From 99f73f35ca4293b6a03dacd9283a1ac2242e3d91 Mon Sep 17 00:00:00 2001
From: HpIahtcthocw <3154200873@qq.com>
Date: Fri, 23 Oct 2026 15:02:59 +0800
Subject: [PATCH 1/4] feat(cindy-web-search): add AnySearch search provider

Signed-off-by: HpIahtcthocw <3154200873@qq.com>
---
 .tests/cindy-web-search.test.mjs    | 202 +++++++++++++++++++++++++++-
 cindy-web-search/ghost.json         |  23 +++-
 cindy-web-search/locales/en.json    |   6 +-
 cindy-web-search/locales/ja.json    |   6 +-
 cindy-web-search/locales/ko.json    |   6 +-
 cindy-web-search/locales/zh-CN.json |   6 +-
 cindy-web-search/main.js            |  92 ++++++++++++-
 cindy-web-search/settings.html      |  21 +++
 cindy-web-search/settings.js        |   2 +-
 9 files changed, 339 insertions(+), 25 deletions(-)

diff --git a/.tests/cindy-web-search.test.mjs b/.tests/cindy-web-search.test.mjs
index 0c66a0f6..af7d2e74 100644
--- a/.tests/cindy-web-search.test.mjs
+++ b/.tests/cindy-web-search.test.mjs
@@ -183,15 +183,15 @@ function createSettingsHarness(options = {}) {
 }
 
