dsh-search-plugin 0.0.0-stage → 0.1.5

package/README.md

@@ -1,3 +1,103 @@
-# Temporary Holding Version
+# 联网搜索（Web search）
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+将互联网作为智能体的信息来源，为分析与判断补充外部依据。
+
+TypeScript ESM 搜索组合包，目标运行版本 **DSH 0.2.1-rc.4**。注册 `codex` 搜索 Provider，复用官方 `web_search`；网页抓取复用本机 `http` Provider 与 `web_fetch`，不重复注册工具。
+
+```text
+web_search → ctx.web → codex → POST /v1/alpha/search
+web_fetch  → ctx.web → http  → 本机直接请求公开网页
+```
+
+## 安装与构建
+
+```sh
+pnpm install
+pnpm check
+# 在父目录执行，将 <name> 替换为目标 profile：
+dsh plugin --profile <name> add ./dsh-search-plugin
+```
+
+本地 checkout 安装需要保留插件目录及构建产物。`pnpm build` 构建 Host 和浏览器 lazy-CJS 模块；修改后需重新构建。首次安装或更新 bundle 后需要重启现有 DSH profile，再刷新网页；加载新版后，UI 的即时配置与凭据更新对下一次搜索生效。插件不会自动更改正在运行的 profile。
+
+bundle 要求标准 DSH base 已有 `web`、`web-fetch-http` 与工具消费者，并选择 `searchProvider: codex`、`fetchProvider: http`。不覆盖已有 HTTP fetch 安全限制、超时或 User-Agent；其他后应用的 patch 可覆盖路由。
+
+## 默认配置：无需填写端点或模型
+
+默认 `authMode: openai`、`openaiProvider: openai`，复用所选 OpenAI Provider 的实时 `baseURL` 与显式 `apiKeyEnv` 引用。例如：
+
+```yaml
+baseURL: https://your-api.example/v1
+apiKeyEnv: OPENAI_API_KEY
+```
+
+搜索自动请求 `https://your-api.example/v1/alpha/search`，通过官方 Credentials 服务解析同一个密钥引用。**不要求填写搜索模型，不调用 Responses，不做协议探测或失败回退。** 上游必须实现 Alpha 搜索接口，普通 OpenAI 兼容聊天服务不一定支持。
+
+端点与凭据一起继承。复用模式始终使用派生地址，忽略独立模式的 `endpoint`（包括旧版残留值）；不同地址请切换独立凭据模式，明确授权该地址使用的凭据引用。每次搜索捕获当前配置并解析一次凭据，不复制存储，不跨请求缓存。
+
+仅支持复用显式 `apiKeyEnv` 引用，不读取 Provider 私有对象、不提取 OAuth token、不绕过 stored-record 优先级、不实现 OAuth 刷新。自定义认证 headers 不会复制；这些连接请改用独立凭据。插件发送标准 Bearer API Key，不支持其他认证协议。
+
+## 配置 UI
+
+进入 **插件 → 联网搜索** 的组合包详情，或点击 **dsh-search-plugin 组件行 → 配置**。两处共用同一份实时配置：
+
+- 复用模式只显示 OpenAI Provider 路由；无需填写端点、模型或密钥。
+- 独立模式显示完整搜索端点 URL、凭据引用与密钥管理。
+- 两种模式均可设置超时、响应字节上限、答案字符上限。
+
+配置页使用官方 ConfigForms 服务和 revision 冲突检测，提供保存、重置与放弃编辑。重置只重置公开配置，不删除凭据或修改旧版密钥字段。密钥单独通过官方 Credentials API 管理：不返回明文、不进入普通配置、不写入浏览器存储；输入留空不会清除已有密钥。删除只删除该引用的托管值，环境变量或其他来源仍可能提供同名凭据。
+
+组合包与组件提供中英文名称和描述；包名与 Provider id 保持不变。自建最小 profile 需要挂载官方 Settings、ConfigEditor、Credentials 及对应 Web 客户端服务；仅 Host schema 不会自动生成页面。
+
+## 配置字段
+
+| 字段 | 默认值 | 含义 |
+| --- | --- | --- |
+| `authMode` | `openai` | `openai` 复用模式或 `credential` 独立模式 |
+| `openaiProvider` | `openai` | 复用模式的官方 LLM Provider id |
+| `credentialRef` | `DSH_CODEX_API_KEY` | 独立模式的官方凭据引用 / 环境变量名 |
+| `endpoint` | 空 | 复用模式自动派生 Alpha 搜索 URL；独立模式必须填写完整 POST URL |
+| `apiKey` | 无 | 兼容旧版的 Host-only 密钥，仅独立模式使用，优先于引用；推荐改用凭据管理 |
+| `timeoutMs` | `60000` | 单次搜索请求超时，毫秒 |
+| `maxResponseBytes` | `2000000` | 搜索响应主体的字节上限 |
+| `maxAnswerChars` | `16000` | 返回答案的字符上限 |
+
+以上字段为即时配置。上限仅控制搜索，不控制本机 HTTP fetch。旧版 `model` 不再使用。复用模式忽略旧 `endpoint`；独立模式升级后需把原 `/responses` 端点改为实际的 Alpha 搜索 URL，插件不会自动改写独立端点。
+
+bundle 可从启动进程环境读取 `DSH_CODEX_AUTH_MODE`（默认 `openai`）、`DSH_CODEX_ENDPOINT` 和旧版 `DSH_CODEX_API_KEY`。用环境变量直接提供搜索 API Key 时需同时设置 `DSH_CODEX_AUTH_MODE=credential`。不再需要 `DSH_CODEX_MODEL`。
+
+独立模式的 profile patch 示例：
+
+```yaml
+- id: dsh-search-plugin
+  config:
+    authMode: credential
+    endpoint: https://your-search.example/v1/alpha/search
+    credentialRef: SEARCH_API_KEY
+```
+
+**patch 替换整份 `config`，不是深度合并。** 修改时保留需要的字段，省略的字段使用 schema 默认值。不要把真实密钥提交进仓库或放入普通配置。插件自身不额外解析 `.env`。
+
+## 协议与安全边界
+
+只支持 **POST `/v1/alpha/search`**，不支持 Responses、Chat Completions 或直接连接 ChatGPT 私有后端；独立模式的 `endpoint` 是完整 URL，不自动补路径。协议按 [Codex 官方 SearchRequest/SearchResponse](https://github.com/openai/codex/blob/main/codex-rs/codex-api/src/search.rs) 实现，而不是替换 Responses URL：
+
+- 每次请求生成 `id`，发送 `commands.search_query: [{ q: 查询文本 }]`、用户 `input`、`settings: { allowed_callers: ['direct'], external_web_access: true }` 和 `max_output_tokens: 2048`，不发送 Responses `tools`、`tool_choice`、`include`、`stream` 或 `store`。
+- Alpha 协议自身要求 `model`。适配器内置路由模型 `gpt-5.6-luna`（[已公开 Alpha 适配器的默认值](https://unpkg.com/@caiqy/dsh-plugin-web-search@0.1.0/lib/providers.js)），不继承聊天模型，也不要求用户填写。目标服务必须支持此路由模型。
+- 响应读取文本 `output` 和可选 `results`（缺失、`null`、空数组均支持）。`results` 是可扩展的不透明条目，只提取有合法 HTTP(S) `url` 的来源及可选 `title`，不要求存在这些字段，不输出 `encrypted_output`。清理 Alpha 私有引用标记，来源去重后交给 DSH 管理数量限制。
+
+搜索端点会收到密钥与查询，请仅配置可信服务，推荐 HTTPS。配置缺失、鉴权错误、上游协议错误、超时等明确失败，不静默切换 Provider，不返回伪造的空结果。不自动重试，不跟随携带认证的重定向。来源只取自结构化响应，不从自然语言猜测或编造链接。DSH 的 `truncated` 表示来源被裁剪，不表示答案字符裁剪。
+
+网页与答案均属于不可信外部数据，不能作为系统指令或工具授权。排错时不要打印未脱敏请求头、真实密钥或完整远端错误正文。
+
+## 本机 HTTP fetch
+
+本机直接请求公开网页，不额外调用付费抓取 API，不携带搜索 API Key。仍有网络成本、搜索端点费用及正文进入模型后的 token 费用。
+
+复用官方 HTTP Provider 的 SSRF 防护、DNS 固定、同源重定向和正文限制。默认 30 秒超时、5 MB 响应、100,000 字符正文、最多 5 次同源跳转，已有 profile 的定制值不被本插件覆盖。不支持 JS 渲染、登录、验证码、PDF/二进制正文或跨源自动重定向；失败不会自动改用浏览器或付费抓取。
+
+若代理 Fake-IP DNS 返回 `198.18.0.0/15` 等非公开地址，官方 fetch 可能以 `WEB_BLOCKED_URL` 拒绝。应修正运行环境的 DNS/路由或按官方能力显式授权，不能关闭 SSRF 防护或伪造公开地址绕过。
+
+## 验证
+
+运行 `pnpm check` 完成类型检查、构建与自动测试。真实搜索与抓取可能产生费用，需要另外验证目标服务、凭据和网络环境；本地测试不等于正在运行的 GUI 部署验收。

