deepseek-web-retrieval 0.7.0 → 0.8.0

package/docs/configuration.md

@@ -0,0 +1,109 @@
+# Configuration guide
+
+The one reference for how every knob resolves on every host: the layering
+chain, the shared config file, the full knob vocabulary, and which layer to set.
+Behavior (what search and fetch do) lives in the README's
+[General behavior](../README.md#general-behavior); per-host mechanics (output
+caps, deadlines, how the environment reaches a stdio server) live in the host
+guides: [Codex](agents/codex.md), [Claude Code](agents/claude-code.md),
+[Pi](agents/pi.md),
+[OpenCode](agents/opencode-v2.md).
+
+## The resolution chain
+
+Every knob resolves through one chain, low → high, identically on every host:
+
+```
+built-in defaults  <  shared config file  <  DEEPSEEK_* environment  <  host-native config
+```
+
+A higher layer always wins, so nothing already configured loses effect. The
+host-native layer means OpenCode's plugin options (`opencode.jsonc`), Pi's
+`deepseekWebRetrieval` settings namespace, and — for MCP hosts — the per-server
+`env` block in the host's registration (that block is how an environment
+variable arrives, not a fifth layer).
+
+## The shared config file
+
+`$XDG_CONFIG_HOME/deepseek-web-retrieval/config.json` when `XDG_CONFIG_HOME` is
+set (this wins on every platform, Windows included); otherwise
+`~/.config/deepseek-web-retrieval/config.json` on Linux and macOS and
+`%APPDATA%\deepseek-web-retrieval\config.json` on Windows. camelCase keys:
+
+```json
+{
+  "count": 20,
+  "blockedDomains": ["pinterest.com"],
+  "language": "zh",
+  "searchLocalization": "203.0.113.7"
+}
+```
+
+Unknown keys and host-integration keys (below) draw a one-line stderr warning
+and are otherwise ignored — a bad file never blocks startup. The API key never
+goes in the file; it keeps its existing channels (`DEEPSEEK_API_KEY` in the
+environment, or OpenCode's stored credential).
+
+## Knob classes
+
+| Knob class | Shared file | Examples |
+| --- | --- | --- |
+| API behavior — the user↔DeepSeek relationship | yes — that is the point of the file | `count`, `blockedDomains`, `language`, `maxRetries` |
+| Host-sensitive — interacts with host output caps and deadlines | carries the safe defaults; a host layer is the recommended override point | `searchTimeoutMs`, `fetchTimeoutMs`, `fetchMaxChars`, `maxSummaryChars` |
+| Host integration — the host's tool landscape | rejected — warned about and ignored | `searchEnabled`, `setDefaultWebsearch`, `apiKeySource` |
+
+Keep host-independent intent in the shared file; prefer a host layer when a
+host-sensitive knob would cross its host's cap or deadline.
+
+## The knob vocabulary
+
+One knob, two names: the camelCase key for the shared file and OpenCode's
