@lincoln504/pi-research 1.3.4 → 1.3.5

package/README.md

@@ -43,7 +43,7 @@ ask in natural language and the tool picks the right one:
 
 ### Use cases
 
-- Plug-and-play (no API key needed) research tool for your [pi](https://github.com/earendil-works/pi).
+- Plug-and-play (no API key needed) research tool for your [Pi](https://github.com/earendil-works/pi) Coding Agent.
 - Research from Claude Code, Codex, or another coding agent, with a cheaper lightweight or local model driving the research so it doesn't spend your main agent's budget.
 - Populating a dataset or building an index of knowledge sources from the web.
 - Holding research in the knowledge store with a configurable scope — project-specific or globally user-scoped, set per directory from the `/research-config` TUI.
@@ -91,3 +91,8 @@ and the stealth-browser stack. v1.0.0 is the first stable release since. Channel
 
 MIT. Bundled third-party licenses are listed in
 [docs/THIRD-PARTY-NOTICES.md](docs/THIRD-PARTY-NOTICES.md).
+
+### Package identity
+
+This project is always `@lincoln504/pi-research` on npm. The unscoped `pi-research`
+package is unrelated and deprecated.

package/dist/cli.mjs

@@ -215,7 +215,8 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let out = message;
+  const rawLength = message.length;
+  let out = rawLength > REDACT_SCAN_LENGTH ? message.slice(0, REDACT_SCAN_LENGTH) : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -232,14 +233,14 @@ function redactSecrets(message) {
     if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
   }
   if (out.length > MAX_LOG_MESSAGE_LENGTH) {
-    out = `${out.slice(0, keep)}\u2026[truncated ${out.length - keep} chars]`;
+    out = `${out.slice(0, keep)}\u2026[truncated ${rawLength - keep} chars]`;
   }
   return out;
 }
 function stripTerminalEscapes(message) {
   return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, REDACT_SCAN_LENGTH, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -256,6 +257,7 @@ var init_log_utils = __esm({
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
     CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
     TERMINAL_ESCAPE_PATTERN = new RegExp(
       "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
       "g"
@@ -266,10 +268,17 @@ var init_log_utils = __esm({
 // src/utils/log-rotation.ts
 import * as fs from "node:fs";
 import * as path2 from "node:path";
-var LogRotation;
+function touchOwnerOnly(filePath, mode) {
+  try {
+    fs.closeSync(fs.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode));
+  } catch {
+  }
+}
+var APPEND_CREATE_NOFOLLOW_FLAGS, LogRotation;
 var init_log_rotation = __esm({
   "src/utils/log-rotation.ts"() {
     "use strict";
+    APPEND_CREATE_NOFOLLOW_FLAGS = fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | (typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0);
     LogRotation = class {
       MAX_LOG_SIZE = 10 * 1024 * 1024;
       // 10MB max file size
@@ -287,10 +296,7 @@ var init_log_rotation = __esm({
         try {
           if (fs.existsSync(logFile)) {
             fs.unlinkSync(logFile);
-            try {
-              fs.closeSync(fs.openSync(logFile, "a", 384));
-            } catch {
-            }
+            touchOwnerOnly(logFile, 384);
             try {
               fs.chmodSync(logFile, 384);
             } catch {
@@ -330,10 +336,7 @@ var init_log_rotation = __esm({
             this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
             return;
           }
-          try {
-            fs.closeSync(fs.openSync(logFile, "a", 384));
-          } catch {
-          }
+          touchOwnerOnly(logFile, 384);
           try {
             fs.chmodSync(logFile, 384);
           } catch {
@@ -9988,11 +9991,31 @@ function reconcileSkillInstalls(opts = {}) {
       if (source !== null) {
         try {
           fs16.unlinkSync(e.path);
+        } catch {
+          keep.push(e);
+          continue;
+        }
+        try {
           fs16.symlinkSync(source, e.path, process.platform === "win32" ? "junction" : "dir");
           keep.push({ ...e, type: "symlink", source });
           result.repointed.push(e.path);
         } catch {
-          keep.push(e);
+          const dir = path17.dirname(e.path);
+          const base = path17.basename(e.path);
+          const suffix = crypto10.randomBytes(4).toString("hex");
+          const fresh = path17.join(dir, `.${base}.new-${suffix}`);
+          try {
+            copyDir(source, fresh);
+            fs16.renameSync(fresh, e.path);
+            keep.push({ ...e, type: "copy", source });
+            result.repointed.push(e.path);
+          } catch {
+            try {
+              fs16.rmSync(fresh, { recursive: true, force: true });
+            } catch {
+            }
+            result.pruned.push(e.path);
+          }
         }
       } else if (!targetLive) {
         try {
@@ -11439,6 +11462,7 @@ function isFullMockMode() {
 init_config();
 init_logger();
 init_error_tracker();
+init_log_utils();
 init_http_body();
 import * as http2 from "node:http";
 
@@ -11574,7 +11598,7 @@ var BrowserClient = class {
               resolve9(parsed);
             }
           } catch (_e) {
-            const raw = collected.toString();
+            const raw = redactSecrets(collected.toString());
             const preview = raw.length > 200 ? raw.slice(0, 200) + "..." : raw;
             const error = new Error(`Failed to parse response (status ${res.statusCode}): ${preview}`);
             errorTracker.trackError(error, {
@@ -17545,6 +17569,7 @@ async function scrape(urls, maxConcurrency = 5, signal, config, sessionId, onUrl
 // src/tools/scrape.ts
 init_constants();
 init_text_utils();
+init_log_utils();
 init_config();
 init_service_registry();
 init_service_interfaces();
@@ -17716,18 +17741,19 @@ ${evictedDuplicates.map((u) => `- ${u}`).join("\n")}
       let freshResults;
       const concurrency = p.maxConcurrency || defaultConcurrency;
       try {
-        const results = await scrape(urlsToFetch, concurrency, signal, options.config, getGlobalState().researchId, (result) => {
+        const results = await scrape(urlsToFetch, concurrency, signal, config, getGlobalState().researchId, (result) => {
           options.onUrlScrapeResult?.(result.url, result.success);
         }, container);
         freshResults = Array.isArray(results) ? results : [];
       } catch (error) {
-        logger.error(`[scrape tool] Scrape failed: ${error instanceof Error ? error.message : String(error)}`);
+        const message = error instanceof Error ? error.message : String(error);
+        logger.error(`[scrape tool] Scrape failed: ${message}`);
         metrics.increment("tool_scrape_calls_total", 1, { status: "error" });
         return {
           content: [{ type: "text", text: `# Scrape Failed
 
