@lincoln504/pi-research 1.2.0 → 1.3.0

package/dist/thread-worker.mjs

@@ -51,13 +51,17 @@ function redactSecrets(message) {
   out = out.replace(JWT_PATTERN, "[REDACTED]");
   out = out.replace(BASIC_AUTH_PATTERN, "Basic [REDACTED]");
   out = out.replace(BEARER_AUTH_PATTERN, "Bearer [REDACTED]");
+  out = out.replace(COOKIE_HEADER_PATTERN, (_m, key, sep) => `${key}${sep}[REDACTED]`);
   out = out.replace(SENSITIVE_KV_PATTERN, (_m, key, sep) => `${key}${sep}[REDACTED]`);
   out = out.replace(KNOWN_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(PROVIDER_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(LONG_HEX_SECRET_PATTERN, "[REDACTED]");
   return out;
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN;
+function stripTerminalEscapes(message) {
+  return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
+}
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -65,6 +69,7 @@ var init_log_utils = __esm({
     MAX_LOG_MESSAGE_LENGTH = 1e4;
     ANSI_PATTERN = /\x1b\[[0-9;]*[A-Za-z]/g;
     URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s:@]+@/gi;
+    COOKIE_HEADER_PATTERN = /\b(set[_-]?cookie|cookie)\b(["']?\s*[:=]\s*["']?)([^\r\n]+)/gi;
     SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
     KNOWN_TOKEN_PATTERN = /\b(sk-[A-Za-z0-9_-]{16,}|gh[posru]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
     JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
@@ -72,6 +77,106 @@ var init_log_utils = __esm({
     BEARER_AUTH_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
+    CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    TERMINAL_ESCAPE_PATTERN = new RegExp(
+      "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
+      "g"
+    );
+  }
+});
+
+// src/utils/user-agent.ts
+var USER_AGENTS;
+var init_user_agent = __esm({
+  "src/utils/user-agent.ts"() {
+    "use strict";
+    USER_AGENTS = [
+      // Chrome on Windows (updated 2025)
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+      // Chrome on macOS
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+      // Chrome on Linux
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+      // Firefox on Windows (updated 2025)
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0",
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0",
+      // Firefox on macOS
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0",
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0"
+    ];
+  }
+});
+
+// src/web-research/scraper-types.ts
+var MAX_HTML_SIZE, MAX_PDF_SIZE, INTERNAL_NETWORK_PATTERNS, FILTERED_TAGS, BOT_PATTERNS, IMAGE_LINK_PATTERN, MARKDOWN_IMAGE_PATTERN;
+var init_scraper_types = __esm({
+  "src/web-research/scraper-types.ts"() {
+    "use strict";
+    init_user_agent();
+    MAX_HTML_SIZE = 25 * 1024 * 1024;
+    MAX_PDF_SIZE = 100 * 1024 * 1024;
+    INTERNAL_NETWORK_PATTERNS = [
+      /^127\./,
+      // IPv4 loopback
+      /^0\./,
+      // IPv4 "this" network
+      /^::1$/,
+      // IPv6 loopback
+      /^fe80::/i,
+      // IPv6 link-local
+      /^f[cd][0-9a-f]{2}:/i,
+      // IPv6 unique local — full fc00::/7 block (fc00::–fdff::)
+      /^169\.254\./,
+      // IPv4 link-local (and metadata)
+      /^10\./,
+      // RFC 1918 Class A private
+      /^192\.168\./,
+      // RFC 1918 Class C private
+      /^172\.(1[6-9]|2[0-9]|3[01])\./,
+      // RFC 1918 Class B private
+      /^::ffff:(127\.|0\.|169\.254\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i
+      // IPv4-mapped IPv6
+    ];
+    FILTERED_TAGS = [
+      "nav",
+      "header",
+      "footer",
+      "aside",
+      "script",
+      "style",
+      "noscript",
+      "form",
+      "input",
+      "select",
+      "textarea",
+      "button",
+      "object",
+      "embed",
+      "svg",
+      "symbol",
+      "use",
+      "defs",
+      "path",
+      "circle",
+      "rect",
+      "line",
+      "polygon",
+      "img",
+      "iframe"
+    ];
+    BOT_PATTERNS = [
+      ["_cf_chl_", "Cloudflare challenge"],
+      ["cf_chl_opt", "Cloudflare challenge opt"],
+      ["cdn-cgi/challenge-platform", "Cloudflare challenge platform"],
+      ["ddos-guard", "DDoS-Guard challenge"],
+      ["Just a moment...", "Cloudflare interstitial"],
