web-access-cli 0.4.0 → 0.6.0

package/README.md

@@ -5,7 +5,7 @@ English | [简体中文](README_CN.md)
 [![CI](https://github.com/Juexe/web-access-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/Juexe/web-access-cli/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
-An agent-neutral CLI for web capabilities. It defines search and web content extraction as stable capabilities while normalizing differences among Tavily, Exa, Bocha, Brave, SearXNG, AnySearch, XCrawl, DeepSeek, Firecrawl, Jina, and other providers behind a unified internal schema.
+An agent-neutral CLI for web capabilities. It defines search and web content extraction as stable capabilities while normalizing differences among Tavily, Exa, Bocha, Yuanbao Search, Brave, SearXNG, AnySearch, XCrawl, DeepSeek, Firecrawl, Jina, and other providers behind a unified internal schema.
 
 The CLI is the primary product interface. It is not tied to Pi, Claude Code, Codex, Cursor, OpenCode, or any other agent. Skills, MCP integrations, and agent plugins may only integrate as adapters on top of the CLI; they must not leak into the core capabilities or provider implementations.
 
@@ -13,10 +13,10 @@ The CLI is the primary product interface. It is not tied to Pi, Claude Code, Cod
 
 | Capability | Provider types | Normalized output |
 | --- | --- | --- |
-| `search` | Tavily, Exa, Bocha, Brave, SearXNG, AnySearch, XCrawl, DeepSeek, xAI x_search, xAI web_search | `rank`, `title`, `url`, `snippet` |
-| `extract` | Firecrawl v2, Jina Reader, Exa Contents, AnySearch, XCrawl, HTTP | Markdown `Document` |
+| `search` | Tavily, Exa, Bocha, Yuanbao Search, Brave, SearXNG, AnySearch, XCrawl, DeepSeek, xAI x_search, xAI web_search | `rank`, `title`, `url`, `snippet` |
+| `extract` | Firecrawl v2, Jina Reader, Exa Contents, AnySearch, XCrawl, DeepSeek Fetch, HTTP | Markdown `Document` |
 
-A provider type describes an implementation, while a provider instance is a configurable instance of that type. One type can have multiple instances, such as `exa_team` and `exa_personal`. A `providers` route is an ordered array of instance IDs that determines which instances are enabled and the initial `auto` order. The CLI stores the learned effective order in the sibling `_providers` field.
+A provider type describes an implementation, while a provider instance is a configurable instance of that type. One type can have multiple instances, such as `exa_team` and `exa_personal`. Each capability has a primary `providers` route and a `providers_fallback` route. Both arrays determine enabled instances and their current `auto` order; the CLI only reorders members within their existing group.
 
 ## Installation
 
@@ -50,12 +50,15 @@ pnpm pack:check
 
 ```text
 src/cli.ts                 Commander CLI and exit codes
+src/server.ts              Standalone DeepSeek-compatible gateway entry point
 src/config/                Configuration files, environment variables, and route merging
 src/core/                  Public types, schemas, errors, routing, and diagnostics
+src/gateway/               Gateway protocol schema, service mapping, and HTTP boundary
 src/providers/             Provider adapters, registry, and HTTP/RSC extraction
 src/transport/             Proxies, timeouts, redirects, and response size limits
 schemas/                   Generated JSON Schemas
 test/                      node:test unit tests and local HTTP integration tests
+deploy/                    Public gateway Compose template, env/config examples, operations guide
 ```
 
 Provider adapters should handle protocol mapping only. Fallback, deadlines, attempts, envelopes, and exit codes are managed centrally by `src/core`. Do not add lifecycle or tool registration code for Pi, Claude Code, Codex, or any other agent to an adapter.
@@ -69,6 +72,7 @@ pnpm typecheck
 pnpm test
 pnpm build
 pnpm pack:check
+pnpm test:docker
 ```
 
 `pnpm check` runs linting, type checking, tests, and the build in that order. After changing `src/core/schema.ts`, run `pnpm build` again and commit the updated `schemas/*.schema.json` files. Provider tests should use the mock transport or local HTTP server from `test/helpers.ts`; they must not depend on real API keys or external network reliability.
@@ -89,9 +93,11 @@ web-access doctor
 
 web-access config edit
 web-access --config "/path/to/config.json" config edit
+web-access config init
+web-access --config "/path/to/config.json" config init --json
 ```
 
-The CLI provides the `search` and `extract` capability commands, the `providers` and `doctor` diagnostic commands, and the `config edit` configuration command. The current version does not provide batch/all, answer, a dedicated PDF path, a Node.js SDK, or a generic MCP integration. The repository includes an optional [web-access-cli Agent Skill](skills/web-access-cli/SKILL.md) for source-checkout use; it is not included in the npm package.
+The CLI provides the `search` and `extract` capability commands, the `providers` and `doctor` diagnostic commands, and the `config init` and `config edit` configuration commands. The current version does not provide batch/all, answer, a dedicated PDF path, a Node.js SDK, or a generic MCP integration. The repository includes an optional [web-access-cli Agent Skill](skills/web-access-cli/SKILL.md) for source-checkout use; it is not included in the npm package.
 
 ### Global options
 
@@ -99,7 +105,7 @@ The CLI provides the `search` and `extract` capability commands, the `providers`
 - `--json`: Output a compact schema v2 JSON envelope. Without it, successful commands write human-readable Markdown; all failures always write JSON.
 - `--help`, `--version`: Print standard CLI help or version text.
 
-Successful commands default to Markdown for human readers. `search` writes a YAML front matter block followed by a numbered result list; `extract` writes YAML front matter followed by the normalized Markdown body; `providers`, `doctor`, and `config edit` write a heading followed by pretty-printed JSON data. Add `--json` when a schema v2 envelope is required. Extract `partial` results and all failures, including invalid input and runtime errors, always remain JSON envelopes. Diagnostic messages are never mixed into stdout.
+Successful commands default to Markdown for human readers. `search` writes a YAML front matter block followed by a numbered result list; `extract` writes YAML front matter followed by the normalized Markdown body; `providers`, `doctor`, and `config edit` write a heading followed by pretty-printed JSON data; `config init` writes the created absolute path on one line. Add `--json` when a schema v2 envelope is required. Extract `partial` results and all failures, including invalid input and runtime errors, always remain JSON envelopes. Diagnostic messages are never mixed into stdout.
 
 ## Configuration
 
@@ -109,13 +115,13 @@ The default path on every platform is `~/.config/web-access-cli/config.json`, wh
 
 `web-access config edit` creates parent directories and a complete default configuration when the file is missing, then opens it with the command in `VISUAL`, or `EDITOR` when `VISUAL` is empty. The value may contain a quoted executable path and arguments; it is parsed without shell evaluation and the configuration path is appended as a separate argument. An existing file is opened byte-for-byte as-is, even when it is temporarily invalid JSON; it is never overwritten or reformatted. The command waits only for the editor process to start, not for it to close. When neither variable is set, the command returns `open_failed`; a configuration file that was created successfully remains available for manual editing.
 
-`config edit` itself never rewrites existing content. After an `auto` capability call succeeds or encounters fallback-eligible failures, the CLI atomically updates `search._providers` or `extract._providers`. If the default configuration does not exist, the first `auto` call that produces a learning result creates the complete default configuration. `_providers` is CLI-managed and cannot enable an instance outside `providers`. Missing, malformed, duplicate, unknown, or membership-mismatched internal entries reset the whole capability to the declared route. Delete `_providers` to restore the user-declared initial order manually.
+`config init` creates a new configuration from standard credential environment variables and refuses to overwrite an existing file. It keeps all built-in instance definitions, writes detected Search providers to the primary route, leaves Search fallback empty, writes detected remote Extract providers to the primary route, and places `http` in the Extract fallback route. After an `auto` capability call succeeds or encounters fallback-eligible failures, the CLI atomically reorders the matching `providers` or `providers_fallback` array in place. Members never move between groups. The legacy `_providers` and `_providers_fallback` fields are rejected as unknown configuration fields.
 
