@lincoln504/pi-research 1.1.2 → 1.3.0

package/src/utils/http-body.ts

@@ -0,0 +1,176 @@
+/**
+ * Capped response-body reading.
+ *
+ * `response.json()` and `response.text()` buffer the WHOLE body into the main
+ * process before anything can inspect its size — the byte count is only knowable
+ * after the memory has already been committed. A hostile or merely broken upstream
+ * can therefore drive this process to an OOM kill with a single reply, and because
+ * a `Content-Length` header is advisory (absent on chunked encoding, and freely
+ * falsifiable) no pre-screen closes that hole. Streaming chunk-by-chunk and
+ * aborting the instant the cap is crossed is the only check that actually bounds
+ * the allocation.
+ *
+ * The scraper has read HTML and PDF this way for some time; these helpers exist so
+ * the JSON API clients share that one implementation rather than each growing a
+ * near-copy of it.
+ */
+
+/** Thrown by {@link readBodyCapped} when a streamed body crosses its byte cap. */
+export class BodyTooLargeError extends Error {
+  constructor(public readonly bytesRead: number, public readonly maxBytes: number) {
+    super(`Response body exceeded ${maxBytes} byte cap`);
+    this.name = 'BodyTooLargeError';
+  }
+}
+
+/**
+ * Default cap for a JSON API response.
+ *
+ * Every endpoint behind these clients answers in kilobytes for a normal query, so
+ * 32MB is orders of magnitude of headroom for legitimate traffic while still
+ * bounding a runaway body to something a Node heap absorbs without dying. Bulk
+ * endpoints that legitimately return more (a full vulnerability catalogue, a
+ * maximum-size CVE page) pass their own larger cap explicitly.
+ */
+export const MAX_JSON_BODY_BYTES = 32 * 1024 * 1024;
+
+/**
+ * Cap for bulk catalogue downloads (CISA KEV's full feed, a 2000-item NVD page).
+ * These are legitimately tens of megabytes and grow over time, so they get their
+ * own ceiling rather than forcing the shared default up for everyone.
+ */
+export const MAX_BULK_JSON_BODY_BYTES = 96 * 1024 * 1024;
+
+/**
+ * Read a response body with a HARD byte cap, streaming chunk-by-chunk so an
+ * over-limit body aborts the moment the cap is crossed.
+ *
+ * A body-less response (test doubles, some mocks) falls back to `arrayBuffer()`;
+ * callers that had a post-read size check keep it as the belt for that path.
+ */
+export async function readBodyCapped(response: Response, maxBytes: number): Promise<Uint8Array> {
+  const body = response.body;
+  // Also tolerate non-standard doubles that expose a body without getReader.
+  if (!body || typeof body.getReader !== 'function') {
+    return new Uint8Array(await response.arrayBuffer());
+  }
+
+  const reader = body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) {
+        total += value.byteLength;
+        if (total > maxBytes) throw new BodyTooLargeError(total, maxBytes);
+        chunks.push(value);
+      }
+    }
+  } finally {
+    // Over-cap or downstream throw: release the connection instead of leaving
+    // the socket open (and the server still sending) until GC. No-op after a
+    // clean done=true read.
+    try { await reader.cancel(); } catch { /* already closed */ }
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) { out.set(c, offset); offset += c.byteLength; }
+  return out;
+}
+
+/**
+ * Whether this response can actually be read as a stream — i.e. whether the cap
+ * can be enforced at all.
+ *
+ * A real `Response` from `fetch()` always exposes a `ReadableStream` body except
+ * for the null-body statuses (204/205/304), which have nothing to cap. So in
+ * production this is true exactly when there are bytes to bound, and the capped
+ * path is never quietly skipped. It returns false only for the null-body statuses
+ * and for hand-rolled test doubles, which implement whichever of
+ * `arrayBuffer()`/`text()`/`json()` they need and no stream at all.
+ */
+function hasStreamBody(response: Response): boolean {
+  const body = response.body;
+  return !!body && typeof body.getReader === 'function';
+}
+
+/**
+ * Capped replacement for `response.text()`.
+ *
+ * Decodes UTF-8 non-fatally, matching `Response.text()` — a malformed byte becomes
+ * U+FFFD rather than throwing, so swapping this in cannot turn a body that used to
+ * parse into an exception.
+ */
+export async function readTextCapped(
+  response: Response,
+  maxBytes: number = MAX_JSON_BODY_BYTES,
+): Promise<string> {
+  if (hasStreamBody(response)) {
+    return new TextDecoder('utf-8').decode(await readBodyCapped(response, maxBytes));
+  }
+  // Double/null-body ladder — see hasStreamBody for why this is unreachable for a
+  // real body-bearing response.
+  if (typeof response.arrayBuffer === 'function') {
+    return new TextDecoder('utf-8').decode(new Uint8Array(await response.arrayBuffer()));
+  }
+  return response.text();
+}
+
+/**
+ * Capped replacement for `response.json()`.
+ *
+ * Throws {@link BodyTooLargeError} for an over-cap body and a `SyntaxError` for a
+ * malformed one, so callers that already distinguish "malformed JSON" from other
+ * failures keep working: the size failure is a distinct, catchable type rather
+ * than something that masquerades as a parse error.
+ */
+export async function readJsonCapped<T = unknown>(
+  response: Response,
+  maxBytes: number = MAX_JSON_BODY_BYTES,
+): Promise<T> {
+  if (hasStreamBody(response) || typeof response.arrayBuffer === 'function' || typeof response.text === 'function') {
+    return JSON.parse(await readTextCapped(response, maxBytes)) as T;
+  }
+  // A double that implements json() alone.
+  return response.json() as Promise<T>;
+}
+
+/**
+ * Accumulator for a Node `IncomingMessage` body that decodes UTF-8 exactly ONCE,
+ * at the end.
+ *
+ * The obvious `body += chunk` is silently lossy. `+=` stringifies each Buffer on
+ * its own, so a multi-byte character straddling a chunk boundary is decoded as two
+ * independent fragments and both halves become U+FFFD. Chunk boundaries fall
+ * wherever the socket happens to split, so the damage scales with payload size and
+ * lands only on non-ASCII text — measured at ~15 mangled characters in a 560KB CJK
+ * body. Nothing throws: `JSON.parse` still succeeds, so the corruption reaches the
+ * report and the knowledge store unannounced.
+ *
+ * Buffering the chunks and concatenating before a single decode is what makes a
+ * split sequence whole again.
+ *
+ * `byteLength` counts real bytes, which is also the honest unit for a payload cap —
+ * the old `body.length` measured UTF-16 code units of an already-corrupted string.
+ */
+export class Utf8Body {
+  private readonly chunks: Buffer[] = [];
+  private bytes = 0;
+
+  /** Total bytes accumulated so far. */
+  get byteLength(): number {
+    return this.bytes;
+  }
+
+  push(chunk: Buffer): void {
+    this.chunks.push(chunk);
+    this.bytes += chunk.byteLength;
+  }
+
+  /** Concatenate and decode. Safe to call once the stream has ended. */
+  toString(): string {
+    return Buffer.concat(this.chunks).toString('utf8');
+  }
+}

