jinzd-ai-cli 0.4.333 → 0.4.337

package/dist/{chunk-A4KKNBG3.js → chunk-DQBWJG32.js}

@@ -11,7 +11,7 @@ import {
   searchPersistentMemories,
   touchMemoryReferences,
   updateMemoryEntry
-} from "./chunk-4RVLGIK3.js";
+} from "./chunk-XF2F2V5Y.js";
 import {
   indexProject
 } from "./chunk-RWRZVQCB.js";
@@ -30,11 +30,11 @@ import {
   runHook,
   runLifecycleHooks,
   runTool
-} from "./chunk-YIEOU7NG.js";
+} from "./chunk-PWXVC6UZ.js";
 import {
   getDangerLevel,
   isFileWriteTool
-} from "./chunk-W4P2KJZN.js";
+} from "./chunk-6SFS6IJH.js";
 import {
   buildTruncatedArgumentsError,
   runLeanAgentLoop
@@ -66,7 +66,7 @@ import {
   recoverGbkMojibake,
   runTestsTool,
   shellInvocation
-} from "./chunk-K4AYNZF7.js";
+} from "./chunk-EGRKGP4P.js";
 import {
   CONFIG_DIR_NAME,
   DEFAULT_MAX_TOOL_OUTPUT_CHARS_CAP,
@@ -75,7 +75,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-JTXHWIBO.js";
+} from "./chunk-7TU4KHMK.js";
 import {
   getCurrentSessionKey,
   getExecutionConfigDir,
@@ -2028,6 +2028,14 @@ function domainMatches(pattern, host) {
   const h = host.trim().toLowerCase().replace(/:\d+$/, "");
   return h === p || h.endsWith(`.${p}`);
 }
+function isHostAllowedByNetworkPolicy(host, policy) {
+  if (!policy?.enabled) return true;
+  if (policy.denyDomains?.some((pattern) => domainMatches(pattern, host))) return false;
+  if (policy.allowDomains && policy.allowDomains.length > 0) {
+    return policy.allowDomains.some((pattern) => domainMatches(pattern, host));
+  }
+  return true;
+}
 function isPrivateNetworkHost(host) {
   const h = host.toLowerCase().replace(/^\[|\]$/g, "");
   if (h === "" || h === "localhost") return true;
@@ -4270,6 +4278,231 @@ ${stderr}`);
 import { promises as dnsPromises } from "dns";
 import net from "net";
 import { Agent } from "undici";
+
+// src/tools/builtin/google-search.ts
+var GOOGLE_SEARCH_API = "https://www.googleapis.com/customsearch/v1";
+var REQUEST_TIMEOUT_MS = 15e3;
+var MAX_RESULTS = 10;
+var DEFAULT_RESULTS = 5;
+var googleSearchContext = {};
+var googleSearchTool = {
+  definition: {
+    name: "google_search",
+    description: "\u26A0\uFE0F NOT RECOMMENDED \u2014 uses Google Custom Search API which requires a paid API key. API keys have leaked in the wild causing tens of thousands of USD in unauthorized charges. PREFER `web_search` (keyless Bing/Google scraping, zero billing risk). This tool is disabled by default; user must set config.googleSearch.enabled=true to use it.",
+    parameters: {
+      query: {
+        type: "string",
+        description: "The search query string.",
+        required: true
+      },
+      num_results: {
+        type: "number",
+        description: "Number of results to return (1-10, default 5).",
+        required: false
+      }
+    },
+    dangerous: false
+  },
+  async execute(args) {
+    const query = String(args["query"] ?? "").trim();
+    if (!query) throw new ToolError("google_search", "query parameter is required");
+    const enabledFlag = googleSearchContext.configManager?.get("googleSearch")?.enabled ?? false;
+    if (!enabledFlag) {
+      throw new ToolError(
+        "google_search",
+        '\u{1F6AB} google_search is disabled by default (v0.4.135+).\n\nWHY: Google Custom Search has no native daily-spend cap. Keys leak (search GitHub for "AIza" \u2014 thousands of public exposures), bots scrape them within hours, and the GCP bill lands days later. Multiple engineers have lost $10k+ USD this way.\n\nRECOMMENDED: use `web_search` instead \u2014 same use case, scrapes Bing/Google public pages, zero API key, zero billing risk.\n\nIF YOU INSIST: edit ~/.aicli/config.json and set `googleSearch.enabled = true`. ALSO go to GCP Console \u2192 Custom Search API \u2192 Quotas and set a hard daily request cap (e.g. 100/day) \u2014 that is the only real damage cap.'
