@lincoln504/pi-research 1.1.2 → 1.3.0

package/src/infrastructure/browser/thread-worker.mjs

@@ -51,13 +51,17 @@ function redactSecrets(message) {
   out = out.replace(JWT_PATTERN, "[REDACTED]");
   out = out.replace(BASIC_AUTH_PATTERN, "Basic [REDACTED]");
   out = out.replace(BEARER_AUTH_PATTERN, "Bearer [REDACTED]");
+  out = out.replace(COOKIE_HEADER_PATTERN, (_m, key, sep) => `${key}${sep}[REDACTED]`);
   out = out.replace(SENSITIVE_KV_PATTERN, (_m, key, sep) => `${key}${sep}[REDACTED]`);
   out = out.replace(KNOWN_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(PROVIDER_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(LONG_HEX_SECRET_PATTERN, "[REDACTED]");
   return out;
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN;
+function stripTerminalEscapes(message) {
+  return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
+}
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -65,6 +69,7 @@ var init_log_utils = __esm({
     MAX_LOG_MESSAGE_LENGTH = 1e4;
     ANSI_PATTERN = /\x1b\[[0-9;]*[A-Za-z]/g;
     URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s:@]+@/gi;
+    COOKIE_HEADER_PATTERN = /\b(set[_-]?cookie|cookie)\b(["']?\s*[:=]\s*["']?)([^\r\n]+)/gi;
     SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
     KNOWN_TOKEN_PATTERN = /\b(sk-[A-Za-z0-9_-]{16,}|gh[posru]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
     JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
@@ -72,6 +77,106 @@ var init_log_utils = __esm({
     BEARER_AUTH_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
+    CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    TERMINAL_ESCAPE_PATTERN = new RegExp(
+      "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
+      "g"
+    );
+  }
+});
+
+// src/utils/user-agent.ts
+var USER_AGENTS;
+var init_user_agent = __esm({
+  "src/utils/user-agent.ts"() {
+    "use strict";
+    USER_AGENTS = [
+      // Chrome on Windows (updated 2025)
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+      // Chrome on macOS
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+      // Chrome on Linux
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+      // Firefox on Windows (updated 2025)
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0",
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0",
+      // Firefox on macOS
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0",
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0"
+    ];
+  }
+});
+
+// src/web-research/scraper-types.ts
+var MAX_HTML_SIZE, MAX_PDF_SIZE, INTERNAL_NETWORK_PATTERNS, FILTERED_TAGS, BOT_PATTERNS, IMAGE_LINK_PATTERN, MARKDOWN_IMAGE_PATTERN;
+var init_scraper_types = __esm({
+  "src/web-research/scraper-types.ts"() {
+    "use strict";
+    init_user_agent();
+    MAX_HTML_SIZE = 25 * 1024 * 1024;
+    MAX_PDF_SIZE = 100 * 1024 * 1024;
+    INTERNAL_NETWORK_PATTERNS = [
+      /^127\./,
+      // IPv4 loopback
+      /^0\./,
+      // IPv4 "this" network
+      /^::1$/,
+      // IPv6 loopback
+      /^fe80::/i,
+      // IPv6 link-local
+      /^f[cd][0-9a-f]{2}:/i,
+      // IPv6 unique local — full fc00::/7 block (fc00::–fdff::)
+      /^169\.254\./,
+      // IPv4 link-local (and metadata)
+      /^10\./,
+      // RFC 1918 Class A private
+      /^192\.168\./,
+      // RFC 1918 Class C private
+      /^172\.(1[6-9]|2[0-9]|3[01])\./,
+      // RFC 1918 Class B private
+      /^::ffff:(127\.|0\.|169\.254\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i
+      // IPv4-mapped IPv6
+    ];
+    FILTERED_TAGS = [
+      "nav",
+      "header",
+      "footer",
+      "aside",
+      "script",
+      "style",
+      "noscript",
+      "form",
+      "input",
+      "select",
+      "textarea",
+      "button",
+      "object",
+      "embed",
+      "svg",
+      "symbol",
+      "use",
