@lincoln504/pi-research 1.3.3 → 1.3.5

package/dist/cli.mjs

@@ -215,12 +215,8 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let keep = MAX_LOG_MESSAGE_LENGTH;
-  if (message.length > keep) {
-    const lastKeptUnit = message.charCodeAt(keep - 1);
-    if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
-  }
-  let out = message.length > MAX_LOG_MESSAGE_LENGTH ? `${message.slice(0, keep)}\u2026[truncated ${message.length - keep} chars]` : message;
+  const rawLength = message.length;
+  let out = rawLength > REDACT_SCAN_LENGTH ? message.slice(0, REDACT_SCAN_LENGTH) : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -231,12 +227,20 @@ function redactSecrets(message) {
   out = out.replace(KNOWN_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(PROVIDER_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(LONG_HEX_SECRET_PATTERN, "[REDACTED]");
+  let keep = MAX_LOG_MESSAGE_LENGTH;
+  if (out.length > keep) {
+    const lastKeptUnit = out.charCodeAt(keep - 1);
+    if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
+  }
+  if (out.length > MAX_LOG_MESSAGE_LENGTH) {
+    out = `${out.slice(0, keep)}\u2026[truncated ${rawLength - keep} chars]`;
+  }
   return out;
 }
 function stripTerminalEscapes(message) {
   return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, REDACT_SCAN_LENGTH, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -245,7 +249,7 @@ var init_log_utils = __esm({
     ANSI_PATTERN = /\x1b\[[0-9;]*[A-Za-z]/g;
     URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s:@]+@/gi;
     COOKIE_HEADER_PATTERN = /\b(set[_-]?cookie|cookie)\b(["']?\s*[:=]\s*["']?)([^\r\n]+)/gi;
-    SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
+    SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key|key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
     KNOWN_TOKEN_PATTERN = /\b(sk-[A-Za-z0-9_-]{16,}|gh[posru]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
     JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
     BASIC_AUTH_PATTERN = /\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}/gi;
@@ -253,6 +257,7 @@ var init_log_utils = __esm({
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
     CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
     TERMINAL_ESCAPE_PATTERN = new RegExp(
       "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
       "g"
@@ -263,10 +268,17 @@ var init_log_utils = __esm({
 // src/utils/log-rotation.ts
 import * as fs from "node:fs";
 import * as path2 from "node:path";
-var LogRotation;
+function touchOwnerOnly(filePath, mode) {
+  try {
+    fs.closeSync(fs.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode));
+  } catch {
+  }
+}
+var APPEND_CREATE_NOFOLLOW_FLAGS, LogRotation;
 var init_log_rotation = __esm({
   "src/utils/log-rotation.ts"() {
     "use strict";
+    APPEND_CREATE_NOFOLLOW_FLAGS = fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | (typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0);
     LogRotation = class {
       MAX_LOG_SIZE = 10 * 1024 * 1024;
       // 10MB max file size
@@ -284,10 +296,7 @@ var init_log_rotation = __esm({
         try {
           if (fs.existsSync(logFile)) {
             fs.unlinkSync(logFile);
-            try {
-              fs.closeSync(fs.openSync(logFile, "a", 384));
-            } catch {
-            }
+            touchOwnerOnly(logFile, 384);
             try {
               fs.chmodSync(logFile, 384);
             } catch {
@@ -327,10 +336,7 @@ var init_log_rotation = __esm({
             this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
             return;
           }
-          try {
-            fs.closeSync(fs.openSync(logFile, "a", 384));
-          } catch {
-          }
+          touchOwnerOnly(logFile, 384);
           try {
             fs.chmodSync(logFile, 384);
           } catch {
@@ -497,7 +503,10 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     unkeyedCaptureDepth++;
     isAnyLoggerCapturingOutput = true;
   }
-  const decoder = new TextDecoder2();
+  const stderrDecoder = new TextDecoder2();
+  const stdoutDecoder = new TextDecoder2();
+  const fd1SyncDecoder = new TextDecoder2();
+  const fd2SyncDecoder = new TextDecoder2();
   const originalStderrWrite = process.stderr.write;
   const originalStdoutWrite = process.stdout.write;
   const originalFsWriteSync = fs3.writeSync;
@@ -543,7 +552,11 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