+      );
+    }
+    const numResults = Math.min(
+      Math.max(Math.floor(Number(args["num_results"] ?? DEFAULT_RESULTS)), 1),
+      MAX_RESULTS
+    );
+    const { apiKey, cx } = resolveConfig();
+    const url = new URL(GOOGLE_SEARCH_API);
+    url.searchParams.set("key", apiKey);
+    url.searchParams.set("cx", cx);
+    url.searchParams.set("q", query);
+    url.searchParams.set("num", String(numResults));
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const response = await fetch(url.toString(), {
+        method: "GET",
+        headers: {
+          "Accept": "application/json"
+        },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const errorBody = await response.text().catch(() => "");
+        if (response.status === 403) {
+          throw new NetworkError(
+            `Google Search API 403 Forbidden \u2014 Invalid API Key or daily free quota exceeded (100/day).
+Please check your API Key and Search Engine ID configuration.`,
+            403
+          );
+        }
+        if (response.status === 429) {
+          throw new NetworkError("Google Search API 429 \u2014 Too many requests, please try again later.", 429);
+        }
+        throw new NetworkError(
+          `Google Search API error: HTTP ${response.status} ${response.statusText}
+${errorBody.slice(0, 500)}`,
+          response.status
+        );
+      }
+      const data = await response.json();
+      return formatResults(query, data, numResults);
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new NetworkError(`Google Search request timed out (${REQUEST_TIMEOUT_MS / 1e3}s). Please check your network or proxy configuration.`, void 0, err);
+      }
+      throw err;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+};
+function resolveConfig() {
+  let apiKey;
+  let cx;
+  if (googleSearchContext.configManager) {
+    apiKey = googleSearchContext.configManager.getApiKey("google-search");
+    cx = EnvLoader.getGoogleSearchEngineId() ?? googleSearchContext.configManager.get("googleSearchEngineId");
+  } else {
+    apiKey = EnvLoader.getApiKey("google-search");
+    cx = EnvLoader.getGoogleSearchEngineId();
+  }
+  if (!apiKey) {
+    throw new ToolError(
+      "google_search",
+      'Google Search API Key not configured.\nConfigure via one of:\n  1. Run /config \u2192 Configure Google Search\n  2. Set env var AICLI_API_KEY_GOOGLESEARCH\n  3. Add apiKeys["google-search"] to ~/.aicli/config.json'
+    );
+  }
+  if (!cx) {
+    throw new ToolError(
+      "google_search",
+      "Google Search Engine ID (cx) not configured.\nConfigure via one of:\n  1. Run /config \u2192 Configure Google Search\n  2. Set env var AICLI_GOOGLE_CX\n  3. Add googleSearchEngineId to ~/.aicli/config.json\n\nGet one at: https://programmablesearchengine.google.com/ \u2192 Create search engine \u2192 Copy Search Engine ID"
+    );
+  }
+  return { apiKey, cx };
+}
+function formatResults(query, data, _requested) {
+  const items = data.items ?? [];
+  if (items.length === 0) {
+    const info2 = data.searchInformation;
+    return `No results found for: "${query}"` + (info2 ? ` (searched ${info2.formattedTotalResults ?? "0"} pages in ${info2.formattedSearchTime ?? "?"}s)` : "");
+  }
+  const info = data.searchInformation;
+  const header = `Search results for "${query}" (${items.length} of ~${info?.formattedTotalResults ?? "?"} results):
+`;
+  const results = items.map((item, i) => {
+    const title = item.title ?? "Untitled";
+    const link = item.link ?? "";
+    const snippet = item.snippet ?? "";
+    return `${i + 1}. **${title}**
+   URL: ${link}
+   ${snippet}`;
+  });
+  return header + "\n" + results.join("\n\n");
+}
+
+// src/tools/builtin/deepseek-web-api.ts
+var DEEPSEEK_TOOLS_HOST = "api.deepseek.com";
+var BASE_URL = `https://${DEEPSEEK_TOOLS_HOST}/v1/tools`;
+var SEARCH_TIMEOUT_MS = 2e4;
+var FETCH_TIMEOUT_MS = 3e4;
+var DEEPSEEK_MAX_QUERY_CHARS = 128;
+function resolveDeepSeekWebKey(configManager = googleSearchContext.configManager) {
+  const key = configManager ? configManager.getApiKey("deepseek") : EnvLoader.getApiKey("deepseek");
+  if (!key || !key.trim()) return void 0;
+  const policy = configManager?.get("networkPolicy");