+      "defs",
+      "path",
+      "circle",
+      "rect",
+      "line",
+      "polygon",
+      "img",
+      "iframe"
+    ];
+    BOT_PATTERNS = [
+      ["_cf_chl_", "Cloudflare challenge"],
+      ["cf_chl_opt", "Cloudflare challenge opt"],
+      ["cdn-cgi/challenge-platform", "Cloudflare challenge platform"],
+      ["ddos-guard", "DDoS-Guard challenge"],
+      ["Just a moment...", "Cloudflare interstitial"],
+      ["Checking your browser before accessing", "Cloudflare interstitial"]
+    ];
+    IMAGE_LINK_PATTERN = /\[([^\]]*)\]\((data:image\/[^)]+|[^)\s]+\.(?:svg|png|jpe?g|gif|webp|bmp|ico)(?:\?[^)]*)?)\)/gi;
+    MARKDOWN_IMAGE_PATTERN = /!\[[^\]]*]\((?:data:image\/[^)]+|[^)\s]+)\)/gi;
   }
 });
 
@@ -265,6 +370,14 @@ var init_log_rotation = __esm({
         try {
           if (fs2.existsSync(logFile)) {
             fs2.unlinkSync(logFile);
+            try {
+              fs2.closeSync(fs2.openSync(logFile, "a", 384));
+            } catch {
+            }
+            try {
+              fs2.chmodSync(logFile, 384);
+            } catch {
+            }
           }
           const files = fs2.readdirSync(logDir);
           const baseName = path2.basename(logFile);
@@ -297,12 +410,16 @@ var init_log_rotation = __esm({
           try {
             fs2.renameSync(logFile, archivePath);
           } catch (renameErr) {
-            if (process.platform === "win32") {
-              fs2.copyFileSync(logFile, archivePath);
-              fs2.unlinkSync(logFile);
-            } else {
-              throw renameErr;
-            }
+            this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
+            return;
+          }
+          try {
+            fs2.closeSync(fs2.openSync(logFile, "a", 384));
+          } catch {
+          }
+          try {
+            fs2.chmodSync(logFile, 384);
+          } catch {
           }
           try {
             const files = fs2.readdirSync(logDir);
@@ -372,10 +489,13 @@ var init_disk_space_checker = __esm({
           const availableBytes = stats.bavail * stats.bsize;
           if (availableBytes < this.MIN_DISK_SPACE_BYTES) {
             this.hasDiskSpace = false;
-            process.stderr.write(
-              `[pi-research] Insufficient disk space for logging: ${Math.round(availableBytes / 1024 / 1024)}MB available, minimum ${this.MIN_DISK_SPACE_BYTES / 1024 / 1024}MB required
+            try {
+              process.stderr.write(
+                `[pi-research] Insufficient disk space for logging: ${Math.round(availableBytes / 1024 / 1024)}MB available, minimum ${this.MIN_DISK_SPACE_BYTES / 1024 / 1024}MB required
 `
-            );
+              );
+            } catch {
+            }
           } else {
             this.hasDiskSpace = true;
           }
@@ -482,7 +602,7 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
       if (shouldRedirectStderr(stat)) {
         savedFd2 = fs4.openSync("/dev/fd/2", "a");
         fs4.closeSync(2);
-        const newFd = fs4.openSync(logFile, "a");
+        const newFd = fs4.openSync(logFile, "a", 384);
         if (newFd === 2) {
           fd2Redirected = true;
         } else {
@@ -614,42 +734,52 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     }
   } catch (_e) {
   }
+  const frame = {
+    retired: false,
+    restore: () => {
+      process.stderr.write = originalStderrWrite;
+      process.stdout.write = originalStdoutWrite;
+      try {
+        fs4.writeSync = originalFsWriteSync;
+      } catch {
+      }
+      console.log = originalConsole.log;
+      console.info = originalConsole.info;
+      console.warn = originalConsole.warn;
+      console.error = originalConsole.error;
+      console.debug = originalConsole.debug;
+      if (fd2Redirected && savedFd2 >= 0) {
+        try {
+          fs4.closeSync(2);