   console.debug = createConsolePatch("debug", logFile, hasSufficientDiskSpace);
   process.stderr.write = (chunk, encodingOrCb, callback) => {
     const cb = typeof encodingOrCb === "function" ? encodingOrCb : callback;
-    const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+    const message = typeof chunk === "string" ? chunk : stderrDecoder.decode(chunk, { stream: true });
+    if (message.length === 0) {
+      if (typeof cb === "function") cb();
+      return true;
+    }
     if (!hasSufficientDiskSpace()) {
       if (typeof cb === "function") cb();
       return true;
@@ -564,7 +577,7 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     return true;
   };
   process.stdout.write = (chunk, encodingOrCb, callback) => {
-    const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+    const message = typeof chunk === "string" ? chunk : stdoutDecoder.decode(chunk, { stream: true });
     const isNative = isNativeLog(message);
     const complexTui = isComplexTui(message);
     const boxDrawing = isBoxDrawing(message);
@@ -618,7 +631,11 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     if (!descriptor || (descriptor.writable || descriptor.set)) {
       fs3.writeSync = (fd, chunk, ...args) => {
         if (fd === 1 || fd === 2) {
-          const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+          const fdDecoder = fd === 1 ? fd1SyncDecoder : fd2SyncDecoder;
+          const message = typeof chunk === "string" ? chunk : fdDecoder.decode(chunk, { stream: true });
+          if (fd === 2 && message.length === 0) {
+            return typeof chunk === "string" ? Buffer.from(chunk).length : chunk.length;
+          }
           const isNative = isNativeLog(message);
           const boxDrawing = isBoxDrawing(message);
           const complexTui = isComplexTui(message);
@@ -1349,6 +1366,24 @@ var init_service_registry = __esm({
             ]);
             if (settleTimer) clearTimeout(settleTimer);
           }
+          const inFlightDisposals = Array.from(this.services.values()).map((r) => r.disposalPromise).filter((p) => p != null);
+          if (inFlightDisposals.length > 0) {
+            if (this.defaultOptions.enableLogging) {
+              logger.debug(`[ServiceContainer] Waiting for ${inFlightDisposals.length} in-flight disposal(s) before teardown`);
+            }
+            let disposalSettleTimer;
+            await Promise.race([
+              Promise.allSettled(inFlightDisposals),
+              new Promise((resolve9) => {
+                disposalSettleTimer = setTimeout(() => {
+                  logger.warn("[ServiceContainer] Timed out waiting for in-flight service disposal; proceeding with teardown");
+                  resolve9();
+                }, DISPOSE_INFLIGHT_INIT_TIMEOUT_MS);
+                disposalSettleTimer.unref?.();
+              })
+            ]);
+            if (disposalSettleTimer) clearTimeout(disposalSettleTimer);
+          }
           const activeServices = Array.from(this.services.keys()).filter(
             (name) => this.services.get(name)?.instance !== null
           );
@@ -1932,7 +1967,7 @@ function normalizeUrl(url) {
     }
     return result;
   } catch (_err) {
-    logger.debug(`[url-utils] normalizing unparseable URL (${url.slice(0, 200)}): ${_err instanceof Error ? _err.message : String(_err)}`);
+    logger.debug(`[url-utils] normalizing unparseable URL (${redactSecrets(url).slice(0, 200)}): ${_err instanceof Error ? _err.message : String(_err)}`);
     let cleaned = url.trim().replace(/^[*_~`"']{1,20}/, "").replace(/[*_~`"',.)}\]]{1,20}$/, "");
     const hashIdx = cleaned.indexOf("#");
     if (hashIdx >= 0) cleaned = cleaned.substring(0, hashIdx);
@@ -1996,6 +2031,7 @@ var init_url_utils = __esm({
   "src/utils/url-utils.ts"() {
     "use strict";
     init_logger();
+    init_log_utils();
     MAX_INITIAL_LINKS = 20;
     MAX_INITIAL_LINK_CHARS = 2048;
   }
@@ -6434,7 +6470,7 @@ var init_chunker = __esm({
             if (code >= 56320 && code <= 57343) {
               if (start - 1 > iterationStart) {
                 start -= 1;
-              } else if (start + 1 < end) {
+              } else if (start + 1 <= end) {
                 start += 1;
               }
             }
@@ -8663,6 +8699,9 @@ var init_knowledge_store_service = __esm({
             await this._initializationPromise;
