@lincoln504/pi-research 1.3.11 → 1.4.1

package/src/infrastructure/browser/task-execution-service.ts

@@ -18,7 +18,7 @@ import { getServiceContainer, getService } from '../../core/service-registry.ts'
 import type { ServiceContainer } from '../../core/service-registry.ts';
 import { ServiceNames } from '../../core/service-interfaces.ts';
 import type { ISchedulerFactory, IScheduler } from '../../core/scheduler-factory.ts';
-import type { ISchedulerInternals } from '../../core/interfaces/scheduler-interfaces.ts';
+import type { ISchedulerInternals, TaskDispatchListener } from '../../core/interfaces/scheduler-interfaces.ts';
 import type { IStateManager } from '../../core/interfaces/state-manager-interfaces.ts';
 import { BrowserClient } from './browser-client.ts';
 
@@ -136,9 +136,19 @@ async function isRegisteredLeaderAlive(container: ServiceContainer): Promise<boo
     return result;
 }
 
-/** Test seam: drop the coalesced liveness probe. */
-export function _resetLeaderLivenessProbeForTests(): void {
+/**
+ * Test seam: drop BOTH module-level globals that survive between tests — the
+ * coalesced liveness probe (1s window) and the restart cooldown (10s window).
+ *
+ * Both are far longer than a test file's runtime, so a test that reaches
+ * restartSchedulerWithHerdGuard leaves state that silently short-circuits the
+ * next one: isRegisteredLeaderAliveUncached / forceSchedulerRestart simply are
+ * not re-invoked. Today nothing observes that only because the one test that
+ * reaches this path happens to run last — ordering, not a guarantee.
+ */
+export function _resetTaskExecutionGlobalsForTests(): void {
     leaderLivenessProbe = null;
+    lastRestartTime = 0;
 }
 
 /**
@@ -321,7 +331,7 @@ export async function runBrowserHealthCheck(config?: Config, retries = 1, signal
 /**
  * Run a worker search query with retry logic.
  */
-export async function runWorkerSearch(query: string, config?: Config, signal?: AbortSignal, retries = 1, sessionId?: string, container: ServiceContainer = getServiceContainer(), handoverRetries = LEADER_HANDOVER_RETRIES): Promise<SearchResult[]> {
+export async function runWorkerSearch(query: string, config?: Config, signal?: AbortSignal, retries = 1, sessionId?: string, container: ServiceContainer = getServiceContainer(), handoverRetries = LEADER_HANDOVER_RETRIES, onTaskEvent?: TaskDispatchListener): Promise<SearchResult[]> {
     if (signal?.aborted) throw new Error('Aborted');
     
     const breaker = sessionId ? getBrowserCircuitBreaker(sessionId) : browserCircuitBreaker;
@@ -330,7 +340,7 @@ export async function runWorkerSearch(query: string, config?: Config, signal?: A
         return await breaker.execute(async () => {
             if (signal?.aborted) throw new Error('Aborted');
             const scheduler = await getScheduler(config, container);
-            return await scheduler.runSearch(query, config, signal);
+            return await scheduler.runSearch(query, config, signal, onTaskEvent);
         });
     } catch (error: unknown) {
         if (signal?.aborted || (error instanceof Error && error.message === 'Aborted')) throw new Error('Aborted', { cause: error });
@@ -348,7 +358,7 @@ export async function runWorkerSearch(query: string, config?: Config, signal?: A
             logger.warn(`[BrowserManager] Leader handover during search (handover attempts left: ${handoverRetries}): ${briefErrorMessage(error)}...`);
             await recoverFromLeaderHandover(container);
             await new Promise((resolve) => setTimeout(resolve, HANDOVER_BACKOFF_MS + Math.floor(Math.random() * 400)));
-            return runWorkerSearch(query, config, signal, retries, sessionId, container, handoverRetries - 1);
+            return runWorkerSearch(query, config, signal, retries, sessionId, container, handoverRetries - 1, onTaskEvent);
         }
 
         if (retries > 0 && isTransientSocketError(error) && !isTaskTimeoutError(error) && !isCloudflareBlockError(error)) {
@@ -371,7 +381,7 @@ export async function runWorkerSearch(query: string, config?: Config, signal?: A
 
