@lincoln504/pi-research 1.3.3 → 1.3.5

package/dist/thread-worker.mjs

@@ -45,12 +45,8 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let keep = MAX_LOG_MESSAGE_LENGTH;
-  if (message.length > keep) {
-    const lastKeptUnit = message.charCodeAt(keep - 1);
-    if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
-  }
-  let out = message.length > MAX_LOG_MESSAGE_LENGTH ? `${message.slice(0, keep)}\u2026[truncated ${message.length - keep} chars]` : message;
+  const rawLength = message.length;
+  let out = rawLength > REDACT_SCAN_LENGTH ? message.slice(0, REDACT_SCAN_LENGTH) : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -61,12 +57,20 @@ function redactSecrets(message) {
   out = out.replace(KNOWN_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(PROVIDER_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(LONG_HEX_SECRET_PATTERN, "[REDACTED]");
+  let keep = MAX_LOG_MESSAGE_LENGTH;
+  if (out.length > keep) {
+    const lastKeptUnit = out.charCodeAt(keep - 1);
+    if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
+  }
+  if (out.length > MAX_LOG_MESSAGE_LENGTH) {
+    out = `${out.slice(0, keep)}\u2026[truncated ${rawLength - keep} chars]`;
+  }
   return out;
 }
 function stripTerminalEscapes(message) {
   return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, REDACT_SCAN_LENGTH, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -75,7 +79,7 @@ var init_log_utils = __esm({
     ANSI_PATTERN = /\x1b\[[0-9;]*[A-Za-z]/g;
     URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s:@]+@/gi;
     COOKIE_HEADER_PATTERN = /\b(set[_-]?cookie|cookie)\b(["']?\s*[:=]\s*["']?)([^\r\n]+)/gi;
-    SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
+    SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key|key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
     KNOWN_TOKEN_PATTERN = /\b(sk-[A-Za-z0-9_-]{16,}|gh[posru]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
     JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
     BASIC_AUTH_PATTERN = /\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}/gi;
@@ -83,6 +87,7 @@ var init_log_utils = __esm({
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
     CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
     TERMINAL_ESCAPE_PATTERN = new RegExp(
       "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
       "g"
@@ -354,10 +359,17 @@ var init_error_tracker = __esm({
 // src/utils/log-rotation.ts
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
-var LogRotation;
+function touchOwnerOnly(filePath, mode) {
+  try {
+    fs2.closeSync(fs2.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode));
+  } catch {
+  }
+}
+var APPEND_CREATE_NOFOLLOW_FLAGS, LogRotation;
 var init_log_rotation = __esm({
   "src/utils/log-rotation.ts"() {
     "use strict";
+    APPEND_CREATE_NOFOLLOW_FLAGS = fs2.constants.O_WRONLY | fs2.constants.O_APPEND | fs2.constants.O_CREAT | (typeof fs2.constants.O_NOFOLLOW === "number" ? fs2.constants.O_NOFOLLOW : 0);
     LogRotation = class {
       MAX_LOG_SIZE = 10 * 1024 * 1024;
       // 10MB max file size
@@ -375,10 +387,7 @@ var init_log_rotation = __esm({
         try {
           if (fs2.existsSync(logFile)) {
             fs2.unlinkSync(logFile);
-            try {
-              fs2.closeSync(fs2.openSync(logFile, "a", 384));
-            } catch {
-            }
+            touchOwnerOnly(logFile, 384);
             try {
               fs2.chmodSync(logFile, 384);
             } catch {
@@ -418,10 +427,7 @@ var init_log_rotation = __esm({
             this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
             return;
           }
-          try {
-            fs2.closeSync(fs2.openSync(logFile, "a", 384));
-          } catch {
-          }
+          touchOwnerOnly(logFile, 384);
           try {
             fs2.chmodSync(logFile, 384);
           } catch {
@@ -588,7 +594,10 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     unkeyedCaptureDepth++;
     isAnyLoggerCapturingOutput = true;
   }
-  const decoder = new TextDecoder();
+  const stderrDecoder = new TextDecoder();
+  const stdoutDecoder = new TextDecoder();
+  const fd1SyncDecoder = new TextDecoder();
+  const fd2SyncDecoder = new TextDecoder();
   const originalStderrWrite = process.stderr.write;
   const originalStdoutWrite = process.stdout.write;
   const originalFsWriteSync = fs4.writeSync;
@@ -634,7 +643,11 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
   console.debug = createConsolePatch("debug", logFile, hasSufficientDiskSpace);
   process.stderr.write = (chunk, encodingOrCb, callback) => {
     const cb = typeof encodingOrCb === "function" ? encodingOrCb : callback;
-    const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+    const message = typeof chunk === "string" ? chunk : stderrDecoder.decode(chunk, { stream: true });
+    if (message.length === 0) {
+      if (typeof cb === "function") cb();
+      return true;
+    }
     if (!hasSufficientDiskSpace()) {
       if (typeof cb === "function") cb();
       return true;
@@ -655,7 +668,7 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     return true;
   };
   process.stdout.write = (chunk, encodingOrCb, callback) => {
-    const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+    const message = typeof chunk === "string" ? chunk : stdoutDecoder.decode(chunk, { stream: true });
     const isNative = isNativeLog(message);