+          const r = fs4.openSync(`/dev/fd/${savedFd2}`, "a");
+          if (r !== 2 && r >= 0) {
+          }
+          try {
+            fs4.closeSync(savedFd2);
+          } catch {
+          }
+        } catch {
+        }
+      }
+    }
+  };
+  captureStack.push(frame);
   try {
     return await task();
   } finally {
-    process.stderr.write = originalStderrWrite;
-    process.stdout.write = originalStdoutWrite;
-    try {
-      fs4.writeSync = originalFsWriteSync;
-    } catch {
-    }
-    console.log = originalConsole.log;
-    console.info = originalConsole.info;
-    console.warn = originalConsole.warn;
-    console.error = originalConsole.error;
-    console.debug = originalConsole.debug;
     if (sessionId) {
       setSessionCapturing(sessionId, false);
     } else {
       unkeyedCaptureDepth = Math.max(0, unkeyedCaptureDepth - 1);
       recomputeGlobalCapturing();
     }
-    if (fd2Redirected && savedFd2 >= 0) {
-      try {
-        fs4.closeSync(2);
-        const r = fs4.openSync(`/dev/fd/${savedFd2}`, "a");
-        if (r !== 2 && r >= 0) {
-        }
-        try {
-          fs4.closeSync(savedFd2);
-        } catch {
-        }
-      } catch {
-      }
+    frame.retired = true;
+    while (captureStack.length > 0 && captureStack[captureStack.length - 1].retired) {
+      captureStack.pop().restore();
     }
   }
 }
-var fs4, sessionCaptureStates, unkeyedCaptureDepth, isAnyLoggerCapturingOutput, NATIVE_LOG_PATTERNS, COMPLEX_TUI_PATTERNS, BOX_DRAWING_CHARS;
+var fs4, sessionCaptureStates, unkeyedCaptureDepth, isAnyLoggerCapturingOutput, captureStack, NATIVE_LOG_PATTERNS, COMPLEX_TUI_PATTERNS, BOX_DRAWING_CHARS;
 var init_stdio_capture = __esm({
   "src/utils/stdio-capture.ts"() {
     "use strict";
@@ -658,6 +788,7 @@ var init_stdio_capture = __esm({
     sessionCaptureStates = /* @__PURE__ */ new Map();
     unkeyedCaptureDepth = 0;
     isAnyLoggerCapturingOutput = false;
+    captureStack = [];
     NATIVE_LOG_PATTERNS = [
       "Warning:",
       "Error:",
@@ -699,7 +830,7 @@ var init_stdio_capture = __esm({
 });
 
 // src/logger.ts
-import { appendFileSync, existsSync as existsSync2, mkdirSync, openSync, closeSync } from "node:fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync, openSync as openSync2, closeSync as closeSync2 } from "node:fs";
 import { appendFile as appendFile2 } from "node:fs/promises";
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 import * as path3 from "node:path";
@@ -859,7 +990,7 @@ var init_logger = __esm({
             mkdirSync(this.logDir, { recursive: true, mode: 448 });
           }
           try {
-            closeSync(openSync(this.logFile, "wx", 384));
+            closeSync2(openSync2(this.logFile, "wx", 384));
           } catch {
           }
         } catch {
@@ -894,7 +1025,7 @@ var init_logger = __esm({
         if (this.consoleLog) {
           const color = level === "ERROR" /* ERROR */ ? "\x1B[31m" : level === "WARN" /* WARN */ ? "\x1B[33m" : level === "DEBUG" /* DEBUG */ ? "\x1B[90m" : "\x1B[36m";
           const reset = "\x1B[0m";
-          const msg = message.replace(/[\r\n]/g, "");
+          const msg = stripTerminalEscapes(message.replace(/[\r\n]/g, ""));
           const rawSid = this.sessionId ?? "";
           const sid = rawSid.replace(/[\r\n]/g, "");
           const prefix = sid ? `[${sid}] ` : "";
@@ -1133,101 +1264,6 @@ var init_metrics = __esm({
   }
 });
 
-// src/utils/user-agent.ts
-var USER_AGENTS;
-var init_user_agent = __esm({
-  "src/utils/user-agent.ts"() {
-    "use strict";
-    USER_AGENTS = [
-      // Chrome on Windows (updated 2025)
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
-      // Chrome on macOS
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
-      // Chrome on Linux