+      ["Checking your browser before accessing", "Cloudflare interstitial"]
+    ];
+    IMAGE_LINK_PATTERN = /\[([^\]]*)\]\((data:image\/[^)]+|[^)\s]+\.(?:svg|png|jpe?g|gif|webp|bmp|ico)(?:\?[^)]*)?)\)/gi;
+    MARKDOWN_IMAGE_PATTERN = /!\[[^\]]*]\((?:data:image\/[^)]+|[^)\s]+)\)/gi;
   }
 });
 
@@ -265,6 +370,14 @@ var init_log_rotation = __esm({
         try {
           if (fs2.existsSync(logFile)) {
             fs2.unlinkSync(logFile);
+            try {
+              fs2.closeSync(fs2.openSync(logFile, "a", 384));
+            } catch {
+            }
+            try {
+              fs2.chmodSync(logFile, 384);
+            } catch {
+            }
           }
           const files = fs2.readdirSync(logDir);
           const baseName = path2.basename(logFile);
@@ -297,12 +410,16 @@ var init_log_rotation = __esm({
           try {
             fs2.renameSync(logFile, archivePath);
           } catch (renameErr) {
-            if (process.platform === "win32") {
-              fs2.copyFileSync(logFile, archivePath);
-              fs2.unlinkSync(logFile);
-            } else {
-              throw renameErr;
-            }
+            this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
+            return;
+          }
+          try {
+            fs2.closeSync(fs2.openSync(logFile, "a", 384));
+          } catch {
+          }
+          try {
+            fs2.chmodSync(logFile, 384);
+          } catch {
           }
           try {
             const files = fs2.readdirSync(logDir);
@@ -372,10 +489,13 @@ var init_disk_space_checker = __esm({
           const availableBytes = stats.bavail * stats.bsize;
           if (availableBytes < this.MIN_DISK_SPACE_BYTES) {
             this.hasDiskSpace = false;
-            process.stderr.write(
-              `[pi-research] Insufficient disk space for logging: ${Math.round(availableBytes / 1024 / 1024)}MB available, minimum ${this.MIN_DISK_SPACE_BYTES / 1024 / 1024}MB required
+            try {
+              process.stderr.write(
+                `[pi-research] Insufficient disk space for logging: ${Math.round(availableBytes / 1024 / 1024)}MB available, minimum ${this.MIN_DISK_SPACE_BYTES / 1024 / 1024}MB required
 `
-            );
+              );
+            } catch {
+            }
           } else {
             this.hasDiskSpace = true;
           }
@@ -482,7 +602,7 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
       if (shouldRedirectStderr(stat)) {
         savedFd2 = fs4.openSync("/dev/fd/2", "a");
         fs4.closeSync(2);
-        const newFd = fs4.openSync(logFile, "a");
+        const newFd = fs4.openSync(logFile, "a", 384);
         if (newFd === 2) {
           fd2Redirected = true;
         } else {
@@ -614,42 +734,52 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     }
   } catch (_e) {
   }
+  const frame = {
+    retired: false,
+    restore: () => {
+      process.stderr.write = originalStderrWrite;
+      process.stdout.write = originalStdoutWrite;
+      try {
+        fs4.writeSync = originalFsWriteSync;
+      } catch {
+      }
+      console.log = originalConsole.log;
+      console.info = originalConsole.info;
+      console.warn = originalConsole.warn;
+      console.error = originalConsole.error;
+      console.debug = originalConsole.debug;
+      if (fd2Redirected && savedFd2 >= 0) {
+        try {
+          fs4.closeSync(2);
+          const r = fs4.openSync(`/dev/fd/${savedFd2}`, "a");
+          if (r !== 2 && r >= 0) {
+          }
+          try {
+            fs4.closeSync(savedFd2);
+          } catch {
+          }
+        } catch {
+        }
+      }
+    }
+  };
+  captureStack.push(frame);
   try {
     return await task();
   } finally {
-    process.stderr.write = originalStderrWrite;
-    process.stdout.write = originalStdoutWrite;
-    try {
-      fs4.writeSync = originalFsWriteSync;
-    } catch {
-    }
-    console.log = originalConsole.log;
-    console.info = originalConsole.info;
-    console.warn = originalConsole.warn;
-    console.error = originalConsole.error;
-    console.debug = originalConsole.debug;
     if (sessionId) {
       setSessionCapturing(sessionId, false);
