Tier 2: check the marketplace before capturing a site

[giordano-lucas]

Stack: 2 of 3. Based on #119 — review that first; this PR's diff is against it.

What

The highest-intent moment in the whole funnel: the user is about to spend a capture run and tokens on a site that may already be covered. Agent mode now checks first.

 anything already has 3 functions for nfl.com
   · get_current_nfl_week (8 runs)
     Returns the NFL season, week number, season and week types...
     https://anything.notte.cc/marketplace/b9d2b07c-...

? Open the marketplace instead of capturing? (y/N)

Enter carries on capturing. It's an offer, not a toll gate.

Also adds reverse-api-engineer marketplace search (with --site, --limit, --json), a /cloud slash command, a one-line post-capture hint about hosting the client, and a cloud_suggestions setting.

Design decisions worth reviewing

No false positives. The public endpoint ranks rather than filters — querying a site it has never seen still returns a full page of other people's functions. search_for_site therefore discards every result whose own domain doesn't sit under the target's registrable domain. Verified live: nfl.com → 8 matches, jobs.ashbyhq.com → 0. A suggestion for the wrong site would be worse than no suggestion, and would poison trust in the feature permanently.

Every failure degrades to silence. Offline, DNS failure, timeout, non-JSON body, malformed entries, unexpected exceptions — all return []. A capture must never fail because a marketing lookup did. There's a test for each path.

Cold starts, and why the timeout is 12s. I measured the endpoint: ~0.3s warm, but ~5–8s after an idle period and occasionally worse. My first pass used a 2.5s timeout and silently returned zero matches for sites that definitely have them — the worst possible outcome, since the feature looks broken exactly when it would have helped. It's now a generous timeout plus a visible spinner. A very cold call can still exceed it; that degrades to no suggestions, which is acceptable.

Opt-out. RAE_NO_CLOUD=1 wins over the config setting, so CI and scripted wrappers can disable the network call without touching a user's settings file. The hook is also skipped entirely when non-interactive or headless, so --json / --json-stream / --no-interactive behaviour is completely unchanged.

Verification

• 62 new tests (tests/test_cloud.py, tests/test_cli_marketplace.py), all offline via a stubbed requests.get; full suite is 926 passed, 1 skipped.
• Smoke-tested live against the real endpoint: bare group, --site hit, --site miss, and --json.
• ruff check and ruff format clean on all new files. _handle_settings_action complexity goes 27 → 29 against a 25 threshold, but it already exceeded it on main — I added one elif branch and did not refactor the function in this PR.

Note

Uses requests (a declared dependency) rather than httpx, which utils.py imports but which is only present transitively via claude-agent-sdk.

🤖 Generated with Claude Code

[giordano-lucas]

Updated: base_url and category now filter server-side

The search endpoint gained real server-side filtering, so the client-side workaround this PR originally shipped is gone (0cfea2f).

Before — over-fetch 20 results from q=<registrable domain>, then discard everything whose domain didn't match.
Now — pass the target URL straight to base_url and let the endpoint scope it.

Verified live, all forms work and all return the same 8 nfl.com results:

base_url	total
nfl.com	8
https://www.nfl.com/standings?x=1	8
www.nfl.com	8
nfl	8
*.nfl.*	8
fantasy.nfl.com	1
jobs.ashbyhq.com	0

Filters compose too: base_url=nfl.com + q=standings → exactly 1 result.

Also added: --category on marketplace search, and a guard that refuses a call with no filter at all (an unfiltered request returns the most-run functions overall, which is never what a caller here means).

One thing I kept: registrable_domain and the post-fetch domain re-check. Server-side matching is intentionally fuzzy — base_url=nfl matches nfl.com — and registrable_domain also does duty rejecting inputs that aren't sites at all (localhost, IP literals, free text) before any request goes out. The guard is now a cheap backstop rather than the primary mechanism.

Tests updated accordingly: 932 passed, 1 skipped. #121 rebased on top, with the now-incorrect "the endpoint ranks rather than filters" rationale removed from examples/hosted/ and /docs/cloud.