-      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
-      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
-      // Firefox on Windows (updated 2025)
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0",
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0",
-      // Firefox on macOS
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0",
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0"
-    ];
-  }
-});
-
-// src/web-research/scraper-types.ts
-var MAX_HTML_SIZE, MAX_PDF_SIZE, INTERNAL_NETWORK_PATTERNS, FILTERED_TAGS, BOT_PATTERNS, IMAGE_LINK_PATTERN, MARKDOWN_IMAGE_PATTERN;
-var init_scraper_types = __esm({
-  "src/web-research/scraper-types.ts"() {
-    "use strict";
-    init_user_agent();
-    MAX_HTML_SIZE = 25 * 1024 * 1024;
-    MAX_PDF_SIZE = 100 * 1024 * 1024;
-    INTERNAL_NETWORK_PATTERNS = [
-      /^127\./,
-      // IPv4 loopback
-      /^0\./,
-      // IPv4 "this" network
-      /^::1$/,
-      // IPv6 loopback
-      /^fe80::/i,
-      // IPv6 link-local
-      /^f[cd][0-9a-f]{2}:/i,
-      // IPv6 unique local — full fc00::/7 block (fc00::–fdff::)
-      /^169\.254\./,
-      // IPv4 link-local (and metadata)
-      /^10\./,
-      // RFC 1918 Class A private
-      /^192\.168\./,
-      // RFC 1918 Class C private
-      /^172\.(1[6-9]|2[0-9]|3[01])\./,
-      // RFC 1918 Class B private
-      /^::ffff:(127\.|0\.|169\.254\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i
-      // IPv4-mapped IPv6
-    ];
-    FILTERED_TAGS = [
-      "nav",
-      "header",
-      "footer",
-      "aside",
-      "script",
-      "style",
-      "noscript",
-      "form",
-      "input",
-      "select",
-      "textarea",
-      "button",
-      "object",
-      "embed",
-      "svg",
-      "symbol",
-      "use",
-      "defs",
-      "path",
-      "circle",
-      "rect",
-      "line",
-      "polygon",
-      "img",
-      "iframe"
-    ];
-    BOT_PATTERNS = [
-      ["_cf_chl_", "Cloudflare challenge"],
-      ["cf_chl_opt", "Cloudflare challenge opt"],
-      ["cdn-cgi/challenge-platform", "Cloudflare challenge platform"],
-      ["ddos-guard", "DDoS-Guard challenge"],
-      ["Just a moment...", "Cloudflare interstitial"],
-      ["Checking your browser before accessing", "Cloudflare interstitial"]
-    ];
-    IMAGE_LINK_PATTERN = /\[([^\]]*)\]\((data:image\/[^)]+|[^)\s]+\.(?:svg|png|jpe?g|gif|webp|bmp|ico)(?:\?[^)]*)?)\)/gi;
-    MARKDOWN_IMAGE_PATTERN = /!\[[^\]]*]\((?:data:image\/[^)]+|[^)\s]+)\)/gi;
-  }
-});
-
 // src/utils/circuit-breaker.ts
 var CircuitBreaker;
 var init_circuit_breaker = __esm({
@@ -1277,7 +1313,7 @@ var init_circuit_breaker = __esm({
           const result = await action();
           const duration = Date.now() - startTime;
           metrics.observe("circuit_breaker_call_duration_ms", duration, { breaker: this.options.name, status: "success" });
-          this.onSuccess();
+          this.onSuccess(admittedAsProbe);
           return result;
         } catch (error) {
           const duration = Date.now() - startTime;
@@ -1295,9 +1331,10 @@ var init_circuit_breaker = __esm({
           if (admittedAsProbe) this.halfOpenInFlight = Math.max(0, this.halfOpenInFlight - 1);
         }
       }
-      onSuccess() {
+      onSuccess(admittedAsProbe) {
         metrics.increment("circuit_breaker_success_total", 1, { breaker: this.options.name, state: this.state });
         if (this.state === "HALF_OPEN") {
+          if (!admittedAsProbe) return;
           this.successCount++;
           if (this.successCount >= this.options.halfOpenMaxCalls) {
             this.transitionTo("CLOSED");
@@ -1389,7 +1426,11 @@ function isPoolShutdownError(error) {
   // classifier matched it, so the first attempt rethrew instead of retrying —
   // and auto-recovery fires only after 3 consecutive worker failures, i.e.
