dsh-free-search 0.9.13 → 0.9.15

package/README.md

@@ -32,12 +32,12 @@ dsh 默认的搜索 provider 依赖 DeepSeek 官方 API key（`DEEPSEEK_API_KEY`
 - **多引擎可选**：DuckDuckGo（html/lite）、Bing、SearXNG（元搜索，支持自定义实例）、AnySearch、Exa、Tavily、Keenable、Firecrawl、Parallel、Perplexity、SerpBase、Serply、DeepSeek 官方、DeepSeek 原生搜索 API、You.com、百度千帆、Kimi、阿里云百炼、火山联网搜索（豆包搜索）、知乎全网/站内（`zhihu_global`/`zhihu_site`，经知乎开放平台 MCP）、OpenAI / Gemini / Claude 模型内置搜索
 - **网页设置页** —— 引擎切换 + API key 配置（UI 中 key 脱敏显示"已配置"）+ 中英文切换；入口在左侧「插件」页的组件行配置（`plugins.row.config`，DSH 0.1.7-rc.1+）。远程访问（VPS / 反向代理 / 自定义域名）下也能用：桥接接口沿用宿主的 Host 围栏，`--trusted-host` 与 `--public-url` 声明的地址会放行（#84）
 - **右侧浮动目录** —— 卡片右侧的页面留白里浮出「引擎 / 回退 / 语言池 / 搜索行为 / 抓取 / 性能」六个快捷跳转，滚动自动高亮当前项、点击平滑跳转；不占用正文宽度（正文布局与 0.9.6 一致），右侧留白不足时自动隐藏
-- **多 key 轮换** —— 任何 key 字段（或对应环境变量）都可以用逗号 / 分号 / 换行分隔多把 key；遇到 401/402/429（鉴权失败、额度耗尽）先轮换同一引擎的下一把，再走引擎回退
+- **多 key 轮换** —— 任何 key 字段（或对应环境变量）都可以用逗号 / 分号 / 换行分隔多把 key；遇到 401/402/429（鉴权失败、额度耗尽）先轮换同一引擎的下一把，再走引擎回退
 - **弹出式切换命令** —— 聊天框输入 `/free-search-engine`，弹出引擎选择窗口，点选即切换（等效设置页 + 保存）
 - **引擎测试** —— `free_search_test` 工具让 agent 一键测试所有引擎；设置页也有"测试引擎"按钮（直测当前引擎，不走回退链，付费引擎无 key 会明确报错）
 - **全局引擎开关与回退优先级** —— 设置页可勾选/取消引擎（取消后全局生效：普通搜索 / Auto / `advanced_search` / `multi_search` / 引擎测试都不再用它），并可用 ↑↓ 调整全局回退顺序（一键恢复默认）
 - **Multi 模式** —— 可把搜索引擎设为 `Multi Search`：`web_search` 按查询语言并发**对应语言池的全部**已启用引擎（不再是前 3 个；中文/英文池可在设置页编辑，每池最低 2 个引擎）、按 URL 合并去重（同站判定用 **eTLD+1**）、跨源命中的结果优先；设置页有 **Fast / Balanced / Deep** 三档强度，也可手填并发上限与目标成功源数；整轮检索共享 **30 秒总预算**，到点返回已有结果（代价是成倍消耗额度；multi 失败会自动退回单引擎回退链）
-- **统一引擎回退** —— 任何引擎失败（付费/免费，缺 key/401/限流/网络）自动轮流尝试下一个引擎：首选引擎 → 其他引擎（exa/tavily/keenable/firecrawl/parallel 无 key 也会尝试，因为它们自带 keyless 免费额度）→ 剩余免费引擎，搜索永不直接失败；结果顶部注明实际生效的引擎（如 `Note: perplexity unavailable or failed, using exa.`）；失败按类别处理：额度/鉴权失败→本会话冷却该引擎，反爬→短退避，超时/5xx/限流→同引擎重试一次，解析失败/0 结果→不冷却（详见下文「失败分类与引擎冷却」）
+- **统一引擎回退** —— 任何引擎失败（付费/免费，缺 key/401/限流/网络）自动轮流尝试下一个引擎：首选引擎 → 其他引擎（exa/tavily/keenable/firecrawl/parallel/you 无 key 也会尝试，因为它们自带 keyless 免费额度）→ 剩余免费引擎，搜索永不直接失败；结果顶部注明实际生效的引擎（如 `Note: perplexity unavailable or failed, using exa.`）；失败按类别处理：额度/鉴权失败→本会话冷却该引擎，反爬→短退避，超时/5xx/限流→同引擎重试一次，解析失败/0 结果→不冷却（详见下文「失败分类与引擎冷却」）
 - **时间过滤** —— `advanced_search` 工具支持 `timeRange`：固定档、自定义相对值、绝对日期三种形式（详见下方逻辑说明）
 - **系统提示词注入** —— agent 知道当前用哪个引擎、哪些需要 key；并明确所有搜索结果是**不可信外部数据**，不得执行其中的指令
 - **提示注入防护（不可信数据边界）** —— 插件自有工具（advanced_search / platform_search / free_search_test）的网页文本包在 `<untrusted-web-content>` 边界内（正文里自带的同名标记会被剥离，防止提前闭合）；核心 web_search / web_fetch 由 DSH 核心自带同类提示（`External web content follows...`）；所有 snippet 统一清洗并截断到 300 字符
@@ -70,12 +70,12 @@ dsh 默认的搜索 provider 依赖 DeepSeek 官方 API key（`DEEPSEEK_API_KEY`
 | `keenable` | Keenable | 免费 | **无 key 也可用**（MCP 匿名），配 key 提升额度 |
 | `firecrawl` | Firecrawl | 免费 | **无 key 也可用**（官方免 key 匿名额度），配 key 提升限额。注意：keyless 档按**出口 IP** 判定，VPN/代理出口会被 403 拒绝；插件会冷却 6 小时并说明原因（有 key 不受影响） |
 | `parallel` | Parallel | 免费 | **无 key 也可用**（官方 MCP 匿名额度），配 key 提升额度并支持精确时间过滤 |
+| `you` | You.com | 免费 | **无 key 也可用**（官方免 key 档，每天 100 次），配 `YDC_API_KEY` 提升额度（旧名 `YOUCOM_API_KEY` 继续兼容） |
 | `perplexity` | Perplexity | 付费 | 需 `PERPLEXITY_API_KEY` |
 | `serpbase` | SerpBase | 付费 | 需 `SERPBASE_API_KEY`（serpbase.dev，注册送 100 次免费额度） |
 | `serply` | Serply | 付费 | 需 `SERPLY_API_KEY`（serply.io，新账户 30 天内 2,500 次免费额度）；Google 网页结果，按设置页语言本地化 |
 | `deepseek-official` | DeepSeek 官方 | 付费 | 需 `DEEPSEEK_API_KEY`；走 Anthropic 兼容的 `web_search` 服务端工具，每次搜索是一整个模型轮次（慢、耗 token） |
 | `deepseek-tools` | DeepSeek 原生搜索 API | 付费 | 需 `DEEPSEEK_API_KEY`（与上一档共用）；直接 `POST /v1/tools/search`，无模型参与，返回结构化 `results[]`（`title`/`url`/`summary`/`date`），同 query 实测 ~0.3s vs 上一档 ~5-6s |
-| `you` | You.com | 付费 | 需 `YOUCOM_API_KEY`（you.com/platform/api-keys，注册即送免费额度） |
 | `baidu` | 百度千帆 AI 搜索 | 额度 | 需 `BAIDU_API_KEY`（千帆 AI 搜索，每日赠 50 次，超额按量后付费）；中文全网，支持时间过滤 |
 | `kimi` | Kimi（Moonshot）联网搜索 | 付费 | 需 `MOONSHOT_API_KEY`（basic 约 ￥0.01/次），返回带正文 chunks 的中文结果；**无免费额度**，适合显式选用或作质量升级池，不建议放进默认并发池 |
 | `kimi` | Kimi（Moonshot）联网搜索 | 付费 | 需 `MOONSHOT_API_KEY`（basic 约 ￥0.01/次），返回带正文 chunks 的中文结果 |
@@ -110,9 +110,9 @@ dsh 默认的搜索 provider 依赖 DeepSeek 官方 API key（`DEEPSEEK_API_KEY`
 | 档位 | 引擎 | 超出后 |
 |---|---|---|
 | ① 无限免 key | `ddg` / `ddg-lite` / `bing` / `searxng` / `anysearch` | — |
-| ② 匿名额度（不配 key 也能跑） | `exa` / `tavily` / `keenable` / `firecrawl` / `parallel` | 配 key 提额 |
+| ② 匿名额度（不配 key 也能跑） | `exa` / `tavily` / `keenable` / `firecrawl` / `parallel` / `you`（每天 100 次） | 配 key 提额 |
 | ③ 免费额度（需 key） | `zhihu_global` / `zhihu_site`（每日 5,000 次试用）、`doubao`（每月 500 次）、`baidu`（每日 50 次）、`aliyun`（新用户 200 次包） | 按量后付费 |
-| ④ 付费升级（需 key 才有产出） | `serpbase`（注册送 100 次）/ `serply`（30 天 2,500 次）/ `you` / `perplexity` / `deepseek-official` / `deepseek-tools` / `kimi` | 按量 / 按次 |
+| ④ 付费升级（需 key 才有产出） | `serpbase`（注册送 100 次）/ `serply`（30 天 2,500 次）/ `perplexity` / `deepseek-official` / `deepseek-tools` / `kimi` | 按量 / 按次 |
 | ⑤ 按次计费（模型内置，显式-only） | `openai` / `gemini` / `claude` | 按 token + 每次搜索 |
 
 选默认池的经验：**① 打底 + ③ 打主力**；② 可以进但要知道它在烧匿名额度；④ 只在你确实需要该源时显式选用；⑤ 永不入池。完整的逐引擎额度事实与默认池提案见 [docs/engine-quota-tiers.md](./docs/engine-quota-tiers.md)。
@@ -124,6 +124,7 @@ dsh 默认的搜索 provider 依赖 DeepSeek 官方 API key（`DEEPSEEK_API_KEY`
 - **Tavily**：通过 `x-tavily-access-mode: keyless` 头走 keyless 匿名额度，不配 key 即可用；配置 `TAVILY_API_KEY` 后走账号档，额度更高、结果质量更稳定。
 - **Keenable**：无 key 时走其公开 MCP 端点（`api.keenable.ai/mcp`）匿名调用；配置 `KEENABLE_API_KEY` 后走 REST API（`api.keenable.ai/v1/search`），额度更高、按组织限流。
 - **Firecrawl**：其 `/v2/search` 端点**无需 key** 即可使用（官方文档明确说明，有匿名限流）；配置 `FIRECRAWL_API_KEY` 后可提高限额。支持 `tbs` 时间过滤（`qdr:h/d/w/m/y` 与自定义日期区间）。
+- **You.com**：无 key 时走官方免 key 档（`api.you.com/v1/agents/search`），每天 100 次免费搜索，无需注册；配置 `YDC_API_KEY`（旧名 `YOUCOM_API_KEY` 继续兼容）后走官方 Search API（`ydc-index.io/v1/search`），额度更高。
 
