@govtechsg/oobee 0.10.93 → 0.10.95

package/src/constants/common.ts

@@ -359,8 +359,11 @@ const checkUrlConnectivityWithBrowser = async (
     }
   }
 
-  // Ensure Accept header for non-html content fallback
-  extraHTTPHeaders.Accept ||= 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';
+  // Ensure Accept header for non-html content fallback — use a local copy to avoid
+  // mutating the caller's extraHTTPHeaders object (which is later checked by crawlers
+  // to decide whether to enable preNavigationHooks header rewriting).
+  const localHeaders = { ...extraHTTPHeaders };
+  localHeaders.Accept ||= 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';
 
   await initModifiedUserAgent(browserToRun, playwrightDeviceDetailsObject, clonedDataDir);
 
@@ -378,7 +381,7 @@ const checkUrlConnectivityWithBrowser = async (
 
   const launchOptions = getPlaywrightLaunchOptions(browserToRun);
   
-  const { Authorization, ...nonAuthHeaders } = extraHTTPHeaders || {};
+  const { Authorization, ...nonAuthHeaders } = localHeaders || {};
   let httpCredentials = undefined;
   if (Authorization?.startsWith('Basic ')) {
     const decoded = Buffer.from(Authorization.slice(6), 'base64').toString();
@@ -436,19 +439,21 @@ const checkUrlConnectivityWithBrowser = async (
     // Only enable generic Authorization header routing interception broadly if 
     // a non-Basic Bearer auth string is heavily relied upon, thereby bypassing 
     // performance warnings inside the check checkUrl phase for typical public scans
-    if (Authorization && !httpCredentials) {
-      const entryOrigin = new URL(url).origin;
-      await browserContext.route('**/*', async (route: any, request: any) => {
-        try {
-          if (new URL(request.url()).origin === entryOrigin) {
-            await route.continue({ headers: { ...request.headers(), Authorization } });
-          } else {
+    if (Object.keys(localHeaders).length > 0) {
+      if (Authorization && !httpCredentials) {
+        const entryOrigin = new URL(url).origin;
+        await browserContext.route('**/*', async (route: any, request: any) => {
+          try {
+            if (new URL(request.url()).origin === entryOrigin) {
+              await route.continue({ headers: { ...request.headers(), Authorization } });
+            } else {
+              await route.continue();
+            }
+          } catch {
             await route.continue();
           }
-        } catch {
-          await route.continue();
-        }
-      });
+        });
+      }
     }
 
     const page = await browserContext.newPage();
@@ -569,7 +574,7 @@ export const isSitemapContent = (content: string) => {
   }
 
   const regexForHtml = new RegExp('<(?:!doctype html|html|head|body)+?>', 'gmi');
-  const regexForXmlSitemap = new RegExp('<(?:urlset|feed|rss)+?.*>', 'gmi');
+  const regexForXmlSitemap = new RegExp('<(?:urlset|sitemapindex|feed|rss)+?.*>', 'gmi');
   if (content.match(regexForHtml) && content.match(regexForXmlSitemap)) {
     // is an XML sitemap wrapped in a HTML document
     return true;
@@ -592,8 +597,22 @@ export const checkUrl = async (
   extraHTTPHeaders: Record<string, string>,
   fileTypes: FileTypes,
 ) => {
+  let urlToCheck = url;
+
+  if (scanner === ScannerTypes.LOCALFILE) {
+    if (!isFilePath(url)) {
+      const res = new RES();
+      res.status = constants.urlCheckStatuses.notALocalFile.code;
+      return res;
+    }
+
+    if (!url.toLowerCase().startsWith('file://')) {
+      urlToCheck = pathToFileURL(path.resolve(url)).toString();
+    }
+  }
+
   const res = await checkUrlConnectivityWithBrowser(
-    url,
+    urlToCheck,
     browser,
     clonedDataDir,
     playwrightDeviceDetailsObject,
@@ -681,6 +700,7 @@ export const prepareData = async (argv: Answers): Promise<Data> => {
     ruleset,
     generateJsonFiles,
     scanDuration,
+    finalUrl,
   } = argv;
 
   const extraHTTPHeaders = parseHeaders(header);
@@ -714,6 +734,10 @@ export const prepareData = async (argv: Answers): Promise<Data> => {
     url = temp.toString();
   }
 