-${error instanceof Error ? error.message : String(error)}` }],
-          details: { error: String(error) }
+${redactSecrets(message)}` }],
+          details: { error: redactSecrets(String(error)) }
         };
       }
       const successfulFresh = freshResults.filter((r) => r.success);
@@ -18974,7 +19000,7 @@ function mapOsvItemToVulnerability(item) {
       for (const cwe of item.database_specific.cwe) {
         if (typeof cwe === "string") {
           cwes.push(cwe);
-        } else if (typeof cwe === "object" && typeof cwe.id === "string") {
+        } else if (typeof cwe === "object" && cwe !== null && typeof cwe.id === "string") {
           cwes.push(cwe.id);
         }
       }
@@ -19355,6 +19381,10 @@ async function searchSecurityDatabases(params, signal) {
 // src/tools/security.ts
 init_constants();
 init_metrics();
+var MAX_DESCRIPTION_CHARS = 300;
+function truncateDescription(description) {
+  return description.length > MAX_DESCRIPTION_CHARS ? `${description.substring(0, MAX_DESCRIPTION_CHARS)}...` : description;
+}
 function createSecuritySearchTool(options) {
   const SecuritySearchParamsSchema = Type6.Object({
     databases: Type6.Optional(Type6.Array(Type6.String({
@@ -19557,7 +19587,7 @@ Unable to search security databases. This may be a temporary issue - try again l
               }
             }
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (vuln.knownExploited === true) {
               markdown += "- **[Actively Exploited]**\n";
@@ -19609,7 +19639,7 @@ Unable to search security databases. This may be a temporary issue - try again l
 `;
             }
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (vuln.dueDate !== void 0) {
               markdown += `- **Due Date:** ${vuln.dueDate}
@@ -19657,7 +19687,7 @@ Unable to search security databases. This may be a temporary issue - try again l
             markdown += `- **Summary:** ${adv.summary}
 `;
             const description = adv.description ?? "";
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (adv.published) {
               markdown += `- **Published:** ${adv.published}
@@ -19699,7 +19729,7 @@ Unable to search security databases. This may be a temporary issue - try again l
             markdown += `- **Severity:** ${vuln.severity}
 `;
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}
+            markdown += `- **Description:** ${truncateDescription(description)}
 `;
             if (vuln.affectedProducts && vuln.affectedProducts.length > 0) {
               markdown += `- **Affected:** ${vuln.affectedProducts.join(", ")}
@@ -20628,11 +20658,13 @@ function watchUrl(videoId) {
 init_retry_utils();
 init_circuit_breaker();
 init_logger();
+init_log_utils();
 init_metrics();
 init_http_body();
 
 // src/youtube/potoken.ts
 init_logger();
+init_safe_unref();
 init_metrics();
 var DEFAULT_REQUEST_KEY = "O43z0dpjhgX20SCx4KAo";
 var BRIDGED_GLOBALS = ["window", "document", "location", "navigator", "origin"];
@@ -20645,9 +20677,19 @@ function describeError(error) {
   return String(error);
 }
 var mintChain = Promise.resolve();
+var MINT_HARD_RELEASE_MS = 5 * 60 * 1e3;
 async function mintPoTokens(identifiers, opts = {}) {
   const run = mintChain.then(() => doMint(identifiers, opts), () => doMint(identifiers, opts));
-  mintChain = run.then(() => void 0, () => void 0);
+  const settled = run.then(() => void 0, () => void 0);
+  let hardTimer;
+  const hardRelease = new Promise((resolve9) => {
+    hardTimer = setTimeout(() => {
+      logger.warn("[youtube] potoken mint mutex force-released \u2014 doMint() did not settle within the hard timeout");
+      resolve9();
+    }, MINT_HARD_RELEASE_MS);
+    safeUnref(hardTimer);
+  });
+  mintChain = Promise.race([settled, hardRelease]).finally(() => clearTimeout(hardTimer));
   return run;
 }
 async function doMint(identifiers, opts) {
@@ -20929,7 +20971,7 @@ function parseJson3(body) {
   try {
     parsed = JSON.parse(body);
   } catch {
-    logger.debug(`[youtube] timedtext body was not valid json3 (first 120 chars): ${body.slice(0, 120)}`);
+    logger.debug(`[youtube] timedtext body was not valid json3 (first 120 chars): ${redactSecrets(body).slice(0, 120)}`);
     return "";
   }
   const events = parsed.events;

package/dist/thread-worker.mjs

@@ -45,7 +45,8 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let out = message;
+  const rawLength = message.length;
+  let out = rawLength > REDACT_SCAN_LENGTH ? message.slice(0, REDACT_SCAN_LENGTH) : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -62,14 +63,14 @@ function redactSecrets(message) {
     if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
   }
   if (out.length > MAX_LOG_MESSAGE_LENGTH) {
-    out = `${out.slice(0, keep)}\u2026[truncated ${out.length - keep} chars]`;
+    out = `${out.slice(0, keep)}\u2026[truncated ${rawLength - keep} chars]`;
   }
   return out;
 }
 function stripTerminalEscapes(message) {
   return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, REDACT_SCAN_LENGTH, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -86,6 +87,7 @@ var init_log_utils = __esm({
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
     CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
     TERMINAL_ESCAPE_PATTERN = new RegExp(
       "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
       "g"
@@ -357,10 +359,17 @@ var init_error_tracker = __esm({
 // src/utils/log-rotation.ts
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
-var LogRotation;
+function touchOwnerOnly(filePath, mode) {
+  try {
+    fs2.closeSync(fs2.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode));
+  } catch {
+  }
+}
+var APPEND_CREATE_NOFOLLOW_FLAGS, LogRotation;
 var init_log_rotation = __esm({
   "src/utils/log-rotation.ts"() {
     "use strict";
+    APPEND_CREATE_NOFOLLOW_FLAGS = fs2.constants.O_WRONLY | fs2.constants.O_APPEND | fs2.constants.O_CREAT | (typeof fs2.constants.O_NOFOLLOW === "number" ? fs2.constants.O_NOFOLLOW : 0);
     LogRotation = class {
       MAX_LOG_SIZE = 10 * 1024 * 1024;
       // 10MB max file size
@@ -378,10 +387,7 @@ var init_log_rotation = __esm({
         try {
           if (fs2.existsSync(logFile)) {
             fs2.unlinkSync(logFile);
-            try {
-              fs2.closeSync(fs2.openSync(logFile, "a", 384));
-            } catch {
-            }
+            touchOwnerOnly(logFile, 384);
             try {
               fs2.chmodSync(logFile, 384);
             } catch {
@@ -421,10 +427,7 @@ var init_log_rotation = __esm({
             this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
             return;
           }
-          try {
-            fs2.closeSync(fs2.openSync(logFile, "a", 384));
-          } catch {
-          }
+          touchOwnerOnly(logFile, 384);
           try {
             fs2.chmodSync(logFile, 384);
           } catch {
@@ -1921,6 +1924,7 @@ init_scraper_types();
 import { appendFileSync as appendFileSync2 } from "node:fs";
 var workerId2 = "";
 var pageCreationLock = Promise.resolve();
+var PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1e3;
 async function createPageSafe(context2) {
   let release;
   const nextLock = new Promise((resolve) => {
@@ -1930,7 +1934,18 @@ async function createPageSafe(context2) {
   pageCreationLock = currentLock.then(() => nextLock);
   await currentLock;
   const pagePromise = context2.newPage();
-  pagePromise.then(release, release);
+  let hardReleased = false;
+  const releaseOnce = () => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
+    release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile2("WARN", "[ThreadWorker] page-creation mutex force-released \u2014 newPage() did not settle within the hard timeout");
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  pagePromise.then(releaseOnce, releaseOnce);
   pagePromise.catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Background page creation rejection: ${err.message}`));
   let timeoutId;
   try {
@@ -1957,6 +1972,15 @@ async function createPageSafe(context2) {
 function setWorkerId2(id) {
   workerId2 = id;
 }
+function parseTimeoutMs(envVar, def) {
+  if (envVar === void 0 || envVar.trim() === "") return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile2("WARN", `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
 function logToDebugFile2(level, ...args) {
   const logFile = process.env["PI_RESEARCH_LOG_FILE"];
   if (!logFile) return;
@@ -2066,7 +2090,7 @@ async function extractSearchResults(page) {
 }
 async function executeSearchTask(_context, query) {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"] || "45000", 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"], 45e3);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
   try {
@@ -2135,7 +2159,7 @@ function seedSubresourceVerdict(validatedUrl) {
 }
 async function executeScrapeTask(_context, url, signal) {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"] || "15000", 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"], 15e3);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
   const onAbort = () => {
@@ -2301,7 +2325,7 @@ async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PR
   }
 }
 async function executeHealthCheck(_context, initMs) {
-  const configuredMs = parseInt(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"] || "0", 10);
+  const configuredMs = parseTimeoutMs(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(1e4, configuredMs) : 1e4;
   if (initMs > 3e3) {
     logToDebugFile2("WARN", `[Worker-${workerId2}] Browser init was slow: ${initMs}ms \u2014 leaving less headroom for DDG navigation.`);
@@ -2594,6 +2618,35 @@ async function initBrowser() {
               height: 1080,
               colorDepth: 24,
               pixelRatio: 1
+            },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              "media.volume_scale": "0.0",
+              "media.autoplay.default": 5
             }
           });
           launchPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser launch rejection: ${err.message}`));