+options, the `DEEPSEEK_*` variable for the environment. The table generates
+from the same config vocabulary the adapters resolve through, so it cannot
+drift from the code (`bun run docs:matrix` regenerates it; CI checks it).
+
+<!-- generated: knob-table — edit src/core/config-summary.ts or env.ts, then run `bun run docs:matrix` -->
+
+| File / OpenCode key | Environment | Default |
+| --- | --- | --- |
+| `count` | `DEEPSEEK_SEARCH_COUNT` | 10 |
+| `maxResults` | `DEEPSEEK_SEARCH_MAX_RESULTS` | follows `count` (10) |
+| `minRerank` | `DEEPSEEK_SEARCH_MIN_RERANK` | 0 |
+| `minAuthority` | `DEEPSEEK_SEARCH_MIN_AUTHORITY` | 0 |
+| `allowUnknownAuthority` | `DEEPSEEK_SEARCH_ALLOW_UNKNOWN_AUTHORITY` | true |
+| `blockedDomains` | `DEEPSEEK_SEARCH_BLOCKED_DOMAINS` | unset |
+| `includeDomains` | `DEEPSEEK_SEARCH_INCLUDE_DOMAINS` | unset |
+| `language` | `DEEPSEEK_SEARCH_LANGUAGE` | unset |
+| `searchLocalization` | `DEEPSEEK_SEARCH_LOCALIZATION` | unset |
+| `maxSummaryChars` | `DEEPSEEK_SEARCH_MAX_SUMMARY_CHARS` | 1200 |
+| `searchTimeoutMs` | `DEEPSEEK_SEARCH_TIMEOUT_MS` | 30000 |
+| `fetchMaxChars` | `DEEPSEEK_FETCH_MAX_CHARS` | 16000 |
+| `fetchAllowedDomains` | `DEEPSEEK_FETCH_ALLOWED_DOMAINS` | unset |
+| `fetchBlockedDomains` | `DEEPSEEK_FETCH_BLOCKED_DOMAINS` | unset |
+| `fetchTimeoutMs` | `DEEPSEEK_FETCH_TIMEOUT_MS` | 30000 |
+| `fetchBlockPrivateHosts` | `DEEPSEEK_FETCH_BLOCK_PRIVATE_HOSTS` | true |
+| `maxRetries` | `DEEPSEEK_MAX_RETRIES` | 2 |
+| `retryBaseDelayMs` | `DEEPSEEK_RETRY_BASE_DELAY_MS` | 250 |
+
+<!-- /generated: knob-table -->
+
+## Special semantics
+
+- **`maxResults` follows `count`** when left unset — configure only `count` and
+  the cap moves with it. An explicit `maxResults` still caps; `count` never
+  follows `maxResults`.
+- **Some switches are false-only.** `allowUnknownAuthority`,
+  `fetchBlockPrivateHosts`, `searchEnabled`, and `fetchEnabled` are on by
+  default; the environment can only turn them off (`false`, `0`, `no`, or
+  `off`). The last two have no file key — they are host-integration keys — so
+  they exist only as `DEEPSEEK_ENABLE_SEARCH` and `DEEPSEEK_ENABLE_FETCH`. A
+  value like `=true` changes nothing.
+- **Invalid environment values are dropped** at startup and the default
+  applies. `npx deepseek-web-retrieval config` reports every dropped or
+  unknown `DEEPSEEK_*` variable as a warning and exits 1, alongside file
+  problems.
+- **`searchLocalization` must be a valid IPv4 or IPv6 address**; anything else
+  is dropped at option resolution. It is deployment-level configuration, never
+  a per-call tool parameter.
+- **Domains** in the environment are comma-separated; entries that are not
+  domains are dropped (and reported by `config`).