+  // Keep browser-resolved URL (if provided by pre-check flow) as canonical entry URL.
+  // For local file paths, keep using the normalized `url` value below.
+  const resolvedEntryUrl = finalUrl && !isFilePath(finalUrl) ? finalUrl : url;
+
   // construct filename for scan results
   const [date, time] = new Date().toLocaleString('sv').replaceAll(/-|:/g, '').split(' ');
   const domain = isLocalFileScan ? path.basename(url) : new URL(url).hostname;
@@ -758,7 +782,7 @@ export const prepareData = async (argv: Answers): Promise<Data> => {
   return {
     type: scanner,
     url,
-    entryUrl: url,
+    entryUrl: resolvedEntryUrl,
     isHeadless: headless,
     deviceChosen,
     customDevice,
@@ -1009,6 +1033,8 @@ export const getLinksFromSitemap = async (
   const scannedSitemaps = new Set<string>();
   const sitemapLinkCounts: Record<string, number> = {};
   const allUrls = new Set<string>(); // all discovered URLs (lightweight strings)
+  const isImageSitemapUrl = (candidateUrl: string) =>
+    /(^|\/)image-sitemap(?:-index)?(?:-\d+)?\.xml(?:$|[?#])/i.test(candidateUrl);
 
   const addToUrlList = (url: string) => {
     if (!url) return;
@@ -1092,6 +1118,11 @@ export const getLinksFromSitemap = async (
     let data;
     let sitemapType;
 
+    if (isImageSitemapUrl(url)) {
+      consoleLogger.info(`Skipping image sitemap: ${url}`);
+      return;
+    }
+
     if (scannedSitemaps.has(url)) {
       // Skip processing if the sitemap has already been scanned
       return;
@@ -1147,11 +1178,28 @@ export const getLinksFromSitemap = async (
 
         const page = await browserContext.newPage();
 
-        await page.goto(url, { waitUntil: 'networkidle', timeout: 60000 });
+        // Use 'domcontentloaded' instead of 'networkidle' — sitemap XMLs with
+        // XSL stylesheet references (e.g. <?xml-stylesheet ...?>) cause the browser
+        // to fetch and apply the stylesheet, which may load additional resources
+        // (fonts, CSS, images) that prevent 'networkidle' from ever being reached.
+        const response = await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 60000 });
+
+        // Prefer the raw response body — this gives us the original XML before
+        // the browser applies any XSL transformation (which would turn the XML
+        // into rendered HTML, losing the sitemap structure).
+        if (response) {
+          try {
+            data = await response.text();
+          } catch {
+            // response.text() can fail if the body was already consumed or
+            // if a redirect occurred; fall through to DOM extraction below.
+          }
+        }
 
-        if ((await page.locator('body').count()) > 0) {
-          data = await page.locator('body').innerText();
-        } else {
+        if (!data) {
+          if ((await page.locator('body').count()) > 0) {
+            data = await page.locator('body').innerText();
+          } else {
           const urlSet = page.locator('urlset');
           const sitemapIndex = page.locator('sitemapindex');
           const rss = page.locator('rss');
@@ -1166,6 +1214,7 @@ export const getLinksFromSitemap = async (
             data = await rss.evaluate(elem => elem.outerHTML);
           } else if (await isRoot(feed)) {
             data = await feed.evaluate(elem => elem.outerHTML);
+            }
           }
         }
       } finally {
@@ -1189,39 +1238,65 @@ export const getLinksFromSitemap = async (
     }
 
     const $ = cheerio.load(data, { xml: true });
+    const countBefore = allUrls.size;
 
     // This case is when the document is not an XML format document
     if ($(':root').length === 0) {
       processNonStandardSitemap(data);
+
+      const linksFromThisSitemap = allUrls.size - countBefore;
+      if (linksFromThisSitemap > 0) {
+        sitemapLinkCounts[url] = (sitemapLinkCounts[url] || 0) + linksFromThisSitemap;
+      }
       return;
     }
 
     // Root element
     const root = $(':root')[0];
+    const hasImageNamespace = Object.values(root?.attribs ?? {}).some(
+      attribVal => typeof attribVal === 'string' && attribVal.toLowerCase().includes('sitemap-image'),
+    );
+
+    if (hasImageNamespace) {
+      consoleLogger.info(`Skipping image sitemap: ${url}`);
+      return;
+    }
 
