bidi2pdf 0.1.13 → 0.1.15

data/lib/bidi2pdf/session_warmer.rb

@@ -0,0 +1,377 @@
+# frozen_string_literal: true
+
+module Bidi2pdf
+  # Keeps a small number of Chrome sessions pre-warmed (chromedriver started, WebSocket connected,
+  # browser ready) so a render can skip that startup latency on the request path. Isolation matches
+  # today's one-Chrome-per-render model exactly: every checked-out slot is used for exactly one
+  # +with_tab+ block and then retired (never returned to the cache) - only a fresh replacement is
+  # warmed in its place, off the request path. Checkout never waits for a warm slot: one is used if
+  # it is ready, otherwise a slot is created synchronously on the spot, i.e. today's exact behavior
+  # for that one render - including its failure mode: if that cold start fails, the error propagates
+  # out of +with_tab+ exactly as it would without the warmer.
+  #
+  # @example Rails initializer
+  #   Bidi2pdf::SessionWarmer.configure do |c|
+  #     c.size = 2
+  #     c.headless = true
+  #   end
+  #
+  # @example Per-request usage
+  #   Bidi2pdf::SessionWarmer.with_tab do |tab|
+  #     tab.navigate_to(url)
+  #     tab.print("invoice.pdf")
+  #   end
+  class SessionWarmer
+    # Configuration for the session warmer.
+    class Configuration
+      # @return [Integer] Number of Chrome slots to keep pre-warmed.
+      attr_accessor :size
+
+      # @return [Boolean] Whether to run Chrome in headless mode.
+      attr_accessor :headless
+
+      # @return [Array<String>] Chrome launch arguments.
+      attr_accessor :chrome_args
+
+      # @return [String, nil] A remote chromedriver session URL (e.g. a `remote-chrome` sidecar). When
+      #   set, a slot connects directly to it instead of spawning a local ChromedriverManager -
+      #   mirrors Launcher#session's own local/remote branch.
+      attr_accessor :remote_browser_url
+
+      # @return [#call, nil] Optional factory callable that returns a slot hash - injectable for tests.
+      #   A custom factory owns the cleanup of anything it half-built before raising: the warmer can
+      #   only retire a slot it was actually handed.
+      attr_accessor :slot_factory
+
+      # @return [Numeric, nil] Seconds a warm slot may sit unused before it is retired and replaced.
+      #   A warm slot is an open, unauthenticated automation endpoint (chromedriver's port, Chrome's
+      #   debugging port) for as long as it idles, so that window is bounded by default. A slot older
+      #   than this is never handed out, and a background reaper recycles idle ones within roughly
+      #   1.25x this value even when no render ever comes. +nil+ disables the limit.
+      attr_accessor :max_idle_age
+
+      DEFAULT_MAX_IDLE_AGE = 300
+
+      def initialize
+        @size = 1
+        @headless = true
+        @chrome_args = Bidi2pdf::Bidi::Session::DEFAULT_CHROME_ARGS
+        @remote_browser_url = nil
+        @slot_factory = nil
+        @max_idle_age = DEFAULT_MAX_IDLE_AGE
+      end
+
+      # @raise [ArgumentError] if a setting can't be honored - checked once, at construction.
+      def validate!
+        validate_size!
+        validate_max_idle_age!
+      end
+
+      private
+
+      def validate_size!
+        return if size.is_a?(Integer) && !size.negative?
+
+        raise ArgumentError, "size must be a non-negative Integer, got #{size.inspect}"
+      end
+
+      def validate_max_idle_age!
+        return if max_idle_age.nil? || (max_idle_age.is_a?(Numeric) && max_idle_age.positive?)
+
+        raise ArgumentError, "max_idle_age must be nil or a positive number of seconds, got #{max_idle_age.inspect}"
+      end
+    end
+
+    class << self
+      # Configures the warmer and eagerly (re)creates the singleton, warming config.size slots right
