@lincoln504/pi-research 1.3.3 → 1.3.5

package/src/infrastructure/browser/thread-worker-browser.ts

@@ -30,6 +30,12 @@ let activeTaskCount = 0;
 // A reset that resetBrowser() deferred because sibling tasks were still
 // active, to be applied once the last one finishes.
 let resetPending = false;
+// The browser instance resetPending was requested against, captured at defer
+// time. An intervening resetBrowser() call from a SIBLING task can take the
+// immediate path (doResetBrowser() + a fresh initBrowser() relaunch) while
+// this flag is still pending — see taskFinished() below for why the flag
+// alone isn't enough to know whether it's still safe to apply.
+let resetPendingForBrowser: any = null;
 
 /**
  * Set the worker ID for logging purposes
@@ -48,7 +54,19 @@ export function taskFinished(): void {
   activeTaskCount = Math.max(0, activeTaskCount - 1);
   if (activeTaskCount === 0 && resetPending) {
     resetPending = false;
-    doResetBrowser();
+    const capturedBrowser = resetPendingForBrowser;
+    resetPendingForBrowser = null;
+    // A sibling task's OWN crash can call resetBrowser() while this flag is
+    // still pending; if that call sees activeTaskCount <= 1 it takes the
+    // IMMEDIATE path (doResetBrowser() below), which tears the browser down
+    // and lets the next task's initBrowser() relaunch a brand-new, unrelated
+    // instance — all without ever touching this flag. Applying a stale
+    // deferred reset unconditionally would then tear down that later,
+    // healthy instance instead of being the no-op it should be. Only apply
+    // it if the browser is still the exact instance it was requested against.
+    if (browser === capturedBrowser) {
+      doResetBrowser();
+    }
   }
 }
 
@@ -175,6 +193,35 @@ export async function initBrowser(): Promise<void> {
               colorDepth: 24,
               pixelRatio: 1,
             },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              'media.volume_scale': '0.0',
+              'media.autoplay.default': 5,
+            },
           });
           // Guard with a hard timeout. We catch the launchPromise rejection so it
           // doesn't surface as an UnhandledPromiseRejection if it rejects after the
@@ -301,6 +348,7 @@ function doResetBrowser(): void {
 export function resetBrowser(): void {
   if (activeTaskCount > 1) {
     resetPending = true;
+    resetPendingForBrowser = browser;
     return;
   }
   doResetBrowser();

package/src/infrastructure/browser/thread-worker-messaging.ts

@@ -16,35 +16,64 @@ import { MAX_HTML_SIZE, MAX_PDF_SIZE } from '../../web-research/scraper-types.ts
  */
 let pageCreationLock = Promise.resolve();
 
-async function createPageSafe(context: any): Promise<any> {
+/** How long createPageSafe() waits for a straggling newPage() before force-releasing
+ * the mutex. Must stay well above the 60s soft timeout below — it exists only to
+ * bound the pathological case where newPage() never settles at all (see comment below). */
+const PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1000;
+
+/** Exported for unit testing of the page-creation mutex's timeout behavior. */
+export async function createPageSafe(context: any): Promise<any> {
   let release!: () => void;
   const nextLock = new Promise<void>(resolve => { release = resolve; });
   const currentLock = pageCreationLock;
   pageCreationLock = currentLock.then(() => nextLock);
 