-    const { xmlns } = root.attribs;
+    const rootName = root?.name?.toLowerCase().split(':').pop() ?? '';
+    const hasXmlSitemapIndexTag = /<\s*(?:[a-z0-9_-]+:)?sitemapindex\b/i.test(data);
+    const hasXmlUrlsetTag = /<\s*(?:[a-z0-9_-]+:)?urlset\b/i.test(data);
 
-    const xmlFormatNamespace = '/schemas/sitemap';
-    if (root.name === 'urlset' && xmlns.includes(xmlFormatNamespace)) {
+    if (rootName === 'urlset') {
       sitemapType = constants.xmlSitemapTypes.xml;
-    } else if (root.name === 'sitemapindex' && xmlns.includes(xmlFormatNamespace)) {
+    } else if (rootName === 'sitemapindex') {
       sitemapType = constants.xmlSitemapTypes.xmlIndex;
-    } else if (root.name === 'rss') {
+    } else if (rootName === 'rss') {
       sitemapType = constants.xmlSitemapTypes.rss;
-    } else if (root.name === 'feed') {
+    } else if (rootName === 'feed') {
       sitemapType = constants.xmlSitemapTypes.atom;
+    } else if (hasXmlSitemapIndexTag) {
+      sitemapType = constants.xmlSitemapTypes.xmlIndex;
+    } else if (hasXmlUrlsetTag) {
+      sitemapType = constants.xmlSitemapTypes.xml;
     } else {
       sitemapType = constants.xmlSitemapTypes.unknown;
     }
 
-    const countBefore = allUrls.size;
-
     switch (sitemapType) {
       case constants.xmlSitemapTypes.xmlIndex:
-        consoleLogger.info(`This is a XML format sitemap index.`);
+        consoleLogger.info(`This is a XML format sitemap index: ${url}`);
         for (const childSitemapUrl of $('loc')) {
-          const childSitemapUrlText = $(childSitemapUrl).text();
-          if (childSitemapUrlText.endsWith('.xml') || childSitemapUrlText.endsWith('.txt')) {
+          const childSitemapUrlText = $(childSitemapUrl).text().trim();
+          if (!childSitemapUrlText) {
+            continue;
+          }
+
+          const childSitemapPath = childSitemapUrlText.split(/[?#]/)[0].toLowerCase();
+          if (childSitemapPath.endsWith('.xml') || childSitemapPath.endsWith('.txt')) {
+            if (isImageSitemapUrl(childSitemapUrlText)) {
+              consoleLogger.info(`Skipping image sitemap: ${childSitemapUrlText}`);
+              continue;
+            }
             await fetchUrls(childSitemapUrlText, extraHTTPHeaders); // Recursive call for nested sitemaps
           } else {
             addToUrlList(childSitemapUrlText); // Add regular URLs to the list
@@ -1229,19 +1304,19 @@ export const getLinksFromSitemap = async (
         }
         break;
       case constants.xmlSitemapTypes.xml:
-        consoleLogger.info(`This is a XML format sitemap.`);
+        consoleLogger.info(`This is a XML format sitemap: ${url}`);
         await processXmlSitemap($, sitemapType, 'loc', 'lastmod', 'url');
         break;
       case constants.xmlSitemapTypes.rss:
-        consoleLogger.info(`This is a RSS format sitemap.`);
+        consoleLogger.info(`This is a RSS format sitemap: ${url}`);
         await processXmlSitemap($, sitemapType, 'link', 'pubDate', 'item');
         break;
       case constants.xmlSitemapTypes.atom:
-        consoleLogger.info(`This is a Atom format sitemap.`);
+        consoleLogger.info(`This is a Atom format sitemap: ${url}`);
         await processXmlSitemap($, sitemapType, 'link', 'published', 'entry');
         break;
       default:
-        consoleLogger.info(`This is an unrecognised XML sitemap format.`);
+        consoleLogger.info(`This is an unrecognised XML sitemap format: ${url}`);
         processNonStandardSitemap(data);
     }
 