package/cordis.patch.yml

@@ -0,0 +1,13 @@
+# Requires the standard DSH base bundle (web service, HTTP fetch and tool consumer).
+- id: web
+  config:
+    searchProvider: codex
+    fetchProvider: http
+
+- insert:
+    - id: dsh-search-plugin
+      name: dsh-search-plugin
+      config:
+        authMode: !!js process.env.DSH_CODEX_AUTH_MODE || 'openai'
+        endpoint: !!js process.env.DSH_CODEX_ENDPOINT
+        apiKey: !!js process.env.DSH_CODEX_API_KEY

package/lib/client.js

@@ -0,0 +1,372 @@
+window.__ModuleLoader__.load({id:"dsh-search-plugin",factory(require){
+const module={exports:{}};const exports=module.exports;
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.ts
+var index_exports = {};
+__export(index_exports, {
+  apply: () => apply,
+  inject: () => inject
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/client/SearchConfig.tsx
+var import_react = require("react");
+var import_jsx_runtime = require("react/jsx-runtime");
+var fields = ["authMode", "openaiProvider", "credentialRef", "endpoint", "timeoutMs", "maxResponseBytes", "maxAnswerChars"];
+var defaults = { authMode: "openai", openaiProvider: "openai", credentialRef: "DSH_CODEX_API_KEY", endpoint: "", timeoutMs: "60000", maxResponseBytes: "2000000", maxAnswerChars: "16000" };
+var numeric = /* @__PURE__ */ new Set(["timeoutMs", "maxResponseBytes", "maxAnswerChars"]);
+function valuesOf(value) {
+  return Object.fromEntries(fields.map((field) => [field, String(value[field] ?? defaults[field])]));
+}
+function SearchConfig(props) {
+  const { t } = props;
+  const state = props.useConfig((snapshot) => snapshot);
+  const credential = props.useCredential((snapshot) => snapshot);
+  const [draft, setDraft] = (0, import_react.useState)(null);
+  const [busy, setBusy] = (0, import_react.useState)(false);
+  const [message, setMessage] = (0, import_react.useState)(null);
+  const [key, setKey] = (0, import_react.useState)(null);
+  const [keyBusy, setKeyBusy] = (0, import_react.useState)(false);
+  const [keyMessage, setKeyMessage] = (0, import_react.useState)(null);
+  if (props.view === "summary") return t("description");
+  if (state.status !== "ready" || !state.value) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", children: t(state.status === "loading" ? "loading" : "unavailable") });
+  const accepted = valuesOf(state.value);
+  const values = draft?.values ?? accepted;
+  const keyText = key?.ref === values.credentialRef ? key.text : "";
+  const conflict = draft !== null && draft.revision !== state.revision;
+  const disabled = !state.writable || busy;
+  const independent = values.authMode === "credential";
+  const visibleFields = fields.filter((field) => numeric.has(field) || (independent ? field === "credentialRef" || field === "endpoint" : field === "openaiProvider"));
+  const validRef = /^[A-Za-z_][A-Za-z0-9_]*$/.test(values.credentialRef);
+  const credentialCurrent = credential.ref === values.credentialRef;
+  const info = credentialCurrent ? credential.info : void 0;
+  const credentialWritable = info?.writable === true && !keyBusy;
+  const edit = (field, value) => {
+    setDraft({ values: { ...values, [field]: value }, revision: draft ? draft.revision : state.revision });
+    setMessage(null);
+    if (field === "authMode") {
+      setKey(null);
+      setKeyMessage(null);
+    }
+    if (field === "credentialRef") {
+      setKey(null);
+      setKeyMessage(null);
+      props.describeCredential(value);
+    }
+  };
+  const save = async (reset) => {
+    if (conflict) {
+      setMessage("conflict");
+      return;
+    }
+    if (!reset) {
+      let valid = fields.filter((field) => numeric.has(field)).every((field) => Number.isSafeInteger(Number(values[field])) && Number(values[field]) > 0);
+      if (independent) {
+        try {
+          const endpoint = new URL(values.endpoint);
+          valid &&= validRef && ["http:", "https:"].includes(endpoint.protocol) && !endpoint.username && !endpoint.password && !endpoint.hash;
+        } catch {
+          valid = false;
+        }
+      } else valid &&= Boolean(values.openaiProvider.trim());
+      if (!valid) {
+        setMessage("invalid");
+        return;
+      }
+    }
+    const savedValues = independent ? values : { ...values, endpoint: "" };
+    const savedFields = ["authMode", ...visibleFields, ...!independent ? ["endpoint"] : []];
+    const ops = reset ? fields.map((field) => ({ op: "unset", path: [field] })) : savedFields.filter((field) => savedValues[field] !== accepted[field]).map((field) => ({ op: "set", path: [field], value: numeric.has(field) ? Number(savedValues[field]) : savedValues[field] }));
+    setBusy(true);
+    setMessage(null);
+    try {
+      if (await props.mutateConfig(ops, draft ? draft.revision : state.revision)) {
+        setDraft(null);
+        setMessage("saved");
+      } else setMessage("failed");
+    } catch {
+      setMessage("failed");
+    } finally {
+      setBusy(false);
+    }
+  };
+  const writeKey = async (remove) => {
+    const ref = values.credentialRef;
+    setKeyBusy(true);