   // exactly when a burst of tasks is in flight and would all die together.
-  err.message.includes("Worker pool is being reset"));
+  err.message.includes("Worker pool is being reset") || // poolifier's wording once destroy() has COMPLETED (vs "destroying pool"
+  // while it is in progress). A queued closure holding a pool captured before
+  // an auto-recovery destroy dispatches into exactly this window; it is the
+  // same transient swap the "being reset" string covers, not a hard fault.
+  err.message.includes("Cannot execute a task on not started pool"));
 }
 var DEFAULT_BREAKER_CONFIG, browserCircuitBreaker;
 var init_browser_error_utils = __esm({
@@ -1595,12 +1636,14 @@ function isPrivateIpv6(ip) {
   if (normalized === "::1") return true;
   if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
   if (normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb")) return true;
+  if (normalized.startsWith("fec") || normalized.startsWith("fed") || normalized.startsWith("fee") || normalized.startsWith("fef")) return true;
   const mapped = extractMappedIpv4(normalized);
   if (mapped) {
     return isPrivateIp(mapped);
   }
   if (normalized.startsWith("2002:")) return true;
   if (/^2001:0{0,4}:/.test(normalized) || normalized.startsWith("2001::")) return true;
+  if (normalized.startsWith("64:ff9b:")) return true;
   if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0") return true;
   return false;
 }
@@ -1753,12 +1796,34 @@ function setupOrphanProtection() {
   if (!cluster.isWorker) {
     return;
   }
-  if (!process2.ppid) {
+  const originalPpid = process2.ppid;
+  if (!originalPpid) {
     return;
   }
+  const exitAsOrphan = async () => {
+    if (cleanupBrowser) {
+      await Promise.race([
+        cleanupBrowser().catch((err) => {
+          logToDebugFile("WARN", `[Worker-${workerId}] Browser cleanup failed during orphan exit:`, err);
+        }),
+        new Promise((resolve) => {
+          const t = setTimeout(resolve, 1e4);
+          if (t.unref) t.unref();
+        })
+      ]);
+    }
+    cleanupOrphanProtection();
+    process2.env["PI_PROCESS_EXITING"] = "1";
+    process2.exit(1);
+  };
   const checkOrphan = async () => {
     try {
-      process2.kill(process2.ppid, 0);
+      if (process2.ppid !== originalPpid) {
+        logToDebugFile("WARN", `[Worker-${workerId}] Re-parented (${originalPpid} -> ${process2.ppid}): parent died, shutting down...`);
+        await exitAsOrphan();
+        return;
+      }
+      process2.kill(originalPpid, 0);
       orphanCheckTimer = setTimeout(checkOrphan, 1e4);
       if (orphanCheckTimer) {
         orphanCheckTimer.unref();
@@ -1770,14 +1835,7 @@ function setupOrphanProtection() {
         return;
       }
       logToDebugFile("WARN", `[Worker-${workerId}] Parent process died or unreachable (orphaned), shutting down...`);
-      if (cleanupBrowser) {
-        await cleanupBrowser().catch((err) => {
-          logToDebugFile("WARN", `[Worker-${workerId}] Browser cleanup failed during orphan exit:`, err);
-        });
-      }
-      cleanupOrphanProtection();
-      process2.env["PI_PROCESS_EXITING"] = "1";
-      process2.exit(1);
+      await exitAsOrphan();
     }
   };
   orphanCheckTimer = setTimeout(checkOrphan, 1e4);
@@ -1838,6 +1896,7 @@ import { platform as platform2 } from "node:os";
 
 // src/infrastructure/browser/thread-worker-messaging.ts
 init_log_utils();
+init_scraper_types();
 import { appendFileSync as appendFileSync2 } from "node:fs";
 var workerId2 = "";
 var pageCreationLock = Promise.resolve();
@@ -2130,17 +2189,31 @@ async function executeScrapeTask(_context, url, signal) {
       validateForWorkerSync(ip.includes(":") ? `http://[${ip}]/` : `http://${ip}/`);
     }
     const contentType = await response?.headerValue("content-type") || "";