@@ -1422,6 +1497,19 @@ export const getBrowserToRun = (
  * after checkingUrl and unable to utilise same cookie for scan
  * */
 export const getClonedProfilesWithRandomToken = (browser: string, randomToken: string): string => {
+  // In Docker, redirect browser temp files away from /tmp to avoid ENOSPC.
+  // Keep the path short — Chrome creates Unix sockets inside TMPDIR-based paths,
+  // and socket paths are limited to 107 bytes on Linux.
+  // Use process.pid to isolate concurrent scan instances.
+  if (fs.existsSync('/.dockerenv')) {
+    const baseDir = getDefaultChromiumDataDir();
+    if (baseDir) {
+      const scanTmpDir = path.join(baseDir, 'tmp', String(process.pid));
+      fs.mkdirSync(scanTmpDir, { recursive: true });
+      process.env.TMPDIR = scanTmpDir;
+    }
+  }
+
   if (browser === BrowserTypes.CHROME) {
     return cloneChromeProfiles(randomToken);
   }
@@ -2191,6 +2279,7 @@ export const isFilePath = (url: string): boolean => {
   const driveLetterPattern = /^[A-Z]:/i;
   const backslashPattern = /\\/;
   return (
+    url.toLowerCase().startsWith('file://') ||
     url.startsWith('/') ||
     driveLetterPattern.test(url) ||
     backslashPattern.test(url) ||

package/src/crawlers/commonCrawlerFunc.ts

@@ -1145,10 +1145,19 @@ export const createCrawleeSubFolders = async (
 export const preNavigationHooks = (extraHTTPHeaders: Record<string, string>) => {
   return [
     async (crawlingContext: CrawlingContext, gotoOptions: PlaywrightGotoOptions) => {
-      if (extraHTTPHeaders) {
+      if (extraHTTPHeaders && Object.keys(extraHTTPHeaders).length > 0) {
         crawlingContext.request.headers = extraHTTPHeaders;
       }
-      gotoOptions = { waitUntil: 'networkidle', timeout: 30000 };
+      // Use domcontentloaded — fires as soon as the DOM is parsed, before
+      // images/stylesheets/network requests settle. This avoids indefinite
+      // hangs on sites with WebSockets, analytics polling, or infinite-scroll
+      // beacons that never reach networkidle. Further page stability is
+      // handled by waitForPageLoaded() in each crawler's requestHandler and
+      // by the DOM mutation observer in postNavigationHooks.
+      if (gotoOptions) {
+        gotoOptions.waitUntil = 'domcontentloaded';
+        gotoOptions.timeout = 30000;
+      }
     },
   ];
 };

package/src/crawlers/crawlDomain.ts

@@ -5,6 +5,7 @@ import type { PlaywrightCrawlingContext, RequestOptions } from 'crawlee';
 import {
   createCrawleeSubFolders,
   getPreLaunchHook,
+  preNavigationHooks,
   runAxeScript,
   isUrlPdf,
   shouldSkipClickDueToDisallowedHref,
@@ -414,12 +415,10 @@ const crawlDomain = async ({
         ],
       },
       requestQueue,
+      maxRequestRetries: 3,
+      maxSessionRotations: 1,
       preNavigationHooks: [
-        async (crawlingContext) => {
-          if (extraHTTPHeaders) {
-            crawlingContext.request.headers = extraHTTPHeaders;
-          }
-        },
+        ...preNavigationHooks(extraHTTPHeaders),
       ],
       postNavigationHooks: [
         async crawlingContext => {

package/src/crawlers/crawlSitemap.ts

@@ -7,6 +7,7 @@ import {
   preNavigationHooks,
   runAxeScript,
   isUrlPdf,
+  splitAuthHeaders,
 } from './commonCrawlerFunc.js';
 
 import constants, {
@@ -85,6 +86,7 @@ const crawlSitemap = async ({
     maxRequestsPerCrawl,
     specifiedMaxConcurrency || constants.maxConcurrency,
   );
+  const initialNoSuccessFailureAbortThreshold = Math.max(5, Math.min(maxRequestsPerCrawl, 25));
 
   if (fromCrawlIntelligentSitemap) {
     dataset = datasetFromIntelligent;
@@ -119,6 +121,7 @@ const crawlSitemap = async ({
   const isScanPdfs = [FileTypes.All, FileTypes.PdfOnly].includes(fileTypes as FileTypes);
   const { playwrightDeviceDetailsObject } = viewportSettings;
   const { maxConcurrency } = constants;
+  const { nonAuthHeaders, httpCredentials } = splitAuthHeaders(extraHTTPHeaders);
 