 The complete JSON Schema is available at [schemas/config.schema.json](schemas/config.schema.json). Example:
 
 ```json
 {
-  "$schema": "https://unpkg.com/web-access-cli@0.4.0/schemas/config.schema.json",
+  "$schema": "https://unpkg.com/web-access-cli@0.6.0/schemas/config.schema.json",
   "providers": [
     {
       "id": "exa_team",
@@ -138,13 +144,15 @@ The complete JSON Schema is available at [schemas/config.schema.json](schemas/co
   ],
   "search": {
     "providers": ["searx_local", "exa_team", "brave"],
+    "providers_fallback": ["deepseek"],
     "limit": 5,
     "timeoutMs": 120000,
     "attemptTimeoutMs": 60000,
     "maxResponseBytes": 5242880
   },
   "extract": {
-    "providers": ["firecrawl_local", "jina", "exa_team", "http"],
+    "providers": ["firecrawl_local", "jina", "exa_team"],
+    "providers_fallback": ["http"],
     "timeoutMs": 120000,
     "attemptTimeoutMs": 45000,
     "maxResponseBytes": 5242880,
@@ -153,16 +161,20 @@ The complete JSON Schema is available at [schemas/config.schema.json](schemas/co
 }
 ```
 
-The built-in instances are `tavily`, `exa`, `bocha`, `brave`, `searxng`, `firecrawl`, `jina`, `http`, `anysearch`, `xcrawl`, `deepseek`, `xai_x_search`, and `xai_web_search`. A configuration entry with the same ID overrides fields on the built-in instance. A custom ID creates another instance of the selected type. An instance is enabled only when it appears in the corresponding `providers` route. Bocha defaults to `https://api.bocha.cn` and requires an API key; AnySearch defaults to `https://api.anysearch.com` and supports anonymous calls; XCrawl defaults to `https://run.xcrawl.com` and requires an API key; DeepSeek defaults to `https://api.deepseek.com/anthropic/v1` and requires an API key.
+The built-in instances are `tavily`, `exa`, `bocha`, `yuanbao`, `brave`, `searxng`, `firecrawl`, `jina`, `http`, `anysearch`, `xcrawl`, `deepseek`, `xai_x_search`, and `xai_web_search`. A configuration entry with the same ID overrides fields on the built-in instance. A custom ID creates another instance of the selected type. An instance is enabled when it appears in either corresponding route. Bocha defaults to `https://api.bocha.cn` and requires an API key; Yuanbao Search defaults to `https://api.wsa.cloud.tencent.com` and requires a service API key; AnySearch defaults to `https://api.anysearch.com` and supports anonymous calls; XCrawl defaults to `https://run.xcrawl.com` and requires an API key; DeepSeek defaults to `https://api.deepseek.com` and requires an API key.
 
 Default routes:
 
-- Search: `tavily -> exa -> bocha -> brave -> searxng -> anysearch -> xcrawl -> deepseek -> xai_web_search`
-- Extract: `firecrawl -> jina -> exa -> anysearch -> xcrawl -> http`
+- Search primary: `tavily -> exa -> bocha -> yuanbao -> brave -> searxng -> anysearch -> xcrawl -> deepseek`
+- Search fallback: `xai_x_search -> xai_web_search`
+- Extract primary: `firecrawl -> jina -> exa -> anysearch -> xcrawl -> deepseek`
+- Extract fallback: `http`
 
-The default routes include every built-in instance that supports the corresponding capability. Custom instance IDs are merged into the instance list but must still be added to routes explicitly. An omitted route uses the defaults above, while an explicit empty array disables that capability. In `auto` mode, incompletely configured instances are skipped; AnySearch can be called anonymously with its default base URL, while XCrawl and DeepSeek are skipped until their API keys are configured. AnySearch and XCrawl accept `searchFilterMode`: `strict` (default; freshness skips the provider) or `best_effort` (rewrites freshness into a query fragment). Domain constraints are rewritten into the query and strictly re-applied locally. XCrawl Extract always uses synchronous Scrape with Markdown output; Map, Crawl, and asynchronous jobs are outside the current CLI capabilities.
+The default routes split built-in providers into a primary group and a fallback group. Custom instance IDs are merged into the instance list but must still be added to a route explicitly. An omitted capability route uses the defaults above; an explicit Search primary empty array is invalid, while Extract may be explicitly disabled with an empty primary route. In `auto` mode, incompletely configured instances are skipped. AnySearch and XCrawl accept `searchFilterMode`: `strict` (default; freshness skips the provider) or `best_effort` (rewrites freshness into a query fragment). Domain constraints are rewritten into the query and strictly re-applied locally. XCrawl Extract always uses synchronous Scrape with Markdown output; Map, Crawl, and asynchronous jobs are outside the current CLI capabilities.
 
-DeepSeek Search performs a full Anthropic-compatible Messages model turn with the native `web_search_20250305` server tool, so it can have higher latency and cost than a dedicated search endpoint. It is last in the default route and is reached only after earlier providers are unavailable, return a final non-2xx HTTP response, or otherwise fail recoverably. The adapter accepts URLs only from structured `web_search_tool_result` blocks, joins citation excerpts by URL, and never extracts URLs from model prose. Domain constraints are rewritten into the query and strictly re-applied locally; `freshness` is unsupported and skips DeepSeek with a recoverable error. Redirects are rejected without contacting the `Location` target. Provider-private `encrypted_content` payloads are omitted from `raw` because they are opaque, cannot be displayed or decoded by the CLI, and add no diagnostic value.
+Yuanbao Search calls Tencent Cloud `POST /SearchPro` with a bearer service API key and a lower-case request body (`Query`, plus optional `Site` and `Freshness`). One `site:` include becomes `Site=<domain>`; up to five excludes become `Site=exclude:<domain>|<domain>`; other combinations are filtered locally only. Each entry of `Pages` is a JSON string and is mapped to `title`/`url`/`snippet`, preferring the standard `passage` summary over the dynamic `content`. Errors returned inside a successful HTTP response, such as `UnauthorizedOperation` or `ResourceNotFound`, stay fallback-eligible so `auto` can continue to the next provider. Only Search is supported; `Cnt` is omitted while `--limit` stays at or below 10 so the lite edition keeps working, and is rounded up to the next multiple of 10 (maximum 50) above that.
+
+DeepSeek uses the official tool API: Search posts to `{baseUrl}/v1/tools/search` and Fetch posts to `{baseUrl}/v1/tools/fetch`, both with a Bearer `DEEPSEEK_API_KEY`. Search sends `count` and `need_content: false` and maps `title`/`url`/`snippet` from `results`, falling back to the longer `summary` only when `snippet` is empty; the remaining fields stay in `raw`. `freshness` has no request field, so it is rewritten into the documented `after:` search syntax, and domain constraints use `site:`/`-site:`. Both are hints only and are strictly re-applied locally; if the combined query would exceed the 128-character limit, the remote hints are dropped and the original query kept. Fetch returns `content` as the Markdown body and `title` as the title; HTTP 404 or an empty body becomes fallback-eligible `no_usable_content`. 401 is `auth_error`, 402 is `quota_exceeded`, 429 is `rate_limited`, and other statuses are `provider_error`; 400/401/402/403 are not retryable against the same provider.
 
 XAI hosted Search reads an external OAuth JSON file from `XAI_AUTH_JSON` on every call and uses only its `access_token`; an external CLIProxyAPI process owns refresh and write-back. Instance fields `authJson`/`authJsonEnv` and `model`/`modelEnv` override the path and model. `xai_web_search` accepts at most five allow or exclude domains (mutually exclusive); `xai_x_search` rejects `freshness`. Model-backed search can take longer than ordinary API searches; Search defaults allow up to 60 seconds per attempt and 120 seconds total.
 
@@ -182,22 +194,24 @@ Environment variables take precedence over plaintext keys in JSON. Built-in inst
 | HTTP | None | None |
 | AnySearch | `ANYSEARCH_API_KEY`, optional | `ANYSEARCH_BASE_URL`, default `https://api.anysearch.com` |
 | XCrawl | `XCRAWL_API_KEY` | `XCRAWL_BASE_URL`, default `https://run.xcrawl.com` |
-| DeepSeek | `DEEPSEEK_API_KEY` | No standard environment variable; default `https://api.deepseek.com/anthropic/v1` |
+| DeepSeek | `DEEPSEEK_API_KEY` | No standard environment variable; default `https://api.deepseek.com` |
 | xAI Search | `XAI_AUTH_JSON` | No standard API-key variable; default `https://cli-chat-proxy.grok.com/v1`, model `grok-4.6` |
 
 Custom instances use `apiKeyEnv` and `baseUrlEnv` to name their environment variables. Every remote provider can define a `baseUrl` and additional `headers`. The public `api.firecrawl.dev` service requires a key; a self-hosted Firecrawl v2 instance can run without one.
 