     const complexTui = isComplexTui(message);
     const boxDrawing = isBoxDrawing(message);
@@ -709,7 +722,11 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     if (!descriptor || (descriptor.writable || descriptor.set)) {
       fs4.writeSync = (fd, chunk, ...args) => {
         if (fd === 1 || fd === 2) {
-          const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+          const fdDecoder = fd === 1 ? fd1SyncDecoder : fd2SyncDecoder;
+          const message = typeof chunk === "string" ? chunk : fdDecoder.decode(chunk, { stream: true });
+          if (fd === 2 && message.length === 0) {
+            return typeof chunk === "string" ? Buffer.from(chunk).length : chunk.length;
+          }
           const isNative = isNativeLog(message);
           const boxDrawing = isBoxDrawing(message);
           const complexTui = isComplexTui(message);
@@ -1489,6 +1506,7 @@ function isBenignScrapeFailure(error) {
   return msg.startsWith("Fetch blocked:") || // bot-protection interstitial (Cloudflare, DDoS-Guard, …)
   msg.startsWith("Fetch returned stub:") || // nav-only / near-empty page
   msg.startsWith("Could not extract content from PDF") || // malformed/encrypted/scanned-only PDF
+  msg.startsWith("PDF too large") || // exceeds the deliberate 100MB policy cap
   /^HTTP \d{3}\b/.test(msg) || // remote 4xx/5xx status
   isCloudflareBlockError(error) || isTaskTimeoutError(error) || isPoolShutdownError(error);
 }
@@ -1906,6 +1924,7 @@ init_scraper_types();
 import { appendFileSync as appendFileSync2 } from "node:fs";
 var workerId2 = "";
 var pageCreationLock = Promise.resolve();
+var PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1e3;
 async function createPageSafe(context2) {
   let release;
   const nextLock = new Promise((resolve) => {
@@ -1914,37 +1933,54 @@ async function createPageSafe(context2) {
   const currentLock = pageCreationLock;
   pageCreationLock = currentLock.then(() => nextLock);
   await currentLock;
-  try {
-    const pagePromise = context2.newPage();
-    pagePromise.catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Background page creation rejection: ${err.message}`));
-    let timeoutId;
-    try {
-      const result = await Promise.race([
-        pagePromise,
-        new Promise((_, reject) => {
-          timeoutId = setTimeout(() => reject(new Error("Browser page creation timed out after 60000ms")), 6e4);
-        })
-      ]);
-      if (timeoutId) clearTimeout(timeoutId);
-      return result;
-    } catch (err) {
-      if (timeoutId) clearTimeout(timeoutId);
-      pagePromise.then((p) => {
-        try {
-          p?.close?.();
-        } catch {
-        }
-      }).catch(() => {
-      });
-      throw err;
-    }
-  } finally {
+  const pagePromise = context2.newPage();
+  let hardReleased = false;
+  const releaseOnce = () => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
     release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile2("WARN", "[ThreadWorker] page-creation mutex force-released \u2014 newPage() did not settle within the hard timeout");
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  pagePromise.then(releaseOnce, releaseOnce);
+  pagePromise.catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Background page creation rejection: ${err.message}`));
+  let timeoutId;
+  try {
+    const result = await Promise.race([
+      pagePromise,
+      new Promise((_, reject) => {
+        timeoutId = setTimeout(() => reject(new Error("Browser page creation timed out after 60000ms")), 6e4);
+      })
+    ]);
+    if (timeoutId) clearTimeout(timeoutId);
+    return result;
+  } catch (err) {
+    if (timeoutId) clearTimeout(timeoutId);
+    pagePromise.then((p) => {
+      try {
+        p?.close?.();
+      } catch {
+      }
+    }).catch(() => {
+    });
+    throw err;
   }
 }
 function setWorkerId2(id) {
   workerId2 = id;
 }
+function parseTimeoutMs(envVar, def) {
+  if (envVar === void 0 || envVar.trim() === "") return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile2("WARN", `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
 function logToDebugFile2(level, ...args) {
   const logFile = process.env["PI_RESEARCH_LOG_FILE"];
   if (!logFile) return;
@@ -2054,7 +2090,7 @@ async function extractSearchResults(page) {
 }
 async function executeSearchTask(_context, query) {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"] || "45000", 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"], 45e3);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
   try {
@@ -2123,7 +2159,7 @@ function seedSubresourceVerdict(validatedUrl) {
 }
 async function executeScrapeTask(_context, url, signal) {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"] || "15000", 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"], 15e3);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
   const onAbort = () => {
@@ -2289,7 +2325,7 @@ async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PR
   }
 }
 async function executeHealthCheck(_context, initMs) {
-  const configuredMs = parseInt(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"] || "0", 10);
+  const configuredMs = parseTimeoutMs(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(1e4, configuredMs) : 1e4;
   if (initMs > 3e3) {
     logToDebugFile2("WARN", `[Worker-${workerId2}] Browser init was slow: ${initMs}ms \u2014 leaving less headroom for DDG navigation.`);
@@ -2339,6 +2375,7 @@ init_logger();
 
