jeo-code 0.8.30 → 0.8.31

package/CHANGELOG.md

@@ -6,6 +6,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.31] - 2026-07-20
+_`web_search` no longer silently degrades every non-Anthropic model to keyless DuckDuckGo scraping — OpenAI and Gemini sessions now get their own native, hosted search tool (matching the same active-model-gated, credential-required design Anthropic already had), with DuckDuckGo remaining the always-on terminal fallback for everyone else._
+
+### Added
+- **Native OpenAI web search** (`src/agent/web-search.ts`) — routes an active `openai`-provider session through the Responses API's hosted `web_search` tool (`api.openai.com/v1/responses`, per platform.openai.com/docs/guides/tools-web-search), parsing `web_search_call` output items for the executed queries and `message` items' `annotations[].url_citation` for inline-cited sources. Gated on a REAL API key only — the ChatGPT/Codex OAuth backend (`chatgpt.com/backend-api/codex/responses`) is a separate, undocumented surface never verified to support hosted Responses tools, so it deliberately never qualifies (falls through to DuckDuckGo instead of guessing). New `JEO_SEARCH_API_KEY_OPENAI` / `JEO_SEARCH_MODEL_OPENAI` overrides (default model: `gpt-4o-mini`).
+- **Native Gemini web search** (`src/agent/web-search.ts`) — routes an active `gemini` (and `antigravity`, when a plain `GEMINI_API_KEY` also happens to be configured) session through Grounding with Google Search (`generateContent` with `tools: [{googleSearch: {}}]`, per ai.google.dev/gemini-api/docs/google-search), parsing `groundingMetadata.groundingChunks`/`groundingSupports`/`webSearchQueries` (verified against the current `google-genai` SDK's `GroundingMetadata`/`GroundingChunk`/`GroundingSupport` schema, whose Python snake_case fields map to the documented classic-endpoint camelCase wire shape) into sources + inline citations. Gated on a REAL API key only — Gemini/Google OAuth is scoped to the separate Cloud Code Assist/antigravity backend and never serves this endpoint (matching `model-manager.ts`'s existing `oauthServesModel` contract). New `JEO_SEARCH_API_KEY_GEMINI` / `JEO_SEARCH_MODEL_GEMINI` overrides (default model: `gemini-2.5-flash`).
+
+### Verified
+- `test/web-search.test.ts` — 23 pass (was 14): +9 new tests covering response parsing against real documented fixture shapes, live-mocked-fetch request-shape assertions (exact URL/headers/body for both new providers), provider-chain routing (openai/gemini/antigravity → their own native provider when THEIR OWN credential is set, never borrowing another provider's key), and the no-API-key → DuckDuckGo fallback path for both.
+- Real (unmocked) end-to-end run of the full chain in this environment (`bun -e`, no OpenAI/Gemini API keys configured here) — genuinely hit DuckDuckGo over the network and returned real, current search results, confirming the provider-chain plumbing works live, not just under test mocks.
+- Full `bun test` — 3090 pass / 0 fail across 304 files.
+- `bun run typecheck` — no errors.
+
 ## [0.8.30] - 2026-07-20
 _`bun run build` (the host-only dev binary build) has been silently broken for every user who ran it — a drift between the plain `package.json` `build` script and the actual working release-binary build command (`scripts/ci-release-build-binaries.ts`), which had already documented and fixed the exact same crash._
 

package/README.ja.md

@@ -283,11 +283,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.31]** (2026-07-20) — `web_search` no longer silently degrades every non-Anthropic model to keyless DuckDuckGo scraping — OpenAI and Gemini sessions now get their own native, hosted search tool (matching the same active-model-gated, credential-required design Anthropic already had), with DuckDuckGo remaining the always-on terminal fallback for everyone else.
 - **[0.8.30]** (2026-07-20) — `bun run build` (the host-only dev binary build) has been silently broken for every user who ran it — a drift between the plain `package.json` `build` script and the actual working release-binary build command (`scripts/ci-release-build-binaries.ts`), which had already documented and fixed the exact same crash.