package/docs/design/installer-design.md

@@ -1,13 +1,13 @@
 # Installer design
 
 Design note for the install-time flow, shipped as the `deepseek-web-retrieval init`,
-`uninstall`, and `list` subcommands for **OpenCode, Pi, and Codex**. It records how the
-[control tiers](../research/control-matrix.md) map to the artifacts the installer emits, so
-the design survives between conversations. Research backing lives in
+`uninstall`, and `list` subcommands for **OpenCode, Pi, Codex, and Claude Code**. It records how the
+[control tiers](../research/control-matrix.md) map to the artifacts the installer emits, so the design
+survives between conversations. Research backing lives in
 [control-matrix.md](../research/control-matrix.md); host facts in [hosts.jsonc](../hosts.jsonc).
 Remaining hosts get host modules here as their guides ship.
 Examples involving other hosts describe design requirements for future modules;
-the current CLI accepts only the three shipped hosts above.
+the current CLI accepts only the four shipped hosts above.
 
 ## Principles
 
@@ -44,9 +44,9 @@ already exists, and the installer uses three phases:
    Report the conflict surface: existing rules steering toward another web tool; other
    web-capable MCP servers already on the field; array-valued keys the plan must merge
    into rather than replace (`disabledTools`, `permissions.deny`, permissions
-   `exclude`, `disabled_tools`); and higher layers (Claude Code managed policy, Devin
-   enterprise team settings) that would outrank what the
-   installer writes.
+   `exclude`, `disabled_tools`); and higher layers (Claude Code managed policy — its
+   existence is checked by the claude-code module; Devin enterprise team settings) that
+   would outrank what the installer writes.
 2. **Merge or snapshot.** Array keys merge with existing entries, recording exactly
    which entries the installer appended; single-value keys (`websearch.provider`, Pi's
    `exposure`) snapshot the prior value before overwriting; files the installer creates
@@ -71,7 +71,9 @@ already exists, and the installer uses three phases:
   competitor, not third-party web MCP servers — those must be excluded too (the
   per-host keys cover them), or routing is not actually forced. Concretely: Pi's
   per-server `enabled` key lets the plan disable detected web-capable competitors
-  (each prior value snapshotted for uninstall); Codex has no per-server kill switch,
+  (each prior value snapshotted for uninstall); Claude Code excludes them the same way
+  via server-level `mcp__<server>` deny rules appended to `permissions.deny`; Codex has
+  no per-server kill switch,
   so a detected web-capable competitor makes the plan refuse the tier instead of
   promising non-exclusive routing; OpenCode's forced is replacement, which no
   third-party server overrides. Detection classifies a server web-capable from its
@@ -156,9 +158,9 @@ the artifacts below name the path where they differ.
 | Optional | Host config registering the integration: Pi's extension path appends an `npm:<package>` source to `packages` in settings.json; the MCP paths register the server (Pi's MCP entry needs `"exposure": "direct"`; the extension path needs nothing — extension tools are `direct` by Pi's own default) |
 | Preferred | The above plus a rules file for the host (file names per host in the [per-host reference](../research/control-matrix.md#per-host-reference)); the rules name the path's tool ids (`deepseek_web_search` for the extension, `mcp__deepseek__deepseek_web_search` for MCP) |
 | Forced (replacement) | OpenCode plugin options (`setDefaultWebsearch` / `fetchOverrideWebfetch`) |
-| Forced (exclusion) | The built-in competitor's kill switch (per-host keys in the per-host reference), plus the exclusion of any other web-capable MCP servers the detect phase found — Pi sets their `enabled` key to `false`; Codex, lacking a per-server kill switch, refuses the tier instead; Pi's extension path additionally refuses when a web-capable `packages`/`extensions` source is listed in settings.json (no per-package kill switch exists) |
+| Forced (exclusion) | The built-in competitor's kill switch (per-host keys in the per-host reference), plus the exclusion of any other web-capable MCP servers the detect phase found — Pi sets their `enabled` key to `false`; Claude Code appends server-level `mcp__<server>` deny rules to `permissions.deny` (merging with the user's own entries); Codex, lacking a per-server kill switch, refuses the tier instead; Pi's extension path additionally refuses when a web-capable `packages`/`extensions` source is listed in settings.json (no per-package kill switch exists) |
 | Forced (de-facto) | Nothing beyond the Optional artifacts — no competitor exists |
-| Off | Codex writes the capability's raw tool name into the server entry's `disabled_tools` (host-native: the tool leaves the model's context; the user's own entries in that array are kept); the other MCP entry writes the capability's false-only server-side switch instead (`DEEPSEEK_ENABLE_SEARCH` / `DEEPSEEK_ENABLE_FETCH`); Pi's extension path writes the same switches into the `deepseekWebRetrieval` settings namespace the extension reads at load; both capabilities off refuses to install |
+| Off | Codex writes the capability's raw tool name into the server entry's `disabled_tools` (host-native: the tool leaves the model's context; the user's own entries in that array are kept); Claude Code appends the capability's full tool id (`mcp__deepseek__*`) to `permissions.deny`, the same host-native removal; the other MCP entry writes the capability's false-only server-side switch instead (`DEEPSEEK_ENABLE_SEARCH` / `DEEPSEEK_ENABLE_FETCH`); Pi's extension path writes the same switches into the `deepseekWebRetrieval` settings namespace the extension reads at load; both capabilities off refuses to install |
 