package/src/utils/json-utils.ts

@@ -96,6 +96,15 @@ function preRepairJson(jsonStr: string): string {
     .replace(/,\s*([}\]])/g, '$1');
 }
 
+/**
+ * Upper bound on the forward candidate scan in extractJsonObject/extractJsonArray.
+ * Prose braces ("Fill {placeholder} …") or citation brackets ("[see note] …") can
+ * precede the real payload, so a closed-but-unparseable candidate must not end the
+ * search — but brace-dense non-JSON text must not turn extraction into a quadratic
+ * walk either, hence the cap.
+ */
+const MAX_JSON_CANDIDATES = 8;
+
 /**
  * Parse a JSON slice, trying it verbatim first and only running preRepairJson on
  * failure. preRepairJson rewrites smart quotes and trailing commas even inside
@@ -114,9 +123,12 @@ function parseRawThenRepair(jsonStr: string): unknown {
 /**
  * Extract JSON object from raw text
  *
- * Finds the first `{` then walks forward with depth-tracking (respecting string
- * literals) to locate its matching `}`. This correctly handles text that contains
- * multiple JSON objects or has trailing content after the object.
+ * Walks forward with depth-tracking (respecting string literals) from each `{`
+ * candidate to its matching `}`. A candidate that closes but fails to parse is a
+ * prose brace (e.g. "Fill {placeholder} like this: {…}"), so the scan advances to
+ * the next `{` — bounded by MAX_JSON_CANDIDATES. Truncated-repair applies at the
+ * first UNCLOSED candidate: past that point there is no further text to scan, and
+ * an unclosed opener is what genuinely cut-off LLM output looks like.
  *
  * @param text - Text to search for JSON object
  * @returns Extraction result with parsed value or error
@@ -124,7 +136,7 @@ function parseRawThenRepair(jsonStr: string): unknown {
 export function extractJsonObject<T = unknown>(
   text: string
 ): JsonExtractionResult<T> {
-  const objStart = text.indexOf('{');
+  let objStart = text.indexOf('{');
 
