@asterxsk/kiln 0.1.0

package/agent/extensions/pi-web-access/test/config-path.test.mjs

@@ -0,0 +1,283 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+
+const utilsUrl = new URL("../utils.ts", import.meta.url).href;
+const exaUrl = new URL("../exa.ts", import.meta.url).href;
+const geminiApiUrl = new URL("../gemini-api.ts", import.meta.url).href;
+
+function runChild(script, env) {
+	const childEnv = { ...process.env };
+	delete childEnv.EXA_API_KEY;
+	delete childEnv.GEMINI_API_KEY;
+	delete childEnv.GOOGLE_GEMINI_BASE_URL;
+	delete childEnv.CLOUDFLARE_API_KEY;
+	for (const [key, value] of Object.entries(env)) {
+		if (value === undefined) {
+			delete childEnv[key];
+		} else {
+			childEnv[key] = value;
+		}
+	}
+	return spawnSync(process.execPath, ["--input-type=module"], {
+		input: script,
+		encoding: "utf8",
+		env: childEnv,
+	});
+}
+
+test("web-search config path uses PI_CODING_AGENT_DIR before XDG_CONFIG_HOME", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-config-path-"));
+	const agentDir = join(root, "agent-dir");
+	const xdgDir = join(root, "xdg");
+	await mkdir(agentDir, { recursive: true });
+	await mkdir(join(xdgDir, "pi"), { recursive: true });
+	await writeFile(join(agentDir, "web-search.json"), JSON.stringify({ exaApiKey: "exa-from-agent" }) + "\n", "utf8");
+	await writeFile(join(xdgDir, "pi", "web-search.json"), JSON.stringify({}) + "\n", "utf8");
+
+	const child = runChild(`
+		const { getWebSearchConfigDir, getWebSearchConfigPath } = await import(${JSON.stringify(utilsUrl)});
+		const { isExaAvailable } = await import(${JSON.stringify(exaUrl)});
+		console.log(JSON.stringify({
+			dir: getWebSearchConfigDir(),
+			path: getWebSearchConfigPath(),
+			available: isExaAvailable(),
+		}));
+	`, {
+		PI_CODING_AGENT_DIR: agentDir,
+		XDG_CONFIG_HOME: xdgDir,
+		HOME: join(root, "home"),
+		USERPROFILE: join(root, "home"),
+	});
+
+	assert.equal(child.status, 0, child.stderr);
+	assert.deepEqual(JSON.parse(child.stdout), {
+		dir: agentDir,
+		path: join(agentDir, "web-search.json"),
+		available: true,
+	});
+});
+
+test("web-search config path uses XDG_CONFIG_HOME pi directory when agent dir is unset", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-xdg-config-"));
+	const xdgDir = join(root, "xdg");
+	await mkdir(join(xdgDir, "pi"), { recursive: true });
+	await writeFile(join(xdgDir, "pi", "web-search.json"), JSON.stringify({ geminiApiKey: "gemini-from-xdg" }) + "\n", "utf8");
+
+	const child = runChild(`
+		const { getWebSearchConfigDir, getWebSearchConfigPath } = await import(${JSON.stringify(utilsUrl)});
+		const { isGeminiApiAvailable } = await import(${JSON.stringify(geminiApiUrl)});
+		console.log(JSON.stringify({
+			dir: getWebSearchConfigDir(),
+			path: getWebSearchConfigPath(),
+			available: isGeminiApiAvailable(),
+		}));
+	`, {
+		PI_CODING_AGENT_DIR: undefined,
+		XDG_CONFIG_HOME: xdgDir,
+		HOME: join(root, "home"),
+		USERPROFILE: join(root, "home"),
+	});
+
+	assert.equal(child.status, 0, child.stderr);
+	assert.deepEqual(JSON.parse(child.stdout), {
+		dir: join(xdgDir, "pi"),
+		path: join(xdgDir, "pi", "web-search.json"),
+		available: true,
+	});
+});
+
+test("Gemini base URL and Cloudflare auth use env before config", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-base-url-"));
+	const agentDir = join(root, "agent-dir");
+	await mkdir(agentDir, { recursive: true });
+	await writeFile(join(agentDir, "web-search.json"), JSON.stringify({
+		geminiBaseUrl: "https://config.example.com/gemini/",
+		cloudflareApiKey: "config-cf-key",
+	}) + "\n", "utf8");
+
+	const child = runChild(`
+		const {
+			getApiHost,
+			getVersionedApiBase,
+			buildAuthHeaders,
+			isGeminiApiAvailable,
+		} = await import(${JSON.stringify(geminiApiUrl)});
+		console.log(JSON.stringify({
