@lincoln504/pi-research 1.1.0 → 1.2.0

package/src/infrastructure/types/state-types.ts

@@ -79,6 +79,15 @@ export const SingletonStateSchema = Type.Object({
     // in-process embedder instead. Optional for entries written by older
     // processes, which are tolerated as matching.
     model: Type.Optional(Type.String()),
+    // Shared secret a follower must present on every embed request. Mirrors
+    // browserServer.authSecret: the server listens on loopback, but loopback is
+    // not an authorization boundary — any local process could otherwise enqueue
+    // embedding work, and because the serial queue steps the leader down when
+    // poisoned, sustained abuse denies the knowledge store rather than merely
+    // burning GPU. Optional so an entry written by an older leader still parses;
+    // a client that finds none simply sends no header, and such a leader does not
+    // check one either.
+    authSecret: Type.Optional(Type.String()),
   })),
 });
 

package/src/knowledge/embedder-init.ts

@@ -252,7 +252,7 @@ export async function purgeModelCache(model: string): Promise<void> {
       logger.warn(`[embedder] Refusing to purge unsafe model-cache path for model id ${JSON.stringify(model)}`);
       return;
     }
-    await rm(modelDir, { recursive: true, force: true });
+    await rm(modelDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
     logger.warn(`[embedder] Purged corrupt model cache at ${modelDir}`);
   } catch (err) {
     logger.warn('[embedder] Failed to purge model cache:', err);

package/src/knowledge/embedder.ts

@@ -68,6 +68,14 @@ export class Embedder {
   private idleTimer: NodeJS.Timeout | null = null;
   private readonly IDLE_TIMEOUT_MS = 60 * 1000;
   private activeEmbeddings = 0;
+  /**
+   * Why the in-flight dispose was started. An IDLE dispose is a memory-reclaim
+   * pause that a later embed is expected to undo, so initialize() waits it out and
+   * re-initializes. A TERMINAL dispose (shutdown, config change, explicit
+   * disposal) must never be undone — re-initializing there would resurrect the
+   * ONNX pipeline during teardown. Only meaningful while state === 'disposing'.
+   */
+  private disposeReason: 'idle' | 'terminal' = 'terminal';
 
   constructor(options: EmbedderOptions) {
     this.model = options.model;
@@ -113,7 +121,7 @@ export class Embedder {
       }
       if (this.state === 'ready') {
         logger.info(`[embedder] Idle timeout reached (${this.IDLE_TIMEOUT_MS}ms), releasing GPU memory...`);
-        this.dispose().catch(err => logger.warn('[embedder] Failed to dispose on idle:', err));
+        this.dispose('idle').catch(err => logger.warn('[embedder] Failed to dispose on idle:', err));
       }
     }, this.IDLE_TIMEOUT_MS);
     if (this.idleTimer) safeUnref(this.idleTimer);
@@ -129,7 +137,36 @@ export class Embedder {
   async initialize(): Promise<void> {
     if (this.state === 'ready') return;
     if (this.state === 'disposing') {
-      throw new Error('Cannot initialize while disposing');
+      // An IDLE dispose is a pause, not an end: the pipeline was released purely
+      // to reclaim GPU/host memory and the next embed is meant to bring it back.
+      // Throwing here lost that race — the idle timer fires, dispose() flips the
+      // state, and a document that arrives during the (up to ~5s) teardown got
+      // "Cannot initialize while disposing", which nothing classifies as
+      // transient, so the writer queue dropped it with no retry. Wait the dispose
+      // out and re-initialize instead.
+      if (this.disposeReason === 'idle') {
+        logger.debug('[embedder] initialize() raced an idle dispose — waiting for it to finish, then re-initializing.');
+        await this.disposePromise?.catch(() => { /* a failed idle dispose must not block the revive */ });
+        // Re-check: another caller may have revived (or terminally disposed) the
+        // embedder while we waited.
+        if ((this.state as EmbedderState) === 'ready') return;
+        // A terminal dispose landed as a DOWNGRADE onto the idle dispose we just
+        // awaited: state is 'idle', but reviving is forbidden — pre-fix this fell
+        // through to a full model load during process teardown. (A LATER, fresh
+        // initialize()/embed() after the completed dispose never enters this
+        // branch and stays revivable — that re-use is pinned behaviour.) The cast
+        // defeats control-flow narrowing, which cannot see the awaited dispose
+        // mutating the field — same idiom as the state re-checks around it.
+        if ((this.disposeReason as 'idle' | 'terminal') === 'terminal') {
+          throw new Error('Cannot initialize while disposing');
+        }
+        if ((this.state as EmbedderState) === 'disposing') {
+          throw new Error('Cannot initialize while disposing');
+        }
+      } else {
+        // Terminal dispose (shutdown / config change): must NOT be revived.
+        throw new Error('Cannot initialize while disposing');
+      }
     }
 
