fix: surface hosted web tools

Author: wangtsiao

Cargo.lock

@@ -7,6 +7,7 @@ members = [
     "crates/safety",
     "crates/tasks",
     "crates/mcp",
+    "crates/network-proxy",
     "crates/protocol",
     "crates/client",
     "crates/config",
@@ -58,6 +59,7 @@ devo-core = { path = "crates/core" }
 devo-file-search = { path = "crates/file-search" }
 devo-keyring-store = { path = "crates/keyring-store" }
 devo-mcp = { path = "crates/mcp" }
+devo-network-proxy = { path = "crates/network-proxy" }
 devo-protocol = { path = "crates/protocol" }
 devo-provider = { path = "crates/provider" }
 devo-rmcp-client = { path = "crates/rmcp-client" }
@@ -103,6 +105,7 @@ regex-lite = "0.1.8"
 reqwest = { version = "0.12", default-features = false, features = [
     "json",
     "rustls-tls",
+    "socks",
     "stream",
 ] }
 reqwest-eventsource = "0.6"

Cargo.toml

@@ -82,6 +82,7 @@ pub(crate) async fn run_prompt(
             collaboration_mode: devo_protocol::CollaborationMode::Build,
             agent_coordinator: None,
             local_web_search: None,
+            network_proxy: None,
         },
     );
     let model_catalog = PresetModelCatalog::load_from_config(&home_dir, Some(&cwd))?;

crates/cli/src/prompt_command.rs

@@ -275,6 +275,26 @@ the provider default endpoint and result count. Compatibility aliases
 `websearch` and `web-search` route to `web_search`, but aliases are not exposed
 to the model.
 
+## Web Fetch
+
+`[tools.web_fetch]` controls whether a turn exposes URL fetching to the model.
+It resolves with the same priority as web search:
+
+1. `[model_bindings.<id>.web_fetch]`
+2. `[providers.<id>.web_fetch]`
+3. `[tools.web_fetch]`
+
+Supported modes:
+
+- `disabled`: do not provide provider-hosted web fetch and do not expose the
+  local `webfetch` function tool.
+- `provider`: let the active provider adapter inject provider-hosted fetch into
+  the request. OpenAI Responses uses hosted tool `{"type":"web_fetch"}`;
+  OpenAI Chat Completions uses `web_fetch_options`; Anthropic Messages uses
+  server tool `{"type":"web_fetch_20250910","name":"web_fetch"}`.
+- `local`: expose the existing local `webfetch` function tool. This is the
+  default to preserve the existing local fetch behavior.
+
 ## Provider Resolution
 
 `resolve_provider_settings_from_config_and_auth` chooses the active model

crates/config/README.md

@@ -286,6 +286,7 @@ impl AppConfigStore {
                         .as_deref()
                         .and_then(non_empty_string),
                     web_search: None,
+                    web_fetch: None,
                     enabled: binding.enabled,
                 },
             );

crates/config/src/app.rs

@@ -4,6 +4,7 @@ use devo_protocol::ProviderWireApi;
 use serde::Deserialize;
 use serde::Serialize;
 
+use crate::WebFetchConfig;
 use crate::WebSearchConfig;
 
 pub(crate) const AUTH_CONFIG_VERSION: u32 = 1;
@@ -58,6 +59,8 @@ pub struct ProviderVendorConfig {
     pub wire_apis: Vec<ProviderWireApi>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub web_search: Option<WebSearchConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub web_fetch: Option<WebFetchConfig>,
     #[serde(default = "default_true")]
     pub enabled: bool,
 }
@@ -71,6 +74,7 @@ impl ProviderVendorConfig {
             && self.headers.is_none()
             && self.wire_apis.is_empty()
             && self.web_search.is_none()
+            && self.web_fetch.is_none()
             && self.enabled
     }
 }
@@ -92,6 +96,8 @@ pub struct ModelBindingConfig {
     pub default_reasoning_effort: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub web_search: Option<WebSearchConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub web_fetch: Option<WebFetchConfig>,
     #[serde(default = "default_true")]
     pub enabled: bool,
 }
@@ -106,6 +112,7 @@ impl Default for ModelBindingConfig {
             invocation_method: default_provider_wire_api(),
             default_reasoning_effort: None,
             web_search: None,
+            web_fetch: None,
             enabled: true,
         }
     }
@@ -251,6 +258,9 @@ impl ProviderConfigSection {
             if overlay_provider.web_search.is_some() {
                 provider.web_search = overlay_provider.web_search;
             }
+            if overlay_provider.web_fetch.is_some() {
+                provider.web_fetch = overlay_provider.web_fetch;
+            }
             provider.enabled = overlay_provider.enabled;
         }
         for (binding_id, overlay_binding) in overlay.model_bindings {
@@ -274,6 +284,9 @@ impl ProviderConfigSection {
             if overlay_binding.web_search.is_some() {
                 binding.web_search = overlay_binding.web_search;
             }
+            if overlay_binding.web_fetch.is_some() {
+                binding.web_fetch = overlay_binding.web_fetch;
+            }
             binding.enabled = overlay_binding.enabled;
         }
     }

