What

Adds web-search-plus — a self-contained utility skill giving the container agent multi-provider web search + URL extraction via a wsp CLI. Search + extract only, no LLM synthesis, no MCP.

Engine vendored byte-identical from hermes-web-search-plus v2.4.0 — pure Python stdlib (no pip deps; HTTP via urllib). 13 providers with deterministic routing + fallback.

Why

The built-in WebSearch runs as a server-side LLM tool billed against the Agent-SDK credit pool. web-search-plus calls providers directly, so it runs outside that pool (self-hosted SearXNG is 0ドル), with provider control + higher-quality extraction. It coexists with WebSearch — it does not replace it.

Conformance to the skills model

Built to docs/skill-guidelines.md:

• Utility skill, self-contained in .claude/skills/add-web-search-plus/; apply copies files in — no branch, no git merge.
• One integration point — python3 added to the container Dockerfile — guarded by a structural test (src/wsp-skill.test.ts, vitest). Negative-probe verified: red on unapplied tree, green on applied.
• REMOVE.md reverses every change (copied files, Dockerfile edit, test).
• Apply is idempotent (re-run safe). Present-tense steps, no VERIFY.md.
• Apply copies no credential values into the container (no secret threading).

Verification (full /add cycle, real keys)

• Apply → image build (python3 3.11.2) → REMOVE leaves git status clean → apply twice = idempotent. pnpm test 353/353, tsc clean.
• Credentials, both paths E2E-verified:
  • Per-group .wsp.env (real key): real Serper key → wsp search in the built container → live results.
  • OneCLI gateway injection: a host-scoped vault secret (api.search.brave.com, header X-Subscription-Token) is injected by the gateway for an all-mode agent — verified with a real Brave search returning live results while the container sent no auth header.
• Multi-provider + routing: serper, tavily, exa each return live results; --explain-routing decides + explains; explicit provider selection works.
• Small-model robustness: the apply was performed by a small model from SKILL.md alone, with no ambiguity reported; all files landed correctly.