 test('manifest declares Cindy Web Search and keeps BYO providers explicit', () => {
-  assert.equal(manifest.version, '1.4.0');
+  assert.equal(manifest.version, '1.5.0');
   assert.equal(manifest.minCindyVersion, '0.1.64');
   assert.equal(manifest.schemaVersion, 3);
   assert.deepEqual(manifest.cindy, { search: ['web'] });
   assert.equal(Object.hasOwn(manifest, 'slots'), false);
-  assert.deepEqual(manifest.network.hosts, ['api.search.brave.com', 'api.tavily.com', 'api.deepseek.com']);
+  assert.deepEqual(manifest.network.hosts, ['api.search.brave.com', 'api.tavily.com', 'api.deepseek.com', 'api.anysearch.com']);
   assert.deepEqual(manifest.setup, { requires: [] });
   const provider = manifest.tools[0].parameters.properties.provider;
-  assert.deepEqual(provider.enum, ['cindy', 'brave', 'tavily', 'deepseek']);
+  assert.deepEqual(provider.enum, ['cindy', 'brave', 'tavily', 'deepseek', 'anysearch']);
   assert.equal(provider.enum.includes('auto'), false);
   const query = manifest.tools[0].parameters.properties.query;
   assert.equal(query.maxLength, 2000);
@@ -631,3 +631,199 @@ test('settings load and persist DeepSeek as the BYO default without losing other
   assert.deepEqual(JSON.parse(write.init.body), original);
   assert.match(harness.status.textContent, /已保存/);
 });
+
+function anySearchResponse(results = []) {
+  return {
+    ok: true,
+    status: 200,
+    body: JSON.stringify({
+      code: 0,
+      message: 'success',
+      request_id: 'test-request-id',
+      data: { results, metadata: { total_results: results.length, search_time_ms: 12 } },
+    }),
+  };
+}
+
+function anySearchItem(overrides = {}) {
+  return {
+    title: 'Example page', url: 'https://example.test/page',
+    snippet: 'Short snippet', content: 'Cleaned content', ...overrides,
+  };
+}
+
+test('AnySearch posts a trimmed query with the shared 1–10 limit and maps snippet/content', async () => {
+  const harness = createHarness({
+    kvFetch: () => { throw new Error('explicit selection must not read preferences'); },
+    networkResult: () => anySearchResponse([
+      anySearchItem(), anySearchItem({ snippet: '', content: 'Content fallback' }),
+      anySearchItem({ title: 'Extra result' }),
+    ]),
+  });
+  const result = await harness.search({ provider: 'anysearch', query: '  Go 1.26 release notes  ', limit: 2 });
+  assert.equal(result.ok, true);
+  assert.equal(result.result.provider, 'anysearch');
+  assert.deepEqual(JSON.parse(JSON.stringify(result.result.results)), [
+    { title: 'Example page', url: 'https://example.test/page', snippet: 'Short snippet' },
+    { title: 'Example page', url: 'https://example.test/page', snippet: 'Content fallback' },
+  ]);
+  assert.equal(harness.networkCalls.length, 1);
+  assert.equal(harness.cindyRequests.length, 0);
+  assert.equal(harness.toolResults.length, 1);
+  const request = harness.networkCalls[0];
+  assert.equal(request.url, 'https://api.anysearch.com/v1/search');
+  assert.equal(request.method, 'POST');
+  assert.equal(request.callId, 'call-1');
+  assert.deepEqual(JSON.parse(JSON.stringify(request.headers)), { 'Content-Type': 'application/json' });
+  assert.deepEqual(JSON.parse(request.body), { query: 'Go 1.26 release notes', max_results: 2 });
+});
+
+test('AnySearch may be the BYO default while Cindy AI remains the initial default', async () => {
+  const configured = { cindyAiEnabled: false, byoDefaultProvider: 'anysearch' };
+  const harness = createHarness({ kv: configured, networkResult: () => anySearchResponse() });
+  const result = await harness.search();
+  assert.equal(result.ok, true);
+  assert.equal(result.result.provider, 'anysearch');
+  assert.equal(JSON.parse(harness.networkCalls[0].body).max_results, 5);
+  assert.equal(harness.cindyRequests.length, 0);
+
+  const enabled = createHarness({ kv: { ...configured, cindyAiEnabled: true } });
+  assert.equal((await enabled.search()).result.provider, 'cindy');
+  assert.equal(enabled.networkCalls.length, 0);
+});
+
+test('AnySearch limit respects the shared 1–10 result contract', async () => {
+  for (const [limit, count] of [[0, 1], [2.9, 2], [50, 10]]) {
+    const harness = createHarness({ networkResult: () => anySearchResponse() });
+    assert.equal((await harness.search({ provider: 'anysearch', limit })).ok, true);
+    assert.equal(JSON.parse(harness.networkCalls[0].body).max_results, count);
+  }
+});
+
+for (const [status, code, guidance] of [
+  [400, 'INVALID_INPUT', /查询/], [401, 'AUTH_REJECTED', /更新 Key/],
+  [402, 'QUOTA_EXHAUSTED', /Key/], [403, 'PERMISSION_DENIED', /授权/],
+  [415, 'INVALID_INPUT', /参数/], [429, 'RATE_LIMITED', /稍后重试/],
+  [500, 'UPSTREAM_UNAVAILABLE', /稍后重试/], [502, 'UPSTREAM_UNAVAILABLE', /稍后重试/],
+  [301, 'UPSTREAM_REJECTED', /权限/], [418, 'UPSTREAM_REJECTED', /权限/],
+]) {
+  test(`AnySearch HTTP ${status} gives actionable ${code} without retry, fallback or body disclosure`, async () => {
+    const harness = createHarness({ networkResult: () => ({ ok: true, status, body: 'upstream-private-detail' }) });
+    const result = await harness.search({ provider: 'anysearch' });
+    assert.equal(result.ok, false);
+    assert.equal(result.errorCode, code);
+    assert.match(result.message, guidance);
+    assert.doesNotMatch(result.message, /upstream-private-detail|HTTP|\b[345]\d\d\b/);
+    assert.equal(harness.networkCalls.length, 1);
+    assert.equal(harness.cindyRequests.length, 0);
+    assert.equal(harness.toolResults.length, 1);
+  });
+}
+
+test('AnySearch 402 with auto-generated credentials never leaks them to the user', async () => {
+  const harness = createHarness({
+    networkResult: () => ({
+      ok: true,
+      status: 402,
+      body: JSON.stringify({
+        code: -1,
+        message: 'Your account and API key have been automatically generated.\nusername=u123\npassword=p456\napi_key=as_sk_abcdef',
+        request_id: 'r1',
+      }),
+    }),
+  });
+  const result = await harness.search({ provider: 'anysearch' });
+  assert.equal(result.ok, false);
+  assert.equal(result.errorCode, 'QUOTA_EXHAUSTED');
+  assert.doesNotMatch(result.message, /u123|p456|as_sk_abcdef|username|password|api_key/);
+  assert.match(result.message, /Key/);
+});
+
+test('AnySearch preserves structured Host error codes with safe, actionable messages', async () => {
+  for (const [errorCode, guidance] of [
+    ['AUTH_REJECTED', /更新 Key/], ['PERMISSION_DENIED', /授权/],
+    ['QUOTA_EXHAUSTED', /Key/], ['RATE_LIMITED', /稍后重试/],
+    ['INVALID_INPUT', /查询/], ['UPSTREAM_UNAVAILABLE', /网络连接/],
+  ]) {
+    for (const throws of [false, true]) {
+      const harness = createHarness({ networkResult: () => {
+        if (throws) throw Object.assign(new Error('private-host-detail'), { errorCode });
+        return { ok: false, errorCode, message: 'private-host-detail' };
+      } });
+      const result = await harness.search({ provider: 'anysearch' });
+      assert.equal(result.errorCode, errorCode);
+      assert.match(result.message, guidance);
+      assert.doesNotMatch(result.message, /private-host-detail/);
+      assert.equal(harness.networkCalls.length, 1);
+      assert.equal(harness.cindyRequests.length, 0);
+      assert.equal(harness.toolResults.length, 1);
+    }
+  }
+});
+
+test('AnySearch handles legacy Host failures and exceptions without exposing diagnostics', async () => {
+  for (const failure of [null, { ok: false, message: 'private-host-detail' }, new Error('private-host-detail')]) {
+    const harness = createHarness({ networkResult: () => {
+      if (failure instanceof Error) throw failure;
+      return failure;
+    } });
+    const result = await harness.search({ provider: 'anysearch' });
+    assert.equal(result.ok, false);
+    assert.equal(result.errorCode, 'INTERNAL');
+    assert.match(result.message, /网络连接/);
+    assert.match(result.message, /AnySearch/);
+    assert.doesNotMatch(result.message, /private-host-detail/);
+    assert.equal(harness.networkCalls.length, 1);
+  }
+});
+
+test('AnySearch rejects malformed, truncated and non-zero-code responses instead of returning empty success', async () => {
+  const bodies = ['invalid-json', 'null', '{}',
+    JSON.stringify({ code: 0, data: {} }),
+    JSON.stringify({ code: 0, data: { results: {} } }),
+    JSON.stringify({ code: -1, message: 'Query is required.', data: { results: [] } }),
+    JSON.stringify({ code: 0, data: { results: [null] } }),
+    JSON.stringify({ code: 0, data: { results: [{ title: null, url: 'u' }] } }),
+    JSON.stringify({ code: 0, data: { results: [{ title: 't', url: 42 }] } }),
+    ' '.repeat(1000001), null,
+  ];
+  for (const response of [
+    ...bodies.map(body => ({ ok: true, status: 200, body })),
+    { ...anySearchResponse(), truncated: true },
+  ]) {
+    const harness = createHarness({ networkResult: () => response });
+    const result = await harness.search({ provider: 'anysearch' });
+    assert.equal(result.ok, false);
+    assert.equal(result.errorCode, 'RESPONSE_INVALID');
+    assert.equal(harness.networkCalls.length, 1);
+    assert.equal(harness.cindyRequests.length, 0);
+  }
+});
+
+test('AnySearch credentials are declared only for the API host and have a settings row', () => {
+  const secret = manifest.network.secrets.find(item => item.key === 'anysearch_api_key');
+  assert.deepEqual(secret.inject, {
+    header: 'Authorization', format: 'Bearer {value}', hosts: ['api.anysearch.com'],
+  });
+  assert.equal(secret.url, 'https://anysearch.com/console/api-keys');
+  assert.equal(manifest.network.hosts.includes('api.anysearch.com'), true);
+  assert.match(settingsHtml, /data-key="anysearch_api_key"/);
+  assert.match(settingsHtml, /href="https:\/\/anysearch\.com\/console\/api-keys"/);
+  assert.match(settingsHtml, /<option value="anysearch">AnySearch<\/option>/);
+  for (const locale of locales) {
+    assert.match(locale.description, /AnySearch/);
+    assert.match(locale.whenToUse, /AnySearch/);
+  }
+});
+
+test('settings load and persist AnySearch as the BYO default without losing other preferences', async () => {
+  const original = { cindyAiEnabled: false, byoDefaultProvider: 'anysearch', unrelated: 'keep' };
+  const harness = createSettingsHarness({ readKv: async () => ({ ok: true, json: async () => original }) });
+  await flushAsync();
+  assert.equal(harness.byoDefaultProvider.value, 'anysearch');
+  harness.byoDefaultProvider.emit('change');
+  await flushAsync();
+  const write = harness.fetchCalls.find(call => call.init.method === 'PUT');
+  assert.deepEqual(JSON.parse(write.init.body), original);
+  assert.match(harness.status.textContent, /已保存/);
+});
diff --git a/cindy-web-search/ghost.json b/cindy-web-search/ghost.json
index dd91f419..d110e5c5 100644
--- a/cindy-web-search/ghost.json