 // src/utils/url-utils.ts
 init_logger();
+init_log_utils();
 
 // src/config.ts
 var ConfigSchema = Type.Object({
@@ -2508,6 +2545,7 @@ var initPromise = null;
 var workerId3 = "";
 var activeTaskCount = 0;
 var resetPending = false;
+var resetPendingForBrowser = null;
 function setWorkerId3(id) {
   workerId3 = id;
 }
@@ -2518,7 +2556,11 @@ function taskFinished() {
   activeTaskCount = Math.max(0, activeTaskCount - 1);
   if (activeTaskCount === 0 && resetPending) {
     resetPending = false;
-    doResetBrowser();
+    const capturedBrowser = resetPendingForBrowser;
+    resetPendingForBrowser = null;
+    if (browser === capturedBrowser) {
+      doResetBrowser();
+    }
   }
 }
 var isBrowserConnected = () => {
@@ -2576,6 +2618,35 @@ async function initBrowser() {
               height: 1080,
               colorDepth: 24,
               pixelRatio: 1
+            },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              "media.volume_scale": "0.0",
+              "media.autoplay.default": 5
             }
           });
           launchPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser launch rejection: ${err.message}`));
@@ -2655,6 +2726,7 @@ function doResetBrowser() {
 function resetBrowser() {
   if (activeTaskCount > 1) {
     resetPending = true;
+    resetPendingForBrowser = browser;
     return;
   }
   doResetBrowser();