crates/config/src/provider/schema.rs

@@ -297,6 +297,7 @@ invocation_method = "openai_responses"
                     headers: Some(r#"{"X-User":"yes"}"#.to_string()),
                     wire_apis: vec![ProviderWireApi::OpenAIResponses],
                     web_search: None,
+                    web_fetch: None,
                     enabled: true,
                 },
             )]),

crates/config/src/tests.rs

@@ -12,11 +12,13 @@ use crate::UserAuthConfigFile;
 pub struct ToolsConfig {
     #[serde(default, skip_serializing_if = "WebSearchConfig::is_default")]
     pub web_search: WebSearchConfig,
+    #[serde(default, skip_serializing_if = "WebFetchConfig::is_default")]
+    pub web_fetch: WebFetchConfig,
 }
 
 impl ToolsConfig {
     pub fn is_empty(&self) -> bool {
-        self.web_search.is_default()
+        self.web_search.is_default() && self.web_fetch.is_default()
     }
 }
 
@@ -49,6 +51,29 @@ impl WebSearchConfig {
     }
 }
 
+/// Selects how Devo exposes web fetch for a provider/model.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum WebFetchMode {
+    Disabled,
+    Provider,
+    #[default]
+    Local,
+}
+
+/// Configures the effective `web_fetch` capability.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub struct WebFetchConfig {
+    #[serde(default, skip_serializing_if = "is_default_web_fetch_mode")]
+    pub mode: WebFetchMode,
+}
+
+impl WebFetchConfig {
+    pub fn is_default(&self) -> bool {
+        self.mode == WebFetchMode::Local
+    }
+}
+
 /// Local third-party search provider configuration.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LocalWebSearchProviderConfig {
@@ -88,6 +113,26 @@ impl ResolvedWebSearchConfig {
     }
 }
 
+/// Fully resolved web fetch behavior for one model invocation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(tag = "mode", rename_all = "snake_case")]
+pub enum ResolvedWebFetchConfig {
+    Disabled,
+    Provider,
+    #[default]
+    Local,
+}
+
+impl ResolvedWebFetchConfig {
+    pub fn is_local(self) -> bool {
+        matches!(self, Self::Local)
+    }
+
+    pub fn is_provider(self) -> bool {
+        matches!(self, Self::Provider)
+    }
+}
+
 /// Local search service plus user-scoped API key for one turn.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ResolvedLocalWebSearchConfig {
@@ -114,6 +159,19 @@ pub fn resolve_web_search_config(
     }
 }
 
+pub fn resolve_web_fetch_config(
+    global: &WebFetchConfig,
+    provider_override: Option<&WebFetchConfig>,
+    binding_override: Option<&WebFetchConfig>,
+) -> ResolvedWebFetchConfig {
+    let effective = binding_override.or(provider_override).unwrap_or(global);
+    match effective.mode {
+        WebFetchMode::Disabled => ResolvedWebFetchConfig::Disabled,
+        WebFetchMode::Provider => ResolvedWebFetchConfig::Provider,
+        WebFetchMode::Local => ResolvedWebFetchConfig::Local,
+    }
+}
+
 fn resolve_local_web_search(
     global: &WebSearchConfig,
     effective: &WebSearchConfig,
@@ -167,6 +225,10 @@ fn is_default_web_search_mode(mode: &WebSearchMode) -> bool {
     *mode == WebSearchMode::Provider
 }
 
+fn is_default_web_fetch_mode(mode: &WebFetchMode) -> bool {
+    *mode == WebFetchMode::Local
+}
+
 #[cfg(test)]
 mod tests {
     use std::collections::BTreeMap;

crates/config/src/tools.rs

@@ -8,6 +8,7 @@ version.workspace = true
 [dependencies]
 devo-config = { workspace = true }
 devo-code-search = { workspace = true }
+devo-network-proxy = { workspace = true }
 devo-protocol = { workspace = true }
 devo-provider = { workspace = true }
 devo-safety = { workspace = true }