fix: address codex review findings on web seam

- search providers (exa/perplexity/deepseek): map the parsed response
  INSIDE the parse try, so a well-formed body of the wrong shape surfaces
  as WEB_PROVIDER_ERROR instead of escaping as a raw TypeError; a WebError
  the mapper throws on purpose is re-thrown untouched
- web-fetch-local: validate numeric limits at plugin construction (positive
  finite caps; non-negative integer maxRedirects) rather than constructing a
  provider with nonsensical values
- web-fetch-local: enforce the redirect budget BEFORE resolving each hop, so
  maxRedirects:N follows exactly N redirects and an over-limit hop reports
  "exceeded the maximum" rather than misdiagnosing a cross-origin block
- drop the stale dsh-tool-web/search and /fetch path aliases (the package no
  longer declares those subpath exports)
- strip trailing EOF blank lines flagged by git diff --check

Each fix carries a regression test.

packages/web/web-fetch-local/src/index.ts

@@ -60,10 +60,30 @@ export const Config: z<Config> = z.object({
 /** The shape after schemastery applies its defaults to every field. */
 type ResolvedConfig = Required<Config>
 
+/** A resource limit (byte/char/length/timeout cap) must be a positive finite number. */
+function assertPositiveFinite(name: string, value: number): void {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(`web-fetch-local: ${name} must be a positive finite number`)
+  }
+}
+
+/** The redirect hop cap must be a non-negative integer (0 follows no redirects). */
+function assertNonNegativeInteger(name: string, value: number): void {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`web-fetch-local: ${name} must be a non-negative integer`)
+  }
+}
+
 /** Register the local HTTP(S) fetch provider with `ctx.web`. */
 export function apply(ctx: Context, config: Config): void {
   // schemastery (Config) has already filled every defaulted field.
   const resolved = config as ResolvedConfig
+  assertPositiveFinite('maxUrlLength', resolved.maxUrlLength)
+  assertPositiveFinite('maxResponseBytes', resolved.maxResponseBytes)
+  assertPositiveFinite('maxBodyChars', resolved.maxBodyChars)
+  assertPositiveFinite('timeoutMs', resolved.timeoutMs)
+  assertPositiveFinite('maxTimeoutMs', resolved.maxTimeoutMs)
+  assertNonNegativeInteger('maxRedirects', resolved.maxRedirects)
   const limits: LocalFetchLimits = {
     maxUrlLength: resolved.maxUrlLength,
     maxResponseBytes: resolved.maxResponseBytes,

packages/web/web-fetch-local/src/provider.ts

@@ -81,11 +81,21 @@ export class LocalFetchProvider implements WebFetchProvider {
   /** Follow same-origin redirects up to the hop cap, then read the final response. */
   private async followAndRead(initialUrl: string, controller: AbortController): Promise<WebFetchResult> {
     let currentUrl = validateFetchUrl(initialUrl, this.limits.maxUrlLength)
+    let redirectsFollowed = 0
 
-    for (let hop = 0; hop <= this.limits.maxRedirects; hop++) {
+    for (;;) {
       const response = await this.requestOnce(currentUrl, controller)
 
       if (isRedirectStatus(response.status)) {
+        // The redirect budget is enforced BEFORE this hop's target is resolved
+        // or origin-checked, so `maxRedirects: N` follows at most N redirects
+        // exactly: the (N+1)th redirect is refused as "exceeded" regardless of
+        // where it points (a same-origin/cross-origin distinction on a hop we
+        // are not allowed to follow would be the wrong diagnosis).
+        if (redirectsFollowed >= this.limits.maxRedirects) {
+          await response.body?.cancel()
+          throw new WebError(`exceeded the maximum of ${this.limits.maxRedirects} redirects`, 'WEB_REDIRECT_BLOCKED')
+        }
         const location = response.headers.get('location')
         if (location === null) {
           // A redirect status with no Location is not a usable resource. Cancel
@@ -113,13 +123,12 @@ export class LocalFetchProvider implements WebFetchProvider {
         }
         await response.body?.cancel()
         currentUrl = validatedTarget
+        redirectsFollowed++
         continue
       }
 
       return await this.readBody(response, currentUrl, controller.signal)
     }
-
-    throw new WebError(`exceeded the maximum of ${this.limits.maxRedirects} redirects`, 'WEB_REDIRECT_BLOCKED')
   }
 
   private async requestOnce(url: URL, controller: AbortController): Promise<Response> {