package/docs/CHANGELOG.md

@@ -5,6 +5,82 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.5] - 2026-08-10
+
+Two rounds of workflow-backed code review on the clean 1.3.4 tree (high-effort,
+then a wider max-effort pass explicitly told not to re-find the first round's
+results), followed by a triage of every open CodeQL alert. Every fix below is
+covered by a passing regression test; two bugs (the OSV null-CWE crash and the
+duration-formatter rounding bug) had no prior test coverage at all, so tests
+were added alongside the fixes.
+
+### Fixed
+
+- **The browser page-creation mutex could still hang forever.** 1.3.4 fixed the mutex releasing too early (before `newPage()` itself settled). That fix had no bound of its own: if `newPage()` never settles at all — not just slow, but genuinely wedged — the lock is now held forever, livelocking every future `createPageSafe()` call on that worker thread. Added a 5-minute hard-release timer that force-releases the lock if `newPage()` still hasn't settled, independent of the settlement-based release for the normal case.
+- **`reconcileSkillInstalls()`'s stale-symlink re-point had no copy fallback.** The sibling `installSkill()` already falls back to a copy when `symlinkSync` fails after the old link is removed (a Windows cross-volume junction failure, most commonly). The periodic reconciler's structurally identical re-point lacked that fallback, so a `symlinkSync` failure there silently left the manifest claiming a skill was installed after the file was already deleted from disk. Added the same fallback — and staged the copy into a dot-prefixed temp dir with an atomic rename into place, so a copy that fails partway (disk full, interrupted process) can never leave an unrecognized, SKILL.md-less partial directory orphaned at the skill's path.
+- **The scrape tool's own gating used a different config than its actual fetch.** `createScrapeTool()` resolves `config = options.config || getConfig(options.ctx.cwd)` and uses that resolved value for every batching/gating decision (knowledge-store mode, concurrency caps, token-fraction limits, pool capacity) — except the real `scrape()` call, which passed the raw, possibly-`undefined` `options.config`. A caller that omits `config` (the parameter is typed optional) got gating computed for one cwd while the actual network fetch silently fell back to whatever `getConfig()` resolves for `process.cwd()` — a different worker/pool concurrency or provider config than what the visible gating decision assumed, with nothing logged to indicate the mismatch.
+- **`redactSecrets()`'s truncate-before-redact fix (1.3.4) removed its own cost bound.** Moving truncation after the full regex chain (correctly, to stop a secret leaking at the truncation boundary) also removed the implicit cap that used to limit those ~10 sequential regex passes to `MAX_LOG_MESSAGE_LENGTH` characters regardless of input size. A verbose/debug log call carrying a multi-megabyte scraped payload now ran the whole chain across the untruncated string. Pre-slices to 4× `MAX_LOG_MESSAGE_LENGTH` before redacting — generous enough that no in-bounds secret is ever missed (patterns only shrink text, never expand it, and content beyond that window can never survive into the final truncated output anyway) — and reports the truncation count against the true raw length instead of the post-redaction length.
+- **Six more truncate-before-redact / unredacted-error-text sites, the same bug class 1.3.4 fixed at five others.** `scrape.ts`'s and `research-tool-definition.ts`'s error-catch paths returned raw `error.message`/`String(error)` directly as tool output; `browser-client.ts`'s JSON-parse-failure handler embedded a raw 200-char response preview in the thrown `Error`; `transcript-client.ts`'s debug log sliced YouTube's raw `timedtext` response to 120 chars before redaction instead of after. Each of these can carry a credential (a failing URL's userinfo, an echoed `Authorization` header, an embedded token in a malformed page) into a log file, a thrown error, or the agent's own conversation/report output. All six now redact before truncating or returning.
+- **A `null` entry in an OSV/GHSA advisory's `database_specific.cwe` crashed the entire lookup.** `typeof cwe === 'object'` is `true` for `null`, so `mapOsvItemToVulnerability` threw on `(null).id` — and since it runs uncaught inside `osv-client.ts`'s per-term fetch (only wrapped in `Promise.allSettled`), one malformed record silently discarded every vulnerability found for that search term, replaced by a generic failure note. Added the missing `cwe !== null` check.
+- **The YouTube PoToken mint mutex had the same unbounded-hang exposure as the browser mutex above.** `doMint()` awaits BotGuard VM execution and interpreter eval against a hostile/malformed attestation script from Google, neither of which take an abort signal — if either hangs instead of rejecting, the module-level `mintChain` mutex never settles, and every subsequent `mintPoTokens()` call across all researchers queues behind it forever. Added the same style of hard-release bound as the browser mutex fix, via a `Promise.race` against a 5-minute (unref'd) timeout.
+- **Three timeout env vars silently became near-zero on a malformed value.** `PI_RESEARCH_SEARCH_TIMEOUT_MS`, `PI_RESEARCH_SCRAPE_TIMEOUT_MS`, and `PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS` were read with `parseInt()`, which truncates at the first non-digit instead of rejecting the value — `parseInt('1m', 10)` is `1`, not `NaN`, so a plausible duration-shorthand typo silently became a 1ms browser timeout instead of falling back to the default, failing every search/scrape/health-check on that worker for the rest of its life with no warning. Replaced with a shared helper using `Number()` (which rejects trailing garbage) plus a warning log on an invalid value.
+- **`formatDuration()` could render the nonsensical "1m 60s".** Rounding `remainingSeconds` independently of `minutes` let a value like 119,601ms (1m 59.601s) round its seconds component up to 60 without rolling into the next minute. Now rounds the total seconds first and derives minutes/seconds from that integer.