     if (this.initializingPromise) {
@@ -529,14 +566,26 @@ export class Embedder {
     }
   }
 
-  async dispose(): Promise<void> {
+  /**
+   * @param reason `'idle'` for the memory-reclaim pause driven by the idle timer —
+   *   a later embed is allowed to revive the embedder. Anything else is terminal
+   *   (shutdown, config change, explicit disposal) and must never be revived, so
+   *   the default is deliberately the safe one: callers that do not opt in get
+   *   terminal semantics.
+   */
+  async dispose(reason: 'idle' | 'terminal' = 'terminal'): Promise<void> {
     if (this.state === 'idle') return;
     this.stopIdleTimer();
 
     if (this.state === 'disposing' && this.disposePromise) {
+      // A terminal dispose landing on top of an in-flight idle dispose must
+      // downgrade the reason, so a concurrent initialize() cannot revive what is
+      // now a shutdown. Never the reverse.
+      if (reason === 'terminal') this.disposeReason = 'terminal';
       return this.disposePromise;
     }
 
+    this.disposeReason = reason;
     this.state = 'disposing';
     this.disposePromise = (async () => {
       // Wait for all active embeddings to complete

package/src/knowledge/index.ts

@@ -115,7 +115,7 @@ export async function forceDeleteKnowledgeStore(config?: Config, workspace?: str
   const dbDir = getDbDir(config, workspace);
   if (fs.existsSync(dbDir)) {
     try {
-      fs.rmSync(dbDir, { recursive: true, force: true });
+      fs.rmSync(dbDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
       fs.mkdirSync(dbDir, { recursive: true });
       logger.info(`[knowledge] Knowledge store at ${dbDir} forcefully deleted and recreated.`);
     } catch (err) {

package/src/knowledge/store.ts

@@ -721,12 +721,28 @@ export class KnowledgeStore implements IKnowledgeStore {
     }
   }
 
-  async deleteByUrlAndType(url: string, ingestionType: string): Promise<void> {
-    // Coordinate with close() — see deleteByUrl.
-    return this.trackOperation('deleteByUrlAndType', undefined, () => this.deleteByUrlAndTypeInner(url, ingestionType));
+  /**
+   * @param olderThan When set, only rows with `timestamp < olderThan` are removed.
+   *   This is what lets a refresh write the replacement chunks FIRST and prune the
+   *   superseded ones after, instead of deleting first and losing the entry
+   *   outright if the insert then fails. `timestamp` is used as the discriminator
+   *   because it is a real (indexed) column — `contentHash` lives inside the
+   *   JSON-encoded `metadata` blob and cannot be filtered on.
+   */
+  async deleteByUrlAndType(url: string, ingestionType: string, olderThan?: number): Promise<void> {
+    // Coordinate with close() — see deleteByUrl. The closing-skip is surfaced
+    // rather than silently resolving: a prune skipped because the store is
+    // closing (a post-run background ingest racing a Ctrl+C close) leaves
+    // duplicates exactly like a failed prune does, but resolved cleanly, so the
+    // writer-queue's failed-prune accounting never saw its most common cause.
+    if (this.isClosing) {
+      logger.warn(`[store] Prune of ${ingestionType} chunks for ${url} skipped — store is closing; superseded duplicates remain until the next refresh.`);
+      metrics.increment('knowledge_store_delete_total', 1, { operation: 'by_url_and_type', status: 'skipped_closing' });
+    }
+    return this.trackOperation('deleteByUrlAndType', undefined, () => this.deleteByUrlAndTypeInner(url, ingestionType, olderThan));
   }
 