   if (objStart === -1) {
     return {
@@ -134,54 +146,67 @@ export function extractJsonObject<T = unknown>(
     };
   }
 
-  const { index: objEnd, inString } = findMatchingBracket(text, objStart);
+  let lastParseError = 'unknown parse error';
+  for (
+    let attempt = 0;
+    attempt < MAX_JSON_CANDIDATES && objStart !== -1;
+    attempt++, objStart = text.indexOf('{', objStart + 1)
+  ) {
+    const { index: objEnd, inString } = findMatchingBracket(text, objStart);
 
-  if (objEnd === -1) {
-    // Attempt local repair for truncated JSON
-    logger.debug('[json-utils] JSON object truncated; attempting local repair');
-    let partialText = text.slice(objStart);
-    
-    // If we were inside a string, we MUST close it first
-    if (inString) {
-        partialText += '"';
-    }
+    if (objEnd === -1) {
+      // Attempt local repair for truncated JSON
+      logger.debug('[json-utils] JSON object truncated; attempting local repair');
+      let partialText = text.slice(objStart);
 
-    for (let i = 1; i <= 15; i++) {
-      try {
-        const candidate = preRepairJson(partialText + '}'.repeat(i));
-        const parsed = JSON.parse(candidate);
-        logger.debug(`[json-utils] JSON object truncated; salvaged by appending ${inString ? 'quote and ' : ''}${i} closing braces`);
-        return { success: true, value: parsed as T, method: 'raw-object' };
-      } catch {
-        continue;
+      // If we were inside a string, we MUST close it first
+      if (inString) {
+          partialText += '"';
+      }
+
+      for (let i = 1; i <= 15; i++) {
+        try {
+          const candidate = preRepairJson(partialText + '}'.repeat(i));
+          const parsed = JSON.parse(candidate);
+          logger.debug(`[json-utils] JSON object truncated; salvaged by appending ${inString ? 'quote and ' : ''}${i} closing braces`);
+          return { success: true, value: parsed as T, method: 'raw-object' };
+        } catch {
+          continue;
+        }
       }
+
+      return {
+        success: false,
+        value: undefined,
+        error: 'No matching closing brace found and local repair failed',
+      };
     }
-    
-    return {
-      success: false,
-      value: undefined,
-      error: 'No matching closing brace found and local repair failed',
-    };
-  }
 
-  try {
-    const parsed = parseRawThenRepair(text.slice(objStart, objEnd + 1));
-    return { success: true, value: parsed as T, method: 'raw-object' };
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
-    return {
-      success: false,
-      value: undefined,
-      error: `Failed to parse JSON object: ${errorMsg}`,
-    };
+    try {
+      const parsed = parseRawThenRepair(text.slice(objStart, objEnd + 1));
+      return { success: true, value: parsed as T, method: 'raw-object' };
+    } catch (err) {
+      // Closed but unparseable — a prose brace, not the payload. Try the next `{`.
+      lastParseError = err instanceof Error ? err.message : String(err);
+    }
   }
+
+  return {
+    success: false,
+    value: undefined,
+    error: `Failed to parse JSON object: ${lastParseError}`,
+  };
 }
 