             const jitter = 100 + Math.floor(Math.random() * 400);
             await new Promise(resolve => setTimeout(resolve, jitter));
-            return runWorkerSearch(query, config, signal, retries - 1, sessionId, container, handoverRetries);
+            return runWorkerSearch(query, config, signal, retries - 1, sessionId, container, handoverRetries, onTaskEvent);
         }
         throw error;
     }

package/src/infrastructure/browser/thread-worker-browser.ts

@@ -134,29 +134,45 @@ export async function initBrowser(): Promise<void> {
         // (consumers install without our lockfile, so a floating range resolves
         // to a newer, broken version):
         //
-        //   • camoufox-js  ^0.10.2  → fetches camoufox Firefox 135 / beta.24, the
-        //     NEWEST camoufox with binaries for every OS we support (Linux x64/
-        //     arm64, macOS x64/arm64, Windows x64). FF146/FF150 dropped the
-        //     Windows build entirely, so the 0.11.x line breaks Windows installs.
+        //   • camoufox-js  ^0.10.2  → the two ORIGINAL reasons for this pin have
+        //     both lapsed (camoufox restored Windows assets in v152.0.4-beta.26,
+        //     2026-07-16; and impit's `only-allow pnpm` guard existed only in
+        //     0.13.1/0.14.0), but a THIRD, worse one replaced them. 0.12.0
+        //     requires `better-sqlite3 ^13.0.1`, and better-sqlite3 13 DROPPED
+        //     PREBUILT BINARIES: 12.x installs via `prebuild-install || node-gyp
+        //     rebuild`, 13.x has no install script at all, so npm falls back to
+        //     auto-running `node-gyp rebuild` for its binding.gyp and every
+        //     install needs a full C++ toolchain. Measured: `npm ci` fails
+        //     outright on the Windows CI runner ("could not find a version of
+        //     Visual Studio 2017 or newer"), which is most Windows consumers.
+        //     Upgrading again means checking better-sqlite3 first, not camoufox.
         //   • playwright-core  1.60.0 (exact) → playwright-core and the camoufox
         //     binary are one matched Juggler-protocol pair. 1.61 added a
-        //     viewport.isMobile field the FF135 build REJECTS ("property
+        //     viewport.isMobile field the build REJECTS ("property
         //     viewport.isMobile not described in this scheme"), failing every
-        //     launch below. 1.60.0 is the newest playwright the FF135 Juggler
-        //     accepts.
+        //     launch below. Corroborated upstream: camoufox-js 0.12.0 declares
+        //     `peerDependencies: playwright-core "<1.61.0"`, the same bound this
+        //     pin has held by hand.
         //   • impit  0.13.0 (exact, a direct dep though only camoufox-js uses it)
-        //     → impit 0.13.1/0.14.0 shipped a `preinstall: npx only-allow pnpm`
-        //     guard (an upstream mistake, fixed in 0.14.1+) that hard-fails
-        //     `npm install -g`. Within camoufox-js's ^0.13.0 range 0.13.0 is the
-        //     only guard-free version; a direct-dep pin is the ONLY way to force
-        //     it for consumers (npm `overrides` don't propagate to installers of
-        //     a published package).
+        //     → camoufox-js 0.10.2 requires `impit ^0.13.0`, and within that range
+        //     0.13.0 is the only version free of the `preinstall: npx only-allow
+        //     pnpm` guard (an upstream mistake in 0.13.1/0.14.0, dropped again in
+        //     0.14.1) that hard-fails `npm install -g`. The exact pin is also the
+        //     ONLY way to force a version for consumers, since npm `overrides`
+        //     don't propagate to installers of a published package.
         //
-        // Removal: upgrade all three together when camoufox ships stable
-        // cross-platform (incl. Windows) FF150 binaries — bumping camoufox-js to
-        // ≥0.11.1 also drops the impit pin (0.11.1 requires the fixed impit
-        // ^0.14.1) and needs playwright re-pinned to the new build's Juggler.
-        // Always re-verify a real headless run on Linux/macOS/Windows after.
+        // What is NOT pinned: the browser BINARY. `camoufox-js fetch` takes no
+        // version argument — it walks the GitHub releases newest-first and takes
+        // the first non-prerelease one with an asset for this OS/arch. A consumer
+        // therefore gets whatever camoufox published most recently, whichever
+        // camoufox-js they have, and a future release could break launches with no
+        // change on our side. Both the current newest (v152.0.4-beta.28, Firefox
+        // 152) and the older v135.0.1-beta.24 an existing cache may hold were
+        // verified launching and driving under playwright-core 1.60.0.
+        //
+        // Always re-verify a REAL headless run after touching any of this: the
+        // unit and integration suites mock the browser, so a Juggler mismatch
+        // reaches production with a fully green suite.
         let CamoufoxModule: any;
         try {
           CamoufoxModule = await import('camoufox-js');
@@ -228,11 +244,28 @@ export async function initBrowser(): Promise<void> {
           // timeout races ahead.
           launchPromise.catch((err: Error) => logToDebugFile('DEBUG', `[ThreadWorker] Background browser launch rejection: ${err.message}`));
           let launchTimeoutId: NodeJS.Timeout | undefined;
+          let raceLost = false;
+          // If the launch resolves AFTER we gave up on it, nobody holds the result:
+          // `browser` is assigned only from the race's winner, so the catch below —
+          // whose comment promises to "close any partially-launched browser" — finds
+          // null and closes nothing. Camoufox's own launch bound is 180s against our
+          // 90s, so a launch completing in that window leaves a fully-started headless
+          // Firefox with no owner, surviving the orphan sweep (its parent worker is
+          // alive) until the pool shuts down. Adopt and close it, exactly as
+          // createPageSafe already does for an orphaned page.
+          launchPromise.then((b: any) => {
+            if (!raceLost) return;
+            logToDebugFile('WARN', `[Worker-${workerId}] Browser launch completed after its deadline; closing the orphaned instance.`);
+            try { b?.close?.(); } catch { /* already gone */ }
+          }).catch(() => { /* rejection already logged above */ });
           try {
             return await Promise.race([
               launchPromise,
               new Promise<never>((_, reject) => {
-                launchTimeoutId = setTimeout(() => reject(new Error(`Browser launch timed out after ${launchTimeoutMs}ms`)), launchTimeoutMs);
+                launchTimeoutId = setTimeout(() => {
+                  raceLost = true;
+                  reject(new Error(`Browser launch timed out after ${launchTimeoutMs}ms`));
+                }, launchTimeoutMs);
               })
             ]);
           } finally {
@@ -267,10 +300,23 @@ export async function initBrowser(): Promise<void> {
         const contextPromise = browser.newContext();
         contextPromise.catch((err: Error) => logToDebugFile('DEBUG', `[ThreadWorker] Background browser context rejection: ${err.message}`));
         let contextTimeoutId: NodeJS.Timeout | undefined;
+        let contextRaceLost = false;
+        // Same adoption as the launch above. Here the catch below CAN close the
+        // browser (it is assigned by now), which disposes the stray context with it —
+        // but only when initBrowser is entered with a dead browser, and it leaves the
+        // context open for the window in between. Closing it directly is unconditional.
+        contextPromise.then((c: any) => {
+          if (!contextRaceLost) return;
+          logToDebugFile('WARN', `[Worker-${workerId}] Browser context creation completed after its deadline; closing the orphaned context.`);
+          try { c?.close?.(); } catch { /* already gone */ }
+        }).catch(() => { /* rejection already logged above */ });
         context = await Promise.race([
           contextPromise,
           new Promise<never>((_, reject) => {
-            contextTimeoutId = setTimeout(() => reject(new Error('Browser context creation timed out after 30000ms')), 30000);
+            contextTimeoutId = setTimeout(() => {
+              contextRaceLost = true;
+              reject(new Error('Browser context creation timed out after 30000ms'));
+            }, 30000);
           })
         ]);
         if (contextTimeoutId) clearTimeout(contextTimeoutId);