+  if (!isHostAllowedByNetworkPolicy(DEEPSEEK_TOOLS_HOST, policy)) return void 0;
+  return key.trim();
+}
+async function deepseekSearch(apiKey, query, count) {
+  const data = await postJson(apiKey, "search", { query, count }, SEARCH_TIMEOUT_MS);
+  return parseDeepSeekSearchResponse(data);
+}
+async function deepseekFetch(apiKey, url) {
+  const data = await postJson(apiKey, "fetch", { url }, FETCH_TIMEOUT_MS);
+  const content = typeof data?.content === "string" ? data.content : "";
+  if (!content.trim()) throw new NetworkError("DeepSeek Fetch returned no content.");
+  return { title: typeof data.title === "string" ? data.title : "", content };
+}
+function parseDeepSeekSearchResponse(data) {
+  const raw = data?.results;
+  if (!Array.isArray(raw)) {
+    throw new NetworkError("DeepSeek Search returned an unexpected response (no results array).");
+  }
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const r = item;
+    const url = typeof r["url"] === "string" ? r["url"] : "";
+    const title = typeof r["title"] === "string" ? r["title"].trim() : "";
+    if (!url || !title) continue;
+    out.push({
+      title,
+      url,
+      snippet: typeof r["snippet"] === "string" ? r["snippet"].trim() : "",
+      summary: typeof r["summary"] === "string" ? r["summary"].trim() : "",
+      siteName: typeof r["site_name"] === "string" && r["site_name"] ? r["site_name"] : null,
+      date: typeof r["date"] === "string" && r["date"] ? r["date"] : null,
+      rerankScore: typeof r["rerank_score"] === "number" ? r["rerank_score"] : null,
+      authority: typeof r["authority"] === "number" ? r["authority"] : null
+    });
+  }
+  return out;
+}
+async function postJson(apiKey, endpoint, body, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(`${BASE_URL}/${endpoint}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      throw new NetworkError(
+        `DeepSeek ${endpoint} HTTP ${res.status}: ${describeDeepSeekError(res.status, text)}`,
+        res.status
+      );
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new NetworkError(`DeepSeek ${endpoint} returned non-JSON response.`);
+    }
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new NetworkError(`DeepSeek ${endpoint} timed out after ${timeoutMs / 1e3}s.`, void 0, err);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function describeDeepSeekError(status, bodyText) {
+  let message = "";
+  try {
+    const parsed = JSON.parse(bodyText);
+    if (typeof parsed?.error?.message === "string") message = parsed.error.message;
+  } catch {
+  }
+  if (!message) message = bodyText.trim().slice(0, 200) || "(empty body)";
+  const hint = status === 401 ? " \u2014 DeepSeek API key missing or invalid" : status === 402 ? " \u2014 DeepSeek account balance is insufficient" : status === 403 ? " \u2014 rejected by DeepSeek security policy" : status === 404 ? " \u2014 no usable content at this URL" : status === 429 ? " \u2014 DeepSeek QPS limit exceeded" : "";
+  return message + hint;
+}
+
+// src/tools/builtin/web-fetch.ts
 function htmlToText(html) {
   let text = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<svg[\s\S]*?<\/svg>/gi, "");
   const HTML_REGEX_LIMIT = 2e5;
@@ -4442,7 +4675,7 @@ function ssrfSafeDispatcher() {
 var webFetchTool = {
   definition: {
     name: "web_fetch",
-    description: "Fetch a URL and return its content as plain text / Markdown. Use this to read documentation, API references, READMEs, articles, or any public web page. Follows redirects automatically. Returns the first ~16000 characters of extracted text.",
+    description: "Fetch a URL and return its content as plain text / Markdown. Use this to read documentation, API references, READMEs, articles, or any public web page. Follows redirects automatically. Returns the first ~16000 characters of extracted text. If the direct request fails and a DeepSeek API key is configured, retries once via the DeepSeek Fetch API.",
     parameters: {
       url: {
         type: "string",
@@ -4472,94 +4705,26 @@ var webFetchTool = {
       if (e.message.startsWith("Blocked:")) throw e;
       throw new NetworkError(`Invalid URL: "${url}"`);