package/docs/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.5] - 2026-08-10
+
+Two rounds of workflow-backed code review on the clean 1.3.4 tree (high-effort,
+then a wider max-effort pass explicitly told not to re-find the first round's
+results), followed by a triage of every open CodeQL alert. Every fix below is
+covered by a passing regression test; two bugs (the OSV null-CWE crash and the
+duration-formatter rounding bug) had no prior test coverage at all, so tests
+were added alongside the fixes.
+
+### Fixed
+
+- **The browser page-creation mutex could still hang forever.** 1.3.4 fixed the mutex releasing too early (before `newPage()` itself settled). That fix had no bound of its own: if `newPage()` never settles at all — not just slow, but genuinely wedged — the lock is now held forever, livelocking every future `createPageSafe()` call on that worker thread. Added a 5-minute hard-release timer that force-releases the lock if `newPage()` still hasn't settled, independent of the settlement-based release for the normal case.
+- **`reconcileSkillInstalls()`'s stale-symlink re-point had no copy fallback.** The sibling `installSkill()` already falls back to a copy when `symlinkSync` fails after the old link is removed (a Windows cross-volume junction failure, most commonly). The periodic reconciler's structurally identical re-point lacked that fallback, so a `symlinkSync` failure there silently left the manifest claiming a skill was installed after the file was already deleted from disk. Added the same fallback — and staged the copy into a dot-prefixed temp dir with an atomic rename into place, so a copy that fails partway (disk full, interrupted process) can never leave an unrecognized, SKILL.md-less partial directory orphaned at the skill's path.
+- **The scrape tool's own gating used a different config than its actual fetch.** `createScrapeTool()` resolves `config = options.config || getConfig(options.ctx.cwd)` and uses that resolved value for every batching/gating decision (knowledge-store mode, concurrency caps, token-fraction limits, pool capacity) — except the real `scrape()` call, which passed the raw, possibly-`undefined` `options.config`. A caller that omits `config` (the parameter is typed optional) got gating computed for one cwd while the actual network fetch silently fell back to whatever `getConfig()` resolves for `process.cwd()` — a different worker/pool concurrency or provider config than what the visible gating decision assumed, with nothing logged to indicate the mismatch.
+- **`redactSecrets()`'s truncate-before-redact fix (1.3.4) removed its own cost bound.** Moving truncation after the full regex chain (correctly, to stop a secret leaking at the truncation boundary) also removed the implicit cap that used to limit those ~10 sequential regex passes to `MAX_LOG_MESSAGE_LENGTH` characters regardless of input size. A verbose/debug log call carrying a multi-megabyte scraped payload now ran the whole chain across the untruncated string. Pre-slices to 4× `MAX_LOG_MESSAGE_LENGTH` before redacting — generous enough that no in-bounds secret is ever missed (patterns only shrink text, never expand it, and content beyond that window can never survive into the final truncated output anyway) — and reports the truncation count against the true raw length instead of the post-redaction length.
+- **Six more truncate-before-redact / unredacted-error-text sites, the same bug class 1.3.4 fixed at five others.** `scrape.ts`'s and `research-tool-definition.ts`'s error-catch paths returned raw `error.message`/`String(error)` directly as tool output; `browser-client.ts`'s JSON-parse-failure handler embedded a raw 200-char response preview in the thrown `Error`; `transcript-client.ts`'s debug log sliced YouTube's raw `timedtext` response to 120 chars before redaction instead of after. Each of these can carry a credential (a failing URL's userinfo, an echoed `Authorization` header, an embedded token in a malformed page) into a log file, a thrown error, or the agent's own conversation/report output. All six now redact before truncating or returning.
+- **A `null` entry in an OSV/GHSA advisory's `database_specific.cwe` crashed the entire lookup.** `typeof cwe === 'object'` is `true` for `null`, so `mapOsvItemToVulnerability` threw on `(null).id` — and since it runs uncaught inside `osv-client.ts`'s per-term fetch (only wrapped in `Promise.allSettled`), one malformed record silently discarded every vulnerability found for that search term, replaced by a generic failure note. Added the missing `cwe !== null` check.
+- **The YouTube PoToken mint mutex had the same unbounded-hang exposure as the browser mutex above.** `doMint()` awaits BotGuard VM execution and interpreter eval against a hostile/malformed attestation script from Google, neither of which take an abort signal — if either hangs instead of rejecting, the module-level `mintChain` mutex never settles, and every subsequent `mintPoTokens()` call across all researchers queues behind it forever. Added the same style of hard-release bound as the browser mutex fix, via a `Promise.race` against a 5-minute (unref'd) timeout.
+- **Three timeout env vars silently became near-zero on a malformed value.** `PI_RESEARCH_SEARCH_TIMEOUT_MS`, `PI_RESEARCH_SCRAPE_TIMEOUT_MS`, and `PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS` were read with `parseInt()`, which truncates at the first non-digit instead of rejecting the value — `parseInt('1m', 10)` is `1`, not `NaN`, so a plausible duration-shorthand typo silently became a 1ms browser timeout instead of falling back to the default, failing every search/scrape/health-check on that worker for the rest of its life with no warning. Replaced with a shared helper using `Number()` (which rejects trailing garbage) plus a warning log on an invalid value.
+- **`formatDuration()` could render the nonsensical "1m 60s".** Rounding `remainingSeconds` independently of `minutes` let a value like 119,601ms (1m 59.601s) round its seconds component up to 60 without rolling into the next minute. Now rounds the total seconds first and derives minutes/seconds from that integer.
+- **A theoretical symlink race on log rotation's file reopen.** After renaming the live log aside during rotation (or unlinking it during `clearLogs`), the code reopens the same path with `fs.openSync(path, 'a', 0o600)` to recreate it owner-only — a window in which a local attacker with write access to the log directory could plant a symlink at that path, causing the reopen to follow it and (re)create/chmod an arbitrary file with this process's permissions. Added `O_NOFOLLOW` to the reopen (a no-op on Windows, where the flag isn't defined) so it refuses to follow a symlink instead.
+- **Scraping a YouTube watch page could play audible audio through the host's speakers.** The general `scrape` tool drives a real stealth Firefox (Camoufox) — unlike the dedicated `youtube_transcript` tool, which only calls YouTube's API (`youtubei.js`/`timedtext`) and never touches a browser. A researcher agent scraping a `youtube.com` watch-page URL through the ordinary `scrape` tool hit YouTube's default video autoplay with no engine-level mute configured, so the browser process played sound through whatever audio sink it could reach. Reported on Linux, where both true-headless and the Xvfb-backed `'virtual'` mode keep a live PulseAudio/PipeWire/ALSA sink reachable — but headless Firefox is not guaranteed silent on macOS/Windows either, so the fix (`media.volume_scale: '0.0'` plus `media.autoplay.default: 5` in the shared Camoufox launch options) is unconditional across platforms and headless modes, not Linux-specific.
+
+### Reviewed, not changed
+
+A full CodeQL alert triage found 12 of 13 open alerts to be false positives or out-of-scope for a code fix, each verified individually rather than dismissed on assumption:
+- Two `js/missing-await` alerts in `embedder.ts` are reference-identity checks (`this.recoveryPromise === recovery`) misread as a forgotten `await` — awaiting either side would break the logic.
+- A `js/file-system-race` alert in `file-lock-service.ts` is on code that already reopens with the `'wx'` exclusive-create flag specifically to make the check-then-open atomic.
+- A `js/insecure-temporary-file` alert in `browser/cleanup-utils.ts` is a read-only liveness probe on a Firefox lock file, not a file creation.
+- Six alerts (`js/file-system-race`, `js/insecure-temporary-file`) are all in test files creating throwaway, randomly-named fixtures under `os.tmpdir()` for the test's own private use.
+- One (`js/unused-local-variable`) was a genuine unused test import; removed.
+
+Patch, not minor: every fix is an internal correctness/security/robustness
+change with no change to pi-research's own CLI, tool, or SDK contract —
+matching this project's established precedent for audit-round releases
+(1.3.1 through 1.3.4).
+
 ## [1.3.4] - 2026-08-09
 