 /**
  * Extract JSON array from raw text
  *
- * Looks for a JSON array spanning from the first `[` to the last `]`.
- * Useful for extracting arrays of strings or objects.
+ * Walks forward with depth-tracking (respecting string literals) from each `[`
+ * candidate to its matching `]`. A candidate that closes but fails to parse is a
+ * citation-style bracket (e.g. "[see note] … [\"a\",\"b\"]"), so the scan advances
+ * to the next `[` — bounded by MAX_JSON_CANDIDATES. Truncated-repair applies at
+ * the first UNCLOSED candidate: past that point there is no further text to scan,
+ * and an unclosed opener is what genuinely cut-off LLM output looks like.
  *
  * @param text - Text to search for JSON array
  * @returns Extraction result with parsed value or error
@@ -189,7 +214,7 @@ export function extractJsonObject<T = unknown>(
 export function extractJsonArray<T = unknown>(
   text: string
 ): JsonExtractionResult<T[]> {
-  const arrStart = text.indexOf('[');
+  let arrStart = text.indexOf('[');
 
   if (arrStart === -1) {
     return {
@@ -199,54 +224,69 @@ export function extractJsonArray<T = unknown>(
     };
   }
 
-  const { index: arrEnd, inString } = findMatchingBracket(text, arrStart);
-  if (arrEnd === -1) {
-    // Attempt local repair for truncated JSON
-    logger.debug('[json-utils] JSON array truncated; attempting local repair');
-    let partialText = text.slice(arrStart);
-    
-    if (inString) {
-        partialText += '"';
-    }
+  let lastError = 'unknown parse error';
+  let lastErrorShape: 'not-array' | 'parse' = 'parse';
+  for (
+    let attempt = 0;
+    attempt < MAX_JSON_CANDIDATES && arrStart !== -1;
+    attempt++, arrStart = text.indexOf('[', arrStart + 1)
+  ) {
+    const { index: arrEnd, inString } = findMatchingBracket(text, arrStart);
+    if (arrEnd === -1) {
+      // Attempt local repair for truncated JSON
+      logger.debug('[json-utils] JSON array truncated; attempting local repair');
+      let partialText = text.slice(arrStart);
 
-    for (let i = 1; i <= 15; i++) {
-      try {
-        const candidate = preRepairJson(partialText + ']'.repeat(i));
-        const parsed = JSON.parse(candidate);
-        if (Array.isArray(parsed)) {
-          logger.debug(`[json-utils] JSON array truncated; salvaged by appending ${inString ? 'quote and ' : ''}${i} closing brackets`);
-          return { success: true, value: parsed as T[], method: 'raw-array' };
-        }
-      } catch {
-        continue;
+      if (inString) {
+          partialText += '"';
       }
-    }
 
-    return {
-      success: false,
-      value: undefined,
-      error: 'No matching closing bracket found and local repair failed',
-    };
-  }
+      for (let i = 1; i <= 15; i++) {
+        try {
+          const candidate = preRepairJson(partialText + ']'.repeat(i));
+          const parsed = JSON.parse(candidate);
+          if (Array.isArray(parsed)) {
+            logger.debug(`[json-utils] JSON array truncated; salvaged by appending ${inString ? 'quote and ' : ''}${i} closing brackets`);
+            return { success: true, value: parsed as T[], method: 'raw-array' };
+          }
+        } catch {
+          continue;
+        }
+      }
 
-  try {
-    const parsed = parseRawThenRepair(text.slice(arrStart, arrEnd + 1));
-    if (!Array.isArray(parsed)) {
       return {
         success: false,
         value: undefined,
-        error: 'Parsed value is not an array',
+        error: 'No matching closing bracket found and local repair failed',
       };
     }
-    return { success: true, value: parsed as T[], method: 'raw-array' };
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
+
+    try {
+      const parsed = parseRawThenRepair(text.slice(arrStart, arrEnd + 1));
+      if (!Array.isArray(parsed)) {
+        lastErrorShape = 'not-array';
+        continue;
+      }
+      return { success: true, value: parsed as T[], method: 'raw-array' };
+    } catch (err) {
+      // Closed but unparseable — a citation bracket, not the payload. Try the next `[`.
+      lastErrorShape = 'parse';
+      lastError = err instanceof Error ? err.message : String(err);
+    }
+  }
+
+  if (lastErrorShape === 'not-array') {
     return {
       success: false,
       value: undefined,
-      error: `Failed to parse JSON array: ${errorMsg}`,
+      error: 'Parsed value is not an array',
     };
   }
+  return {
+    success: false,
+    value: undefined,
+    error: `Failed to parse JSON array: ${lastError}`,
+  };
 }
 