+			host: getApiHost(),
+			base: getVersionedApiBase(),
+			headers: buildAuthHeaders(),
+			available: isGeminiApiAvailable(),
+		}));
+	`, {
+		PI_CODING_AGENT_DIR: agentDir,
+		XDG_CONFIG_HOME: undefined,
+		HOME: join(root, "home"),
+		USERPROFILE: join(root, "home"),
+		GOOGLE_GEMINI_BASE_URL: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio/",
+		CLOUDFLARE_API_KEY: "env-cf-key",
+	});
+
+	assert.equal(child.status, 0, child.stderr);
+	assert.deepEqual(JSON.parse(child.stdout), {
+		host: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio",
+		base: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio/v1beta",
+		headers: { "cf-aig-authorization": "Bearer env-cf-key" },
+		available: true,
+	});
+});
+
+test("Gemini command source is lazy, overrides stale env, rotates, and uses header auth", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-command-"));
+	const agentDir = join(root, "agent-dir");
+	const commandPath = join(root, "read-key.mjs");
+	const counterPath = join(root, "counter");
+	await mkdir(agentDir, { recursive: true });
+	await writeFile(commandPath, `import { existsSync, readFileSync, writeFileSync } from "node:fs";\nconst counterPath = process.argv[2];\nconst count = (existsSync(counterPath) ? Number(readFileSync(counterPath, "utf8")) : 0) + 1;\nwriteFileSync(counterPath, String(count));\nprocess.stdout.write("synthetic-gemini-" + count);\n`, "utf8");
+	await writeFile(join(agentDir, "web-search.json"), JSON.stringify({
+		geminiApiKey: `!${JSON.stringify(process.execPath)} ${JSON.stringify(commandPath)} ${JSON.stringify(counterPath)}`,
+	}) + "\n", "utf8");
+
+	const child = runChild(`
+		import { existsSync } from "node:fs";
+		const requests = [];
+		globalThis.fetch = async (url, init) => {
+			requests.push({ url: String(url), headers: Object.fromEntries(new Headers(init.headers)) });
+			return new Response(JSON.stringify({ candidates: [{ content: { parts: [{ text: "ok" }] } }] }), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		};
+		const { isGeminiApiAvailable, queryGeminiApiWithVideo } = await import(${JSON.stringify(geminiApiUrl)});
+		const available = isGeminiApiAvailable();
+		const lazy = !existsSync(${JSON.stringify(counterPath)});
+		await queryGeminiApiWithVideo("first", "files/one", { timeoutMs: 1000 });
+		await queryGeminiApiWithVideo("second", "files/two", { timeoutMs: 1000 });
+		console.log(JSON.stringify({ available, lazy, requests }));
+	`, {
+		PI_CODING_AGENT_DIR: agentDir,
+		XDG_CONFIG_HOME: undefined,
+		HOME: join(root, "home"),
+		USERPROFILE: join(root, "home"),
+		GEMINI_API_KEY: "stale-gemini-environment-value",
+	});
+
+	assert.equal(child.status, 0, child.stderr);
+	const output = JSON.parse(child.stdout);
+	assert.equal(output.available, true);
+	assert.equal(output.lazy, true);
+	assert.deepEqual(output.requests.map(request => request.headers["x-goog-api-key"]), [
+		"synthetic-gemini-1",
+		"synthetic-gemini-2",
+	]);
+	for (const request of output.requests) {
+		assert.equal(new URL(request.url).searchParams.has("key"), false);
+		assert.equal(new URL(request.url).searchParams.has("api_key"), false);
+		assert.equal(request.url.includes("stale-gemini-environment-value"), false);
+	}
+});
+
+test("Gemini API helper rejects credential query parameters before fetch", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-query-reject-"));
+	const child = runChild(`
+		let fetchCalls = 0;
+		globalThis.fetch = async () => { fetchCalls += 1; return new Response("ok"); };
+		const { fetchGeminiApi } = await import(${JSON.stringify(geminiApiUrl)});
+		let message = "";
+		try {
+			await fetchGeminiApi("https://generativelanguage.googleapis.com/v1beta/models/test?API_KEY=synthetic-secret", {}, "synthetic-secret");
+		} catch (error) {
+			message = error.message;