           } catch {
           }
+          if (this._disposalPromise) {
+            return this._disposalPromise;
+          }
         }
         this.lifecycle = "disposing" /* DISPOSING */;
         logger.debug("[KnowledgeStoreService] Disposing...");
@@ -8670,7 +8709,8 @@ var init_knowledge_store_service = __esm({
         const store = this._store;
         const writerQueue = this._writerQueue;
         const initLock = this._initLock;
-        this._disposalPromise = (async () => {
+        let disposePromise = null;
+        disposePromise = (async () => {
           try {
             if (writerQueue) {
               await writerQueue.dispose?.();
@@ -8694,9 +8734,12 @@ var init_knowledge_store_service = __esm({
             logger.error("[KnowledgeStoreService] Error during disposal:", err);
           } finally {
             this.lifecycle = "disposed" /* DISPOSED */;
-            this._disposalPromise = null;
+            if (this._disposalPromise === disposePromise) {
+              this._disposalPromise = null;
+            }
           }
         })();
+        this._disposalPromise = disposePromise;
         return this._disposalPromise;
       }
       /**
@@ -9740,16 +9783,31 @@ function installSkill(toolIds, opts = {}) {
               continue;
             }
             fs16.unlinkSync(absSkillPath);
-            fs16.symlinkSync(source, absSkillPath, process.platform === "win32" ? "junction" : "dir");
-            upsertEntry(manifest, { tool: id, path: absSkillPath, type: "symlink", source, createdAt: now, ...skillVersion ? { version: skillVersion } : {} });
-            results.push({ tool: id, path: absSkillPath, type: "symlink", status: "installed", message: "re-pointed stale symlink to current source" });
+            try {
+              fs16.symlinkSync(source, absSkillPath, process.platform === "win32" ? "junction" : "dir");
+              upsertEntry(manifest, { tool: id, path: absSkillPath, type: "symlink", source, createdAt: now, ...skillVersion ? { version: skillVersion } : {} });
+              results.push({ tool: id, path: absSkillPath, type: "symlink", status: "installed", message: "re-pointed stale symlink to current source" });
+            } catch (relinkErr) {
+              try {
+                copyDir(source, absSkillPath);
+                upsertEntry(manifest, { tool: id, path: absSkillPath, type: "copy", source, createdAt: now, ...skillVersion ? { version: skillVersion } : {} });
+                results.push({ tool: id, path: absSkillPath, type: "copy", status: "installed", message: `symlink re-point unavailable (${relinkErr?.code ?? relinkErr?.message}); copied instead` });
+              } catch (copyErr) {
+                results.push({ tool: id, path: absSkillPath, type: "symlink", status: "error", message: `symlink re-point failed (${relinkErr?.code ?? relinkErr?.message}) and the copy fallback also failed: ${copyErr?.message ?? String(copyErr)}` });
+              }
+            }
             continue;
           }
         }
       } catch {
       }
       results.push({ tool: id, path: absSkillPath, type, status: "already-installed" });
-      upsertEntry(manifest, { tool: id, path: absSkillPath, type: isSymlinkPresent(absSkillPath) ? "symlink" : "copy", source, createdAt: now, ...skillVersion ? { version: skillVersion } : {} });
+      {
+        const isSymlinkNow = isSymlinkPresent(absSkillPath);
+        const existingEntry = manifest.entries.find((e) => e.path === absSkillPath);
+        const versionField = isSymlinkNow ? skillVersion ? { version: skillVersion } : {} : existingEntry?.version ? { version: existingEntry.version } : {};
+        upsertEntry(manifest, { tool: id, path: absSkillPath, type: isSymlinkNow ? "symlink" : "copy", source, createdAt: now, ...versionField });
+      }
       continue;
     }
     if (fs16.existsSync(absSkillPath) || isSymlinkPresent(absSkillPath)) {
@@ -9933,11 +9991,31 @@ function reconcileSkillInstalls(opts = {}) {
       if (source !== null) {
         try {
           fs16.unlinkSync(e.path);
+        } catch {
+          keep.push(e);
+          continue;
+        }
+        try {
           fs16.symlinkSync(source, e.path, process.platform === "win32" ? "junction" : "dir");
           keep.push({ ...e, type: "symlink", source });
           result.repointed.push(e.path);
         } catch {
-          keep.push(e);