 ## Execution and fallback
 
-`--provider auto` follows the effective `_providers` order, or starts from `providers` when the internal field is absent or invalid:
+`--provider auto` follows the configured `providers` order first and enters `providers_fallback` only after the complete primary group fails with a fallback-eligible result:
 
 1. An instance with incomplete configuration is recorded as a failed attempt and skipped.
 2. A final provider HTTP response outside 2xx, including authentication, request, rate-limit, and server errors, causes the router to try the next instance.
 3. Other recoverable errors, including network errors, timeouts, oversized responses, and missing usable content, also cause the router to continue.
 4. Non-recoverable failures without a final non-2xx response, including invalid input and unsupported content detected in a successful response, stop execution immediately.
-5. If every instance fails, the command returns `provider_exhausted`. The best short content produced during extraction is preserved in `partial`.
+5. If every instance in both groups fails, the command returns `provider_exhausted`. The best short content produced during extraction is preserved in `partial`.
+
+Before those routes run, `extract --provider auto` checks one Markdown variant when an HTTP instance is enabled in either group. It appends `.md` to file-like paths or uses `index.md` for directory paths, requests `text/markdown` and `text/plain`, and accepts only a sufficiently long non-HTML text response. A miss or request failure is transparent and falls through to the configured routes. A hit is reported as the enabled HTTP instance; it does not change provider order. Explicit non-HTTP selections are unchanged, while an explicit HTTP selection checks the Markdown variant before fetching the original URL.
 
-After each `auto` call, a successful instance moves to the front, untried instances remain in the middle, and instances with the fallback-eligible failures above move stably to the back. Relative order within each group is preserved. The order stays unchanged when every instance fails. Search and Extract learn independently; explicit instances, non-fallback failures, and user cancellation never update the order. Writes use atomic replacement, and the last writer wins across concurrent processes.
+After each `auto` call, a successful instance moves to the front of its group, untried instances remain in the middle, and instances with the fallback-eligible failures above move stably to the back. Relative order within each group is preserved; no provider crosses between primary and fallback. The order stays unchanged when every instance in a group fails. Search and Extract learn independently; explicit instances, non-fallback failures, and user cancellation never update the order. Writes use atomic replacement, and the last writer wins across concurrent processes.
 
 An attempt keeps the provider's original error code, HTTP status, and `retryable` value. `retryable` describes whether the original operation can be retried against the same provider; it is not the sole condition for switching to the next provider in an automatic route.
 
@@ -252,7 +266,58 @@ Exit codes:
 - `1`: Runtime, provider, doctor, or editor launch failure
 - `130`: User cancellation
 
-`providers` lists each instance's type, capabilities, route status, credential source, and base URL source. Its `searchRoute` and `extractRoute` fields show the effective order for the next `auto` call. `doctor` performs local configuration checks only and does not call remote APIs. If an enabled route contains an unconfigured instance, the command returns `doctor_failed` with exit code `1`.
+`providers` lists each instance's type, capabilities, route status, credential source, and base URL source. Its `searchRoute`/`searchFallbackRoute` and `extractRoute`/`extractFallbackRoute` fields show the two effective orders for the next `auto` call. `doctor` performs local configuration checks only and does not call remote APIs. If an enabled route contains an unconfigured instance, the command returns `doctor_failed` with exit code `1`.
+
+## DeepSeek-compatible HTTP gateway
+
+The repository also ships a **separate** HTTP service that wraps the same provider, route and transport implementations in the DeepSeek tool protocol. It is not a replacement for the CLI: commands, exit codes, the schema v2 envelope and the npm bin contract are unchanged.
+
+```sh
+# From source (listens on 127.0.0.1:8080 by default)
+WEB_ACCESS_CONFIG=~/.config/web-access-cli/config.json \
+WEB_ACCESS_GATEWAY_API_KEY_FILE=/path/to/gateway-api-key \
+pnpm start:gateway     # or node --import tsx src/server.ts
+
+# Built output
+node dist/server.js
+```
+
+| Method | Path | Notes |
+| --- | --- | --- |
+| `POST` | `/v1/tools/search` | DeepSeek Search compatible |
+| `POST` | `/v1/tools/fetch` | DeepSeek Fetch compatible |
+| `GET` | `/`, `/panel` | Request records panel (HTML, no data in the page itself) |
+| `GET` | `/admin/api/records` | Recent request records (requires the Bearer key) |
+| `GET` | `/healthz` | Process liveness, no authentication |
+| `GET` | `/readyz` | Configuration/lifecycle readiness, no authentication |
+
+The gateway reads its own Bearer key from a file only (`WEB_ACCESS_GATEWAY_API_KEY_FILE`), compares fixed-length digests with Node crypto, and rejects duplicate `Authorization` headers. Request bodies are counted as a stream with a 64 KiB cap and a 10-second read timeout; at most four tool requests may be in flight, and excess requests receive 429. Success and error responses use `Cache-Control: no-store`.
+
+Request fields match the official contract:
+
+| Field | Behavior |
+| --- | --- |
+| `query` | Required, 1–128 Unicode characters, not entirely whitespace; search operators are preserved |
+| `count` | Integer 1–50, default 10 |
+| `ori_question` | Optional or `null`; when non-null, 1–128 characters |
+| `localization` | Optional, default empty string; when non-empty it must be an IP address |
+| `need_content` | Optional, default `false`; must be a boolean |
+
+Fetch accepts only a non-empty absolute HTTP(S) URL of at most 8192 characters with a hostname and no userinfo. Unknown request fields are ignored and cannot select a provider, credential, timeout or configuration override.
+
+**Responses are protocol-compatible, not equivalent to the official search engine**: `summary` reuses `snippet`, `rerank_score` is always `0`, `authority` is always `-1`, and `site_name`/`site_icon`/`date` are always `null`. The placeholder score is **not** a DeepSeek quality score; clients filtering on `rerank_score >= 1.5` or `authority >= 3` must change strategy or they will drop every result. Result count, ranking and summary quality are not promised, and the gateway never paginates or merges providers to fill `count`.
+
+`ori_question` and `localization` are validated and accepted, but the neutral core has no equivalent capability, so they do not affect provider requests and are not folded into `query`.
+
+With `need_content=true`, content is backfilled in rank order with at most two concurrent tasks, a 30-second total window, 10 seconds per item, and a 3-second per-provider attempt cap. Failed, timed-out or over-limit content stays empty while the result is kept; one content value is capped at 256 KiB JSON-encoded UTF-8 and the complete response at 8 MiB, clearing content from the lowest ranks when needed. **Backfill spends extract provider quota.**
+
+The gateway derives its own config for Fetch and backfill with a 1-character minimum, so valid short pages succeed, while the source Markdown probe still requires at least 500 characters (or the original threshold, whichever is larger) so a short `Not found` page cannot win. Search and Fetch each use the configured total timeout; backfill has an independent 30-second window, and client disconnects cancel in-flight work.
+
+Errors are always `{ "error": { "message": "...", "type": "...", "param": null, "code": "..." } }`: 400 invalid input, 401 `invalid_api_key`, 402 insufficient quota, 404 no usable content or an unavailable direct target, 408 body read timeout, 413 body too large, 429 rate limited (with `Retry-After`), 504 upstream timeout, and 500 for credential/configuration failures, unknown failures or oversized output. Target-site 401/403 means Fetch is unavailable; cloud-provider 401/403 returns 500.
+
+The gateway never writes provider order and never modifies configuration: it uses the snapshot loaded at startup. Deployment, Docker Compose templates, secret mounts, diagnostics, upgrades and rollback are documented in [deploy/README.md](deploy/README.md); the architectural decision is in [docs/adr/0019-deepseek-tool-gateway.md](docs/adr/0019-deepseek-tool-gateway.md).
+
+Open the gateway root or `/panel` in a browser and enter the gateway key to inspect the last 500 tool requests (status, duration, error code, provider, query/URL and the first five result titles). Records are in memory only, are cleared on restart, and never contain response bodies, headers or credentials; unauthenticated requests are excluded. The panel HTML carries no data, and `/admin/api/records` uses the same Bearer key as the tool endpoints. A bookmark with an `#apikey=<key>` fragment logs in directly; the script strips it from the address bar immediately. Do not pass the key in a query string.
 