 - **[0.8.29]** (2026-07-20) — gajae-code (gjc) v0.10.2→v0.11.4 gap analysis: most of that range is gjc-specific architecture jeo intentionally does not replicate (SDK broker/session-index recovery, Gajae Pet, coordinator-mcp, Telegram/Discord rich-delivery internals, browser tab workers, worktree-subcommand removal, RPC durable model selection) — one genuinely applicable TUI bug was found and closed; the CLI empty-non-TTY-stdin fix (gjc #2586) was investigated and found already-correct by construction (jeo's one-shot gate forces true whenever stdin isn't a TTY, regardless of args, so the hang gjc fixed cannot occur here).
 - **[0.8.28]** (2026-07-16) — Improved the welcome UI's right-side table to display dynamic sections (What's New, Flow keys, Project pulse, and Session trail) matching gajae-code (gjc) >= 0.8.0 features.
 - **[0.8.27]** (2026-07-16) — Repeat-read recovery now survives both context-overflow and refusal-result elision without reopening mutating-call loops.
-- **[0.8.26]** (2026-07-14) — Model catalog cleanup (drop sub-4.6 Anthropic `claude-haiku-4-5` from the exposed catalog/aliases per user direction) plus a focused gap analysis against `gajae-code`'s (gjc) 0.8.0→0.10.1 release history (~200 PRs) — most of gjc's surface (RPC/ACP/coordinator-mcp/IRC-sidebar/psmux/Windows-team) doesn't exist in jeo's smaller architecture and was ruled out with direct evidence; a few genuinely applicable gaps were found and closed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -284,11 +284,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.31]** (2026-07-20) — `web_search` no longer silently degrades every non-Anthropic model to keyless DuckDuckGo scraping — OpenAI and Gemini sessions now get their own native, hosted search tool (matching the same active-model-gated, credential-required design Anthropic already had), with DuckDuckGo remaining the always-on terminal fallback for everyone else.
 - **[0.8.30]** (2026-07-20) — `bun run build` (the host-only dev binary build) has been silently broken for every user who ran it — a drift between the plain `package.json` `build` script and the actual working release-binary build command (`scripts/ci-release-build-binaries.ts`), which had already documented and fixed the exact same crash.
 - **[0.8.29]** (2026-07-20) — gajae-code (gjc) v0.10.2→v0.11.4 gap analysis: most of that range is gjc-specific architecture jeo intentionally does not replicate (SDK broker/session-index recovery, Gajae Pet, coordinator-mcp, Telegram/Discord rich-delivery internals, browser tab workers, worktree-subcommand removal, RPC durable model selection) — one genuinely applicable TUI bug was found and closed; the CLI empty-non-TTY-stdin fix (gjc #2586) was investigated and found already-correct by construction (jeo's one-shot gate forces true whenever stdin isn't a TTY, regardless of args, so the hang gjc fixed cannot occur here).
 - **[0.8.28]** (2026-07-16) — Improved the welcome UI's right-side table to display dynamic sections (What's New, Flow keys, Project pulse, and Session trail) matching gajae-code (gjc) >= 0.8.0 features.
 - **[0.8.27]** (2026-07-16) — Repeat-read recovery now survives both context-overflow and refusal-result elision without reopening mutating-call loops.
-- **[0.8.26]** (2026-07-14) — Model catalog cleanup (drop sub-4.6 Anthropic `claude-haiku-4-5` from the exposed catalog/aliases per user direction) plus a focused gap analysis against `gajae-code`'s (gjc) 0.8.0→0.10.1 release history (~200 PRs) — most of gjc's surface (RPC/ACP/coordinator-mcp/IRC-sidebar/psmux/Windows-team) doesn't exist in jeo's smaller architecture and was ruled out with direct evidence; a few genuinely applicable gaps were found and closed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -291,11 +291,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.31]** (2026-07-20) — `web_search` no longer silently degrades every non-Anthropic model to keyless DuckDuckGo scraping — OpenAI and Gemini sessions now get their own native, hosted search tool (matching the same active-model-gated, credential-required design Anthropic already had), with DuckDuckGo remaining the always-on terminal fallback for everyone else.
 - **[0.8.30]** (2026-07-20) — `bun run build` (the host-only dev binary build) has been silently broken for every user who ran it — a drift between the plain `package.json` `build` script and the actual working release-binary build command (`scripts/ci-release-build-binaries.ts`), which had already documented and fixed the exact same crash.