 ### 安装
 
@@ -205,7 +206,7 @@ DSH 0.2.1 设置 → 网页搜索 → **DeepSeek 搜索 API** 开关会和本插
 配置页提供：
 
 - **Search engine**：下拉框切换引擎，保存即生效
-- **API keys**：为 Exa / Tavily / Keenable / Firecrawl / Parallel / Perplexity / DeepSeek / SerpBase / Serply / You.com 填写 key（密码框，保存后只显示"已配置"；Exa / Tavily / Keenable / Firecrawl / Parallel 不填也可免 key 使用）
+- **API keys**：为 Exa / Tavily / Keenable / Firecrawl / Parallel / Perplexity / DeepSeek / SerpBase / Serply / You.com 填写 key（密码框，保存后只显示"已配置"；Exa / Tavily / Keenable / Firecrawl / Parallel / You.com 不填也可免 key 使用）
   - **推荐**：付费引擎 key 建议写入 harness 凭据中心 `~/.dsh/.credentials.yaml`（如 `DEEPSEEK_API_KEY: sk-...`，与官方 LLM provider 一致，一处管理所有 key）。插件读取优先级：凭据中心 > 设置页 > 环境变量，设置页填的 key 仅作为遗留兼容。
 - **Test engine**：直测当前引擎可用性（不走回退链，付费引擎无 key 会明确报错）
 - **Use Bing default**：把当前搜索引擎切回稳定的免费 Bing；`Discard` 只撤销尚未保存的编辑
@@ -305,9 +306,10 @@ DSH 0.1.7-rc.1 起，配置跟随 profile 的插件条目保存：设置页与 `
 # profiles/<profile>/cordis.patch.yml 中该条目的 config：
 provider: bing              # ddg / ddg-lite / bing / searxng / anysearch / exa / tavily / keenable / firecrawl / parallel / perplexity / serpbase / serply / deepseek-official / deepseek-tools / you / baidu / kimi / aliyun / doubao / zhihu_global / zhihu_site / openai / gemini / claude / auto / multi
 fallbackOn: [quota, auth, bot-wall, transient, invalid-response, unknown]   # 允许触发回退的失败类别；[] = 任何失败都立即中止（默认全部）
-lang: zh                    # 搜索语言池/本地化（zh / en / ru …，不再被设置页强行改写）
-#   lang 决定：Bing 的 mkt/Accept-Language、Wikipedia 子域（ja → ja.wikipedia.org）、地理编码语言；
-#   我们自己渲染的文案只有中文/英文两套，其它语言（ja/ru/de…）一律走英文，避免回答前先塞一段中文（#92）。
+lang: zh                    # 搜索语言池/本地化（zh / en / ru …，不再被设置页强行改写）
+#   lang 决定：Bing 的 mkt/Accept-Language、Wikipedia 子域（ja → ja.wikipedia.org）、地理编码语言；
+#   我们自己渲染的文案只有中文/英文两套，其它语言（ja/ru/de…）一律走英文，避免回答前先塞一段中文（#92）；
+#   weather 例外，另有日文（ja 得到日文天气，ru/de… 仍走英文）。
 #   web_fetch（fs-quality-fetch）的 Accept-Language 同样跟随 lang，不再固定中文（#92）。
 uiLang: zh                  # 设置页界面语言（zh / en）；留空则跟随 lang
 bingMarket: zh-CN           # Bing 市场；留空 = 自动（不发送 mkt）
@@ -510,12 +512,12 @@ Search engine test:
 | `assert-killtree-win32.mjs` | Windows 子进程树终止（#74）：不再依赖 `taskkill` | `node tools/assert-killtree-win32.mjs`（8） |
 | `assert-killtree-portable.mjs` | 跨平台 `killTree` 便携版契约 | `node tools/assert-killtree-portable.mjs`（5） |
 | `assert-parallel-mcp.mjs` | Parallel MCP 引擎：25 s 超时/调用方取消覆盖**响应体读取**、共享 SSE 解析器（通知/多行帧）、6 类错误路径、REST 精确时间过滤 | `node tools/assert-parallel-mcp.mjs`（15） |
-| `assert-output-language.mjs` | 语言分支（#92）：`searchLanguage` 支持 zh/en/ja/ru/de/es/fr/ko 其余回退 en、`outputLanguage` 只输出 zh/en、天气文案 ja→英文、置信度说明随语言、失败备注随语言 | `node tools/assert-output-language.mjs`（8） |
-| `assert-uncertainty.mjs` | 输出契约：0/1 源为 low、2 源与同站为 medium、3 个不同域为 high、时间过滤无日期、失败备注、聚合站提示 | `node tools/assert-uncertainty.mjs`（8） |
-| `assert-multikey.mjs` | 多 key 字段：单 key 不变、逗号/分号/换行分隔、空白项丢弃、空输入为空数组 | `node tools/assert-multikey.mjs`（3） |
-| `assert-firecrawl-keyless.mjs` | Firecrawl keyless 出口判定：403 + VPN/proxy 文案才算拒绝、普通 403 与 401/429/500 不算、冷却初始未触发 | `node tools/assert-firecrawl-keyless.mjs`（5） |
-| `assert-fetch-charset.mjs` | 抓取编码（#88）：`charset=gbk` / `gb2312` 按声明解码、无声明时嗅探 `<meta charset>` 与 http-equiv 形式、默认 UTF-8、未知 label 兜底 UTF-8 不抛错 | `node tools/assert-fetch-charset.mjs`（6） |
-| `assert-fetch-abort.mjs` | 抓取中断（#87）：压缩响应中途断连必须 reject（不再永久 pending）、明文断连同样 reject、abort 能打断停滞的 gzip 流、complete 响应与重定向仍正常 | `node tools/assert-fetch-abort.mjs`（6） |
+| `assert-output-language.mjs` | 语言分支（#92）：`searchLanguage` 支持 zh/en/ja/ru/de/es/fr/ko 其余回退 en、`outputLanguage` 只输出 zh/en、天气文案 zh/en/ja（其它回退英文，含 WMO 描述与正文）、置信度说明随语言、失败备注随语言 | `node tools/assert-output-language.mjs`（10） |
+| `assert-uncertainty.mjs` | 输出契约：0/1 源为 low、2 源与同站为 medium、3 个不同域为 high、时间过滤无日期、失败备注、聚合站提示 | `node tools/assert-uncertainty.mjs`（8） |
+| `assert-multikey.mjs` | 多 key 字段：单 key 不变、逗号/分号/换行分隔、空白项丢弃、空输入为空数组 | `node tools/assert-multikey.mjs`（3） |
+| `assert-firecrawl-keyless.mjs` | Firecrawl keyless 出口判定：403 + VPN/proxy 文案才算拒绝、普通 403 与 401/429/500 不算、冷却初始未触发 | `node tools/assert-firecrawl-keyless.mjs`（5） |
+| `assert-fetch-charset.mjs` | 抓取编码（#88）：`charset=gbk` / `gb2312` 按声明解码、无声明时嗅探 `<meta charset>` 与 http-equiv 形式、默认 UTF-8、未知 label 兜底 UTF-8 不抛错 | `node tools/assert-fetch-charset.mjs`（6） |
+| `assert-fetch-abort.mjs` | 抓取中断（#87）：压缩响应中途断连必须 reject（不再永久 pending）、明文断连同样 reject、abort 能打断停滞的 gzip 流、complete 响应与重定向仍正常 | `node tools/assert-fetch-abort.mjs`（6） |
 | `assert-bridge-access.mjs` | 桥接 Host 围栏（#84）：loopback 放行、remote peer 打 loopback Host 拒绝、`--trusted-host`（无端口匹配任意端口 / 带端口精确匹配）、`--public-url`、绑定地址、跨站与异源拒绝 | `node tools/assert-bridge-access.mjs`（11） |
 | `assert-provider-takeover.mjs` | provider 接管：旧属性 API 与 rc.2 的 `config.*` ref 两套兼容、`settings.mutate(web)` 单批写入、显式指定的 provider 不被抢占、`fetchProviderTakeover: false` 时保留显式 `http`、describe 噪声不误报、嵌套 config 变化与 web 重建分别成行、关闭 DSH 搜索开关后重新接管且不抢 `deepseek-search-api`、apply 重入/重复注册不再中断、重复日志去重 | `node tools/assert-provider-takeover.mjs`（16） |
 