-  private async deleteByUrlAndTypeInner(url: string, ingestionType: string): Promise<void> {
+  private async deleteByUrlAndTypeInner(url: string, ingestionType: string, olderThan?: number): Promise<void> {
     let retryCount = 0;
     const MAX_RETRIES = 5;
     const BASE_DELAY = 100;
@@ -738,11 +754,15 @@ export class KnowledgeStore implements IKnowledgeStore {
       try {
         const escapedUrl = url.replace(/'/g, "''");
         const escapedType = ingestionType.replace(/'/g, "''");
-        await table.delete(`url = '${escapedUrl}' AND ingestion_type = '${escapedType}' AND (${scopeFilter})`);
+        // Integer-coerced so the predicate can never carry anything but digits.
+        const ageClause = Number.isFinite(olderThan as number)
+          ? ` AND timestamp < ${Math.floor(olderThan as number)}`
+          : '';
+        await table.delete(`url = '${escapedUrl}' AND ingestion_type = '${escapedType}' AND (${scopeFilter})${ageClause}`);
         const duration = Date.now() - startTime;
         metrics.observe('knowledge_store_delete_duration_ms', duration, { operation: 'by_url_and_type' });
         metrics.increment('knowledge_store_delete_total', 1, { operation: 'by_url_and_type', status: 'success' });
-        logger.log(`[store] Deleted ${ingestionType} chunks for ${url} (scoped)`);
+        logger.log(`[store] Deleted ${ingestionType} chunks for ${url} (scoped)${ageClause ? ' older than the replacement' : ''}`);
         return;
       } catch (err) {
         if (isLanceCommitConflict(err)) {
@@ -842,10 +862,14 @@ export class KnowledgeStore implements IKnowledgeStore {
     const startTime = Date.now();
     const escapedUrl = url.replace(/'/g, "''");
 
+    // limit > 1 deliberately: after a failed prune two generations of this URL can
+    // coexist, and LanceDB's fragment-scan order typically returns the OLDEST row
+    // first — limit(1) would serve the superseded content (and feed its older
+    // timestamp to the serve-age gate) until the next successful ingest.
     const results = await table
       .query()
       .where(`url = '${escapedUrl}' AND ingestion_type = 'synthesis-description' AND (${scopeFilter})`)
-      .limit(1)
+      .limit(16)
       .toArray();
 
     const duration = Date.now() - startTime;
@@ -856,6 +880,8 @@ export class KnowledgeStore implements IKnowledgeStore {
       metrics.increment('knowledge_store_cache_hits_total', 1, { status: 'miss' });
       return null;
     }
+    // Newest generation wins, never row order.
+    results.sort((a: any, b: any) => Number(b.timestamp) - Number(a.timestamp));
 
     const r = results[0];
     // Read-time freshness. The stored timestamp (ms) is otherwise discarded here;
@@ -1081,7 +1107,7 @@ export class KnowledgeStore implements IKnowledgeStore {
       for (const name of migrationDirs) {
         const fullPath = path.join(this.options.dbDir, name);
         logger.info(`[store] Removing orphaned migration temp directory: ${name}`);
-        await fsPromises.rm(fullPath, { recursive: true, force: true });
+        await fsPromises.rm(fullPath, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
       }
 