 - **[0.8.29]** (2026-07-20) — gajae-code (gjc) v0.10.2→v0.11.4 gap analysis: most of that range is gjc-specific architecture jeo intentionally does not replicate (SDK broker/session-index recovery, Gajae Pet, coordinator-mcp, Telegram/Discord rich-delivery internals, browser tab workers, worktree-subcommand removal, RPC durable model selection) — one genuinely applicable TUI bug was found and closed; the CLI empty-non-TTY-stdin fix (gjc #2586) was investigated and found already-correct by construction (jeo's one-shot gate forces true whenever stdin isn't a TTY, regardless of args, so the hang gjc fixed cannot occur here).
 - **[0.8.28]** (2026-07-16) — Improved the welcome UI's right-side table to display dynamic sections (What's New, Flow keys, Project pulse, and Session trail) matching gajae-code (gjc) >= 0.8.0 features.
 - **[0.8.27]** (2026-07-16) — Repeat-read recovery now survives both context-overflow and refusal-result elision without reopening mutating-call loops.
-- **[0.8.26]** (2026-07-14) — Model catalog cleanup (drop sub-4.6 Anthropic `claude-haiku-4-5` from the exposed catalog/aliases per user direction) plus a focused gap analysis against `gajae-code`'s (gjc) 0.8.0→0.10.1 release history (~200 PRs) — most of gjc's surface (RPC/ACP/coordinator-mcp/IRC-sidebar/psmux/Windows-team) doesn't exist in jeo's smaller architecture and was ruled out with direct evidence; a few genuinely applicable gaps were found and closed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -283,11 +283,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.31]** (2026-07-20) — `web_search` no longer silently degrades every non-Anthropic model to keyless DuckDuckGo scraping — OpenAI and Gemini sessions now get their own native, hosted search tool (matching the same active-model-gated, credential-required design Anthropic already had), with DuckDuckGo remaining the always-on terminal fallback for everyone else.
 - **[0.8.30]** (2026-07-20) — `bun run build` (the host-only dev binary build) has been silently broken for every user who ran it — a drift between the plain `package.json` `build` script and the actual working release-binary build command (`scripts/ci-release-build-binaries.ts`), which had already documented and fixed the exact same crash.
 - **[0.8.29]** (2026-07-20) — gajae-code (gjc) v0.10.2→v0.11.4 gap analysis: most of that range is gjc-specific architecture jeo intentionally does not replicate (SDK broker/session-index recovery, Gajae Pet, coordinator-mcp, Telegram/Discord rich-delivery internals, browser tab workers, worktree-subcommand removal, RPC durable model selection) — one genuinely applicable TUI bug was found and closed; the CLI empty-non-TTY-stdin fix (gjc #2586) was investigated and found already-correct by construction (jeo's one-shot gate forces true whenever stdin isn't a TTY, regardless of args, so the hang gjc fixed cannot occur here).
 - **[0.8.28]** (2026-07-16) — Improved the welcome UI's right-side table to display dynamic sections (What's New, Flow keys, Project pulse, and Session trail) matching gajae-code (gjc) >= 0.8.0 features.
 - **[0.8.27]** (2026-07-16) — Repeat-read recovery now survives both context-overflow and refusal-result elision without reopening mutating-call loops.
-- **[0.8.26]** (2026-07-14) — Model catalog cleanup (drop sub-4.6 Anthropic `claude-haiku-4-5` from the exposed catalog/aliases per user direction) plus a focused gap analysis against `gajae-code`'s (gjc) 0.8.0→0.10.1 release history (~200 PRs) — most of gjc's surface (RPC/ACP/coordinator-mcp/IRC-sidebar/psmux/Windows-team) doesn't exist in jeo's smaller architecture and was ruled out with direct evidence; a few genuinely applicable gaps were found and closed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.30",
+  "version": "0.8.31",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/web-search.ts

@@ -7,8 +7,11 @@
  *      available is primary.
  *   2. Otherwise the ACTIVE MODEL's own native search provider is primary,
  *      but only when that provider's credentials are present (active-model
- *      gating — never credential scanning). Today that maps Anthropic models
- *      to Anthropic's server-side `web_search_20250305` tool.
+ *      gating — never credential scanning). Native providers today: Anthropic's
+ *      server-side `web_search_20250305` tool, OpenAI's Responses API `web_search`
+ *      hosted tool, and Gemini's `googleSearch` grounding tool (also used for
+ *      `antigravity` sessions when a plain `GEMINI_API_KEY` happens to be set —
+ *      Google/Gemini OAuth does not serve this endpoint, so it never qualifies).