@@ -569,12 +571,12 @@ This plugin provides multiple free search engines with automatic fallback, compl
 - **Multi-Engine Support** — DuckDuckGo (HTML / Lite), Bing, AnySearch AI, SearXNG (meta-search with custom instances), Exa, Tavily, Keenable, Firecrawl, Parallel, Perplexity, SerpBase, Serply, DeepSeek Official, You.com, Baidu Qianfan, Kimi, Aliyun Bailian, Volcano Doubao, Zhihu web-wide/site search (`zhihu_global`/`zhihu_site`, via the Zhihu open-platform MCP), and the model-based OpenAI / Gemini / Claude searches
 - **Web Settings UI** — Engine switching, API key configuration (keys masked as "configured" in the UI), and a Chinese/English toggle; the entry is the component-row config (`plugins.row.config`) on the sidebar Plugins page (DSH 0.1.7-rc.1+). Remote access (VPS, reverse proxy, custom domain) works too: the bridge reuses the host's own Host fence, so addresses declared with `--trusted-host` or `--public-url` are accepted (#84)
 - **Right-hand section rail** — A floating list (Engines / Fallback / Language pools / Search behaviour / Fetch / Performance) sits in the page margin to the right of the card: it highlights the section you are in while scrolling and jumps smoothly on click. It is rendered in a portal and never narrows the card, so the body layout is unchanged; it hides itself when the margin is too tight.
-- **Multi-key rotation** — Any key field (or its env var) accepts several keys separated by commas, semicolons or newlines; on 401/402/429 (bad key, quota exhausted) the same engine retries with the next key before the engine-level fallback runs
+- **Multi-key rotation** — Any key field (or its env var) accepts several keys separated by commas, semicolons or newlines; on 401/402/429 (bad key, quota exhausted) the same engine retries with the next key before the engine-level fallback runs
 - **Popup Switch Command** — Type `/free-search-engine` in the chat: a picker opens with all engines; click one to switch (equivalent to the settings page + save)
 - **Engine Testing** — `free_search_test` for the agent to check all engines in one call; the settings UI also has a "Test engine" button that tests the selected engine directly (no fallback chain; paid engines without a key report an explicit error)
 - **Global engine enable/disable & fallback priority** — uncheck engines you never want (applies everywhere: web_search fallback, Auto routing, advanced_search, multi_search, engine tests) and reorder the global fallback chain with ↑↓ (one-click reset)
 - **Multi mode** — pick `Multi Search` as the engine: web_search queries **every enabled engine of the query's language pool** concurrently (no longer top 3; zh/en pools editable in the settings UI, minimum 2 engines each), merges/deduplicates URLs (same-site detection via **eTLD+1**) and prioritizes cross-source hits; the settings UI offers **Fast / Balanced / Deep** presets or your own cap and target numbers; the whole run shares one **30-second budget** and returns whatever it already has when time is up (costs more quota; a failed multi run automatically falls back to the single-engine chain)
-- **Unified Engine Fallback** — Any engine failure (paid or free, missing key, 401, rate limit, network error) automatically tries the next engine: the configured engine first, then other engines (exa/tavily/keenable/firecrawl/parallel are tried even without a key because they have built-in keyless quota), then the remaining free engines (Bing/AnySearch etc.) — with a note attached to the results naming the engine that actually served them (e.g. `Note: perplexity unavailable or failed, using exa.`). Failures are classified: quota/auth failures cool the engine down for the session, anti-bot walls back off briefly, timeout/5xx/rate-limit failures retry the same engine once, and parse errors / 0 results are reported without cooling it down (see "Failure-aware fallback" below). Search never fails outright.
+- **Unified Engine Fallback** — Any engine failure (paid or free, missing key, 401, rate limit, network error) automatically tries the next engine: the configured engine first, then other engines (exa/tavily/keenable/firecrawl/parallel/you are tried even without a key because they have built-in keyless quota), then the remaining free engines (Bing/AnySearch etc.) — with a note attached to the results naming the engine that actually served them (e.g. `Note: perplexity unavailable or failed, using exa.`). Failures are classified: quota/auth failures cool the engine down for the session, anti-bot walls back off briefly, timeout/5xx/rate-limit failures retry the same engine once, and parse errors / 0 results are reported without cooling it down (see "Failure-aware fallback" below). Search never fails outright.
 - **Time Filtering** — The `advanced_search` tool supports `timeRange`: fixed tiers, custom relative values, or an absolute date (details below)
 - **System Prompt Injection** — The agent is aware of the currently active engine and which engines require API keys; it is also told that all search output is **untrusted external data** and must never be executed as instructions
 - **Prompt-Injection Guard (untrusted-data boundary)** — Web-derived text from the plugin's own tools (`advanced_search` / `platform_search` / `free_search_test`) is wrapped in an explicit `<untrusted-web-content>` boundary (look-alike tags inside the text are stripped to prevent early closure); the core `web_search` / `web_fetch` tools carry DSH core's own notice (`External web content follows...`); every snippet is cleaned and capped at 300 characters
@@ -607,12 +609,12 @@ If this plugin has been helpful, a ⭐ on [GitHub](https://github.com/DDDMUC/dsh
 | `keenable` | Keenable | Free | **Usable without a key** (anonymous MCP); configure a key for higher quota |
 | `firecrawl` | Firecrawl | Free | **Usable without a key** (official keyless anonymous quota); a key adds higher limits. Note: the keyless tier is judged by **egress IP** — VPN/proxy egress gets a 403, in which case the plugin cools it down for 6 hours and says why (a key is unaffected) |
 | `parallel` | Parallel | Free | **Works without a key** (official MCP anonymous quota); a key raises limits and enables precise time filtering |
+| `you` | You.com | Free | **Works without a key** (official keyless tier, 100 searches a day); set `YDC_API_KEY` for higher limits (the old `YOUCOM_API_KEY` name still works) |
 | `perplexity` | Perplexity | Paid | Requires `PERPLEXITY_API_KEY` |
 | `serpbase` | SerpBase | Paid | Requires `SERPBASE_API_KEY` (serpbase.dev, 100 free queries on signup) |
 | `serply` | Serply | Paid | Requires `SERPLY_API_KEY` (serply.io, 2,500 free credits for the first 30 days); Google web results localized to the settings language |
 | `deepseek-official` | DeepSeek Official | Paid | Requires `DEEPSEEK_API_KEY`; uses the Anthropic-compatible `web_search` server tool, so every search is a full model turn (slow, token-billed) |
 | `deepseek-tools` | DeepSeek Native Search API | Paid | Requires `DEEPSEEK_API_KEY` (shared with the row above); calls `POST /v1/tools/search` directly, no model involved, returns structured `results[]` (`title`/`url`/`summary`/`date`) — measured ~0.3s vs ~5-6s for the row above on the same query |
-| `you` | You.com | Paid | Requires `YOUCOM_API_KEY` (you.com/platform/api-keys, free tier on signup) |
 | `baidu` | Baidu Qianfan AI Search | Quota | Requires `BAIDU_API_KEY` (Qianfan AI Search, 50 free calls/day then pay-as-you-go); Chinese web-wide, supports time filtering |
 | `kimi` | Kimi (Moonshot) Web Search | Paid | Requires `MOONSHOT_API_KEY` (basic ~¥0.01/call); returns Chinese results with body chunks; **no free quota**, so prefer explicit selection or the escalation pool over the default concurrent pool |
 | `kimi` | Kimi (Moonshot) Web Search | Paid | Requires `MOONSHOT_API_KEY` (basic ~¥0.01/call); returns Chinese results with body chunks |
@@ -627,7 +629,7 @@ If this plugin has been helpful, a ⭐ on [GitHub](https://github.com/DDDMUC/dsh
 | `claude` | Claude server-side web_search | Paid | Requires `ANTHROPIC_API_KEY`; results come from `web_search_tool_result`. **Billed per search, explicit selection only**; default `claude-sonnet-5-5`, model/endpoint configurable (`claudeModel` / `claudeBaseUrl`) |
 
 - **Default engine is `bing`** (free and most stable), ready to use out of the box after installation.
-- **Auto-failover**: any engine failure (rate-limited free engine, or missing/invalid paid key, network error) automatically tries the next engine — the configured engine first, then other engines (exa/tavily/keenable/firecrawl/parallel are tried even without a key because they have built-in keyless quota), then the remaining free engines (Bing/AnySearch etc.) — with a note attached to the results naming the engine that actually served them (e.g. `Note: perplexity unavailable or failed, using exa.`). Search never fails outright because of engine issues.
+- **Auto-failover**: any engine failure (rate-limited free engine, or missing/invalid paid key, network error) automatically tries the next engine — the configured engine first, then other engines (exa/tavily/keenable/firecrawl/parallel/you are tried even without a key because they have built-in keyless quota), then the remaining free engines (Bing/AnySearch etc.) — with a note attached to the results naming the engine that actually served them (e.g. `Note: perplexity unavailable or failed, using exa.`). Search never fails outright because of engine issues.
 - **Official Links in Settings**: Free engines display "Visit Website →", while paid engines display "Get API Key →" (opens in a new tab):
   - Exa: <https://dashboard.exa.ai/api-keys>
   - Tavily: <https://app.tavily.com/home>
@@ -648,9 +650,9 @@ The free/paid binary is not what decides **who belongs in a default pool** — t
 | Tier | Engines | Past the allowance |
 |---|---|---|
 | ① Unlimited, no key | `ddg` / `ddg-lite` / `bing` / `searxng` / `anysearch` | — |
-| ② Anonymous quota (runs without a key) | `exa` / `tavily` / `keenable` / `firecrawl` / `parallel` | key raises the quota |
+| ② Anonymous quota (runs without a key) | `exa` / `tavily` / `keenable` / `firecrawl` / `parallel` / `you` (100/day) | key raises the quota |
 | ③ Free quota (key required) | `zhihu_global` / `zhihu_site` (5,000/day trial), `doubao` (500/month), `baidu` (50/day), `aliyun` (200-call starter pack) | pay-as-you-go |
-| ④ Paid upgrade (needs a key to return anything) | `serpbase` (100 free on signup) / `serply` (2,500 for 30 days) / `you` / `perplexity` / `deepseek-official` / `deepseek-tools` / `kimi` | per call / per query |
+| ④ Paid upgrade (needs a key to return anything) | `serpbase` (100 free on signup) / `serply` (2,500 for 30 days) / `perplexity` / `deepseek-official` / `deepseek-tools` / `kimi` | per call / per query |
 | ⑤ Per-call billing (model built-in, explicit-only) | `openai` / `gemini` / `claude` | per token + per search |
 
 Rule of thumb for a default pool: **① as the floor + ③ as the workhorse**; ② is allowed but remember it burns anonymous quota; ④ only when you actually want that source; ⑤ never enters a pool. Per-engine facts and a default-pool proposal live in [docs/engine-quota-tiers.md](./docs/engine-quota-tiers.md).
@@ -662,6 +664,7 @@ Rule of thumb for a default pool: **① as the floor + ③ as the workhorse**;
 - **Tavily**: offers keyless anonymous quota via the `x-tavily-access-mode: keyless` header — it works without a key; configuring `TAVILY_API_KEY` switches to the account tier for higher quota and more stable results.
 - **Keenable**: without a key it is called via its public MCP endpoint (`api.keenable.ai/mcp`); configuring `KEENABLE_API_KEY` switches to the REST API (`api.keenable.ai/v1/search`) for higher quota and organization-scoped rate limits.
 - **Firecrawl**: its `/v2/search` endpoint works **without a key** out of the box (the official docs state "No API key needed to get started", with anonymous rate limits); configuring `FIRECRAWL_API_KEY` raises the limits. Supports `tbs` time filtering (`qdr:h/d/w/m/y` and custom date ranges).
+- **You.com**: without a key it calls the official keyless tier (`api.you.com/v1/agents/search`), 100 free searches a day with no signup; setting `YDC_API_KEY` (the old `YOUCOM_API_KEY` name still works) switches to the Search API (`ydc-index.io/v1/search`) for higher limits.
 