   await currentLock;
-  try {
-    const pagePromise = context.newPage();
-    pagePromise.catch((err: Error) => logToDebugFile('DEBUG', `[ThreadWorker] Background page creation rejection: ${err.message}`));
-    let timeoutId: NodeJS.Timeout | undefined;
-    try {
-      const result = await Promise.race([
-        pagePromise,
-        new Promise<never>((_, reject) => {
-          timeoutId = setTimeout(() => reject(new Error('Browser page creation timed out after 60000ms')), 60000);
-        })
-      ]);
-      if (timeoutId) clearTimeout(timeoutId);
-      return result;
-    } catch (err) {
-      if (timeoutId) clearTimeout(timeoutId);
-      // The timeout (or another error) won the race. If newPage() later resolves,
-      // close that orphaned page so it doesn't accumulate in the long-lived context.
-      pagePromise.then((p: any) => { try { p?.close?.(); } catch { /* already gone */ } }).catch(() => {});
-      throw err;
-    }
-  } finally {
+  const pagePromise = context.newPage();
+  // Release the mutex once newPage() itself has actually settled — NOT when the
+  // timeout race below settles. Releasing in an outer `finally` (the old shape)
+  // fired as soon as the 60s timeout won the race, while newPage() was still
+  // pending in the background — so the NEXT queued caller started its OWN
+  // newPage() concurrently with this still-unsettled one, exactly the concurrent-
+  // newPage() scenario this lock exists to prevent (see the comment above), and
+  // it happens precisely when the browser is already under the stress that
+  // causes 60s+ page-creation stalls in the first place. Attached before the
+  // race starts so it's independent of which branch below returns/throws.
+  //
+  // A hard release timer bounds the case where newPage() never settles at all
+  // (rather than just being slow) — without it, a single wedged newPage() call
+  // would hold this lock forever and livelock every future createPageSafe() call
+  // on this worker thread.
+  let hardReleased = false;
+  const releaseOnce = (): void => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
     release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile('WARN', '[ThreadWorker] page-creation mutex force-released — newPage() did not settle within the hard timeout');
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  pagePromise.then(releaseOnce, releaseOnce);
+  pagePromise.catch((err: Error) => logToDebugFile('DEBUG', `[ThreadWorker] Background page creation rejection: ${err.message}`));
+
+  let timeoutId: NodeJS.Timeout | undefined;
+  try {
+    const result = await Promise.race([
+      pagePromise,
+      new Promise<never>((_, reject) => {
+        timeoutId = setTimeout(() => reject(new Error('Browser page creation timed out after 60000ms')), 60000);
+      })
+    ]);
+    if (timeoutId) clearTimeout(timeoutId);
+    return result;
+  } catch (err) {
+    if (timeoutId) clearTimeout(timeoutId);
+    // The timeout (or another error) won the race. If newPage() later resolves,
+    // close that orphaned page so it doesn't accumulate in the long-lived context.
+    pagePromise.then((p: any) => { try { p?.close?.(); } catch { /* already gone */ } }).catch(() => {});
+    throw err;
   }
 }
 
@@ -55,6 +84,22 @@ export function setWorkerId(id: string): void {
   workerId = id;
 }
 
+/**
+ * Parse a millisecond timeout from an env var. Uses Number() rather than
+ * parseInt() so trailing garbage is REJECTED rather than silently truncated —
+ * parseInt('1m', 10) === 1, which turned a plausible duration-shorthand typo
+ * into a near-instant timeout instead of falling back to the default.
+ */
+function parseTimeoutMs(envVar: string | undefined, def: number): number {
+  if (envVar === undefined || envVar.trim() === '') return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile('WARN', `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
+
 /**
  * Log to debug file
  */
@@ -197,7 +242,7 @@ export async function executeSearchTask(
   query: string
 ): Promise<{ results: any[]; jitter: number }> {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env['PI_RESEARCH_SEARCH_TIMEOUT_MS'] || '45000', 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env['PI_RESEARCH_SEARCH_TIMEOUT_MS'], 45000);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
 
@@ -314,7 +359,7 @@ export async function executeScrapeTask(
   signal?: AbortSignal
 ): Promise<{ contentType: string; html?: string; bufferB64?: string; jitter: number }> {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env['PI_RESEARCH_SCRAPE_TIMEOUT_MS'] || '15000', 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env['PI_RESEARCH_SCRAPE_TIMEOUT_MS'], 15000);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
 