       // `_backup_` dirs are intentional, user-recoverable snapshots from the
@@ -1094,7 +1120,7 @@ export class KnowledgeStore implements IKnowledgeStore {
         for (const name of backupDirs.slice(0, -1)) {
           const fullPath = path.join(this.options.dbDir, name);
           logger.info(`[store] Removing superseded backup directory: ${name}`);
-          await fsPromises.rm(fullPath, { recursive: true, force: true });
+          await fsPromises.rm(fullPath, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
         }
       }
     } catch (err) {

package/src/knowledge/webgpu-viability.ts

@@ -150,10 +150,13 @@ function runProbe(model: string, cacheDir: string, timeoutMs: number): Promise<b
     }, timeoutMs);
     if (typeof timer.unref === 'function') timer.unref();
 
-    let stdout = '';
-    let stderr = '';
-    child.stdout?.on('data', (d) => { stdout += String(d); });
-    child.stderr?.on('data', (d) => { stderr += String(d); });
+    // Buffered and decoded once at 'close': per-chunk String(d) mangles a
+    // multi-byte character straddling a pipe-chunk boundary (the PROBE_OK
+    // sentinel is ASCII, but the logged stderr detail line is not guaranteed to be).
+    const stdoutChunks: Buffer[] = [];
+    const stderrChunks: Buffer[] = [];
+    child.stdout?.on('data', (d) => { stdoutChunks.push(Buffer.from(d)); });
+    child.stderr?.on('data', (d) => { stderrChunks.push(Buffer.from(d)); });
 
     child.on('error', (err) => {
       logger.warn('[embedder] WebGPU probe process error — defaulting to CPU:', err);
@@ -161,6 +164,8 @@ function runProbe(model: string, cacheDir: string, timeoutMs: number): Promise<b
     });
 
     child.on('close', (code, signal) => {
+      const stdout = Buffer.concat(stdoutChunks).toString('utf8');
+      const stderr = Buffer.concat(stderrChunks).toString('utf8');
       // Viability is the sentinel, not the exit code (teardown may abort post-success).
       if (stdout.includes('PROBE_OK')) {
         finish(true);

package/src/knowledge/writer-queue.ts

@@ -16,7 +16,7 @@ interface WriterQueueOptions {
   store: {
     isStoreClosed?: () => boolean;
     findByUrl: (url: string) => Promise<StoreDocument[]>;
-    deleteByUrlAndType: (url: string, type: string) => Promise<void>;
+    deleteByUrlAndType: (url: string, type: string, olderThan?: number) => Promise<void>;
     addDocuments: (docs: StoreDocument[]) => Promise<void>;
   };
   chunker: Chunker | null;
@@ -73,50 +73,58 @@ export class WriterQueue implements IWriterQueue {
     if (this.processing) return;
     this.processing = true;
 