     } else {
       unkeyedCaptureDepth = Math.max(0, unkeyedCaptureDepth - 1);
       recomputeGlobalCapturing();
     }
-    if (fd2Redirected && savedFd2 >= 0) {
-      try {
-        fs4.closeSync(2);
-        const r = fs4.openSync(`/dev/fd/${savedFd2}`, "a");
-        if (r !== 2 && r >= 0) {
-        }
-        try {
-          fs4.closeSync(savedFd2);
-        } catch {
-        }
-      } catch {
-      }
+    frame.retired = true;
+    while (captureStack.length > 0 && captureStack[captureStack.length - 1].retired) {
+      captureStack.pop().restore();
     }
   }
 }
-var fs4, sessionCaptureStates, unkeyedCaptureDepth, isAnyLoggerCapturingOutput, NATIVE_LOG_PATTERNS, COMPLEX_TUI_PATTERNS, BOX_DRAWING_CHARS;
+var fs4, sessionCaptureStates, unkeyedCaptureDepth, isAnyLoggerCapturingOutput, captureStack, NATIVE_LOG_PATTERNS, COMPLEX_TUI_PATTERNS, BOX_DRAWING_CHARS;
 var init_stdio_capture = __esm({
   "src/utils/stdio-capture.ts"() {
     "use strict";
@@ -658,6 +788,7 @@ var init_stdio_capture = __esm({
     sessionCaptureStates = /* @__PURE__ */ new Map();
     unkeyedCaptureDepth = 0;
     isAnyLoggerCapturingOutput = false;
+    captureStack = [];
     NATIVE_LOG_PATTERNS = [
       "Warning:",
       "Error:",
@@ -699,7 +830,7 @@ var init_stdio_capture = __esm({
 });
 
 // src/logger.ts
-import { appendFileSync, existsSync as existsSync2, mkdirSync, openSync, closeSync } from "node:fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync, openSync as openSync2, closeSync as closeSync2 } from "node:fs";
 import { appendFile as appendFile2 } from "node:fs/promises";
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 import * as path3 from "node:path";
@@ -859,7 +990,7 @@ var init_logger = __esm({
             mkdirSync(this.logDir, { recursive: true, mode: 448 });
           }
           try {
-            closeSync(openSync(this.logFile, "wx", 384));
+            closeSync2(openSync2(this.logFile, "wx", 384));
           } catch {
           }
         } catch {
@@ -894,7 +1025,7 @@ var init_logger = __esm({
         if (this.consoleLog) {
           const color = level === "ERROR" /* ERROR */ ? "\x1B[31m" : level === "WARN" /* WARN */ ? "\x1B[33m" : level === "DEBUG" /* DEBUG */ ? "\x1B[90m" : "\x1B[36m";
           const reset = "\x1B[0m";
-          const msg = message.replace(/[\r\n]/g, "");
+          const msg = stripTerminalEscapes(message.replace(/[\r\n]/g, ""));
           const rawSid = this.sessionId ?? "";
           const sid = rawSid.replace(/[\r\n]/g, "");
           const prefix = sid ? `[${sid}] ` : "";
@@ -1133,101 +1264,6 @@ var init_metrics = __esm({
   }
 });
 
-// src/utils/user-agent.ts
-var USER_AGENTS;
-var init_user_agent = __esm({
-  "src/utils/user-agent.ts"() {
-    "use strict";
-    USER_AGENTS = [
-      // Chrome on Windows (updated 2025)
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
-      // Chrome on macOS
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
-      // Chrome on Linux
-      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
-      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
-      // Firefox on Windows (updated 2025)
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0",
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0",
-      // Firefox on macOS
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0",
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0"
-    ];
-  }
-});
-
-// src/web-research/scraper-types.ts
-var MAX_HTML_SIZE, MAX_PDF_SIZE, INTERNAL_NETWORK_PATTERNS, FILTERED_TAGS, BOT_PATTERNS, IMAGE_LINK_PATTERN, MARKDOWN_IMAGE_PATTERN;
-var init_scraper_types = __esm({
-  "src/web-research/scraper-types.ts"() {
-    "use strict";
-    init_user_agent();
-    MAX_HTML_SIZE = 25 * 1024 * 1024;
-    MAX_PDF_SIZE = 100 * 1024 * 1024;
-    INTERNAL_NETWORK_PATTERNS = [
-      /^127\./,
-      // IPv4 loopback
-      /^0\./,
-      // IPv4 "this" network
-      /^::1$/,
-      // IPv6 loopback
-      /^fe80::/i,
-      // IPv6 link-local
-      /^f[cd][0-9a-f]{2}:/i,
-      // IPv6 unique local — full fc00::/7 block (fc00::–fdff::)
-      /^169\.254\./,
-      // IPv4 link-local (and metadata)