@@ -658,7 +703,7 @@ export async function executeHealthCheck(
 ): Promise<{ success: boolean; navMs: number }> {
   // Nav timeout: read from env (passed through getBrowserEnv), floor at 10s.
   // The outer BrowserTaskScheduler.runHealthCheck() has its own 45s hard deadline.
-  const configuredMs = parseInt(process.env['PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS'] || '0', 10);
+  const configuredMs = parseTimeoutMs(process.env['PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS'], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(10000, configuredMs) : 10000;
 
   if (initMs > 3000) {

package/src/infrastructure/browser/thread-worker.mjs

@@ -45,12 +45,8 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let keep = MAX_LOG_MESSAGE_LENGTH;
-  if (message.length > keep) {
-    const lastKeptUnit = message.charCodeAt(keep - 1);
-    if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
-  }
-  let out = message.length > MAX_LOG_MESSAGE_LENGTH ? `${message.slice(0, keep)}\u2026[truncated ${message.length - keep} chars]` : message;
+  const rawLength = message.length;
+  let out = rawLength > REDACT_SCAN_LENGTH ? message.slice(0, REDACT_SCAN_LENGTH) : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -61,12 +57,20 @@ function redactSecrets(message) {
   out = out.replace(KNOWN_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(PROVIDER_TOKEN_PATTERN, "[REDACTED]");
   out = out.replace(LONG_HEX_SECRET_PATTERN, "[REDACTED]");
+  let keep = MAX_LOG_MESSAGE_LENGTH;
+  if (out.length > keep) {
+    const lastKeptUnit = out.charCodeAt(keep - 1);
+    if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
+  }
+  if (out.length > MAX_LOG_MESSAGE_LENGTH) {
+    out = `${out.slice(0, keep)}\u2026[truncated ${rawLength - keep} chars]`;
+  }
   return out;
 }
 function stripTerminalEscapes(message) {
   return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, REDACT_SCAN_LENGTH, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -75,7 +79,7 @@ var init_log_utils = __esm({
     ANSI_PATTERN = /\x1b\[[0-9;]*[A-Za-z]/g;
     URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s:@]+@/gi;
     COOKIE_HEADER_PATTERN = /\b(set[_-]?cookie|cookie)\b(["']?\s*[:=]\s*["']?)([^\r\n]+)/gi;
-    SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
+    SENSITIVE_KV_PATTERN = /\b(api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|secret|client[_-]?secret|password|passwd|pwd|authorization|bearer|set[_-]?cookie|cookie|session[_-]?id|session|csrf[_-]?token|xsrf[_-]?token|private[_-]?key|key)\b(["']?\s*[:=]\s*["']?)([^\s"',&)]+)/gi;
     KNOWN_TOKEN_PATTERN = /\b(sk-[A-Za-z0-9_-]{16,}|gh[posru]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
     JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
     BASIC_AUTH_PATTERN = /\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}/gi;
@@ -83,6 +87,7 @@ var init_log_utils = __esm({
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
     CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
     TERMINAL_ESCAPE_PATTERN = new RegExp(
       "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
       "g"
@@ -354,10 +359,17 @@ var init_error_tracker = __esm({
 // src/utils/log-rotation.ts
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
-var LogRotation;
+function touchOwnerOnly(filePath, mode) {
+  try {
+    fs2.closeSync(fs2.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode));
+  } catch {
+  }
+}
+var APPEND_CREATE_NOFOLLOW_FLAGS, LogRotation;
 var init_log_rotation = __esm({
   "src/utils/log-rotation.ts"() {
     "use strict";
+    APPEND_CREATE_NOFOLLOW_FLAGS = fs2.constants.O_WRONLY | fs2.constants.O_APPEND | fs2.constants.O_CREAT | (typeof fs2.constants.O_NOFOLLOW === "number" ? fs2.constants.O_NOFOLLOW : 0);
     LogRotation = class {
       MAX_LOG_SIZE = 10 * 1024 * 1024;
       // 10MB max file size
@@ -375,10 +387,7 @@ var init_log_rotation = __esm({
         try {
           if (fs2.existsSync(logFile)) {
             fs2.unlinkSync(logFile);
-            try {
-              fs2.closeSync(fs2.openSync(logFile, "a", 384));
-            } catch {
-            }
+            touchOwnerOnly(logFile, 384);
             try {
               fs2.chmodSync(logFile, 384);
             } catch {
@@ -418,10 +427,7 @@ var init_log_rotation = __esm({
             this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
             return;
           }
-          try {
-            fs2.closeSync(fs2.openSync(logFile, "a", 384));
-          } catch {
-          }
+          touchOwnerOnly(logFile, 384);
           try {
             fs2.chmodSync(logFile, 384);
           } catch {
@@ -588,7 +594,10 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     unkeyedCaptureDepth++;
     isAnyLoggerCapturingOutput = true;
   }
-  const decoder = new TextDecoder();
+  const stderrDecoder = new TextDecoder();
+  const stdoutDecoder = new TextDecoder();
+  const fd1SyncDecoder = new TextDecoder();
+  const fd2SyncDecoder = new TextDecoder();
   const originalStderrWrite = process.stderr.write;
   const originalStdoutWrite = process.stdout.write;
   const originalFsWriteSync = fs4.writeSync;
@@ -634,7 +643,11 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
   console.debug = createConsolePatch("debug", logFile, hasSufficientDiskSpace);
   process.stderr.write = (chunk, encodingOrCb, callback) => {
     const cb = typeof encodingOrCb === "function" ? encodingOrCb : callback;
-    const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+    const message = typeof chunk === "string" ? chunk : stderrDecoder.decode(chunk, { stream: true });
+    if (message.length === 0) {
+      if (typeof cb === "function") cb();
+      return true;
+    }
     if (!hasSufficientDiskSpace()) {
       if (typeof cb === "function") cb();
       return true;