 ### Installation
 
@@ -743,7 +746,7 @@ After installation, open the config page (DSH 0.1.7-rc.1+):
 The config page provides:
 
 - **Search engine**: Select an engine from the dropdown; changes take effect immediately upon saving.
-- **API keys**: Enter keys for Exa / Tavily / Keenable / Firecrawl / Parallel / Perplexity / DeepSeek (password fields; displayed as "configured" once saved; Exa / Tavily / Keenable / Firecrawl / Parallel work without a key too).
+- **API keys**: Enter keys for Exa / Tavily / Keenable / Firecrawl / Parallel / Perplexity / DeepSeek / You.com (password fields; displayed as "configured" once saved; Exa / Tavily / Keenable / Firecrawl / Parallel / You.com work without a key too).
   - **Recommended**: store paid-engine keys in the harness credential center `~/.dsh/.credentials.yaml` (e.g. `DEEPSEEK_API_KEY: sk-...`, same as the official LLM providers — one place for all keys). Resolution order: credentials center > settings page > environment variable; the settings-page fields remain for backward compatibility.
 - **Test engine**: Tests the selected engine directly (no fallback chain; paid engines without a key report an explicit error).
 - **Use Bing default**: stage a switch back to the stable free Bing engine; `Discard` only cancels unsaved edits
@@ -843,9 +846,10 @@ The old `free-search:` section of `~/.dsh/settings.yaml` is **not** imported by
 # config of that entry in profiles/<profile>/cordis.patch.yml:
 provider: bing              # ddg / ddg-lite / bing / searxng / anysearch / exa / tavily / keenable / firecrawl / parallel / perplexity / serpbase / serply / deepseek-official / deepseek-tools / you / baidu / kimi / aliyun / doubao / zhihu_global / zhihu_site / openai / gemini / claude / auto / multi
 fallbackOn: [quota, auth, bot-wall, transient, invalid-response, unknown]   # failure classes allowed to trigger fallback; [] = abort on any failure (default: all)
-lang: zh                    # search language pools / localization (zh / en / ru …; no longer rewritten by the settings page)
-#   lang drives Bing's mkt/Accept-Language, the Wikipedia subdomain (ja → ja.wikipedia.org) and the geocoding language;
-#   text this plugin renders itself only exists in Chinese and English, so other languages (ja/ru/de…) get English rather than a wall of Chinese (#92).
+lang: zh                    # search language pools / localization (zh / en / ru …; no longer rewritten by the settings page)
+#   lang drives Bing's mkt/Accept-Language, the Wikipedia subdomain (ja → ja.wikipedia.org) and the geocoding language;
+#   text this plugin renders itself only exists in Chinese and English, so other languages (ja/ru/de…) get English rather than a wall of Chinese (#92);
+#   weather also has Japanese (ja gets Japanese weather text, ru/de… still get English).
 #   web_fetch (fs-quality-fetch) sends the same Accept-Language instead of a fixed Chinese one (#92).
 uiLang: zh                  # settings UI language (zh / en); empty = follow lang
 bingMarket: zh-CN           # Bing market; empty = automatic (no mkt sent)
@@ -1048,12 +1052,12 @@ Restart `dsh web` after switching to apply changes.
 | `assert-killtree-win32.mjs` | Windows process-tree termination (#74): no longer relies on `taskkill` | `node tools/assert-killtree-win32.mjs` (8) |
 | `assert-killtree-portable.mjs` | portable `killTree` contract | `node tools/assert-killtree-portable.mjs` (5) |
 | `assert-parallel-mcp.mjs` | Parallel MCP engine: the 25 s timeout / caller abort covers the **body read**, shared SSE parser (notifications, multiline frames), six error paths, REST precise time filtering | `node tools/assert-parallel-mcp.mjs` (15) |
-| `assert-output-language.mjs` | language branches (#92): `searchLanguage` passes zh/en/ja/ru/de/es/fr/ko through and falls back to en, `outputLanguage` only returns zh/en, weather text is English for ja, and both confidence and failure notes follow the language | `node tools/assert-output-language.mjs` (8) |
-| `assert-uncertainty.mjs` | output contract: 0/1 source is low, two sources or a single site is medium, three distinct domains is high, time filter without dates, failure notes, aggregator caveat | `node tools/assert-uncertainty.mjs` (8) |
-| `assert-multikey.mjs` | multi-key fields: a single key is unchanged, comma/semicolon/newline separate keys, blank entries are dropped, empty input yields none | `node tools/assert-multikey.mjs` (3) |
-| `assert-firecrawl-keyless.mjs` | Firecrawl keyless egress refusal: only a 403 with the VPN/proxy wording counts, plain 403 and 401/429/500 do not, and the cooldown starts inactive | `node tools/assert-firecrawl-keyless.mjs` (5) |
-| `assert-fetch-charset.mjs` | fetch encoding (#88): `charset=gbk` / `gb2312` decoded as declared, `<meta charset>` and the http-equiv form sniffed when the header omits it, UTF-8 by default, and an unknown label falls back to UTF-8 instead of throwing | `node tools/assert-fetch-charset.mjs` (6) |
-| `assert-fetch-abort.mjs` | fetch interruption (#87): a compressed response cut mid-body rejects instead of hanging forever, identity truncation rejects too, abort breaks a stalled gzip stream, and complete responses plus redirects still work | `node tools/assert-fetch-abort.mjs` (6) |
+| `assert-output-language.mjs` | language branches (#92): `searchLanguage` passes zh/en/ja/ru/de/es/fr/ko through and falls back to en, `outputLanguage` only returns zh/en, weather text has zh/en/ja (WMO descriptions and body; others fall back to English), and both confidence and failure notes follow the language | `node tools/assert-output-language.mjs` (10) |
+| `assert-uncertainty.mjs` | output contract: 0/1 source is low, two sources or a single site is medium, three distinct domains is high, time filter without dates, failure notes, aggregator caveat | `node tools/assert-uncertainty.mjs` (8) |
+| `assert-multikey.mjs` | multi-key fields: a single key is unchanged, comma/semicolon/newline separate keys, blank entries are dropped, empty input yields none | `node tools/assert-multikey.mjs` (3) |
+| `assert-firecrawl-keyless.mjs` | Firecrawl keyless egress refusal: only a 403 with the VPN/proxy wording counts, plain 403 and 401/429/500 do not, and the cooldown starts inactive | `node tools/assert-firecrawl-keyless.mjs` (5) |
+| `assert-fetch-charset.mjs` | fetch encoding (#88): `charset=gbk` / `gb2312` decoded as declared, `<meta charset>` and the http-equiv form sniffed when the header omits it, UTF-8 by default, and an unknown label falls back to UTF-8 instead of throwing | `node tools/assert-fetch-charset.mjs` (6) |
+| `assert-fetch-abort.mjs` | fetch interruption (#87): a compressed response cut mid-body rejects instead of hanging forever, identity truncation rejects too, abort breaks a stalled gzip stream, and complete responses plus redirects still work | `node tools/assert-fetch-abort.mjs` (6) |
 | `assert-bridge-access.mjs` | bridge Host fence (#84): loopback allowed, a remote peer behind a loopback Host refused, `--trusted-host` (port-less matches any port, explicit port matches exactly), `--public-url`, the bind address, cross-site and foreign-Origin refused | `node tools/assert-bridge-access.mjs` (11) |
 | `assert-provider-takeover.mjs` | provider takeover: both the legacy property API and the rc.2 `config.*` refs, a single batched `settings.mutate(web)`, explicit foreign providers left untouched, an explicit `http` kept when `fetchProviderTakeover` is off, describe()-triggered events ignored when nothing changed, nested config changes and web rebuilds reported separately, re-takeover after DSH's search switch is turned off without fighting an explicit `deepseek-search-api`, apply re-entry / duplicate registrations tolerated, and repeated logs deduplicated | `node tools/assert-provider-takeover.mjs` (16) |
 

package/lib/client.js

@@ -168,7 +168,7 @@ window.__ModuleLoader__.load({
     const NS = "web-search-free";
     const I18N = {
       zh: {
-        description: "免费搜索 —— 无需 API key（Bing / DuckDuckGo / AnySearch / Exa / Tavily / Keenable / Firecrawl / Parallel），支持 You.com（API KEY）",
+        description: "免费搜索 —— 无需 API key（Bing / DuckDuckGo / AnySearch / Exa / Tavily / Keenable / Firecrawl / Parallel / You.com）",
         unsaved: "未保存",
         searchEngine: "搜索引擎",
         visit: "访问官网 →",
@@ -185,7 +185,7 @@ window.__ModuleLoader__.load({
         deepseekPh: (c) => c ? "DeepSeek API 密钥（已配置）" : "DeepSeek API 密钥（sk-...）",
         serpbasePh: (c) => c ? "SerpBase API 密钥（已配置）" : "SerpBase API 密钥（serpbase.dev 获取）",
         serplyPh: (c) => c ? "Serply API 密钥（已配置）" : "Serply API 密钥（serply.io 获取）",
-        youcomPh: (c) => c ? "You.com API 密钥（已配置）" : "You.com API 密钥（you.com/platform/api-keys 获取）",
+        youcomPh: (c) => c ? "You.com API 密钥（已配置）" : "You.com API 密钥（可选，不填也可免费使用，每天 100 次；YDC_API_KEY）",
         baiduPh: (c) => c ? "Baidu API 密钥（已配置）" : "百度千帆 API 密钥（BAIDU_API_KEY）",
         kimiPh: (c) => c ? "Kimi API 密钥（已配置）" : "Kimi API 密钥（MOONSHOT_API_KEY）",
         aliyunPh: (c) => c ? "Aliyun API 密钥（已配置）" : "阿里云 DashScope 密钥（DASHSCOPE_API_KEY）",
@@ -296,7 +296,7 @@ window.__ModuleLoader__.load({
         starCta: "行，给你一颗 Star",
       },
       en: {
-        description: "Free web search — no API key needed (Bing / DuckDuckGo / AnySearch / Exa / Tavily / Keenable / Firecrawl / Parallel), plus You.com (API KEY)",
+        description: "Free web search — no API key needed (Bing / DuckDuckGo / AnySearch / Exa / Tavily / Keenable / Firecrawl / Parallel / You.com)",
         unsaved: "unsaved",
         searchEngine: "Search engine",
         visit: "Visit website →",
@@ -313,7 +313,7 @@ window.__ModuleLoader__.load({
         deepseekPh: (c) => c ? "DeepSeek API key (configured)" : "DeepSeek API key (sk-...)",
         serpbasePh: (c) => c ? "SerpBase API key (configured)" : "SerpBase API key (from serpbase.dev)",
         serplyPh: (c) => c ? "Serply API key (configured)" : "Serply API key (from serply.io)",
-        youcomPh: (c) => c ? "You.com API key (configured)" : "You.com API key (from you.com/platform/api-keys)",
+        youcomPh: (c) => c ? "You.com API key (configured)" : "You.com API key (optional, free without: 100 searches a day; YDC_API_KEY)",
         baiduPh: (c) => c ? "Baidu API key (configured)" : "Baidu Qianfan API key (BAIDU_API_KEY)",
         kimiPh: (c) => c ? "Kimi API key (configured)" : "Kimi API key (MOONSHOT_API_KEY)",
         aliyunPh: (c) => c ? "Aliyun API key (configured)" : "Aliyun DashScope API key (DASHSCOPE_API_KEY)",
@@ -426,7 +426,7 @@ window.__ModuleLoader__.load({
     };
     const tt = (lang) => I18N[String(lang ?? "").trim().toLowerCase() === "zh" ? "zh" : "en"];
     // 当前插件版本（与 lib/index.js 的 PLUGIN_VERSION 保持一致；跟随上游 v0.7.5）
-    const PLUGIN_VERSION = "0.9.13";
+    const PLUGIN_VERSION = "0.9.15";
     const PLUGIN_REPO_URL = "https://github.com/DDDMUC/dsh-free-search";
     // 右侧浮动目录（#85）：条目顺序即页面顺序，anchor 是页面里对应 field 的 id。
     const NAV_ITEMS = [
@@ -465,7 +465,7 @@ window.__ModuleLoader__.load({
       { id: "serply", label: "Serply · Google", badge: "API KEY", link: "https://serply.io" },
       { id: "deepseek-official", label: "DeepSeek Official", badge: "API KEY", link: "https://platform.deepseek.com/api_keys" },
       { id: "deepseek-tools", label: "DeepSeek Tools API", badge: "API KEY", link: "https://api-docs.deepseek.com/zh-cn/guides/search" },
-      { id: "you", label: "You.com", badge: "API KEY", link: "https://you.com/platform/api-keys" },
+      { id: "you", label: "You.com", badge: "FREE", link: "https://you.com/platform/api-keys" },
       { id: "baidu", label: "Baidu · 百度千帆", badge: "API KEY", link: "https://console.bce.baidu.com/qianfan" },
       { id: "kimi", label: "Kimi · Moonshot", badge: "API KEY", link: "https://platform.moonshot.cn" },
       { id: "aliyun", label: "Aliyun · 百炼", badge: "API KEY", link: "https://bailian.console.aliyun.com" },
@@ -755,7 +755,7 @@ window.__ModuleLoader__.load({
       // #68 密钥状态可视化：引擎 id → 配置中心键名（少数引擎不同名），三态：已配置/可选/缺失
       const CONFIGURED_KEY_ID = { "deepseek-official": "deepseek", "deepseek-tools": "deepseek", you: "youcom", zhihu_global: "zhihu", zhihu_site: "zhihu" };
       const NO_KEY_ENGINES = ["ddg", "ddg-lite", "bing"];
-      const OPTIONAL_KEY_ENGINES = ["anysearch", "exa", "tavily", "keenable", "firecrawl", "parallel", "searxng"];
+      const OPTIONAL_KEY_ENGINES = ["anysearch", "exa", "tavily", "keenable", "firecrawl", "parallel", "searxng", "you"];
       const hasConfiguredKey = (id) => {
         const k = CONFIGURED_KEY_ID[id] ?? id;
         return Boolean(keysConfigured[k] || credConfigured[k]);