-      /^10\./,
-      // RFC 1918 Class A private
-      /^192\.168\./,
-      // RFC 1918 Class C private
-      /^172\.(1[6-9]|2[0-9]|3[01])\./,
-      // RFC 1918 Class B private
-      /^::ffff:(127\.|0\.|169\.254\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i
-      // IPv4-mapped IPv6
-    ];
-    FILTERED_TAGS = [
-      "nav",
-      "header",
-      "footer",
-      "aside",
-      "script",
-      "style",
-      "noscript",
-      "form",
-      "input",
-      "select",
-      "textarea",
-      "button",
-      "object",
-      "embed",
-      "svg",
-      "symbol",
-      "use",
-      "defs",
-      "path",
-      "circle",
-      "rect",
-      "line",
-      "polygon",
-      "img",
-      "iframe"
-    ];
-    BOT_PATTERNS = [
-      ["_cf_chl_", "Cloudflare challenge"],
-      ["cf_chl_opt", "Cloudflare challenge opt"],
-      ["cdn-cgi/challenge-platform", "Cloudflare challenge platform"],
-      ["ddos-guard", "DDoS-Guard challenge"],
-      ["Just a moment...", "Cloudflare interstitial"],
-      ["Checking your browser before accessing", "Cloudflare interstitial"]
-    ];
-    IMAGE_LINK_PATTERN = /\[([^\]]*)\]\((data:image\/[^)]+|[^)\s]+\.(?:svg|png|jpe?g|gif|webp|bmp|ico)(?:\?[^)]*)?)\)/gi;
-    MARKDOWN_IMAGE_PATTERN = /!\[[^\]]*]\((?:data:image\/[^)]+|[^)\s]+)\)/gi;
-  }
-});
-
 // src/utils/circuit-breaker.ts
 var CircuitBreaker;
 var init_circuit_breaker = __esm({
@@ -1277,7 +1313,7 @@ var init_circuit_breaker = __esm({
           const result = await action();
           const duration = Date.now() - startTime;
           metrics.observe("circuit_breaker_call_duration_ms", duration, { breaker: this.options.name, status: "success" });
-          this.onSuccess();
+          this.onSuccess(admittedAsProbe);
           return result;
         } catch (error) {
           const duration = Date.now() - startTime;
@@ -1295,9 +1331,10 @@ var init_circuit_breaker = __esm({
           if (admittedAsProbe) this.halfOpenInFlight = Math.max(0, this.halfOpenInFlight - 1);
         }
       }
-      onSuccess() {
+      onSuccess(admittedAsProbe) {
         metrics.increment("circuit_breaker_success_total", 1, { breaker: this.options.name, state: this.state });
         if (this.state === "HALF_OPEN") {
+          if (!admittedAsProbe) return;
           this.successCount++;
           if (this.successCount >= this.options.halfOpenMaxCalls) {
             this.transitionTo("CLOSED");
@@ -1599,12 +1636,14 @@ function isPrivateIpv6(ip) {
   if (normalized === "::1") return true;
   if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
   if (normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb")) return true;
+  if (normalized.startsWith("fec") || normalized.startsWith("fed") || normalized.startsWith("fee") || normalized.startsWith("fef")) return true;
   const mapped = extractMappedIpv4(normalized);
   if (mapped) {
     return isPrivateIp(mapped);
   }
   if (normalized.startsWith("2002:")) return true;
   if (/^2001:0{0,4}:/.test(normalized) || normalized.startsWith("2001::")) return true;
+  if (normalized.startsWith("64:ff9b:")) return true;
   if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0") return true;
   return false;
 }
@@ -1857,6 +1896,7 @@ import { platform as platform2 } from "node:os";
 
 // src/infrastructure/browser/thread-worker-messaging.ts
 init_log_utils();
+init_scraper_types();
 import { appendFileSync as appendFileSync2 } from "node:fs";
 var workerId2 = "";
 var pageCreationLock = Promise.resolve();
@@ -2149,17 +2189,31 @@ async function executeScrapeTask(_context, url, signal) {
       validateForWorkerSync(ip.includes(":") ? `http://[${ip}]/` : `http://${ip}/`);
     }
     const contentType = await response?.headerValue("content-type") || "";
+    const status = response?.status?.() ?? 0;
     if (contentType.includes("application/pdf")) {
       if (!response) throw new Error(`[Worker] No response received for PDF URL: ${url}`);
+      if (status >= 400) throw new Error(`HTTP ${status}`);
+      const declaredLength = parseInt(await response.headerValue("content-length").catch(() => null) || "", 10);
+      if (Number.isFinite(declaredLength) && declaredLength > MAX_PDF_SIZE) {