 Two rounds on the clean 1.3.3 tree: a full-tree re-audit (10 independent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "A set of web research tools (search, scrape, and others) and research agent system that uses them safely and efficiently.",
   "type": "module",
   "private": false,

package/skills/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.3.4", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.3.5", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/src/infrastructure/browser/browser-client.ts

@@ -12,6 +12,7 @@ import type { SearchResult } from '../../web-research/types.ts';
 import type { IScheduler } from '../../core/interfaces/scheduler-interfaces.ts';
 import { logger } from '../../logger.ts';
 import { errorTracker } from '../../utils/error-tracker.ts';
+import { redactSecrets } from '../../utils/log-utils.ts';
 import { Utf8Body } from '../../utils/http-body.ts';
 import { getClientAgent } from './client-agent.ts';
 import type { NodeError } from '../../types/index.ts';
@@ -200,8 +201,10 @@ export class BrowserClient implements IScheduler {
                             resolve(parsed);
                         }
                     } catch (_e) {
-                        // FIX (#23): Truncate response body in error to prevent data leakage
-                        const raw = collected.toString();
+                        // FIX (#23): Truncate response body in error to prevent data leakage.
+                        // Redact BEFORE truncating — slicing first can cut a secret-shaped
+                        // token mid-way, leaving a fragment too short to be recognized.
+                        const raw = redactSecrets(collected.toString());
                         const preview = raw.length > 200 ? raw.slice(0, 200) + '...' : raw;
                         const error = new Error(`Failed to parse response (status ${res.statusCode}): ${preview}`);
                         errorTracker.trackError(error, {

package/src/infrastructure/browser/thread-worker-browser.ts

@@ -193,6 +193,35 @@ export async function initBrowser(): Promise<void> {
               colorDepth: 24,
               pixelRatio: 1,
             },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              'media.volume_scale': '0.0',
+              'media.autoplay.default': 5,
+            },
           });
           // Guard with a hard timeout. We catch the launchPromise rejection so it
           // doesn't surface as an UnhandledPromiseRejection if it rejects after the

package/src/infrastructure/browser/thread-worker-messaging.ts

@@ -16,6 +16,11 @@ import { MAX_HTML_SIZE, MAX_PDF_SIZE } from '../../web-research/scraper-types.ts
  */
 let pageCreationLock = Promise.resolve();
 