+    setKeyMessage(null);
+    try {
+      if (remove) await props.removeCredential(ref);
+      else await props.storeCredential(ref, keyText);
+      setKey(null);
+      setKeyMessage("keySaved");
+    } catch {
+      setKeyMessage("keyFailed");
+    } finally {
+      setKeyBusy(false);
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dsh-search-config", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dsh-search-hint", children: t("inherit") }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dsh-search-hint", children: t("trust") }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { onSubmit: (event) => {
+      event.preventDefault();
+      void save(false);
+    }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("fieldset", { disabled, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("authMode") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("select", { value: values.authMode, onChange: (event) => edit("authMode", event.target.value), children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "openai", children: t("openai") }),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "credential", children: t("credential") })
+          ] })
+        ] }),
+        visibleFields.map((field) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t(field) }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "input",
+            {
+              type: numeric.has(field) ? "number" : "text",
+              min: numeric.has(field) ? 1 : void 0,
+              step: numeric.has(field) ? 1 : void 0,
+              value: values[field],
+              onChange: (event) => edit(field, event.target.value),
+              disabled: field === "credentialRef" && keyBusy
+            }
+          )
+        ] }, field))
+      ] }),
+      !state.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", children: t("readOnly") }),
+      conflict && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", children: t("conflict") }),
+      message && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", children: t(message) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dsh-search-actions", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "submit", disabled: disabled || conflict || !draft, children: t(busy ? "saving" : "save") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", disabled: disabled || conflict, onClick: () => {
+          void save(true);
+        }, children: t("reset") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", disabled: busy || !draft, onClick: () => {
+          setDraft(null);
+          setMessage(null);
+          setKey(null);
+          props.describeCredential(accepted.credentialRef);
+        }, children: t("discard") })
+      ] })
+    ] }),
+    values.authMode === "credential" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: "dsh-search-secret", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("key") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "input",
+          {
+            type: "password",
+            autoComplete: "new-password",
+            value: keyText,
+            disabled: !credentialWritable,
+            onChange: (event) => {
+              setKey({ ref: values.credentialRef, text: event.target.value });
+              setKeyMessage(null);
+            }
+          }
+        )
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dsh-search-hint", children: t("keyHint") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", children: t(!validRef ? "invalidRef" : credentialCurrent && credential.error ? "keyFailed" : !info ? "keyLoading" : info.configured ? "keySet" : "keyUnset") }),
+      info && !info.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: t("keyReadOnly") }),
+      keyMessage && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", children: t(keyMessage) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dsh-search-actions", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", disabled: !credentialWritable || !keyText.trim(), onClick: () => {
+          void writeKey(false);
+        }, children: t("keySave") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", disabled: !credentialWritable || !info?.configured, onClick: () => {
+          void writeKey(true);
+        }, children: t("keyRemove") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", disabled: !validRef || keyBusy, onClick: () => props.describeCredential(values.credentialRef), children: t("keyRefresh") })
+      ] })
+    ] })
+  ] });
+}
+
+// src/client/locales.ts
+var en = {
+  title: "Web search",
+  description: "Give agents access to information from the web to inform their analysis and decisions.",
+  authMode: "Authentication",
+  openai: "Reuse OpenAI provider (default)",
+  credential: "Independent credential",
+  openaiProvider: "OpenAI provider route",
+  credentialRef: "Credential reference",
+  endpoint: "Alpha search endpoint (full URL)",
+  timeoutMs: "Timeout (ms)",
+  maxResponseBytes: "Maximum response bytes",
+  maxAnswerChars: "Maximum answer characters",