+        const sizeMB = Math.round(declaredLength / 1024 / 1024);
+        throw new Error(`PDF too large (${sizeMB}MB, max 100MB)`);
+      }
       const buffer = await response.body();
+      if (buffer.byteLength > MAX_PDF_SIZE) {
+        const sizeMB = Math.round(buffer.byteLength / 1024 / 1024);
+        throw new Error(`PDF too large (${sizeMB}MB, max 100MB)`);
+      }
       await Promise.allSettled(pendingAddrChecks);
       if (poisonedError) throw poisonedError;
       await page.close();
-      return { contentType, buffer, jitter: 0 };
+      return { contentType, bufferB64: buffer.toString("base64"), jitter: 0 };
     }
     let html = await page.content();
     const cfPatterns = ["_cf_chl_", "cdn-cgi/challenge-platform", "cf_chl_opt", "Just a moment...", "Checking your browser before accessing"];
     const hasCloudflare = cfPatterns.some((pattern) => html.includes(pattern));
+    if (status >= 400 && !hasCloudflare) {
+      throw new Error(`HTTP ${status}`);
+    }
     if (hasCloudflare) {
       logToDebugFile2("WARN", `[Worker-${workerId2}] Cloudflare challenge detected for: ${url}`);
       try {
@@ -2184,6 +2238,10 @@ async function executeScrapeTask(_context, url, signal) {
       await page.waitForLoadState("networkidle", { timeout: 1e4 }).catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Swallowed page close/wait error: ${err.message || String(err)}`));
       html = await page.content();
     }
+    if (html.length > MAX_HTML_SIZE) {
+      const sizeMB = Math.round(html.length / 1024 / 1024);
+      throw new Error(`Browser HTML too large (${sizeMB}MB, max 25MB)`);
+    }
     const jitter = process.env["PI_RESEARCH_MOCK_SCRAPE"] === "true" ? 0 : Math.floor(Math.random() * 1e3) + 500;
     if (jitter > 0) await new Promise((r) => setTimeout(r, jitter));
     const finalAddr = await finalMainFrameAddr;

package/docs/ARCHITECTURE.md

@@ -201,7 +201,7 @@ Services that hold resources implement `dispose()`; the registry disposes them i
 reverse dependency order. Resolving through the registry (rather than direct imports)
 enforces lifecycle discipline (init → use → dispose) and lets tests swap in mocks.
 
-- Core (`src/core/`): `PlanningService`, `SchedulerService`, `HealthCheckService`
+- Core (`src/core/`): `PlanningService`, `SchedulerService`
 - Infrastructure (`src/infrastructure/`): `StateManagerService`, `KnowledgeStoreService`, `MetricsService`, `WorkerPoolManager`, `FileLockService`, `GPUResourceService` (plus `WriterQueue`, defined in `src/knowledge/` and registered here)
 - Orchestration (`src/orchestration/`): `ResearchOrchestrationService`, `ResearchSessionService`, `ResearchSynthesisService`
 

package/docs/CHANGELOG.md

@@ -5,6 +5,51 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.0] - 2026-08-06
+
+Bundles three unreleased fix rounds that accumulated on top of 1.2.0 (each
+already pushed to main but never cut), plus a final fresh-eyes review pass
+done specifically to gate this release: an independent reviewer read every
+line of the combined diff against 1.2.0 with no knowledge of why any of it
+was written, and found several real defects the rounds that produced the
+code had missed — two of them the most severe in this release. Every item
+below was re-verified against the current code (not the original bug
+report) before being counted as fixed; the two highest-severity findings
+were personally reproduced (one as an actual OOM crash) before dispatching
+a fix.
+
+A minor (not patch) version for the same reason 1.2.0 was: the range
+changes the cancellation exit-code contract again, in the same category
+the last release documented as minor-worthy. A cancelled research run that
+had already collected at least one report used to report plain success
+(`ok: true`, exit `0`) because the orchestrator's fallback-synthesis path
+resolves normally on cancellation rather than throwing — `cmdResearch`'s
+success branch never consulted the cancellation latch, only its error
+branch did. It now exits `128 + signal` (or `130` for a programmatic
+abort) and sets `cancelled: true` in `--json`, matching every other
+cancellation-reporting path fixed in 1.2.0.