+		}
+		console.log(JSON.stringify({ fetchCalls, message }));
+	`, {
+		PI_CODING_AGENT_DIR: undefined,
+		XDG_CONFIG_HOME: undefined,
+		HOME: join(root, "home"),
+		USERPROFILE: join(root, "home"),
+	});
+	assert.equal(child.status, 0, child.stderr);
+	const output = JSON.parse(child.stdout);
+	assert.equal(output.fetchCalls, 0);
+	assert.match(output.message, /query parameters are not allowed/);
+	assert.equal(output.message.includes("synthetic-secret"), false);
+});
+
+test("Gemini provider and transport errors redact the resolved credential", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-redaction-"));
+	const secret = "SYNTHETIC_GEMINI_SECRET_MUST_NOT_ESCAPE";
+	const child = runChild(`
+		let call = 0;
+		globalThis.fetch = async () => {
+			call += 1;
+			if (call === 1) return new Response(${JSON.stringify("provider echoed SYNTHETIC_GEMINI_SECRET_MUST_NOT_ESCAPE")}, { status: 400 });
+			throw new Error(${JSON.stringify("transport echoed SYNTHETIC_GEMINI_SECRET_MUST_NOT_ESCAPE")});
+		};
+		const { queryGeminiApiWithVideo } = await import(${JSON.stringify(geminiApiUrl)});
+		const messages = [];
+		for (let index = 0; index < 2; index += 1) {
+			try { await queryGeminiApiWithVideo("describe", "files/test", { timeoutMs: 1000 }); }
+			catch (error) { messages.push(error.message); }
+		}
+		console.log(JSON.stringify(messages));
+	`, {
+		PI_CODING_AGENT_DIR: undefined,
+		XDG_CONFIG_HOME: undefined,
+		HOME: join(root, "home"),
+		USERPROFILE: join(root, "home"),
+		GEMINI_API_KEY: secret,
+	});
+	assert.equal(child.status, 0, child.stderr);
+	const messages = JSON.parse(child.stdout);
+	assert.equal(messages.length, 2);
+	for (const message of messages) {
+		assert.equal(message.includes(secret), false);
+		assert.equal(message.includes("[redacted]"), true);
+	}
+});
+
+test("Gemini API requests include role and gateway auth headers", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-request-"));
+	const child = runChild(`
+		let capturedUrl = "";
+		let capturedHeaders = null;
+		let capturedBody = null;
+		globalThis.fetch = async (url, init) => {
+			capturedUrl = String(url);
+			capturedHeaders = Object.fromEntries(new Headers(init.headers));
+			capturedBody = JSON.parse(init.body);
+			return new Response(JSON.stringify({ candidates: [{ content: { parts: [{ text: "ok" }] } }] }), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		};
+
+		const { queryGeminiApiWithVideo } = await import(${JSON.stringify(geminiApiUrl)});
+		const text = await queryGeminiApiWithVideo("Describe", "files/test", { model: "gemini-test", timeoutMs: 1000 });
+		console.log(JSON.stringify({ text, capturedUrl, capturedHeaders, capturedBody }));
+	`, {
+		PI_CODING_AGENT_DIR: undefined,
+		XDG_CONFIG_HOME: undefined,
+		HOME: join(root, "home"),
+		USERPROFILE: join(root, "home"),
+		GOOGLE_GEMINI_BASE_URL: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio",
+		CLOUDFLARE_API_KEY: "env-cf-key",
+	});
+
+	assert.equal(child.status, 0, child.stderr);
+	const output = JSON.parse(child.stdout);
+	assert.equal(output.text, "ok");
+	assert.equal(output.capturedUrl, "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio/v1beta/models/gemini-test:generateContent");
+	assert.equal(output.capturedHeaders["cf-aig-authorization"], "Bearer env-cf-key");
+	assert.equal(output.capturedHeaders["content-type"], "application/json");
+	assert.deepEqual(output.capturedBody.contents, [{
+		role: "user",
+		parts: [
+			{ fileData: { fileUri: "files/test" } },
+			{ text: "Describe" },
+		],
+	}]);
+});

package/agent/extensions/pi-web-access/test/content-find.test.mjs

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import { findContent } from "../content-find.ts";
+
+test("findContent supports exact, case-insensitive, and fuzzy matches", () => {
