@lincoln504/pi-research 1.3.4 → 1.3.6

package/docs/CHANGELOG.md

@@ -5,6 +5,60 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.6] - 2026-08-10
+
+An independent fresh-eyes review of the entire 1.3.4→1.3.5 diff — the previous
+release's own fixes had only ever been reviewed by their author. It found seven
+further defects, several in the exact hard-release-timer and redaction-boundary
+patterns 1.3.5 introduced. Every fix below is covered by a regression test
+confirmed (via a local revert-and-rerun) to fail against the pre-fix code.
+
+### Fixed
+
+- **The page-creation and PoToken-mint hard-release timers (new in 1.3.5) could still let two calls race.** Both mutexes force-release after a 5-minute bound so a truly wedged call can't livelock the queue forever — but the bound has no way to tell "permanently hung" apart from "just very slow." A call that resolves a moment after the hard release fires was already let straight through to the next queued caller, who then ran its own `newPage()`/`doMint()` concurrently with the still-in-flight first one: the exact race each mutex exists to prevent (Playwright/Firefox deadlock on concurrent `newPage()`; corrupted `globalThis.window`/`document`/`navigator` from two overlapping bridge/unbridge pairs). Both now mark the wedged resource (the browser context; the whole PoToken minter, since `globalThis` is process-global) and reject further calls against it fast — no second `newPage()`/`doMint()` call — until the original stuck call actually settles.
+- **`redactSecrets()`'s own cost-bounding pre-slice (new in 1.3.5) could itself cut a secret in half.** The 4×`MAX_LOG_MESSAGE_LENGTH` pre-slice added to bound redaction's cost on huge inputs runs before any pattern sees the text — the same class of mid-token truncation the truncate-before-redact fix (1.3.4) closed at the *final* boundary, just reopened at this new earlier one. A secret straddling that cut, in a message dense enough with other redactable content that the cut point's post-redaction position falls inside the final visible window, leaked its un-redacted fragment. The slice boundary now extends forward past any run of token-shaped characters (bounded to 2KB extra) so it never lands mid-secret.
+- **`fs.chmodSync` right after the new `O_NOFOLLOW`-hardened `touchOwnerOnly()` (1.3.5) still followed symlinks.** The O_NOFOLLOW open correctly refused to write through a symlink planted at the log path, but the very next line re-stamped the file's mode with a plain, path-based `chmodSync` — which happily dereferences a symlink and silently chmods whatever it points at, undoing the hardening one line later. `touchOwnerOnly()` now stamps the mode itself via `fchmodSync` on the same already-open, already-verified file descriptor, and the separate path-based chmod calls are gone.
+- **The truncation-count in a redacted log message could go negative.** 1.3.5 switched the reported "truncated N chars" count to the pre-redaction raw length so it would reflect content discarded by the earlier cost-bounding slice — but several redaction patterns *expand* text (`key=1` → `key=[REDACTED]`), so a short, redaction-dense message could end up with a post-redaction length exceeding the raw length, making the subtraction negative and printing the literal `…[truncated -1 chars]`. Now takes the larger of the raw and post-redaction lengths.
+- **`reconcileSkillInstalls()`'s new (1.3.5) symlink-repoint copy fallback never swept its own staging leftovers.** The fallback stages a fresh copy into a dot-prefixed temp dir before an atomic rename into place; a process killed between the copy succeeding and the rename could leave that temp dir behind. The sibling copy-refresh branch already sweeps its own leftovers before every attempt — this branch didn't, and since a crash also frequently makes the manifest entry look deleted (pruning it before the branch runs again), repeated failures could accumulate orphaned staging directories with nothing ever revisiting them. Now sweeps unconditionally on every visit to a symlink entry, independent of whether that entry survives.
+- **The page-creation mutex's hard-release timer (1.3.5) was never unref'd**, unlike the identical PoToken-mint timer in the same release. A bare `setTimeout` keeps the event loop alive for up to 5 minutes; any shutdown path that doesn't route through the cluster worker's forced `process.exit(0)` would hang waiting on it instead of exiting promptly. Now unref'd like its sibling.
+
+## [1.3.5] - 2026-08-10
+
+Two rounds of workflow-backed code review on the clean 1.3.4 tree (high-effort,
+then a wider max-effort pass explicitly told not to re-find the first round's
+results), followed by a triage of every open CodeQL alert. Every fix below is
+covered by a passing regression test; two bugs (the OSV null-CWE crash and the
+duration-formatter rounding bug) had no prior test coverage at all, so tests
+were added alongside the fixes.
