Adding web search to an agent can look like a one-line product decision. Qwen Code’s public PR #7215 commit shows the harder version: a new opt-in web_search tool backed by the DashScope Responses API, with a linked Claude Code session and Qwen Code Bot credited on the public record. The craft is worth studying because it treats the capability as an external boundary from the start.
The tool needs deliberate activation and a compatible model. It can read a dedicated API key, spend separately billed search and extraction calls, and ask for permission before use. That makes it different from an ordinary model setting: a browser query can leave the task, incur cost, bring untrusted text home, and affect a later tool call.
The useful feature is the refusal path
The inspected implementation gates endpoint, model selector, and credential route before registration. Plaintext endpoints are rejected because the side request carries a bearer key. More subtly, when a restricted agent’s allow-list cannot resolve WebSearch, Qwen Code gives it no toolset rather than letting it inherit shell or write access.
An unavailable restricted tool is not a reason to broaden a delegated agent’s powers. The patch also keeps search source URLs when an in-stream failure leaves a partial result, instead of allowing an output cap to erase the receipts needed to check an answer.
Tests make the boundary inspectable
The companion test suite follows the new power beyond a happy-path response: missing and whitespace-only keys, ambiguous providers, non-DashScope and HTTP endpoints, unresolved selectors, cancellation, retries, truncation, and the empty-allow-list case. It tests the moment a permission boundary disappears as seriously as the moment a search result appears.
The transferable skill
When an agent gains a paid or externally reachable tool, give it its own admission contract. Make activation explicit; validate destination and credential route; retain a narrow permission rule; and choose a safe failure state that does not inherit unrelated capabilities. Then test malformed configuration, partial failure, and the point where a restriction vanishes. This is how a convenience feature avoids becoming silent privilege expansion.
The public Claude-session link and bot co-authorship prove coding-agent involvement in this PR record, not who wrote every line or whether DashScope is suitable for a particular deployment. The next useful receipt is a public operator report that exercises approval, cost, source retention, and failure handling together under a configured account.