package/src/infrastructure/browser/thread-worker-messaging.ts

@@ -259,15 +259,42 @@ async function extractSearchResults(page: any): Promise<any[]> {
 /**
  * Execute a search task
  */
+/**
+ * Bind a task-timeout signal to the page it is bounding.
+ *
+ * `page.setDefaultTimeout` bounds Playwright's action and navigation verbs
+ * individually; it does not bound their sum, and it does not bound a Response read
+ * at all. Closing the page is what actually ends the work: any in-flight call
+ * rejects with 'Target closed', which runTask's catch already maps back to the
+ * task timeout. Fire-and-forget, `{ once }` so the listener cannot outlive the task.
+ */
+function bindTaskAbortToPage(page: any, signal?: AbortSignal): void {
+  if (!signal) return;
+  const onAbort = () => { page.close().catch(() => {}); };
+  if (signal.aborted) onAbort();
+  else signal.addEventListener('abort', onAbort, { once: true });
+}
+
 export async function executeSearchTask(
   _context: any,
-  query: string
+  query: string,
+  signal?: AbortSignal
 ): Promise<{ results: any[]; jitter: number }> {
   const page = await createPageSafe(_context);
   const SEARCH_TIMEOUT = parseTimeoutMs(process.env['PI_RESEARCH_SEARCH_TIMEOUT_MS'], 45000);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
 