+	const text = "Alpha configuration guide.\n\nThe server configuraton value is 42.";
+
+	assert.equal(findContent(text, ["configuration"], "exact").matchCount, 1);
+	assert.equal(findContent(text, ["ALPHA"], "case-insensitive").matchCount, 1);
+	assert.equal(findContent(text, ["configuration value"], "fuzzy").matchCount, 1);
+});
+
+test("findContent caps the complete formatted response", () => {
+	const query = "x".repeat(500);
+	const text = Array.from(
+		{ length: 30 },
+		(_, index) => `${"a".repeat(500)} ${query} ${"b".repeat(500)} ${index}`,
+	).join("\n\n");
+	const result = findContent(text, [query], "exact");
+
+	assert.equal(result.matchCount, 30);
+	assert.ok(result.returnedMatches < result.matchCount);
+	assert.ok(result.text.length <= 20_000);
+});

package/agent/extensions/pi-web-access/test/credential-source.test.mjs

@@ -0,0 +1,118 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+	CredentialResolutionError,
+	hasCredentialSource,
+	resolveCredential,
+} from "../credential-source.ts";
+
+const fake = value => async () => ({ stdout: value });
+
+function options(configuredValue, environmentValue) {
+	return { provider: "Synthetic", configuredValue, environmentValue };
+}
+
+test("literal and legacy environment credentials preserve existing precedence", async () => {
+	assert.equal(await resolveCredential(options("literal-value", "environment-value")), "environment-value");
+	assert.equal(await resolveCredential(options("literal-value", undefined)), "literal-value");
+	assert.equal(await resolveCredential(options(undefined, "environment-value")), "environment-value");
+	assert.equal(await resolveCredential(options(undefined, undefined)), null);
+});
+
+test("explicit environment sources use only the named variable", async () => {
+	assert.equal(await resolveCredential({
+		...options("${SCOPED_SYNTHETIC_KEY}", "stale-legacy-value"),
+		environment: { SCOPED_SYNTHETIC_KEY: "scoped-value" },
+	}), "scoped-value");
+	await assert.rejects(
+		resolveCredential({
+			...options("$SCOPED_SYNTHETIC_KEY", "stale-legacy-value"),
+			environment: {},
+		}),
+		err => err instanceof CredentialResolutionError && err.category === "environment-empty",
+	);
+});
+
+test("command sources override stale values, remain lazy, and rotate per resolution", async () => {
+	let calls = 0;
+	const runCommand = async (command, runOptions) => {
+		calls += 1;
+		assert.equal(command, "/trusted/read synthetic");
+		assert.deepEqual(runOptions.environment, {
+			HOME: "/synthetic/home",
+			PATH: "/usr/bin:/bin",
+			OP_SESSION_my: "synthetic-password-manager-session",
+		});
+		return { stdout: calls === 1 ? "first-value\n" : "second-value\n" };
+	};
+	const commandOptions = {
+		...options("!/trusted/read synthetic", "stale-environment-value"),
+		runCommand,
+		environment: {
+			HOME: "/synthetic/home",
+			PATH: "/usr/bin:/bin",
+			EXA_API_KEY: "stale-provider-key-must-not-reach-command",
+			OP_SESSION_my: "synthetic-password-manager-session",
+			OP_SERVICE_ACCOUNT_TOKEN: "must-not-reach-command",
+			NODE_OPTIONS: "--require=untrusted.js",
+		},
+	};
+
+	assert.equal(hasCredentialSource(commandOptions), true);
+	assert.equal(calls, 0);
+	assert.equal(await resolveCredential(commandOptions), "first-value");
+	assert.equal(await resolveCredential(commandOptions), "second-value");
+	assert.equal(calls, 2);
+});
+
+test("command output must be one non-empty bounded value", async () => {
+	for (const [stdout, category] of [
+		["", "command-empty"],
+		["one\ntwo\n", "command-invalid-output"],
+		["x".repeat(16_385), "command-output-too-large"],
+	]) {
+		await assert.rejects(
+			resolveCredential({ ...options("!ignored", undefined), runCommand: fake(stdout) }),
+			err => err instanceof CredentialResolutionError && err.category === category,