+  inherit: "By default, reuse the OpenAI baseURL and API-key reference: https://example.com/v1 becomes https://example.com/v1/alpha/search. No endpoint or model is required. Only Alpha search is supported; there is no Responses fallback. Reuse requires an explicit apiKeyEnv reference; OAuth and native stored credentials are not supported. For another address, choose independent authentication and enter its full endpoint URL.",
+  trust: "The endpoint receives your credential and search queries. Only use a trusted service.",
+  save: "Save configuration",
+  reset: "Reset overrides",
+  discard: "Discard edits",
+  saving: "Saving\u2026",
+  saved: "Configuration saved.",
+  failed: "The configuration was not accepted. Review your edits or reload the page.",
+  loading: "Loading configuration\u2026",
+  unavailable: "Configuration is unavailable.",
+  readOnly: "Configuration is read-only.",
+  conflict: "Configuration changed elsewhere. Discard edits to reload the current values before saving.",
+  key: "New API key",
+  keyHint: "Stored only in the credentials domain, not configuration. Blank keeps the existing key. Values are never returned.",
+  keySet: "A credential is configured.",
+  keyUnset: "No credential is configured.",
+  keyLoading: "Checking credential\u2026",
+  keyReadOnly: "This credential source is read-only.",
+  keySave: "Store key",
+  keyRemove: "Remove stored key",
+  keyRefresh: "Refresh status",
+  keySaved: "Credential updated. Environment or other source layers may still supply a value after removal.",
+  keyFailed: "Credential operation failed. Check the credential provider and retry.",
+  invalidRef: "Use an environment-style reference name (letters, digits, underscore; not starting with a digit).",
+  invalid: "Use positive integer limits. Reuse requires a provider route; independent authentication requires a valid credential reference and a full HTTP(S) endpoint without credentials or a fragment."
+};
+var zh = {
+  title: "\u8054\u7F51\u641C\u7D22",
+  description: "\u5C06\u4E92\u8054\u7F51\u4F5C\u4E3A\u667A\u80FD\u4F53\u7684\u4FE1\u606F\u6765\u6E90\uFF0C\u4E3A\u5206\u6790\u4E0E\u5224\u65AD\u8865\u5145\u5916\u90E8\u4F9D\u636E\u3002",
+  authMode: "\u8BA4\u8BC1\u65B9\u5F0F",
+  openai: "\u590D\u7528 OpenAI Provider\uFF08\u9ED8\u8BA4\uFF09",
+  credential: "\u72EC\u7ACB\u51ED\u636E",
+  openaiProvider: "OpenAI Provider \u8DEF\u7531",
+  credentialRef: "\u51ED\u636E\u5F15\u7528\u540D",
+  endpoint: "Alpha \u641C\u7D22\u7AEF\u70B9\uFF08\u5B8C\u6574 URL\uFF09",
+  timeoutMs: "\u8D85\u65F6\uFF08\u6BEB\u79D2\uFF09",
+  maxResponseBytes: "\u54CD\u5E94\u5B57\u8282\u4E0A\u9650",
+  maxAnswerChars: "\u7B54\u6848\u5B57\u7B26\u4E0A\u9650",
+  inherit: "\u9ED8\u8BA4\u590D\u7528 OpenAI \u7684 baseURL \u4E0E API Key \u5F15\u7528\uFF0C\u4F8B\u5982 https://example.com/v1 \u81EA\u52A8\u6D3E\u751F https://example.com/v1/alpha/search\uFF0C\u65E0\u9700\u586B\u5199\u7AEF\u70B9\u6216\u6A21\u578B\u3002\u4EC5\u652F\u6301 Alpha \u641C\u7D22\uFF0C\u4E0D\u56DE\u9000 Responses\u3002\u590D\u7528\u8981\u6C42\u663E\u5F0F apiKeyEnv \u5F15\u7528\uFF0C\u4E0D\u652F\u6301 OAuth \u6216\u539F\u751F\u5B58\u50A8\u51ED\u636E\uFF1B\u5982\u9700\u5176\u4ED6\u5730\u5740\uFF0C\u8BF7\u5207\u6362\u72EC\u7ACB\u51ED\u636E\u5E76\u586B\u5199\u5B8C\u6574\u7AEF\u70B9 URL\u3002",
+  trust: "\u7AEF\u70B9\u4F1A\u6536\u5230\u51ED\u636E\u4E0E\u641C\u7D22\u67E5\u8BE2\uFF0C\u8BF7\u4EC5\u4F7F\u7528\u53EF\u4FE1\u670D\u52A1\u3002",
+  save: "\u4FDD\u5B58\u914D\u7F6E",
+  reset: "\u91CD\u7F6E\u8986\u76D6",
+  discard: "\u653E\u5F03\u7F16\u8F91",
+  saving: "\u4FDD\u5B58\u4E2D\u2026",
+  saved: "\u914D\u7F6E\u5DF2\u4FDD\u5B58\u3002",
+  failed: "\u914D\u7F6E\u672A\u88AB\u63A5\u53D7\uFF0C\u8BF7\u68C0\u67E5\u7F16\u8F91\u5185\u5BB9\u6216\u91CD\u65B0\u52A0\u8F7D\u9875\u9762\u3002",
+  loading: "\u6B63\u5728\u52A0\u8F7D\u914D\u7F6E\u2026",
+  unavailable: "\u5F53\u524D\u65E0\u6CD5\u914D\u7F6E\u6B64\u63D2\u4EF6\u3002",
+  readOnly: "\u914D\u7F6E\u4E3A\u53EA\u8BFB\u3002",
+  conflict: "\u914D\u7F6E\u5DF2\u5728\u5176\u4ED6\u4F4D\u7F6E\u66F4\u6539\uFF0C\u8BF7\u653E\u5F03\u7F16\u8F91\u4EE5\u52A0\u8F7D\u6700\u65B0\u503C\uFF0C\u518D\u91CD\u65B0\u4FDD\u5B58\u3002",
+  key: "\u65B0 API \u5BC6\u94A5",
+  keyHint: "\u4EC5\u5199\u5165\u72EC\u7ACB\u51ED\u636E\u57DF\uFF0C\u4E0D\u8FDB\u5165\u914D\u7F6E\u3002\u7559\u7A7A\u4FDD\u7559\u73B0\u6709\u5BC6\u94A5\uFF1B\u5DF2\u5B58\u5BC6\u94A5\u6C38\u4E0D\u56DE\u663E\u3002",
+  keySet: "\u5DF2\u914D\u7F6E\u51ED\u636E\u3002",
+  keyUnset: "\u5C1A\u672A\u914D\u7F6E\u51ED\u636E\u3002",
+  keyLoading: "\u6B63\u5728\u68C0\u67E5\u51ED\u636E\u2026",
+  keyReadOnly: "\u6B64\u51ED\u636E\u6765\u6E90\u4E0D\u53EF\u5199\u3002",
+  keySave: "\u5B58\u50A8\u5BC6\u94A5",
+  keyRemove: "\u79FB\u9664\u5DF2\u5B58\u5BC6\u94A5",
+  keyRefresh: "\u5237\u65B0\u72B6\u6001",
+  keySaved: "\u51ED\u636E\u5DF2\u66F4\u65B0\uFF1B\u79FB\u9664\u540E\u73AF\u5883\u53D8\u91CF\u6216\u5176\u4ED6\u6765\u6E90\u4ECD\u53EF\u80FD\u63D0\u4F9B\u51ED\u636E\u3002",
+  keyFailed: "\u51ED\u636E\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u51ED\u636E\u63D0\u4F9B\u65B9\u540E\u91CD\u8BD5\u3002",