+
+### Fixed
+
+**Found in this release's own fresh-eyes pass (new, on top of the three prior rounds):**
+- **The chunker's own safety invariant was false — `overlap < targetSize` does not, in fact, prevent infinite loops.** Reproduced directly: `new Chunker({targetSize: 5, overlap: 4}).chunk(...)` on text containing a boundary-straddling emoji crashed the worker process with an out-of-memory error rather than merely running slowly. The UTF-16 surrogate-pair backoff (added earlier in this range) can land on the exact fixed point the forward-progress guard already enforces for `end`, so neither `start` nor `end` advances between iterations and the same chunk is pushed forever. A matching, milder gap let a lone high surrogate ship uncorrected into stored/embedded text whenever backing off would have violated that same guard. Both closed: the surrogate fix now grows past the low surrogate instead of silently doing nothing when shrinking would re-collide, and a new forward-progress invariant on `start` — mirroring the existing one on `end` — guarantees real per-iteration progress independent of any heuristic interaction, not just the ones already traced by hand. A brute-force sweep across small targetSize/overlap/emoji-position combinations backs the fix, not just the one reproducing triple.
+- **Uninstall's "is this directory exclusively ours" check was a bare name match, not an ownership check.** `isPiResearchNamespaced()` treated any path segment literally equal to `pi-research` as sufficient proof a `PI_RESEARCH_STATE_DIR` override was safe to delete wholesale — but naming a directory after the tool pointed at it is a completely ordinary thing to do (e.g. organizing several tools' state under `~/agents-state/<tool-name>/`), and nothing stops a user from keeping unrelated content in that same folder. The one regression test guarding this path only ever planted pi-research-owned entries, never foreign content, so it could never have caught this. Now only the exact default `<dirName>/research` layout — something the runtime actually constructs itself and can therefore prove is exclusively its own — authorizes wholesale removal; every other override, however named, only ever loses the specific entries the runtime is known to create there.
+- **A researcher could still run a full billed session after its run was told to stop.** The three fast-stop checkpoints added earlier in this range (top-of-loop, initial-links loop, post-backoff sleep) left one window uncovered: between `createResearcherSession()` resolving and the session being registered for `abortAllSessions()`'s visibility, a few lines later behind an awaited call. A stop tripping in exactly that gap was invisible to the abort scan, and the caller's bounded ~10s wait for self-stopping researchers elapsed before the session's own LLM call and scrape burst finished — the run returned and released its slot while the researcher kept going in the background. A fourth checkpoint immediately after registration closes it.
+- **A "FIX" comment described a circuit-breaker key format that has never existed in production.** `research-cleanup.ts` cleared session breakers assuming they're keyed `${piSessionId}-<8hex>`, but every real caller keys them by the plain `researchId` (generated independently of the pi session) — the function that would produce the assumed format has no production caller at all. The clear was consequently a no-op, masked on the normal run-completion path by a second, correctly-keyed clear elsewhere; the gap only mattered when this was the sole cleanup path (a throw before the orchestrator ever runs). Fixed to clear by the real key; the now-unused prefix-clearing utility this bug motivated, along with its own comment repeating the same wrong premise, is removed rather than left as bait for the same mistake again.
+- **A follower's healthcheck request couldn't be cancelled the way search/scrape already can.** The abort-signal plumbing added earlier in this range for search/scrape was never extended to healthcheck: the interface type carries no `signal` parameter and the one production caller always calls without one — currently harmless, but silently ready to reintroduce "follower cancellation burns a leader pool slot to timeout" the moment any caller starts passing a real signal, with no compiler error to flag it. Wired through, mirroring search/scrape exactly.
+- **Routine follower-cancellation was logged and counted as a server error.** The same abort-signal work introduced rejections shaped like `"Task search aborted while running"`, which the pool-shutdown error classifier doesn't recognize — so every cancelled in-flight browser task (a normal, frequent event whenever a research run is cancelled) logged at ERROR and inflated `browser_search_errors_total`/`browser_scrape_errors_total` before the layer that correctly demotes it ever saw the error. Each of the three call sites now checks the actual signal the rejection is a consequence of, rather than pattern-matching text — deliberately not widened inside the shared classifier, which a different caller also uses to detect a genuine leader handover.
+- **Severity filtering for a security-database search normalized only one of three backends.** `getSeverityParam()` was applied on the NVD leg only; GitHub and OSV read the raw, unvalidated value directly — reproducing, for two of three backends, the exact "unrecognized value silently filters everything to zero" bug an earlier round in this range fixed for NVD. Masked today because the sole production caller does its own separate, stricter validation first. Now normalized once, ahead of all three legs.
+- A flaky CI failure surfaced during this release's own gate run traced to a test relying on a fixed 50ms sleep to assume a lock had been fully acquired before tearing it down — on a loaded runner, teardown could occasionally win the race and land in a different, already-correctly-handled code path than the one the test meant to exercise. Replaced with a real "critical section has started" signal; no production code was at fault.