+		);
+	}
+});
+
+test("command failures are categorized and redact command output", async () => {
+	const secret = "SYNTHETIC_SECRET_MUST_NOT_ESCAPE";
+	for (const [failure, category] of [
+		[Object.assign(new Error(`spawn failed ${secret}`), { code: "ENOENT", stderr: secret }), "command-failed"],
+		[Object.assign(new Error(`timed out ${secret}`), { killed: true, stderr: secret }), "command-timeout"],
+		[Object.assign(new Error(`too large ${secret}`), { code: "ERR_CHILD_PROCESS_STDIO_MAXBUFFER", stderr: secret }), "command-output-too-large"],
+	]) {
+		await assert.rejects(
+			resolveCredential({
+				...options("!/trusted/read synthetic", "stale-value"),
+				runCommand: async () => { throw failure; },
+			}),
+			err => {
+				assert.equal(err instanceof CredentialResolutionError, true);
+				assert.equal(err.category, category);
+				assert.equal(err.message.includes(secret), false);
+				assert.equal(err.message.includes("/trusted/read"), false);
+				return true;
+			},
+		);
+	}
+});
+
+test("escaped source prefixes remain literal and override legacy environment values", async () => {
+	assert.equal(await resolveCredential(options("$$OPENAI_API_KEY", "legacy-value")), "$OPENAI_API_KEY");
+	assert.equal(await resolveCredential(options("$!literal-command", "legacy-value")), "!literal-command");
+	assert.equal(hasCredentialSource(options("$$OPENAI_API_KEY", undefined)), true);
+});
+
+test("malformed explicit sources fail closed instead of becoming literals", async () => {
+	for (const source of ["!", "$BAD-NAME", "${UNCLOSED"]) {
+		await assert.rejects(
+			resolveCredential(options(source, "stale-value")),
+			err => err instanceof CredentialResolutionError && err.category === "invalid-source",
+		);
+	}
+});

package/agent/extensions/pi-web-access/test/data-uri-sanitize.test.mjs

@@ -0,0 +1,210 @@
+import assert from "node:assert/strict";
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import { performance } from "node:perf_hooks";
+import { test } from "node:test";
+
+import { sanitizeInlineDataUris } from "../data-uri-sanitize.ts";
+
+const DATA_URI_MARKER_PREFIX = "[pi-web-access inline data URI omitted;";
+
+function markerCount(text) {
+	return text.split(DATA_URI_MARKER_PREFIX).length - 1;
+}
+
+function assertRequiredMarkerFields(markerText, ordinal, sourcePath) {
+	assert.match(markerText, new RegExp(`ordinal=${ordinal}(?:;|\\])`));
+	assert.ok(markerText.includes(`source=${sourcePath};`));
+	assert.match(markerText, /mime=[a-z0-9!#$&^_.+\/-]+;/);
+	assert.match(markerText, /encoding=(?:base64|percent-encoded);/);
+	assert.match(markerText, /encodedBytes=\d+;/);
+	assert.match(markerText, /decodedBytes=(?:\d+|unknown)(?:;|\])/);
+	assert.match(markerText, /sha256=[a-f0-9]{64};/);
+	assert.match(markerText, /digestBasis=(?:decoded|encoded);/);
+	assert.match(markerText, /retrieval=not-retained\]/);
+}
+
+test("original 21-image failure shape collapses to bounded markers", { timeout: 20_000 }, () => {
+	const encoded = Buffer.alloc(240 * 1024, 0xa5).toString("base64");
+	const content = Array.from({ length: 21 }, (_, index) =>
+		`Prose ${index} before ![OSF screenshot ${index}](data:image/png;base64,${encoded}) prose ${index} after.`,
+	).join("\n\n");
+	assert.ok(Buffer.byteLength(content, "utf8") > 4 * 1024 * 1024);
+
+	const started = performance.now();
+	const { text, omissions } = sanitizeInlineDataUris(content, "urls[0].content");
+	const elapsedMs = performance.now() - started;
+
+	assert.equal(omissions.length, 21);
+	assert.equal(markerCount(text), 21);
+	assert.doesNotMatch(text, /data:image\/png;base64,/i);
+	for (let ordinal = 1; ordinal <= 21; ordinal++) {
+		assertRequiredMarkerFields(text, ordinal, "urls[0].content");
+	}
+	assert.ok(Buffer.byteLength(text, "utf8") < 32 * 1024);