  *   3. DuckDuckGo (keyless HTML scraping, no API key, no OAuth) is ALWAYS
  *      appended as the terminal fallback, so a missing/failed primary still
  *      returns real results with zero configuration — results are always
@@ -53,7 +56,7 @@ export interface SearchRequest {
 }
 
 export interface SearchProviderDef {
-  id: "anthropic" | "duckduckgo";
+  id: "anthropic" | "openai" | "gemini" | "duckduckgo";
   label: string;
   /** Credential gate — keyless providers return true unconditionally. */
   isAvailable(): Promise<boolean> | boolean;
@@ -204,6 +207,196 @@ async function searchAnthropic(req: SearchRequest): Promise<WebSearchResponse> {
   return parsed;
 }
 
+// ── OpenAI provider (Responses API `web_search` hosted tool) ─────────────────
+
+const OPENAI_RESPONSES_URL = "https://api.openai.com/v1/responses";
+// Cheapest current tool-calling-capable model — the hosted `web_search` tool works
+// across the whole Responses API model line (per platform.openai.com/docs/guides/
+// tools-web-search), not just the now-deprecated `*-search-preview` variants.
+const DEFAULT_SEARCH_MODEL_OPENAI = "gpt-4o-mini";
+const OPENAI_HARD_TIMEOUT_MS = 90_000;
+
+/** Only a real API key is trusted for the hosted `web_search` tool. The ChatGPT/Codex
+ *  OAuth backend (`chatgpt.com/backend-api/codex/responses`, see openai-responses.ts) is
+ *  a SEPARATE, undocumented surface never verified to support hosted Responses tools —
+ *  `api.openai.com/v1/responses` with a plain Bearer API key is the documented, stable
+ *  path this provider uses exclusively. */
+async function resolveOpenAISearchCredential(): Promise<Credential> {
+  const dedicated = jeoEnv("SEARCH_API_KEY_OPENAI");
+  if (dedicated) return { kind: "api_key", provider: "openai", token: dedicated };
+  const cred = await resolveCredential("openai");
+  return cred.kind === "api_key" ? cred : { kind: "none", provider: "openai" };
+}
+
+/** Parse a non-streaming Responses API `web_search` result into the unified shape.
+ *  Per platform.openai.com/docs/guides/tools-web-search: `output` items of type
+ *  `web_search_call` carry the executed queries (`action.query`), `message` items
+ *  carry `content[].text` + `annotations[]` of type `url_citation` (url/title/
+ *  start_index/end_index) for inline-cited sources. */
+export function parseOpenAISearchResponse(response: any): WebSearchResponse {
+  const answerParts: string[] = [];
+  const searchQueries: string[] = [];
+  const citations: WebSearchResponse["citations"] = [];
+  const sourcesByUrl = new Map<string, WebSearchSource>();
+
+  for (const item of response?.output ?? []) {
+    if (item?.type === "web_search_call" && item.action?.type === "search" && typeof item.action.query === "string") {
+      searchQueries.push(item.action.query);
+    } else if (item?.type === "message" && Array.isArray(item.content)) {
+      for (const block of item.content) {
+        if ((block?.type === "output_text" || block?.type === "text") && typeof block.text === "string") {
+          const text = block.text as string;
+          answerParts.push(text);
+          for (const a of block.annotations ?? []) {
+            if (a?.type === "url_citation" && typeof a.url === "string") {
+              const citedText = typeof a.start_index === "number" && typeof a.end_index === "number"
+                ? text.slice(a.start_index, a.end_index)
+                : undefined;
+              citations.push({ url: a.url, title: typeof a.title === "string" ? a.title : undefined, citedText });
+              if (!sourcesByUrl.has(a.url)) sourcesByUrl.set(a.url, { title: (typeof a.title === "string" && a.title) || a.url, url: a.url });
+            }
+          }
+        }
+      }
+    }
+  }
+
+  return {
+    provider: "OpenAI",
+    answer: answerParts.join("\n\n") || undefined,
+    sources: [...sourcesByUrl.values()],
+    citations,
+    searchQueries,
+    usage: response?.usage
+      ? {
+          inputTokens: response.usage.input_tokens,
