Expose authenticated web search and extraction APIs

[AnthonyRonning]

Summary

• add JWT-authenticated, end-to-end encrypted POST /v1/web/search and POST /v1/web/extract endpoints with provider-neutral request and response types backed by the existing Kagi client
• expose bounded search controls and multi-page extraction while preserving the existing web-search.kagi feature-flagged Responses behavior
• require current paid-feature access in deployed modes, fail closed when billing is unavailable, and keep the existing local non-guest development path
• reserve per-user/global concurrency and rolling quota before billing checks, then commit quota immediately before provider work
• normalize extraction and result URLs to public HTTPS targets and reject credentials, local/private/reserved addresses, metadata hosts, control characters, and oversized requests
• strip Markdown/HTML image embeds from untrusted web text, preserve ordinary links and alt text, bound page/result content, and return sanitized provider errors and traces

API behavior

• Direct web endpoints are not feature flagged; authenticated paid clients can use them independently of the Responses tool rollout.
• Search results omit provider image metadata and return only bounded text and public links.
• Extraction accepts up to 10 public HTTPS URLs and returns bounded per-page results, including sanitized partial failures.
• The Responses API continues selecting Kagi per request through web-search.kagi, with Brave remaining the default when the flag is off.

Validation

• OpenSecret test suite: 275 passed, 17 ignored
• strict Rust formatting and all-target/all-feature Clippy with -D warnings
• live encrypted Rust SDK search and extraction calls against the local backend and Kagi
• focused coverage for request validation, paid-access decisions, preflight reservations, concurrency/quota release, retry bounds, response-size limits, URL normalization, provider-error sanitization, image stripping, and safe truncation
• git diff --check

Companion work

• OpenSecret SDK draft: feat: harden Rust auth and add encrypted web APIs OpenSecret-SDK#88
• Maple draft: feat(agent): add native Maple provider and authenticated web tools Maple#643

The SDK is intentionally unpublished for this review stack; Maple uses the workspace-local exact SDK revision until the package release follow-up.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 22c165eb-68a8-4c4b-af70-6d94a615da89

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex-maple-native-provider-web-tools-opensecret

---

_{Comment @coderabbitai help to get the list of available commands.}