 OpenCode additionally appends `permissions` allow entries for exactly the tools it
 registers (`websearch`, `deepseek_fetch`, and `webfetch` when fetch is forced), merged
@@ -194,8 +196,9 @@ into any existing `permissions` array rather than replacing it.
   reverts cannot re-enable a still-excluded competitor.
 - Verify is file-level: after apply it re-reads each written file and asserts every op
   holds (set values in place, appended entries present, rules block present). Higher
-  layers would be a plan-time detect concern, and none of the three shipped hosts
-  documents a layer above user config, so there is nothing to check there yet.
+  layers are a plan-time detect concern; Claude Code documents one (managed policy), and
+  the claude-code module reports an existing managed-settings.json instead of failing
+  silently. The other shipped hosts document no layer above user config.
 - Only a bare `--apply` enables writes; assigning a value such as `--apply=false`
   is a usage error and writes nothing.
 - `--pin` is opt-in version pinning: the ref written into host config gets the
@@ -224,7 +227,7 @@ host-side tool filtering.
 
 ## Hosts without an installer story
 
-Claude Code, Cursor, Devin, GitHub Copilot, and Cline still have no
+Cursor, Devin, GitHub Copilot, and Cline still have no
 host module; their artifacts (from the tier-to-artifact mapping) remain hand-edited
 config until a module lands here. OpenCode's `opencode plugin add` remains available but
 cannot pass options or manage snapshots; `init` supersedes it for tiered installs.

package/docs/hosts.jsonc

@@ -102,11 +102,15 @@
       "nativeSearchProvider": false,
       "nativeFetchOverride": false,
       "paths": ["mcp"],
-      "status": "no-adapter-yet",
+      "status": "supported",
       "control": {
         "search": { "optional": "yes", "preferred": "yes", "forced": "exclusion", "key": "`permissions.deny: [\"WebSearch\"]` removes the tool from context" },
         "fetch": { "optional": "yes", "preferred": "yes", "forced": "exclusion", "key": "`permissions.deny: [\"WebFetch\"]`, or `CLAUDE_CODE_DISABLE_WEB_FETCH=1`" }
       },
+      "adapter": "src/mcp",
+      "installer": "src/installer/hosts/claude-code",
+      "guide": "docs/agents/claude-code.md",
+      "e2eScenario": "claude-code"
     },
     {
       "name": "cursor",

package/docs/integration.md

@@ -17,7 +17,7 @@ ship built-in web tools. MCP tools can add equivalent tools, but do not replace
 | Native tool / fetch override | No | Yes | Host tool API | OpenCode v2 adapter |
 | Custom tool plugin | Yes | Yes | Host plugin API | Cline CLI/SDK; no adapter yet |
 | Extension API | Yes | Yes | Host extension API | Pi adapter (`src/pi/`) |
-| MCP server | Yes | Yes | Host MCP client | Shipped (`src/mcp/`; Pi and Codex guides) |
+| MCP server | Yes | Yes | Host MCP client | Shipped (`src/mcp/`; Pi, Codex, and Claude Code guides) |
 | CLI/HTTP wrapper | Yes | Yes | Host can call external tools | Not shipped |
 
 MCP is a protocol, not an agent. It is one possible transport for hosts that support MCP
@@ -35,7 +35,7 @@ Rows are sorted with open-source hosts first, then by host name alphabetically.
 | Codex | 0.163.0 | Yes (Apache-2.0) | No | No | MCP server | Supported |
 | OpenCode | 2.0.32 | Yes (MIT) | Yes | Yes | native websearch provider or native tool/fetch override | Supported |
 | Pi | 1.3.0 | Yes (MIT) | No | No | extension API or MCP server | Supported |
-| Claude Code | 2.1.303 | No | No | No | MCP server | No adapter yet |
+| Claude Code | 2.1.303 | No | No | No | MCP server | Supported |
 | Cursor | 2026.10.08 | No | No | No | MCP server | No adapter yet |
 | Devin | 3000.11.92 | No | No | No | MCP server | No adapter yet |
 | GitHub Copilot | 1.0.98 | No | No | No | MCP server | No adapter yet |
@@ -48,7 +48,7 @@ Codex are Apache-2.0; OpenCode and Pi are MIT. Claude Code and
 Cursor are proprietary. GitHub Copilot CLI and Devin CLI publish installers and docs, not
 source code, under proprietary terms.
 