+          const dir = path17.dirname(e.path);
+          const base = path17.basename(e.path);
+          const suffix = crypto10.randomBytes(4).toString("hex");
+          const fresh = path17.join(dir, `.${base}.new-${suffix}`);
+          try {
+            copyDir(source, fresh);
+            fs16.renameSync(fresh, e.path);
+            keep.push({ ...e, type: "copy", source });
+            result.repointed.push(e.path);
+          } catch {
+            try {
+              fs16.rmSync(fresh, { recursive: true, force: true });
+            } catch {
+            }
+            result.pruned.push(e.path);
+          }
         }
       } else if (!targetLive) {
         try {
@@ -11384,6 +11462,7 @@ function isFullMockMode() {
 init_config();
 init_logger();
 init_error_tracker();
+init_log_utils();
 init_http_body();
 import * as http2 from "node:http";
 
@@ -11519,7 +11598,7 @@ var BrowserClient = class {
               resolve9(parsed);
             }
           } catch (_e) {
-            const raw = collected.toString();
+            const raw = redactSecrets(collected.toString());
             const preview = raw.length > 200 ? raw.slice(0, 200) + "..." : raw;
             const error = new Error(`Failed to parse response (status ${res.statusCode}): ${preview}`);
             errorTracker.trackError(error, {
@@ -15867,6 +15946,7 @@ init_logger();
 
 // src/infrastructure/browser/task-execution-service.ts
 init_logger();
+init_log_utils();
 init_error_tracker();
 
 // src/infrastructure/browser/browser-lifecycle.ts
@@ -15914,6 +15994,10 @@ var lastRestartTime = 0;
 var RESTART_COOLDOWN_MS = 1e4;
 var LEADER_HANDOVER_RETRIES = 3;
 var HANDOVER_BACKOFF_MS = 1200;
+function briefErrorMessage(error) {
+  const msg2 = error instanceof Error ? error.message : String(error);
+  return redactSecrets(msg2).substring(0, 100);
+}
 async function recoverFromLeaderHandover(container) {
   logger.warn("[BrowserManager] Leader handover detected (pool draining) \u2014 dropping stale scheduler handle and re-resolving...");
   await forceSchedulerRestart2(false, container).catch(
@@ -16003,7 +16087,7 @@ async function runBrowserTask(taskOrUrl, type = "scrape", config, signal, retrie
         taskType: type,
         errorType: "leader_handover"
       });
-      logger.warn(`[BrowserManager] Leader handover during ${type} task (handover attempts left: ${handoverRetries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+      logger.warn(`[BrowserManager] Leader handover during ${type} task (handover attempts left: ${handoverRetries}): ${briefErrorMessage(error)}...`);
       await recoverFromLeaderHandover(container);
       await new Promise((resolve9) => setTimeout(resolve9, HANDOVER_BACKOFF_MS + Math.floor(Math.random() * 400)));
       return runBrowserTask(taskOrUrl, type, config, signal, retries, container, handoverRetries - 1);
@@ -16015,7 +16099,7 @@ async function runBrowserTask(taskOrUrl, type = "scrape", config, signal, retrie
         taskType: type,
         errorType: "transient_socket_error"
       });
-      logger.warn(`[BrowserManager] Transient socket error during ${type} task (retries left: ${retries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+      logger.warn(`[BrowserManager] Transient socket error during ${type} task (retries left: ${retries}): ${briefErrorMessage(error)}...`);
       if (isPoolShutdownError(error)) {
         logger.warn(`[BrowserManager] Pool is draining \u2014 waiting for pool idle before retry...`);
         await waitForBrowserPoolIdle(15e3).catch((err) => logger.debug("Wait for browser idle timed out or failed:", err));
@@ -16042,7 +16126,7 @@ async function runBrowserHealthCheck(config, retries = 1, signal, container = ge
         operation: "healthcheck",
         errorType: "transient_socket_error"
       });
-      logger.warn(`[BrowserManager] Transient socket error during healthcheck (retries left: ${retries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+      logger.warn(`[BrowserManager] Transient socket error during healthcheck (retries left: ${retries}): ${briefErrorMessage(error)}...`);
       if (isPoolShutdownError(error)) {
         await recoverFromLeaderHandover(container);
       } else {
@@ -16074,7 +16158,7 @@ async function runWorkerSearch(query, config, signal, retries = 1, sessionId, co
         query,
         errorType: "leader_handover"