+- **A theoretical symlink race on log rotation's file reopen.** After renaming the live log aside during rotation (or unlinking it during `clearLogs`), the code reopens the same path with `fs.openSync(path, 'a', 0o600)` to recreate it owner-only — a window in which a local attacker with write access to the log directory could plant a symlink at that path, causing the reopen to follow it and (re)create/chmod an arbitrary file with this process's permissions. Added `O_NOFOLLOW` to the reopen (a no-op on Windows, where the flag isn't defined) so it refuses to follow a symlink instead.
+- **Scraping a YouTube watch page could play audible audio through the host's speakers.** The general `scrape` tool drives a real stealth Firefox (Camoufox) — unlike the dedicated `youtube_transcript` tool, which only calls YouTube's API (`youtubei.js`/`timedtext`) and never touches a browser. A researcher agent scraping a `youtube.com` watch-page URL through the ordinary `scrape` tool hit YouTube's default video autoplay with no engine-level mute configured, so the browser process played sound through whatever audio sink it could reach. Reported on Linux, where both true-headless and the Xvfb-backed `'virtual'` mode keep a live PulseAudio/PipeWire/ALSA sink reachable — but headless Firefox is not guaranteed silent on macOS/Windows either, so the fix (`media.volume_scale: '0.0'` plus `media.autoplay.default: 5` in the shared Camoufox launch options) is unconditional across platforms and headless modes, not Linux-specific.
+
+### Reviewed, not changed
+
+A full CodeQL alert triage found 12 of 13 open alerts to be false positives or out-of-scope for a code fix, each verified individually rather than dismissed on assumption:
+- Two `js/missing-await` alerts in `embedder.ts` are reference-identity checks (`this.recoveryPromise === recovery`) misread as a forgotten `await` — awaiting either side would break the logic.
+- A `js/file-system-race` alert in `file-lock-service.ts` is on code that already reopens with the `'wx'` exclusive-create flag specifically to make the check-then-open atomic.
+- A `js/insecure-temporary-file` alert in `browser/cleanup-utils.ts` is a read-only liveness probe on a Firefox lock file, not a file creation.
+- Six alerts (`js/file-system-race`, `js/insecure-temporary-file`) are all in test files creating throwaway, randomly-named fixtures under `os.tmpdir()` for the test's own private use.
+- One (`js/unused-local-variable`) was a genuine unused test import; removed.
+
+Patch, not minor: every fix is an internal correctness/security/robustness
+change with no change to pi-research's own CLI, tool, or SDK contract —
+matching this project's established precedent for audit-round releases
+(1.3.1 through 1.3.4).
+
+## [1.3.4] - 2026-08-09
+
+Two rounds on the clean 1.3.3 tree: a full-tree re-audit (10 independent
+reviews, each a disjoint `src/` slice) followed by a targeted security/
+cross-platform/dead-code sweep (parallel reviews of secret-redaction
+call sites, path/URL handling, Windows/macOS compatibility, and unused
+exports). Every fix below is paired with a regression test confirmed (via
+a local revert-and-rerun) to fail against the pre-fix code.
+
+### Fixed
+
+- **`createPageSafe()`'s page-creation mutex released before `newPage()` itself had settled.** The lock released in an outer `finally` as soon as its internal 60s race settled — including when the timeout won, while the real `context.newPage()` call was still pending in the background. That let the next queued caller start its own `newPage()` concurrently with the still-unsettled prior one — exactly the concurrent-`newPage()` Firefox/Juggler deadlock scenario the lock exists to prevent, and it happens precisely when the browser is already stalling under stress. Release is now tied to the underlying `newPage()` promise itself settling, independent of which branch of the timeout race resolves.
+- **A deferred `resetBrowser()` could tear down a later, unrelated, healthy browser.** The deferred-reset flag was a bare boolean with no identity tied to which browser instance it was requested against. A sibling task's own crash could take the *immediate* reset path (activeTaskCount ≤ 1) and relaunch a fresh browser without ever clearing the stale deferred flag; once the task counter later hit zero, the stale flag fired against whatever browser was current — tearing down a healthy instance a subsequent task had just started using. The flag now captures the specific browser instance at defer time and only applies if that instance is still current.
+- **`ServiceContainer.disposeAll()` could double-invoke a service's `dispose()`.** Teardown snapshotted "instances to dispose" without waiting for a `clear()`/`replace()` disposal already in flight for the same service — if that disposal had called `instance.dispose()` but not yet nulled/replaced `registration.instance`, the snapshot included it, and the DAG-teardown loop called `dispose()` a second time on the same instance, concurrently with the original call. `get()` already guarded this window for reads; `disposeAll()` now waits it out the same way before reading instances.
+- **The `WRITER_QUEUE` DI registration cached its first writer-queue object forever.** Once resolved, the registry never re-resolved it — but the writer queue is rebuilt whenever the knowledge store re-initializes (a Knowledge Mode or cwd change via `/research-config`), so every write after such a change silently landed on a disposed, closed writer queue. `storeLinkDescriptions` now resolves the writer queue directly from the already-fresh `KnowledgeStoreService` instead of through the stale cache.
+- **`KnowledgeStoreService.dispose()` lacked the identity guard `initialize()` already has.** Two concurrent `dispose()` calls arriving while an `initialize()` was in flight could both pass the early checks and both build their own teardown closure from the same instance snapshot — double-invoking `dispose()` on the embedder/store/writer-queue, the same class of race fixed in the service registry above.
+- **Chunker UTF-16 surrogate corruption at tight overlap ratios.** At a `targetSize`/`overlap` combination that left less than one code unit of slack (e.g. `targetSize:2, overlap:1`), the surrogate-pair read-side guard's two escape branches (pull back / push forward) could both be simultaneously blocked, leaving a chunk boundary mid-surrogate-pair and opening the next chunk with a lone low surrogate — silently corrupted on UTF-8 encode. The push-forward bound was off by one; landing exactly on `end` (zero overlap for that transition) is a safe position that was wrongly excluded.