package/lib/fetch_provider.js

@@ -122,33 +122,33 @@ function browserDumpDom(browserPath, url, { timeoutMs = 25000, signal } = {}) {
   });
 }
 
-// #88：按声明的 charset 解码。GBK/GB2312/Big5/Shift_JIS 老站很常见，
-// 一律当 UTF-8 会得到整页 \uFFFD，而且不会报错、不会降级，模型直接吃一页乱码。
-function parseCharset(contentType) {
-  const match = /charset\s*=\s*"?([^";\s]+)"?/i.exec(String(contentType || ""));
-  return match ? match[1].trim().toLowerCase() : "";
-}
-
-function sniffHtmlCharset(buffer) {
-  const head = buffer.subarray(0, 2048).toString("latin1");
-  let match = /<meta[^>]+charset\s*=\s*["']?\s*([\w.:-]+)/i.exec(head);
-  if (match) return match[1].toLowerCase();
-  match = /<meta[^>]+content\s*=\s*["'][^"']*charset\s*=\s*([\w.:-]+)/i.exec(head);
-  return match ? match[1].toLowerCase() : "";
-}
-
-function decodeBody(buffer, contentType) {
-  let label = parseCharset(contentType);
-  if (!label && /html|xml/i.test(String(contentType || ""))) label = sniffHtmlCharset(buffer);
-  if (!label) label = "utf-8";
-  try {
-    return new TextDecoder(label, { fatal: false }).decode(buffer);
-  } catch {
-    // 无法识别的 label（或该 Node 没编进对应编码表）：退回 UTF-8，不抛错。
-    return buffer.toString("utf8");
-  }
-}
-
+// #88：按声明的 charset 解码。GBK/GB2312/Big5/Shift_JIS 老站很常见，
+// 一律当 UTF-8 会得到整页 \uFFFD，而且不会报错、不会降级，模型直接吃一页乱码。
+function parseCharset(contentType) {
+  const match = /charset\s*=\s*"?([^";\s]+)"?/i.exec(String(contentType || ""));
+  return match ? match[1].trim().toLowerCase() : "";
+}
+
+function sniffHtmlCharset(buffer) {
+  const head = buffer.subarray(0, 2048).toString("latin1");
+  let match = /<meta[^>]+charset\s*=\s*["']?\s*([\w.:-]+)/i.exec(head);
+  if (match) return match[1].toLowerCase();
+  match = /<meta[^>]+content\s*=\s*["'][^"']*charset\s*=\s*([\w.:-]+)/i.exec(head);
+  return match ? match[1].toLowerCase() : "";
+}
+
+function decodeBody(buffer, contentType) {
+  let label = parseCharset(contentType);
+  if (!label && /html|xml/i.test(String(contentType || ""))) label = sniffHtmlCharset(buffer);
+  if (!label) label = "utf-8";
+  try {
+    return new TextDecoder(label, { fatal: false }).decode(buffer);
+  } catch {
+    // 无法识别的 label（或该 Node 没编进对应编码表）：退回 UTF-8，不抛错。
+    return buffer.toString("utf8");
+  }
+}
+
 /** GET 跟随重定向（≤5 跳），返回最终 URL / 状态 / 正文 / 内容类型；支持 gzip/br/deflate 解压。 */
 export function httpsGetFollow(url, { headers = {}, timeoutMs = 20000, signal } = {}, transport = https) {
   return new Promise((resolve, reject) => {

package/lib/index.js

@@ -9,7 +9,7 @@ import { mcpCall, mcpContentText, parseMcpResponseText } from "./mcp_adapter.js"
 import { registerResearchTool } from "./research.js";
 import { registerDomainSearchTool } from "./vertical.js";
 import { createFetchProvider } from "./fetch_provider.js";
-import { fetchWeather, sanitizeWeatherResult, WEATHER_OUTPUT_SCHEMA } from "./weather.js";
+import { fetchWeather, formatWeather, sanitizeWeatherResult, WEATHER_OUTPUT_SCHEMA } from "./weather.js";
 import { setActiveBlockedDomains, getActiveBlockedDomains, isDomainBlocked, applyBlockedFilterToResult } from "./domain_filter.js";
 import { stripTrackingParams, normalizeUrlForDedupe } from "./url_norm.js";
 import { selectEngines, planTopUp, resolveMinSources, describeTarget, credentialRequirement, partitionByCredentials, rankMergedResults, domainOf } from "./multi_policy.js";
@@ -155,6 +155,9 @@ const KEENABLE_MCP_URL = "https://api.keenable.ai/mcp";
 const SERPBASE_URL = "https://api.serpbase.dev/google/search";
 const SERPLY_URL = "https://api.serply.io/v1/search";
 const YOUCOM_URL = "https://ydc-index.io/v1/search";
+// You.com 免 key 档：同样的 query / count 参数与 results.web[] 响应，每天 100 次免费搜索
+const YOUCOM_FREE_URL = "https://api.you.com/v1/agents/search";
+const YOUCOM_KEYS_LINK = "https://you.com/platform/api-keys";
 const TINYFISH_URL = "https://api.search.tinyfish.ai";
 const JINA_URL = "https://s.jina.ai/";
 const DOUBAO_SEARCH_URL = "https://open.feedcoopapi.com/search_api/web_search";
@@ -399,7 +402,7 @@ function routeEngines(query, { timeRange, disabledEngines = [], fallbackOrder =
 }
 
 // 当前插件版本（发布时与 package.json 同步；跟随上游 v0.7.5，不在 PR 里 bump）
-const PLUGIN_VERSION = "0.9.13";
+const PLUGIN_VERSION = "0.9.15";
 // 检查更新的 npm registry 元数据地址（dsh-free-search 是 npmjs 上的公开包）
 const NPM_REGISTRY_URL = "https://registry.npmjs.org/dsh-free-search/latest";
 const PLUGIN_NPM_URL = "https://www.npmjs.com/package/dsh-free-search";
@@ -2255,16 +2258,17 @@ async function searchSerply(query, maxResults, apiKey, options, signal) {
   return { sources: uniqueSources(sources, maxResults ?? 10), truncated: false };
 }
 
-// You.com: requires YOUCOM_API_KEY (get a free key at https://you.com/platform/api-keys)
+// You.com：无 key 走免 key 档（api.you.com/v1/agents/search，每天 100 次），有 key 走官方 Search API（X-API-Key）。
+// key 读取 YDC_API_KEY（标准名），旧名 YOUCOM_API_KEY 继续兼容，见 resolveYoucomApiKey。
 async function searchYoucom(query, maxResults, apiKey, signal) {
-  if (!apiKey) throw new Error("You.com search requires YOUCOM_API_KEY");
-  // 官方 Search API（keyed tier）：GET + query 参数，X-API-Key 认证；count 为每段条数上限
+  // 两档参数相同：GET + query 参数；count 为每段条数上限
   const params = new URLSearchParams({ query, count: String(Math.min(maxResults ?? 10, 20)) });
-  const response = await fetch(`${YOUCOM_URL}?${params}`, {
+  const keyed = Boolean(apiKey);
+  const response = await fetch(`${keyed ? YOUCOM_URL : YOUCOM_FREE_URL}?${params}`, {
     method: "GET",
     redirect: "error",
     headers: {
-      "X-API-Key": apiKey,
+      ...(keyed ? { "X-API-Key": apiKey } : {}),
       accept: "application/json",
       "user-agent": "deepseek-harness/free-search",
     },
@@ -2272,13 +2276,16 @@ async function searchYoucom(query, maxResults, apiKey, signal) {
   });
   if (!response.ok) {
     const detail = await response.text().catch(() => "");
-    if (response.status === 401 || response.status === 403) {
+    if (keyed && (response.status === 401 || response.status === 403)) {
       throw new Error(`You.com API key is invalid (HTTP ${response.status}) - update it in Settings > Plugins > Free Search`);
     }
     if (response.status === 402) {
       throw new Error(`You.com quota/billing error (HTTP 402) - check usage at you.com/platform/api-keys. ${detail.slice(0, 200)}`);
     }
     if (response.status === 429) {
+      if (!keyed) {
+        throw new Error(`You.com free tier rate limit exceeded (HTTP 429) - set YDC_API_KEY for higher limits: ${YOUCOM_KEYS_LINK}`);
+      }
       throw new Error("You.com rate limit exceeded (HTTP 429) - check your plan at you.com/platform/api-keys");
     }
     throw new Error(`You.com API error (HTTP ${response.status}): ${detail.slice(0, 200)}`);
@@ -2301,6 +2308,23 @@ async function searchYoucom(query, maxResults, apiKey, signal) {
   return { sources: uniqueSources(sources, maxResults ?? 10), truncated: false };
 }
 