       });
-      logger.warn(`[BrowserManager] Leader handover during search (handover attempts left: ${handoverRetries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+      logger.warn(`[BrowserManager] Leader handover during search (handover attempts left: ${handoverRetries}): ${briefErrorMessage(error)}...`);
       await recoverFromLeaderHandover(container);
       await new Promise((resolve9) => setTimeout(resolve9, HANDOVER_BACKOFF_MS + Math.floor(Math.random() * 400)));
       return runWorkerSearch(query, config, signal, retries, sessionId, container, handoverRetries - 1);
@@ -16086,7 +16170,7 @@ async function runWorkerSearch(query, config, signal, retries = 1, sessionId, co
         query,
         errorType: "transient_socket_error"
       });
-      logger.warn(`[BrowserManager] Transient socket error during search (retries left: ${retries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+      logger.warn(`[BrowserManager] Transient socket error during search (retries left: ${retries}): ${briefErrorMessage(error)}...`);
       if (isPoolShutdownError(error)) {
         await waitForBrowserPoolIdle(15e3).catch((err) => logger.debug("Wait for browser idle timed out or failed:", err));
       } else {
@@ -16513,13 +16597,11 @@ function registerHealthChecks(registry, container = getServiceContainer()) {
   registry.register("StateManager", async () => {
     try {
       const stateManager = await getService(ServiceNames.STATE_MANAGER, { container }, container);
-      const stats = await stateManager.getMetrics();
       const gpuOwner = await stateManager.getGpuOwner();
       return {
         healthy: true,
         diagnostic: {
           status: "operational",
-          sessions: stats.activeSessions,
           gpuLocked: !!gpuOwner,
           gpuOwner: gpuOwner?.sessionId || "none"
         }
@@ -16805,6 +16887,7 @@ function isBenignScrapeFailure(error) {
   return msg2.startsWith("Fetch blocked:") || // bot-protection interstitial (Cloudflare, DDoS-Guard, …)
   msg2.startsWith("Fetch returned stub:") || // nav-only / near-empty page
   msg2.startsWith("Could not extract content from PDF") || // malformed/encrypted/scanned-only PDF
+  msg2.startsWith("PDF too large") || // exceeds the deliberate 100MB policy cap
   /^HTTP \d{3}\b/.test(msg2) || // remote 4xx/5xx status
   isCloudflareBlockError(error) || isTaskTimeoutError(error) || isPoolShutdownError(error);
 }
@@ -17097,8 +17180,22 @@ async function extractPdfToMarkdown(bytes) {
     throw new Error(`PDF too large (${sizeMB}MB, max 100MB)`);
   }
   const pdfExtractionStart = Date.now();
+  let WasmPdfDocument;
+  try {
+    ({ WasmPdfDocument } = await import("pdf-oxide-wasm"));
+  } catch (e) {
+    const msg2 = e instanceof Error ? e.message : String(e);
+    logger.error(`[Scrapers] pdf-oxide-wasm failed to load \u2014 PDF extraction is unavailable (not just for this URL): ${msg2}`);
+    metrics.increment("scrape_pdf_errors_total", 1, { error_type: "native_module_unavailable" });
+    errorTracker.trackError(e instanceof Error ? e : String(e), {
+      component: "scrapers",
+      operation: "pdf-extract",
+      contentType: "pdf",
+      errorType: "native_module_unavailable"
+    });
+    throw new Error(`PDF extraction unavailable (pdf-oxide-wasm failed to load: ${msg2})`, { cause: e });
+  }
   try {
-    const { WasmPdfDocument } = await import("pdf-oxide-wasm");
     const doc = new WasmPdfDocument(bytes);
     const pageCount = doc.pageCount();
     let markdown = `# PDF Document
@@ -17472,6 +17569,7 @@ async function scrape(urls, maxConcurrency = 5, signal, config, sessionId, onUrl
 // src/tools/scrape.ts
 init_constants();
 init_text_utils();
+init_log_utils();
 init_config();
 init_service_registry();
 init_service_interfaces();
@@ -17643,18 +17741,19 @@ ${evictedDuplicates.map((u) => `- ${u}`).join("\n")}
       let freshResults;
       const concurrency = p.maxConcurrency || defaultConcurrency;
       try {
-        const results = await scrape(urlsToFetch, concurrency, signal, options.config, getGlobalState().researchId, (result) => {
+        const results = await scrape(urlsToFetch, concurrency, signal, config, getGlobalState().researchId, (result) => {
           options.onUrlScrapeResult?.(result.url, result.success);
         }, container);
         freshResults = Array.isArray(results) ? results : [];
       } catch (error) {