     }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), 2e4);
-    let rawHtml;
-    let finalUrl;
-    let contentType;
-    const MAX_REDIRECTS = 10;
-    const FETCH_HEADERS = {
-      "User-Agent": "Mozilla/5.0 (compatible; ai-cli/1.0; +https://github.com/ai-cli)",
-      Accept: "text/html,application/xhtml+xml,text/plain,*/*",
-      "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8"
-    };
-    const dispatcher = ssrfSafeDispatcher();
+    let text;
     try {
-      let currentUrl = url;
-      let resp = null;
-      for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-        const parsedHop = new URL(currentUrl);
-        if (isPrivateHost(parsedHop.hostname)) {
-          throw new NetworkError(`Blocked: redirect to private/internal address "${currentUrl}".`);
-        }
-        await resolveAndCheck(parsedHop.hostname);
-        const r = await fetch(currentUrl, {
-          signal: controller.signal,
-          headers: FETCH_HEADERS,
-          redirect: "manual",
-          // 手动控制重定向
-          dispatcher
-          // dual undici-types：`dispatcher` 字段在 undici 与 @types/node 内置的
-          // undici-types 两份 RequestInit 间判不兼容，localized 转换。
-        });
-        if (r.status >= 300 && r.status < 400) {
-          if (hop >= MAX_REDIRECTS) {
-            throw new NetworkError(`Too many redirects (>${MAX_REDIRECTS}): ${url}`);
-          }
-          const location = r.headers.get("Location");
-          if (!location) {
-            resp = r;
-            break;
-          }
-          currentUrl = new URL(location, currentUrl).href;
-          continue;
-        }
-        resp = r;
-        break;
-      }
-      if (!resp) throw new NetworkError(`Too many redirects (>${MAX_REDIRECTS}): ${url}`);
-      finalUrl = currentUrl;
-      contentType = resp.headers.get("content-type") ?? "";
-      if (!resp.ok) {
-        throw new NetworkError(`HTTP ${resp.status} ${resp.statusText}`, resp.status);
-      }
-      const bodyBytes = await readBodyCapped(resp, MAX_BODY_BYTES);
-      clearTimeout(timeoutId);
-      rawHtml = new TextDecoder("utf-8", { fatal: false }).decode(bodyBytes);
+      text = await fetchDirect(url);
     } catch (err) {
-      clearTimeout(timeoutId);
-      if (err.name === "AbortError") {
-        throw new NetworkError(`Request timed out after 20s: ${url}`, void 0, err);
-      }
-      const cause = err.cause;
-      if (cause?.message?.startsWith("Blocked:")) throw new NetworkError(cause.message);
-      if (err instanceof Error && err.message === "fetch failed") {
-        const detail = cause?.message ? ` (${cause.message})` : "";
-        throw new NetworkError(
-          `Connection failed for ${url}${detail}. The domain may be unreachable from the current network (some sites require a proxy \u2014 see config.proxy) or temporarily down. Do not retry the same URL; try an alternative source.`,
-          void 0,
-          err
-        );
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.startsWith("Blocked:")) throw err;
+      const key = resolveDeepSeekWebKey();
+      if (!key) throw err;
+      try {
+        const ds = await deepseekFetch(key, url);
+        text = [
+          ds.title ? `# ${ds.title}` : "",
+          `Source: ${url} (via DeepSeek Fetch \u2014 direct request failed: ${msg.split("\n")[0]})`,
+          ""
+        ].filter(Boolean).join("\n") + "\n\n" + ds.content;
+      } catch (dsErr) {
+        const dsMsg = dsErr instanceof Error ? dsErr.message : String(dsErr);
+        throw new NetworkError(`${msg}
+DeepSeek Fetch fallback also failed: ${dsMsg}`, void 0, err);
       }
-      throw err;
-    } finally {
-      void dispatcher.close().catch(() => {
-      });
-    }
-    let text;
-    if (contentType.includes("text/plain") || contentType.includes("application/json")) {
-      text = rawHtml;
-    } else {
-      const title = extractTitle(rawHtml);
-      const desc = extractDescription(rawHtml);
-      const body = htmlToText(rawHtml);
-      const header = [
-        title ? `# ${title}` : "",
-        desc ? `> ${desc}` : "",
-        `Source: ${finalUrl}`,
-        ""
-      ].filter(Boolean).join("\n");
-      text = header + "\n\n" + body;
     }