+	assert.ok(elapsedMs < 15_000, `6-8 MiB sanitization took ${Math.round(elapsedMs)}ms`);
+});
+
+test("many individually small images have no per-payload exemption", { timeout: 20_000 }, () => {
+	const count = 4_300;
+	const encoded = Buffer.alloc(768, 0x5a).toString("base64");
+	const content = Array.from(
+		{ length: count },
+		(_, index) => `Paragraph ${index} ![small ${index}](data:image/png;base64,${encoded}) end ${index}.`,
+	).join("\n");
+
+	const { text, omissions } = sanitizeInlineDataUris(content, "urls[0].content");
+	assert.equal(omissions.length, count);
+	assert.equal(markerCount(text), count);
+	assert.doesNotMatch(text, /data:image\/png;base64,/i);
+});
+
+test("readable prose and Markdown alt text remain unchanged around replacements", () => {
+	const input = "Before ![architecture diagram](data:image/png;base64,SGk=) between <img src=\"data:text/plain,hello%20world\" alt=\"inline\"> after.";
+	const { text, omissions } = sanitizeInlineDataUris(input, "urls[0].content");
+	assert.equal(omissions.length, 2);
+	assert.ok(text.startsWith("Before ![architecture diagram]("));
+	assert.ok(text.includes(") between <img src=\""));
+	assert.ok(text.endsWith("\" alt=\"inline\"> after."));
+	assert.ok(text.includes("architecture diagram"));
+	assert.ok(text.includes("alt=\"inline\""));
+	assert.equal(markerCount(text), 2);
+	assert.doesNotMatch(text, /data:/i);
+});
+
+test("small legitimate SVG is explicitly omitted with decoded digest metadata", () => {
+	const decoded = "<svg xmlns=\"http://www.w3.org/2000/svg\"><path d=\"M0 0\"/></svg>";
+	const payload = encodeURIComponent(decoded);
+	const { text, omissions } = sanitizeInlineDataUris(
+		`Diagram: ![tiny vector](data:image/svg+xml;charset=utf-8,${payload}) done`,
+		"urls[0].content",
+	);
+	assert.equal(omissions.length, 1);
+	const omission = omissions[0];
+	assert.equal(omission.mimeType, "image/svg+xml");
+	assert.equal(omission.encoding, "percent-encoded");
+	assert.equal(omission.encodedBytes, Buffer.byteLength(payload));
+	assert.equal(omission.decodedBytes, Buffer.byteLength(decoded));
+	assert.equal(omission.sha256, createHash("sha256").update(decoded).digest("hex"));
+	assert.equal(omission.digestBasis, "decoded");
+	assert.equal(omission.retrieval, "not-retained");
+	assert.ok(text.includes("![tiny vector]("));
+	assertRequiredMarkerFields(text, 1, "urls[0].content");
+	assert.doesNotMatch(text, /data:/i);
+});
+
+test("data URI variants are handled without payload-bearing errors", () => {
+	const fixtures = {
+		base64: "data:image/png;base64,SGVsbG8=",
+		percent: "data:text/plain,hello%20world",
+		missingMime: "data:;base64,SGk=",
+		parameters: "data:text/plain;charset=utf-8,hello%2Cworld",
+		quoted: "<img src='data:image/gif;base64,R0lGODlhAQABAIAAAAUEBA=='>",
+		quotedApostrophe: "<img src=\"data:text/plain,it's\">",
+		markdown: "![alt](data:application/octet-stream;base64,AAEC)",
+		invalidBase64: "data:image/png;base64,***not-base64***",
+		mixedCase: "DATA:IMAGE/PNG;BASE64,UE5H",
+	};
+	const byKey = new Map();
+	for (const [key, input] of Object.entries(fixtures)) {
+		const result = sanitizeInlineDataUris(input, key);
+		assert.equal(result.omissions.length, 1, `expected one omission for ${key}`);
+		assert.doesNotMatch(result.text, /data:/i);
+		byKey.set(key, { omission: result.omissions[0], text: result.text });
+	}
+	assert.equal(byKey.get("missingMime").omission.mimeType, "text/plain");
+	assert.equal(byKey.get("missingMime").omission.encoding, "base64");
+	assert.equal(byKey.get("parameters").omission.decodedBytes, 11);
+	assert.equal(byKey.get("mixedCase").omission.mimeType, "image/png");
+	const invalid = byKey.get("invalidBase64");
+	assert.equal(invalid.omission.decodedBytes, null);
+	assert.equal(invalid.omission.digestBasis, "encoded");
