feat(webui): add BYOK web search settings

Let WebUI users configure the single web search provider credential from BYOK while keeping saved secrets masked and hot-reloaded for new searches.

Co-authored-by: Cursor <cursoragent@cursor.com>

webui/src/lib/api.ts

@@ -4,6 +4,7 @@ import type {
   SettingsPayload,
   SettingsUpdate,
   SlashCommand,
+  WebSearchSettingsUpdate,
 } from "./types";
 
 export class ApiError extends Error {
@@ -168,3 +169,18 @@ export async function updateProviderSettings(
     token,
   );
 }
+
+export async function updateWebSearchSettings(
+  token: string,
+  update: WebSearchSettingsUpdate,
+  base: string = "",
+): Promise<SettingsPayload> {
+  const query = new URLSearchParams();
+  query.set("provider", update.provider);
+  if (update.apiKey !== undefined) query.set("api_key", update.apiKey);
+  if (update.baseUrl !== undefined) query.set("base_url", update.baseUrl);
+  return request<SettingsPayload>(
+    `${base}/api/settings/web-search/update?${query}`,
+    token,
+  );
+}

webui/src/lib/types.ts

@@ -82,6 +82,16 @@ export interface SettingsPayload {
     api_base?: string | null;
     default_api_base?: string | null;
   }>;
+  web_search: {
+    provider: string;
+    api_key_hint?: string | null;
+    base_url?: string | null;
+    providers: Array<{
+      name: string;
+      label: string;
+      credential: "none" | "api_key" | "base_url";
+    }>;
+  };
   runtime: {
     config_path: string;
   };
@@ -99,6 +109,12 @@ export interface ProviderSettingsUpdate {
   apiBase?: string;
 }
 
+export interface WebSearchSettingsUpdate {
+  provider: string;
+  apiKey?: string;
+  baseUrl?: string;
+}
+
 export interface SlashCommand {
   command: string;
   title: string;