+// You.com key 解析（纯函数，便于断言）：凭据中心 YDC_API_KEY → 凭据中心 YOUCOM_API_KEY → 设置页 youcomApiKey
+// → 环境变量 YDC_API_KEY → 环境变量 YOUCOM_API_KEY。与其它引擎一样凭据中心优先；旧名只是别名，已有配置不受影响。
+const YOUCOM_KEY_REFS = ["YDC_API_KEY", "YOUCOM_API_KEY"];
+async function resolveYoucomApiKey({ resolveCredential, settingsValue, env } = {}) {
+  if (resolveCredential) {
+    for (const ref of YOUCOM_KEY_REFS) {
+      const value = await resolveCredential(ref);
+      if (value) return value;
+    }
+  }
+  if (settingsValue) return settingsValue;
+  for (const ref of YOUCOM_KEY_REFS) {
+    if (env?.[ref]) return env[ref];
+  }
+  return "";
+}
+
 // TinyFish Search（api.search.tinyfish.ai）：GET + X-API-Key；免费 12000 请求/天。
 // 支持 after_date / before_date（YYYY-MM-DD）时间过滤。
 async function searchTinyfish(query, maxResults, apiKey, timeRange, signal) {
@@ -3430,6 +3454,7 @@ const KEY_REF_MAP = {
   serpbaseApiKey: "SERPBASE_API_KEY",
   serplyApiKey: "SERPLY_API_KEY",
   deepseekApiKey: "DEEPSEEK_API_KEY",
+  // 设置页写入的凭据槽位保持旧名，已保存的 key 不受影响；读取时 YDC_API_KEY 优先（见 resolveYoucomApiKey）
   youcomApiKey: "YOUCOM_API_KEY",
   baiduApiKey: "BAIDU_API_KEY",
   kimiApiKey: "MOONSHOT_API_KEY",
@@ -3699,23 +3724,23 @@ function apply(ctx, config) {
   // credentials 服务可能晚于本插件挂载（跨 bundle 顺序），运行期动态获取而不是 apply 时缓存
   const getCredentials = () => ctx.get("credentials");
 
-  // #84：读取宿主的远程访问信任集合（--trusted-host / --public-url），供桥接 Host 围栏使用。
-  // webStartup 只在 dsh web 下提供；拿不到就维持 loopback-only 的老行为。
-  ctx.inject(["webStartup"], (sctx) => {
-    try {
-      const startup = sctx.get("webStartup");
-      if (!startup) return;
-      if (Array.isArray(startup.trustedHosts)) {
-        bridgeTrust.hosts = startup.trustedHosts
-          .filter((entry) => typeof entry === "string" && entry.trim())
-          .map((entry) => entry.trim());
-      }
-      if (typeof startup.publicUrl === "string" && startup.publicUrl) {
-        try {
-          bridgeTrust.publicHost = new URL(startup.publicUrl).host;
-        } catch {}
-      }
-    } catch {}
+  // #84：读取宿主的远程访问信任集合（--trusted-host / --public-url），供桥接 Host 围栏使用。
+  // webStartup 只在 dsh web 下提供；拿不到就维持 loopback-only 的老行为。
+  ctx.inject(["webStartup"], (sctx) => {
+    try {
+      const startup = sctx.get("webStartup");
+      if (!startup) return;
+      if (Array.isArray(startup.trustedHosts)) {
+        bridgeTrust.hosts = startup.trustedHosts
+          .filter((entry) => typeof entry === "string" && entry.trim())
+          .map((entry) => entry.trim());
+      }
+      if (typeof startup.publicUrl === "string" && startup.publicUrl) {
+        try {
+          bridgeTrust.publicHost = new URL(startup.publicUrl).host;
+        } catch {}
+      }
+    } catch {}
   });
 
   // 系统提示词动态刷新：设置变更时重新生成，避免显示旧引擎
@@ -3808,6 +3833,21 @@ function apply(ctx, config) {
     return resolveApiKey("GOOGLE_API_KEY", undefined);
   };
   const resolveClaudeKey = () => resolveApiKey("ANTHROPIC_API_KEY", "claudeApiKey");
+  // You.com：标准名 YDC_API_KEY，旧名 YOUCOM_API_KEY 作为别名继续生效（不配 key 走免 key 档）
+  const resolveYoucomKey = () =>
+    resolveYoucomApiKey({
+      resolveCredential: async (ref) => {
+        const credentials = getCredentials();
+        if (!credentials) return "";
+        try {
+          return (await credentials.resolve(ref))?.value ?? "";
+        } catch {
+          return "";
+        }
+      },
+      settingsValue: current().youcomApiKey,
+      env: process.env,
+    });
 
   // 总控 provider：按 settings 的 provider 字段路由到任意引擎。
   // 任何引擎失败（缺 key / 401 / 限流 / 网络）都会自动轮流尝试下一个引擎，
@@ -4055,14 +4095,8 @@ function apply(ctx, config) {
             }
             result = await searchSerply(request.query, request.maxResults, key, cfg, effSignal);
           } else if (engine === "you") {
-            // you.com：必须配置 YOUCOM_API_KEY（无 key 跳过）
-            const key = await resolveApiKey("YOUCOM_API_KEY", "youcomApiKey");
-            if (!key) {
-              lastError = new Error("You.com requires YOUCOM_API_KEY (get one at you.com/platform/api-keys)");
-              if (engine === preferred) preferredFailure = "YOUCOM_API_KEY is not configured";
-              logger.warn(`free-search: engine "${engine}" skipped (no key), trying next engine`);
-              continue; // 无 key 跳过
-            }
+            // you.com：有 key（YDC_API_KEY / 旧名 YOUCOM_API_KEY）走官方 Search API，无 key 走免 key 档（每天 100 次）
+            const key = await resolveYoucomKey();
             result = await searchYoucom(request.query, request.maxResults, key, effSignal);
           } else if (engine === "tinyfish") {
             // tinyfish：必须配置 TINYFISH_API_KEY（无 key 跳过）；免费 12000 请求/天
@@ -4599,8 +4633,7 @@ function apply(ctx, config) {
           return await searchClaude(q, n, key, current());
         }
         case "you": {
-          const key = await resolveApiKey("YOUCOM_API_KEY", "youcomApiKey");
-          if (!key) return { ok: false, error: "YOUCOM_API_KEY not configured" };
+          const key = await resolveYoucomKey();
           return await searchYoucom(q, n, key);
         }
         default:
@@ -5216,27 +5249,12 @@ function apply(ctx, config) {
           output: {
             schema: WEATHER_OUTPUT_SCHEMA,
             render(args, value) {
-              const lang = outputLanguage(configLanguage(current()));
-              const c = value.current ?? {};
-              const lines = [];
-              lines.push(lang === "en" ? `Weather for ${value.location}:` : `${value.location} 天气：`);
-              lines.push(
-                lang === "en"
-                  ? `Now: ${c.temperature}°C (feels ${c.apparent}°C), ${c.text}, humidity ${c.humidity}%, wind ${c.wind} km/h`
-                  : `当前：${c.temperature}°C（体感 ${c.apparent}°C），${c.text}，湿度 ${c.humidity}%，风速 ${c.wind} km/h`
-              );
-              for (const d of value.daily ?? []) {
-                lines.push(
-                  lang === "en"
-                    ? `${d.date}: ${d.min}~${d.max}°C, ${d.text}${d.precipitationProbability !== undefined ? `, precip ${d.precipitationProbability}%` : ""}`
-                    : `${d.date}：${d.min}~${d.max}°C，${d.text}${d.precipitationProbability !== undefined ? `，降水概率 ${d.precipitationProbability}%` : ""}`
-                );
-              }
-              return [{ type: "text", text: wrapUntrustedBlock(lines.join("\n")) }];
+              // 正文 zh / en / ja 三套（其它语言回退 en），与 fetchWeather 生成的天气描述同一语言
+              return [{ type: "text", text: wrapUntrustedBlock(formatWeather(value, configLanguage(current()))) }];
             },
           },
           async execute(args) {
-            // 天气正文只提供 zh/en（回退 en），地理编码用真实搜索语言（ja 就查日文地名）。
+            // 天气正文 zh/en/ja（其它回退 en，见 textLanguage），地理编码用真实搜索语言（ja 就查日文地名）。
             const lang = searchLanguage(configLanguage(current()));
             const location = String(args.location ?? "").trim();
             if (!location) throw new Error("weather: location is required");
@@ -5585,6 +5603,9 @@ export {
   searchTinyfish,
   searchJina,
   searchYoucom,
+  resolveYoucomApiKey,
+  YOUCOM_FREE_URL,
+  YOUCOM_URL,
   searchZhihuGlobal,
   searchZhihuSite,
   ZHIHU_MCP_URL,

package/lib/multi_policy.js

@@ -208,7 +208,7 @@ export function rankMergedResults(items, { appliesFreshness = false } = {}) {
  * `if (!key) return { error: "<ENV> not configured" }` 的引擎**，与代码自身对
  * 「缺 key」的声明严格一致。
  *   - 免 key 引擎 ddg/ddg-lite/bing/searxng 不收；
- *   - 有免 key 兜底的 anysearch（key 可空）/ exa、parallel（回落 MCP）不收；
+ *   - 有免 key 兜底的 anysearch（key 可空）/ exa、parallel（回落 MCP）/ you（无 key 走免 key 档）不收；
  *   - tavily/keenable/firecrawl 分支没有 not configured 检查（缺 key 时会带着空串去请求，
  *     以鉴权失败收场），暂不收——那属于另一个行为变更，需单独决定。
  * settings 字段必须带上：只在环境变量里找 key 会漏掉「仅填在设置页」的用户。
@@ -236,7 +236,6 @@ export const REQUIRED_CREDENTIALS = {
     { env: "GOOGLE_API_KEY", settings: null },
   ],
   claude: [{ env: "ANTHROPIC_API_KEY", settings: "claudeApiKey" }],
-  you: [{ env: "YOUCOM_API_KEY", settings: "youcomApiKey" }],
 };
 