     if (selector) {
       const lower = selector.toLowerCase();
@@ -4584,16 +4749,132 @@ var webFetchTool = {
     return text;
   }
 };
+async function fetchDirect(url) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 2e4);
+  let rawHtml;
+  let finalUrl;
+  let contentType;
+  const MAX_REDIRECTS = 10;
+  const FETCH_HEADERS = {
+    "User-Agent": "Mozilla/5.0 (compatible; ai-cli/1.0; +https://github.com/ai-cli)",
+    Accept: "text/html,application/xhtml+xml,text/plain,*/*",
+    "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8"
+  };
+  const dispatcher = ssrfSafeDispatcher();
+  try {
+    let currentUrl = url;
+    let resp = null;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      const parsedHop = new URL(currentUrl);
+      if (isPrivateHost(parsedHop.hostname)) {
+        throw new NetworkError(`Blocked: redirect to private/internal address "${currentUrl}".`);
+      }
+      await resolveAndCheck(parsedHop.hostname);
+      const r = await fetch(currentUrl, {
+        signal: controller.signal,
+        headers: FETCH_HEADERS,
+        redirect: "manual",
+        // 手动控制重定向
+        dispatcher
+        // dual undici-types：`dispatcher` 字段在 undici 与 @types/node 内置的
+        // undici-types 两份 RequestInit 间判不兼容，localized 转换。
+      });
+      if (r.status >= 300 && r.status < 400) {
+        if (hop >= MAX_REDIRECTS) {
+          throw new NetworkError(`Too many redirects (>${MAX_REDIRECTS}): ${url}`);
+        }
+        const location = r.headers.get("Location");
+        if (!location) {
+          resp = r;
+          break;
+        }
+        currentUrl = new URL(location, currentUrl).href;
+        continue;
+      }
+      resp = r;
+      break;
+    }
+    if (!resp) throw new NetworkError(`Too many redirects (>${MAX_REDIRECTS}): ${url}`);
+    finalUrl = currentUrl;
+    contentType = resp.headers.get("content-type") ?? "";
+    if (!resp.ok) {
+      throw new NetworkError(`HTTP ${resp.status} ${resp.statusText}`, resp.status);
+    }
+    const bodyBytes = await readBodyCapped(resp, MAX_BODY_BYTES);
+    clearTimeout(timeoutId);
+    rawHtml = new TextDecoder("utf-8", { fatal: false }).decode(bodyBytes);
+  } catch (err) {
+    clearTimeout(timeoutId);
+    if (err.name === "AbortError") {
+      throw new NetworkError(`Request timed out after 20s: ${url}`, void 0, err);
+    }
+    const cause = err.cause;
+    if (cause?.message?.startsWith("Blocked:")) throw new NetworkError(cause.message);
+    if (err instanceof Error && err.message === "fetch failed") {
+      const detail = cause?.message ? ` (${cause.message})` : "";
+      throw new NetworkError(
+        `Connection failed for ${url}${detail}. The domain may be unreachable from the current network (some sites require a proxy \u2014 see config.proxy) or temporarily down. Do not retry the same URL; try an alternative source.`,
+        void 0,
+        err
+      );
+    }
+    throw err;
+  } finally {
+    void dispatcher.close().catch(() => {
+    });
+  }
+  let text;
+  if (contentType.includes("text/plain") || contentType.includes("application/json")) {
+    text = rawHtml;
+  } else {
+    const title = extractTitle(rawHtml);
+    const desc = extractDescription(rawHtml);
+    const body = htmlToText(rawHtml);
+    const header = [
+      title ? `# ${title}` : "",
+      desc ? `> ${desc}` : "",
+      `Source: ${finalUrl}`,
+      ""
+    ].filter(Boolean).join("\n");
+    text = header + "\n\n" + body;
+  }
+  return text;
+}
 
 // src/tools/builtin/web-search.ts
-var REQUEST_TIMEOUT_MS = 15e3;
-var MAX_RESULTS = 10;
-var DEFAULT_RESULTS = 5;
+function planEngineOrder(engine, query, hasDeepSeekKey) {
+  const skipped = [];
+  if (engine === "bing") return { order: ["bing"], skipped };
+  if (engine === "google") return { order: ["google"], skipped };
+  const tooLong = [...query].length > DEEPSEEK_MAX_QUERY_CHARS;
+  if (engine === "deepseek") {
+    if (!hasDeepSeekKey) {
+      throw new ToolError(
+        "web_search",
+        "engine 'deepseek' needs a DeepSeek API key (config apiKeys.deepseek or AICLI_API_KEY_DEEPSEEK), and networkPolicy must allow api.deepseek.com. Use engine 'auto' or 'bing' instead."
