feat: add optional you.com search integration

[mouse-value-add]

CoreCoder has no way to reach the web: when a task needs current docs, a changelog, or an error message from a newer library version than the repo pins, the agent can only guess. This adds an opt-in you_web_search tool so it can look things up instead.

What changed

• corecoder/tools/web_search.py (~80 lines) — YouWebSearchTool on the existing Tool base class, plus a web_search_tools() loader. Plain urllib, no new dependency; the repo stays stdlib-only outside the OpenAI client.
• corecoder/cli.py — the loader slots in next to load_mcp_tools() (tools=[*ALL_TOOLS, *web_search_tools(), *load_mcp_tools()]), and the banner gains one line when the tool is active.
• tests/test_web_search.py — 8 offline tests: registration gating, schema, result formatting, 401/network error paths, count clamping, consent-gate placement.
• README.md / README_CN.md — new "Web search" section, code-map entry, and the line-count/test-count numbers updated so test_readme_line_counts_are_current stays green.

Design choices

• Opt-in, exactly like MCP. No YDC_API_KEY in the environment → web_search_tools() returns [] and the default eight-tool set is byte-for-byte unchanged for every existing user.
• Behind the consent gate. Like MCP tools, it stays out of READ_ONLY in permissions.py: a query leaves the machine, so the agent asks first. In one-shot mode without --yes it's refused like any other mutating call.
• Failures are ordinary tool results. A 401 names the env var, a network error says the search is unavailable — the loop routes around it instead of dying, matching how mcp.py treats a dead server.
• I followed the repo's conventions throughout: error strings returned from execute() rather than raised, ClassVar parameters dict, ruff line length, and the README's enforced line-count bookkeeping.

Setup

export YDC_API_KEY=***   # https://you.com/platform/api-keys
corecoder -p "find the current recommended way to test FastAPI websocket endpoints, with links"

The model then has you_web_search(query, count) available alongside the built-ins. If you'd rather not carry an API key at all, the README also documents the keyless alternative through the existing MCP section:

{"mcpServers": {"you": {"command": "npx", "args": ["-y", "mcp-remote", "https://api.you.com/mcp?profile=free"]}}}

(You.com also ships agent skills/plugins for many harnesses via youdotcom-oss/agent-skills, but for this repo the thin first-party tool felt like the right shape given the minimalism ethos.)

Validation

• python -m pytest tests/ -q → 171 passed (163 before, 8 new; all offline, mocked HTTP)
• ruff check corecoder tests → clean
• python -m compileall -q corecoder tests → clean
• Default behavior confirmed unchanged: without YDC_API_KEY, ALL_TOOLS is still exactly the 8 built-ins and web_search_tools() is [].
• Live smoke test not run here (no YDC_API_KEY in this environment). To do one: export YDC_API_KEY=<key> then corecoder -p "search for the latest pytest release notes".

Happy to adjust the shape if you'd prefer a different name, or to move the env-var read into config.py instead of the loader.