+- **`redactSecrets()` truncated before redacting.** A secret straddling the 10,000-char truncation boundary had its patterns matched against the already-cut string — a credential split mid-token was too short for any pattern to recognize, leaking a fragment in the clear right before the "…[truncated N chars]" marker. Redaction now always runs on the full message before truncation.
+- **The same truncate-before-redact bug had already spread to five other call sites** that built their own short log-line summaries by truncating `error.message` before ever passing it through `redactSecrets` — `task-execution-service.ts` (5 retry-path WARN logs), `sdk.ts`'s end-of-run error summary, and `url-utils.ts`'s unparseable-URL debug log. A failing scrape/navigation routinely echoes the failing URL verbatim, which can carry userinfo credentials; each site now redacts the full message before truncating for display.
+- **`redactSecrets()`'s key/value pattern had no bare `key` alternative.** Several provider APIs (e.g. StackExchange's `?key=<apikey>` query parameter) name their credential with no qualifying prefix like `api_` or `private_`, so it fell through every existing pattern uncaught. Added `key` to the sensitive-key-name alternation, after the more specific `*_key` variants so those still match first.
+- **`stdio-capture.ts`'s `TextDecoder` instances were missing `{stream: true}`.** A single native write/writeSync call can split a multi-byte UTF-8 character's bytes across two separate calls; without streaming mode each half decoded independently to U+FFFD instead of reconstructing the original character. Also split the previously-shared decoder into one per logical byte stream (stdout, stderr, FD1, FD2) — a shared decoder's carried-over partial bytes are only valid within one continuous stream, and mixing streams could try to complete one stream's dangling sequence with another's bytes.
+- **Path traversal in `github-advisories.ts`'s repo-scoped search.** An owner or repo name of exactly `.` or `..` passed the character-allowlist regex (dots are permitted, for names like `node.js`) and, once interpolated into the API path, was collapsed by the URL parser before the request was sent — `owner=".."` turned `/repos/../rate_limit/...` into a request for `/rate_limit/...`, escaping the intended `/repos/{owner}/{name}/` scope with this tool's own GitHub credentials. The allowlist now additionally rejects a segment that is entirely dots.
+- **PDF-extraction failures conflated a broken native install with a routine malformed PDF.** `pdf-oxide-wasm` failing to load (missing prebuilt binary, corrupted install) meant PDF extraction was broken for every URL, not just one — but it shared a catch block with genuine per-PDF parse failures, so both logged at `debug` and were classified as the same benign, routine outcome. The two are now caught separately: a native-module load failure surfaces at `error` with its own metric label and is never classified as benign. Also added the missing `PDF too large` case to the benign-failure classifier (it exceeds a deliberate size cap, exactly as routine as a malformed PDF, but had never been added).
+- **Skill-installer copy-version laundering.** An ordinary re-run of `installSkill()` against an already-installed owned *copy* stamped the manifest's recorded version to the current package version without ever refreshing the actual on-disk copy — permanently defeating `reconcileSkillInstalls()`'s later staleness check, which compares the recorded version against current. The unrefreshed branch now preserves whatever version was already recorded instead of claiming it's current.
+- **`installSkill()`'s stale-symlink re-point could silently report success after deleting the skill.** The re-point unlinks the old symlink, then creates the new one; if the second step failed (e.g. a Windows junction cannot cross volumes, and `pi update` can relocate the package to a different drive) the error escaped to an outer catch that fell through to reporting "already-installed" — even though the skill directory no longer existed on disk at all. It now falls back to a copy, mirroring the fresh-install path's existing fallback for the identical failure.
+- **StackExchange REST client ignored an already-aborted signal.** The client chained an external `AbortSignal` via a bare `addEventListener('abort', ...)`, which never fires for a signal that was already aborted before the call started — an already-cancelled request still went out to the network. Replaced the hand-rolled `AbortController` + listener wiring with `createTimeoutSignal` (already used by the `security/*.ts` clients), whose `AbortSignal.any` combination correctly produces an already-aborted signal up front.
+- **StackExchange `format=compact` with `command=get` fell through to a raw JSON dump.** The compact formatter only branched on an array result (search/user/site); `get`'s single-question-with-answers object shape had no matching branch, unlike the table formatter's equivalent case. Wired up the existing (previously unused) `formatQuestionsCompact`/`formatAnswersCompact` compact formatters for this shape.
+- **A misleading, permanently-zero "sessions" healthcheck stat.** The `StateManager` health diagnostic reported `stats.activeSessions` from `state.sessions` — a field nothing in production code ever writes to (the session-tracking write API has no live caller anywhere in the codebase), so the figure was always 0, presented as if it were live data. Removed from the diagnostic; the underlying write-side API is still dead code, flagged for a future cleanup round rather than a risky mid-release refactor of state-manager's DI wiring.
+
+### Removed
+
+- `neutralizeControlChars()` (superseded by `stripTerminalEscapes()`, which already performs the same control-character neutralization as part of a superset of its job; zero remaining callers).
+- Six other dead exported utilities with zero production callers, independently verified: `didResearcherScrape`/`getResearcherScrapes` (`shared-links.ts`), `validateComplexity` (`input-validation.ts`), `normalizeStringArrayDetailed`/`NormalizeArrayResult` (`json-utils.ts`), `getCurrentRunRegistry` (`metrics.ts` — its own internal consumer already reads the underlying `AsyncLocalStorage` directly).
+
+Patch, not minor: every fix is an internal correctness/security/robustness
+change with no change to pi-research's own CLI, tool, or SDK contract —
+matching this project's established precedent for audit-round releases
+(1.3.1, 1.3.2, 1.3.3).
+
 ## [1.3.3] - 2026-08-07
 