 ## HTTP and security boundaries
 
@@ -260,6 +325,7 @@ Exit codes:
 - Follows up to five redirects. Cross-origin redirects remove authentication, Cookie, and common token headers.
 - Enforces a streaming byte limit on every response instead of buffering an unbounded response first.
 - HTTP Extract uses LinkeDOM, Mozilla Readability, and Turndown, with fallback parsing for Next.js RSC payloads.
+- HTTP Extract prefers an enabled source Markdown variant (`.md` or directory `index.md`) before provider routes when that variant returns usable Markdown.
 - Returns `unsupported_content` for PDF, image, audio, video, zip, and general binary content.
 - By design, the CLI does not block localhost, private network addresses, or cloud metadata URLs. For untrusted input, callers must enforce their own URL allowlist, network isolation, or outbound proxy policy.
 

package/README_CN.md

@@ -5,7 +5,7 @@
 [![CI](https://github.com/Juexe/web-access-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/Juexe/web-access-cli/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
-一个 Agent-neutral 的网页能力 CLI。它把“搜索”和“网页正文提取”定义为稳定能力，把 Tavily、Exa、Bocha、Brave、SearXNG、AnySearch、XCrawl、DeepSeek、Firecrawl、Jina 等差异收敛到内部统一 schema。
+一个 Agent-neutral 的网页能力 CLI。它把“搜索”和“网页正文提取”定义为稳定能力，把 Tavily、Exa、Bocha、元宝搜索、Brave、SearXNG、AnySearch、XCrawl、DeepSeek、Firecrawl、Jina 等差异收敛到内部统一 schema。
 
 CLI 是主要产品形态，不绑定 Pi、Claude Code、Codex、Cursor、OpenCode 或其他 Agent。Skill、MCP 和 Agent 插件只能作为 CLI 上层 adapter 接入，不能污染核心能力和 Provider 实现。
 
@@ -13,10 +13,10 @@ CLI 是主要产品形态，不绑定 Pi、Claude Code、Codex、Cursor、OpenCo
 
 | 能力 | Provider Type | 统一输出 |
 | --- | --- | --- |
-| `search` | Tavily、Exa、Bocha、Brave、SearXNG、AnySearch、XCrawl、DeepSeek、xAI x_search、xAI web_search | `rank`、`title`、`url`、`snippet` |
-| `extract` | Firecrawl v2、Jina Reader、Exa Contents、AnySearch、XCrawl、HTTP | Markdown `Document` |
+| `search` | Tavily、Exa、Bocha、元宝搜索、Brave、SearXNG、AnySearch、XCrawl、DeepSeek、xAI x_search、xAI web_search | `rank`、`title`、`url`、`snippet` |
+| `extract` | Firecrawl v2、Jina Reader、Exa Contents、AnySearch、XCrawl、DeepSeek Fetch、HTTP | Markdown `Document` |
 
-Provider Type 描述实现类型；Provider Instance 是一份可配置实例。一个 Type 可以有多个 Instance，例如 `exa_team` 和 `exa_personal`。`providers` Route 是有序 Instance ID 数组，决定启用状态和 `auto` 的初始顺序；CLI 会把学习后的实际顺序保存在同级 `_providers`。
+Provider Type 描述实现类型；Provider Instance 是一份可配置实例。一个 Type 可以有多个 Instance，例如 `exa_team` 和 `exa_personal`。每个能力都有主 `providers` Route 和兜底 `providers_fallback` Route；两组数组同时决定启用状态和 `auto` 顺序，CLI 只在原分组内部调整成员顺序。
 
 ## 安装
 
@@ -50,12 +50,15 @@ pnpm pack:check
 
 ```text
 src/cli.ts                 Commander CLI 与退出码
+src/server.ts              DeepSeek 兼容网关的独立进程入口
 src/config/                配置文件、环境变量与 Route 合并
 src/core/                  公共类型、schema、错误、路由和诊断
+src/gateway/               网关协议 schema、服务映射与 HTTP 边界
 src/providers/             Provider adapter、registry、HTTP/RSC 提取
 src/transport/             代理、超时、重定向和响应大小限制
 schemas/                   构建生成的 JSON Schema
 test/                      node:test 单元测试与本地 HTTP 集成测试
+deploy/                    网关公开部署模板、配置示例与运维说明
 ```
 
 Provider adapter 应只负责协议映射；fallback、deadline、attempts、envelope 和退出码由 `src/core` 统一处理。不要在 adapter 中引入 Pi、Claude Code、Codex 或其他 Agent 的生命周期和工具注册代码。
@@ -69,6 +72,7 @@ pnpm typecheck
 pnpm test
 pnpm build
 pnpm pack:check
+pnpm test:docker
 ```
 
 `pnpm check` 会按上述顺序执行 lint、类型检查、测试和构建。修改 `src/core/schema.ts` 后必须重新运行 `pnpm build`，并提交更新后的 `schemas/*.schema.json`。Provider 测试应使用 `test/helpers.ts` 的 mock transport 或本地 HTTP server，不依赖真实 API key 和外网稳定性。
@@ -89,9 +93,11 @@ web-access doctor
 
 web-access config edit
 web-access --config "/path/to/config.json" config edit
+web-access config init
+web-access --config "/path/to/config.json" config init --json
 ```
 
-CLI 提供 `search`、`extract` 两个能力命令，`providers`、`doctor` 两个诊断命令，以及 `config edit` 配置维护命令。当前版本不提供 batch/all、answer、PDF 专线、Node SDK 或通用 MCP 集成。仓库提供可选的 [web-access-cli Agent Skill](skills/web-access-cli/SKILL.md)，仅供源码仓库使用，不包含在 npm 发布包中。
+CLI 提供 `search`、`extract` 两个能力命令，`providers`、`doctor` 两个诊断命令，以及 `config init`、`config edit` 配置维护命令。当前版本不提供 batch/all、answer、PDF 专线、Node SDK 或通用 MCP 集成。仓库提供可选的 [web-access-cli Agent Skill](skills/web-access-cli/SKILL.md)，仅供源码仓库使用，不包含在 npm 发布包中。
 
 ### 通用选项
 
@@ -99,7 +105,7 @@ CLI 提供 `search`、`extract` 两个能力命令，`providers`、`doctor` 两
 - `--json`：输出紧凑 schema v2 JSON envelope；不指定时，成功命令输出面向人的 Markdown，失败始终输出 JSON。
 - `--help`、`--version`：输出常规 CLI 帮助或版本文本。
 
-成功命令默认输出面向人的 Markdown。`search` 输出 YAML front matter 和编号结果列表；`extract` 输出 YAML front matter 和规范化后的 Markdown 正文；`providers`、`doctor` 和 `config edit` 输出标题和格式化 JSON 数据。需要 schema v2 envelope 时显式追加 `--json`。提取失败（包括 `partial`）以及所有失败路径始终输出 JSON envelope。诊断信息不会混入 stdout。
+成功命令默认输出面向人的 Markdown。`search` 输出 YAML front matter 和编号结果列表；`extract` 输出 YAML front matter 和规范化后的 Markdown 正文；`providers`、`doctor` 和 `config edit` 输出标题和格式化 JSON 数据；`config init` 输出新配置的绝对路径。需要 schema v2 envelope 时显式追加 `--json`。提取失败（包括 `partial`）以及所有失败路径始终输出 JSON envelope。诊断信息不会混入 stdout。
 
 ## 配置
 
@@ -109,13 +115,13 @@ CLI 提供 `search`、`extract` 两个能力命令，`providers`、`doctor` 两
 
 `web-access config edit` 会在配置文件缺失时创建父目录和完整默认配置，再优先使用 `VISUAL`、其次使用 `EDITOR` 打开；变量值可以包含带引号的可执行文件路径和参数，解析时不会执行 shell，并将配置路径作为独立的最后一个参数传入。已有文件会原样打开，即使内容暂时不是有效 JSON 也不会被覆盖或格式化。命令只等待编辑器进程启动，不等待编辑器关闭。两个变量都未设置、格式无效或启动失败时返回 `open_failed`；如果配置刚刚创建成功，文件仍会保留以便手动编辑。
 