   const requestList = await RequestList.open({
     sources: linksFromSitemap,
@@ -142,11 +145,15 @@ const crawlSitemap = async ({
               ...playwrightDeviceDetailsObject,
               ...(process.env.OOBEE_USER_AGENT && { userAgent: process.env.OOBEE_USER_AGENT }),
               ...(process.env.OOBEE_DISABLE_BROWSER_DOWNLOAD && { acceptDownloads: false }),
+              ...(nonAuthHeaders && { extraHTTPHeaders: nonAuthHeaders }),
+              ...(httpCredentials && { httpCredentials }),
             };
           },
         ],
       },
       requestList,
+      maxRequestRetries: 3,
+      maxSessionRotations: 1,
       postNavigationHooks: [
         async ({ page }) => {
           try {
@@ -197,6 +204,7 @@ const crawlSitemap = async ({
         },
       ],
       preNavigationHooks: [
+        ...preNavigationHooks(extraHTTPHeaders),
         async ({ request, page }, gotoOptions) => {
           const url = request.url.toLowerCase();
 
@@ -213,8 +221,6 @@ const crawlSitemap = async ({
 
             return;
           }
-
-          preNavigationHooks(extraHTTPHeaders);
         },
       ],
       requestHandlerTimeoutSecs: 90,
@@ -449,6 +455,17 @@ const crawlSitemap = async ({
           httpStatusCode: typeof status === 'number' ? status : 0,
         });
         crawlee.log.error(`Failed Request - ${request.url}: ${request.errorMessages}`);
+
+        if (
+          urlsCrawled.scanned.length === 0 &&
+          urlsCrawled.error.length >= initialNoSuccessFailureAbortThreshold
+        ) {
+          consoleLogger.info(
+            `Aborting sitemap crawl: ${urlsCrawled.error.length} failed pages with 0 successful scans.`,
+          );
+          isAbortingScan = true;
+          crawler.autoscaledPool?.abort();
+        }
       },
       maxRequestsPerCrawl: Infinity,
       maxConcurrency: specifiedMaxConcurrency || maxConcurrency,

package/src/crawlers/custom/utils.ts

@@ -1228,19 +1228,32 @@ export const initNewPage = async (page, pageClosePromises, processPageParams, pa
         const allowed = isOverlayAllowed(page.url(), processPageParams.entryUrl);
 
         if (!allowed) {
-          await Promise.race([
-            removeOverlayMenu(page),
-            new Promise((_, reject) => {
-              setTimeout(() => {
-                reject(
-                  new Error(
-                    `removeOverlayMenu timed out after ${OVERLAY_OPERATION_TIMEOUT_MS}ms`,
-                  ),
-                );
-              }, OVERLAY_OPERATION_TIMEOUT_MS);
-            }),
-          ]);
-          return;
+          // On macOS and Windows the custom flow always runs headful.
+          // The URL guard (urlGuard.ts) intercepts non-http/https navigations
+          // and calls page.goto(safeUrl). Do NOT remove the overlay here —
+          // removing it causes it to stay permanently disabled if the redirect
+          // races ahead of the next reconcile cycle.
+          // Instead, fall through to the hasOverlay / addOverlayMenu block so
+          // the overlay is (re-)injected even on transient non-http/https URLs
+          // (e.g. file://, about:blank) and again after the guard's redirect.
+          const isDesktopHost = process.platform === 'darwin' || process.platform === 'win32';
+          if (!isDesktopHost) {
+            // On Linux / Docker: remove overlay for non-http/https URLs and stop.
+            await Promise.race([
+              removeOverlayMenu(page),
+              new Promise((_, reject) => {
+                setTimeout(() => {
+                  reject(
+                    new Error(
+                      `removeOverlayMenu timed out after ${OVERLAY_OPERATION_TIMEOUT_MS}ms`,
+                    ),
+                  );
+                }, OVERLAY_OPERATION_TIMEOUT_MS);
+              }),
+            ]);
+            return;
+          }
+          // Desktop hosts: skip removal and fall through to re-add overlay.
         }
 
         const hasOverlay = await page.evaluate(() =>

package/src/crawlers/guards/urlGuard.ts

@@ -35,8 +35,18 @@ export function addUrlGuardScript(context, opts = {}) {
       });
 
