三个搜索 key 改为 auth.json 中的 tavily/exa/keenable api_key 凭据, pi-web-search/auth.ts 复刻上游 resolve-config-value 语义(!command、 $VAR 插值、credential env 优先、$$/$! 转义)并在每次调用时读取, 进程环境变量与 search.env 不再被直接读取。search_config.sh 重写为 scripts/search-auth.mjs 的薄封装:加锁原子写、权限 600、保留其他 凭据条目,支持 --migrate 从旧 search.env 一次性导入。 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
pi-web-search
Unified web search and fetch for Pi. The main model only ever sees two tools —
web_search and web_fetch — provider selection happens inside the extension.
web_search(query, max_results?, site?, published_after?, published_before?, depth?)routes each query to Tavily, Exa, or Keenable using the session's current main model (ctx.model+ctx.modelRegistry.complete), guided by per-provider rules. Results includedetails.provider/details.routedByfor debugging.web_fetch(urls, max_characters?)always reads pages via Exa (web_fetch_exa), degrading silently to Keenable then Tavily.
Providers (clients/)
Plain fetch calls — no MCP adapter, no upstream extension wrappers:
clients/tavily.ts—POST api.tavily.com/search|extract, Bearer key. Requires atavilycredential.clients/keenable.ts—api.keenable.ai, keyless/publicendpoints by default, akeenablecredential raises rate limits. Adapted from@keenable/pi-search.clients/exa.ts— JSON-RPC overmcp.exa.ai/mcp(Streamable HTTP):initializeonce, cachemcp-session-id,tools/callper request, re-init on session expiry. Anexacredential is optional (x-api-keyheader).
Keys live in Pi's auth.json as one api_key credential per provider
(tavily, exa, keenable), read by auth.ts with upstream resolution
semantics — literal values, $VAR/${VAR} interpolation, and !command
indirection (e.g. "!op read op://Vault/Tavily/key"). search_config.sh
writes them (atomically, mode 600, preserving all other entries); process
environment variables are not read directly — use "key": "$TAVILY_API_KEY"
to indirect through env. KEENABLE_API_URL stays env-only, or can be stored
in the keenable credential's env map.
Routing
router.ts asks the current model to answer with exactly one provider name,
given a prompt containing the per-provider strengths and the query's requested
filters. Decisions are cached per session (LRU, 32 entries). Failure paths are
deterministic: an unroutable answer or a dead provider falls back across the
remaining available providers — never a heuristic choice over the model.