 /** 该引擎需要哪些凭据描述符；不需要凭据（免 key / 有兜底）时返回 null。 */

package/lib/weather.js

@@ -1,183 +1,214 @@
-// Weather（Open-Meteo：geocoding + forecast，全部免 key）
-// 与 lib/index.js 的 weather 工具配套。这里同时导出 output schema 与 sanitizeWeatherResult()，
-// 使 tools/assert-weather-contract.mjs 能离线校验「返回值 ↔ schema」逐字段对齐——
-// 0.8.4/0.8.5 曾因 schema 漏声明 latitude/longitude/timezone/current.code/daily[].code
-// 导致 additionalProperties:false 校验失败、工具 100% 不可用（issue #73）。
-
-const OPEN_METEO_GEOCODING_URL = "https://geocoding-api.open-meteo.com/v1/search";
-const OPEN_METEO_FORECAST_URL = "https://api.open-meteo.com/v1/forecast";
-
-// WMO weather code → 描述（中文/英文）
-const WMO_CODES = {
-  0: ["晴", "Clear sky"],
-  1: ["大部晴朗", "Mainly clear"],
-  2: ["多云", "Partly cloudy"],
-  3: ["阴", "Overcast"],
-  45: ["雾", "Fog"],
-  48: ["雾凇", "Depositing rime fog"],
-  51: ["毛毛雨（弱）", "Light drizzle"],
-  53: ["毛毛雨", "Moderate drizzle"],
-  55: ["毛毛雨（强）", "Dense drizzle"],
-  56: ["冻毛毛雨（弱）", "Light freezing drizzle"],
-  57: ["冻毛毛雨（强）", "Dense freezing drizzle"],
-  61: ["小雨", "Slight rain"],
-  63: ["中雨", "Moderate rain"],
-  65: ["大雨", "Heavy rain"],
-  66: ["冻雨（弱）", "Light freezing rain"],
-  67: ["冻雨（强）", "Heavy freezing rain"],
-  71: ["小雪", "Slight snow"],
-  73: ["中雪", "Moderate snow"],
-  75: ["大雪", "Heavy snow"],
-  77: ["雪粒", "Snow grains"],
-  80: ["阵雨（弱）", "Slight rain showers"],
-  81: ["阵雨", "Moderate rain showers"],
-  82: ["阵雨（强）", "Violent rain showers"],
-  85: ["阵雪（弱）", "Slight snow showers"],
-  86: ["阵雪（强）", "Heavy snow showers"],
-  95: ["雷暴", "Thunderstorm"],
-  96: ["雷暴伴小冰雹", "Thunderstorm with slight hail"],
-  99: ["雷暴伴大冰雹", "Thunderstorm with heavy hail"],
-};
-/** 天气文案只有 zh / en 两套；其它语言（ja/ru/…）走英文，避免整段中文（#92）。 */
-export function textLanguage(lang) {
-  return String(lang ?? "").trim().toLowerCase() === "zh" ? "zh" : "en";
-}
-
-export function wmoText(code, lang) {
-  const textLang = textLanguage(lang);
-  const hit = WMO_CODES[code];
-  if (!hit) return textLang === "zh" ? "未知" : "Unknown";
-  return (textLang === "zh" ? hit[0] : hit[1]) + ` (WMO ${code})`;
-}
-
-export async function geocodeLocation(name, signal, language = "en") {
-  const params = new URLSearchParams({ name, count: "1", language: String(language ?? "en") || "en", format: "json" });
-  const response = await fetch(`${OPEN_METEO_GEOCODING_URL}?${params}`, {
-    method: "GET",
-    redirect: "error",
-    headers: { accept: "application/json", "user-agent": "deepseek-harness/free-search" },
-    signal: AbortSignal.any([...(signal !== undefined ? [signal] : []), AbortSignal.timeout(15000)]),
-  });
-  if (!response.ok) throw new Error(`geocoding API error (HTTP ${response.status})`);
-  const data = await response.json();
-  const hit = data.results?.[0];
-  if (!hit) return null;
-  return {
-    name: hit.name,
-    admin: hit.admin1 ?? "",
-    country: hit.country ?? "",
-    latitude: hit.latitude,
-    longitude: hit.longitude,
-  };
-}
-
-export async function fetchWeather(location, days, lang, signal) {
-  const geo = await geocodeLocation(location, signal, lang);
-  if (!geo) throw new Error(`could not geocode location "${location}" — try a nearby larger city`);
-  const params = new URLSearchParams({
-    latitude: String(geo.latitude),
-    longitude: String(geo.longitude),
-    current: "temperature_2m,relative_humidity_2m,apparent_temperature,weather_code,wind_speed_10m",
-    daily: "weather_code,temperature_2m_max,temperature_2m_min,precipitation_probability_max",
-    timezone: "auto",
-    forecast_days: String(Math.min(Math.max(Number(days) || 3, 1), 7)),
-  });
-  const response = await fetch(`${OPEN_METEO_FORECAST_URL}?${params}`, {
-    method: "GET",
-    redirect: "error",
-    headers: { accept: "application/json", "user-agent": "deepseek-harness/free-search" },
-    signal: AbortSignal.any([...(signal !== undefined ? [signal] : []), AbortSignal.timeout(15000)]),
-  });
-  if (!response.ok) throw new Error(`forecast API error (HTTP ${response.status})`);
-  const data = await response.json();
-  const cur = data.current ?? {};
-  const daily = data.daily ?? {};
-  return {
-    location: [geo.name, geo.admin, geo.country].filter(Boolean).join(", "),
-    latitude: geo.latitude,
-    longitude: geo.longitude,
-    current: {
-      temperature: cur.temperature_2m,
-      apparent: cur.apparent_temperature,
-      humidity: cur.relative_humidity_2m,
-      wind: cur.wind_speed_10m,
-      code: cur.weather_code,
-      text: wmoText(cur.weather_code, lang),
-    },
-    daily: (daily.time ?? []).map((date, i) => ({
-      date,
-      min: daily.temperature_2m_min?.[i],
-      max: daily.temperature_2m_max?.[i],
-      code: daily.weather_code?.[i],
-      text: wmoText(daily.weather_code?.[i], lang),
-      precipitationProbability: daily.precipitation_probability_max?.[i],
-    })),
-    timezone: data.timezone ?? "",
-  };
-}
-
-// weather 工具的 output schema。与 fetchWeather 返回值逐字段对齐：
-// 任何一边增删字段都必须同步，否则 additionalProperties:false 会让工具调用失败（#73）。
-export const WEATHER_OUTPUT_SCHEMA = {
-  type: "object",
-  additionalProperties: false,
-  properties: {
-    location: { type: "string" },
-    latitude: { type: "number" },
-    longitude: { type: "number" },
-    timezone: { type: "string" },
-    current: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        temperature: { type: "number" },
-        apparent: { type: "number" },
-        humidity: { type: "number" },
-        wind: { type: "number" },
-        code: { type: "number" },
-        text: { type: "string" },
-      },
-    },
-    daily: {
-      type: "array",
-      items: {
-        type: "object",
-        additionalProperties: false,
-        properties: {
-          date: { type: "string" },
-          min: { type: "number" },
-          max: { type: "number" },
-          code: { type: "number" },
-          text: { type: "string" },
-          precipitationProbability: { type: "number" },
-        },
-      },
-    },
-  },
-};
-
-// lossless JSON 不允许 undefined 字段：按"存在且有值"构造对象（与其它工具的做法一致）。
-export function sanitizeWeatherResult(r) {
-  return {
-    location: r.location,
-    ...(r.latitude !== undefined ? { latitude: r.latitude } : {}),
-    ...(r.longitude !== undefined ? { longitude: r.longitude } : {}),
-    ...(r.timezone ? { timezone: r.timezone } : {}),
-    current: {
-      ...(r.current?.temperature !== undefined ? { temperature: r.current.temperature } : {}),
-      ...(r.current?.apparent !== undefined ? { apparent: r.current.apparent } : {}),
-      ...(r.current?.humidity !== undefined ? { humidity: r.current.humidity } : {}),
-      ...(r.current?.wind !== undefined ? { wind: r.current.wind } : {}),
-      ...(r.current?.code !== undefined ? { code: r.current.code } : {}),
-      ...(r.current?.text ? { text: r.current.text } : {}),
-    },
-    daily: (r.daily ?? []).map((d) => ({
-      date: d.date,
-      ...(d.min !== undefined ? { min: d.min } : {}),
-      ...(d.max !== undefined ? { max: d.max } : {}),
-      ...(d.code !== undefined ? { code: d.code } : {}),
-      ...(d.text ? { text: d.text } : {}),
-      ...(d.precipitationProbability !== undefined ? { precipitationProbability: d.precipitationProbability } : {}),
-    })),
-  };
-}
+// Weather（Open-Meteo：geocoding + forecast，全部免 key）
+// 与 lib/index.js 的 weather 工具配套。这里同时导出 output schema 与 sanitizeWeatherResult()，
+// 使 tools/assert-weather-contract.mjs 能离线校验「返回值 ↔ schema」逐字段对齐——
+// 0.8.4/0.8.5 曾因 schema 漏声明 latitude/longitude/timezone/current.code/daily[].code
+// 导致 additionalProperties:false 校验失败、工具 100% 不可用（issue #73）。
+
+const OPEN_METEO_GEOCODING_URL = "https://geocoding-api.open-meteo.com/v1/search";
+const OPEN_METEO_FORECAST_URL = "https://api.open-meteo.com/v1/forecast";
+
+// WMO weather code → 描述（中文/英文/日文）。
+// 日文按日本气象厅「国際式の天気記号」的 ww 表（与 Open-Meteo 的 code 同一套编号）：
+// https://www.jma.go.jp/jma/kishou/know/kurashi/symbols.html
+// 「X，弱」→ 弱いX，「X，並」「X，並又は強」→ X，「X，強」→ 強いX，「激しい」→ 激しいX。
+// 0–3 在 ww 表里是「云的变化」而非云量，按气象厅预报用语（快晴 / 晴れ / 曇り）与天气预报画面的
+// 天気テロップ「晴時々曇 = PARTLY CLOUDY」对应。96/99 的强弱在 ww 表里指雷电而非冰雹。
+const WMO_CODES = {
+  0: ["晴", "Clear sky", "快晴"],
+  1: ["大部晴朗", "Mainly clear", "晴れ"],
+  2: ["多云", "Partly cloudy", "晴れ時々曇り"],
+  3: ["阴", "Overcast", "曇り"],
+  45: ["雾", "Fog", "霧"],
+  48: ["雾凇", "Depositing rime fog", "霧（霧氷を伴う）"],
+  51: ["毛毛雨（弱）", "Light drizzle", "弱い霧雨"],
+  53: ["毛毛雨", "Moderate drizzle", "霧雨"],
+  55: ["毛毛雨（强）", "Dense drizzle", "強い霧雨"],
+  56: ["冻毛毛雨（弱）", "Light freezing drizzle", "弱い着氷性の霧雨"],
+  57: ["冻毛毛雨（强）", "Dense freezing drizzle", "着氷性の霧雨"],
+  61: ["小雨", "Slight rain", "弱い雨"],
+  63: ["中雨", "Moderate rain", "雨"],
+  65: ["大雨", "Heavy rain", "強い雨"],
+  66: ["冻雨（弱）", "Light freezing rain", "弱い着氷性の雨"],
+  67: ["冻雨（强）", "Heavy freezing rain", "着氷性の雨"],
+  71: ["小雪", "Slight snow", "弱い雪"],
+  73: ["中雪", "Moderate snow", "雪"],
+  75: ["大雪", "Heavy snow", "強い雪"],
+  77: ["雪粒", "Snow grains", "霧雪"],