     const restoreToSafeUrl = async (page, attemptedUrl) => {
+      const safeUrl = lastAllowedUrlByPage.get(page) || fallbackUrl || 'about:blank';
+      // Only redirect if the safe URL is itself an allowed (http/https) URL.
+      // If the entry URL is file:// (e.g. scanning a local HTML file), the
+      // fallback is also file://, and redirecting would create an infinite loop:
+      //   file:// → restoreToSafeUrl → file:// → framenavigated → restoreToSafeUrl → …
+      try {
+        const safeObj = new URL(safeUrl);
+        if (!ALLOWED_PROTOCOLS.has(safeObj.protocol)) return;
+      } catch {
+        return;
+      }
       try {
-        const safeUrl = lastAllowedUrlByPage.get(page) || fallbackUrl || 'about:blank';
         await page.goto(safeUrl, { waitUntil: 'domcontentloaded' });
       } catch {
         // page might be closing; ignore
@@ -58,6 +68,13 @@ export function addUrlGuardScript(context, opts = {}) {
         lastAllowedUrlByPage.set(page, urlObj.toString());
         return;
       }
+
+      // Skip browser-internal transitional states (about:blank, about:srcdoc, etc.).
+      // page.goto() navigates through about:blank before loading the target URL.
+      // Redirecting from about: creates an infinite loop:
+      //   restoreToSafeUrl → page.goto(safeUrl) → about:blank → restoreToSafeUrl → …
+      if (urlObj.protocol === 'about:') return;
+
       await restoreToSafeUrl(page, urlStr);
     });
   };

package/src/generateHtmlReport.ts

@@ -126,6 +126,18 @@ export const generateHtmlReport = async (
     const scanData = JSON.parse(await fs.readFile(scanDataJsonPath, 'utf8'));
     const scanItemsAll = JSON.parse(await fs.readFile(scanItemsJsonPath, 'utf8'));
 
+    // Disk space: passed may be absent from scanItems.json (excluded to reduce disk usage).
+    // Provide an empty-category fallback so convertItemsToReferences does not crash.
+    // To revert (when passed is restored in scanItems.json), remove this block.
+    if (!scanItemsAll.passed) {
+      scanItemsAll.passed = {
+        description: itemTypeDescription.passed,
+        totalItems: 0,
+        totalRuleIssues: 0,
+        rules: [],
+      };
+    }
+
     // Build the lighter scanItems payload used by the HTML report.
     const lightScanItemsPayload = convertItemsToReferences({
       items: scanItemsAll,
@@ -141,7 +153,7 @@ export const generateHtmlReport = async (
       mustFix: ensureCategory(mustFix, 'mustFix'),
       goodToFix: ensureCategory(goodToFix, 'goodToFix'),
       needsReview: ensureCategory(needsReview, 'needsReview'),
-      passed: ensureCategory(scanItemsAll.passed || {}, 'passed'),
+      passed: ensureCategory(scanItemsAll.passed, 'passed'),
     };
 
     const pagesScanned = Array.isArray(scanData.pagesScanned) ? scanData.pagesScanned : [];

package/src/logs.ts

@@ -39,6 +39,10 @@ export const errorsTxtPath = path.join(basePath, `${uuid}.txt`);
 
 const consoleLogger = createLogger({
   silent: !(process.env.RUNNING_FROM_PH_GUI || process.env.OOBEE_VERBOSE),
+  // exitOnError: false — Winston logs uncaught exceptions but does not call process.exit().
+  // Process lifecycle is controlled by psTreeHandler in combine.ts, which suppresses known
+  // benign errors (e.g. Playwright post-close connection errors) and rethrows real ones.
+  exitOnError: false,
   format: combine(timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }), logFormat),
   transports: [
     new transports.Console({ level: 'info' }),
@@ -54,6 +58,8 @@ const consoleLogger = createLogger({
 // Also used in common functions to not link internal information
 // if running from mass scanner, log out errors in console
 const silentLogger = createLogger({
+  // exitOnError: false — see consoleLogger comment above.
+  exitOnError: false,
   format: combine(timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }), logFormat),
   transports: [
     new transports.File({ 