+    const status = response?.status?.() ?? 0;
     if (contentType.includes("application/pdf")) {
       if (!response) throw new Error(`[Worker] No response received for PDF URL: ${url}`);
+      if (status >= 400) throw new Error(`HTTP ${status}`);
+      const declaredLength = parseInt(await response.headerValue("content-length").catch(() => null) || "", 10);
+      if (Number.isFinite(declaredLength) && declaredLength > MAX_PDF_SIZE) {
+        const sizeMB = Math.round(declaredLength / 1024 / 1024);
+        throw new Error(`PDF too large (${sizeMB}MB, max 100MB)`);
+      }
       const buffer = await response.body();
+      if (buffer.byteLength > MAX_PDF_SIZE) {
+        const sizeMB = Math.round(buffer.byteLength / 1024 / 1024);
+        throw new Error(`PDF too large (${sizeMB}MB, max 100MB)`);
+      }
       await Promise.allSettled(pendingAddrChecks);
       if (poisonedError) throw poisonedError;
       await page.close();
-      return { contentType, buffer, jitter: 0 };
+      return { contentType, bufferB64: buffer.toString("base64"), jitter: 0 };
     }
     let html = await page.content();
     const cfPatterns = ["_cf_chl_", "cdn-cgi/challenge-platform", "cf_chl_opt", "Just a moment...", "Checking your browser before accessing"];
     const hasCloudflare = cfPatterns.some((pattern) => html.includes(pattern));
+    if (status >= 400 && !hasCloudflare) {
+      throw new Error(`HTTP ${status}`);
+    }
     if (hasCloudflare) {
       logToDebugFile2("WARN", `[Worker-${workerId2}] Cloudflare challenge detected for: ${url}`);
       try {
@@ -2165,6 +2238,10 @@ async function executeScrapeTask(_context, url, signal) {
       await page.waitForLoadState("networkidle", { timeout: 1e4 }).catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Swallowed page close/wait error: ${err.message || String(err)}`));
       html = await page.content();
     }
+    if (html.length > MAX_HTML_SIZE) {
+      const sizeMB = Math.round(html.length / 1024 / 1024);
+      throw new Error(`Browser HTML too large (${sizeMB}MB, max 25MB)`);
+    }
     const jitter = process.env["PI_RESEARCH_MOCK_SCRAPE"] === "true" ? 0 : Math.floor(Math.random() * 1e3) + 500;
     if (jitter > 0) await new Promise((r) => setTimeout(r, jitter));
     const finalAddr = await finalMainFrameAddr;

package/src/infrastructure/browser/worker-pool-manager.ts

@@ -112,6 +112,7 @@ export class WorkerPoolManager implements IService {
             try {
                 if (this.pool && this.currentWorkerCount !== maxWorkers) {
                     logger.log(`[WorkerPoolManager] Worker count changed from ${this.currentWorkerCount} to ${maxWorkers}, recreating pool...`);
+                    this.poolEpoch++; // intentional destroy: silence the dying pool's exit events
                     await this.pool.destroy();
                     this.pool = null;
                 }
@@ -185,8 +186,13 @@ export class WorkerPoolManager implements IService {
                 const myEpoch = ++this.poolEpoch;
                 this.pool = new FixedClusterPool(maxWorkers, workerPath, {
                     env: browserEnv,
-                    // Prevent query leakage via process.argv in forked workers
-                    workerOptions: { execArgv: [] },
+                    // Prevent query leakage via process.argv in forked workers: cluster
+                    // pools fork through cluster.setupPrimary(opts.settings), and
+                    // cluster.settings.args defaults to process.argv.slice(2) — without
+                    // this, every worker re-exposes the full CLI (research query
+                    // included) in `ps`. NB `workerOptions` is a worker_threads-only
+                    // poolifier knob; it is ignored by cluster pools.