+
+**From the first post-1.2.0 audit round** (orchestration, browser, embedding/state, knowledge, CLI/config, utils, tools, SDK/planning — ~40 defects): aborted researchers restarting as untracked zombies (an `=== 'Aborted'` string match missed the actual sentinel shape); PDF content zeroed over cluster IPC and the resulting extraction error cached as a successful scrape; the stale-profile sweep touching arbitrary shared-tmp entries outside its own namespace; cluster workers leaking the research query into `ps` output; `clearEmbeddingServer` gaining compare-and-delete semantics (a mere follower's clean shutdown could deregister a live leader); `getEmbedder` refusing to join an in-flight init for a different model/device; a code-fence-straddling chunk boundary emitting one overlap-sliver per character; an explicit `--config` file's keys previously applying nowhere when shadowed by the ambient overlay; CLI flags silently swallowing their own values (`--model --json` running against the literal model `"--json"`); nested embedder-init stdio capture losing LIFO ordering on a mid-capture cancel; the scrape context gate billing pre-slice batch counts; StackExchange rate-limit/quota state not surviving across tool calls; and NVD severity filtering not normalizing case or the MODERATE→MEDIUM synonym.
+
+**From the second post-1.2.0 audit round** (browser/web-research, orchestration/SDK, knowledge/embedding, CLI/config/install — ~38 defects, including 2 regressions in the first round's own diff caught by that round's fresh-eyes pass): browser scrapes never checking HTTP status, so 4xx/5xx error pages were cached as citable content; the 100MB PDF / 25MB HTML size caps enforced only after the worker had already buffered and IPC'd the full body; search failures always hitting the global circuit breaker instead of the run's own; a follower's cancelled run burning its leader's pool slot to full timeout instead of aborting on socket close; fast-stop not reaching a researcher still acquiring links, sleeping between attempts, or rebuilding its session; the inter-attempt backoff sleep being non-abortable; a poisoned embedding leader staying eligible to re-elect onto GPU in the same process; NaN embedding vectors laundering to 0 across the HTTP hop; the full-text-search skip-guard's version bookkeeping missing rows committed mid-rebuild; a missing/unreadable explicit `--config` file being silently ignored instead of erroring; duplicate SIGINT delivery (process-group plus launcher-forwarded) hitting a consumed one-shot handler and force-exiting mid-cleanup; and the uninstall script's original, pre-this-release ownership gap for `PI_RESEARCH_STATE_DIR` (the one further hardened above).
+
+**From the backlog-clearing round** (re-auditing every item deferred since v1.0.7 plus both rounds above): the cancellation-reporting gap described above; `knowledge --json` success payloads not carrying `ok: true` despite claiming parity with the error shape, and `knowledge-config` having no `--json` error handling at all; the SSRF IPv6 gate missing `fec0::/10` and the NAT64 well-known prefix `64:ff9b::/96` (a real bypass on hosts whose egress traverses a NAT64 gateway, reachable via `64:ff9b::169.254.169.254`); steering messages already consumed by a finished run leaking into the next unrelated run's system-prompt injection; `clearBrowserServer` gaining the same compare-and-delete semantics its embedding-leader sibling already had; a second, independent chunker surrogate-pair gap (raw UTF-16 boundaries with no pair awareness); and steering-extended round budgets being invisible to the round-phase prompt logic (`PlanningService` recomputed `maxRounds` from the base complexity table only). `HealthCheckService` — zero runtime consumers, fully superseded by the live `src/healthcheck/registry.ts` system — was deleted.
+
+### Changed
+- **A cancelled-but-partially-successful research run now reports its true status.** See above — this is the same exit-code contract 1.2.0 established, extended to a success-path case that fix didn't reach.
+
 ## [1.2.0] - 2026-08-05
 
 Clears the medium/low findings deferred out of the 1.1.2 audit, then a second
@@ -256,20 +301,73 @@ and the host-version self-check gained the tested-ceiling warning.
 
 ---
 
-## Deferred Findings (from v1.0.7 audit)
-
-The following issues were identified during the v1.0.7 audit but intentionally deferred to future releases:
-
-1. **KnowledgeStore.close() timeout behavior** - The close() method proceeds even when the pending-write wait times out. A correct fix requires threading cancellation tokens through write paths or documenting the 10s timeout as intended behavior.
-
-2. **Cross-session teardown via shared singletons** - Session shutdown handlers run process-wide cleanup for reload/new/fork events. The correct behavior depends on pi's session model semantics and needs further investigation.