@@ -655,7 +668,7 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     return true;
   };
   process.stdout.write = (chunk, encodingOrCb, callback) => {
-    const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+    const message = typeof chunk === "string" ? chunk : stdoutDecoder.decode(chunk, { stream: true });
     const isNative = isNativeLog(message);
     const complexTui = isComplexTui(message);
     const boxDrawing = isBoxDrawing(message);
@@ -709,7 +722,11 @@ async function captureStdio(logFile, hasSufficientDiskSpace, task, sessionId) {
     if (!descriptor || (descriptor.writable || descriptor.set)) {
       fs4.writeSync = (fd, chunk, ...args) => {
         if (fd === 1 || fd === 2) {
-          const message = typeof chunk === "string" ? chunk : decoder.decode(chunk);
+          const fdDecoder = fd === 1 ? fd1SyncDecoder : fd2SyncDecoder;
+          const message = typeof chunk === "string" ? chunk : fdDecoder.decode(chunk, { stream: true });
+          if (fd === 2 && message.length === 0) {
+            return typeof chunk === "string" ? Buffer.from(chunk).length : chunk.length;
+          }
           const isNative = isNativeLog(message);
           const boxDrawing = isBoxDrawing(message);
           const complexTui = isComplexTui(message);
@@ -1489,6 +1506,7 @@ function isBenignScrapeFailure(error) {
   return msg.startsWith("Fetch blocked:") || // bot-protection interstitial (Cloudflare, DDoS-Guard, …)
   msg.startsWith("Fetch returned stub:") || // nav-only / near-empty page
   msg.startsWith("Could not extract content from PDF") || // malformed/encrypted/scanned-only PDF
+  msg.startsWith("PDF too large") || // exceeds the deliberate 100MB policy cap
   /^HTTP \d{3}\b/.test(msg) || // remote 4xx/5xx status
   isCloudflareBlockError(error) || isTaskTimeoutError(error) || isPoolShutdownError(error);
 }
@@ -1906,6 +1924,7 @@ init_scraper_types();
 import { appendFileSync as appendFileSync2 } from "node:fs";
 var workerId2 = "";
 var pageCreationLock = Promise.resolve();
+var PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1e3;
 async function createPageSafe(context2) {
   let release;
   const nextLock = new Promise((resolve) => {
@@ -1914,37 +1933,54 @@ async function createPageSafe(context2) {
   const currentLock = pageCreationLock;
   pageCreationLock = currentLock.then(() => nextLock);
   await currentLock;
-  try {
-    const pagePromise = context2.newPage();
-    pagePromise.catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Background page creation rejection: ${err.message}`));
-    let timeoutId;
-    try {
-      const result = await Promise.race([
-        pagePromise,
-        new Promise((_, reject) => {
-          timeoutId = setTimeout(() => reject(new Error("Browser page creation timed out after 60000ms")), 6e4);
-        })
-      ]);
-      if (timeoutId) clearTimeout(timeoutId);
-      return result;
-    } catch (err) {
-      if (timeoutId) clearTimeout(timeoutId);
-      pagePromise.then((p) => {
-        try {
-          p?.close?.();
-        } catch {
-        }
-      }).catch(() => {
-      });
-      throw err;
-    }
-  } finally {
+  const pagePromise = context2.newPage();
+  let hardReleased = false;
+  const releaseOnce = () => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
     release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile2("WARN", "[ThreadWorker] page-creation mutex force-released \u2014 newPage() did not settle within the hard timeout");
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  pagePromise.then(releaseOnce, releaseOnce);
+  pagePromise.catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Background page creation rejection: ${err.message}`));
+  let timeoutId;
+  try {
+    const result = await Promise.race([
+      pagePromise,
+      new Promise((_, reject) => {
+        timeoutId = setTimeout(() => reject(new Error("Browser page creation timed out after 60000ms")), 6e4);
+      })
+    ]);
+    if (timeoutId) clearTimeout(timeoutId);
+    return result;
+  } catch (err) {
+    if (timeoutId) clearTimeout(timeoutId);
+    pagePromise.then((p) => {
+      try {
+        p?.close?.();
+      } catch {
+      }
+    }).catch(() => {
+    });
+    throw err;
   }
 }
 function setWorkerId2(id) {
   workerId2 = id;
 }
+function parseTimeoutMs(envVar, def) {
+  if (envVar === void 0 || envVar.trim() === "") return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile2("WARN", `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
 function logToDebugFile2(level, ...args) {
   const logFile = process.env["PI_RESEARCH_LOG_FILE"];
   if (!logFile) return;
@@ -2054,7 +2090,7 @@ async function extractSearchResults(page) {
 }
 async function executeSearchTask(_context, query) {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"] || "45000", 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"], 45e3);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
   try {
@@ -2123,7 +2159,7 @@ function seedSubresourceVerdict(validatedUrl) {
 }
 async function executeScrapeTask(_context, url, signal) {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"] || "15000", 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"], 15e3);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
   const onAbort = () => {
@@ -2289,7 +2325,7 @@ async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PR
   }
 }
 async function executeHealthCheck(_context, initMs) {
-  const configuredMs = parseInt(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"] || "0", 10);
+  const configuredMs = parseTimeoutMs(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(1e4, configuredMs) : 1e4;
   if (initMs > 3e3) {
     logToDebugFile2("WARN", `[Worker-${workerId2}] Browser init was slow: ${initMs}ms \u2014 leaving less headroom for DDG navigation.`);
@@ -2339,6 +2375,7 @@ init_logger();
 