+/** How long createPageSafe() waits for a straggling newPage() before force-releasing
+ * the mutex. Must stay well above the 60s soft timeout below — it exists only to
+ * bound the pathological case where newPage() never settles at all (see comment below). */
+const PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1000;
+
 /** Exported for unit testing of the page-creation mutex's timeout behavior. */
 export async function createPageSafe(context: any): Promise<any> {
   let release!: () => void;
@@ -25,16 +30,32 @@ export async function createPageSafe(context: any): Promise<any> {
 
   await currentLock;
   const pagePromise = context.newPage();
-  // Release the mutex only once newPage() itself has actually settled — NOT when
-  // the timeout race below settles. Releasing in an outer `finally` (the old
-  // shape) fired as soon as the 60s timeout won the race, while newPage() was
-  // still pending in the background — so the NEXT queued caller started its OWN
+  // Release the mutex once newPage() itself has actually settled — NOT when the
+  // timeout race below settles. Releasing in an outer `finally` (the old shape)
+  // fired as soon as the 60s timeout won the race, while newPage() was still
+  // pending in the background — so the NEXT queued caller started its OWN
   // newPage() concurrently with this still-unsettled one, exactly the concurrent-
   // newPage() scenario this lock exists to prevent (see the comment above), and
   // it happens precisely when the browser is already under the stress that
   // causes 60s+ page-creation stalls in the first place. Attached before the
   // race starts so it's independent of which branch below returns/throws.
-  pagePromise.then(release, release);
+  //
+  // A hard release timer bounds the case where newPage() never settles at all
+  // (rather than just being slow) — without it, a single wedged newPage() call
+  // would hold this lock forever and livelock every future createPageSafe() call
+  // on this worker thread.
+  let hardReleased = false;
+  const releaseOnce = (): void => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
+    release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile('WARN', '[ThreadWorker] page-creation mutex force-released — newPage() did not settle within the hard timeout');
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  pagePromise.then(releaseOnce, releaseOnce);
   pagePromise.catch((err: Error) => logToDebugFile('DEBUG', `[ThreadWorker] Background page creation rejection: ${err.message}`));
 
   let timeoutId: NodeJS.Timeout | undefined;
@@ -63,6 +84,22 @@ export function setWorkerId(id: string): void {
   workerId = id;
 }
 
+/**
+ * Parse a millisecond timeout from an env var. Uses Number() rather than
+ * parseInt() so trailing garbage is REJECTED rather than silently truncated —
+ * parseInt('1m', 10) === 1, which turned a plausible duration-shorthand typo
+ * into a near-instant timeout instead of falling back to the default.
+ */
+function parseTimeoutMs(envVar: string | undefined, def: number): number {
+  if (envVar === undefined || envVar.trim() === '') return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile('WARN', `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
+
 /**
  * Log to debug file
  */
@@ -205,7 +242,7 @@ export async function executeSearchTask(
   query: string
 ): Promise<{ results: any[]; jitter: number }> {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env['PI_RESEARCH_SEARCH_TIMEOUT_MS'] || '45000', 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env['PI_RESEARCH_SEARCH_TIMEOUT_MS'], 45000);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
 
@@ -322,7 +359,7 @@ export async function executeScrapeTask(
   signal?: AbortSignal
 ): Promise<{ contentType: string; html?: string; bufferB64?: string; jitter: number }> {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env['PI_RESEARCH_SCRAPE_TIMEOUT_MS'] || '15000', 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env['PI_RESEARCH_SCRAPE_TIMEOUT_MS'], 15000);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
 
@@ -666,7 +703,7 @@ export async function executeHealthCheck(
 ): Promise<{ success: boolean; navMs: number }> {
   // Nav timeout: read from env (passed through getBrowserEnv), floor at 10s.
   // The outer BrowserTaskScheduler.runHealthCheck() has its own 45s hard deadline.
-  const configuredMs = parseInt(process.env['PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS'] || '0', 10);
+  const configuredMs = parseTimeoutMs(process.env['PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS'], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(10000, configuredMs) : 10000;
 
   if (initMs > 3000) {

package/src/infrastructure/browser/thread-worker.mjs

@@ -45,7 +45,8 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let out = message;
+  const rawLength = message.length;
+  let out = rawLength > REDACT_SCAN_LENGTH ? message.slice(0, REDACT_SCAN_LENGTH) : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -62,14 +63,14 @@ function redactSecrets(message) {
     if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
   }
   if (out.length > MAX_LOG_MESSAGE_LENGTH) {
-    out = `${out.slice(0, keep)}\u2026[truncated ${out.length - keep} chars]`;
+    out = `${out.slice(0, keep)}\u2026[truncated ${rawLength - keep} chars]`;
   }
   return out;
 }
 function stripTerminalEscapes(message) {
   return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, REDACT_SCAN_LENGTH, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -86,6 +87,7 @@ var init_log_utils = __esm({
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
     CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
     TERMINAL_ESCAPE_PATTERN = new RegExp(
       "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
       "g"
@@ -357,10 +359,17 @@ var init_error_tracker = __esm({
 // src/utils/log-rotation.ts
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
-var LogRotation;
+function touchOwnerOnly(filePath, mode) {
+  try {
+    fs2.closeSync(fs2.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode));
+  } catch {
+  }
+}
+var APPEND_CREATE_NOFOLLOW_FLAGS, LogRotation;
 var init_log_rotation = __esm({
   "src/utils/log-rotation.ts"() {
     "use strict";
+    APPEND_CREATE_NOFOLLOW_FLAGS = fs2.constants.O_WRONLY | fs2.constants.O_APPEND | fs2.constants.O_CREAT | (typeof fs2.constants.O_NOFOLLOW === "number" ? fs2.constants.O_NOFOLLOW : 0);
     LogRotation = class {
       MAX_LOG_SIZE = 10 * 1024 * 1024;
       // 10MB max file size
@@ -378,10 +387,7 @@ var init_log_rotation = __esm({
         try {
           if (fs2.existsSync(logFile)) {
             fs2.unlinkSync(logFile);
-            try {
-              fs2.closeSync(fs2.openSync(logFile, "a", 384));
-            } catch {
-            }
+            touchOwnerOnly(logFile, 384);
             try {
               fs2.chmodSync(logFile, 384);
             } catch {
@@ -421,10 +427,7 @@ var init_log_rotation = __esm({
             this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
             return;
           }
-          try {
-            fs2.closeSync(fs2.openSync(logFile, "a", 384));
-          } catch {
-          }
+          touchOwnerOnly(logFile, 384);
           try {
             fs2.chmodSync(logFile, 384);
           } catch {
@@ -1921,6 +1924,7 @@ init_scraper_types();
 import { appendFileSync as appendFileSync2 } from "node:fs";
 var workerId2 = "";
 var pageCreationLock = Promise.resolve();
+var PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1e3;
 async function createPageSafe(context2) {
   let release;
   const nextLock = new Promise((resolve) => {
@@ -1930,7 +1934,18 @@ async function createPageSafe(context2) {
   pageCreationLock = currentLock.then(() => nextLock);
   await currentLock;
   const pagePromise = context2.newPage();
-  pagePromise.then(release, release);
+  let hardReleased = false;
+  const releaseOnce = () => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
+    release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile2("WARN", "[ThreadWorker] page-creation mutex force-released \u2014 newPage() did not settle within the hard timeout");
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  pagePromise.then(releaseOnce, releaseOnce);
   pagePromise.catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Background page creation rejection: ${err.message}`));
   let timeoutId;
   try {
@@ -1957,6 +1972,15 @@ async function createPageSafe(context2) {
 function setWorkerId2(id) {
   workerId2 = id;
 }
+function parseTimeoutMs(envVar, def) {
+  if (envVar === void 0 || envVar.trim() === "") return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile2("WARN", `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
 function logToDebugFile2(level, ...args) {
   const logFile = process.env["PI_RESEARCH_LOG_FILE"];
   if (!logFile) return;
@@ -2066,7 +2090,7 @@ async function extractSearchResults(page) {
 }
 async function executeSearchTask(_context, query) {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"] || "45000", 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"], 45e3);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
   try {
@@ -2135,7 +2159,7 @@ function seedSubresourceVerdict(validatedUrl) {
 }
 async function executeScrapeTask(_context, url, signal) {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"] || "15000", 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"], 15e3);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
   const onAbort = () => {
@@ -2301,7 +2325,7 @@ async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PR
   }
 }
 async function executeHealthCheck(_context, initMs) {
-  const configuredMs = parseInt(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"] || "0", 10);
+  const configuredMs = parseTimeoutMs(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(1e4, configuredMs) : 1e4;
   if (initMs > 3e3) {
     logToDebugFile2("WARN", `[Worker-${workerId2}] Browser init was slow: ${initMs}ms \u2014 leaving less headroom for DDG navigation.`);
@@ -2594,6 +2618,35 @@ async function initBrowser() {
               height: 1080,
               colorDepth: 24,
               pixelRatio: 1
+            },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              "media.volume_scale": "0.0",
+              "media.autoplay.default": 5
             }
           });
           launchPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser launch rejection: ${err.message}`));