+  invalidRef: "\u8BF7\u8F93\u5165\u73AF\u5883\u53D8\u91CF\u683C\u5F0F\u7684\u5F15\u7528\u540D\uFF08\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\uFF0C\u4E0D\u80FD\u4EE5\u6570\u5B57\u5F00\u5934\uFF09\u3002",
+  invalid: "\u8BF7\u586B\u5199\u6B63\u6574\u6570\u4E0A\u9650\u3002\u590D\u7528\u6A21\u5F0F\u9700\u8981 Provider \u8DEF\u7531\uFF1B\u72EC\u7ACB\u8BA4\u8BC1\u9700\u8981\u6709\u6548\u51ED\u636E\u5F15\u7528\u540D\u4E0E\u5B8C\u6574 HTTP(S) \u7AEF\u70B9\uFF0CURL \u4E0D\u5F97\u5305\u542B\u7528\u6237\u540D\u3001\u5BC6\u7801\u6216\u7247\u6BB5\u3002"
+};
+
+// src/client/style.css
+var style_default = ".dsh-search-config { display: flex; flex-direction: column; gap: 16px; color: var(--dsw-alias-label-primary); }\n.dsh-search-config fieldset { border: 0; margin: 0; padding: 0; display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 240px), 1fr)); gap: 16px; }\n.dsh-search-config label { display: flex; flex-direction: column; gap: 8px; font-size: 14px; }\n.dsh-search-config input, .dsh-search-config select { box-sizing: border-box; width: 100%; min-height: 38px; padding: 8px 10px; border-radius: 8px; border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-layer-1); color: inherit; font: inherit; }\n.dsh-search-config button { min-height: 36px; padding: 8px 12px; border: 1px solid var(--dsw-alias-border-l2); border-radius: 8px; background: var(--dsw-alias-button-elevated-fill); color: inherit; cursor: pointer; font: inherit; }\n.dsh-search-config :disabled { opacity: .55; cursor: not-allowed; }\n.dsh-search-config :focus-visible { outline: 2px solid var(--dsw-alias-link); outline-offset: 2px; }\n.dsh-search-hint { margin: 0; color: var(--dsw-alias-label-tertiary); font-size: 13px; line-height: 1.6; }\n.dsh-search-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 16px; }\n.dsh-search-secret { border-top: 1px solid var(--dsw-alias-border-l2); padding-top: 20px; }\n.dsh-search-secret .dsh-search-hint { margin-top: 8px; }\n";
+
+// src/client/index.ts
+var inject = ["slots", "locale", "remote", "remote.credentials", "configForms"];
+function apply(ctx) {
+  ctx.effect(() => ctx.locale.register("searchPlugin", { en, zh }));
+  ctx.effect(() => {
+    const style = document.createElement("style");
+    style.dataset.plugin = "dsh-search-plugin";
+    style.textContent = style_default;
+    document.head.append(style);
+    return () => style.remove();
+  });
+  let state = { ref: "", error: false };
+  let sequence = 0;
+  let disposed = false;
+  const listeners = /* @__PURE__ */ new Set();
+  const publish = (next) => {
+    state = next;
+    for (const listener of listeners) listener();
+  };
+  const describeCredential = (ref) => {
+    if (disposed) return;
+    const request = ++sequence;
+    publish({ ref, error: false });
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(ref)) return;
+    void ctx.remote.credentials.describe([ref]).then((result) => {
+      if (!disposed && request === sequence) {
+        publish(result.ok ? { ref, info: result.value[ref], error: false } : { ref, error: true });
+      }
+    }, () => {
+      if (!disposed && request === sequence) publish({ ref, error: true });
+    });
+  };
+  const form = ctx.configForms.get("dsh-search-plugin");
+  const refresh = () => {
+    const value = form.getSnapshot().value;
+    if (value) describeCredential(typeof value.credentialRef === "string" ? value.credentialRef : "DSH_CODEX_API_KEY");
+  };
+  ctx.effect(() => form.subscribe(refresh));
+  refresh();
+  ctx.effect(() => ctx.remote.$on("credentials/reference-updated", (ref) => {
+    if (ref === state.ref) describeCredential(ref);
+  }));
+  ctx.effect(() => () => {
+    disposed = true;
+    sequence++;
+    listeners.clear();
+  });
+  const face = {
+    hooks: {
+      credential: { getSnapshot: () => state, subscribe: (listener) => {
+        listeners.add(listener);
+        return () => {
+          listeners.delete(listener);
+        };
+      } },
+      config: { getSnapshot: () => form.getSnapshot(), subscribe: (listener) => form.subscribe(listener) }
+    },
+    mutateConfig: (ops, expectedRevision) => form.mutate(ops, expectedRevision),
+    describeCredential,
+    storeCredential: async (ref, value) => {
+      const result = await ctx.remote.credentials.set(ref, value);
+      if (!result.ok) throw result.error;
+      describeCredential(ref);
+    },
+    removeCredential: async (ref) => {
+      const result = await ctx.remote.credentials.unset(ref);
+      if (!result.ok) throw result.error;
+      describeCredential(ref);
+    }
+  };
+  ctx.effect(() => ctx.slots.inject("plugins.bundle.config", () => ctx.slots.register({
+    name: "plugins.bundle.config",
+    key: "dsh-search-plugin",
+    locale: "searchPlugin",
+    inject: () => face
+  }, SearchConfig)));
+  ctx.effect(() => ctx.slots.inject("plugins.row.config", () => ctx.slots.register({
+    name: "plugins.row.config",
+    key: "dsh-search-plugin#dsh-search-plugin",
+    locale: "searchPlugin",
+    inject: () => face
+  }, SearchConfig)));
+}
+
+return module.exports;
+}});