+  // Same binding the scrape path has used all along, and for the same reason: the
+  // worker's task deadline was armed but its signal was only ever handed to
+  // executeScrapeTask, so on a search it fired into nothing. Playwright's own
+  // per-action timeouts still bound each verb, but the sum of them plus the jitter
+  // sleep can outlast the whole task budget — and poolifier keeps counting this node
+  // as executing until the worker replies, so the node stays pinned long after the
+  // caller was answered. Closing the page rejects whatever is in flight with
+  // 'Target closed', which runTask's catch already recognises as the timeout.
+  bindTaskAbortToPage(page, signal);
+
   try {
     logToDebugFile('DEBUG', `[Worker-${workerId}] Starting search for: ${query}`);
     
@@ -692,11 +719,15 @@ const HEALTH_FALLBACK_URL = 'https://example.com/';
 async function executeHealthCheckAttempt(
   _context: any,
   navTimeoutMs: number,
-  url: string = HEALTH_PRIMARY_URL
+  url: string = HEALTH_PRIMARY_URL,
+  signal?: AbortSignal
 ): Promise<{ success: boolean; navMs: number }> {
   const page = await createPageSafe(_context);
   page.setDefaultTimeout(navTimeoutMs);
   page.setDefaultNavigationTimeout(navTimeoutMs);
+  // See executeSearchTask: the probe runs twice (primary then fallback), so its own
+  // nav timeout bounds each attempt but not the pair.
+  bindTaskAbortToPage(page, signal);
 
   try {
     const navStart = Date.now();
@@ -721,7 +752,8 @@ async function executeHealthCheckAttempt(
  */
 export async function executeHealthCheck(
   _context: any,
-  initMs: number
+  initMs: number,
+  signal?: AbortSignal
 ): Promise<{ success: boolean; navMs: number }> {
   // Nav timeout: read from env (passed through getBrowserEnv), floor at 10s.
   // The outer BrowserTaskScheduler.runHealthCheck() has its own 45s hard deadline.
@@ -733,14 +765,14 @@ export async function executeHealthCheck(
   }
 
   try {
-    return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT);
+    return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_PRIMARY_URL, signal);
   } catch (firstError: unknown) {
     // One retry: if the first attempt fails, the page may have been in a bad state
     // (challenge redirect, partial load, transient network blip). A second attempt
     // on a fresh page helps distinguish a real outage from a one-off failure.
     logToDebugFile('WARN', `[Worker-${workerId}] Health check attempt 1 failed: ${firstError instanceof Error ? firstError.message : String(firstError)}. Retrying once...`);
     try {
-      return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT);
+      return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_PRIMARY_URL, signal);
     } catch (retryError: unknown) {
       const retryMsg = retryError instanceof Error ? retryError.message : String(retryError);
       // A TIMEOUT is left to propagate: upstream (isBusyPoolHealthFailure) already
@@ -756,7 +788,7 @@ export async function executeHealthCheck(
         // healthy enough to research (search has its own retries/fallbacks downstream).
         logToDebugFile('WARN', `[Worker-${workerId}] Search-provider health probe failed twice (${retryMsg}); verifying open-web reachability via fallback endpoint...`);
         try {
-          const fallback = await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_FALLBACK_URL);
+          const fallback = await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_FALLBACK_URL, signal);
           logToDebugFile('WARN', `[Worker-${workerId}] Fallback endpoint reachable — open web is up, search provider is degraded. Proceeding with research.`);
           return fallback;
         } catch (fallbackError: unknown) {

