fix: 守卫 websearch 数值配置 + 上游错误体改写服务端日志

review 发现的两处低危问题:
- 非数字的 WEBSEARCH_TIMEOUT_MS/WEBSEARCH_MAX_RESULTS 会得到 NaN，
  setTimeout(fn, NaN) 被强转为 0 立即触发，导致每次搜索秒超时。
  新增 parsePositiveInt 守卫，非正整数回退默认值。
- Tavily 非 2xx 错误的完整 body 改为只写服务端日志（截断 500 字），
  返回聊天的提示仍由 describeHttpError 截断到 200 字。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lishuceo

src/__tests__/config.test.ts

@@ -59,4 +59,62 @@ describe('config', () => {
       expect(config.claude.defaultWorkDir).toBe(dirname(process.cwd()));
     });
   });
+
+  describe('parsePositiveInt', () => {
+    it('parses valid positive integers', async () => {
+      const { parsePositiveInt } = await loadConfig();
+      expect(parsePositiveInt('15000', 999)).toBe(15000);
+      expect(parsePositiveInt('1', 999)).toBe(1);
+    });
+
+    it('falls back when undefined or empty', async () => {
+      const { parsePositiveInt } = await loadConfig();
+      expect(parsePositiveInt(undefined, 15000)).toBe(15000);
+      expect(parsePositiveInt('', 15000)).toBe(15000);
+    });
+
+    it('falls back on non-numeric values (guards setTimeout(fn, NaN) firing instantly)', async () => {
+      const { parsePositiveInt } = await loadConfig();
+      expect(parsePositiveInt('abc', 15000)).toBe(15000);
+      expect(parsePositiveInt('none', 15000)).toBe(15000);
+    });
+
+    it('falls back on zero and negative values', async () => {
+      const { parsePositiveInt } = await loadConfig();
+      expect(parsePositiveInt('0', 15000)).toBe(15000);
+      expect(parsePositiveInt('-5', 15000)).toBe(15000);
+    });
+  });
+
+  describe('websearch config', () => {
+    it('auto-enables when TAVILY_API_KEY is present', async () => {
+      vi.stubEnv('TAVILY_API_KEY', 'tvly-abc');
+      delete process.env.WEBSEARCH_ENABLED;
+      const { config } = await loadConfig();
+      expect(config.websearch.enabled).toBe(true);
+      expect(config.websearch.apiKey).toBe('tvly-abc');
+    });
+
+    it('stays disabled when no key and no explicit enable', async () => {
+      vi.stubEnv('TAVILY_API_KEY', '');
+      delete process.env.WEBSEARCH_ENABLED;
+      const { config } = await loadConfig();
+      expect(config.websearch.enabled).toBe(false);
+    });
+
+    it('WEBSEARCH_ENABLED=false overrides key presence', async () => {
+      vi.stubEnv('TAVILY_API_KEY', 'tvly-abc');
+      vi.stubEnv('WEBSEARCH_ENABLED', 'false');
+      const { config } = await loadConfig();
+      expect(config.websearch.enabled).toBe(false);
+    });
+
+    it('falls back to safe timeout/maxResults on non-numeric env', async () => {
+      vi.stubEnv('WEBSEARCH_TIMEOUT_MS', 'abc');
+      vi.stubEnv('WEBSEARCH_MAX_RESULTS', 'xyz');
+      const { config } = await loadConfig();
+      expect(config.websearch.timeoutMs).toBe(15000);
+      expect(config.websearch.maxResults).toBe(5);
+    });
+  });
 });

src/config.ts

@@ -4,6 +4,15 @@ dotenv.config();
 import { dirname } from 'node:path';
 import type { GroupConfig } from './agent/types.js';
 
+/**
+ * parseInt 的正整数守卫：非数字或 <=0 的环境变量值回退到默认值。
+ * 防止形如 setTimeout(fn, NaN) 被强转为 0 立即触发的隐患。
+ */
+export function parsePositiveInt(raw: string | undefined, fallback: number): number {
+  const n = parseInt(raw ?? '', 10);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+
 function parseGroupConfigs(raw?: string): Record<string, GroupConfig> {
   if (!raw?.trim()) return {};
   try {
@@ -185,11 +194,11 @@ export const config = {
     /** Tavily API base URL */
     baseUrl: process.env.TAVILY_BASE_URL || 'https://api.tavily.com',
     /** 默认返回结果数 (1-20) */
-    maxResults: parseInt(process.env.WEBSEARCH_MAX_RESULTS || '5', 10),
+    maxResults: parsePositiveInt(process.env.WEBSEARCH_MAX_RESULTS, 5),
     /** 默认搜索深度: basic (1 credit) | advanced (2 credits) */
     searchDepth: (process.env.WEBSEARCH_DEPTH || 'basic') as 'basic' | 'advanced',
     /** 单次请求超时毫秒数 */
-    timeoutMs: parseInt(process.env.WEBSEARCH_TIMEOUT_MS || '15000', 10),
+    timeoutMs: parsePositiveInt(process.env.WEBSEARCH_TIMEOUT_MS, 15000),
   },
 
   // 定时任务配置

src/websearch/tool.ts

@@ -135,7 +135,8 @@ export function webSearchTool() {
         if (!resp.ok) {
           const body = await resp.text().catch(() => '');
           const detail = describeHttpError(resp.status, body);
-          logger.warn({ status: resp.status, query: args.query }, 'web_search Tavily API error');
+          // 完整 body 仅写服务端日志（便于排障），返回给聊天的 detail 已被 describeHttpError 截断
+          logger.warn({ status: resp.status, query: args.query, body: body.slice(0, 500) }, 'web_search Tavily API error');
           return {
             content: [{ type: 'text' as const, text: detail }],
             isError: true,