-`config edit` 本身不会改写已有内容；能力命令使用 `auto` 成功或发生可回退失败后，会原子更新 `search._providers` 或 `extract._providers`。默认配置尚不存在时，首次产生学习结果的 `auto` 调用会创建完整默认配置。`_providers` 由 CLI 管理，不会启用 `providers` 之外的 Instance；其内容缺失、格式错误、重复、引用未知 ID 或与 `providers` 成员集合不一致时会整组重置。删除 `_providers` 可以手动恢复用户声明的初始顺序。
+`config init` 按标准凭据环境变量创建新配置，已存在文件时拒绝覆盖。它保留全部内置 Instance 定义，将检测到的 Search provider 写入主 Route，Search fallback 留空，将检测到的远程 Extract provider 写入主 Route，并把 `http` 放入 Extract fallback。能力命令使用 `auto` 成功或发生可回退失败后，会原子重排对应的 `providers` 或 `providers_fallback` 数组；成员不会跨组移动。旧的 `_providers` 和 `_providers_fallback` 字段会被严格配置校验拒绝。
 
 完整 JSON Schema 位于 [schemas/config.schema.json](schemas/config.schema.json)。示例：
 
 ```json
 {
-  "$schema": "https://unpkg.com/web-access-cli@0.4.0/schemas/config.schema.json",
+  "$schema": "https://unpkg.com/web-access-cli@0.6.0/schemas/config.schema.json",
   "providers": [
     {
       "id": "exa_team",
@@ -138,13 +144,15 @@ CLI 提供 `search`、`extract` 两个能力命令，`providers`、`doctor` 两
   ],
   "search": {
     "providers": ["searx_local", "exa_team", "brave"],
+    "providers_fallback": ["deepseek"],
     "limit": 5,
     "timeoutMs": 120000,
     "attemptTimeoutMs": 60000,
     "maxResponseBytes": 5242880
   },
   "extract": {
-    "providers": ["firecrawl_local", "jina", "exa_team", "http"],
+    "providers": ["firecrawl_local", "jina", "exa_team"],
+    "providers_fallback": ["http"],
     "timeoutMs": 120000,
     "attemptTimeoutMs": 45000,
     "maxResponseBytes": 5242880,
@@ -153,16 +161,20 @@ CLI 提供 `search`、`extract` 两个能力命令，`providers`、`doctor` 两
 }
 ```
 
-内置 Instance 为 `tavily`、`exa`、`bocha`、`brave`、`searxng`、`firecrawl`、`jina`、`http`、`anysearch`、`xcrawl`、`deepseek`、`xai_x_search`、`xai_web_search`。配置同 ID 时会覆盖内置实例的字段；自定义 ID 可以创建同 Type 的额外实例。只有出现在对应 `providers` Route 中的实例才启用。Bocha 默认 base URL 为 `https://api.bocha.cn`，必须配置 API key；AnySearch 默认 base URL 为 `https://api.anysearch.com`，支持匿名调用；XCrawl 默认 base URL 为 `https://run.xcrawl.com`，必须配置 API key；DeepSeek 默认 base URL 为 `https://api.deepseek.com/anthropic/v1`，必须配置 API key。
+内置 Instance 为 `tavily`、`exa`、`bocha`、`yuanbao`、`brave`、`searxng`、`firecrawl`、`jina`、`http`、`anysearch`、`xcrawl`、`deepseek`、`xai_x_search`、`xai_web_search`。配置同 ID 时会覆盖内置实例的字段；自定义 ID 可以创建同 Type 的额外实例。出现在对应主 Route 或 fallback Route 中的实例才启用。Bocha 默认 base URL 为 `https://api.bocha.cn`，必须配置 API key；元宝搜索默认 base URL 为 `https://api.wsa.cloud.tencent.com`，必须配置服务 API KEY；AnySearch 默认 base URL 为 `https://api.anysearch.com`，支持匿名调用；XCrawl 默认 base URL 为 `https://run.xcrawl.com`，必须配置 API key；DeepSeek 默认 base URL 为 `https://api.deepseek.com`，必须配置 API key。
 
 默认 Route：
 
-- Search：`tavily -> exa -> bocha -> brave -> searxng -> anysearch -> xcrawl -> deepseek -> xai_web_search`
-- Extract：`firecrawl -> jina -> exa -> anysearch -> xcrawl -> http`
+- Search 主轮：`tavily -> exa -> bocha -> yuanbao -> brave -> searxng -> anysearch -> xcrawl -> deepseek`
+- Search fallback：`xai_x_search -> xai_web_search`
+- Extract 主轮：`firecrawl -> jina -> exa -> anysearch -> xcrawl -> deepseek`
+- Extract fallback：`http`
 
-默认 Route 包含支持对应 Capability 的全部内置 Instance。自定义 ID 会合并到 Instance 列表，但仍需显式加入 Route；省略 Route 时使用上述默认值，显式空数组则禁用对应能力。`auto` 会跳过未完成配置的 Instance；AnySearch 使用默认 base URL 时可匿名调用，XCrawl 和 DeepSeek 则在配置 API key 前被跳过。AnySearch 与 XCrawl 可设置 `searchFilterMode`：`strict`（默认，遇到 freshness 时跳过）或 `best_effort`（将日期改写为查询片段）。域名条件会改写查询并在本地再次严格过滤。XCrawl Extract 固定使用同步 Scrape 的 Markdown 输出；Map、Crawl 和异步任务不属于当前 CLI 能力。
+默认 Route 将内置 provider 分为主轮和 fallback。自定义 ID 会合并到 Instance 列表，但仍需显式加入 Route；省略能力 Route 时使用上述默认分组，Search 主 Route 显式空数组会报错，Extract 主 Route 可以显式为空以禁用 Extract。`auto` 会跳过未完成配置的 Instance。AnySearch 与 XCrawl 可设置 `searchFilterMode`：`strict`（默认，遇到 freshness 时跳过）或 `best_effort`（将日期改写为查询片段）。域名条件会改写查询并在本地再次严格过滤。XCrawl Extract 固定使用同步 Scrape 的 Markdown 输出；Map、Crawl 和异步任务不属于当前 CLI 能力。
 
-DeepSeek Search 通过 Anthropic-compatible Messages API 调用原生 `web_search_20250305` server tool，一次搜索是完整模型轮次，因此延迟和成本可能高于专用搜索 endpoint。它位于默认 Route 末尾，仅在前序 Provider 未配置、返回最终非 2xx HTTP 响应或发生其他可恢复失败后触发。Adapter 只接受 `web_search_tool_result` 中的结构化 URL，按 URL 合并 citation 摘要，绝不从模型 prose 中猜测 URL。域名条件会改写查询并在本地再次严格过滤；DeepSeek 不支持 `freshness`，遇到该参数时以可恢复错误跳过；重定向会被严格拒绝，且不会访问 `Location` 目标。Provider 私有的 `encrypted_content` 是 CLI 无法展示或解码的 opaque payload，不具备诊断价值，因此会从 `raw` 中移除。
+元宝搜索调用腾讯云 `POST /SearchPro`，使用 Bearer 服务 API KEY 和小写驼峰请求体（`Query`，可选 `Site` 与 `Freshness`）。单个 `site:` 指定域名改写为 `Site=<domain>`，不超过五个排除域名改写为 `Site=exclude:<domain>|<domain>`，其余组合只在本地过滤。`Pages` 的每一项都是 JSON 字符串，映射为 `title`/`url`/`snippet`，摘要优先取标准摘要 `passage`，其次才是动态摘要 `content`。HTTP 200 中返回的 `UnauthorizedOperation`、`ResourceNotFound` 等业务错误保持可回退，`auto` 会继续尝试下一个 Provider。该 Provider 仅支持 Search；`--limit` 不超过 10 时不发送 `Cnt`，以免极速版拒绝请求，超出时按 10 向上取整发送（上限 50）。
+
+DeepSeek 使用官方工具 API：Search 请求 `{baseUrl}/v1/tools/search`，Fetch 请求 `{baseUrl}/v1/tools/fetch`，都以 Bearer 携带 `DEEPSEEK_API_KEY`。Search 发送 `count` 和 `need_content: false`，从 `results` 映射 `title`/`url`/`snippet`，仅在 `snippet` 为空时回退到更长的 `summary`，其余字段保留在 `raw`。官方 Search 没有 `freshness` 字段，因此改写为文档支持的 `after:` 搜索语法，域名条件使用 `site:`/`-site:`；两者都只是远端提示，结果仍在本地严格复核，拼接后超过 128 字符上限时丢弃远端提示并保留原始查询。Fetch 用 `content` 作为 Markdown 正文、`title` 作为标题；HTTP 404 或正文为空返回可回退的 `no_usable_content`。401 为 `auth_error`，402 为 `quota_exceeded`，429 为 `rate_limited`，其余状态为 `provider_error`；400/401/402/403 不会重试同一 Provider。
 