-        logger.error(`[scrape tool] Scrape failed: ${error instanceof Error ? error.message : String(error)}`);
+        const message = error instanceof Error ? error.message : String(error);
+        logger.error(`[scrape tool] Scrape failed: ${message}`);
         metrics.increment("tool_scrape_calls_total", 1, { status: "error" });
         return {
           content: [{ type: "text", text: `# Scrape Failed
 
-${error instanceof Error ? error.message : String(error)}` }],
-          details: { error: String(error) }
+${redactSecrets(message)}` }],
+          details: { error: redactSecrets(String(error)) }
         };
       }
       const successfulFresh = freshResults.filter((r) => r.success);
@@ -18548,9 +18647,9 @@ async function searchGitHubAdvisories(terms, options) {
         throw new Error(`Invalid repo format: "${options.repo}". Expected "owner/name".`);
       }
       const [owner, name] = repoParts;
-      const repoNameRe = /^[A-Za-z0-9._-]+$/;
+      const repoNameRe = /^(?!\.+$)[A-Za-z0-9._-]+$/;
       if (!repoNameRe.test(owner) || !repoNameRe.test(name)) {
-        throw new Error(`Invalid repo format: "${options.repo}". Owner and name may only contain letters, digits, '.', '_' and '-'.`);
+        throw new Error(`Invalid repo format: "${options.repo}". Owner and name may only contain letters, digits, '.', '_' and '-', and cannot be all dots.`);
       }
       const url = `${GITHUB_API_BASE}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/security-advisories?per_page=${perPage}`;
       const response = await githubCircuitBreaker.execute(() => retryWithBackoff(async () => {
@@ -18901,7 +19000,7 @@ function mapOsvItemToVulnerability(item) {
       for (const cwe of item.database_specific.cwe) {
         if (typeof cwe === "string") {
           cwes.push(cwe);
-        } else if (typeof cwe === "object" && typeof cwe.id === "string") {
+        } else if (typeof cwe === "object" && cwe !== null && typeof cwe.id === "string") {
           cwes.push(cwe.id);
         }
       }
@@ -19282,6 +19381,10 @@ async function searchSecurityDatabases(params, signal) {
 // src/tools/security.ts
 init_constants();
 init_metrics();
+var MAX_DESCRIPTION_CHARS = 300;
+function truncateDescription(description) {
+  return description.length > MAX_DESCRIPTION_CHARS ? `${description.substring(0, MAX_DESCRIPTION_CHARS)}...` : description;
+}
 function createSecuritySearchTool(options) {
   const SecuritySearchParamsSchema = Type6.Object({
     databases: Type6.Optional(Type6.Array(Type6.String({
@@ -19484,7 +19587,7 @@ Unable to search security databases. This may be a temporary issue - try again l
               }
             }
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (vuln.knownExploited === true) {
               markdown += "- **[Actively Exploited]**\n";
@@ -19536,7 +19639,7 @@ Unable to search security databases. This may be a temporary issue - try again l
 `;
             }
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (vuln.dueDate !== void 0) {
               markdown += `- **Due Date:** ${vuln.dueDate}
@@ -19584,7 +19687,7 @@ Unable to search security databases. This may be a temporary issue - try again l
             markdown += `- **Summary:** ${adv.summary}
 `;
             const description = adv.description ?? "";
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (adv.published) {
               markdown += `- **Published:** ${adv.published}
@@ -19626,7 +19729,7 @@ Unable to search security databases. This may be a temporary issue - try again l
             markdown += `- **Severity:** ${vuln.severity}
 `;
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (vuln.affectedProducts && vuln.affectedProducts.length > 0) {
               markdown += `- **Affected:** ${vuln.affectedProducts.join(", ")}
@@ -19674,6 +19777,7 @@ init_logger();
 init_circuit_breaker();
 init_metrics();
 init_http_body();
+init_retry_utils();
 var API_BASE = "https://api.stackexchange.com/2.3";
 var QUOTA_PROBE_COOLDOWN_MS = 10 * 60 * 1e3;
 var StackExchangeClient = class {
@@ -19721,21 +19825,11 @@ var StackExchangeClient = class {
       if (!url.searchParams.has("site") && !options.endpoint.startsWith("/sites")) {
         url.searchParams.set("site", "stackoverflow.com");
       }
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => {
-        controller.abort();
-      }, this._timeout);