package/src/security/osv-types.ts

@@ -237,7 +237,7 @@ export function mapOsvItemToVulnerability(item: OsvVulnerability): Vulnerability
       for (const cwe of item.database_specific.cwe) {
         if (typeof cwe === 'string') {
           cwes.push(cwe);
-        } else if (typeof cwe === 'object' && typeof (cwe as { id?: string }).id === 'string') {
+        } else if (typeof cwe === 'object' && cwe !== null && typeof (cwe as { id?: string }).id === 'string') {
           cwes.push((cwe as { id: string }).id);
         }
       }

package/src/skill-install/skill-installer.ts

@@ -647,10 +647,38 @@ export function reconcileSkillInstalls(opts: InstallOptions = {}): ReconcileResu
         // Re-point to the current package source (handles update/reinstall).
         try {
           fs.unlinkSync(e.path);
+        } catch { keep.push(e); continue; /* old link untouched; retry next startup */ }
+        try {
           fs.symlinkSync(source, e.path, process.platform === 'win32' ? 'junction' : 'dir');
           keep.push({ ...e, type: 'symlink', source });
           result.repointed.push(e.path);
-        } catch { keep.push(e); /* leave entry; retry next startup */ }
+        } catch {
+          // The old link is already gone at this point (unlinkSync above
+          // succeeded). Mirror installSkill()'s fallback: try a copy rather than
+          // leaving the skill MISSING on disk while the manifest still claims
+          // it's installed (e.g. a Windows cross-volume junction failure).
+          // Stage into a dot-prefixed temp dir and rename into place, same as
+          // the copy-refresh path above — copying directly into e.path left a
+          // partial, SKILL.md-less directory permanently orphaned on disk
+          // (unrecognized by isOwnedCopy) when copyDir failed partway (disk
+          // full, interrupted process).
+          const dir = path.dirname(e.path);
+          const base = path.basename(e.path);
+          const suffix = crypto.randomBytes(4).toString('hex');
+          const fresh = path.join(dir, `.${base}.new-${suffix}`);
+          try {
+            copyDir(source, fresh);
+            fs.renameSync(fresh, e.path);
+            keep.push({ ...e, type: 'copy', source });
+            result.repointed.push(e.path);
+          } catch {
+            try { fs.rmSync(fresh, { recursive: true, force: true }); } catch { /* best effort */ }
+            // Both the re-point and the copy fallback failed — the skill really
+            // is gone from disk now. Drop the entry instead of leaving the
+            // manifest claiming a missing skill is still installed.
+            result.pruned.push(e.path);
+          }
+        }
       } else if (!targetLive) {
         // Dangling with no resolvable source (package fully removed): remove the
         // dead link and drop the entry so the agent's skills dir stays clean.

package/src/tools/research-tool-definition.ts

@@ -24,6 +24,7 @@ import { ServiceNames } from '../core/service-interfaces.ts';
 import type { IResearchOrchestration, IResearchSynthesisService } from '../core/service-interfaces.ts';
 import { metrics, MetricsRegistry, runWithRunRegistry } from '../utils/metrics.ts';
 import { createResearchRunId, logger, createLogger, isVerboseFromEnv, runWithLogger } from '../logger.ts';
+import { redactSecrets } from '../utils/log-utils.ts';
 import { exportResearchReport, appendExportMessage } from '../utils/research-export.ts';
 import { validateAndSanitizeQuery } from '../utils/input-validation.ts';
 import { validateInitialLinks, MAX_INITIAL_LINKS, MAX_INITIAL_LINK_CHARS } from '../utils/url-utils.ts';
@@ -507,14 +508,14 @@ export function createResearchTool(iface?: ConfigInterface): ToolDefinition {
             return {
                 content: [{
                     type: 'text',
-                    text: `[SYSTEM MESSAGE]: The research operation was halted gracefully because an API rate limit (HTTP 429) was reached. Please inform the user that the operation was stopped due to provider rate limits and they should wait a moment before trying again.\n\nDetails: ${String(error)}`
+                    text: `[SYSTEM MESSAGE]: The research operation was halted gracefully because an API rate limit (HTTP 429) was reached. Please inform the user that the operation was stopped due to provider rate limits and they should wait a moment before trying again.\n\nDetails: ${redactSecrets(String(error))}`
                 }],
                 details: {}
             };
         }
 
         logger.error('[research] run failed', error);
-        return { content: [{ type: 'text', text: `Research failed: ${String(error)}` }], details: {} };
+        return { content: [{ type: 'text', text: `Research failed: ${redactSecrets(String(error))}` }], details: {} };
       } finally {
         // Guarantees panel teardown even when the run fails before the inner
         // research loop is reached (e.g. health-check failure), where the inner

