DSH Web Search Z.AI
Native-feeling web_search for DeepSeek Harness (DSH) installs whose model route is Z.AI / GLM, delivered as one dependency-free Cordis plugin for the host web seam (ctx.web).
The shipped harness selects deepseek-official as its search provider, which requires a real DeepSeek API key. On an install that runs GLM through the zai provider, only ZAI_API_KEY exists — so every web_search fails with HTTP 401. This package registers a zai-official search provider that performs searches through Z.AI's Anthropic-compatible Messages API using the native web_search_20250305 server tool (glm-5.3), authenticating with the ZAI_API_KEY credential you already have, and flips the web seam's selection to it. The Profile Bundle patch carries both rows; a fresh install needs no manual composition editing.
How it works
- Sends one Messages request per search: model
glm-5.3, the web_search_20250305 server tool (max_uses: 3), max_tokens: 512 — sources come from the tool-result blocks, so the completion budget stays small and inside the web tool's 60s timeout.
- Z.AI's Anthropic dialect returns tool results as
tool_result blocks whose content is a stringified Python-repr/JSON hybrid rather than standard web_search_tool_result blocks (which is exactly why the shipped web-search-deepseek provider cannot simply be repointed at Z.AI). A quote-aware scanner extracts title / link / content records from either shape, standard blocks included for forward compatibility.
- Transient upstream failures (
Internal Network Failure, 5xx, timeouts) are retried up to 3 times; permanent errors surface verbatim with the HTTP status.
- Each request is appended to the initiating session log as
web/zai-search-llm-request for observability, mirroring the shipped provider.
- Registration goes through
web.registerSearchProvider, whose disposer is fiber-owned — removing the plugin row cleanly unregisters the provider and (on a fresh apply of the base config) restores the previous selection.
Requirements
- DeepSeek Harness with the
web seam (the standard web profile; any base-backed profile works).
- A Z.AI API key stored as the
ZAI_API_KEY credential — the web Models page writes it, or use your credentials store directly. No other credentials, environment variables, or npm dependencies.
Cost note: every search is a GLM model turn with server-side search. It bills like a small model call, not like a free search-API hit.
Install
Install into your web profile (the package carries its own Profile Bundle patch — no manual composition row is needed):
dsh plugin --profile web add @canary-builds/dsh-web-search-zai
Restart DSH. To update, run the same command again and restart.
If your profile's cordis.patch.yml already overrides the web row (any manual searchProvider selection), remove that override — profile patches apply after bundle patches and would win. Likewise, remove any manually inserted web-search-zai row before switching to the bundle install; two rows with the same id will collide.
Install from a git checkout (pre-release)
Until the first npm release, install from a clone:
git clone https://github.com/Canary-Builds/dsh-web-search-zai \
~/.dsh/profiles/web/plugins/dsh-web-search-zai
ln -sfn ../plugins/dsh-web-search-zai \
~/.dsh/profiles/web/node_modules/dsh-web-search-zai
Then add the rows to ~/.dsh/profiles/web/cordis.patch.yml (the same content as this package's cordis.patch.yml, with the row name dsh-web-search-zai matching the unscoped symlink):
- insert:
- id: web-search-zai
name: dsh-web-search-zai
- id: web
name: '@deepseek-ai/dsh-web'
config:
searchProvider: zai-official
fetchProvider: http
Profiles with patchReload: live pick the change up without a restart; otherwise restart DSH.
Switching back to DeepSeek
Store a real DeepSeek key as DEEPSEEK_API_KEY, remove this package (dsh plugin --profile web remove @canary-builds/dsh-web-search-zai), and restore searchProvider: deepseek-official in the web row. The shipped provider row is never touched by this bundle's patch while it is installed — but removing the bundle restores the base config on the next start.
Configuration
There is no settings card and no schema dependency — deliberately, to keep the package installable with zero npm dependencies. The knobs are the constants at the top of index.js:
| Constant | Default | Meaning |
|---|
MODEL | glm-5.3 | Model that performs the search turn |
MAX_USES | 3 | Server-tool search passes per request |
MAX_TOKENS | 512 | Completion budget (sources arrive in tool blocks) |
MAX_ATTEMPTS / RETRY_DELAY_MS | 3 / 700 | Transient-failure retry policy |
REQUEST_TIMEOUT_MS | 45000 | Per-attempt timeout, inside the web tool's budget |
API_KEY_REF | ZAI_API_KEY | Credentials-store reference |
Compatibility
- Targets the DSH
web seam contract (registerSearchProvider / WebSearchProvider) as shipped in 0.1.x; the seam is stable, but a future DSH that changes the provider contract will need a re-test.
- The Z.AI tool-result dialect is parsed tolerantly (Python-repr and JSON shapes, nested or flat). If Z.AI changes the shape entirely, searches fail with a descriptive
WEB_PROVIDER_ERROR naming the endpoint — file an issue.
Behavior notes
- The provider reports
available() only when the credentials service is present; searches throw WEB_PROVIDER_CREDENTIAL_MISSING with setup instructions when ZAI_API_KEY is unset.
- URLs are deduped across multiple search passes within one request; snippets are capped at 400 characters; the seam's
maxResults truncation applies downstream.
- Cancellation is honored end-to-end (
WEB_ABORTED), including mid-fetch.
License
MIT
Development
Single-file ESM plugin, no build step, no dependencies: edit index.js, restart DSH (or rely on a live profile patch reload after touching cordis.patch.yml). Functional smoke test: import apply, mount it on a mock ctx exposing web.registerSearchProvider and the credentials seam, and call provider.search({ query }). Report an issue · Canary Builds