+++ b/cindy-web-search/ghost.json
@@ -2,9 +2,9 @@
   "schemaVersion": 3,
   "id": "cindy-web-search",
   "name": "Web Search",
-  "description": "Cindy 内置的网页搜索插件:默认使用 Cindy AI 搜索,也可用你自己的 Brave / Tavily / DeepSeek key 搜索公网。key 在主界面侧边栏「插件」→「Web Search」详情页填写,加密存本机、只注入声明域名的请求。",
-  "whenToUse": "需要搜索公网信息、查资料、找网页、看最新动态时找我(默认使用 Cindy AI 搜索,也可在主界面侧边栏「插件」→「Web Search」详情页配置 Brave、Tavily 或 DeepSeek key)。",
-  "version": "1.4.0",
+  "description": "Cindy 内置的网页搜索插件:默认使用 Cindy AI 搜索,也可用你自己的 Brave / Tavily / DeepSeek / AnySearch key 搜索公网。key 在主界面侧边栏「插件」→「Web Search」详情页填写,加密存本机、只注入声明域名的请求。AnySearch 可不填 key 匿名使用。",
+  "whenToUse": "需要搜索公网信息、查资料、找网页、看最新动态时找我(默认使用 Cindy AI 搜索,也可在主界面侧边栏「插件」→「Web Search」详情页配置 Brave、Tavily、DeepSeek 或 AnySearch key)。",
+  "version": "1.5.0",
   "minCindyVersion": "0.1.64",
   "locales": {
     "en": "locales/en.json",
@@ -21,7 +21,7 @@
     "search": ["web"]
   },
   "network": {
-    "hosts": ["api.search.brave.com", "api.tavily.com", "api.deepseek.com"],
+    "hosts": ["api.search.brave.com", "api.tavily.com", "api.deepseek.com", "api.anysearch.com"],
     "secrets": [
       {
         "key": "brave_api_key",
@@ -55,6 +55,17 @@
           "format": "Bearer {value}",
           "hosts": ["api.deepseek.com"]
         }
+      },
+      {
+        "key": "anysearch_api_key",
+        "label": "AnySearch API Key",
+        "hint": "可选,不填使用匿名额度(国内可访问、速率较低);as_sk_ 开头",
+        "url": "https://anysearch.com/console/api-keys",
+        "inject": {
+          "header": "Authorization",
+          "format": "Bearer {value}",
+          "hosts": ["api.anysearch.com"]
+        }
       }
     ]
   },
@@ -64,12 +75,12 @@
   "tools": [
     {
       "name": "search_web",
-      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary，按成功请求计费，不读取全文。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。",
+      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary；AnySearch 可不填 Key 使用匿名额度（国内可访问、速率较低），也可在插件详情页配置 AnySearch API Key，snippet 缺失时用 content 回退，不读取全文。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。",
       "parameters": {
         "type": "object",
         "properties": {
           "query": { "type": "string", "maxLength": 2000, "description": "搜索关键词(保留用户意图,不要扩写,最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符)" },
-          "provider": { "type": "string", "enum": ["cindy", "brave", "tavily", "deepseek"], "description": "指定搜索源;通常省略(默认使用 Cindy AI 搜索)" },
+          "provider": { "type": "string", "enum": ["cindy", "brave", "tavily", "deepseek", "anysearch"], "description": "指定搜索源;通常省略(默认使用 Cindy AI 搜索)" },
           "limit": { "type": "number", "description": "结果条数,默认 5,最大 10" }
         },
         "required": ["query"]
diff --git a/cindy-web-search/locales/en.json b/cindy-web-search/locales/en.json
index d893e4eb..51d6c244 100644
--- a/cindy-web-search/locales/en.json
+++ b/cindy-web-search/locales/en.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy's built-in web search plugin. It uses Cindy AI by default, or searches the public web with your own Brave, Tavily or DeepSeek API key. Keys are configured in the plugin details, encrypted locally, and injected only into requests to declared hosts.",
-  "whenToUse": "Use this plugin to search the public web, research a topic, find web pages, or check current information. Cindy AI is used by default; you can also configure a Brave, Tavily or DeepSeek key in the Web Search plugin details.",
+  "description": "Cindy's built-in web search plugin. It uses Cindy AI by default, or searches the public web with your own Brave, Tavily, DeepSeek or AnySearch API key. Keys are configured in the plugin details, encrypted locally, and injected only into requests to declared hosts. AnySearch works anonymously without a key.",
+  "whenToUse": "Use this plugin to search the public web, research a topic, find web pages, or check current information. Cindy AI is used by default; you can also configure a Brave, Tavily, DeepSeek or AnySearch key in the Web Search plugin details.",
   "tools": {
     "search_web": {
-      "description": "Search the public web; returns { provider, results: [{ title, url, snippet }] }. Default: Cindy AI; optional Brave, Tavily or DeepSeek. Queries: at most 2000 characters; DeepSeek: 128 Unicode characters, never truncated. DeepSeek prefers summary for snippets, bills successful requests and does not fetch full pages. No automatic retries or provider fallback. Failures preserve Host errorCode; relay message to the user and configure missing keys in plugin details."
+      "description": "Search the public web; returns { provider, results: [{ title, url, snippet }] }. Default: Cindy AI; optional Brave, Tavily, DeepSeek or AnySearch. Queries: at most 2000 characters; DeepSeek: 128 Unicode characters, never truncated. DeepSeek prefers summary for snippets, bills successful requests and does not fetch full pages. AnySearch works without a key (anonymous quota, accessible in mainland China, lower rate) or with an AnySearch API key configured in the plugin details; snippet falls back to content when missing. Failures preserve Host errorCode; relay message to the user and configure missing keys in plugin details. No automatic retries or provider fallback."
     }
   }
 }
diff --git a/cindy-web-search/locales/ja.json b/cindy-web-search/locales/ja.json
index 626acc2f..d021d38a 100644
--- a/cindy-web-search/locales/ja.json
+++ b/cindy-web-search/locales/ja.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy 内蔵のウェブ検索プラグインです。既定では Cindy AI を使い、自分の Brave、Tavily または DeepSeek API キーでも公開ウェブを検索できます。キーはプラグイン詳細で設定し、ローカルで暗号化され、宣言済みホストへのリクエストにだけ注入されます。",
-  "whenToUse": "公開ウェブの検索、調査、ウェブページの発見、最新情報の確認に使用します。既定では Cindy AI を使い、Web Search プラグイン詳細で Brave、Tavily または DeepSeek のキーも設定できます。",
+  "description": "Cindy 内蔵のウェブ検索プラグインです。既定では Cindy AI を使い、自分の Brave、Tavily、DeepSeek または AnySearch API キーでも公開ウェブを検索できます。キーはプラグイン詳細で設定し、ローカルで暗号化され、宣言済みホストへのリクエストにだけ注入されます。AnySearch はキーなしでも匿名で利用できます。",
+  "whenToUse": "公開ウェブの検索、調査、ウェブページの発見、最新情報の確認に使用します。既定では Cindy AI を使い、Web Search プラグイン詳細で Brave、Tavily、DeepSeek または AnySearch のキーも設定できます。",
   "tools": {
     "search_web": {
-      "description": "公開ウェブを検索し、{ provider, results: [{ title, url, snippet }] } を返します。既定は Cindy AI。Brave / Tavily / DeepSeek も選択できます。クエリは最大 2000 文字、DeepSeek は Unicode 128 文字（切り詰めなし）。DeepSeek の摘要は summary を優先し、成功したリクエストに課金され、ページ全文は取得しません。自動再試行や検索元の切り替えは行いません。失敗時はホストの errorCode を保持し、message をユーザーに伝えてください。キー未設定時はプラグイン詳細で設定します。"
+      "description": "公開ウェブを検索し、{ provider, results: [{ title, url, snippet }] } を返します。既定は Cindy AI。Brave / Tavily / DeepSeek / AnySearch も選択できます。クエリは最大 2000 文字、DeepSeek は Unicode 128 文字（切り詰めなし）。DeepSeek の摘要は summary を優先し、成功したリクエストに課金され、ページ全文は取得しません。AnySearch はキーなしの匿名利用（国内からアクセス可能、低レート）も、プラグイン詳細で設定した AnySearch API キーでも動作し、snippet が無い場合は content にフォールバックします。失敗時はホストの errorCode を保持し、message をユーザーに伝えてください。キー未設定時はプラグイン詳細で設定します。自動再試行や検索元の切り替えは行いません。"
     }
   }
 }
diff --git a/cindy-web-search/locales/ko.json b/cindy-web-search/locales/ko.json
index 9a630984..e811796c 100644
--- a/cindy-web-search/locales/ko.json
+++ b/cindy-web-search/locales/ko.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy에 내장된 웹 검색 플러그인입니다. 기본적으로 Cindy AI를 사용하며 사용자의 Brave, Tavily 또는 DeepSeek API 키로도 공개 웹을 검색할 수 있습니다. 키는 플러그인 상세 화면에서 설정하며 로컬에서 암호화되고 선언된 호스트 요청에만 주입됩니다.",
-  "whenToUse": "공개 웹 검색, 자료 조사, 웹페이지 찾기, 최신 정보 확인에 사용합니다. 기본적으로 Cindy AI를 사용하며 Web Search 플러그인 상세 화면에서 Brave, Tavily 또는 DeepSeek 키도 설정할 수 있습니다.",
+  "description": "Cindy에 내장된 웹 검색 플러그인입니다. 기본적으로 Cindy AI를 사용하며 사용자의 Brave, Tavily, DeepSeek 또는 AnySearch API 키로도 공개 웹을 검색할 수 있습니다. 키는 플러그인 상세 화면에서 설정하며 로컬에서 암호화되고 선언된 호스트 요청에만 주입됩니다. AnySearch는 키 없이도 익명으로 사용할 수 있습니다.",
+  "whenToUse": "공개 웹 검색, 자료 조사, 웹페이지 찾기, 최신 정보 확인에 사용합니다. 기본적으로 Cindy AI를 사용하며 Web Search 플러그인 상세 화면에서 Brave, Tavily, DeepSeek 또는 AnySearch 키도 설정할 수 있습니다.",
   "tools": {
     "search_web": {
-      "description": "공개 웹을 검색하고 { provider, results: [{ title, url, snippet }] }를 반환합니다. 기본값은 Cindy AI이며 Brave / Tavily / DeepSeek도 선택할 수 있습니다. 검색어는 최대 2000자, DeepSeek은 Unicode 128자이며 자르지 않습니다. DeepSeek 요약은 summary를 우선 사용하고 성공한 요청에 과금되며 페이지 전문은 가져오지 않습니다. 자동 재시도나 검색 공급자 전환은 없습니다. 실패 시 호스트의 errorCode를 유지하고 message를 사용자에게 전달하세요. 키가 없으면 플러그인 상세 화면에서 설정합니다."
+      "description": "공개 웹을 검색하고 { provider, results: [{ title, url, snippet }] }를 반환합니다. 기본값은 Cindy AI이며 Brave / Tavily / DeepSeek / AnySearch도 선택할 수 있습니다. 검색어는 최대 2000자, DeepSeek은 Unicode 128자이며 자르지 않습니다. DeepSeek 요약은 summary를 우선 사용하고 성공한 요청에 과금되며 페이지 전문은 가져오지 않습니다. AnySearch는 키 없이 익명 사용(국내 접근 가능, 낮은 속도) 또는 플러그인 상세 화면에서 설정한 AnySearch API 키로도 동작하며 snippet이 없으면 content로 대체합니다. 실패 시 호스트의 errorCode를 유지하고 message를 사용자에게 전달하세요. 키가 없으면 플러그인 상세 화면에서 설정합니다. 자동 재시도나 검색 공급자 전환은 없습니다."
     }
   }
 }
diff --git a/cindy-web-search/locales/zh-CN.json b/cindy-web-search/locales/zh-CN.json
index a62d67c4..486553e7 100644
--- a/cindy-web-search/locales/zh-CN.json
+++ b/cindy-web-search/locales/zh-CN.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy 内置的网页搜索插件：默认使用 Cindy AI 搜索，也可使用你自己的 Brave、Tavily 或 DeepSeek Key 搜索公网。Key 在插件详情页填写，在本机加密保存，并且只注入发往已声明域名的请求。",
-  "whenToUse": "需要搜索公网信息、查资料、找网页或查看最新动态时使用。默认使用 Cindy AI 搜索，也可在 Web Search 插件详情页配置 Brave、Tavily 或 DeepSeek Key。",
+  "description": "Cindy 内置的网页搜索插件：默认使用 Cindy AI 搜索，也可使用你自己的 Brave、Tavily、DeepSeek 或 AnySearch Key 搜索公网。Key 在插件详情页填写，在本机加密保存，并且只注入发往已声明域名的请求。AnySearch 可不填 Key 匿名使用。",
+  "whenToUse": "需要搜索公网信息、查资料、找网页或查看最新动态时使用。默认使用 Cindy AI 搜索，也可在 Web Search 插件详情页配置 Brave、Tavily、DeepSeek 或 AnySearch Key。",
   "tools": {
     "search_web": {
-      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary，按成功请求计费，不读取全文。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。"
+      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary，按成功请求计费，不读取全文；AnySearch 可不填 Key 使用匿名额度（国内可访问、速率较低），也可在插件详情页配置 AnySearch API Key，snippet 缺失时用 content 回退。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。"
     }
   }
 }
diff --git a/cindy-web-search/main.js b/cindy-web-search/main.js
index 53af7273..543f41cd 100644
--- a/cindy-web-search/main.js
+++ b/cindy-web-search/main.js
@@ -6,7 +6,9 @@
  *   使用 Cindy AI 额度；
  * - brave:network 槽 -> Brave，使用用户自己的 Brave Key；
  * - tavily:network 槽 -> Tavily，使用用户自己的 Tavily Key；
- * - deepseek:network 槽 -> DeepSeek Search API，使用用户自己的 DeepSeek Key。
+ * - deepseek:network 槽 -> DeepSeek Search API，使用用户自己的 DeepSeek Key；
+ * - anysearch:network 槽 -> AnySearch，Key 可选(匿名额度,国内可访问)，注入
+ *   Authorization:Bearer 时使用用户自己的 AnySearch Key。
  *
  * 未指定 Provider 时只读取普通偏好:
  * - cindyAiEnabled 缺省 true -> cindy；
@@ -19,6 +21,7 @@
 var BRAVE_URL = 'https://api.search.brave.com/res/v1/web/search';
 var TAVILY_URL = 'https://api.tavily.com/search';
 var DEEPSEEK_URL = 'https://api.deepseek.com/v1/tools/search';
+var ANYSEARCH_URL = 'https://api.anysearch.com/v1/search';
 