 pi 0.84.1 compatibility. Triggered by updating the local `pi` install and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "A set of web research tools (search, scrape, and others) and research agent system that uses them safely and efficiently.",
   "type": "module",
   "private": false,

package/skills/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.3.3", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.3.5", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/src/core/service-registry.ts

@@ -18,9 +18,10 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 
 
 /**
- * How long teardown waits for an initialization that is still in flight. Long
- * enough to cover a normal service coming up, short enough that a service blocked
- * on something slow (a model download) cannot hold shutdown open indefinitely.
+ * How long teardown waits for an initialization or a clear()/replace()
+ * disposal that is still in flight. Long enough to cover a normal service
+ * coming up or tearing down, short enough that a service blocked on
+ * something slow (a model download) cannot hold shutdown open indefinitely.
  */
 const DISPOSE_INFLIGHT_INIT_TIMEOUT_MS = 5_000;
 
@@ -521,6 +522,39 @@ export class ServiceContainer {
         if (settleTimer) clearTimeout(settleTimer);
       }
 
+      // A concurrent clear()/replace() can be mid-disposal right now: its
+      // async IIFE has already called instance.dispose() (or is about to)
+      // but hasn't yet nulled/replaced registration.instance. Snapshotting
+      // activeServices without waiting for this would include that service,
+      // and the loop below would call instance.dispose() a SECOND time on
+      // the very same instance concurrently with clear()/replace()'s own
+      // call — get() already guards against reading mid-disposal state (see
+      // its own disposalPromise wait above); teardown needs the same guard
+      // before it reads/touches registration.instance below. Bounded for the
+      // same reason as the init wait: a service stuck disposing must not
+      // hold overall teardown open indefinitely — the snapshot below still
+      // catches whatever state is left after the timeout.
+      const inFlightDisposals = Array.from(this.services.values())
+        .map((r) => r.disposalPromise)
+        .filter((p): p is Promise<void> => p != null);
+      if (inFlightDisposals.length > 0) {
+        if (this.defaultOptions.enableLogging) {
+          logger.debug(`[ServiceContainer] Waiting for ${inFlightDisposals.length} in-flight disposal(s) before teardown`);
+        }
+        let disposalSettleTimer: ReturnType<typeof setTimeout> | undefined;
+        await Promise.race([
+          Promise.allSettled(inFlightDisposals),
+          new Promise<void>((resolve) => {
+            disposalSettleTimer = setTimeout(() => {
+              logger.warn('[ServiceContainer] Timed out waiting for in-flight service disposal; proceeding with teardown');
+              resolve();
+            }, DISPOSE_INFLIGHT_INIT_TIMEOUT_MS);
+            disposalSettleTimer.unref?.();
+          }),
+        ]);
+        if (disposalSettleTimer) clearTimeout(disposalSettleTimer);
+      }
+
       const activeServices = Array.from(this.services.keys()).filter(name =>
         this.services.get(name)?.instance !== null
       );

package/src/healthcheck/index.ts

@@ -233,17 +233,19 @@ export function registerHealthChecks(registry: IHealthRegistryService, container
   registry.register('StateManager', async () => {
     try {
       const stateManager = await getService<IStateManager>(ServiceNames.STATE_MANAGER, { container }, container);
-      const stats = await stateManager.getMetrics();
       const gpuOwner = await stateManager.getGpuOwner();
-      
-      return { 
-          healthy: true, 
-          diagnostic: { 
+
+      // No `sessions` field here: the session-tracking API (addSession/
+      // removeSession/updateHeartbeat) that would ever populate state.sessions
+      // has no production caller anywhere in the codebase — stats.activeSessions
+      // was always 0, permanently, presenting fake data as a live diagnostic.
+      return {
+          healthy: true,
+          diagnostic: {
               status: 'operational',
-              sessions: stats.activeSessions,
               gpuLocked: !!gpuOwner,
               gpuOwner: gpuOwner?.sessionId || 'none'
-          } 
+          }
       };
     } catch (e) {
       return { healthy: false, error: `State manager healthcheck failed: ${e instanceof Error ? e.message : String(e)}` };

package/src/infrastructure/browser/browser-client.ts

@@ -12,6 +12,7 @@ import type { SearchResult } from '../../web-research/types.ts';
 import type { IScheduler } from '../../core/interfaces/scheduler-interfaces.ts';
 import { logger } from '../../logger.ts';
 import { errorTracker } from '../../utils/error-tracker.ts';
+import { redactSecrets } from '../../utils/log-utils.ts';
 import { Utf8Body } from '../../utils/http-body.ts';
 import { getClientAgent } from './client-agent.ts';
 import type { NodeError } from '../../types/index.ts';
@@ -200,8 +201,10 @@ export class BrowserClient implements IScheduler {
                             resolve(parsed);
                         }
                     } catch (_e) {
-                        // FIX (#23): Truncate response body in error to prevent data leakage
-                        const raw = collected.toString();
+                        // FIX (#23): Truncate response body in error to prevent data leakage.
+                        // Redact BEFORE truncating — slicing first can cut a secret-shaped
+                        // token mid-way, leaving a fragment too short to be recognized.
+                        const raw = redactSecrets(collected.toString());
                         const preview = raw.length > 200 ? raw.slice(0, 200) + '...' : raw;
                         const error = new Error(`Failed to parse response (status ${res.statusCode}): ${preview}`);
                         errorTracker.trackError(error, {