-    while (this.queue.length > 0) {
-      const item = this.queue.shift()!;
-      try {
-        // FIX (#2): Chain per-URL to serialize concurrent ingests of the same URL.
-        // process() already runs sequentially, so we chain only for the race case
-        // where two enqueue() calls trigger concurrent process() calls.
-        const urlKey = normalizeUrl(item.url);
-        const prev = this.inflightByUrl.get(urlKey) ?? Promise.resolve();
-        const inflight = prev.then(() => this._ingestInner(item));
-        this.inflightByUrl.set(urlKey, inflight);
+    // try/finally around the whole drain: the latch and the drain notification used
+    // to sit on the normal exit path only. Anything escaping the loop — including
+    // from the catch block below, which itself awaits and logs — left `processing`
+    // stuck true forever: no further item would ever be ingested, drain() would never
+    // resolve, and dispose() would burn its full timeout on every later shutdown.
+    // enqueue() swallows this promise's rejection, so the wedge was silent.
+    try {
+      while (this.queue.length > 0) {
+        const item = this.queue.shift()!;
         try {
-          await inflight;
-        } finally {
-          if (this.inflightByUrl.get(urlKey) === inflight) {
-            this.inflightByUrl.delete(urlKey);
-          }
-        }
-      } catch (err) {
-        if (isEmbedderUnreachable(err)) {
-          logger.warn(`[writer-queue] Embedder unreachable for ${item.url}, retrying once after 2s...`);
-          await new Promise(r => setTimeout(r, 2000));
+          // FIX (#2): Chain per-URL to serialize concurrent ingests of the same URL.
+          // process() already runs sequentially, so we chain only for the race case
+          // where two enqueue() calls trigger concurrent process() calls.
+          const urlKey = normalizeUrl(item.url);
+          const prev = this.inflightByUrl.get(urlKey) ?? Promise.resolve();
+          const inflight = prev.then(() => this._ingestInner(item));
+          this.inflightByUrl.set(urlKey, inflight);
           try {
-            await this.ingest(item);
-          } catch (retryErr) {
-            logger.error(`[writer-queue] Retry failed for ${item.url}, dropping:`, retryErr);
-            metrics.increment('knowledge_ingest_dropped_total', 1, { reason: 'embedder_unreachable' });
+            await inflight;
+          } finally {
+            if (this.inflightByUrl.get(urlKey) === inflight) {
+              this.inflightByUrl.delete(urlKey);
+            }
+          }
+        } catch (err) {
+          if (isEmbedderUnreachable(err)) {
+            logger.warn(`[writer-queue] Embedder unreachable for ${item.url}, retrying once after 2s...`);
+            await new Promise(r => setTimeout(r, 2000));
+            try {
+              await this.ingest(item);
+            } catch (retryErr) {
+              logger.error(`[writer-queue] Retry failed for ${item.url}, dropping:`, retryErr);
+              metrics.increment('knowledge_ingest_dropped_total', 1, { reason: 'embedder_unreachable' });
+            }
+          } else if (isNoSpace(err)) {
+            logger.error(`[writer-queue] ENOSPC: disk full — dropping ${item.url}. Free up disk space to resume knowledge ingestion.`);
+            metrics.increment('knowledge_ingest_dropped_total', 1, { reason: 'enospc' });
+          } else {
+            logger.error(`[writer-queue] Failed to ingest ${item.url}:`, err);
+            metrics.increment('knowledge_ingest_dropped_total', 1, { reason: 'ingest_error' });
           }
-        } else if (isNoSpace(err)) {
-          logger.error(`[writer-queue] ENOSPC: disk full — dropping ${item.url}. Free up disk space to resume knowledge ingestion.`);
-          metrics.increment('knowledge_ingest_dropped_total', 1, { reason: 'enospc' });
-        } else {
-          logger.error(`[writer-queue] Failed to ingest ${item.url}:`, err);
-          metrics.increment('knowledge_ingest_dropped_total', 1, { reason: 'ingest_error' });
         }
       }
-    }
+    } finally {
+      this.processing = false;
 
-    this.processing = false;
-    
-    // Notify all drain callers
-    const resolvers = [...this.drainResolvers];
-    this.drainResolvers = [];
-    for (const resolve of resolvers) {
-      resolve();
+      // Notify all drain callers
+      const resolvers = [...this.drainResolvers];
+      this.drainResolvers = [];
+      for (const resolve of resolvers) {
+        resolve();
+      }
     }
   }
 
