Add ask-web and tts: the two AI tools we already pay for

[ralyodio]

From a list of 131 AI tools, the useful question was which of them are actually ours. The team vault answers it: of the 13 keys in profullstack-sharable-keys--prod, five appear on that list — OpenAI, Anthropic, Perplexity, ElevenLabs, Gemini — and two of those had no command here.

Command	What it does
ask-web	Perplexity: a question answered from the live web, with the pages it came from
tts	ElevenLabs: text read aloud in a named voice, audio kept

Neither is named ask or say — both already resolve to something else on PATH, and a command that shadows another one silently is worse than a longer name. No pit alias, for the same reason.

The parts worth reviewing

ask-web numbers its sources from citations, not search_results. The response carries both, and they are not redundant: citations is a positional URL list whose order is the [n] the model wrote, while search_results carries the titles in whatever order it likes. Numbering from the titles would mislabel every source, quietly. A marker the answer cites with no source behind it is reported on stderr rather than dropped.

tts refuses an ambiguous voice. Voices are called things like River - Relaxed, Neutral, Informative, so a name may be an ID, the full label, or just the human part. A prefix matching two voices is an error naming both — a silent pick would change narrator the day the account gains a voice, with nothing on screen to explain why. voice_settings is omitted entirely unless asked for, so a call cannot overwrite what a shared account tuned in the dashboard.

KNOWN_KEYS gains perplexity and elevenlabs. The rule that kept it at two still holds — a key earns its place by being read by a command here, not by being one the team owns — and the vault's other nine stay in the vault.

Gemini is deliberately absent

It was the third candidate. The vault's GEMINI_API_KEY returns 400 User location is not supported for the API use from this network, so a provider built on it would ship broken. Worth knowing before someone tries again.

Verification

• 224 tests pass (57 new), pnpm typecheck clean.
• Both commands exercised against the live APIs: a real answer with 20 resolvable sources, and a valid 128kbps 44.1kHz MP3.
• cli-tools list and cli-tools config pick both up.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

6 finding(s)

MEDIUM: 1 | LOW: 5

Severity	Rule	Location
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
LOW	insecure-temp-file	test/blog.test.ts:73
LOW	insecure-temp-file	test/blog.test.ts:74
LOW	insecure-temp-file	test/credentials.test.ts:43
LOW	insecure-temp-file	test/credentials.test.ts:44
LOW	secret-generic-api-key	test/credentials.test.ts:208

Snippets are redacted; ThreatCrush never prints matched credential material.