package/src/infrastructure/browser/thread-worker.mjs

@@ -99,7 +99,10 @@ var init_log_utils = __esm({
       `${B_LEFT}(sk-[A-Za-z0-9_-]{16,}|gh[posru]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})${B_RIGHT}`,
       "g"
     );
-    JWT_PATTERN = new RegExp(`${B_LEFT}eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+`, "g");
+    JWT_PATTERN = new RegExp(
+      `${B_LEFT}eyJ[A-Za-z0-9_-]{1,1024}\\.[A-Za-z0-9_-]{1,8192}\\.[A-Za-z0-9_-]{1,4096}`,
+      "g"
+    );
     BASIC_AUTH_PATTERN = new RegExp(`${B_LEFT}Basic\\s+[A-Za-z0-9+/]{16,}={0,2}`, "gi");
     BEARER_AUTH_PATTERN = new RegExp(`${B_LEFT}Bearer\\s+[A-Za-z0-9._~+/-]+=*`, "gi");
     PROVIDER_TOKEN_PATTERN = new RegExp(
@@ -1057,6 +1060,17 @@ var init_logger = __esm({
           timestamp,
           level,
           ...getLogContext(),
+          // Every process writes to the SAME log file — up to three concurrent research
+          // runs plus the elected browser-pool leader — and until this field existed
+          // there was nothing to tell their lines apart. Reconstructing a lock
+          // contention from the log then meant inferring process boundaries from
+          // timing, which is guesswork: two runs a second apart interleave into what
+          // reads like one process contradicting itself. Twelve bytes a line buys
+          // attributable forensics.
+          //
+          // After the context spread, not before: which process wrote a line is not
+          // something a scoped context gets to claim otherwise.
+          pid: process.pid,
           message,
           ...firstError ? { errorMessage: redactSecrets(firstError.message), errorStack: redactSecrets(firstError.stack ?? "") } : {}
         };
@@ -1163,7 +1177,7 @@ var init_metrics = __esm({
       increment(name, value = 1, labels) {
         const key = this.getKey(name, labels);
         this.counters.set(key, (this.counters.get(key) ?? 0) + value);
-        if (name === "llm_cost_total" || name === "llm_tokens_total") {
+        if (name.startsWith("llm_")) {
           logger.debug(`[Metrics] Incremented ${name} by ${value}${labels ? ` (labels: ${JSON.stringify(labels)})` : ""}`);
         }
       }
@@ -1267,6 +1281,28 @@ var init_metrics = __esm({
       async measure(name, action, labels) {
         return this.getActive().measure(name, action, labels);
       }
+      /**
+       * Emit API that ALWAYS targets the session registry, ignoring any active run
+       * context.
+       *
+       * For process-lifetime callbacks that happen to be *registered* during a run.
+       * AsyncLocalStorage resolves at emit time from the async resource that fired,
+       * and for a listener installed on a long-lived emitter that resource is the
+       * emitter itself — created, for every lazily-initialized subsystem here, inside
+       * whichever run first needed it. So a worker-pool error handler installed during
+       * run 1 keeps writing into run 1's registry for the rest of the process: those
+       * counts disappear from every later run's summary (the registry was discarded
+       * when the run ended) and the dead registry stays reachable through the closure.
+       *
+       * Use this only where the emission is genuinely process-scoped. Anything that
+       * describes work a run asked for belongs in the run registry, which is what the
+       * plain emit methods above give you.
+       */
+      session = {
+        increment: (name, value = 1, labels) => this._session.increment(name, value, labels),
+        setGauge: (name, value, labels) => this._session.setGauge(name, value, labels),
+        observe: (name, value, labels) => this._session.observe(name, value, labels)
+      };
       // ── Session-level read API ─────────────────────────────────────────────
       /** Snapshot of the session registry (infrastructure / cross-run metrics). */
       getSessionSnapshot() {
@@ -1509,6 +1545,7 @@ var scraper_utils_exports = {};
 __export(scraper_utils_exports, {
   createJsMarkdownConverter: () => createJsMarkdownConverter,
   createNativeMarkdownConverter: () => createNativeMarkdownConverter,
+  disposeSsrfSafeFetcher: () => disposeSsrfSafeFetcher,
   extractDomain: () => extractDomain,
   formatErrorWithCause: () => formatErrorWithCause,
   getRandomUserAgent: () => getRandomUserAgent,
@@ -1644,19 +1681,33 @@ function isSsrfBlockError(error) {
   }
   return false;
 }
-async function getSsrfSafeFetcher() {