package/lib/connection.js

@@ -0,0 +1,86 @@
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
+import { WebError } from '@deepseek-ai/dsh-web';
+import { CodexSearchProvider } from './provider.js';
+function fail(message) {
+    throw new WebError(`Web search: ${message}`, 'CODEX_CONFIGURATION_ERROR');
+}
+function record(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        fail('OpenAI provider configuration is unavailable');
+    return value;
+}
+/** Resolve configuration and credentials for each search, without retaining secrets between operations. */
+export class ConfiguredSearchProvider {
+    ctx;
+    config;
+    id = 'codex';
+    constructor(ctx, config) {
+        this.ctx = ctx;
+        this.config = config;
+    }
+    available() { return true; }
+    /** Capture endpoint, limits and the selected credential as one request configuration. */
+    async resolve() {
+        const config = this.config;
+        let endpoint = config.endpoint.get();
+        let ref = config.credentialRef.get();
+        const literal = config.apiKey.get();
+        const limits = {
+            timeoutMs: config.timeoutMs.get(), maxResponseBytes: config.maxResponseBytes.get(),
+            maxAnswerChars: config.maxAnswerChars.get(),
+        };
+        if (config.authMode.get() === 'openai') {
+            const provider = config.openaiProvider.get();
+            const llm = this.ctx.get('llm');
+            const settings = this.ctx.get('settings');
+            if (!llm || !settings)
+                fail('OpenAI authentication reuse requires the LLM and Settings services');
+            const route = llm.listConfigurableProviders().find(entry => entry.provider === provider);
+            if (!route)
+                fail('selected OpenAI provider is not configured');
+            if (route.error)
+                fail('repair the selected OpenAI provider in model settings');
+            const section = settings.describe({ redactSecrets: true }).find(entry => entry.ns === route.settingsNs);
+            if (!section)
+                fail('selected OpenAI provider settings are unavailable');
+            let value = section.value;
+            for (const key of route.settingsPath)
+                value = record(value)[key];
+            const profile = record(value);
+            if (profile.headers !== undefined && Object.keys(record(profile.headers)).length) {
+                fail('custom OpenAI headers cannot be reused; configure a dedicated credential');
+            }
+            let base = typeof profile.baseURL === 'string' && profile.baseURL ? profile.baseURL : undefined;
+            if (!base)
+                for (const name of route.baseURLEnv ?? []) {
+                    if (process.env[name]) {
+                        base = process.env[name];
+                        break;
+                    }
+                }
+            base ??= route.defaultBaseURL;
+            if (!base)
+                fail('selected OpenAI provider has no endpoint');
+            const expected = new URL(`${base.replace(/\/+$/, '')}/alpha/search`);
+            // endpoint belongs to independent authentication; never forward reused keys there.
+            endpoint = expected.href;
+            ref = typeof profile.apiKeyEnv === 'string' ? profile.apiKeyEnv : '';
+            if (!ref)
+                fail('this provider authentication cannot be reused; configure a dedicated credential');
+        }
+        if (!endpoint)
+            fail('独立凭据模式需要填写 Alpha Search 完整端点；默认复用 OpenAI 模式无需填写端点');
+        const credentials = this.ctx.get('credentials');
+        const key = config.authMode.get() === 'credential' && literal
+            ? literal : ref && credentials ? (await credentials.resolve(credentialRef(ref)))?.value : undefined;
+        if (!key)
+            fail('API key is unavailable; configure the selected credential (OAuth reuse is not supported)');
+        return { endpoint, apiKey: key, ...limits };
+    }
+    async search(request, signal) {
+        signal?.throwIfAborted();
+        const resolved = await this.resolve();
+        signal?.throwIfAborted();
+        return new CodexSearchProvider(resolved).search(request, signal);
+    }
+}