 function clampLimit(n) {
   var v = typeof n === 'number' && isFinite(n) ? Math.floor(n) : 5;
@@ -26,7 +29,7 @@ function clampLimit(n) {
 }
 
 function isByoProvider(value) {
-  return value === 'brave' || value === 'tavily' || value === 'deepseek';
+  return value === 'brave' || value === 'tavily' || value === 'deepseek' || value === 'anysearch';
 }
 
 async function readSearchPrefs() {
@@ -193,9 +196,92 @@ async function searchDeepSeek(query, limit, callId) {
   };
 }
 
+function anySearchFailure(errorCode) {
+  var messages = {
+    NOT_CONFIGURED: '请在「插件」→「Web Search」详情页配置 AnySearch API Key。',
+    AUTH_REJECTED: 'AnySearch API Key 无效，请在「插件」→「Web Search」详情页更新 Key。',
+    PERMISSION_DENIED: 'AnySearch 搜索请求未获授权，请检查 AnySearch 账号及接口权限。',
+    QUOTA_EXHAUSTED: 'AnySearch 搜索额度已用完，请在「插件」→「Web Search」详情页配置 AnySearch API Key 后重试。',
+    RATE_LIMITED: 'AnySearch 搜索请求过于频繁，请稍后重试。',
+    INVALID_INPUT: 'AnySearch 搜索参数无效，请缩短查询后重试。',
+    UPSTREAM_UNAVAILABLE: 'AnySearch 搜索服务暂时不可用，请检查网络连接后稍后重试。',
+    UPSTREAM_REJECTED: 'AnySearch 未接受搜索请求，请检查账号权限或更新 Web Search 插件后再试。',
+    RESPONSE_INVALID: 'AnySearch 返回的搜索结果格式无效或过大，请缩小结果条数后重试。',
+  };
+  var code = typeof errorCode === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(errorCode)
+    ? errorCode : 'INTERNAL';
+  return {
+    ok: false,
+    errorCode: code,
+    message: messages[code] || 'AnySearch 搜索请求未完成，请检查网络连接、Cindy 授权，并按需在「插件」→「Web Search」详情页配置 AnySearch API Key。',
+  };
+}
+
+/**
+ * AnySearch unified search. The API key is optional: without one the Host sends
+ * the request anonymously (国内可访问,速率受每日免费额度限制); with a configured
+ * key the Host injects Authorization: Bearer <key> for api.anysearch.com only.
+ * The 402 response body may contain auto-generated credentials, so it is never
+ * relayed to the model or the user.
+ */
+async function searchAnySearch(query, limit, callId) {
+  var r;
+  try {
+    r = await cindy.fetch({
+      url: ANYSEARCH_URL,
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ query: query, max_results: limit }),
+      callId: callId,
+    });
+  } catch (e) {
+    return anySearchFailure(e && e.errorCode);
+  }
+  if (!r || !r.ok) return anySearchFailure(r && r.errorCode);
+  if (r.status !== 200) {
+    var codes = {
+      400: 'INVALID_INPUT',
+      401: 'AUTH_REJECTED',
+      402: 'QUOTA_EXHAUSTED',
+      403: 'PERMISSION_DENIED',
+      415: 'INVALID_INPUT',
+      429: 'RATE_LIMITED',
+    };
+    return anySearchFailure(codes[r.status] || (r.status >= 500 && r.status <= 599
+      ? 'UPSTREAM_UNAVAILABLE' : 'UPSTREAM_REJECTED'));
+  }
+  // Do not parse truncated/oversized responses or pass upstream error bodies on.
+  if (r.truncated || typeof r.body !== 'string' || r.body.length > 1000000) {
+    return anySearchFailure('RESPONSE_INVALID');
+  }
+  var data;
+  try {
+    data = JSON.parse(r.body);
+  } catch (e) {
+    return anySearchFailure('RESPONSE_INVALID');
+  }
+  if (!data || typeof data.code !== 'number' || data.code !== 0 || !data.data
+    || !Array.isArray(data.data.results)) {
+    return anySearchFailure('RESPONSE_INVALID');
+  }
+  if (data.data.results.some(function (item) {
+    return !item || typeof item.title !== 'string' || typeof item.url !== 'string'
+      || !(typeof item.snippet === 'string' || typeof item.content === 'string'
+        || item.snippet === undefined && item.content === undefined);
+  })) return anySearchFailure('RESPONSE_INVALID');
+  return {
+    ok: true,
+    provider: 'anysearch',
+    results: data.data.results.slice(0, limit).map(function (item) {
+      return { title: item.title, url: item.url, snippet: item.snippet || item.content || '' };
+    }),
+  };
+}
+
 function searchByo(provider, query, limit, callId) {
   if (provider === 'deepseek') return searchDeepSeek(query, limit, callId);
   if (provider === 'tavily') return searchTavily(query, limit);
+  if (provider === 'anysearch') return searchAnySearch(query, limit, callId);
   return searchBrave(query, limit);
 }
 