package/src/tools/scrape.ts

@@ -24,6 +24,7 @@ import {
   MAX_SCRAPE_CONTENT_CHARS_PER_DOC,
 } from '../constants.ts';
 import { truncateWithMarker } from '../utils/text-utils.ts';
+import { redactSecrets } from '../utils/log-utils.ts';
 import { type Config, getConfig } from '../config.ts';
 import { getService, tryGetServiceContainerFromCtx } from '../core/service-registry.ts';
 import { ServiceNames } from '../core/service-interfaces.ts';
@@ -261,16 +262,17 @@ export function createScrapeTool(options: {
       const concurrency = p.maxConcurrency || defaultConcurrency;
       
       try {
-        const results = await scrape(urlsToFetch, concurrency, signal, options.config, getGlobalState().researchId, (result) => {
+        const results = await scrape(urlsToFetch, concurrency, signal, config, getGlobalState().researchId, (result) => {
           options.onUrlScrapeResult?.(result.url, result.success);
         }, container);
         freshResults = Array.isArray(results) ? results : [];
       } catch (error) {
-          logger.error(`[scrape tool] Scrape failed: ${error instanceof Error ? error.message : String(error)}`);
+          const message = error instanceof Error ? error.message : String(error);
+          logger.error(`[scrape tool] Scrape failed: ${message}`);
           metrics.increment('tool_scrape_calls_total', 1, { status: 'error' });
           return {
-            content: [{ type: 'text', text: `# Scrape Failed\n\n${error instanceof Error ? error.message : String(error)}` }],
-            details: { error: String(error) },
+            content: [{ type: 'text', text: `# Scrape Failed\n\n${redactSecrets(message)}` }],
+            details: { error: redactSecrets(String(error)) },
           };
       }
 

package/src/tools/security.ts

@@ -13,6 +13,15 @@ import { getMaxGatheringCalls } from '../constants.ts';
 import { metrics } from '../utils/metrics.ts';
 import type { SecuritySearchParams } from '../security/types.ts';
 
+const MAX_DESCRIPTION_CHARS = 300;
+
+/** Truncates an advisory description for the markdown summary line. */
+function truncateDescription(description: string): string {
+  return description.length > MAX_DESCRIPTION_CHARS
+    ? `${description.substring(0, MAX_DESCRIPTION_CHARS)}...`
+    : description;
+}
+
 export function createSecuritySearchTool(options: {
   ctx: ExtensionContext;
   tracker: ToolUsageTracker;
@@ -229,7 +238,7 @@ export function createSecuritySearchTool(options: {
               }
             }
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}\n`;
+            markdown += `- **Description:** ${truncateDescription(description)}\n`;
             if (vuln.knownExploited === true) {
               markdown += '- **[Actively Exploited]**\n';
             }
@@ -270,7 +279,7 @@ export function createSecuritySearchTool(options: {
               markdown += `- **Product:** ${vuln.product}\n`;
             }
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}\n`;
+            markdown += `- **Description:** ${truncateDescription(description)}\n`;
             if (vuln.dueDate !== undefined) {
               markdown += `- **Due Date:** ${vuln.dueDate}\n`;
             }
@@ -310,7 +319,7 @@ export function createSecuritySearchTool(options: {
             }
             markdown += `- **Summary:** ${adv.summary}\n`;
             const description = adv.description ?? '';
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}\n`;
+            markdown += `- **Description:** ${truncateDescription(description)}\n`;
             if (adv.published) {
               markdown += `- **Published:** ${adv.published}\n`;
             }
@@ -344,7 +353,7 @@ export function createSecuritySearchTool(options: {
             markdown += `### ${vuln.id}\n`;
             markdown += `- **Severity:** ${vuln.severity}\n`;
             const description = vuln.description;
-            markdown += `- **Description:** ${description.length > 300 ? `${description.substring(0, 300)}...` : description}\n`;
+            markdown += `- **Description:** ${truncateDescription(description)}\n`;
             if (vuln.affectedProducts && vuln.affectedProducts.length > 0) {
               markdown += `- **Affected:** ${vuln.affectedProducts.join(', ')}\n`;
             }

package/src/utils/log-rotation.ts

@@ -10,6 +10,25 @@ export interface RotationLogger {
   log(...args: unknown[]): void;
 }
 
+// Numeric equivalent of the 'a' flag string (O_WRONLY|O_APPEND|O_CREAT), with
+// O_NOFOLLOW added when the platform defines it (not available on Windows) so
+// the open refuses to follow a symlink an attacker with write access to the
+// log directory could plant at this path in the window between the preceding
+// unlink/rename and this reopen — defense-in-depth on top of an already-narrow
+// threat model (it requires local write access to this directory to begin with).
+const APPEND_CREATE_NOFOLLOW_FLAGS =
+  fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT |
+  (typeof fs.constants.O_NOFOLLOW === 'number' ? fs.constants.O_NOFOLLOW : 0);
+
+/** Best-effort (re)create `filePath` with `mode`, refusing to follow a symlink
+ * planted at the path. Failures are swallowed by design — see call sites.
+ * Exported for unit testing of the symlink-refusal behavior. */
+export function touchOwnerOnly(filePath: string, mode: number): void {
+  try {
+    fs.closeSync(fs.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode));
+  } catch { /* best-effort — the next append recreates the file */ }
+}
+
 export class LogRotation {
   private readonly MAX_LOG_SIZE = 10 * 1024 * 1024; // 10MB max file size
   private readonly MAX_LOG_FILES = 10; // Keep last 10 archived logs
@@ -30,9 +49,7 @@ export class LogRotation {
         // Same rationale as the post-rotation recreate in rotateLogFile: the
         // unlink discarded the 0o600 file, and a umask-default recreate by the
         // next append would drop the owner-only posture.
-        try {
-          fs.closeSync(fs.openSync(logFile, 'a', 0o600));
-        } catch { /* best-effort — the next append recreates the file */ }
+        touchOwnerOnly(logFile, 0o600);
         // And, as there, re-stamp the mode: a concurrent append landing between
         // the unlink and the open makes the creation-time 0o600 a no-op.
         try {
@@ -94,9 +111,7 @@ export class LogRotation {
       // world-traversable tmpdir, silently dropping the owner-only posture Logger
       // establishes at construction. Mode applies only at creation, so this is
       // harmless where a file already exists or mode semantics differ (win32).
-      try {
-        fs.closeSync(fs.openSync(logFile, 'a', 0o600));
-      } catch { /* best-effort — the next append recreates the file */ }
+      touchOwnerOnly(logFile, 0o600);
       // The mode above applies only if THIS open created the file. Several
       // processes append to this consolidated log, so a concurrent async append
       // can recreate it at umask perms between the rename and the open, turning