 /**

package/src/utils/llm-usage.ts

@@ -51,11 +51,16 @@ function warnIfUnpriced(model: Model<any>, tokens: number, cost: number): void {
   );
 }
 
-/** Structural subset of the run observer — just the token sink. Kept structural (rather
+/** Structural subset of the run observer — just the token sinks. Kept structural (rather
  *  than importing ResearchObserver from core/) so this foundation-layer helper does not
  *  depend on an upper layer; the full ResearchObserver satisfies it. */
 export interface TokenSink {
   onTokensConsumed?: (tokens: number, cost: number) => void;
+  /** Phase-scoped sinks, fed from the `component` label ('coordinator'/'evaluator');
+   *  they drive the TUI coord/eval cost rows and the SDK planning_tokens /
+   *  evaluation_tokens events. */
+  onPlanningTokens?: (tokens: number, cost: number) => void;
+  onEvaluationTokens?: (tokens: number, cost: number) => void;
 }
 
 export interface RecordUsageOptions {
@@ -86,6 +91,17 @@ export function recordLlmUsage(
     metrics.increment('llm_tokens_total', tokens, labels);
     metrics.increment('llm_cost_total', cost, labels);
     opts.observer?.onTokensConsumed?.(tokens, cost);
+    // Phase-scoped events: coordinator/evaluator call sites label their usage
+    // 'coordinator'/'evaluator' (see planning-service.ts); route those to the
+    // dedicated observer hooks so the TUI coord/eval cost rows and the SDK
+    // planning_tokens/evaluation_tokens events fire. Before this mapping the hooks
+    // had zero emit sites (regression in c90d7f37) — coordinator/evaluator usage
+    // reached only onTokensConsumed, which the TUI observer does not implement.
+    if (opts.component === 'coordinator') {
+      opts.observer?.onPlanningTokens?.(tokens, cost);
+    } else if (opts.component === 'evaluator') {
+      opts.observer?.onEvaluationTokens?.(tokens, cost);
+    }
   }
   return { tokens, cost };
 }

package/src/utils/log-rotation.ts

@@ -27,8 +27,19 @@ export class LogRotation {
     try {
       if (fs.existsSync(logFile)) {
         fs.unlinkSync(logFile);
+        // Same rationale as the post-rotation recreate in rotateLogFile: the
+        // unlink discarded the 0o600 file, and a umask-default recreate by the
+        // next append would drop the owner-only posture.
+        try {
+          fs.closeSync(fs.openSync(logFile, 'a', 0o600));
+        } catch { /* best-effort — the next append recreates the file */ }
+        // And, as there, re-stamp the mode: a concurrent append landing between
+        // the unlink and the open makes the creation-time 0o600 a no-op.
+        try {
+          fs.chmodSync(logFile, 0o600);
+        } catch { /* best-effort */ }
       }
-      
+
       const files = fs.readdirSync(logDir);
       const baseName = path.basename(logFile);
       const archives = files.filter(f => f.startsWith(baseName) && f !== baseName);
@@ -63,19 +74,40 @@ export class LogRotation {
       const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
       const archivePath = `${logFile}.${timestamp}`;
       
