refactor(web): remove provider runtime facade

vincentkoc · vincentkoc · commit e122cd09ab0f · 2026-06-18T10:21:20.000+08:00
diff --git a/.github/codeql/codeql-network-ssrf-boundary-critical-security.yml b/.github/codeql/codeql-network-ssrf-boundary-critical-security.yml
@@ -20,7 +20,7 @@ paths:
   - src/agents/tools/web-shared.ts
   - src/plugin-sdk/ssrf-policy.ts
   - src/web-fetch
-  - src/web/provider-runtime-shared.ts
+  - packages/web-content-core/src/provider-runtime-shared.ts
   - packages/memory-host-sdk/src/host/ssrf-policy.ts
   - packages/net-policy/src
 
diff --git a/.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml b/.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml
@@ -16,7 +16,7 @@ query-filters:
 paths:
   - src/web-fetch
   - src/web-search
-  - src/web/provider-runtime-shared.ts
+  - packages/web-content-core/src/provider-runtime-shared.ts
   - src/media
   - src/media-understanding
   - src/image-generation
diff --git a/src/agents/tools/web-fetch.ts b/src/agents/tools/web-fetch.ts
@@ -17,7 +17,7 @@ import { wrapExternalContent, wrapWebContent } from "../../security/external-con
 import { createLazyImportLoader } from "../../shared/lazy-promise.js";
 import { isRecord } from "../../utils.js";
 import { extractReadableContent } from "../../web-fetch/content-extractors.runtime.js";
-import { resolveWebProviderConfig } from "../../web/provider-runtime-shared.js";
+import { resolveWebProviderConfig } from "../../../packages/web-content-core/src/provider-runtime-shared.js";
 import { stringEnum } from "../schema/string-enum.js";
 import { setToolTerminalPresentation } from "../tool-terminal-presentation.js";
 import type { AnyAgentTool } from "./common.js";
diff --git a/src/web-fetch/runtime.ts b/src/web-fetch/runtime.ts
@@ -19,7 +19,7 @@ import {
   readWebProviderEnvValue,
   resolveWebProviderConfig,
   resolveWebProviderDefinition,
-} from "../web/provider-runtime-shared.js";
+} from "../../packages/web-content-core/src/provider-runtime-shared.js";
 
 // Runtime provider selection for the web_fetch tool. It resolves config,
 // credentials, runtime metadata, and sandbox-safe bundled provider scopes.
diff --git a/src/web-search/runtime.ts b/src/web-search/runtime.ts
@@ -27,7 +27,7 @@ import {
   providerRequiresCredential,
   readWebProviderEnvValue,
   resolveWebProviderConfig,
-} from "../web/provider-runtime-shared.js";
+} from "../../packages/web-content-core/src/provider-runtime-shared.js";
 import type {
   ResolveWebSearchDefinitionParams,
   RunWebSearchParams,
diff --git a/src/web/provider-runtime-shared.ts b/src/web/provider-runtime-shared.ts