-  if (cachedSsrfFetcher !== void 0) return cachedSsrfFetcher;
+function getSsrfSafeFetcher() {
+  cachedSsrfFetcher ??= (async () => {
+    try {
+      const { Agent, fetch: undiciFetch } = await import("undici");
+      return {
+        fetch: undiciFetch,
+        dispatcher: new Agent({ connect: { lookup: ssrfSafeLookup } })
+      };
+    } catch (e) {
+      logger.warn(`[Scrapers] undici unavailable; connect-time SSRF pinning disabled (request-time validation still active): ${e instanceof Error ? e.message : String(e)}`);
+      return null;
+    }
+  })();
+  return cachedSsrfFetcher;
+}
+async function disposeSsrfSafeFetcher() {
+  const pending = cachedSsrfFetcher;
+  cachedSsrfFetcher = void 0;
+  if (pending === void 0) return;
+  const cached = await pending.catch(() => null);
+  const closable = cached?.dispatcher;
+  if (!closable?.close) return;
   try {
-    const { Agent, fetch: undiciFetch } = await import("undici");
-    cachedSsrfFetcher = {
-      fetch: undiciFetch,
-      dispatcher: new Agent({ connect: { lookup: ssrfSafeLookup } })
-    };
+    await closable.close();
   } catch (e) {
-    logger.warn(`[Scrapers] undici unavailable; connect-time SSRF pinning disabled (request-time validation still active): ${e instanceof Error ? e.message : String(e)}`);
-    cachedSsrfFetcher = null;
+    logger.debug(`[Scrapers] Error closing SSRF dispatcher: ${e instanceof Error ? e.message : String(e)}`);
   }
-  return cachedSsrfFetcher;
 }
 function formatErrorWithCause(err) {
   try {
@@ -2152,11 +2203,21 @@ async function extractSearchResults(page) {
     return found;
   });
 }
-async function executeSearchTask(_context, query) {
+function bindTaskAbortToPage(page, signal) {
+  if (!signal) return;
+  const onAbort = () => {
+    page.close().catch(() => {
+    });
+  };
+  if (signal.aborted) onAbort();
+  else signal.addEventListener("abort", onAbort, { once: true });
+}
+async function executeSearchTask(_context, query, signal) {
   const page = await createPageSafe(_context);
   const SEARCH_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"], 45e3);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
+  bindTaskAbortToPage(page, signal);
   try {
     logToDebugFile2("DEBUG", `[Worker-${workerId2}] Starting search for: ${query}`);
     if (process.env["PI_RESEARCH_MOCK_SEARCH"] === "true") {
@@ -2369,10 +2430,11 @@ async function executeScrapeTask(_context, url, signal) {
 }
 var HEALTH_PRIMARY_URL = "https://lite.duckduckgo.com/lite/";
 var HEALTH_FALLBACK_URL = "https://example.com/";
-async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PRIMARY_URL) {
+async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PRIMARY_URL, signal) {
   const page = await createPageSafe(_context);
   page.setDefaultTimeout(navTimeoutMs);
   page.setDefaultNavigationTimeout(navTimeoutMs);
+  bindTaskAbortToPage(page, signal);
   try {
     const navStart = Date.now();
     await page.goto(url, { waitUntil: "domcontentloaded" });
@@ -2388,25 +2450,25 @@ async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PR
     throw error;
   }
 }
-async function executeHealthCheck(_context, initMs) {
+async function executeHealthCheck(_context, initMs, signal) {
   const configuredMs = parseTimeoutMs(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(1e4, configuredMs) : 1e4;
   if (initMs > 3e3) {
     logToDebugFile2("WARN", `[Worker-${workerId2}] Browser init was slow: ${initMs}ms \u2014 leaving less headroom for DDG navigation.`);
   }
   try {
-    return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT);
+    return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_PRIMARY_URL, signal);
   } catch (firstError) {
     logToDebugFile2("WARN", `[Worker-${workerId2}] Health check attempt 1 failed: ${firstError instanceof Error ? firstError.message : String(firstError)}. Retrying once...`);
     try {
-      return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT);
+      return await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_PRIMARY_URL, signal);
     } catch (retryError) {
       const retryMsg = retryError instanceof Error ? retryError.message : String(retryError);
       const isTimeout = /tim(e|ed)\s*out|timeout/i.test(retryMsg);
       if (!isTimeout) {
         logToDebugFile2("WARN", `[Worker-${workerId2}] Search-provider health probe failed twice (${retryMsg}); verifying open-web reachability via fallback endpoint...`);