 XAI hosted Search 使用 `XAI_AUTH_JSON` 指向外部 OAuth JSON 文件，每次调用只读取 `access_token`，由外部 CLIProxyAPI 负责刷新和回写。可用 `authJson`/`authJsonEnv` 与 `model`/`modelEnv` 为实例覆盖路径和模型。`xai_web_search` 支持最多 5 个 allow 或 exclude 域名（两者不能同时使用）；`xai_x_search` 不接受 `freshness`。模型搜索可能需要更长时间；Search 默认单次超时 60 秒、总超时 120 秒。
 
@@ -182,22 +194,24 @@ XAI hosted Search 使用 `XAI_AUTH_JSON` 指向外部 OAuth JSON 文件，每次
 | HTTP | 无 | 无 |
 | AnySearch | `ANYSEARCH_API_KEY`，可选 | `ANYSEARCH_BASE_URL`，默认 `https://api.anysearch.com` |
 | XCrawl | `XCRAWL_API_KEY` | `XCRAWL_BASE_URL`，默认 `https://run.xcrawl.com` |
-| DeepSeek | `DEEPSEEK_API_KEY` | 无标准环境变量；默认 `https://api.deepseek.com/anthropic/v1` |
+| DeepSeek | `DEEPSEEK_API_KEY` | 无标准环境变量；默认 `https://api.deepseek.com` |
 | xAI Search | `XAI_AUTH_JSON` | 无标准环境变量；默认 `https://cli-chat-proxy.grok.com/v1`，模型 `grok-4.6` |
 
 自定义 Instance 使用 `apiKeyEnv` 和 `baseUrlEnv` 指定自己的环境变量。所有远端 Provider 都可以设置 `baseUrl` 和附加 `headers`。公共 `api.firecrawl.dev` 需要 key；自托管 Firecrawl v2 可以不设置 key。
 
 ## 执行与回退
 
-`--provider auto` 按 `_providers` 的有效顺序执行；字段不存在或无效时从 `providers` 开始：
+`--provider auto` 先按 `providers` 顺序执行；只有主轮全部失败且结果可回退时才进入 `providers_fallback`：
 
 1. 未完成配置的实例会记录为失败 attempt 并跳过。
 2. Provider 返回的最终 HTTP 响应不在 2xx 范围时，包括鉴权、请求、限流和服务器错误，Router 会尝试下一个实例。
 3. 网络错误、超时、响应过大、无可用正文等其他可恢复错误也会继续 Route。
 4. 没有最终非 2xx 响应的不可恢复错误，例如无效输入或在成功响应中检测到不支持的内容，会立即停止。
-5. 所有实例失败时返回 `provider_exhausted`。提取过程中产生的最佳短正文会保留在 `partial`。
+5. 两组实例全部失败时返回 `provider_exhausted`。提取过程中产生的最佳短正文会保留在 `partial`。
+
+执行这些 Route 前，`extract --provider auto` 会在任一组启用了 HTTP Instance 时先探测一个源站 Markdown 变体：文件型路径追加 `.md`，目录路径使用 `index.md`，请求 `text/markdown`/`text/plain`，只接受足够长且非 HTML 的文本响应。未命中或请求失败时不产生额外 attempt，并继续原有 Route；命中时结果归属已启用的 HTTP Instance，且不改变 Provider 顺序。显式非 HTTP 选择不变；显式 HTTP 会先探测 Markdown，未命中后再请求原 URL。
 
-每次 `auto` 调用完成后，成功 Instance 移到队头，未尝试 Instance 保持在中间，发生上述可回退失败的 Instance 稳定移到队尾；三组内部顺序不变。所有 Instance 都失败时顺序不变。Search 与 Extract 独立学习；显式 Instance、不可回退错误和用户取消不会更新顺序。写入采用原子替换，并发进程由最后写入者生效。
+每次 `auto` 调用完成后，成功 Instance 移到所在组队头，未尝试 Instance 保持在中间，发生上述可回退失败的 Instance 稳定移到所在组队尾；顺序学习不会跨组移动 provider。所有 Instance 都失败时顺序不变。Search 与 Extract 独立学习；显式 Instance、不可回退错误和用户取消不会更新顺序。写入采用原子替换，并发进程由最后写入者生效。
 
 Attempt 会保留 Provider 的原始错误码、HTTP status 和 `retryable` 值。`retryable` 表示原始操作是否适合对同一 Provider 重试，不再是自动 Route 切换到下一 Provider 的唯一条件。
 
@@ -252,7 +266,58 @@ title: "Example title"
 - `1`：运行时/provider/doctor/编辑器启动失败
 - `130`：用户取消
 
-`providers` 会列出每个 Instance 的 Type、能力、Route 启用状态、凭据来源和 base URL 来源；`searchRoute` 与 `extractRoute` 是下一次 `auto` 使用的有效顺序。`doctor` 只做本地配置检查，不主动调用远端 API；当已启用 Route 中存在未配置 Instance 时，命令返回 `doctor_failed` 和退出码 `1`。
+`providers` 会列出每个 Instance 的 Type、能力、Route 启用状态、凭据来源和 base URL 来源；`searchRoute`/`searchFallbackRoute` 与 `extractRoute`/`extractFallbackRoute` 是下一次 `auto` 使用的两组有效顺序。`doctor` 只做本地配置检查，不主动调用远端 API；当已启用 Route 中存在未配置 Instance 时，命令返回 `doctor_failed` 和退出码 `1`。
+
+## DeepSeek 兼容 HTTP 网关
+
+仓库另外提供一个**独立**的 HTTP 服务，把同样的 provider、路由和传输实现包装成 DeepSeek 工具协议。它不是 CLI 的替代品：CLI 的命令、退出码、schema v2 envelope 和 npm bin 契约都不变。
+
+```sh
+# 源码运行（默认监听 127.0.0.1:8080）
+WEB_ACCESS_CONFIG=~/.config/web-access-cli/config.json \
+WEB_ACCESS_GATEWAY_API_KEY_FILE=/path/to/gateway-api-key \
+pnpm start:gateway     # 或 node --import tsx src/server.ts
+
+# 构建后运行
+node dist/server.js
+```
+
+| 方法 | 路径 | 说明 |
+| --- | --- | --- |
+| `POST` | `/v1/tools/search` | DeepSeek Search 兼容 |
+| `POST` | `/v1/tools/fetch` | DeepSeek Fetch 兼容 |
+| `GET` | `/`、`/panel` | 请求记录面板（HTML，页面本身不含数据） |
+| `GET` | `/admin/api/records` | 最近请求记录（需要 Bearer Key） |
+| `GET` | `/healthz` | 进程存活，无需鉴权 |
+| `GET` | `/readyz` | 配置/生命周期就绪，无需鉴权 |
+
+网关只从文件读取独立的 Bearer Key（`WEB_ACCESS_GATEWAY_API_KEY_FILE`），使用 Node crypto 做定长摘要比较，并拒绝重复 `Authorization`。入站请求体按流计数，上限 64 KiB，读取超时 10 秒；全服务最多 4 个在途工具请求，满额返回 429。成功与错误都使用 `Cache-Control: no-store`。
+
+请求字段与官方一致：
+
+| 字段 | 行为 |
+| --- | --- |
+| `query` | 必填，1–128 个 Unicode 字符，不能全为空白；原样保留搜索语法 |
+| `count` | 1–50 的整数，缺省 10 |
+| `ori_question` | 可省略或 `null`；非 null 时 1–128 个字符 |
+| `localization` | 可省略，默认空字符串；非空必须是 IP 地址 |
+| `need_content` | 可省略，默认 `false`；必须是布尔值 |
+
+Fetch 只接受非空、最长 8192 字符、含 hostname、无 userinfo 的绝对 HTTP(S) URL。未知请求字段会被忽略，且无法通过未知字段指定 provider、凭据、timeout 或配置。
+
+**响应是协议兼容而非与官方搜索引擎等价**：`summary` 直接复制 `snippet`，`rerank_score` 恒为 `0`，`authority` 恒为 `-1`，`site_name`/`site_icon`/`date` 恒为 `null`。占位评分**不是** DeepSeek 的质量评分；依赖 `rerank_score >= 1.5` 或 `authority >= 3` 筛选的客户端必须调整策略，否则会过滤掉全部结果。网关不承诺结果数量、排序或摘要质量与官方一致，也不跨 provider 凑数或重新分页。
+
+`ori_question` 与 `localization` 本期接受并校验，但中立核心没有对应能力，因此不影响 provider 请求，也不会拼进 `query`。
+
+`need_content=true` 时为每条结果补抓正文：按排名顺序、最多两路并发、总预算 30 秒、单篇 10 秒、每次 provider 尝试 3 秒。失败、超时或超限的正文留空但结果保留；单篇正文最多 256 KiB（JSON 编码后），完整响应最多 8 MiB，超限时从低排名起清空 `content`。**补抓会消耗 extract 上游额度。**
+
+网关为 Fetch 与补抓派生自己的配置，正文最短阈值降为 1 个字符，因此有效短页面会成功；源站 `.md` 猜测仍要求至少 500 字符（或原配置阈值取大者），避免短小的 `Not found` 页面误命中。搜索和 Fetch 各用现有配置的总超时，补抓有独立的 30 秒窗口；客户端断开会取消在途工作。
+
+错误统一为 `{ "error": { "message": "...", "type": "...", "param": null, "code": "..." } }`：400 输入错误、401 `invalid_api_key`、402 额度不足、404 无可用正文或直连目标不可用、408 读取请求体超时、413 请求体过大、429 限流（带 `Retry-After`）、504 下游超时、500 凭据/配置/未知失败/输出超限。目标站点的 401/403 属于 Fetch 不可用；云 provider 的 401/403 返回 500。
+
+网关不写回 provider 顺序，也不修改配置：服务运行期间使用启动时加载的配置快照。部署方式、Docker Compose 模板、secret 挂载、诊断、升级与回滚见 [deploy/README.md](deploy/README.md)；架构决策见 [docs/adr/0019-deepseek-tool-gateway.md](docs/adr/0019-deepseek-tool-gateway.md)。
+
+浏览器打开网关根路径或 `/panel`，输入网关 Key 即可查看最近 500 条工具请求（状态、耗时、错误码、provider、query/URL 与前 5 条结果标题）。记录只保存在内存中，重启清空，不记录响应正文、header 或凭据；未鉴权请求不进入记录。面板 HTML 本身不含数据，`/admin/api/records` 复用同一个 Bearer Key。也可用 `#apikey=<key>` 片段直接打开，脚本读取后立即从地址栏移除；不要用查询串传递 Key。
 