package/src/mergeAxeResults/jsonArtifacts.ts

@@ -292,9 +292,14 @@ const writeJsonAndBase64Files = async (
   const { items, ...rest } = allIssues;
   const { jsonFilePath: scanDataJsonFilePath, base64FilePath: scanDataBase64FilePath } =
     await writeJsonFileAndCompressedJsonFile(rest, storagePath, 'scanData');
+  // Disk space: passed items excluded from scanItems.json to reduce disk usage.
+  // Passed counts are still in scanData.json and the embedded report payload (scanItems-light).
+  // To revert, remove the destructure line and restore the original argument:
+  // { oobeeAppVersion: allIssues.oobeeAppVersion, ...items }
+  const { passed: _passedItems, ...itemsWithoutPassed } = items;
   const { jsonFilePath: scanItemsJsonFilePath, base64FilePath: scanItemsBase64FilePath } =
     await writeJsonFileAndCompressedJsonFile(
-      { oobeeAppVersion: allIssues.oobeeAppVersion, ...items },
+      { oobeeAppVersion: allIssues.oobeeAppVersion, ...itemsWithoutPassed },
       storagePath,
       'scanItems',
       itemsStore,

package/src/mergeAxeResults.ts

@@ -359,6 +359,16 @@ const writeSummaryPdf = async (
   browser: string,
   _userDataDirectory: string,
 ) => {
+  // Flush stale browser temp files before launching PDF browser (Docker only,
+  // where TMPDIR is a per-scan subdirectory we control).
+  if (process.env.TMPDIR && fs.existsSync('/.dockerenv')) {
+    try {
+      fs.emptyDirSync(process.env.TMPDIR);
+    } catch {
+      // Best-effort; locked files from prior browser sessions are non-fatal.
+    }
+  }
+
   const renderPdfWithBrowser = async (browserToUse: string) => {
     let browserInstance;
     let context;
@@ -525,26 +535,40 @@ const pushResults = async (pageResults, allIssues, isCustomFlow, itemsStore: Ite
           metadata,
           itemsCount: items.length,
         };
-        await itemsStore.appendPageItems(category, rule, {
-          url,
-          pageTitle,
-          items,
-          pageIndex,
-          pageImagePath,
-          metadata,
-        });
+        // Disk space: skip storing passed items in itemsStore.
+        // To revert, remove the `if` guard and use the original call directly:
+        // await itemsStore.appendPageItems(category, rule, {
+        //   url, pageTitle, items, pageIndex, pageImagePath, metadata,
+        // });
+        if (category !== 'passed') {
+          await itemsStore.appendPageItems(category, rule, {
+            url,
+            pageTitle,
+            items,
+            pageIndex,
+            pageImagePath,
+            metadata,
+          });
+        }
       } else if (!(url in currRuleFromAllIssues.pagesAffected)) {
         currRuleFromAllIssues.pagesAffected[url] = {
           pageTitle,
           itemsCount: items.length,
           ...(filePath && { filePath }),
         };
-        await itemsStore.appendPageItems(category, rule, {
-          url,
-          pageTitle,
-          items,
-          ...(filePath && { filePath }),
-        });
+        // Disk space: skip storing passed items in itemsStore.
+        // To revert, remove the `if` guard and use the original call directly:
+        // await itemsStore.appendPageItems(category, rule, {
+        //   url, pageTitle, items, ...(filePath && { filePath }),
+        // });
+        if (category !== 'passed') {
+          await itemsStore.appendPageItems(category, rule, {
+            url,
+            pageTitle,
+            items,
+            ...(filePath && { filePath }),
+          });
+        }
       }
     }
   }
@@ -924,7 +948,9 @@ const generateArtifacts = async (
   populateScanPagesDetail(allIssues);
 
   // Build htmlGroups in a second pass from disk-backed items
-  for (const category of ['mustFix', 'goodToFix', 'needsReview', 'passed'] as const) {
+  // Disk space: 'passed' removed from this loop (no items stored in itemsStore for passed).
+  // To revert, restore: ['mustFix', 'goodToFix', 'needsReview', 'passed']
+  for (const category of ['mustFix', 'goodToFix', 'needsReview'] as const) {
     for (const rule of allIssues.items[category].rules) {
       for await (const entry of itemsStore.readRuleItems(category, rule.rule)) {
         buildHtmlGroups(rule, entry.items, entry.url);