@@ -207,7 +293,7 @@ async function searchWeb(args, callId, callerTool) {
   var provider = args && args.provider;
 
   if (provider !== undefined && provider !== 'cindy' && !isByoProvider(provider)) {
-    return { ok: false, message: 'provider 只支持 cindy / brave / tavily / deepseek' };
+    return { ok: false, message: 'provider 只支持 cindy / brave / tavily / deepseek / anysearch' };
   }
   if (provider === 'cindy') return searchCindy(query, limit, callId, callerTool);
   if (isByoProvider(provider)) return searchByo(provider, query, limit, callId);
diff --git a/cindy-web-search/settings.html b/cindy-web-search/settings.html
index 6a41ed12..69e5affd 100644
--- a/cindy-web-search/settings.html
+++ b/cindy-web-search/settings.html
@@ -129,6 +129,7 @@
         <option value="brave">Brave</option>
         <option value="tavily">Tavily</option>
         <option value="deepseek">DeepSeek</option>
+        <option value="anysearch">AnySearch</option>
       </select>
     </div>
   </section>
@@ -191,6 +192,26 @@
     <a class="console-link" href="https://platform.deepseek.com/api_keys">前往控制台获取 ↗</a>
   </div>
 
+  <div class="secret" data-key="anysearch_api_key" data-tail-prefix="as_sk…" data-empty-ph="粘贴 as_sk 开头的 key">
+    <div class="label-row">
+      <span class="name">AnySearch API Key</span>
+      <span class="badge">✓ 已保存</span>
+    </div>
+    <p class="hint">可选项：不填也能匿名搜索（国内可访问，受每日免费额度限制）；填入 as_sk_ 开头的 Key 后按你的账号额度计费。</p>
+    <div class="input-row">
+      <div class="pill">
+        <input class="key-input" type="password" autocomplete="off" spellcheck="false">
+        <button class="icon-btn eye hidden" type="button" title="显示或隐藏">
+          <svg class="on" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7-10-7-10-7Z"/><circle cx="12" cy="12" r="3"/></svg>
+          <svg class="off" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.9 4.24A9.12 9.12 0 0 1 12 4c6.5 0 10 7 10 7a13.16 13.16 0 0 1-1.67 2.68"/><path d="M6.61 6.61A13.526 13.526 0 0 0 2 12s3.5 7 10 7a9.74 9.74 0 0 0 5.39-1.61"/><line x1="2" y1="2" x2="22" y2="22"/></svg>
+        </button>
+      </div>
+      <button class="btn save" type="button">保存</button>
+      <button class="btn clear" type="button">清除</button>
+    </div>
+    <a class="console-link" href="https://anysearch.com/console/api-keys">前往控制台获取 ↗</a>
+  </div>
+
   <p id="status"></p>
 
   <script src="/settings.js"></script>
diff --git a/cindy-web-search/settings.js b/cindy-web-search/settings.js
index 2a7de5d7..0b21db5a 100644
--- a/cindy-web-search/settings.js
+++ b/cindy-web-search/settings.js
@@ -35,7 +35,7 @@
   }
 
   function isByoProvider(value) {
-    return value === 'brave' || value === 'tavily' || value === 'deepseek';
+    return value === 'brave' || value === 'tavily' || value === 'deepseek' || value === 'anysearch';
   }
 
   function normalizePreferences(kv) {

From e9485ad6c0f3a19b72cf33251611f810a3a7952b Mon Sep 17 00:00:00 2001
From: HpIahtcthocw <3154200873@qq.com>
Date: Fri, 23 Oct 2026 15:09:50 +0800
Subject: [PATCH 2/4] fix(cindy-web-search): gate anonymous AnySearch on
 explicit user opt-in

Signed-off-by: HpIahtcthocw <3154200873@qq.com>
---
 .tests/cindy-web-search.test.mjs | 69 +++++++++++++++++++++++++++++---
 cindy-web-search/main.js         | 40 ++++++++++++++++--
 2 files changed, 100 insertions(+), 9 deletions(-)

diff --git a/.tests/cindy-web-search.test.mjs b/.tests/cindy-web-search.test.mjs
index af7d2e74..3bc06a27 100644
--- a/.tests/cindy-web-search.test.mjs
+++ b/.tests/cindy-web-search.test.mjs
@@ -73,6 +73,14 @@ function createHarness(options = {}) {
     cindy,
     fetch: async (url, init) => {
       if (options.kvFetch) return options.kvFetch(url, init);
+      if (url === '/secrets') {
+        return {
+          ok: true,
+          async json() {
+            return options.secrets ?? [];
+          },
+        };
+      }
       assert.equal(url, '/kv');
       return {
         ok: true,
@@ -654,7 +662,7 @@ function anySearchItem(overrides = {}) {
 
 test('AnySearch posts a trimmed query with the shared 1–10 limit and maps snippet/content', async () => {
   const harness = createHarness({
-    kvFetch: () => { throw new Error('explicit selection must not read preferences'); },
+    kv: { byoDefaultProvider: 'anysearch' },
     networkResult: () => anySearchResponse([
       anySearchItem(), anySearchItem({ snippet: '', content: 'Content fallback' }),
       anySearchItem({ title: 'Extra result' }),
@@ -694,7 +702,7 @@ test('AnySearch may be the BYO default while Cindy AI remains the initial defaul
 
 test('AnySearch limit respects the shared 1–10 result contract', async () => {
   for (const [limit, count] of [[0, 1], [2.9, 2], [50, 10]]) {
-    const harness = createHarness({ networkResult: () => anySearchResponse() });
+    const harness = createHarness({ kv: { byoDefaultProvider: 'anysearch' }, networkResult: () => anySearchResponse() });
     assert.equal((await harness.search({ provider: 'anysearch', limit })).ok, true);
     assert.equal(JSON.parse(harness.networkCalls[0].body).max_results, count);
   }
@@ -708,7 +716,7 @@ for (const [status, code, guidance] of [
   [301, 'UPSTREAM_REJECTED', /权限/], [418, 'UPSTREAM_REJECTED', /权限/],
 ]) {
   test(`AnySearch HTTP ${status} gives actionable ${code} without retry, fallback or body disclosure`, async () => {
-    const harness = createHarness({ networkResult: () => ({ ok: true, status, body: 'upstream-private-detail' }) });
+    const harness = createHarness({ kv: { byoDefaultProvider: 'anysearch' }, networkResult: () => ({ ok: true, status, body: 'upstream-private-detail' }) });
     const result = await harness.search({ provider: 'anysearch' });
     assert.equal(result.ok, false);
     assert.equal(result.errorCode, code);
@@ -722,6 +730,7 @@ for (const [status, code, guidance] of [
 
 test('AnySearch 402 with auto-generated credentials never leaks them to the user', async () => {
   const harness = createHarness({
+    kv: { byoDefaultProvider: 'anysearch' },
     networkResult: () => ({
       ok: true,
       status: 402,
@@ -746,7 +755,7 @@ test('AnySearch preserves structured Host error codes with safe, actionable mess
     ['INVALID_INPUT', /查询/], ['UPSTREAM_UNAVAILABLE', /网络连接/],
   ]) {
     for (const throws of [false, true]) {
-      const harness = createHarness({ networkResult: () => {
+      const harness = createHarness({ kv: { byoDefaultProvider: 'anysearch' }, networkResult: () => {
         if (throws) throw Object.assign(new Error('private-host-detail'), { errorCode });
         return { ok: false, errorCode, message: 'private-host-detail' };
       } });
@@ -763,7 +772,7 @@ test('AnySearch preserves structured Host error codes with safe, actionable mess
 