 ## HTTP 与安全边界
 
@@ -260,6 +325,7 @@ title: "Example title"
 - 最多跟随 5 次重定向；跨 origin 重定向会移除鉴权、Cookie 和常见 token headers。
 - 所有响应都执行流式字节上限，避免先完整缓冲超大响应。
 - HTTP Extract 使用 LinkeDOM、Mozilla Readability、Turndown，并对 Next.js RSC payload 做后备解析。
+- HTTP Extract 在 route 已启用 HTTP Instance 时优先读取可用的源站 Markdown 变体（`.md` 或目录 `index.md`）。
 - PDF、图片、音频、视频、zip 和通用二进制内容会返回 `unsupported_content`。
 - 按项目设计，CLI 不阻止 localhost、私网地址或云元数据 URL。调用者必须在不可信输入场景中自行实施 URL allowlist、网络隔离或出站代理策略。
 

package/THIRD_PARTY_NOTICES.md

@@ -33,19 +33,6 @@
 
 Pi-specific 的工具注册、UI、Agent 生命周期与协议代码没有进入本项目。
 
-## DeepSeek Harness web-search-deepseek
-
-DeepSeek Search Provider 的 Anthropic-compatible Messages wire shape、结构化结果解析与 citation 映射参考并改写自：
-
-- 项目：`deepseek-harness`
-- 仓库：`https://github.com/deepseek-ai/deepseek-harness.git`
-- 上游路径：`packages/web/web-search-deepseek`
-- 参考提交：`99f6f02fecdb7dff40c3fbc9470f5907c29f74ca`
-- Copyright 2026 DeepSeek
-- 许可证：MIT（适用的许可文本与上文所列 MIT 文本相同）
-
-动态 Settings、Credential Service、Session event、LLM seam 和 Agent 集成代码没有进入本项目。
-
 ## Grok Build xAI Search
 
 The xAI hosted search request and response mapping is derived from the `grok-build` project:

package/dist/cli.js

@@ -5,6 +5,7 @@ import { Command, CommanderError, InvalidArgumentError, Option, } from "commande
 import { formatMarkdown } from "./cli-output.js";
 import { loadConfig } from "./config/config.js";
 import { executeConfigEdit } from "./config/edit.js";
+import { executeConfigInit } from "./config/init.js";
 import { createProviderOrderWriter } from "./config/provider-order.js";
 import { executeDoctor, executeProviders } from "./core/diagnostics.js";
 import { asWebAccessError, WebAccessError } from "./core/errors.js";
@@ -51,6 +52,13 @@ function writeEnvelope(envelope) {
     process.stdout.write(`${JSON.stringify(envelope)}\n`);
 }
 function writeOutput(envelope, mode) {
+    if (mode === "path" &&
+        envelope.ok &&
+        "command" in envelope &&
+        envelope.command === "config.init") {
+        process.stdout.write(`${envelope.data.path}\n`);
+        return;
+    }
     if (mode === "markdown" && envelope.ok) {
         process.stdout.write(formatMarkdown(envelope));
         return;
@@ -60,6 +68,7 @@ function writeOutput(envelope, mode) {
 export function createProgram(run, dependencies = {}) {
     const program = new Command();
     const runConfigEdit = dependencies.executeConfigEdit ?? executeConfigEdit;
+    const runConfigInit = dependencies.executeConfigInit ?? executeConfigInit;
     program
         .name("web-access")
         .description("Agent-neutral 的网页搜索与内容提取 CLI")
@@ -149,6 +158,14 @@ export function createProgram(run, dependencies = {}) {
         ? "json"
         : "markdown"));
     const config = program.command("config").description("管理配置文件");
+    config
+        .command("init")
+        .description("按当前标准凭据环境变量创建配置")
+        .option("--json", "输出 JSON envelope", false)
+        .action((options) => {
+        const globals = program.optsWithGlobals();
+        run(() => runConfigInit({ explicitPath: globals.config }), options.json || globals.json ? "json" : "path");
+    });
     config
         .command("edit")
         .description("创建默认配置文件并用 VISUAL 或 EDITOR 打开")