+      # here - at boot/configuration time, off the request path - instead of lazily on whichever
+      # request happens to trigger the first #with_tab (which would otherwise pay for every
+      # configured slot, serially, on that one unlucky request).
+      def configure
+        @config = Configuration.new
+        yield @config if block_given?
+        @instance&.shutdown
+        # Cleared first: if the constructor below raises, a stale, already-shut-down instance must
+        # not stay registered (it would keep serving cold slots but never warm again).
+        @instance = nil
+        @instance = new(@config, slot_factory: @config.slot_factory)
+      end
+
+      # Returns the warmer's configuration, initializing defaults if needed.
+      def config
+        @config ||= Configuration.new
+      end
+
+      # Returns a callable that creates one real, fully-warmed Chrome slot from +config+. If building
+      # fails part-way (chromedriver up, but the session or its browser never came ready), whatever
+      # already exists is retired before the error propagates - no caller ever gets a reference to a
+      # half-built slot, so nobody else could clean it up.
+      def default_slot_factory(config)
+        lambda do
+          parts = {}
+          build_slot(config, parts)
+        rescue StandardError
+          retire_slot(session: parts[:session], manager: parts[:manager])
+          raise
+        end
+      end
+
+      # Closes a slot's session and stops its chromedriver (nil for a remote slot, or for a part that
+      # was never created). Each step is independent: a failure in one is logged, never raised, and
+      # never skips the other.
+      def retire_slot(session:, manager:)
+        safe_close("session") { session&.close }
+        safe_close("manager") { manager&.stop }
+      end
+
+      def safe_close(label)
+        yield
+      rescue StandardError => e
+        Bidi2pdf.logger.warn "session_warmer: error closing #{label}: #{e.message}"
+      end
+
+      # Returns the shared singleton warmer instance, creating it (and pre-warming it) on first call.
+      def instance
+        @instance ||= new(config, slot_factory: config.slot_factory)
+      end
+
+      # Checks out a slot, yields a fresh tab for one render, then retires the slot.
+      def with_tab(&)
+        instance.with_tab(&)
+      end
+
+      # Retires every currently-warm spare and resets the singleton.
+      def shutdown
+        @instance&.shutdown
+        @instance = nil
+      end
+
+      private
+
+      # Records each part in +parts+ the moment it exists, so #default_slot_factory's rescue can
+      # retire exactly what was created so far. Mirrors Launcher#session's local/remote branch.
+      def build_slot(config, parts)
+        config.remote_browser_url ? connect_remote(config, parts) : start_local(config, parts)
+
+        { session: parts[:session], browser: parts[:session].browser, manager: parts[:manager] }
+      end
+
+      def connect_remote(config, parts)
+        parts[:session] = Bidi2pdf::Bidi::Session.new(
+          session_url: config.remote_browser_url,
+          headless: config.headless,
+          chrome_args: config.chrome_args
+        )
+      end
+
+      def start_local(config, parts)
+        parts[:manager] = Bidi2pdf::ChromedriverManager.new(port: 0, headless: config.headless, chrome_args: config.chrome_args)
+        parts[:manager].start
+        parts[:session] = parts[:manager].session
+      end
+    end
+
+    def initialize(config, slot_factory: nil)
+      config.validate!
+      @config = config
+      @slot_factory = slot_factory || self.class.default_slot_factory(config)
+      @mutex = Mutex.new
+      @available = []
+      @replenish_threads = []
+      @warming = 0
+      @shutdown = false