-OpenCode, Pi, and Codex have supported setup guides and installer host modules. The
+OpenCode, Pi, Codex, and Claude Code have supported setup guides and installer host modules. The
 MCP server in `src/mcp/` provides a possible stdio path for the remaining hosts, but
 protocol compatibility alone does not establish a tested host setup. For those rows,
 `No adapter yet` means no supported host-specific adapter or setup guide is shipped.
@@ -66,8 +66,10 @@ the details: built-in web tools and their kill switches, MCP registration, and r
 - **OpenCode v2** — Uses OpenCode's native plugin API and
   exposes both a websearch provider and a fetch tool/override. See
   [OpenCode v2](agents/opencode-v2.md).
-- **Claude Code** — Ships built-in `WebSearch` and `WebFetch` tools. See
-  [Claude Code](research/control-matrix.md#claude-code).
+- **Claude Code** — Ships built-in `WebSearch` and `WebFetch` tools. Supported through
+  the MCP server; see
+  [Claude Code](agents/claude-code.md) and
+  [Claude Code in the per-host reference](research/control-matrix.md#claude-code).
 - **Codex** — Ships a built-in `web_search` tool. Supported through the MCP server; see
   [Codex](agents/codex.md) and [Codex in the per-host reference](research/control-matrix.md#codex).
 - **Cursor** — Uses the same `mcp.json` servers as the editor; ships built-in web search
@@ -119,7 +121,8 @@ Code importing the core's removed `formatFetchContent` helper must migrate to
 ## Available paths and future hosts
 
 - **MCP server** — shipped in `src/mcp/` (the fallback path in the [Pi](agents/pi.md) guide
-  and the path in the [Codex](agents/codex.md) guide); the broadest route for hosts that
+  and the path in the [Codex](agents/codex.md) and
+  [Claude Code](agents/claude-code.md) guides); the broadest route for hosts that
   support MCP tools. Protocol compatibility across these hosts is researched in
   [mcp-compatibility.md](research/mcp-compatibility.md).
 - **Native extension adapters** — the Pi extension adapter ships in `src/pi/`; a host whose

package/docs/research/control-matrix.md

@@ -71,8 +71,9 @@ Reading notes:
 One section per host, in hosts.jsonc order. Each carries what an install needs beyond the
 matrix: the built-in competitors, their kill switches, how the MCP server is registered,
 and which rules files steer preference. The `init` CLI implements these tiers for
-OpenCode, Pi, and Codex (see [installer design](../design/installer-design.md)). Config
-paths imply the available scopes; keys locked to a single scope are enumerated in the
+OpenCode, Pi, Codex, and Claude Code (see
+[installer design](../design/installer-design.md)). Config paths imply the available
+scopes; keys locked to a single scope are enumerated in the
 [installer design](../design/installer-design.md#scope).
 