package/src/utils/log-utils.ts

@@ -133,6 +133,16 @@ const CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
  * Applied to every message before it reaches the log file or the console, so
  * neither sink receives clear-text secrets or unbounded network data.
  */
+// How much raw input the regex chain below is allowed to scan before a final
+// truncation to MAX_LOG_MESSAGE_LENGTH. A multiple of MAX_LOG_MESSAGE_LENGTH,
+// not 1:1, because most patterns below SHRINK text (a 64-char secret becomes
+// "[REDACTED]"), so more than `keep` raw characters can be needed to fully
+// populate the final truncated output. Nothing past this point can ever
+// survive into the visible output regardless, so skipping it is free — this
+// is what bounds redactSecrets() to O(MAX_LOG_MESSAGE_LENGTH) instead of
+// O(input length) on multi-megabyte scraped payloads.
+const REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
+
 export function redactSecrets(message: string): string {
   // Redact BEFORE truncating. Every pattern below needs to see a secret in
   // full to match it (e.g. LONG_HEX_SECRET_PATTERN requires 32+ contiguous
@@ -140,7 +150,8 @@ export function redactSecrets(message: string): string {
   // whatever fragment survives the cut (e.g. the first 20 chars of a 64-hex
   // browser auth secret) too short for any pattern to recognize, so it was
   // written out in the clear right before the "…[truncated N chars]" marker.
-  let out = message;
+  const rawLength = message.length;
+  let out = rawLength > REDACT_SCAN_LENGTH ? message.slice(0, REDACT_SCAN_LENGTH) : message;
   out = out.replace(ANSI_PATTERN, '');
   out = out.replace(URL_CREDENTIALS_PATTERN, '$1[REDACTED]@');
   // Redact whole-token formats BEFORE the key/value pass: the KV value class
@@ -172,7 +183,7 @@ export function redactSecrets(message: string): string {
     if (lastKeptUnit >= 0xd800 && lastKeptUnit <= 0xdbff) keep -= 1;
   }
   if (out.length > MAX_LOG_MESSAGE_LENGTH) {
-    out = `${out.slice(0, keep)}…[truncated ${out.length - keep} chars]`;
+    out = `${out.slice(0, keep)}…[truncated ${rawLength - keep} chars]`;
   }
   return out;
 }

package/src/utils/text-utils.ts

@@ -188,8 +188,12 @@ export function formatDuration(ms: number): string {
   if (ms < 1000) return `${ms}ms`;
   const seconds = ms / 1000;
   if (seconds < 60) return `${seconds.toFixed(1)}s`;
-  const minutes = Math.floor(seconds / 60);
-  const remainingSeconds = Math.round(seconds % 60);
+  // Round the total first, then derive minutes/seconds from that integer —
+  // rounding remainingSeconds independently of minutes let e.g. 59.6s round up
+  // to a nonsensical "Xm 60s" instead of rolling over to the next minute.
+  const totalSeconds = Math.round(seconds);
+  const minutes = Math.floor(totalSeconds / 60);
+  const remainingSeconds = totalSeconds % 60;
   if (minutes < 60) return `${minutes}m ${remainingSeconds}s`;
   const hours = Math.floor(minutes / 60);
   const remainingMinutes = minutes % 60;

package/src/youtube/potoken.ts

@@ -42,6 +42,7 @@
  */
 
 import { logger } from '../logger.ts';
+import { safeUnref } from '../utils/safe-unref.ts';
 import { metrics } from '../utils/metrics.ts';
 
 /**
@@ -76,6 +77,15 @@ function describeError(error: unknown): string {
 // Module-level mutex: serialize all globalThis mutation across concurrent callers.
 let mintChain: Promise<unknown> = Promise.resolve();
 
+// How long the mutex waits for a straggling doMint() before force-releasing
+// the chain for the next caller. doMint() awaits non-fetch operations with no
+// abort signal (interpreter eval, BotGuard VM execution against a
+// hostile/malformed attestation script) that could in principle hang forever;
+// without this bound, a single wedged call would permanently break YouTube
+// transcript fetching for the rest of the process. Mirrors the hard-release
+// timer on the browser page-creation mutex in thread-worker-messaging.ts.
+const MINT_HARD_RELEASE_MS = 5 * 60 * 1000;
+
 /**
  * Mint a session-bound token (for `identifiers[0]`, the visitorData) plus one
  * content-bound token per remaining identifier (the video IDs), all from a
@@ -90,8 +100,22 @@ export async function mintPoTokens(
 ): Promise<Map<string, string>> {
   // Chain on the mutex so only one bridged section runs at a time.
   const run = mintChain.then(() => doMint(identifiers, opts), () => doMint(identifiers, opts));
-  // Keep the chain alive regardless of this call's success/failure.
-  mintChain = run.then(() => undefined, () => undefined);
+  // Keep the chain alive regardless of this call's success/failure, but bound
+  // how long the NEXT caller waits on it: if `run` never settles, force the
+  // chain open after the hard timeout rather than wedging every future
+  // mintPoTokens() call behind it forever. The abandoned `run` may still
+  // mutate globalThis in the background after this — an accepted trade-off
+  // in the pathological case, same as the sibling browser-worker fix.
+  const settled = run.then(() => undefined, () => undefined);
+  let hardTimer: NodeJS.Timeout;
+  const hardRelease = new Promise<void>(resolve => {
+    hardTimer = setTimeout(() => {
+      logger.warn('[youtube] potoken mint mutex force-released — doMint() did not settle within the hard timeout');
+      resolve();
+    }, MINT_HARD_RELEASE_MS);
+    safeUnref(hardTimer);
+  });
+  mintChain = Promise.race([settled, hardRelease]).finally(() => clearTimeout(hardTimer));
   return run;
 }
 

package/src/youtube/transcript-client.ts

@@ -20,6 +20,7 @@
 import { withTimeout, retryWithBackoff, createTimeoutSignal } from '../web-research/retry-utils.ts';
 import { CircuitBreaker } from '../utils/circuit-breaker.ts';
 import { logger } from '../logger.ts';
+import { redactSecrets } from '../utils/log-utils.ts';
 import { metrics } from '../utils/metrics.ts';
 import { readTextCapped } from '../utils/http-body.ts';
 import { mintPoTokens } from './potoken.ts';
@@ -355,8 +356,10 @@ function parseJson3(body: string): string {
     // Log the real cause: an unparseable body is NOT necessarily an empty
     // bot-protection response (the caller's default diagnosis) — it can be an HTML
     // interstitial or a response-shape change. A short snippet disambiguates without
-    // dumping a huge/again-sensitive body.
-    logger.debug(`[youtube] timedtext body was not valid json3 (first 120 chars): ${body.slice(0, 120)}`);
+    // dumping a huge/again-sensitive body. Redact BEFORE truncating to 120 chars —
+    // slicing first can cut a secret-shaped token mid-way, leaving a fragment too
+    // short for redactSecrets' whole-token patterns to recognize.
+    logger.debug(`[youtube] timedtext body was not valid json3 (first 120 chars): ${redactSecrets(body).slice(0, 120)}`);
     return '';
   }
   const events = (parsed as { events?: unknown[] }).events;