         try {
-          const fallback = await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_FALLBACK_URL);
+          const fallback = await executeHealthCheckAttempt(_context, HEALTH_TIMEOUT, HEALTH_FALLBACK_URL, signal);
           logToDebugFile2("WARN", `[Worker-${workerId2}] Fallback endpoint reachable \u2014 open web is up, search provider is degraded. Proceeding with research.`);
           return fallback;
         } catch (fallbackError) {
@@ -2510,7 +2572,7 @@ var ConfigSchema = Type.Object({
    *  never killed before it has used its full nav budget plus time waiting in the queue.
    *  (default: 10000) */
   BROWSER_TASK_TIMEOUT_MS: Type.Number({ minimum: 2e3, maximum: 12e4, default: 1e4 }),
-  /** Timeout for coordinator/evaluator/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-30min).
+  /** Timeout for coordinator/research-lead/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-30min).
    *  Not exposed in TUI — controlled via PI_RESEARCH_LLM_TIMEOUT_MS env var.
    *  Ceiling raised to 30min (matching RESEARCHER_TIMEOUT_MS): a slow model on a
    *  large-context synthesis/plan call can legitimately run >10min, and the old
@@ -2518,7 +2580,7 @@ var ConfigSchema = Type.Object({
    *  (e.g. 900000), causing those calls to time out mid-generation. */
   LLM_TIMEOUT_MS: Type.Number({ minimum: 6e4, maximum: 18e5, default: 3e5 }),
   /** Chain-of-thought "thinking" level for the engine's own LLM calls (coordinator,
-   *  evaluator, synthesis, JSON-repair, knowledge extraction) AND the researcher
+   *  router, synthesizer, JSON-repair, knowledge extraction) AND the researcher
    *  sub-agents. Default 'off': these calls emit structured JSON / cited reports, not
    *  open-ended reasoning, so thinking only burns the output-token budget (often
    *  truncating before the JSON/report block) and adds latency for at most a marginal
@@ -2533,22 +2595,26 @@ var ConfigSchema = Type.Object({
     Type.Literal("medium"),
     Type.Literal("high")
   ], { default: "off" }),
-  /** Max output tokens for the coordinator plan + mid-round evaluator decision (and,
-   *  when the evaluator synthesizes mid-round, the report). Default 16384. The blanket
+  /** Max output tokens for the coordinator's round-1 plan. Default 16384. The routing
+   *  decision has its OWN, much smaller ceiling (it emits a decision, never a report,
+   *  and cannot synthesize mid-round under the split protocol); the final report uses
+   *  SYNTHESIS_MAX_TOKENS below. The blanket
    *  4096 cap previously throttled every call and could be exhausted by a thinking block
    *  before any text was emitted. Capped at the model's real ceiling at call time.
    *  Not exposed in TUI — controlled via PI_RESEARCH_PLANNING_MAX_TOKENS env var. */
   PLANNING_MAX_TOKENS: Type.Number({ minimum: 1024, maximum: 131072, default: 16384 }),
-  /** Max output tokens for the final synthesized research report (the forced-synthesis
-   *  evaluator call). Default 32768 so a full cited report is never truncated. Capped at
+  /** Max output tokens for the final synthesized research report (the synthesizer call,
+   *  and each pass of a reduce when the corpus does not fit in one). Default 32768 so a
+   *  full cited report is never truncated. It is also the reserve subtracted from the
+   *  model's context window when budgeting that corpus. Capped at
    *  the model's real maxTokens at call time.
    *  Not exposed in TUI — controlled via PI_RESEARCH_SYNTHESIS_MAX_TOKENS env var. */
   SYNTHESIS_MAX_TOKENS: Type.Number({ minimum: 1024, maximum: 131072, default: 32768 }),
   /** LLM Model override for researcher sub-agents and knowledge synthesis.
    *  Format: provider/model-id (e.g. google/gemini-2.0-flash-001) or just model-id.
    *  When set, this overrides ctx.model for researcher sub-agents (both deep and quick)
-   *  and the knowledge synthesis background LLM. The coordinator and evaluator always
-   *  use the caller's model (ctx.model).
+   *  and the knowledge synthesis background LLM. The coordinator and the research lead
+   *  always use the caller's model (ctx.model).
    */
   RESEARCH_MODEL: Type.Optional(Type.String()),
   /** Explicit directory for the knowledge store database (overrides default) */
@@ -2602,6 +2668,7 @@ function resolveHeadlessMode() {
   if (process.env["PI_RESEARCH_USE_XVFB"] === "true") return "virtual";
   return true;
 }
+var HEALTHCHECK_MIN_BUDGET_MS = 45e3 + 6e4;
 