package/lib/index.js

@@ -0,0 +1,21 @@
+import Schema from '@deepseek-ai/schemastery';
+import { ConfiguredSearchProvider } from './connection.js';
+export const name = 'dsh-search-plugin';
+export const inject = ['web'];
+export const Config = Schema.object({
+    authMode: Schema.union(['openai', 'credential']).default('openai').volatile(),
+    openaiProvider: Schema.string().min(1).default('openai').volatile(),
+    credentialRef: Schema.string().pattern(/^[A-Za-z_][A-Za-z0-9_]*$/).default('DSH_CODEX_API_KEY').volatile(),
+    endpoint: Schema.string().pattern(/^$|^https?:\/\/[^\s]+$/).default('').volatile(),
+    apiKey: Schema.string().role('secret').volatile(),
+    timeoutMs: Schema.number().step(1).min(1).default(60000).volatile(),
+    maxResponseBytes: Schema.number().step(1).min(1).default(2000000).volatile(),
+    maxAnswerChars: Schema.number().step(1).min(1).default(16000).volatile(),
+});
+/** Register the provider; Cordis owns its registration and optional settings policy. */
+export function apply(ctx, config) {
+    ctx.web.registerSearchProvider(new ConfiguredSearchProvider(ctx, config));
+    ctx.inject(['settings'], child => {
+        child.effect(() => child.settings.configure({ auto: false }, ctx.fiber));
+    });
+}

package/lib/provider.js

@@ -0,0 +1,123 @@
+import { randomUUID } from 'node:crypto';
+import { WebError } from '@deepseek-ai/dsh-web';
+// Alpha Search's routing model, not the user's chat/Responses model.
+export const ALPHA_SEARCH_MODEL = 'gpt-5.6-luna';
+function protocolError(message) {
+    throw new WebError(`Codex search: ${message}`, 'CODEX_PROTOCOL_ERROR');
+}
+/** Decode Alpha's output/results, never Responses output items or guessed links. */
+export function parseSearchResponse(value, maxAnswerChars) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        protocolError('expected an object');
+    const response = value;
+    if (typeof response.output !== 'string')
+        protocolError('output text is missing');
+    if (response.results != null && !Array.isArray(response.results))
+        protocolError('expected results to be an array');
+    const sources = new Map();
+    // Alpha results are opaque, extensible DTOs; only web URLs are citeable sources.
+    for (const item of response.results ?? []) {
+        if (typeof item !== 'object' || item === null || typeof item.url !== 'string')
+            continue;
+        let url;
+        try {
+            url = new URL(item.url);
+        }
+        catch {
+            continue;
+        }
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+            continue;
+        const previous = sources.get(item.url);
+        sources.set(item.url, {
+            url: item.url,
+            ...(previous?.title !== undefined ? { title: previous.title } : typeof item.title === 'string' ? { title: item.title } : {}),
+        });
+    }
+    // Alpha ref_ids have no meaning in DSH; structured sources are returned separately.
+    const answer = response.output.replace(/\uE200cite\uE202[^\uE201]*\uE201(?:\s*\[wordlim:\s*\d+\])?/gu, '').trim();
+    let content = answer.slice(0, maxAnswerChars);
+    if (content.length < answer.length && /[\uD800-\uDBFF]$/.test(content))
+        content = content.slice(0, -1);
+    return { ...(content ? { content } : {}), sources: [...sources.values()], truncated: false };
+}
+/** Alpha Search only. No retry, redirect following, or protocol fallback. */
+export class CodexSearchProvider {
+    id = 'codex';
+    config;
+    constructor(config) {
+        const endpoint = new URL(config.endpoint);
+        if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.hash) {
+            throw new Error('Codex endpoint must be an HTTP(S) URL without credentials or a fragment');
+        }
+        if (!config.apiKey.trim())
+            throw new Error('Codex apiKey must be non-empty');
+        this.config = { ...config };
+    }
+    available() { return true; }
+    async search(request, signal) {
+        const timeout = AbortSignal.timeout(this.config.timeoutMs);
+        const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+        try {
+            const response = await fetch(this.config.endpoint, {
+                method: 'POST', redirect: 'manual', signal: combined,
+                headers: { Authorization: `Bearer ${this.config.apiKey}`, 'Content-Type': 'application/json', Accept: 'application/json' },
+                body: JSON.stringify({
+                    id: randomUUID(), model: ALPHA_SEARCH_MODEL,
+                    input: [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: request.query }] }],
+                    commands: { search_query: [{ q: request.query }] },
+                    settings: { allowed_callers: ['direct'], external_web_access: true },
+                    max_output_tokens: 2048,
+                }),
+            });
+            if (!response.ok) {
+                await response.body?.cancel();
+                throw new WebError(`Codex search HTTP ${response.status}`, 'CODEX_HTTP_ERROR');
+            }
+            if (!response.body)
+                protocolError('empty response body');
+            const reader = response.body.getReader();
+            const chunks = [];
+            let bytes = 0;
+            try {
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    bytes += value.byteLength;
+                    if (bytes > this.config.maxResponseBytes) {
+                        await reader.cancel();
+                        throw new WebError('Codex search response exceeds maxResponseBytes', 'CODEX_RESPONSE_TOO_LARGE');
+                    }
+                    chunks.push(value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            const buffer = new Uint8Array(bytes);
+            let offset = 0;
+            for (const chunk of chunks) {
+                buffer.set(chunk, offset);
+                offset += chunk.length;
+            }
+            let value;
+            try {
+                value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(buffer));
+            }
+            catch {
+                protocolError('expected a UTF-8 JSON response; SSE is not supported');
+            }
+            return parseSearchResponse(value, this.config.maxAnswerChars);
+        }
+        catch (error) {
+            if (error instanceof WebError)
+                throw error;
+            if (signal?.aborted)
+                throw new WebError('Codex search cancelled', 'WEB_ABORTED');
+            if (timeout.aborted)
+                throw new WebError('Codex search timed out', 'CODEX_TIMEOUT');
+            throw new WebError('Codex search transport failed', 'CODEX_TRANSPORT_ERROR');
+        }
+    }
+}