+      @reaper_wakeup = Thread::Queue.new
+      prewarm
+      @reaper = Thread.new { reap_loop } if @config.max_idle_age
+    end
+
+    # Checks out a slot, creates an isolated UserContext/Window/Tab for one render, yields the tab,
+    # then unconditionally closes those resources and retires the underlying slot.
+    def with_tab
+      slot = checkout
+      user_context = nil
+      window = nil
+      tab = nil
+
+      begin
+        user_context = slot[:browser].create_user_context
+        window = user_context.create_browser_window
+        tab = window.create_browser_tab
+        yield tab
+      ensure
+        safe_close("tab") { tab&.close }
+        safe_close("window") { window&.close }
+        safe_close("user context") { user_context&.close }
+        retire(slot)
+      end
+    end
+
+    # Retires every currently-warm spare and waits for any in-flight background replenishment to
+    # finish (each of those, seeing @shutdown, retires its own result instead of stashing it - see
+    # #stash_or_retire). A subsequent #with_tab still works - it just falls back to a synchronous
+    # slot, since checkout never depends on a warm one being there.
+    def shutdown
+      spares, threads = @mutex.synchronize do
+        @shutdown = true
+        [@available.dup.tap { @available.clear }, @replenish_threads.dup.tap { @replenish_threads.clear }]
+      end
+
+      @reaper_wakeup << :stop
+      @reaper&.join
+      threads.each(&:join)
+      spares.each { |slot| retire(slot) }
+    end
+
+    private
+
+    # Fail-fast on purpose (a Chrome that can't start at boot should be loud), but not leaky: if slot
+    # N fails, no instance is returned to own slots 1..N-1, so they are retired here first.
+    def prewarm
+      @config.size.times { @available << stamp(create_slot) }
+    rescue StandardError
+      @available.each { |slot| retire(slot) }
+      @available.clear
+      raise
+    end
+
+    def create_slot
+      @slot_factory.call
+    end
+
+    # Session#started? is just an internal flag set once at startup - it never flips back if Chrome,
+    # ChromeDriver, or the WebSocket dies externally while a slot sits idle in the cache. The
+    # client's own #open? is kept live by the reader thread noticing a real socket error, so
+    # checking it too catches that case - cheap (no network round trip), though still a heuristic,
+    # not a full liveness guarantee (a stuck-but-not-yet-disconnected socket still reads healthy).
+    def healthy?(slot)
+      slot[:session].started? && slot[:session].client&.open? == true
+    end
+
+    def now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+
+    # Marks the moment a slot entered the cache - idle age counts from here, not from when its
+    # Chrome started, since it is the unattended waiting that max_idle_age bounds.
+    def stamp(slot)
+      slot.merge(warmed_at: now)
+    end
+
+    def expired?(slot)
+      !@config.max_idle_age.nil? && now - slot[:warmed_at] > @config.max_idle_age
+    end
+
+    # Checkout alone can't bound idle time: with no traffic nothing would ever look at a spare. This
+    # thread does, four times per max_idle_age, so an unused slot is recycled within ~1.25x of it.
+    # Thread::Queue#pop(timeout:) doubles as an interruptible sleep - #shutdown pushes :stop.
+    def reap_loop
+      interval = [@config.max_idle_age / 4.0, 0.05].max
+      recycle_expired until @reaper_wakeup.pop(timeout: interval) == :stop
+    end
+
+    def recycle_expired
+      expired = @mutex.synchronize do
+        next [] if @shutdown
+
+        old, fresh = @available.partition { |slot| expired?(slot) }
+        @available.replace(fresh)
+        old
+      end
+      return if expired.empty?
+
+      Bidi2pdf.notification_service.instrument("session_warmer.expired.bidi2pdf", { count: expired.size })