 // src/utils/url-utils.ts
 init_logger();
+init_log_utils();
 
 // src/config.ts
 var ConfigSchema = Type.Object({
@@ -2508,6 +2545,7 @@ var initPromise = null;
 var workerId3 = "";
 var activeTaskCount = 0;
 var resetPending = false;
+var resetPendingForBrowser = null;
 function setWorkerId3(id) {
   workerId3 = id;
 }
@@ -2518,7 +2556,11 @@ function taskFinished() {
   activeTaskCount = Math.max(0, activeTaskCount - 1);
   if (activeTaskCount === 0 && resetPending) {
     resetPending = false;
-    doResetBrowser();
+    const capturedBrowser = resetPendingForBrowser;
+    resetPendingForBrowser = null;
+    if (browser === capturedBrowser) {
+      doResetBrowser();
+    }
   }
 }
 var isBrowserConnected = () => {
@@ -2576,6 +2618,35 @@ async function initBrowser() {
               height: 1080,
               colorDepth: 24,
               pixelRatio: 1
+            },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              "media.volume_scale": "0.0",
+              "media.autoplay.default": 5
             }
           });
           launchPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser launch rejection: ${err.message}`));
@@ -2655,6 +2726,7 @@ function doResetBrowser() {
 function resetBrowser() {
   if (activeTaskCount > 1) {
     resetPending = true;
+    resetPendingForBrowser = browser;
     return;
   }
   doResetBrowser();