 ### Cline
@@ -209,15 +210,31 @@ paths imply the available scopes; keys locked to a single scope are enumerated i
 - **Built-in web tools** — `WebSearch` and `WebFetch`. Kill switch: bare deny rules —
   `"permissions": {"deny": ["WebSearch", "WebFetch"]}` — remove the tools from the model's
   context entirely; deny outranks allow at every settings level and cannot be carved out.
-  `--disallowedTools` is the flag form. `CLAUDE_CODE_DISABLE_WEB_FETCH=1` (2.1.285+) kills
-  WebFetch only; there is no env equivalent for WebSearch
+  Permission rules live in the settings file of each level: managed
+  `managed-settings.json` (Linux `/etc/claude-code/`, macOS
+  `/Library/Application Support/ClaudeCode/`, Windows
+  `C:\Program Files\ClaudeCode\` — the legacy `C:\ProgramData\ClaudeCode\` path
+  is not read) →
+  user `~/.claude/settings.json` → project `.claude/settings.json` → local
+  `.claude/settings.local.json`; the installer writes the chosen scope's settings file
+  and reports an existing managed layer. A bare `mcp__<server>` rule denies every tool
+  of one MCP server — the per-server kill switch the installer uses for web-capable
+  competitors under the forced tier. `--disallowedTools` is the flag form.
+  `CLAUDE_CODE_DISABLE_WEB_FETCH=1` (2.1.285+) kills WebFetch only; there is no env
+  equivalent for WebSearch
   ([tools](https://code.claude.com/docs/en/tools),
-  [permissions](https://code.claude.com/docs/en/permissions)).
-- **MCP registration** — `.mcp.json` (`mcpServers` with `command`/`args`/`env`, or
-  `type: "http"` + `url`); `${VAR}` expansion in `command`/`args`/`env`/`url`/`headers`.
-  Tool permission rules use `mcp__<server>__<tool>`. Tool descriptions are capped at 4,096
+  [permissions](https://code.claude.com/docs/en/permissions),
+  [settings](https://code.claude.com/docs/en/settings)).
+- **MCP registration** — three scopes across two files: project `.mcp.json` at the
+  project root (team-shared, first-use approval prompt per project), local scope under
+  the project's entry in `~/.claude.json` (private, the `claude mcp add` default), and
+  user scope at the top-level `mcpServers` key of `~/.claude.json` (`--scope user`).
+  Entries take `mcpServers` with `command`/`args`/`env`, or `type: "http"` + `url`;
+  `${VAR}` expansion in `command`/`args`/`env`/`url`/`headers`. Tool permission rules
+  use `mcp__<server>__<tool>`. Tool descriptions are capped at 4,096
   chars (2.1.296+) and tool output at 25k tokens by default (`MAX_MCP_OUTPUT_TOKENS`),
-  with oversized text saved to a file; 16 MiB message cap on HTTP transports.
+  with oversized text saved to a file; 16 MiB message cap on HTTP transports
+  ([MCP quickstart](https://code.claude.com/docs/en/mcp-quickstart)).
 - **Rules** — `CLAUDE.md` hierarchy (managed → user `~/.claude/CLAUDE.md` → project →
   `CLAUDE.local.md`) with `@import`; `AGENTS.md` is read instead only when no CLAUDE.md
   exists anywhere above the cwd (since 2.1.277)
@@ -303,3 +320,11 @@ paths imply the available scopes; keys locked to a single scope are enumerated i
   `toolPolicies`). Codex's docs location and Copilot's `GEMINI.md` dating were re-verified
   2026-10-21 and are settled in their sections above. Protocol-revision evidence for every
   host lives in [mcp-compatibility.md](mcp-compatibility.md).
+- **Claude Code forward-compat anchors (checked at the 2.1.303 lock):** the headless docs
+  pre-announce `--bare` becoming the default for `-p`, and bare mode never reads
+  `.mcp.json` — the billed e2e scenario and the project-scope install story both need
+  re-checking when that lands. `${VAR}` expansion in the `env` block of a user-scope
+  `~/.claude.json` entry is supported but only indirectly documented (the docs spell out
+  `.mcp.json` and `command`/`args`; the e2e's `hasCompletedOnboarding` flag and the
+  redundant `enableAllProjectMcpServers` belt-and-suspenders are undocumented), so a
+  baseline bump should re-verify all three against the then-current docs.