+	assert.equal(invalid.omission.decodeError, "invalid-base64-character");
+	assert.ok(invalid.text.includes("decodedBytes=unknown"));
+	assert.ok(invalid.text.includes("decodeError=invalid-base64-character"));
+	assert.ok(!invalid.text.includes("not-base64"));
+});
+
+test("malformed enclosed data URIs are wholly removed without payload suffix leakage", () => {
+	const cases = [
+		{
+			input: '<img src="data:image/png;base64,QUFB QkJC">',
+			forbidden: ["QUFB", "QkJC"],
+			error: "invalid-base64-character",
+		},
+		{
+			input: "![x](data:text/plain,abc(def)ghi)",
+			forbidden: ["abc(def)ghi", "ghi)"],
+			decodedBytes: 11,
+		},
+		{
+			input: "data:text/plain,abc(def)ghi",
+			forbidden: ["abc(def)ghi"],
+			decodedBytes: 11,
+		},
+		{
+			input: "![x](data:image/png;base64,SGVs\nbG8=)",
+			forbidden: ["SGVs", "bG8="],
+			error: "invalid-base64-character",
+		},
+		{
+			input: '<img src="data:image/png;base64">',
+			forbidden: ["data:image/png;base64"],
+			error: "missing-comma",
+			encodedBytes: Buffer.byteLength("image/png;base64"),
+		},
+	];
+
+	for (const fixture of cases) {
+		const result = sanitizeInlineDataUris(fixture.input, "urls[0].content");
+		assert.equal(result.omissions.length, 1);
+		assert.equal(markerCount(result.text), 1);
+		assert.doesNotMatch(result.text, /data:/i);
+		for (const fragment of fixture.forbidden) assert.ok(!result.text.includes(fragment));
+		if (fixture.error) assert.equal(result.omissions[0].decodeError, fixture.error);
+		if (fixture.encodedBytes !== undefined) assert.equal(result.omissions[0].encodedBytes, fixture.encodedBytes);
+		if (fixture.decodedBytes !== undefined) assert.equal(result.omissions[0].decodedBytes, fixture.decodedBytes);
+	}
+	assert.equal(
+		sanitizeInlineDataUris("ordinary data: value", "urls[0].content").text,
+		"ordinary data: value",
+	);
+});
+
+test("valid RFC MIME token characters are normalized without truncating the URI", () => {
+	for (const mimeType of ["application/x.foo~bar", "application/x.foo*bar", "application/x.foo'bar"]) {
+		const result = sanitizeInlineDataUris(`<img src=\"data:${mimeType},ok\">`, "urls[0].content");
+		assert.equal(result.omissions.length, 1);
+		assert.equal(result.omissions[0].mimeType, mimeType);
+		assert.equal(result.omissions[0].decodedBytes, 2);
+		assert.doesNotMatch(result.text, /data:/i);
+	}
+});
+
+test("malformed comma-less candidates scale linearly and are explicitly marked", { timeout: 15_000 }, () => {
+	function measure(count) {
+		const input = Array.from({ length: count }, () => "data:x;").join(" ");
+		const started = performance.now();
+		const result = sanitizeInlineDataUris(input, "urls[0].content");
+		const elapsedMs = performance.now() - started;
+		assert.equal(result.omissions.length, count);
+		assert.ok(result.omissions.every((item) => item.decodeError === "missing-comma"));
+		assert.doesNotMatch(result.text, /data:/i);
+		return elapsedMs;
+	}
+	const smallMs = measure(2_000);
+	const largeMs = measure(4_000);
+	assert.ok(largeMs < 10_000, `malformed scan took ${Math.round(largeMs)}ms`);
+	assert.ok(largeMs <= smallMs * 4 + 500, `nonlinear malformed scan: ${smallMs}ms -> ${largeMs}ms`);
+});
+
+test("overlong headers are bounded and classified without retaining header or payload", () => {
+	const header = `image/png;name=${"x".repeat(2_048)};base64`;
+	const result = sanitizeInlineDataUris(`![x](data:${header},SGVsbG8=)`, "urls[0].content");
+	assert.equal(result.omissions.length, 1);
+	assert.equal(result.omissions[0].decodedBytes, null);
+	assert.equal(result.omissions[0].decodeError, "header-too-long");
+	assert.equal(result.omissions[0].digestBasis, "encoded");
+	assert.ok(!result.text.includes("x".repeat(128)));
+	assert.doesNotMatch(result.text, /data:/i);
+});