package/src/infrastructure/knowledge-store-service.ts

@@ -311,6 +311,17 @@ export class KnowledgeStoreService implements IKnowledgeStoreService {
       } catch {
         // init failed; its own catch already reset state — nothing to wait on.
       }
+      // Re-check: a SECOND concurrent dispose() call can reach this same point
+      // (its own _disposalPromise check above also saw null, before either of
+      // us had published one) and, if it settles the await first, publish its
+      // own disposal while we were still awaiting. Without this, both calls
+      // would go on to capture the SAME embedder/store/writerQueue/initLock
+      // references below and each independently call .dispose()/.close() on
+      // them — the same double-teardown-of-one-instance class of bug fixed at
+      // the ServiceContainer level (disposeAll() vs clear()/replace()).
+      if (this._disposalPromise) {
+        return this._disposalPromise;
+      }
     }
 
     this.lifecycle = ServiceLifecycle.DISPOSING;
@@ -330,7 +341,10 @@ export class KnowledgeStoreService implements IKnowledgeStoreService {
     const writerQueue = this._writerQueue;
     const initLock = this._initLock;
 
-    this._disposalPromise = (async () => {
+    // Named locally (mirrors initialize()'s initPromise) so the finally below
+    // can identity-check before clearing — see there for why.
+    let disposePromise: Promise<void> | null = null;
+    disposePromise = (async () => {
       try {
         if (writerQueue) {
           await writerQueue.dispose?.();
@@ -370,9 +384,20 @@ export class KnowledgeStoreService implements IKnowledgeStoreService {
         logger.error('[KnowledgeStoreService] Error during disposal:', err);
       } finally {
         this.lifecycle = ServiceLifecycle.DISPOSED;
-        this._disposalPromise = null;
+        // Identity-guarded, mirroring initialize()'s own marker clear (see its
+        // finally): only the disposal that still owns _disposalPromise may
+        // null it. The re-check above closes the common race, but this is the
+        // same defense-in-depth initialize() uses — without it, a stale
+        // closure's completion could null a NEWER disposal's still-in-flight
+        // marker, making a concurrent initialize() believe nothing is
+        // disposing and rebuild components while that newer disposal is still
+        // tearing them down.
+        if (this._disposalPromise === disposePromise) {
+          this._disposalPromise = null;
+        }
       }
     })();
+    this._disposalPromise = disposePromise;
 
     return this._disposalPromise;
   }

package/src/knowledge/chunker.ts

@@ -209,12 +209,25 @@ export class Chunker {
       // pair's high half is guaranteed already present in the chunk just
       // pushed, so skipping the low half here loses nothing, it just narrows
       // this chunk's overlap by one code unit instead of widening it.
+      //
+      // The push-forward bound is `<= end`, not `< end`: landing exactly on
+      // `end` (start === end, zero overlap for this transition) is a
+      // perfectly safe position — `end` is always a valid index up to
+      // text.length, and the NEXT chunk's own bounds are recomputed fresh
+      // from `start` at the top of the loop, independent of this `end`. A
+      // strict `<` excluded that boundary case, so at tight targetSize/
+      // overlap ratios (e.g. targetSize:2, overlap:1, straddling a surrogate
+      // pair) BOTH escapes could be simultaneously blocked — the pull-back
+      // correctly refused (it would violate forward-progress) and the
+      // push-forward wrongly refused too (start+1 landed exactly on `end`) —
+      // leaving `start` unmoved on the lone low surrogate, corrupting the
+      // next chunk's opening character.
       if (start > 0) {
         const code = text.charCodeAt(start);
         if (code >= 0xdc00 && code <= 0xdfff) {
           if (start - 1 > iterationStart) {
             start -= 1;
-          } else if (start + 1 < end) {
+          } else if (start + 1 <= end) {
             start += 1;
           }
         }