+      );
+    }
+    if (tooLong) {
+      throw new ToolError(
+        "web_search",
+        `engine 'deepseek' accepts queries up to ${DEEPSEEK_MAX_QUERY_CHARS} characters \u2014 shorten the query.`
+      );
+    }
+    return { order: ["deepseek"], skipped };
+  }
+  if (hasDeepSeekKey && !tooLong) return { order: ["deepseek", "bing", "google"], skipped };
+  if (hasDeepSeekKey && tooLong) skipped.push(`deepseek: query longer than ${DEEPSEEK_MAX_QUERY_CHARS} chars, skipped`);
+  return { order: ["bing", "google"], skipped };
+}
+var REQUEST_TIMEOUT_MS2 = 15e3;
+var MAX_RESULTS2 = 10;
+var DEFAULT_RESULTS2 = 5;
 var UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36";
 var webSearchTool = {
   definition: {
     name: "web_search",
-    description: 'Search the web using Bing or Google by scraping their public result pages. No API key required, no billing risk. Returns structured {title, url, snippet} for each result. Use this for fresh facts, news, or any "what does X say about Y" lookup. Prefer this over google_search (which needs a paid API key).',
+    description: 'Search the web. Uses the DeepSeek Search API when a DeepSeek API key is configured (results carry a relevance score and a longer summary), otherwise scrapes Bing / Google public result pages. Returns title, url and summary/snippet for each result. Use this for fresh facts, news, or any "what does X say about Y" lookup. With the deepseek engine the query (max 128 chars) supports operators: site:example.com, -site:, "exact phrase", -term, lang:en, after:2025, before:2026-06-01. Prefer this over google_search (which needs a paid API key).',
     parameters: {
       query: {
         type: "string",
@@ -4607,7 +4888,7 @@ var webSearchTool = {
       },
       engine: {
         type: "string",
-        description: "Search engine: 'bing' (default for CN reachability), 'google', or 'auto' (try bing first, fall back to google on empty/error). Default 'auto'.",
+        description: "Search engine: 'auto' (default \u2014 DeepSeek Search API if a DeepSeek key is configured, then Bing, then Google on empty/error), 'deepseek', 'bing', or 'google'.",
         required: false
       }
     },
@@ -4617,21 +4898,30 @@ var webSearchTool = {
     const query = String(args["query"] ?? "").trim();
     if (!query) throw new ToolError("web_search", "query parameter is required");
     const numResults = Math.min(
-      Math.max(Math.floor(Number(args["num_results"] ?? DEFAULT_RESULTS)), 1),
-      MAX_RESULTS
+      Math.max(Math.floor(Number(args["num_results"] ?? DEFAULT_RESULTS2)), 1),
+      MAX_RESULTS2
     );
     const engine = String(args["engine"] ?? "auto").toLowerCase();
-    if (!["bing", "google", "auto"].includes(engine)) {
-      throw new ToolError("web_search", `engine must be one of: bing, google, auto (got: ${engine})`);
+    if (!["deepseek", "bing", "google", "auto"].includes(engine)) {
+      throw new ToolError("web_search", `engine must be one of: auto, deepseek, bing, google (got: ${engine})`);
     }
-    const order = engine === "auto" ? ["bing", "google"] : engine === "bing" ? ["bing"] : ["google"];
-    const errors = [];
+    const deepseekKey = engine === "bing" || engine === "google" ? void 0 : resolveDeepSeekWebKey();
+    const { order, skipped } = planEngineOrder(engine, query, deepseekKey !== void 0);
+    const errors = [...skipped];
     let weakBingFallback = null;
     let weakBingReason = null;
     for (let i = 0; i < order.length; i++) {
       const eng = order[i];
       const isLastEngine = i === order.length - 1;
       try {
+        if (eng === "deepseek") {
+          const dsResults = await deepseekSearch(deepseekKey, query, numResults);
+          if (dsResults.length === 0) {
+            errors.push("deepseek: 0 results");
+            continue;
+          }
+          return formatDeepSeekResults(query, dsResults);
+        }
         const results = eng === "bing" ? await searchBing(query, numResults) : await searchGoogle(query, numResults);
         if (results.length === 0) {
           errors.push(`${eng}: 0 results`);
@@ -4646,13 +4936,13 @@ var webSearchTool = {
             continue;
           }
         }
-        return formatResults(query, eng, results);
+        return formatResults2(query, eng, results);
       } catch (err) {
         errors.push(`${eng}: ${err instanceof Error ? err.message : String(err)}`);
       }
     }
     if (weakBingFallback) {
-      return formatResults(query, "bing", weakBingFallback, {