-      const abortHandler = () => {
-        clearTimeout(timeoutId);
-        controller.abort();
-      };
-      if (signal) {
-        signal.addEventListener("abort", abortHandler, { once: true });
-      }
+      const requestSignal = createTimeoutSignal(this._timeout, signal);
       try {
         const response = await fetch(url.toString(), {
           method: options.method,
-          signal: controller.signal,
+          signal: requestSignal,
           headers: {
             "Accept": "application/json"
           }
@@ -19790,11 +19884,6 @@ var StackExchangeClient = class {
           throw new Error(`Request timeout after ${this._timeout}ms`, { cause: error });
         }
         throw error;
-      } finally {
-        clearTimeout(timeoutId);
-        if (signal) {
-          signal.removeEventListener("abort", abortHandler);
-        }
       }
     });
   }
@@ -20035,6 +20124,33 @@ function formatCompactQuestions(questions) {
 }
 
 // src/stackexchange/output/compact.ts
+function formatQuestionsCompact(questions) {
+  if (questions.length === 0) {
+    return "No questions found.";
+  }
+  const lines = [];
+  let index = 1;
+  for (const q of questions) {
+    const accepted = q.accepted_answer_id ? "[accepted]" : "         ";
+    lines.push(`${index}. ${accepted} [${q.title}](${q.link}) (${q.score} pts, ${q.answer_count} ans, ${q.view_count} views)`);
+    index++;
+  }
+  return lines.join("\n");
+}
+function formatAnswersCompact(answers) {
+  if (answers.length === 0) {
+    return "No answers found.";
+  }
+  const lines = [];
+  let index = 1;
+  for (const a of answers) {
+    const accepted = a.is_accepted ? "[accepted]" : "         ";
+    const displayName = a.owner?.display_name ?? "Unknown";
+    lines.push(`${index}. ${accepted} by ${displayName} (${a.score} pts)`);
+    index++;
+  }
+  return lines.join("\n");
+}
 function formatUsersCompact(users) {
   if (users.length === 0) {
     return "No users found.";
@@ -20318,6 +20434,16 @@ function formatCompact(result) {
         return formatCompactQuestions(result);
       }
     }
+  } else if (typeof result === "object" && result !== null) {
+    if ("question" in result && "answers" in result) {
+      const r = result;
+      let output = formatQuestionsCompact([r.question]);
+      if (r.answers.length > 0) {
+        output += `
+${formatAnswersCompact(r.answers)}`;
+      }
+      return output;
+    }
   }
   return JSON.stringify(result);
 }
@@ -20532,11 +20658,13 @@ function watchUrl(videoId) {
 init_retry_utils();
 init_circuit_breaker();
 init_logger();
+init_log_utils();
 init_metrics();
 init_http_body();
 
 // src/youtube/potoken.ts
 init_logger();
+init_safe_unref();
 init_metrics();
 var DEFAULT_REQUEST_KEY = "O43z0dpjhgX20SCx4KAo";
 var BRIDGED_GLOBALS = ["window", "document", "location", "navigator", "origin"];
@@ -20549,9 +20677,19 @@ function describeError(error) {
   return String(error);
 }
 var mintChain = Promise.resolve();
+var MINT_HARD_RELEASE_MS = 5 * 60 * 1e3;
 async function mintPoTokens(identifiers, opts = {}) {
   const run = mintChain.then(() => doMint(identifiers, opts), () => doMint(identifiers, opts));
-  mintChain = run.then(() => void 0, () => void 0);
+  const settled = run.then(() => void 0, () => void 0);
+  let hardTimer;
+  const hardRelease = new Promise((resolve9) => {
+    hardTimer = setTimeout(() => {
+      logger.warn("[youtube] potoken mint mutex force-released \u2014 doMint() did not settle within the hard timeout");
+      resolve9();
+    }, MINT_HARD_RELEASE_MS);
+    safeUnref(hardTimer);
+  });
+  mintChain = Promise.race([settled, hardRelease]).finally(() => clearTimeout(hardTimer));
   return run;
 }
 async function doMint(identifiers, opts) {
@@ -20833,7 +20971,7 @@ function parseJson3(body) {
   try {
     parsed = JSON.parse(body);
   } catch {
-    logger.debug(`[youtube] timedtext body was not valid json3 (first 120 chars): ${body.slice(0, 120)}`);
+    logger.debug(`[youtube] timedtext body was not valid json3 (first 120 chars): ${redactSecrets(body).slice(0, 120)}`);
     return "";
   }
   const events = parsed.events;
@@ -22362,32 +22500,36 @@ ${result}`);
           if (this.config.KNOWLEDGE_STORE_MODE !== "none") {
             const ksService = await getService(ServiceNames.KNOWLEDGE_STORE, ctx, container);
             if (ksService.isReady()) {