 // src/infrastructure/browser/thread-worker-browser.ts
 var browser = null;
@@ -2716,11 +2783,24 @@ async function initBrowser() {
           });
           launchPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser launch rejection: ${err.message}`));
           let launchTimeoutId;
+          let raceLost = false;
+          launchPromise.then((b) => {
+            if (!raceLost) return;
+            logToDebugFile3("WARN", `[Worker-${workerId3}] Browser launch completed after its deadline; closing the orphaned instance.`);
+            try {
+              b?.close?.();
+            } catch {
+            }
+          }).catch(() => {
+          });
           try {
             return await Promise.race([
               launchPromise,
               new Promise((_, reject) => {
-                launchTimeoutId = setTimeout(() => reject(new Error(`Browser launch timed out after ${launchTimeoutMs}ms`)), launchTimeoutMs);
+                launchTimeoutId = setTimeout(() => {
+                  raceLost = true;
+                  reject(new Error(`Browser launch timed out after ${launchTimeoutMs}ms`));
+                }, launchTimeoutMs);
               })
             ]);
           } finally {
@@ -2745,10 +2825,23 @@ async function initBrowser() {
         const contextPromise = browser.newContext();
         contextPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser context rejection: ${err.message}`));
         let contextTimeoutId;
+        let contextRaceLost = false;
+        contextPromise.then((c) => {
+          if (!contextRaceLost) return;
+          logToDebugFile3("WARN", `[Worker-${workerId3}] Browser context creation completed after its deadline; closing the orphaned context.`);
+          try {
+            c?.close?.();
+          } catch {
+          }
+        }).catch(() => {
+        });
         context = await Promise.race([
           contextPromise,
           new Promise((_, reject) => {
-            contextTimeoutId = setTimeout(() => reject(new Error("Browser context creation timed out after 30000ms")), 3e4);
+            contextTimeoutId = setTimeout(() => {
+              contextRaceLost = true;
+              reject(new Error("Browser context creation timed out after 30000ms"));
+            }, 3e4);
           })
         ]);
         if (contextTimeoutId) clearTimeout(contextTimeoutId);
@@ -2864,14 +2957,14 @@ async function runTask(data) {
     let result;
     if (type === "search") {
       if (!query) throw new Error("Search task requires a query");
-      const searchResult = await executeSearchTask(getContext(), query);
+      const searchResult = await executeSearchTask(getContext(), query, abortController.signal);
       result = { results: searchResult.results, duration: Date.now() - startTime, jitter: searchResult.jitter };
     } else if (type === "scrape") {
       if (!url) throw new Error("Scrape task requires a URL");
       const scrapeResult = await executeScrapeTask(getContext(), url, abortController.signal);
       result = { ...scrapeResult, duration: Date.now() - startTime };
     } else if (type === "healthcheck") {
-      const healthResult = await executeHealthCheck(getContext(), initMs);
+      const healthResult = await executeHealthCheck(getContext(), initMs, abortController.signal);
       result = { ...healthResult, duration: Date.now() - startTime };
     } else {
       result = { error: "Unknown task type", duration: Date.now() - startTime };

package/src/infrastructure/browser/thread-worker.ts

@@ -116,14 +116,14 @@ async function runTask(data: TaskData | undefined): Promise<TaskResult> {
     let result: any;
     if (type === 'search') {
       if (!query) throw new Error('Search task requires a query');
-      const searchResult = await executeSearchTask(getContext(), query);
+      const searchResult = await executeSearchTask(getContext(), query, abortController.signal);
       result = { results: searchResult.results, duration: Date.now() - startTime, jitter: searchResult.jitter };
     } else if (type === 'scrape') {
       if (!url) throw new Error('Scrape task requires a URL');
       const scrapeResult = await executeScrapeTask(getContext(), url, abortController.signal);
       result = { ...scrapeResult, duration: Date.now() - startTime };
     } else if (type === 'healthcheck') {
-      const healthResult = await executeHealthCheck(getContext(), initMs);
+      const healthResult = await executeHealthCheck(getContext(), initMs, abortController.signal);
       result = { ...healthResult, duration: Date.now() - startTime };
     } else {
       result = { error: 'Unknown task type', duration: Date.now() - startTime };