+                    settings: { args: [] },
                     errorHandler: (e: Error) => {
                         // Ignore events from a pool that has since been replaced/destroyed — a
                         // trailing error from an old pool's dying worker must not affect the live one.
@@ -211,9 +217,13 @@ export class WorkerPoolManager implements IService {
                         }
                     },
                     exitHandler: (code: number) => {
-                        // null exit code means the worker was killed intentionally (e.g. pool.destroy()).
-                        // Ignore exits from a superseded pool instance (see errorHandler).
-                        if (code !== 0 && code !== null && this.poolEpoch === myEpoch) {
+                        // A worker we destroy on purpose exits with code null — but so does one
+                        // the OOM killer SIGKILLs, and that is exactly the death mode that leaves
+                        // in-flight execute() promises stranded (poolifier never settles them).
+                        // Every intentional destroy bumps poolEpoch first, so a null-code exit
+                        // that still matches the live epoch is an unexpected death and must count
+                        // toward auto-recovery like any other abnormal exit.
+                        if (code !== 0 && this.poolEpoch === myEpoch) {
                             logger.error(`[WorkerPoolManager] Worker exited with code ${code}`);
                             this.consecutiveErrors++;
                             if (this.consecutiveErrors >= 3) {
@@ -245,6 +255,7 @@ export class WorkerPoolManager implements IService {
                     // Only null the shared field if it still points at the pool we built —
                     // a concurrent path may already have moved on.
                     if (this.pool === built) this.pool = null;
+                    this.poolEpoch++; // intentional destroy: silence the dying pool's exit events
                     await built.destroy().catch((err: any) => logger.debug('Swallowed pool destroy error:', err));
                     throw new Error('Worker pool is shutting down');
                 }
@@ -337,6 +348,7 @@ export class WorkerPoolManager implements IService {
                 // pool (and bumped the generation), so skip — destroying again is spurious
                 // and nulling shared state would clobber a pool rebuilt after the shutdown.
                 if (this.isShuttingDown || this.generation !== myGen) return;
+                this.poolEpoch++; // intentional destroy: silence the dying pool's exit events
                 if (deadPool) await deadPool.destroy();
                 logger.info('[WorkerPoolManager] Auto-recovery: old pool destroyed.');
             } catch (err) {
@@ -399,6 +411,7 @@ export class WorkerPoolManager implements IService {
                 // Use a timeout for pool destruction. Workers run async browser teardown
                 // in their killHandler (context.close / browser.close via Playwright), so
                 // allow enough time for those to complete before the IPC channel closes.
+                this.poolEpoch++; // intentional destroy: silence the dying pool's exit events
                 const destroyPromise = this.pool.destroy();
                 destroyPromise.catch((err: Error) => logger.debug(`[WorkerPoolManager] Background pool destroy rejection: ${err.message}`));
                 await raceWithDeadline(destroyPromise, 5000);