package/lib/types/connection.d.ts

@@ -0,0 +1,15 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { type WebSearchProvider, type WebSearchRequest, type WebSearchResult } from '@deepseek-ai/dsh-web';
+import type { Config } from './index.js';
+import { type AlphaSearchConfig } from './provider.js';
+/** Resolve configuration and credentials for each search, without retaining secrets between operations. */
+export declare class ConfiguredSearchProvider implements WebSearchProvider {
+    private readonly ctx;
+    private readonly config;
+    readonly id = "codex";
+    constructor(ctx: Context, config: Config);
+    available(): boolean;
+    /** Capture endpoint, limits and the selected credential as one request configuration. */
+    resolve(): Promise<AlphaSearchConfig>;
+    search(request: WebSearchRequest, signal?: AbortSignal): Promise<WebSearchResult>;
+}

package/lib/types/index.d.ts

@@ -0,0 +1,36 @@
+import type { Context, Volatile } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "dsh-search-plugin";
+export declare const inject: string[];
+/** Live search settings. Credentials are resolved by reference for each operation. */
+export interface Config {
+    authMode: Volatile<'openai' | 'credential'>;
+    openaiProvider: Volatile<string>;
+    credentialRef: Volatile<string>;
+    endpoint: Volatile<string>;
+    apiKey: Volatile<string | undefined>;
+    timeoutMs: Volatile<number>;
+    maxResponseBytes: Volatile<number>;
+    maxAnswerChars: Volatile<number>;
+}
+export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+    authMode: Schema<"openai" | "credential", "openai" | "credential", "volatile-defined">;
+    openaiProvider: Schema<string, string, "volatile-defined">;
+    credentialRef: Schema<string, string, "volatile-defined">;
+    endpoint: Schema<string, string, "volatile-defined">;
+    apiKey: Schema<string, string, "volatile">;
+    timeoutMs: Schema<number, number, "volatile-defined">;
+    maxResponseBytes: Schema<number, number, "volatile-defined">;
+    maxAnswerChars: Schema<number, number, "volatile-defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    authMode: Schema<"openai" | "credential", "openai" | "credential", "volatile-defined">;
+    openaiProvider: Schema<string, string, "volatile-defined">;
+    credentialRef: Schema<string, string, "volatile-defined">;
+    endpoint: Schema<string, string, "volatile-defined">;
+    apiKey: Schema<string, string, "volatile">;
+    timeoutMs: Schema<number, number, "volatile-defined">;
+    maxResponseBytes: Schema<number, number, "volatile-defined">;
+    maxAnswerChars: Schema<number, number, "volatile-defined">;
+}>>, "plain">;
+/** Register the provider; Cordis owns its registration and optional settings policy. */
+export declare function apply(ctx: Context, config: Config): void;

package/lib/types/provider.d.ts

@@ -0,0 +1,20 @@
+import { type WebSearchProvider, type WebSearchRequest, type WebSearchResult } from '@deepseek-ai/dsh-web';
+/** Resolved values for one Alpha Search request; never persisted or exposed to the browser. */
+export interface AlphaSearchConfig {
+    endpoint: string;
+    apiKey: string;
+    timeoutMs: number;
+    maxResponseBytes: number;
+    maxAnswerChars: number;
+}
+export declare const ALPHA_SEARCH_MODEL = "gpt-5.6-luna";
+/** Decode Alpha's output/results, never Responses output items or guessed links. */
+export declare function parseSearchResponse(value: unknown, maxAnswerChars: number): WebSearchResult;
+/** Alpha Search only. No retry, redirect following, or protocol fallback. */
+export declare class CodexSearchProvider implements WebSearchProvider {
+    readonly id = "codex";
+    private readonly config;
+    constructor(config: AlphaSearchConfig);
+    available(): boolean;
+    search(request: WebSearchRequest, signal?: AbortSignal): Promise<WebSearchResult>;
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Web search",
+    "description": "Give agents access to information from the web to inform their analysis and decisions."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "联网搜索",
+    "description": "将互联网作为智能体的信息来源，为分析与判断补充外部依据。"
+  }
+}

package/package.json

@@ -1,6 +1,88 @@
 {
   "name": "dsh-search-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.5",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/urzz/dsh-search-plugin.git"
+  },
+  "description": "Give agents access to information from the web to inform their analysis and decisions.",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "files": [
+    "lib",
+    "locale/*.json",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "engines": {
+    "dsh": ">=0.2.1-rc.4 <0.3.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-plugin-manager",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-api-remotes"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/build-client.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json",
+    "test": "pnpm build && node --test tests/*.test.mjs",
+    "check": "pnpm typecheck && pnpm test",
+    "prepack": "pnpm build"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "~3.18.4"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.0",
+    "@deepseek-ai/dsh-credentials": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-web": "0.2.1-rc.4"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.0",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.6",
+    "@deepseek-ai/dsh-api-gateway": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-api-remotes": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-api-settings-controller": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-store": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-credentials": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-credentials-local": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-tool-web": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-web": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-web-fetch-http": "0.2.1-rc.4",
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "esbuild": "^0.25.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.3.1",
+    "typescript": "^5.9.3"
+  }
+}