@@ -172,15 +180,28 @@ export class WriterQueue implements IWriterQueue {
     // Dedup: check if we already have this exact URL+type with identical content.
     // findByUrl applies scope filtering, so this only dedupes within the
     // current project's visible scope (local workspace + global entries).
+    // Compared against the NEWEST generation, not row order: after a failed prune
+    // two generations coexist and findByUrl's order is arbitrary — matching the
+    // OLD generation's hash would skip the refresh with the duplicates in place.
     const existing = await this.options.store.findByUrl(normalizedUrl);
     const sameType = existing.filter(c => c.metadata['ingestionType'] === incomingType);
-    if (sameType.length > 0 && sameType[0]!.metadata['contentHash'] === hash) {
-      logger.log(`[writer-queue] Skipping ${normalizedUrl} (${incomingType}) — content unchanged.`);
-      return;
-    }
-
     if (sameType.length > 0) {
-      await this.options.store.deleteByUrlAndType(normalizedUrl, incomingType);
+      const newestTs = Math.max(...sameType.map(d => Number(d.timestamp) || 0));
+      const newest = sameType.find(d => (Number(d.timestamp) || 0) === newestTs)!;
+      if (newest.metadata['contentHash'] === hash) {
+        // Content unchanged vs the current generation — but a prior failed prune
+        // may still have left older generations behind, and with stable content
+        // this skip is the only code that ever looks at this URL again. Collect
+        // them now instead of preserving the duplicates forever.
+        if (sameType.some(d => (Number(d.timestamp) || 0) < newestTs)) {
+          await this.options.store.deleteByUrlAndType(normalizedUrl, incomingType, newestTs).catch((err) => {
+            logger.warn(`[writer-queue] Sweeping superseded duplicates for ${normalizedUrl} (${incomingType}) failed:`, err);
+            metrics.increment('knowledge_ingest_stale_prune_failed_total', 1);
+          });
+        }
+        logger.log(`[writer-queue] Skipping ${normalizedUrl} (${incomingType}) — content unchanged.`);
+        return;
+      }
     }
 
     const rawChunks = this.options.chunker
@@ -189,6 +210,10 @@ export class WriterQueue implements IWriterQueue {
 
     if (rawChunks.length === 0) return;
 
+    // Single timestamp shared by every chunk of this write: it is both the row's
+    // recency value and the boundary used to prune the rows this write replaces.
+    const insertedAt = Date.now();
+
     const docs: StoreDocument[] = rawChunks.map((chunk, i) => ({
       url: normalizedUrl,
       text: chunk.text,
@@ -203,10 +228,27 @@ export class WriterQueue implements IWriterQueue {
         chunkIndex: i,
         totalChunks: rawChunks.length,
       },
-      timestamp: Date.now(),
+      timestamp: insertedAt,
     }));
 
+    // Write the replacement BEFORE removing what it replaces. Deleting first made
+    // the refresh destructive: addDocuments can fail (embedder unreachable, ENOSPC,
+    // store closing mid-write) and the perfectly good previous entry was already
+    // gone, so a failed refresh left the URL with no entry at all rather than a
+    // stale one. In this order a failure leaves the old entry intact and the retry
+    // simply tries again.
     await this.options.store.addDocuments(docs);
+
+    if (sameType.length > 0) {
+      // Prune only rows older than this write, so the delete cannot take the rows
+      // just inserted. Failing here leaves duplicate chunks — visible but harmless,
+      // and cleaned up by the next successful ingest of this URL — which is a far
+      // better outcome than throwing away a write that already succeeded.
+      await this.options.store.deleteByUrlAndType(normalizedUrl, incomingType, insertedAt).catch((err) => {
+        logger.warn(`[writer-queue] Replacement for ${normalizedUrl} (${incomingType}) is stored, but pruning the superseded chunks failed; duplicates remain until the next refresh:`, err);
+        metrics.increment('knowledge_ingest_stale_prune_failed_total', 1);
+      });
+    }
   }
 