+  80: ["阵雨（弱）", "Slight rain showers", "弱いにわか雨"],
+  81: ["阵雨", "Moderate rain showers", "にわか雨"],
+  82: ["阵雨（强）", "Violent rain showers", "激しいにわか雨"],
+  85: ["阵雪（弱）", "Slight snow showers", "弱いにわか雪"],
+  86: ["阵雪（强）", "Heavy snow showers", "にわか雪"],
+  95: ["雷暴", "Thunderstorm", "雷雨"],
+  96: ["雷暴伴小冰雹", "Thunderstorm with slight hail", "雷雨（ひょうを伴う）"],
+  99: ["雷暴伴大冰雹", "Thunderstorm with heavy hail", "激しい雷雨（ひょうを伴う）"],
+};
+const TEXT_LANGUAGES = ["zh", "en", "ja"];
+const UNKNOWN_TEXT = { zh: "未知", en: "Unknown", ja: "不明" };
+
+/** 天气文案有 zh / en / ja 三套；其它语言（ru/de/…）走英文，避免整段中文（#92）。 */
+export function textLanguage(lang) {
+  const tag = String(lang ?? "").trim().toLowerCase();
+  return TEXT_LANGUAGES.includes(tag) ? tag : "en";
+}
+
+export function wmoText(code, lang) {
+  const textLang = textLanguage(lang);
+  const hit = WMO_CODES[code];
+  if (!hit) return UNKNOWN_TEXT[textLang];
+  return hit[TEXT_LANGUAGES.indexOf(textLang)] + ` (WMO ${code})`;
+}
+
+/** weather 工具的正文（render 用）。lang 同 textLanguage()，description 由 fetchWeather 按同一语言生成。 */
+export function formatWeather(value, lang) {
+  const textLang = textLanguage(lang);
+  const c = value.current ?? {};
+  const pp = (d, fmt) => (d.precipitationProbability !== undefined ? fmt(d.precipitationProbability) : "");
+  const lines = [];
+  if (textLang === "zh") {
+    lines.push(`${value.location} 天气：`);
+    lines.push(`当前：${c.temperature}°C（体感 ${c.apparent}°C），${c.text}，湿度 ${c.humidity}%，风速 ${c.wind} km/h`);
+    for (const d of value.daily ?? []) lines.push(`${d.date}：${d.min}~${d.max}°C，${d.text}${pp(d, (p) => `，降水概率 ${p}%`)}`);
+  } else if (textLang === "ja") {
+    lines.push(`${value.location} の天気：`);
+    lines.push(`現在：${c.temperature}°C（体感 ${c.apparent}°C）、${c.text}、湿度 ${c.humidity}%、風速 ${c.wind} km/h`);
+    for (const d of value.daily ?? []) lines.push(`${d.date}：${d.min}〜${d.max}°C、${d.text}${pp(d, (p) => `、降水確率 ${p}%`)}`);
+  } else {
+    lines.push(`Weather for ${value.location}:`);
+    lines.push(`Now: ${c.temperature}°C (feels ${c.apparent}°C), ${c.text}, humidity ${c.humidity}%, wind ${c.wind} km/h`);
+    for (const d of value.daily ?? []) lines.push(`${d.date}: ${d.min}~${d.max}°C, ${d.text}${pp(d, (p) => `, precip ${p}%`)}`);
+  }
+  return lines.join("\n");
+}
+
+export async function geocodeLocation(name, signal, language = "en") {
+  const params = new URLSearchParams({ name, count: "1", language: String(language ?? "en") || "en", format: "json" });
+  const response = await fetch(`${OPEN_METEO_GEOCODING_URL}?${params}`, {
+    method: "GET",
+    redirect: "error",
+    headers: { accept: "application/json", "user-agent": "deepseek-harness/free-search" },
+    signal: AbortSignal.any([...(signal !== undefined ? [signal] : []), AbortSignal.timeout(15000)]),
+  });
+  if (!response.ok) throw new Error(`geocoding API error (HTTP ${response.status})`);
+  const data = await response.json();
+  const hit = data.results?.[0];
+  if (!hit) return null;
+  return {
+    name: hit.name,
+    admin: hit.admin1 ?? "",
+    country: hit.country ?? "",
+    latitude: hit.latitude,
+    longitude: hit.longitude,
+  };
+}
+
+export async function fetchWeather(location, days, lang, signal) {
+  const geo = await geocodeLocation(location, signal, lang);
+  if (!geo) throw new Error(`could not geocode location "${location}" — try a nearby larger city`);
+  const params = new URLSearchParams({
+    latitude: String(geo.latitude),
+    longitude: String(geo.longitude),
+    current: "temperature_2m,relative_humidity_2m,apparent_temperature,weather_code,wind_speed_10m",
+    daily: "weather_code,temperature_2m_max,temperature_2m_min,precipitation_probability_max",
+    timezone: "auto",
+    forecast_days: String(Math.min(Math.max(Number(days) || 3, 1), 7)),
+  });
+  const response = await fetch(`${OPEN_METEO_FORECAST_URL}?${params}`, {
+    method: "GET",
+    redirect: "error",
+    headers: { accept: "application/json", "user-agent": "deepseek-harness/free-search" },
+    signal: AbortSignal.any([...(signal !== undefined ? [signal] : []), AbortSignal.timeout(15000)]),
+  });
+  if (!response.ok) throw new Error(`forecast API error (HTTP ${response.status})`);
+  const data = await response.json();
+  const cur = data.current ?? {};
+  const daily = data.daily ?? {};
+  return {
+    location: [geo.name, geo.admin, geo.country].filter(Boolean).join(", "),
+    latitude: geo.latitude,
+    longitude: geo.longitude,
+    current: {
+      temperature: cur.temperature_2m,
+      apparent: cur.apparent_temperature,
+      humidity: cur.relative_humidity_2m,
+      wind: cur.wind_speed_10m,
+      code: cur.weather_code,
+      text: wmoText(cur.weather_code, lang),
+    },
+    daily: (daily.time ?? []).map((date, i) => ({
+      date,
+      min: daily.temperature_2m_min?.[i],
+      max: daily.temperature_2m_max?.[i],
+      code: daily.weather_code?.[i],
+      text: wmoText(daily.weather_code?.[i], lang),
+      precipitationProbability: daily.precipitation_probability_max?.[i],
+    })),
+    timezone: data.timezone ?? "",
+  };
+}
+
+// weather 工具的 output schema。与 fetchWeather 返回值逐字段对齐：
+// 任何一边增删字段都必须同步，否则 additionalProperties:false 会让工具调用失败（#73）。
+export const WEATHER_OUTPUT_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    location: { type: "string" },
+    latitude: { type: "number" },
+    longitude: { type: "number" },
+    timezone: { type: "string" },
+    current: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        temperature: { type: "number" },
+        apparent: { type: "number" },
+        humidity: { type: "number" },
+        wind: { type: "number" },
+        code: { type: "number" },
+        text: { type: "string" },
+      },
+    },
+    daily: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          date: { type: "string" },
+          min: { type: "number" },
+          max: { type: "number" },
+          code: { type: "number" },
+          text: { type: "string" },
+          precipitationProbability: { type: "number" },
+        },
+      },
+    },
+  },
+};
+
+// lossless JSON 不允许 undefined 字段：按"存在且有值"构造对象（与其它工具的做法一致）。
+export function sanitizeWeatherResult(r) {
+  return {
+    location: r.location,
+    ...(r.latitude !== undefined ? { latitude: r.latitude } : {}),
+    ...(r.longitude !== undefined ? { longitude: r.longitude } : {}),
+    ...(r.timezone ? { timezone: r.timezone } : {}),
+    current: {
+      ...(r.current?.temperature !== undefined ? { temperature: r.current.temperature } : {}),
+      ...(r.current?.apparent !== undefined ? { apparent: r.current.apparent } : {}),
+      ...(r.current?.humidity !== undefined ? { humidity: r.current.humidity } : {}),
+      ...(r.current?.wind !== undefined ? { wind: r.current.wind } : {}),
+      ...(r.current?.code !== undefined ? { code: r.current.code } : {}),
+      ...(r.current?.text ? { text: r.current.text } : {}),
+    },
+    daily: (r.daily ?? []).map((d) => ({
+      date: d.date,
+      ...(d.min !== undefined ? { min: d.min } : {}),
+      ...(d.max !== undefined ? { max: d.max } : {}),
+      ...(d.code !== undefined ? { code: d.code } : {}),
+      ...(d.text ? { text: d.text } : {}),
+      ...(d.precipitationProbability !== undefined ? { precipitationProbability: d.precipitationProbability } : {}),
+    })),
+  };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-free-search",
-  "version": "0.9.13",
-  "description": "Free web search for DeepSeek Harness: 27 engines (Bing/DuckDuckGo/AnySearch/SearXNG/Exa/Tavily/Keenable/Firecrawl/Parallel keyless; Zhihu global/site via MCP and Perplexity/SerpBase/DeepSeek (official + native tools/search)/You.com/Baidu/Kimi/Aliyun/Doubao with key; OpenAI/Gemini/Claude model built-in search, explicit-only) + auto smart routing + global engine enable/disable & fallback priority + editable zh/en language pools + multi mode (parallel full language-pool merge) + multi_search cross-source tool + failure-aware fallback (quota/auth cooldown, transient retry, fallbackOn) + time filtering + platform search + domain blocklist (blockedDomains) + web_fetch, with web settings UI.",
+  "version": "0.9.15",
+  "description": "Free web search for DeepSeek Harness: 27 engines (Bing/DuckDuckGo/AnySearch/SearXNG/Exa/Tavily/Keenable/Firecrawl/Parallel/You.com keyless; Zhihu global/site via MCP and Perplexity/SerpBase/DeepSeek (official + native tools/search)/Baidu/Kimi/Aliyun/Doubao with key; OpenAI/Gemini/Claude model built-in search, explicit-only) + auto smart routing + global engine enable/disable & fallback priority + editable zh/en language pools + multi mode (parallel full language-pool merge) + multi_search cross-source tool + failure-aware fallback (quota/auth cooldown, transient retry, fallbackOn) + time filtering + platform search + domain blocklist (blockedDomains) + web_fetch, with web settings UI.",
   "type": "module",
   "main": "lib/index.js",
   "exports": {