+      replenish_async
+      expired.each { |slot| retire(slot) }
+    rescue StandardError => e
+      Bidi2pdf.logger.warn "session_warmer: recycling idle slots failed: #{e.message}"
+    end
+
+    # A warm hit takes the spare and triggers a background replacement; a miss (empty cache, or a
+    # spare that died while idle) falls straight through to a synchronous slot - it never waits, so
+    # an under-provisioned warmer is never worse than not having one. A cold start that fails raises,
+    # as it would without the warmer.
+    #
+    # Oldest spare first (shift, not pop), so no slot lingers at the bottom of the cache while newer
+    # ones are used; and one past max_idle_age is never handed out, even if the reaper hasn't got to
+    # it yet - it is retired like a dead spare and this render cold-starts instead.
+    def checkout
+      slot = @mutex.synchronize { @available.shift }
+      had_spare = !slot.nil?
+      hit = had_spare && !expired?(slot) && healthy?(slot)
+      taken = nil
+
+      Bidi2pdf.notification_service.instrument("session_warmer.checkout.bidi2pdf", { hit: hit }) do
+        taken = hit ? slot : cold_checkout(slot)
+      end
+
+      # Every checkout tops the cache back up, hit or miss - #replenish_async itself bounds the work
+      # to the current deficit, so a miss on an already-full-or-filling cache starts nothing.
+      replenish_async
+      taken
+    end
+
+    def cold_checkout(dead_slot)
+      retire(dead_slot) if dead_slot
+      create_slot
+    end
+
+    # Tops the cache up towards config.size, counting warmers already in flight. Deficit-based on
+    # purpose, not "replace what this checkout popped": that rule could never recover from a single
+    # failed warm (nothing stashed -> every later checkout a miss -> never replenished again), while
+    # replenishing unconditionally let @available grow without bound under a burst of misses.
+    # available + warming never exceeds config.size, and a failed warm frees its reservation, so the
+    # next checkout simply tries again.
+    #
+    # Threads are created and registered inside the same critical section, so #shutdown's snapshot
+    # can't miss one that has started but isn't listed yet (#warm_one needs this mutex to finish,
+    # so it just waits for it).
+    def replenish_async
+      @mutex.synchronize do
+        next if @shutdown
+
+        @replenish_threads.select!(&:alive?)
+        deficit = @config.size - (@available.size + @warming)
+        deficit.times do
+          @warming += 1
+          @replenish_threads << Thread.new { warm_one }
+        end
+      end
+    end
+
+    def warm_one
+      slot = create_slot
+    rescue StandardError => e
+      @mutex.synchronize { @warming -= 1 }
+      Bidi2pdf.logger.warn "session_warmer: failed to warm a replacement slot: #{e.message}"
+      Bidi2pdf.notification_service.instrument("session_warmer.warm_failed.bidi2pdf", { error: e.class.name })
+    else
+      stash_or_retire(slot)
+    end
+
+    # A replacement warmed after #shutdown has nothing to stash into - retire it immediately rather
+    # than leaking a live Chrome process that nothing will ever check out. Either way this warmer's
+    # reservation is released here, in the same critical section as the stash.
+    def stash_or_retire(slot)
+      discard = @mutex.synchronize do
+        @warming -= 1
+
+        if @shutdown
+          true
+        else
+          @available << stamp(slot)
+          false
+        end
+      end
+
+      retire(slot) if discard
+    end
+
+    def retire(slot)
+      self.class.retire_slot(session: slot[:session], manager: slot[:manager])
+    end
+
+    def safe_close(label, &)
+      self.class.safe_close(label, &)
+    end
+  end
+end