   async drain(timeoutMs?: number): Promise<void> {

package/src/orchestration/deep-research-orchestrator.ts

@@ -10,7 +10,7 @@ import { logger } from '../logger.ts';
 import { safeUnref } from '../utils/safe-unref.ts';
 import { metrics } from '../utils/metrics.ts';
 import { getSteeringMessages, consumeQueuedMessages, getActiveSteeringMessages, getFailedResearchers, getResearcherFailureReasons } from './session-state.ts';
-import { MAX_EXTRA_ROUNDS_WITH_STEERING } from '../constants.ts';
+import { MAX_EXTRA_ROUNDS_WITH_STEERING, resolveExcludedTools } from '../constants.ts';
 import {
   getMaxRounds,
 } from '../core/planning-utils.ts';
@@ -218,6 +218,17 @@ export class DeepResearchOrchestrator {
                 excludeTools: this.options.excludeTools,
                 steeringMessages: steeringTexts,
             });
+        } else if (this.currentRound >= maxRounds) {
+            // Last iteration: the `plan.action === 'synthesize' || currentRound >=
+            // maxRounds` break below fires no matter what the evaluator decides, and
+            // the forced-synthesis path after the loop runs updatePlanForRound again
+            // with mustSynthesize. So on every capped run whose evaluator would have
+            // said `delegate` — the common case, since it is being cut off mid-plan —
+            // this call is a second full-context coordinator request whose result is
+            // discarded. Break straight to the forced synthesis: exactly one
+            // coordinator call either way, and the same outcome.
+            logger.log(`[DeepOrchestrator] Round cap (${maxRounds}) reached — skipping the evaluator and going straight to final synthesis ${this.elapsed()}`);
+            break;
         } else {
             const synthesisService = await getService<IResearchSynthesisService>(ServiceNames.RESEARCH_SYNTHESIS_SERVICE, ctx, container);
             observer?.onEvaluationStart?.(this.currentRound);
@@ -382,7 +393,7 @@ export class DeepResearchOrchestrator {
                 options: {
                     ...this.options,
                     config: this.config,
-                    excludeTools: this.options.excludeTools || ['grep'],
+                    excludeTools: resolveExcludedTools(this.options.excludeTools),
                     observer: this.observer,
                 },
                 currentRound: this.currentRound,

package/src/orchestration/quick-research-orchestrator.ts

@@ -18,7 +18,7 @@ import { logger } from '../logger.ts';
 import { getConfig, type Config } from '../config.ts';
 import { createResearcherSession } from './researcher.ts';
 import { ensureAssistantResponse, parseCitations } from '../utils/text-utils.ts';
-import { getMaxScrapeBatches } from '../constants.ts';
+import { getMaxScrapeBatches, resolveExcludedTools } from '../constants.ts';
 import type { ResearchObserver } from '../core/interfaces/observer-interfaces.ts';
 import { HeadlessObserver, makeSafeObserver, type HeadlessObserverOptions } from './headless-observer.ts';
 import { getService, tryGetServiceContainerFromCtx } from '../core/service-registry.ts';
@@ -180,7 +180,7 @@ export class QuickResearchOrchestrator {
           modelRegistry: ctx.modelRegistry,
           systemPrompt: prompt,
           extensionCtx: ctx,
-          excludeTools: this.options.excludeTools || ['grep'],
+          excludeTools: resolveExcludedTools(this.options.excludeTools),
           config: this.config,
           getGlobalState: (): SystemResearchState => ({
             version: 1,

package/src/orchestration/research-orchestration-service.ts

@@ -14,7 +14,7 @@ import type { Model } from '@earendil-works/pi-ai';
 import { resolveResearchModel } from '../core/llm/research-model-resolver.ts';
 import type { QueryResultWithError } from '../web-research/types.ts';
 import type { RunResearchersOptions } from './orchestration-types.ts';
-import { RESEARCHER_LAUNCH_DELAY_MS } from '../constants.ts';
+import { RESEARCHER_LAUNCH_DELAY_MS, resolveExcludedTools } from '../constants.ts';
 import { search } from '../web-research/search.ts';
 import { parseCitations } from '../utils/text-utils.ts';
 import { logger, resetLogger } from '../logger.ts';
@@ -98,9 +98,7 @@ export class ResearchOrchestrationService implements IResearchOrchestration {
     const configDisabledTools = researchConfig.DISABLED_TOOLS
       ? researchConfig.DISABLED_TOOLS.split(',').map((s) => s.trim()).filter(Boolean)
       : [];
-    const mergedExcludeTools = configDisabledTools.length > 0
-      ? [...new Set([...(excludeTools ?? []), ...configDisabledTools])]
-      : excludeTools;
+    const mergedExcludeTools = resolveExcludedTools(excludeTools, configDisabledTools);
 
     // Resolve model using centralized priority logic
     const selectedModel = await this.resolveResearchModel(options);