feat: add optional you.com search integration

[mouse-value-add]

What

Adds an optional You.com provider to the existing WebSearch tool. When YDC_API_KEY is set in the environment, searches go through the You.com Search API (https://api.ydc-index.io/search, X-API-Key header) and return stable JSON results with snippets. When the key is unset — the default — behaviour is exactly as before (DuckDuckGo HTML scrape with the lite-endpoint fallback). If the You.com call fails for any reason (bad key, network, HTTP error), the tool silently falls back to the DuckDuckGo path, so a misconfigured key can never break web search.

Why this is useful here

src/agent/tools/web.ts currently depends on regex-parsing DuckDuckGo's HTML layout — the file itself documents three fallback parse strategies because the layout shifts. This PR gives the tool an API-backed engine that doesn't depend on page structure, while keeping the zero-config path intact. The result header now labels the engine used (via you.com / via duckduckgo) so it's visible which path served a query.

Changes

• src/agent/tools/web.ts — ydcApiKey() (env read, trim, empty-reject), parseYdcResults() (tolerant JSON parser: accepts {hits:[...]} or a bare array, joins snippets arrays, falls back to description, dedupes by URL, respects the limit), ydcSearch() (fetch + error handling), and engine selection inside webSearchTool with automatic DDG fallback. Exposed a small _internals seam for tests.
• src/agent/tools/web.test.ts — 11 new tests: parser (shapes, dedupe, limit, junk bodies), key handling (unset default, whitespace, empty), and engine selection (You.com used when key set + results returned, DDG fallback on You.com failure, You.com never called without a key). All fetch/network is mocked; no live calls in CI.
• README.md — one-line mention of the optional provider in the tools table.
• CHANGELOG.md — Unreleased entry.

Setup

export YDC_API_KEY=***   # from https://you.com/platform/api-keys

No other configuration; nothing changes for users who don't set the variable. No new dependencies (plain fetch).

Usage example

User: what's new in the MCP spec?
Agent → WebSearch(search_term="model context protocol spec changes 2026")
→ Web results for "model context protocol spec changes 2026" (via you.com):
  1. ...

For anyone who prefers MCP instead of a direct API key: You.com also ships a remote MCP server (https://api.you.com/mcp, keyless basic search at https://api.you.com/mcp?profile=free) that can be added through OpenCursor's existing MCP client config — this PR is just the lighter built-in path for the WebSearch tool itself.

Validation

• pnpm run check-types — pass
• pnpm run lint — pass
• pnpm vitest run src/agent/tools/web.test.ts — 23/23 pass (12 existing + 11 new)
• pnpm run test:unit — 935 pass; 1 pre-existing failure in waitTools.test.ts > Rg > runs ripgrep when available, reproduced on a clean checkout of main (environment-specific, unrelated to this change)
• Live check: endpoint https://api.ydc-index.io/search verified reachable and correctly 403s an invalid key (exercising the fallback path); no valid key available in this environment, so live authenticated result parsing is covered by the mocked tests instead

Fallback/error handling

• No key → DDG path, byte-identical to current behaviour.
• Key set but call fails → DDG path, via duckduckgo label.
• Key set, You.com returns results → You.com path, via you.com label.

I kept this fully optional and followed the existing tool structure in web.ts — happy to adjust the shape if you'd prefer a config setting over an env var, or to drop the engine label from the header.