-      // Rename current log file to archive
+      // Rename current log file to archive. The archive name is timestamped, so
+      // the target never pre-exists — a rename failure means the SOURCE is held
+      // open (Windows sharing semantics). A copy+unlink fallback here would
+      // destroy appends the OTHER processes writing this consolidated log (main,
+      // embedding server, browser workers) land between the copy and the unlink.
+      // Skipping the rotation is the data-preserving choice: the file transiently
+      // exceeds the cap until a later check succeeds (accepted by the throttling
+      // contract in checkAndRotate).
       try {
         fs.renameSync(logFile, archivePath);
       } catch (renameErr) {
-        // fs.renameSync fails on Windows if target exists (NTFS). Fall back to copy+delete.
-        if (process.platform === 'win32') {
-          fs.copyFileSync(logFile, archivePath);
-          fs.unlinkSync(logFile);
-        } else {
-          throw renameErr;
-        }
+        this.logger.log('[Logger] Log rotation skipped (rename failed; file likely in use):', renameErr);
+        return;
       }
-      
+
+      // Rotation moved the 0o600 file aside; without an explicit recreate the next
+      // append materializes it at the umask default (typically 0644) in a
+      // world-traversable tmpdir, silently dropping the owner-only posture Logger
+      // establishes at construction. Mode applies only at creation, so this is
+      // harmless where a file already exists or mode semantics differ (win32).
+      try {
+        fs.closeSync(fs.openSync(logFile, 'a', 0o600));
+      } catch { /* best-effort — the next append recreates the file */ }
+      // The mode above applies only if THIS open created the file. Several
+      // processes append to this consolidated log, so a concurrent async append
+      // can recreate it at umask perms between the rename and the open, turning
+      // the 0o600 into a no-op — stamp the mode unconditionally to close that
+      // window for good. ENOENT (nothing recreated it and the open failed) is
+      // tolerable: best-effort posture, same as the recreate itself.
+      try {
+        fs.chmodSync(logFile, 0o600);
+      } catch { /* best-effort */ }
+
+
       // Clean up old archives
       try {
         const files = fs.readdirSync(logDir);

package/src/utils/log-utils.ts

@@ -86,6 +86,11 @@ const MAX_LOG_MESSAGE_LENGTH = 10_000;
 const ANSI_PATTERN = /\x1b\[[0-9;]*[A-Za-z]/g;
 // Credentials embedded in a URL userinfo component: scheme://user:pass@host
 const URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s:@]+@/gi;
+// Cookie / Set-Cookie headers. The KV value class below stops at whitespace, so
+// "Cookie: lang=en; SID=secret123" would mask only the first pair and leave every
+// later one exposed. A cookie string is a ;-and-space separated list of secrets,
+// not a single token — mask the ENTIRE header value to end-of-line.
+const COOKIE_HEADER_PATTERN = /\b(set[_-]?cookie|cookie)\b(["']?\s*[:=]\s*["']?)([^\r\n]+)/gi;
 // key=value / key: "value" pairs whose key names a secret.
 const SENSITIVE_KV_PATTERN =
   /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
@@ -137,6 +142,9 @@ export function redactSecrets(message: string): string {
   // Before the KV pass, for the same reason as Basic above: the KV value class
   // stops at the space after "Bearer", leaving an opaque token exposed.
   out = out.replace(BEARER_AUTH_PATTERN, 'Bearer [REDACTED]');
+  // Whole-header cookie masking before the KV pass, which would otherwise stop
+  // at the first whitespace and leave every subsequent pair in the clear.
+  out = out.replace(COOKIE_HEADER_PATTERN, (_m, key: string, sep: string) => `${key}${sep}[REDACTED]`);
   out = out.replace(SENSITIVE_KV_PATTERN, (_m, key: string, sep: string) => `${key}${sep}[REDACTED]`);
   out = out.replace(KNOWN_TOKEN_PATTERN, '[REDACTED]');
   out = out.replace(PROVIDER_TOKEN_PATTERN, '[REDACTED]');
@@ -144,6 +152,38 @@ export function redactSecrets(message: string): string {
   return out;
 }
 