 test('AnySearch handles legacy Host failures and exceptions without exposing diagnostics', async () => {
   for (const failure of [null, { ok: false, message: 'private-host-detail' }, new Error('private-host-detail')]) {
-    const harness = createHarness({ networkResult: () => {
+    const harness = createHarness({ kv: { byoDefaultProvider: 'anysearch' }, networkResult: () => {
       if (failure instanceof Error) throw failure;
       return failure;
     } });
@@ -791,7 +800,7 @@ test('AnySearch rejects malformed, truncated and non-zero-code responses instead
     ...bodies.map(body => ({ ok: true, status: 200, body })),
     { ...anySearchResponse(), truncated: true },
   ]) {
-    const harness = createHarness({ networkResult: () => response });
+    const harness = createHarness({ kv: { byoDefaultProvider: 'anysearch' }, networkResult: () => response });
     const result = await harness.search({ provider: 'anysearch' });
     assert.equal(result.ok, false);
     assert.equal(result.errorCode, 'RESPONSE_INVALID');
@@ -827,3 +836,51 @@ test('settings load and persist AnySearch as the BYO default without losing othe
   assert.deepEqual(JSON.parse(write.init.body), original);
   assert.match(harness.status.textContent, /已保存/);
 });
+
+test('AnySearch anonymous calls fail closed with NOT_CONFIGURED until the user opts in', async () => {
+  // No AnySearch preference, no saved key -> no network request at all.
+  const neverOptedIn = createHarness({ kv: {}, networkResult: () => anySearchResponse() });
+  const blocked = await neverOptedIn.search({ provider: 'anysearch' });
+  assert.equal(blocked.ok, false);
+  assert.equal(blocked.errorCode, 'NOT_CONFIGURED');
+  assert.match(blocked.message, /AnySearch/);
+  assert.equal(neverOptedIn.networkCalls.length, 0);
+  assert.equal(neverOptedIn.cindyRequests.length, 0);
+  assert.equal(neverOptedIn.toolResults.length, 1);
+
+  // Explicit provider still requires the same opt-in.
+  const stillBlocked = createHarness({ kv: { cindyAiEnabled: true }, networkResult: () => anySearchResponse() });
+  const blockedAgain = await stillBlocked.search({ provider: 'anysearch' });
+  assert.equal(blockedAgain.ok, false);
+  assert.equal(blockedAgain.errorCode, 'NOT_CONFIGURED');
+  assert.equal(stillBlocked.networkCalls.length, 0);
+
+  // Saving an AnySearch API Key opts the user in even without the preference.
+  const keyOnly = createHarness({
+    kv: {},
+    secrets: [{ key: 'anysearch_api_key', saved: true, tail: 'abcd' }],
+    networkResult: () => anySearchResponse(),
+  });
+  const keyResult = await keyOnly.search({ provider: 'anysearch' });
+  assert.equal(keyResult.ok, true);
+  assert.equal(keyResult.result.provider, 'anysearch');
+  assert.equal(keyOnly.networkCalls.length, 1);
+
+  // An unrelated saved key does not opt in.
+  const unrelatedKey = createHarness({
+    kv: {},
+    secrets: [{ key: 'tavily_api_key', saved: true }],
+    networkResult: () => anySearchResponse(),
+  });
+  const unrelatedResult = await unrelatedKey.search({ provider: 'anysearch' });
+  assert.equal(unrelatedResult.ok, false);
+  assert.equal(unrelatedResult.errorCode, 'NOT_CONFIGURED');
+  assert.equal(unrelatedKey.networkCalls.length, 0);
+
+  // Preference read failures fail closed.
+  const unreadable = createHarness({ kvFetch: async () => { throw new Error('kv unavailable'); } });
+  const unreadableResult = await unreadable.search({ provider: 'anysearch' });
+  assert.equal(unreadableResult.ok, false);
+  assert.equal(unreadableResult.errorCode, 'NOT_CONFIGURED');
+  assert.equal(unreadable.networkCalls.length, 0);
+});
diff --git a/cindy-web-search/main.js b/cindy-web-search/main.js
index 543f41cd..cef2570a 100644
--- a/cindy-web-search/main.js
+++ b/cindy-web-search/main.js
@@ -198,7 +198,7 @@ async function searchDeepSeek(query, limit, callId) {
 
 function anySearchFailure(errorCode) {
   var messages = {
-    NOT_CONFIGURED: '请在「插件」→「Web Search」详情页配置 AnySearch API Key。',
+    NOT_CONFIGURED: '请先在「插件」→「Web Search」详情页选择 AnySearch 作为自备搜索渠道，或配置 AnySearch API Key，然后重试。',
     AUTH_REJECTED: 'AnySearch API Key 无效，请在「插件」→「Web Search」详情页更新 Key。',
     PERMISSION_DENIED: 'AnySearch 搜索请求未获授权，请检查 AnySearch 账号及接口权限。',
     QUOTA_EXHAUSTED: 'AnySearch 搜索额度已用完，请在「插件」→「Web Search」详情页配置 AnySearch API Key 后重试。',
@@ -217,14 +217,48 @@ function anySearchFailure(errorCode) {
   };
 }
 
+/**
+ * AnySearch is a keyless provider, so an anonymous call would send the user's
+ * query to api.anysearch.com even if they never opted in. Gate anonymous usage
+ * on an explicit user choice: the user selected AnySearch as their BYO default
+ * in settings, or saved an AnySearch API Key. Otherwise fail closed like the
+ * other providers (NOT_CONFIGURED).
+ */
+async function anySearchConfigured() {
+  try {
+    var kvResponse = await fetch('/kv');
+    if (kvResponse.ok) {
+      var kv = await kvResponse.json();
+      if (kv && typeof kv === 'object' && !Array.isArray(kv)
+        && kv.byoDefaultProvider === 'anysearch') return true;
+    }
+  } catch (e) {
+    // fall through to the secrets check
+  }
+  try {
+    var secretsResponse = await fetch('/secrets');
+    if (secretsResponse.ok) {
+      var secrets = await secretsResponse.json();
+      if (Array.isArray(secrets) && secrets.some(function (s) {
+        return s && s.key === 'anysearch_api_key' && s.saved;
+      })) return true;
+    }
+  } catch (e) {
+    // fail closed below
+  }
+  return false;
+}
+
 /**
  * AnySearch unified search. The API key is optional: without one the Host sends
  * the request anonymously (国内可访问,速率受每日免费额度限制); with a configured
  * key the Host injects Authorization: Bearer <key> for api.anysearch.com only.
- * The 402 response body may contain auto-generated credentials, so it is never
- * relayed to the model or the user.
+ * Anonymous calls are only allowed after the user explicitly opted in (see
+ * anySearchConfigured). The 402 response body may contain auto-generated
+ * credentials, so it is never relayed to the model or the user.
  */
 async function searchAnySearch(query, limit, callId) {
+  if (!(await anySearchConfigured())) return anySearchFailure('NOT_CONFIGURED');
   var r;
   try {
     r = await cindy.fetch({

From 3063b9696cab53b171ccdbee9fdc4cd7a9c09267 Mon Sep 17 00:00:00 2001
From: HpIahtcthocw <3154200873@qq.com>
Date: Fri, 23 Oct 2026 15:16:55 +0800
Subject: [PATCH 3/4] docs(cindy-web-search): explain AnySearch anonymous
 opt-in in descriptions and settings