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACN,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,MAAM,GACN,MAAM,WAAW,CAAC;AACnB,OAAO,EAAsB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAQhF,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAWvC,SAAS,OAAO,CAAC,KAAa,EAAE,QAAkB;IACjD,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAC9C,MAAM,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC7B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACxD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB;IACzC,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAC1B,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClD,IACC;QACC,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,mBAAmB;KACnB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAE/B,OAAO,CAAC,CAAC;IACV,OAAO,CAAC,CAAC;AACV,CAAC;AAED,SAAS,aAAa,CAAC,QAAwB;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,QAAwB,EAAE,IAAmB;IACjE,IAAI,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,OAAO;IACR,CAAC;IACD,aAAa,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,GAGS,EACT,YAAY,GAAoB,EAAE;IAElC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,YAAY,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAC1E,OAAO;SACL,IAAI,CAAC,YAAY,CAAC;SAClB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,wBAAwB,EAAE,CAAC;IAC7B,OAAO,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,YAAY,EAAE,CAAC;IAEvB,OAAO;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,MAAM,CAAC;SACnB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;SAC5B,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,CAAC;SACpE,MAAM,CAAC,sBAAsB,EAAE,YAAY,EAAE,OAAO,CAAC;SACrD,SAAS,CACT,IAAI,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;QAClD,KAAK;QACL,OAAO;QACP,MAAM;KACN,CAAC,CACF;SACA,MAAM,CAAC,2BAA2B,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;SAC7D,MAAM,CAAC,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;SAC5D,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CACN,CACC,KAAa,EACb,OAQC,EACA,EAAE;QACH,GAAG,CACF,KAAK,IAAI,EAAE;YACV,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAiB,CAAC;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAkB;gBAC9B,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;gBACvD,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;gBACvD,SAAS,EAAE,OAAO,CAAC,OAAO;aAC1B,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,KAAK;gBACjB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,KAAK,GAAG,EAAE;gBACrB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;YAC5D,OAAO,aAAa,CAAC,OAAO,EAAE;gBAC7B,MAAM;gBACN,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC,EACD,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;YACjD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,UAAU,CACb,CAAC;IACH,CAAC,CACD,CAAC;IAEH,OAAO;SACL,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,wCAAwC,CAAC;SACrD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;SAChC,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,CAAC;SACpE,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CACN,CACC,GAAW,EACX,OAIC,EACA,EAAE;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAiB,CAAC;QAC9C,MAAM,UAAU,GACf,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QACpD,GAAG,CAAC,KAAK,IAAI,EAAE;YACd,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAmB;gBAC/B,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;gBACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACxC,SAAS,EAAE,OAAO,CAAC,OAAO;aAC1B,CAAC;YACF,OAAO,cAAc,CAAC,OAAO,EAAE;gBAC9B,MAAM;gBACN,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC,EAAE,UAAU,CAAC,CAAC;IAChB,CAAC,CACD,CAAC;IAEH,OAAO;SACL,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE,CACtC,GAAG,CACF,GAAG,EAAE,CACJ,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAiB,CAAC,MAAM,CAAC,CAAC,EACnE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;QACjD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CACb,CACD,CAAC;IAEH,OAAO;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE,CACtC,GAAG,CACF,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAiB,CAAC,MAAM,CAAC,CAAC,EACrE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;QACjD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CACb,CACD,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE,CACtC,GAAG,CACF,GAAG,EAAE,CACJ,aAAa,CAAC;QACb,YAAY,EAAE,OAAO,CAAC,IAAI,EAAiB,CAAC,MAAM;KAClD,CAAC,EACH,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;QACjD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CACb,CACD,CAAC;IAEH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAyB,CAAC;QAC/C,OAAO,MAAyB,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAA0B,CAAC;QACnD,CAAC,CAAE,OAA2B;QAC9B,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,eAAe,EAAE,CAAC;AAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;AAEpD,KAAK,UAAU,IAAI;IAClB,IAAI,OAA4C,CAAC;IACjD,IAAI,iBAAiB,GAAkB,MAAM,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,EAAE;QACrD,iBAAiB,GAAG,IAAI,CAAC;QACzB,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAC7B,IAAI,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAC7C,CAAC;QACF,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACR,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC/B,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACzC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,IACC,MAAM,YAAY,cAAc;YAChC,MAAM,CAAC,IAAI,KAAK,yBAAyB;YAEzC,OAAO;QACR,IAAI,MAAM,YAAY,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;YAC1E,OAAO;QACR,MAAM,UAAU,GACf,MAAM,YAAY,cAAc;YAC/B,CAAC,CAAC,IAAI,cAAc,CAClB,eAAe,EACf,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAC/D,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CACjB;YACF,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY,CAC3B,SAAiB,EACjB,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC;QACJ,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,IAAI,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACN,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,MAAM,GACN,MAAM,WAAW,CAAC;AACnB,OAAO,EAAsB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAQhF,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAYvC,SAAS,OAAO,CAAC,KAAa,EAAE,QAAkB;IACjD,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAC9C,MAAM,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC7B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACxD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB;IACzC,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAC1B,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClD,IACC;QACC,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,mBAAmB;KACnB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAE/B,OAAO,CAAC,CAAC;IACV,OAAO,CAAC,CAAC;AACV,CAAC;AAED,SAAS,aAAa,CAAC,QAAwB;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,QAAwB,EAAE,IAAmB;IACjE,IACC,IAAI,KAAK,MAAM;QACf,QAAQ,CAAC,EAAE;QACX,SAAS,IAAI,QAAQ;QACrB,QAAQ,CAAC,OAAO,KAAK,aAAa,EACjC,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAChD,OAAO;IACR,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,OAAO;IACR,CAAC;IACD,aAAa,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,GAGS,EACT,YAAY,GAAoB,EAAE;IAElC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,YAAY,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAC1E,MAAM,aAAa,GAAG,YAAY,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAC1E,OAAO;SACL,IAAI,CAAC,YAAY,CAAC;SAClB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,wBAAwB,EAAE,CAAC;IAC7B,OAAO,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,YAAY,EAAE,CAAC;IAEvB,OAAO;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,MAAM,CAAC;SACnB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;SAC5B,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,CAAC;SACpE,MAAM,CAAC,sBAAsB,EAAE,YAAY,EAAE,OAAO,CAAC;SACrD,SAAS,CACT,IAAI,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;QAClD,KAAK;QACL,OAAO;QACP,MAAM;KACN,CAAC,CACF;SACA,MAAM,CAAC,2BAA2B,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;SAC7D,MAAM,CAAC,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;SAC5D,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CACN,CACC,KAAa,EACb,OAQC,EACA,EAAE;QACH,GAAG,CACF,KAAK,IAAI,EAAE;YACV,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAiB,CAAC;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAkB;gBAC9B,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;gBACvD,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;gBACvD,SAAS,EAAE,OAAO,CAAC,OAAO;aAC1B,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,KAAK;gBACjB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,KAAK,GAAG,EAAE;gBACrB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;YAC5D,OAAO,aAAa,CAAC,OAAO,EAAE;gBAC7B,MAAM;gBACN,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC,EACD,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;YACjD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,UAAU,CACb,CAAC;IACH,CAAC,CACD,CAAC;IAEH,OAAO;SACL,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,wCAAwC,CAAC;SACrD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;SAChC,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,CAAC;SACpE,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CACN,CACC,GAAW,EACX,OAIC,EACA,EAAE;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAiB,CAAC;QAC9C,MAAM,UAAU,GACf,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QACpD,GAAG,CAAC,KAAK,IAAI,EAAE;YACd,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAmB;gBAC/B,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;gBACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACxC,SAAS,EAAE,OAAO,CAAC,OAAO;aAC1B,CAAC;YACF,OAAO,cAAc,CAAC,OAAO,EAAE;gBAC9B,MAAM;gBACN,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC,EAAE,UAAU,CAAC,CAAC;IAChB,CAAC,CACD,CAAC;IAEH,OAAO;SACL,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE,CACtC,GAAG,CACF,GAAG,EAAE,CACJ,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAiB,CAAC,MAAM,CAAC,CAAC,EACnE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;QACjD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CACb,CACD,CAAC;IAEH,OAAO;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE,CACtC,GAAG,CACF,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAiB,CAAC,MAAM,CAAC,CAAC,EACrE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;QACjD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CACb,CACD,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,iBAAiB,CAAC;SAC9B,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAAiB,CAAC;QACzD,GAAG,CACF,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EACrD,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IACJ,MAAM;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC;SAC3C,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE,CACtC,GAAG,CACF,GAAG,EAAE,CACJ,aAAa,CAAC;QACb,YAAY,EAAE,OAAO,CAAC,IAAI,EAAiB,CAAC,MAAM;KAClD,CAAC,EACH,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC,IAAI;QACjD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CACb,CACD,CAAC;IAEH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAyB,CAAC;QAC/C,OAAO,MAAyB,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAA0B,CAAC;QACnD,CAAC,CAAE,OAA2B;QAC9B,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,eAAe,EAAE,CAAC;AAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;AAEpD,KAAK,UAAU,IAAI;IAClB,IAAI,OAA4C,CAAC;IACjD,IAAI,iBAAiB,GAAkB,MAAM,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,EAAE;QACrD,iBAAiB,GAAG,IAAI,CAAC;QACzB,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAC7B,IAAI,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAC7C,CAAC;QACF,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACR,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC/B,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACzC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,IACC,MAAM,YAAY,cAAc;YAChC,MAAM,CAAC,IAAI,KAAK,yBAAyB;YAEzC,OAAO;QACR,IAAI,MAAM,YAAY,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;YAC1E,OAAO;QACR,MAAM,UAAU,GACf,MAAM,YAAY,cAAc;YAC/B,CAAC,CAAC,IAAI,cAAc,CAClB,eAAe,EACf,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAC/D,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CACjB;YACF,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY,CAC3B,SAAiB,EACjB,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC;QACJ,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,IAAI,EAAE,CAAC;AACd,CAAC"}