root/MarketingTool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[verified] add Nous Portal web research adapter
CI / compose (push) Successful in 11m13s
Details

Browse Source
This commit is contained in:
Marco0300
2026-09-03 21:01:36 +02:00
parent d39c359cae
commit 4f87ca93f6
6 changed files with 258 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/README.md
+9 -21
View File
@@ -29,27 +29,15 @@ remain the controlled, operator-supplied mode.
The provider status is available at authenticated `GET
/api/v1/discovery/ai-provider-status` (the older
`/api/v1/discovery/provider-status` alias is retained). Configure only on the
server. For native OpenAI Responses web search, use exactly:
```dotenv
AI_RESEARCH_PROVIDER=openai_web_search
AI_RESEARCH_PROVIDER_MODEL=<OpenAI model supporting web search>
AI_RESEARCH_PROVIDER_URL=https://api.openai.com/v1/responses
AI_RESEARCH_PROVIDER_ALLOWED_HOSTS=api.openai.com
OPENAI_API_KEY=<standard OpenAI API key>
```
The native adapter sends `tools: [{"type":"web_search"}]` and
`include: ["web_search_call.action.sources"]`; it parses only bounded
`url_citation` annotations and web-search `sources` URLs. `OPENAI_API_KEY` is
used for this adapter (the generic `AI_RESEARCH_PROVIDER_API_KEY` remains
supported as a compatibility override). Anthropic/Google retain the generic
approved-provider request/response contract and use `AI_RESEARCH_PROVIDER_API_KEY`.
Requests have an 8-second timeout, 64 KiB response limit, 8 KiB criteria limit,
and 50-target maximum. Missing credentials, unapproved providers, unsafe
endpoints, malformed responses, prompt-injection-shaped criteria, and unsafe
URLs fail closed. Provider status reports readiness metadata only and never
returns API keys.
server. The native Nous adapter uses OpenAI-compatible Chat Completions at
`https://inference-api.nousresearch.com/v1/chat/completions` and strict
`web_search`/`scrape_website` tools backed by an allowlisted Firecrawl-compatible
API. Configure server-side `NOUS_API_KEY`, `NOUS_MODEL`, `NOUS_BASE_URL`,
`NOUS_ALLOWED_HOSTS`, `FIRECRAWL_API_KEY`, `FIRECRAWL_BASE_URL`, and
`FIRECRAWL_ALLOWED_HOSTS` with `AI_RESEARCH_PROVIDER=nous_portal`. Tool calls,
responses, criteria, and results are bounded; page text is untrusted; only
structured HTTPS targets are accepted and the existing SSRF-safe crawler fetches
and persists evidence. Status is fail-closed and never returns secrets.
All protected endpoints require the server-side session cookie. Every query is constrained by the authenticated user's `organization_id`; IDs from another tenant behave as not found and must not disclose whether a record exists.