Signed-off-by: HpIahtcthocw <3154200873@qq.com>
---
 cindy-web-search/ghost.json         | 4 ++--
 cindy-web-search/locales/en.json    | 4 ++--
 cindy-web-search/locales/ja.json    | 4 ++--
 cindy-web-search/locales/ko.json    | 4 ++--
 cindy-web-search/locales/zh-CN.json | 4 ++--
 cindy-web-search/settings.html      | 2 +-
 6 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/cindy-web-search/ghost.json b/cindy-web-search/ghost.json
index d110e5c5..be1492a1 100644
--- a/cindy-web-search/ghost.json
+++ b/cindy-web-search/ghost.json
@@ -59,7 +59,7 @@
       {
         "key": "anysearch_api_key",
         "label": "AnySearch API Key",
-        "hint": "可选,不填使用匿名额度(国内可访问、速率较低);as_sk_ 开头",
+        "hint": "可选。免 Key 匿名搜索需先在上方「自备搜索渠道」选择 AnySearch，或填写本 Key（as_sk_ 开头）按账号额度计费",
         "url": "https://anysearch.com/console/api-keys",
         "inject": {
           "header": "Authorization",
@@ -75,7 +75,7 @@
   "tools": [
     {
       "name": "search_web",
-      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary；AnySearch 可不填 Key 使用匿名额度（国内可访问、速率较低），也可在插件详情页配置 AnySearch API Key，snippet 缺失时用 content 回退，不读取全文。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。",
+      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary；AnySearch 可免 Key 匿名搜索（国内可访问、速率较低），但需先在「插件」→「Web Search」详情页把 AnySearch 设为自备搜索渠道（关闭 Cindy AI 后生效）或填写 AnySearch API Key，否则返回 NOT_CONFIGURED；snippet 缺失时用 content 回退，不读取全文。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。",
       "parameters": {
         "type": "object",
         "properties": {
diff --git a/cindy-web-search/locales/en.json b/cindy-web-search/locales/en.json
index 51d6c244..6038d1a6 100644
--- a/cindy-web-search/locales/en.json
+++ b/cindy-web-search/locales/en.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy's built-in web search plugin. It uses Cindy AI by default, or searches the public web with your own Brave, Tavily, DeepSeek or AnySearch API key. Keys are configured in the plugin details, encrypted locally, and injected only into requests to declared hosts. AnySearch works anonymously without a key.",
+  "description": "Cindy's built-in web search plugin: Cindy AI by default, or your own Brave / Tavily / DeepSeek / AnySearch API key. Keys are configured in the plugin details, encrypted locally, injected only to declared hosts. AnySearch works keyless; opt in in the plugin details first.",
   "whenToUse": "Use this plugin to search the public web, research a topic, find web pages, or check current information. Cindy AI is used by default; you can also configure a Brave, Tavily, DeepSeek or AnySearch key in the Web Search plugin details.",
   "tools": {
     "search_web": {
-      "description": "Search the public web; returns { provider, results: [{ title, url, snippet }] }. Default: Cindy AI; optional Brave, Tavily, DeepSeek or AnySearch. Queries: at most 2000 characters; DeepSeek: 128 Unicode characters, never truncated. DeepSeek prefers summary for snippets, bills successful requests and does not fetch full pages. AnySearch works without a key (anonymous quota, accessible in mainland China, lower rate) or with an AnySearch API key configured in the plugin details; snippet falls back to content when missing. Failures preserve Host errorCode; relay message to the user and configure missing keys in plugin details. No automatic retries or provider fallback."
+      "description": "Search the public web; returns { provider, results: [{ title, url, snippet }] }. Default: Cindy AI; optional Brave, Tavily, DeepSeek or AnySearch. Queries: at most 2000 characters; DeepSeek: 128 Unicode characters, never truncated. DeepSeek prefers summary for snippets, bills successful requests and does not fetch full pages. AnySearch works without a key (anonymous quota, accessible in mainland China, lower rate) or with an AnySearch API key; anonymous usage requires opting in first by selecting AnySearch as the BYO provider or saving a key in the plugin details, otherwise NOT_CONFIGURED is returned; snippet falls back to content when missing. Failures preserve Host errorCode; relay message to the user and configure missing keys in plugin details. No automatic retries or provider fallback."
     }
   }
 }
diff --git a/cindy-web-search/locales/ja.json b/cindy-web-search/locales/ja.json
index d021d38a..dcdaf878 100644
--- a/cindy-web-search/locales/ja.json
+++ b/cindy-web-search/locales/ja.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy 内蔵のウェブ検索プラグインです。既定では Cindy AI を使い、自分の Brave、Tavily、DeepSeek または AnySearch API キーでも公開ウェブを検索できます。キーはプラグイン詳細で設定し、ローカルで暗号化され、宣言済みホストへのリクエストにだけ注入されます。AnySearch はキーなしでも匿名で利用できます。",
+  "description": "Cindy 内蔵のウェブ検索プラグインです。既定では Cindy AI を使い、自分の Brave、Tavily、DeepSeek または AnySearch API キーでも公開ウェブを検索できます。キーはプラグイン詳細で設定し、ローカルで暗号化され、宣言済みホストへのリクエストにだけ注入されます。AnySearch はキーなしの匿名利用に対応しています（プラグイン詳細で AnySearch を BYO プロバイダーに選択するか、キーを保存して事前にオプトインしてください）。",
   "whenToUse": "公開ウェブの検索、調査、ウェブページの発見、最新情報の確認に使用します。既定では Cindy AI を使い、Web Search プラグイン詳細で Brave、Tavily、DeepSeek または AnySearch のキーも設定できます。",
   "tools": {
     "search_web": {
-      "description": "公開ウェブを検索し、{ provider, results: [{ title, url, snippet }] } を返します。既定は Cindy AI。Brave / Tavily / DeepSeek / AnySearch も選択できます。クエリは最大 2000 文字、DeepSeek は Unicode 128 文字（切り詰めなし）。DeepSeek の摘要は summary を優先し、成功したリクエストに課金され、ページ全文は取得しません。AnySearch はキーなしの匿名利用（国内からアクセス可能、低レート）も、プラグイン詳細で設定した AnySearch API キーでも動作し、snippet が無い場合は content にフォールバックします。失敗時はホストの errorCode を保持し、message をユーザーに伝えてください。キー未設定時はプラグイン詳細で設定します。自動再試行や検索元の切り替えは行いません。"
+      "description": "公開ウェブを検索し、{ provider, results: [{ title, url, snippet }] } を返します。既定は Cindy AI。Brave / Tavily / DeepSeek / AnySearch も選択できます。クエリは最大 2000 文字、DeepSeek は Unicode 128 文字（切り詰めなし）。DeepSeek の摘要は summary を優先し、成功したリクエストに課金され、ページ全文は取得しません。AnySearch はキーなしの匿名利用（国内からアクセス可能、低レート）または AnySearch API キーで動作しますが、匿名利用はプラグイン詳細で AnySearch を BYO プロバイダーに選択するかキーを保存して事前にオプトインする必要があり、未設定の場合は NOT_CONFIGURED を返します。snippet が無い場合は content にフォールバックします。失敗時はホストの errorCode を保持し、message をユーザーに伝えてください。キー未設定時はプラグイン詳細で設定します。自動再試行や検索元の切り替えは行いません。"
     }
   }
 }
diff --git a/cindy-web-search/locales/ko.json b/cindy-web-search/locales/ko.json
index e811796c..f960e659 100644
--- a/cindy-web-search/locales/ko.json
+++ b/cindy-web-search/locales/ko.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy에 내장된 웹 검색 플러그인입니다. 기본적으로 Cindy AI를 사용하며 사용자의 Brave, Tavily, DeepSeek 또는 AnySearch API 키로도 공개 웹을 검색할 수 있습니다. 키는 플러그인 상세 화면에서 설정하며 로컬에서 암호화되고 선언된 호스트 요청에만 주입됩니다. AnySearch는 키 없이도 익명으로 사용할 수 있습니다.",
+  "description": "Cindy에 내장된 웹 검색 플러그인입니다. 기본적으로 Cindy AI를 사용하며 사용자의 Brave, Tavily, DeepSeek 또는 AnySearch API 키로도 공개 웹을 검색할 수 있습니다. 키는 플러그인 상세 화면에서 설정하며 로컬에서 암호화되고 선언된 호스트 요청에만 주입됩니다. AnySearch는 키 없이도 익명으로 사용할 수 있습니다(플러그인 상세 화면에서 AnySearch를 BYO 공급자로 선택하거나 키를 저장하여 사전 동의해야 합니다).",
   "whenToUse": "공개 웹 검색, 자료 조사, 웹페이지 찾기, 최신 정보 확인에 사용합니다. 기본적으로 Cindy AI를 사용하며 Web Search 플러그인 상세 화면에서 Brave, Tavily, DeepSeek 또는 AnySearch 키도 설정할 수 있습니다.",
   "tools": {
     "search_web": {
-      "description": "공개 웹을 검색하고 { provider, results: [{ title, url, snippet }] }를 반환합니다. 기본값은 Cindy AI이며 Brave / Tavily / DeepSeek / AnySearch도 선택할 수 있습니다. 검색어는 최대 2000자, DeepSeek은 Unicode 128자이며 자르지 않습니다. DeepSeek 요약은 summary를 우선 사용하고 성공한 요청에 과금되며 페이지 전문은 가져오지 않습니다. AnySearch는 키 없이 익명 사용(국내 접근 가능, 낮은 속도) 또는 플러그인 상세 화면에서 설정한 AnySearch API 키로도 동작하며 snippet이 없으면 content로 대체합니다. 실패 시 호스트의 errorCode를 유지하고 message를 사용자에게 전달하세요. 키가 없으면 플러그인 상세 화면에서 설정합니다. 자동 재시도나 검색 공급자 전환은 없습니다."
+      "description": "공개 웹을 검색하고 { provider, results: [{ title, url, snippet }] }를 반환합니다. 기본값은 Cindy AI이며 Brave / Tavily / DeepSeek / AnySearch도 선택할 수 있습니다. 검색어는 최대 2000자, DeepSeek은 Unicode 128자이며 자르지 않습니다. DeepSeek 요약은 summary를 우선 사용하고 성공한 요청에 과금되며 페이지 전문은 가져오지 않습니다. AnySearch는 키 없이 익명 사용(국내 접근 가능, 낮은 속도) 또는 AnySearch API 키로도 동작하지만, 익명 사용은 플러그인 상세 화면에서 AnySearch를 BYO 공급자로 선택하거나 키를 저장해 사전 동의해야 하며, 미설정 시 NOT_CONFIGURED를 반환합니다. snippet이 없으면 content로 대체합니다. 실패 시 호스트의 errorCode를 유지하고 message를 사용자에게 전달하세요. 키가 없으면 플러그인 상세 화면에서 설정합니다. 자동 재시도나 검색 공급자 전환은 없습니다."
     }
   }
 }
diff --git a/cindy-web-search/locales/zh-CN.json b/cindy-web-search/locales/zh-CN.json
index 486553e7..16911bdf 100644
--- a/cindy-web-search/locales/zh-CN.json
+++ b/cindy-web-search/locales/zh-CN.json
@@ -1,10 +1,10 @@
 {
   "name": "Web Search",
-  "description": "Cindy 内置的网页搜索插件：默认使用 Cindy AI 搜索，也可使用你自己的 Brave、Tavily、DeepSeek 或 AnySearch Key 搜索公网。Key 在插件详情页填写，在本机加密保存，并且只注入发往已声明域名的请求。AnySearch 可不填 Key 匿名使用。",
+  "description": "Cindy 内置的网页搜索插件：默认使用 Cindy AI 搜索，也可使用你自己的 Brave、Tavily、DeepSeek 或 AnySearch Key 搜索公网。Key 在插件详情页填写，在本机加密保存，并且只注入发往已声明域名的请求。AnySearch 支持免 Key 匿名使用（需先在插件详情页选择 AnySearch 为自备搜索渠道，或填写 Key）。",
   "whenToUse": "需要搜索公网信息、查资料、找网页或查看最新动态时使用。默认使用 Cindy AI 搜索，也可在 Web Search 插件详情页配置 Brave、Tavily、DeepSeek 或 AnySearch Key。",
   "tools": {
     "search_web": {
-      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary，按成功请求计费，不读取全文；AnySearch 可不填 Key 使用匿名额度（国内可访问、速率较低），也可在插件详情页配置 AnySearch API Key，snippet 缺失时用 content 回退。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。"
+      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary，按成功请求计费，不读取全文；AnySearch 可免 Key 匿名搜索（国内可访问、速率较低），但需先在插件详情页把 AnySearch 设为自备搜索渠道（关闭 Cindy AI 后生效）或填写 AnySearch API Key，否则返回 NOT_CONFIGURED；snippet 缺失时用 content 回退。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。"
     }
   }
 }
diff --git a/cindy-web-search/settings.html b/cindy-web-search/settings.html
index 69e5affd..abe263bb 100644
--- a/cindy-web-search/settings.html
+++ b/cindy-web-search/settings.html
@@ -197,7 +197,7 @@
       <span class="name">AnySearch API Key</span>
       <span class="badge">✓ 已保存</span>
     </div>
-    <p class="hint">可选项：不填也能匿名搜索（国内可访问，受每日免费额度限制）；填入 as_sk_ 开头的 Key 后按你的账号额度计费。</p>
+    <p class="hint">可选项：免 Key 匿名搜索需先在上方「自备搜索渠道」中选择 AnySearch，或直接填写本 Key；填入 as_sk_ 开头的 Key 后按你的账号额度计费。</p>
     <div class="input-row">
       <div class="pill">
         <input class="key-input" type="password" autocomplete="off" spellcheck="false">