+// Every ESC-initiated terminal sequence — not just the colour/style CSI subset
+// ANSI_PATTERN strips. Alternatives, tried in order at each ESC:
+//   1. CSI with parameter (incl. private-mode `?`), intermediate, and final
+//      bytes per ECMA-48 — catches \x1b[?25l (hide cursor) and kin.
+//   2. OSC to BEL or ST (or truncated) — catches \x1b]0;title\x07 retitling.
+//   3. DCS/SOS/PM/APC to ST (or truncated).
+//   4. Bare ESC plus at most one byte — the fallback that also swallows a
+//      trailing/truncated ESC rather than leaking it.
+// (Built from strings, so no-control-regex has nothing to flag here.)
+const TERMINAL_ESCAPE_PATTERN = new RegExp(
+  '\\x1b\\[[0-?]*[ -/]*[@-~]?' +
+  '|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?' +
+  '|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?' +
+  '|\\x1b.?',
+  'g',
+);
+
+/**
+ * Strip terminal escape sequences and residual control bytes from a line bound
+ * for the CONSOLE sink. redactSecrets' ANSI_PATTERN removes only plain CSI
+ * colour/style sequences, so private-mode CSI (\x1b[?25l), OSC window-retitling
+ * (\x1b]0;…\x07), and DCS/SOS/PM/APC embedded in untrusted content would
+ * otherwise reach the user's terminal verbatim under PI_RESEARCH_CONSOLE_LOG.
+ * The console sink keeps its own explicit CR/LF→"" replace (the form CodeQL
+ * recognizes as the log-injection sanitizer); this handles everything else,
+ * spacing out any leftover C0/DEL byte (BEL, backspace, …) like
+ * neutralizeControlChars does.
+ */
+export function stripTerminalEscapes(message: string): string {
+  return message.replace(TERMINAL_ESCAPE_PATTERN, '').replace(CONTROL_CHARS_PATTERN, ' ');
+}
+
 /**
  * Neutralize control characters (newlines, carriage returns, etc.) so that
  * untrusted content cannot forge or corrupt a raw console log line

package/src/utils/metrics-summary.ts

@@ -137,9 +137,17 @@ export function extractRunStats(snapshot: IMetricsSnapshot): ResearchStats | nul
   const browserSearchQueries = sumCounter(counters, 'browser_search_queries_total');
   const searchQueries = sumCounter(counters, 'search_queries_total') + browserSearchQueries;
 
-  // URLs discovered via search
-  const urlsDiscovered = sumCounter(counters, 'browser_search_results_total') +
-    sumCounter(counters, 'browser_search_unique_urls_total');
+  // URLs discovered via search. browser_search_unique_urls_total is the
+  // cross-query deduped subset of the SAME batch counted by
+  // browser_search_results_total (raw per-query results), so summing both
+  // near-doubles the figure. The unique counter IS the discovered count; the
+  // raw counter is only a fallback for a search that threw before completing
+  // the batch (the unique count is emitted after cross-query dedup, so such a
+  // run never emits it).
+  const uniqueUrlsDiscovered = sumCounter(counters, 'browser_search_unique_urls_total');
+  const urlsDiscovered = uniqueUrlsDiscovered > 0
+    ? uniqueUrlsDiscovered
+    : sumCounter(counters, 'browser_search_results_total');
 
   // URLs scraped — outcomes from scrape_results_total
   const fetchSuccess = getLabeledCounter(counters, 'scrape_results_total', { outcome: 'fetch_success' });
@@ -178,12 +186,22 @@ export function extractRunStats(snapshot: IMetricsSnapshot): ResearchStats | nul
   // Cost — sum all label variants
   const cost = sumCounter(counters, 'llm_cost_total');
 
-  // Duration from histogram
-  const durationMs = histograms['research_session_duration_ms{mode="deep",complexity="1",status="success"}']?.max ||
-    histograms['research_session_duration_ms{mode="deep",complexity="2",status="success"}']?.max ||
-    histograms['research_session_duration_ms{mode="deep",complexity="3",status="success"}']?.max ||
-    histograms['research_session_duration_ms{mode="quick",complexity="0",status="success"}']?.max ||
-    0;
+  // Duration from histogram. The registry serializes label keys in ALPHABETICAL
+  // order (MetricsRegistry.serializeLabels), so the real key is
+  // `{complexity="…",mode="…",status="…"}` — a lookup that hardcodes any other
+  // label order can never match. Complexity is also emitted as String(complexity)
+  // with no fixed value set. Scan by metric-name prefix + success status instead,
+  // taking the largest observed max across matching label variants.
+  let durationMs = 0;
+  for (const key of Object.keys(histograms)) {
+    if (
+      key.startsWith('research_session_duration_ms{') &&
+      key.includes('status="success"')
+    ) {
+      const max = histograms[key]?.max ?? 0;
+      if (max > durationMs) durationMs = max;
+    }
+  }
 
   // Rounds completed — evaluator runs give us the round count
   const roundsCompleted = sumCounter(counters, 'evaluator_runs_total');