+      return formatResults2(query, "bing", weakBingFallback, {
         warning: `engine signaled weak relevance (${weakBingReason}). These results may be Bing's "popular sites" fallback rather than real matches. Consider rephrasing the query (shorter, fewer constraints), or use web_fetch against a known authoritative URL (e.g. baike.baidu.com, mfa.gov.cn, news.cctv.com).`
       });
     }
@@ -4858,7 +5148,7 @@ function parseGoogleResults(html, maxResults) {
 }
 async function fetchHtml(url) {
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS2);
   try {
     const res = await fetch(url, {
       method: "GET",
@@ -4875,7 +5165,7 @@ async function fetchHtml(url) {
     return await res.text();
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
-      throw new NetworkError(`Request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s.`, void 0, err);
+      throw new NetworkError(`Request timed out after ${REQUEST_TIMEOUT_MS2 / 1e3}s.`, void 0, err);
     }
     throw err;
   } finally {
@@ -4888,7 +5178,31 @@ function stripTags2(html) {
 function decodeHtmlEntities(s) {
   return s.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&#x2F;/g, "/").replace(/&nbsp;/g, " ");
 }
-function formatResults(query, engine, results, opts) {
+var DEEPSEEK_SUMMARY_MAX_CHARS = 600;
+function clipSummary(s) {
+  const flat = s.replace(/\s+/g, " ").trim();
+  const chars = [...flat];
+  if (chars.length <= DEEPSEEK_SUMMARY_MAX_CHARS) return flat;
+  return chars.slice(0, DEEPSEEK_SUMMARY_MAX_CHARS).join("") + "\u2026";
+}
+function formatDeepSeekResults(query, results) {
+  const preamble = `Search results for "${query}" via deepseek (${results.length} results; relevance 0\u20133, \u22651.5 is high quality):
+`;
+  const body = results.map((r, i) => {
+    const meta = [
+      r.siteName,
+      r.date ? r.date.slice(0, 10) : null,
+      r.rerankScore !== null ? `relevance ${r.rerankScore.toFixed(2)}` : null
+    ].filter(Boolean).join(" \xB7 ");
+    const text = clipSummary(r.summary || r.snippet) || "(no summary)";
+    return `${i + 1}. **${r.title}**
+   URL: ${r.url}${meta ? `
+   ${meta}` : ""}
+   ${text}`;
+  }).join("\n\n");
+  return preamble + "\n" + body;
+}
+function formatResults2(query, engine, results, opts) {
   let preamble = `Search results for "${query}" via ${engine} (${results.length} results):
 `;
   if (opts?.warning) {
@@ -5182,134 +5496,6 @@ function renderTodoList(todos) {
   console.log();
 }
 
-// src/tools/builtin/google-search.ts
-var GOOGLE_SEARCH_API = "https://www.googleapis.com/customsearch/v1";
-var REQUEST_TIMEOUT_MS2 = 15e3;
-var MAX_RESULTS2 = 10;
-var DEFAULT_RESULTS2 = 5;
-var googleSearchContext = {};
-var googleSearchTool = {
-  definition: {
-    name: "google_search",
-    description: "\u26A0\uFE0F NOT RECOMMENDED \u2014 uses Google Custom Search API which requires a paid API key. API keys have leaked in the wild causing tens of thousands of USD in unauthorized charges. PREFER `web_search` (keyless Bing/Google scraping, zero billing risk). This tool is disabled by default; user must set config.googleSearch.enabled=true to use it.",
-    parameters: {
-      query: {
-        type: "string",
-        description: "The search query string.",
-        required: true
-      },
-      num_results: {
-        type: "number",
-        description: "Number of results to return (1-10, default 5).",
-        required: false
-      }
-    },
-    dangerous: false
-  },
-  async execute(args) {
-    const query = String(args["query"] ?? "").trim();
-    if (!query) throw new ToolError("google_search", "query parameter is required");
-    const enabledFlag = googleSearchContext.configManager?.get("googleSearch")?.enabled ?? false;
-    if (!enabledFlag) {
-      throw new ToolError(
-        "google_search",
-        '\u{1F6AB} google_search is disabled by default (v0.4.135+).\n\nWHY: Google Custom Search has no native daily-spend cap. Keys leak (search GitHub for "AIza" \u2014 thousands of public exposures), bots scrape them within hours, and the GCP bill lands days later. Multiple engineers have lost $10k+ USD this way.\n\nRECOMMENDED: use `web_search` instead \u2014 same use case, scrapes Bing/Google public pages, zero API key, zero billing risk.\n\nIF YOU INSIST: edit ~/.aicli/config.json and set `googleSearch.enabled = true`. ALSO go to GCP Console \u2192 Custom Search API \u2192 Quotas and set a hard daily request cap (e.g. 100/day) \u2014 that is the only real damage cap.'
