERATORS} ` + "To read a full page, pass a result URL to the deepseek_fetch tool.";
   FETCH_TOOL_DESCRIPTION = "Fetch one web page as clean Markdown through DeepSeek's Fetch API. " + `${FETCH_SERVICE_LIMITS} ` + `${FETCH_OUTPUT_TRUNCATED}`;
+  SEARCH_ORI_QUESTION_PARAMETER = "The user's original question or task that triggered this search, in the user's own words rather than a " + "reformulated query. Optional; 1-128 characters, and longer values are truncated.";
 });
 
 // src/mcp/server.ts
@@ -5624,10 +6229,13 @@ function createDeepSeekServer(config, env = process.env, client = retrievalClien
       description: SEARCH_TOOL_DESCRIPTION,
       inputSchema: SEARCH_INPUT,
       annotations: { readOnlyHint: true }
-    }, async ({ query }, ctx) => {
+    }, async ({ query, original_question }, ctx) => {
       try {
         const request = requestContext(config, env, ctx.mcpReq.signal);
-        const results = await client.searchWeb(query, config.search, request);
+        const results = await client.searchWeb(query, config.search, {
+          ...request,
+          oriQuestion: original_question
+        });
         return callResult(server, ctx, formatSearchResults(results), {
           results: results.map(toStructuredResult)
         });
@@ -5679,14 +6287,15 @@ function toErrorResult(error) {
 var MCP_SERVER_NAME = "deepseek-web-retrieval", SEARCH_INPUT, FETCH_INPUT;
 var init_server = __esm(() => {
   init_package();
-  init_client2();
+  init_client();
   init_constants();
   init_descriptions();
   init_format2();
   init_auth2();
-  init_client();
+  init_client2();
   SEARCH_INPUT = z2.object({
-    query: z2.string().min(1).describe(SEARCH_QUERY_PARAMETER)
+    query: z2.string().min(1).describe(SEARCH_QUERY_PARAMETER),
+    original_question: z2.string().optional().describe(SEARCH_ORI_QUESTION_PARAMETER)
   });
   FETCH_INPUT = z2.object({
     url: z2.string().min(1).describe(FETCH_URL_PARAMETER)
@@ -5705,7 +6314,7 @@ function serveMcp() {
     console.error(MISSING_API_KEY_MESSAGE);
     process.exit(1);
   }
-  const config = resolveEnvOptions(env);
+  const config = resolveEnvOptions(env, sharedFileOptions({ env }));
   const precheck = servePrecheck(config);
   if (precheck) {
     console.error(precheck);
@@ -5726,14 +6335,19 @@ function serveMcp() {
     config.fetch.enabled ? `fetch (max ${config.fetch.maxChars} chars)` : null
   ].filter(Boolean).join(", ");
   console.error(`deepseek-web-retrieval MCP server on stdio (${tools})`);
+  const deviations = configDeviations(config);
+  if (deviations)
+    console.error(`config: ${deviations}`);
   process.on("SIGINT", () => void handle.close());
   process.on("SIGTERM", () => void handle.close());
 }
 var init_serve = __esm(() => {
   init_auth();
+  init_config_file();
+  init_config_summary();
   init_env();
   init_auth2();
-  init_client();
+  init_client2();
   init_server();
 });