-              const writer = await getService(ServiceNames.WRITER_QUEUE, ctx, container);
-              const citations = parseCitations(result);
-              if (citations.length === 0) {
-                logger.warn("[QuickOrchestrator] Researcher produced no parseable CITED LINKS \u2014 no descriptions stored for this session");
-              }
-              let enqueued = 0;
-              for (const cit of citations) {
-                if (cit.url) {
-                  const fullContent = getCachedScrapedContent(this.options.researchId, cit.url);
-                  const markdown = cit.description || `(source: ${cit.url})`;
-                  writer.enqueue({
-                    url: normalizeUrl(cit.url),
-                    markdown,
-                    content: fullContent,
-                    metadata: {
-                      ingestionType: "synthesis-description",
-                      source: "researcher",
-                      synthesizedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                      description: cit.description || "",
-                      fullContentSnippet: fullContent?.substring(0, 5e3)
-                    }
-                  });
-                  enqueued++;
+              const writer = await ksService.getWriterQueue();
+              if (!writer) {
+                logger.debug("[QuickOrchestrator] Writer queue unavailable, skipping link descriptions");
+              } else {
+                const citations = parseCitations(result);
+                if (citations.length === 0) {
+                  logger.warn("[QuickOrchestrator] Researcher produced no parseable CITED LINKS \u2014 no descriptions stored for this session");
                 }
+                let enqueued = 0;
+                for (const cit of citations) {
+                  if (cit.url) {
+                    const fullContent = getCachedScrapedContent(this.options.researchId, cit.url);
+                    const markdown = cit.description || `(source: ${cit.url})`;
+                    writer.enqueue({
+                      url: normalizeUrl(cit.url),
+                      markdown,
+                      content: fullContent,
+                      metadata: {
+                        ingestionType: "synthesis-description",
+                        source: "researcher",
+                        synthesizedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                        description: cit.description || "",
+                        fullContentSnippet: fullContent?.substring(0, 5e3)
+                      }
+                    });
+                    enqueued++;
+                  }
+                }
+                if (enqueued > 0) await writer.drain();
               }
-              if (enqueued > 0) await writer.drain();
             }
           }
         } catch (err) {
@@ -23180,7 +23322,11 @@ var ResearchOrchestrationService = class {
         return;
       }
       const synthesisService = await getService(ServiceNames.RESEARCH_SYNTHESIS_SERVICE, ctx, container);
-      const writer = await getService(ServiceNames.WRITER_QUEUE, ctx, container);
+      const writer = await ksService.getWriterQueue();
+      if (!writer) {
+        logger.debug("[ResearchOrchestrationService] Writer queue unavailable, skipping link descriptions");
+        return;
+      }
       const roundPrefix = `${round}.`;
       let enqueued = 0;
       let researcherCount = 0;
@@ -23833,6 +23979,7 @@ async function initializeOrchestrationServices(ctx, container = getServiceContai
 init_service_registry();
 init_service_interfaces();
 init_logger();
+init_log_utils();
 init_config();
 init_metrics();
 
@@ -24175,7 +24322,7 @@ function getLastResearcherOutcome() {
 }
 function logRunErrorSummary(report, depthLabel, status) {
   if (!report || report.totalErrors === 0) return;
-  const top = report.patterns.slice(0, 3).map((p) => `"${String(p.message ?? p.signature ?? "error").slice(0, 48)}" \xD7${p.count}`).join(", ");
+  const top = report.patterns.slice(0, 3).map((p) => `"${redactSecrets(String(p.message ?? p.signature ?? "error")).slice(0, 48)}" \xD7${p.count}`).join(", ");
   logger.warn(`[SDK] run ${status} with ${report.totalErrors} tracked error(s) across ${report.uniquePatterns} pattern(s) [${depthLabel}]${top ? ` \u2014 top: ${top}` : ""}`);
 }
 function wrapObserverForOutcomeCapture(observer, onPlanned) {