+          outputTokens: response.usage.output_tokens,
+          searchRequests: searchQueries.length || undefined,
+        }
+      : undefined,
+    model: typeof response?.model === "string" ? response.model : undefined,
+    requestId: typeof response?.id === "string" ? response.id : undefined,
+  };
+}
+
+async function searchOpenAI(req: SearchRequest): Promise<WebSearchResponse> {
+  const credential = await resolveOpenAISearchCredential();
+  if (credential.kind !== "api_key") {
+    throw new Error("OpenAI: no API key credentials (set OPENAI_API_KEY or JEO_SEARCH_API_KEY_OPENAI — the ChatGPT/Codex subscription login does not serve the hosted web_search tool)");
+  }
+  const effectiveQuery = req.recency ? `${req.query} (results from the last ${req.recency})` : req.query;
+  const body = {
+    model: jeoEnv("SEARCH_MODEL_OPENAI") || DEFAULT_SEARCH_MODEL_OPENAI,
+    tools: [{ type: "web_search" }],
+    input: effectiveQuery,
+  };
+  const response = await fetch(OPENAI_RESPONSES_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${credential.token}` },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(OPENAI_HARD_TIMEOUT_MS),
+  });
+  if (!response.ok) {
+    const detail = (await response.text().catch(() => "")).slice(0, 300);
+    throw new Error(`OpenAI API error (${response.status}): ${detail}`);
+  }
+  const parsed = parseOpenAISearchResponse(await response.json().catch(() => null));
+  if (req.limit && req.limit > 0 && parsed.sources.length > req.limit) {
+    parsed.sources = parsed.sources.slice(0, req.limit);
+  }
+  return parsed;
+}
+
+// ── Gemini provider (Grounding with Google Search, generateContent tool) ─────
+
+const GEMINI_GENERATE_URL_BASE = "https://generativelanguage.googleapis.com/v1beta/models";
+const DEFAULT_SEARCH_MODEL_GEMINI = "gemini-2.5-flash";
+const GEMINI_HARD_TIMEOUT_MS = 90_000;
+
+/** Only a real API key is trusted. The plain `generativelanguage.googleapis.com`
+ *  endpoint this hits does NOT serve Gemini/Google OAuth credentials — those are
+ *  scoped to the separate Cloud Code Assist / antigravity backend (see
+ *  model-manager.ts's `oauthServesModel`: a Gemini OAuth token never serves
+ *  `google/gemini-*` models on its own). */
+async function resolveGeminiSearchCredential(): Promise<Credential> {
+  const dedicated = jeoEnv("SEARCH_API_KEY_GEMINI");
+  if (dedicated) return { kind: "api_key", provider: "gemini", token: dedicated };
+  const cred = await resolveCredential("gemini");
+  return cred.kind === "api_key" ? cred : { kind: "none", provider: "gemini" };
+}
+
+interface GeminiGroundingChunk { web?: { uri?: string; title?: string } }
+interface GeminiGroundingSupport { segment?: { startIndex?: number; endIndex?: number; text?: string }; groundingChunkIndices?: number[] }
+
+/** Parse a `generateContent` response carrying `groundingMetadata` (Grounding with
+ *  Google Search) into the unified shape. Per ai.google.dev/gemini-api/docs/google-search
+ *  and the current google-genai SDK's GroundingMetadata/GroundingChunk/GroundingSupport
+ *  schema (Python SDK's snake_case maps to camelCase on the classic REST wire:
+ *  groundingChunks, groundingSupports, webSearchQueries, groundingChunkIndices). */
+export function parseGeminiSearchResponse(response: any): WebSearchResponse {
+  const candidate = response?.candidates?.[0];
+  const parts: any[] = candidate?.content?.parts ?? [];
+  const answer = parts.map((p: any) => (typeof p?.text === "string" ? p.text : "")).join("");
+  const grounding = candidate?.groundingMetadata;
+  const chunks: GeminiGroundingChunk[] = grounding?.groundingChunks ?? [];
+  const sources: WebSearchSource[] = chunks
+    .filter(c => !!c.web?.uri)
+    .map(c => ({ title: c.web!.title || c.web!.uri!, url: c.web!.uri! }));
+  const citations: WebSearchResponse["citations"] = (grounding?.groundingSupports as GeminiGroundingSupport[] | undefined ?? []).flatMap(s => {
+    const text = s.segment?.text