data/lib/bidi2pdf/test_helpers/images.rb

@@ -6,6 +6,14 @@ rescue LoadError
   warn "Missing #{dep}. Add it to your Gemfile if you're using Bidi2pdf image test helpers."
 end
 
+# CVE-2026-66066 (Rails Active Storage, 2026-07-29): libvips ships loaders/savers that were never
+# fuzz-tested (SVG, JPEG XL, JPEG 2000, BMP, ICO, PSD, anything delegated to ImageMagick, ...) -
+# left reachable, a crafted file can trigger arbitrary file read or RCE. Applied once, here, for
+# every consumer of this opt-in module (Extractor, ImageSimilarityChecker, contains_pdf_image),
+# rather than left to each call site to remember - PNG/JPEG (what this gem's own screenshot/PDF
+# rendering actually produces) load through already-fuzzed loaders and are unaffected.
+Vips.block_untrusted(true) if defined?(Vips)
+
 require_relative "images/tiff_helper"
 require_relative "images/extractor"
 require_relative "images/image_similarity_checker"

data/lib/bidi2pdf/test_helpers/pdf_reader_utils.rb

@@ -49,7 +49,7 @@ module Bidi2pdf
         # @param pdf_data [String, StringIO, File] The PDF data to be converted.
         # @return [IO] An IO object containing the PDF data.
         def convert_data_to_io(pdf_data)
-          # rubocop:disable Lint/DuplicateBranch
+          # rubocop:disable-next Lint/DuplicateBranch
           if pdf_data.is_a?(String) && (pdf_data.start_with?("JVBERi") || pdf_data.start_with?("JVBER"))
             StringIO.new(Base64.decode64(pdf_data))
           elsif pdf_data.start_with?("%PDF-")
@@ -61,7 +61,6 @@ module Bidi2pdf
           else
             StringIO.new(pdf_data)
           end
-          # rubocop:enable Lint/DuplicateBranch
         end
       end
 

data/lib/bidi2pdf/test_helpers/pdf_text_sanitizer.rb

@@ -6,7 +6,7 @@ require "diff/lcs/hunk"
 
 module Bidi2pdf
   module TestHelpers
-    # rubocop: disable Metrics/ModuleLength
+    # rubocop: disable-next Metrics/ModuleLength
     module PDFTextSanitizer
       class << self
         def clean(text)
@@ -148,6 +148,5 @@ module Bidi2pdf
         end
       end
     end
-    # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/bidi2pdf/test_helpers/testcontainers/chromedriver_container.rb

@@ -73,7 +73,7 @@ module Bidi2pdf
         # rubocop: enable Metrics/AbcSize
 
         def session_url(protocol: "http")
-          "#{protocol}://#{host}:#{mapped_port(port)}/session"
+          ContainerEndpoint.new(self, port).url(scheme: protocol, path: "session")
         end
       end
     end

data/lib/bidi2pdf/test_helpers/testcontainers/chromedriver_test_helper.rb

@@ -36,6 +36,24 @@ module Bidi2pdf
         def create_session(session_url)
           Bidi2pdf::Bidi::Session.new(session_url: session_url, headless: true, chrome_args: chrome_args)
         end
+
+        # Full session/tab lifecycle in one call - create_session above only builds the session
+        # object, it never starts or closes it, and there is no after(:each) teardown for a spec
+        # that uses it directly. Mirrors Bidi2pdf::DSL.with_tab's own ensure-based teardown, but
+        # against a session_url this module already knows about (a long-lived remote-chrome
+        # reached over `session:` metadata, not a freshly spawned local chromedriver per call).
+        def with_tab(session_url)
+          session = create_session(session_url)
+          session.start
+          user_context = session.browser.create_user_context
+          tab = user_context.create_browser_window
+
+          yield tab
+        ensure
+          tab&.close
+          user_context&.close
+          session&.close
+        end
       end
     end
   end
@@ -52,7 +70,8 @@ RSpec.configure do |config|
       config.chromedriver_container = start_chromedriver_container(
         build_dir: File.join(Bidi2pdf::TestHelpers.configuration.docker_dir, ".."),
         mounts: config.respond_to?(:chromedriver_mounts) ? config.chromedriver_mounts : {},
-        shared_network: config.shared_network
+        shared_network: config.shared_network,
+        chromedriver_log_level: config.respond_to?(:chromedriver_log_level) ? config.chromedriver_log_level : "WARNING"
       )
 
       reporter.message("🚀 chromedriver container started for tests")
@@ -103,12 +122,13 @@ end
 # alias the long class name
 ChromedriverTestcontainer = Bidi2pdf::TestHelpers::Testcontainers::ChromedriverContainer
 