From 6bad15d18762ffbfa5acd2dc9844c32c42afddef Mon Sep 17 00:00:00 2001
From: HpIahtcthocw <3154200873@qq.com>
Date: Fri, 23 Oct 2026 15:25:13 +0800
Subject: [PATCH 4/4] fix(cindy-web-search): coerce non-string snippets,
 restore DeepSeek billing note

Signed-off-by: HpIahtcthocw <3154200873@qq.com>
---
 .tests/cindy-web-search.test.mjs | 19 +++++++++++++++++++
 cindy-web-search/ghost.json      |  2 +-
 cindy-web-search/main.js         | 10 ++++++----
 3 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/.tests/cindy-web-search.test.mjs b/.tests/cindy-web-search.test.mjs
index 3bc06a27..bd01055b 100644
--- a/.tests/cindy-web-search.test.mjs
+++ b/.tests/cindy-web-search.test.mjs
@@ -809,6 +809,25 @@ test('AnySearch rejects malformed, truncated and non-zero-code responses instead
   }
 });
 
+test('AnySearch coerces non-string snippet/content instead of returning objects', async () => {
+  const harness = createHarness({
+    kv: { byoDefaultProvider: 'anysearch' },
+    networkResult: () => anySearchResponse([
+      anySearchItem({ snippet: {}, content: 'text' }),
+      anySearchItem({ snippet: 'ok', content: 42 }),
+      anySearchItem({ snippet: null, content: '' }),
+    ]),
+  });
+  const result = await harness.search({ provider: 'anysearch', limit: 3 });
+  assert.equal(result.ok, true);
+  assert.deepEqual(JSON.parse(JSON.stringify(result.result.results)), [
+    { title: 'Example page', url: 'https://example.test/page', snippet: 'text' },
+    { title: 'Example page', url: 'https://example.test/page', snippet: 'ok' },
+    { title: 'Example page', url: 'https://example.test/page', snippet: '' },
+  ]);
+  assert.equal(harness.networkCalls.length, 1);
+});
+
 test('AnySearch credentials are declared only for the API host and have a settings row', () => {
   const secret = manifest.network.secrets.find(item => item.key === 'anysearch_api_key');
   assert.deepEqual(secret.inject, {
diff --git a/cindy-web-search/ghost.json b/cindy-web-search/ghost.json
index be1492a1..e9b037a8 100644
--- a/cindy-web-search/ghost.json
+++ b/cindy-web-search/ghost.json
@@ -75,7 +75,7 @@
   "tools": [
     {
       "name": "search_web",
-      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary；AnySearch 可免 Key 匿名搜索（国内可访问、速率较低），但需先在「插件」→「Web Search」详情页把 AnySearch 设为自备搜索渠道（关闭 Cindy AI 后生效）或填写 AnySearch API Key，否则返回 NOT_CONFIGURED；snippet 缺失时用 content 回退，不读取全文。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。",
+      "description": "搜索公网，返回 { provider, results: [{ title, url, snippet }] }。默认 Cindy AI，也可指定 Brave / Tavily / DeepSeek / AnySearch。查询最多 2000 字符；DeepSeek 最多 128 个 Unicode 字符（不截断），摘要优先使用 summary，按成功请求计费；AnySearch 可免 Key 匿名搜索（国内可访问、速率较低），但需先在「插件」→「Web Search」详情页把 AnySearch 设为自备搜索渠道（关闭 Cindy AI 后生效）或填写 AnySearch API Key，否则返回 NOT_CONFIGURED；snippet 缺失时用 content 回退，不读取全文。失败时保留宿主 errorCode，把 message 告诉用户；缺 Key 时按指引在插件详情页配置。不自动重试或切换搜索源。",
       "parameters": {
         "type": "object",
         "properties": {
diff --git a/cindy-web-search/main.js b/cindy-web-search/main.js
index cef2570a..23e66d99 100644
--- a/cindy-web-search/main.js
+++ b/cindy-web-search/main.js
@@ -299,15 +299,17 @@ async function searchAnySearch(query, limit, callId) {
     return anySearchFailure('RESPONSE_INVALID');
   }
   if (data.data.results.some(function (item) {
-    return !item || typeof item.title !== 'string' || typeof item.url !== 'string'
-      || !(typeof item.snippet === 'string' || typeof item.content === 'string'
-        || item.snippet === undefined && item.content === undefined);
+    return !item || typeof item.title !== 'string' || typeof item.url !== 'string';
   })) return anySearchFailure('RESPONSE_INVALID');
   return {
     ok: true,
     provider: 'anysearch',
     results: data.data.results.slice(0, limit).map(function (item) {
-      return { title: item.title, url: item.url, snippet: item.snippet || item.content || '' };
+      // snippet/content are optional strings; coerce anything else rather than
+      // returning a non-string (e.g. an object) as the result snippet.
+      var snippet = typeof item.snippet === 'string' ? item.snippet : '';
+      var content = typeof item.content === 'string' ? item.content : '';
+      return { title: item.title, url: item.url, snippet: snippet || content };
     }),
   };
 }