root/MarketingTool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add native OpenAI web search research adapter
CI / compose (push) Successful in 11m0s
Details

Browse Source
This commit is contained in:
Marco0300
2026-09-03 20:42:59 +02:00
parent da91c188f3
commit fe3dd338b8
5 changed files with 195 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/README.md
+22 -9
View File
@@ -29,15 +29,28 @@ remain the controlled, operator-supplied mode.
The provider status is available at authenticated `GET
/api/v1/discovery/ai-provider-status` (the older
`/api/v1/discovery/provider-status` alias is retained). Configure only on the
server with `AI_RESEARCH_PROVIDER` (`openai_web_search`, `anthropic_web_search`,
or `google_web_search`), `AI_RESEARCH_PROVIDER_MODEL`,
`AI_RESEARCH_PROVIDER_URL` (HTTPS), `AI_RESEARCH_PROVIDER_ALLOWED_HOSTS`
(exact hostname allowlist), and `AI_RESEARCH_PROVIDER_API_KEY`. Requests have an
8-second timeout, 64 KiB response limit, 8 KiB criteria limit, and 50-target
maximum. Missing credentials, unapproved providers, unsafe endpoints, malformed
responses, prompt-injection-shaped criteria, and unsafe URLs fail closed.
`SEARCH_PROVIDER_*` is a deprecated migration adapter only and is not the
primary AI workflow.
server. For native OpenAI Responses web search, use exactly:
```dotenv
AI_RESEARCH_PROVIDER=openai_web_search
AI_RESEARCH_PROVIDER_MODEL=<OpenAI model supporting web search>
AI_RESEARCH_PROVIDER_URL=https://api.openai.com/v1/responses
AI_RESEARCH_PROVIDER_ALLOWED_HOSTS=api.openai.com
OPENAI_API_KEY=<standard OpenAI API key>
```
The native adapter sends `tools: [{"type":"web_search"}]` and
`include: ["web_search_call.action.sources"]`; it parses only bounded
`url_citation` annotations and web-search `sources` URLs. `OPENAI_API_KEY` is
used for this adapter (the generic `AI_RESEARCH_PROVIDER_API_KEY` remains
supported as a compatibility override). Anthropic/Google retain the generic
approved-provider request/response contract and use `AI_RESEARCH_PROVIDER_API_KEY`.
Requests have an 8-second timeout, 64 KiB response limit, 8 KiB criteria limit,
and 50-target maximum. Missing credentials, unapproved providers, unsafe
endpoints, malformed responses, prompt-injection-shaped criteria, and unsafe
URLs fail closed. Provider status reports readiness metadata only and never
returns API keys.
All protected endpoints require the server-side session cookie. Every query is constrained by the authenticated user's `organization_id`; IDs from another tenant behave as not found and must not disclose whether a record exists.