-
-3. **Lower-severity hardening items** - Various low-confidence or low-impact findings noted for future investigation:
-   - SIGINT-adjacent cancellation race
-   - Knowledge-store migration vs. concurrent access
-   - Global activity gate reused for per-session decisions
-   - Zombie queued browser tasks after timeout
-   - Non-atomic `clearBrowserServer`
-   - Inconsistent `knowledge --json` payload shapes
-   - Backward-clock-step tolerance across multiple rate limiters
+## Deferred Findings — cleared 2026-08-06
+
+The v1.0.7-era list below was re-audited against the current tree, three weeks
+and many fix rounds after it was written. Every item resolved one of two ways:
+already fixed as a side effect of unrelated work since, or fixed directly in
+this pass with a regression test. None remain open.
+
+- **KnowledgeStore.close() timeout behavior** — already safe: writes register
+  into the active-write set before the close-in-progress check can be seen,
+  and LanceDB table handles keep working after the owning connection closes,
+  so a timed-out close no longer strands or corrupts an in-flight write.
+- **Cross-session teardown via shared singletons** — not reachable: pi fully
+  serializes a session's teardown before the next one is created, so shared
+  singletons are never disposed out from under a still-live session.
+- **SIGINT-adjacent cancellation race** — real gap, fixed: a cancelled run
+  that had already produced a report returned through the orchestrator's
+  normal (non-throwing) partial-synthesis path, so the CLI's success branch
+  never saw the cancellation latch and reported `ok:true`/exit 0 for a run
+  the user had stopped. The success path now checks the latch and reports
+  the same `cancelled: true` / `128+signal` contract the error path already
+  used.
+- **Knowledge-store migration vs. concurrent access** — already safe: a
+  cross-process file lock serializes migrations, and every read/write
+  re-resolves its table handle, so a migration racing another process's
+  handle fails that operation cleanly instead of serving stale data.
+- **Global activity gate reused for per-session decisions** — real gap,
+  fixed: steering messages already consumed by a finished research run
+  survived in session state and leaked into the next, unrelated run's
+  system-prompt injection and final-report attribution. Only genuinely
+  still-queued messages now survive a run boundary.
+- **Zombie queued browser tasks after timeout** — already fixed (in the
+  first post-1.2.0 audit round): a queued task's client-side timeout now
+  actually removes it from the scheduler's queue instead of leaving it to
+  be dispatched later.
+- **Non-atomic `clearBrowserServer`** — real gap, fixed: the file write
+  itself was already atomic, but the read-decide-clear sequence around it
+  was not — a dead-leader restart path could wipe a legitimately new
+  leader's registration elected in the same window. `clearBrowserServer`
+  now takes an optional expected-owner argument and compares-and-deletes
+  inside the lock, mirroring the embedding leader's existing CAS.
+- **Inconsistent `knowledge --json` payload shapes** — real gap, fixed: the
+  success payload never carried `ok:true` despite a comment claiming parity
+  with the error shape, and `knowledge-config`'s failure path had no
+  try/catch at all and fell through to a plain-text-only handler even under
+  `--json`. Both now emit a consistent, documented shape.
+- **Backward-clock-step tolerance across multiple rate limiters** — already
+  safe: every limiter's timing arithmetic leans toward waiting longer on a
+  negative clock delta, never toward a burst or a permanent wedge.
+
+Two further items surfaced and closed in the same pass, found via later
+audit rounds' own deferred lists rather than the v1.0.7 one:
+- **SSRF: `isPrivateIpv6` missed `fec0::/10`** (deprecated site-local) and
+  **`64:ff9b::/96`** (the NAT64 well-known prefix — actively deployed today,
+  and a real bypass vector on a host whose egress traverses a NAT64
+  gateway). Both ranges are now blocked.
+- **Chunk boundaries could split a UTF-16 surrogate pair**, corrupting one
+  character (renders as U+FFFD) in stored/embedded text at an unlucky
+  boundary — the same class of bug already handled in three other places
+  in the codebase, now handled here too, on both the truncation and the
+  overlap-derived start boundary.
+- **Steering-extended round budgets weren't visible to the round-phase
+  prompt.** When mid-run steering extended the round cap beyond the base
+  per-complexity value, the planning service still computed guidance
+  against the base value, producing an impossible "Round 4 of 3" and,
+  more consequentially, prematurely selecting LATE-phase framing during
+  rounds steering had explicitly unlocked.
+
+One dead-code cleanup: `HealthCheckService` (a superseded, zero-consumer
+predecessor of the live `src/healthcheck/registry.ts` system) was removed.