+      ?? (typeof s.segment?.startIndex === "number" && typeof s.segment?.endIndex === "number" ? answer.slice(s.segment.startIndex, s.segment.endIndex) : undefined);
+    return (s.groundingChunkIndices ?? [])
+      .map(i => chunks[i])
+      .filter((chunk): chunk is GeminiGroundingChunk & { web: { uri: string } } => !!chunk?.web?.uri)
+      .map(chunk => ({ url: chunk.web.uri, title: chunk.web.title, citedText: text }));
+  });
+
+  return {
+    provider: "Gemini",
+    answer: answer.trim() || undefined,
+    sources,
+    citations,
+    searchQueries: grounding?.webSearchQueries ?? [],
+    usage: response?.usageMetadata
+      ? {
+          inputTokens: response.usageMetadata.promptTokenCount,
+          outputTokens: response.usageMetadata.candidatesTokenCount,
+          searchRequests: (grounding?.webSearchQueries ?? []).length || undefined,
+        }
+      : undefined,
+    model: typeof response?.modelVersion === "string" ? response.modelVersion : undefined,
+    requestId: typeof response?.responseId === "string" ? response.responseId : undefined,
+  };
+}
+
+async function searchGemini(req: SearchRequest): Promise<WebSearchResponse> {
+  const credential = await resolveGeminiSearchCredential();
+  if (credential.kind !== "api_key") {
+    throw new Error("Gemini: no API key credentials (set GEMINI_API_KEY or JEO_SEARCH_API_KEY_GEMINI — Google/Gemini OAuth does not serve this endpoint)");
+  }
+  const effectiveQuery = req.recency ? `${req.query} (results from the last ${req.recency})` : req.query;
+  const model = jeoEnv("SEARCH_MODEL_GEMINI") || DEFAULT_SEARCH_MODEL_GEMINI;
+  const body = {
+    contents: [{ role: "user", parts: [{ text: effectiveQuery }] }],
+    tools: [{ googleSearch: {} }],
+  };
+  const response = await fetch(`${GEMINI_GENERATE_URL_BASE}/${encodeURIComponent(model)}:generateContent?key=${encodeURIComponent(credential.token)}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(GEMINI_HARD_TIMEOUT_MS),
+  });
+  if (!response.ok) {
+    const detail = (await response.text().catch(() => "")).slice(0, 300);
+    throw new Error(`Gemini API error (${response.status}): ${detail}`);
+  }
+  const parsed = parseGeminiSearchResponse(await response.json().catch(() => null));
+  if (req.limit && req.limit > 0 && parsed.sources.length > req.limit) {
+    parsed.sources = parsed.sources.slice(0, req.limit);
+  }
+  return parsed;
+}
+
 // ── DuckDuckGo provider (keyless terminal fallback; gjc port) ────────────────
 
 const DDG_HTML_ENDPOINT = "https://html.duckduckgo.com/html/";
@@ -381,6 +574,26 @@ const PROVIDERS: Record<SearchProviderDef["id"], SearchProviderDef> = {
     },
     search: searchAnthropic,
   },
+  openai: {
+    id: "openai",
+    label: "OpenAI",
+    isAvailable: async () => {
+      if (jeoEnv("SEARCH_API_KEY_OPENAI")) return true;
+      const cred = await resolveCredential("openai").catch(() => null);
+      return cred?.kind === "api_key";
+    },
+    search: searchOpenAI,
+  },
+  gemini: {
+    id: "gemini",
+    label: "Gemini",
+    isAvailable: async () => {
+      if (jeoEnv("SEARCH_API_KEY_GEMINI")) return true;
+      const cred = await resolveCredential("gemini").catch(() => null);
+      return cred?.kind === "api_key";
+    },
+    search: searchGemini,
+  },
   duckduckgo: {
     id: "duckduckgo",
     label: "DuckDuckGo",
@@ -393,6 +606,13 @@ const PROVIDERS: Record<SearchProviderDef["id"], SearchProviderDef> = {
  *  Providers without a jeo-native search implementation fall through to DuckDuckGo. */
 const MODEL_PROVIDER_TO_SEARCH: Record<string, SearchProviderDef["id"]> = {
   anthropic: "anthropic",
+  openai: "openai",
+  gemini: "gemini",
+  // antigravity sessions route to Google's OWN native search when a plain
+  // GEMINI_API_KEY also happens to be configured — the antigravity OAuth
+  // credential itself never qualifies (see resolveGeminiSearchCredential),
+  // so this never silently scans an unrelated provider's credentials.
+  antigravity: "gemini",
 };
 
 let activeModelHint: string | undefined;