-def start_chromedriver_container(build_dir:, mounts:, shared_network:)
+def start_chromedriver_container(build_dir:, mounts:, shared_network:, chromedriver_log_level: "WARNING")
   container = ChromedriverTestcontainer.new(ChromedriverTestcontainer::DEFAULT_IMAGE,
                                             build_dir: build_dir,
                                             docker_file: "docker/Dockerfile.chromedriver")
                                        .with_network(shared_network)
                                        .with_network_aliases("remote-chrome")
+                                       .with_env("CHROMEDRIVER_LOG_LEVEL", chromedriver_log_level)
 
   container.with_filesystem_binds(mounts) if mounts&.any?
 

data/lib/bidi2pdf/test_helpers/testcontainers/container_endpoint.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Bidi2pdf
+  module TestHelpers
+    module Testcontainers
+      # Builds a URL for reaching a container's published port from the test
+      # process, using the container's own host/port resolution.
+      class ContainerEndpoint
+        def initialize(container, port)
+          @container = container
+          @port = port
+        end
+
+        def url(scheme: "http", path: "")
+          "#{scheme}://#{@container.accessible_host}:#{@container.mapped_port(@port)}/#{path}"
+        end
+
+        # Address reachable from another container on the same Docker network (e.g. remote-chrome
+        # reaching nginx), by alias and internal port - as opposed to #url's host-accessible,
+        # externally-mapped port. Uses the same @port this instance was built with, not a
+        # container_ports.first guess: the two methods must agree on which port they're both
+        # describing for the same container, or a caller comparing #url and #alias_url for what's
+        # meant to be the same endpoint could silently get two different services.
+        def alias_url(scheme: "http", path: "")
+          "#{scheme}://#{@container.aliases.first}:#{@port}/#{path}"
+        end
+      end
+    end
+  end
+end

data/lib/bidi2pdf/test_helpers/testcontainers/testcontainers_refinement.rb

@@ -29,6 +29,39 @@ module Bidi2pdf
         self
       end
 
+      def container_json
+        @_container&.json
+      end
+
+      # Address of the Docker host at which this container's *mapped* ports
+      # are reachable from the test process.
+      #
+      # Resolution belongs to testcontainers: it honours TC_HOST, a tcp:/ssh:
+      # DOCKER_HOST, a native local daemon, and a sibling container reaching
+      # the daemon over the bridge gateway — and it derives #mapped_port from
+      # the same decision, so the two must stay on one path. We only add a
+      # fallback for the cases 0.2.0 leaves unresolved.
+      #
+      # This is not the address containers use to reach each other; for that
+      # the helpers join a shared network and address containers by alias.
+      def accessible_host
+        resolved_host || "localhost"
+      end
+
+      # testcontainers-core 0.2.0 cannot resolve a host when the test process
+      # runs inside a container and the container under test is on a custom
+      # network: #container_gateway_ip hardcodes the "bridge" network key
+      # (docker_container.rb:1074), so #host returns nil. On the default
+      # bridge it can instead reach docker_container.rb:703, which calls an
+      # undefined `bridge_ip`. Both are fixed on testcontainers-ruby main;
+      # treat either as "unresolved" and fall back.
+      def resolved_host
+        value = host
+        value unless value.nil? || value.empty?
+      rescue NoMethodError
+        nil
+      end
+
       def _container_create_options
         opts = super
         network_name = network&.info&.[]("Name")

data/lib/bidi2pdf/test_helpers/testcontainers.rb

@@ -10,6 +10,7 @@ module Bidi2pdf
   module TestHelpers
     module Testcontainers
       require_relative "testcontainers/testcontainers_refinement"
+      require_relative "testcontainers/container_endpoint"
       require_relative "testcontainers/chromedriver_container"
       require_relative "testcontainers/chromedriver_test_helper"
     end

data/lib/bidi2pdf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bidi2pdf
-  VERSION = "0.1.13"
+  VERSION = "0.1.15"
 end