package/src/infrastructure/browser/task-execution-service.ts

@@ -9,6 +9,7 @@ import type { Config } from '../../config.ts';
 import type { SearchResult } from '../../web-research/types.ts';
 import type { BrowserTask } from '../../types/index.ts';
 import { logger } from '../../logger.ts';
+import { redactSecrets } from '../../utils/log-utils.ts';
 import { errorTracker } from '../../utils/error-tracker.ts';
 import { getBrowserCircuitBreaker, browserCircuitBreaker, isTransientSocketError, isPoolShutdownError, isTaskTimeoutError, isCloudflareBlockError } from './browser-error-utils.ts';
 import { getScheduler as _getScheduler, forceSchedulerRestart as _forceSchedulerRestart } from './scheduler-factory.ts';
@@ -42,6 +43,21 @@ const LEADER_HANDOVER_RETRIES = 3;
 /** Backoff between handover attempts — long enough for an election to complete. */
 const HANDOVER_BACKOFF_MS = 1200;
 
+/**
+ * A short, log-line-sized summary of an error — redacted BEFORE truncating.
+ * A raw error.message can echo the failing URL verbatim (Playwright/undici
+ * navigation errors routinely do), and a URL can carry userinfo credentials
+ * (https://user:pass@host/...). Truncating first — the old `.substring(0,
+ * 100)` at each call site below — can cut a credential mid-token, leaving a
+ * short unredacted fragment in the log: redactSecrets' patterns need to see
+ * the whole token to recognize it. Same class of bug as the truncate-before-
+ * redact fix in log-utils.ts itself; redact the full message first here too.
+ */
+export function briefErrorMessage(error: unknown): string {
+    const msg = error instanceof Error ? error.message : String(error);
+    return redactSecrets(msg).substring(0, 100);
+}
+
 /**
  * Recover from a leader handover before retrying.
  *
@@ -225,7 +241,7 @@ export async function runBrowserTask<T>(
                 taskType: type,
                 errorType: 'leader_handover',
             });
-            logger.warn(`[BrowserManager] Leader handover during ${type} task (handover attempts left: ${handoverRetries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+            logger.warn(`[BrowserManager] Leader handover during ${type} task (handover attempts left: ${handoverRetries}): ${briefErrorMessage(error)}...`);
             await recoverFromLeaderHandover(container);
             await new Promise((resolve) => setTimeout(resolve, HANDOVER_BACKOFF_MS + Math.floor(Math.random() * 400)));
             return runBrowserTask<T>(taskOrUrl, type, config, signal, retries, container, handoverRetries - 1);
@@ -238,7 +254,7 @@ export async function runBrowserTask<T>(
                 taskType: type,
                 errorType: 'transient_socket_error',
             });
-            logger.warn(`[BrowserManager] Transient socket error during ${type} task (retries left: ${retries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+            logger.warn(`[BrowserManager] Transient socket error during ${type} task (retries left: ${retries}): ${briefErrorMessage(error)}...`);
 
             if (isPoolShutdownError(error)) {
                 // Handover budget already spent — fall back to a plain drain wait.
@@ -280,7 +296,7 @@ export async function runBrowserHealthCheck(config?: Config, retries = 1, signal
                 operation: 'healthcheck',
                 errorType: 'transient_socket_error',
             });
-            logger.warn(`[BrowserManager] Transient socket error during healthcheck (retries left: ${retries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+            logger.warn(`[BrowserManager] Transient socket error during healthcheck (retries left: ${retries}): ${briefErrorMessage(error)}...`);
 
             if (isPoolShutdownError(error)) {
                 // Same stale-handle trap as the task paths: waiting alone leaves the
@@ -329,7 +345,7 @@ export async function runWorkerSearch(query: string, config?: Config, signal?: A
                 query,
                 errorType: 'leader_handover',
             });
-            logger.warn(`[BrowserManager] Leader handover during search (handover attempts left: ${handoverRetries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+            logger.warn(`[BrowserManager] Leader handover during search (handover attempts left: ${handoverRetries}): ${briefErrorMessage(error)}...`);
             await recoverFromLeaderHandover(container);
             await new Promise((resolve) => setTimeout(resolve, HANDOVER_BACKOFF_MS + Math.floor(Math.random() * 400)));
             return runWorkerSearch(query, config, signal, retries, sessionId, container, handoverRetries - 1);
@@ -342,7 +358,7 @@ export async function runWorkerSearch(query: string, config?: Config, signal?: A
                 query,
                 errorType: 'transient_socket_error',
             });
-            logger.warn(`[BrowserManager] Transient socket error during search (retries left: ${retries}): ${(error instanceof Error ? error.message : String(error)).substring(0, 100)}...`);
+            logger.warn(`[BrowserManager] Transient socket error during search (retries left: ${retries}): ${briefErrorMessage(error)}...`);
 
             if (isPoolShutdownError(error)) {
                 await waitForBrowserPoolIdle(15000).catch((err) => logger.debug('Wait for browser idle timed out or failed:', err));