package/docs/research/mcp-compatibility.md

@@ -82,7 +82,7 @@ host facts; each row below was verified against that lock on the research baseli
 | Cline | `2024-11-05` | stdio, Streamable HTTP, SSE | Custom client (no official SDK); `protocolVersion "2024-11-05"` extracted from the platform binary; source repo not public |
 | Codex | `2025-06-18`; `mcp_2026_07_28` feature flag opts into `2026-07-28` | stdio, Streamable HTTP (no SSE) | Git tag `rust-v0.163.0`: rmcp 3.5.1 pinned; initialize sends `V_2025_06_18` |
 | Pi | `2025-11-25` | stdio, Streamable HTTP (SSE rejected) | Git tag: own `@earendil-works/pi-mcp` client, `LATEST_PROTOCOL_VERSION "2025-11-25"` |
-| Claude Code | `2026-07-28` by default (`MCP_PROTOCOL_NEGOTIATION=legacy` opt-out) | stdio, Streamable HTTP, SSE, ws | Changelog 2.1.296+: "negotiate MCP protocol version 2026-07-28 by default"; docs: TS SDK 2.0 runtime |
+| Claude Code | `2026-07-28` by default (`MCP_PROTOCOL_NEGOTIATION=legacy` opt-out) | stdio, Streamable HTTP, SSE, ws | Docs: the v2 runtime (TS SDK 2.0) defaults from 2.1.274+ without flag fetching and "asks stdio servers for that revision by default"; changelog 2.1.299 extended the default to cloud session and Remote Control connectors |
 | Cursor | Unpinnable from primary sources (docs show ≥ `2025-06-18` features) | stdio, Streamable HTTP, SSE | Docs feature set only; no revision stated in docs or changelog |
 | Devin | `2026-07-28` | stdio, Streamable HTTP (SSE fallback), SSE | Changelog for the locked release itself: "Support for MCP protocol revision 2026-07-28" |
 | GitHub Copilot | `2026-07-28` | stdio (`type: "local"`), Streamable HTTP, SSE | Changelog 1.0.81: "Ship MCP 2026-07-28 support to CLI, SDK, IDE, and in-memory clients" |
@@ -128,7 +128,7 @@ differences:
    Codex and Pi reject it anyway.
 3. **Build on the official SDK v2 dual-era serving.** One build then serves the full range:
    the `2024-11-05` floor set by Cline (v2 legacy support spans `2024-10-07`–`2025-11-25`)
-   up to the `2026-07-28` negotiators (Claude Code 2.1.296+, Devin 3000.11.92, Copilot CLI
+   up to the `2026-07-28` negotiators (Claude Code 2.1.274+, Devin 3000.11.92, Copilot CLI
    1.0.81+). A v1.x-built server still works today — modern clients fall back to the legacy
    handshake — but it can never offer the stateless era; v2 serves both from one entry
    point.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "deepseek-web-retrieval",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Token-efficient DeepSeek Search and Fetch for coding agents, starting with OpenCode v2.",
   "type": "module",
   "license": "MIT",

package/src/core/env.ts

@@ -40,18 +40,21 @@ const FALSE_ONLY_ENV = {
   fetchEnabled: ENABLE_FETCH_ENV,
 } as const;
 
+/** Every option key mapped onto its `DEEPSEEK_*` variable — the inverse view of the maps above. */
+export const OPTION_ENV_BY_KEY: Readonly<Record<string, string>> = {
+  ...NUMBER_ENV,
+  ...TEXT_ENV,
+  ...DOMAINS_ENV,
+  ...FALSE_ONLY_ENV,
+};
+
 /**
  * Every option's `DEEPSEEK_*` variable name, in map order — the names a host that
  * isolates its children from the parent environment (Codex) must forward for
  * shell-set options to reach the server. `DEEPSEEK_API_KEY` is deliberately
  * absent: it is not an option variable, and installers compose it separately.
  */
-export const OPTION_ENV_VARS: readonly string[] = [
-  ...Object.values(NUMBER_ENV),
-  ...Object.values(TEXT_ENV),
-  ...Object.values(DOMAINS_ENV),
-  ...Object.values(FALSE_ONLY_ENV),
-];
+export const OPTION_ENV_VARS: readonly string[] = Object.values(OPTION_ENV_BY_KEY);
 
 /**
  * Maps `DEEPSEEK_*` environment variables onto the shared plugin option keys and