data/lib/bidi2pdf.rb

@@ -9,6 +9,7 @@ require_relative "bidi2pdf/bidi/session"
 require_relative "bidi2pdf/dsl"
 require_relative "bidi2pdf/notifications"
 require_relative "bidi2pdf/notifications/logging_subscriber"
+require_relative "bidi2pdf/session_warmer"
 require_relative "bidi2pdf/verbose_logger"
 
 module Bidi2pdf
@@ -51,6 +52,8 @@ module Bidi2pdf
 
   class PrintError < Error; end
 
+  class ScreenshotError < Error; end
+
   class ScriptInjectionError < Error; end
 
   class StyleInjectionError < Error; end
@@ -85,7 +88,7 @@ module Bidi2pdf
   # Global configuration for Bidi2pdf
 
   class << self
-    attr_accessor :default_timeout, :enable_default_logging_subscriber
+    attr_accessor :default_timeout, :enable_default_logging_subscriber, :log_truncate_limit, :chromedriver_log_level
     attr_reader :logging_subscriber, :logger, :network_events_logger, :browser_console_logger, :notification_service
 
     # Allow configuration through a block
@@ -108,6 +111,26 @@ module Bidi2pdf
       end
     end
 
+    # Truncates a value for safe log output - a raw url/param can be a `data:` URL whose base64
+    # payload is proportional to document size, and logging it whole can be large enough to choke
+    # CI log ingestion (confirmed live: GitHub Actions' log UI stalls badly on very long single
+    # lines, reading as a hung job even though the process underneath is fine).
+    #
+    # @param [Object] value The value to truncate (converted via #to_s).
+    # @param [Integer] limit The maximum number of bytes to keep. Defaults to
+    #   +Bidi2pdf.log_truncate_limit+, itself configurable via +Bidi2pdf.configure+.
+    # @return [String] The value unchanged if short enough, otherwise a truncated prefix plus a
+    #   byte-count marker. Truncation is byte-based (not character-based), since the goal is
+    #   bounding actual log-entry size; a partial trailing multi-byte character is scrubbed rather
+    #   than left as invalid UTF-8.
+    def truncate_for_log(value, limit: log_truncate_limit)
+      str = value.to_s
+      return str if str.bytesize <= limit
+
+      truncated = str.byteslice(0, limit).scrub("")
+      "#{truncated}... (#{str.bytesize} bytes total)"
+    end
+
     def translate_paper_format(format)
       format = format.to_s.downcase.to_sym
 
@@ -159,6 +182,8 @@ module Bidi2pdf
 
     config.default_timeout = 60
 
+    config.log_truncate_limit = 200
+
     config.notification_service = Notifications
   end
 end

data/sig/bidi2pdf/bidi/add_headers_interceptor.rbs

@@ -1,20 +1,27 @@
 module Bidi2pdf
   module Bidi
     class AddHeadersInterceptor
-      @id: String
-      @client: untyped
-      @headers: Hash[String, String]
+      @headers: untyped
 
-      attr_reader id: String
-      attr_reader headers: Hash[String, String]
+      @url_patterns: untyped
 
-      def initialize: (String id, Hash[String, String] headers, untyped client) -> void
+      @context: untyped
 
-      def handle_event: (Hash[String, untyped] response) -> (nil | untyped)
+      include Interceptor
 
-      private
+      def self.phases: () -> ::Array[untyped]
 
-      attr_reader client: untyped
+      def self.events: () -> ::Array["network.beforeRequestSent"]
+
+      attr_reader headers: untyped
+
+      attr_reader url_patterns: untyped
+
+      attr_reader context: untyped
+
+      def initialize: (headers: untyped, url_patterns: untyped, context: untyped) -> void
+
+      def process_interception: (untyped _event_response, untyped _navigation_id, untyped network_id, untyped _url) -> untyped
     end
   end
 end