-      );
-    }
-    const numResults = Math.min(
-      Math.max(Math.floor(Number(args["num_results"] ?? DEFAULT_RESULTS2)), 1),
-      MAX_RESULTS2
-    );
-    const { apiKey, cx } = resolveConfig();
-    const url = new URL(GOOGLE_SEARCH_API);
-    url.searchParams.set("key", apiKey);
-    url.searchParams.set("cx", cx);
-    url.searchParams.set("q", query);
-    url.searchParams.set("num", String(numResults));
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS2);
-    try {
-      const response = await fetch(url.toString(), {
-        method: "GET",
-        headers: {
-          "Accept": "application/json"
-        },
-        signal: controller.signal
-      });
-      if (!response.ok) {
-        const errorBody = await response.text().catch(() => "");
-        if (response.status === 403) {
-          throw new NetworkError(
-            `Google Search API 403 Forbidden \u2014 Invalid API Key or daily free quota exceeded (100/day).
-Please check your API Key and Search Engine ID configuration.`,
-            403
-          );
-        }
-        if (response.status === 429) {
-          throw new NetworkError("Google Search API 429 \u2014 Too many requests, please try again later.", 429);
-        }
-        throw new NetworkError(
-          `Google Search API error: HTTP ${response.status} ${response.statusText}
-${errorBody.slice(0, 500)}`,
-          response.status
-        );
-      }
-      const data = await response.json();
-      return formatResults2(query, data, numResults);
-    } catch (err) {
-      if (err instanceof Error && err.name === "AbortError") {
-        throw new NetworkError(`Google Search request timed out (${REQUEST_TIMEOUT_MS2 / 1e3}s). Please check your network or proxy configuration.`, void 0, err);
-      }
-      throw err;
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-};
-function resolveConfig() {
-  let apiKey;
-  let cx;
-  if (googleSearchContext.configManager) {
-    apiKey = googleSearchContext.configManager.getApiKey("google-search");
-    cx = EnvLoader.getGoogleSearchEngineId() ?? googleSearchContext.configManager.get("googleSearchEngineId");
-  } else {
-    apiKey = EnvLoader.getApiKey("google-search");
-    cx = EnvLoader.getGoogleSearchEngineId();
-  }
-  if (!apiKey) {
-    throw new ToolError(
-      "google_search",
-      'Google Search API Key not configured.\nConfigure via one of:\n  1. Run /config \u2192 Configure Google Search\n  2. Set env var AICLI_API_KEY_GOOGLESEARCH\n  3. Add apiKeys["google-search"] to ~/.aicli/config.json'
-    );
-  }
-  if (!cx) {
-    throw new ToolError(
-      "google_search",
-      "Google Search Engine ID (cx) not configured.\nConfigure via one of:\n  1. Run /config \u2192 Configure Google Search\n  2. Set env var AICLI_GOOGLE_CX\n  3. Add googleSearchEngineId to ~/.aicli/config.json\n\nGet one at: https://programmablesearchengine.google.com/ \u2192 Create search engine \u2192 Copy Search Engine ID"
-    );
-  }
-  return { apiKey, cx };
-}
-function formatResults2(query, data, _requested) {
-  const items = data.items ?? [];
-  if (items.length === 0) {
-    const info2 = data.searchInformation;
-    return `No results found for: "${query}"` + (info2 ? ` (searched ${info2.formattedTotalResults ?? "0"} pages in ${info2.formattedSearchTime ?? "?"}s)` : "");
-  }
-  const info = data.searchInformation;
-  const header = `Search results for "${query}" (${items.length} of ~${info?.formattedTotalResults ?? "?"} results):
-`;
-  const results = items.map((item, i) => {
-    const title = item.title ?? "Untitled";
-    const link = item.link ?? "";
-    const snippet = item.snippet ?? "";
-    return `${i + 1}. **${title}**
-   URL: ${link}
-   ${snippet}`;
-  });
-  return header + "\n" + results.join("\n\n");
-}
-
 // src/agents/agent-config.ts
 import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync5 } from "fs";
 import { join as join4 } from "path";
@@ -7179,10 +7365,10 @@ export {
   truncateOutput,
   ToolExecutor,
   globToRegex,
+  googleSearchContext,
   lastResponseStore,
   cleanupRejectedTeeFile,
   askUserContext,
-  googleSearchContext,
   isToolCapableProvider,
   spawnAgentContext,
   estimateTokens,