+
+### Fixed
+
+- **The browser page-creation mutex could still hang forever.** 1.3.4 fixed the mutex releasing too early (before `newPage()` itself settled). That fix had no bound of its own: if `newPage()` never settles at all — not just slow, but genuinely wedged — the lock is now held forever, livelocking every future `createPageSafe()` call on that worker thread. Added a 5-minute hard-release timer that force-releases the lock if `newPage()` still hasn't settled, independent of the settlement-based release for the normal case.
+- **`reconcileSkillInstalls()`'s stale-symlink re-point had no copy fallback.** The sibling `installSkill()` already falls back to a copy when `symlinkSync` fails after the old link is removed (a Windows cross-volume junction failure, most commonly). The periodic reconciler's structurally identical re-point lacked that fallback, so a `symlinkSync` failure there silently left the manifest claiming a skill was installed after the file was already deleted from disk. Added the same fallback — and staged the copy into a dot-prefixed temp dir with an atomic rename into place, so a copy that fails partway (disk full, interrupted process) can never leave an unrecognized, SKILL.md-less partial directory orphaned at the skill's path.
+- **The scrape tool's own gating used a different config than its actual fetch.** `createScrapeTool()` resolves `config = options.config || getConfig(options.ctx.cwd)` and uses that resolved value for every batching/gating decision (knowledge-store mode, concurrency caps, token-fraction limits, pool capacity) — except the real `scrape()` call, which passed the raw, possibly-`undefined` `options.config`. A caller that omits `config` (the parameter is typed optional) got gating computed for one cwd while the actual network fetch silently fell back to whatever `getConfig()` resolves for `process.cwd()` — a different worker/pool concurrency or provider config than what the visible gating decision assumed, with nothing logged to indicate the mismatch.
+- **`redactSecrets()`'s truncate-before-redact fix (1.3.4) removed its own cost bound.** Moving truncation after the full regex chain (correctly, to stop a secret leaking at the truncation boundary) also removed the implicit cap that used to limit those ~10 sequential regex passes to `MAX_LOG_MESSAGE_LENGTH` characters regardless of input size. A verbose/debug log call carrying a multi-megabyte scraped payload now ran the whole chain across the untruncated string. Pre-slices to 4× `MAX_LOG_MESSAGE_LENGTH` before redacting — generous enough that no in-bounds secret is ever missed (patterns only shrink text, never expand it, and content beyond that window can never survive into the final truncated output anyway) — and reports the truncation count against the true raw length instead of the post-redaction length.
+- **Six more truncate-before-redact / unredacted-error-text sites, the same bug class 1.3.4 fixed at five others.** `scrape.ts`'s and `research-tool-definition.ts`'s error-catch paths returned raw `error.message`/`String(error)` directly as tool output; `browser-client.ts`'s JSON-parse-failure handler embedded a raw 200-char response preview in the thrown `Error`; `transcript-client.ts`'s debug log sliced YouTube's raw `timedtext` response to 120 chars before redaction instead of after. Each of these can carry a credential (a failing URL's userinfo, an echoed `Authorization` header, an embedded token in a malformed page) into a log file, a thrown error, or the agent's own conversation/report output. All six now redact before truncating or returning.
+- **A `null` entry in an OSV/GHSA advisory's `database_specific.cwe` crashed the entire lookup.** `typeof cwe === 'object'` is `true` for `null`, so `mapOsvItemToVulnerability` threw on `(null).id` — and since it runs uncaught inside `osv-client.ts`'s per-term fetch (only wrapped in `Promise.allSettled`), one malformed record silently discarded every vulnerability found for that search term, replaced by a generic failure note. Added the missing `cwe !== null` check.
+- **The YouTube PoToken mint mutex had the same unbounded-hang exposure as the browser mutex above.** `doMint()` awaits BotGuard VM execution and interpreter eval against a hostile/malformed attestation script from Google, neither of which take an abort signal — if either hangs instead of rejecting, the module-level `mintChain` mutex never settles, and every subsequent `mintPoTokens()` call across all researchers queues behind it forever. Added the same style of hard-release bound as the browser mutex fix, via a `Promise.race` against a 5-minute (unref'd) timeout.
+- **Three timeout env vars silently became near-zero on a malformed value.** `PI_RESEARCH_SEARCH_TIMEOUT_MS`, `PI_RESEARCH_SCRAPE_TIMEOUT_MS`, and `PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS` were read with `parseInt()`, which truncates at the first non-digit instead of rejecting the value — `parseInt('1m', 10)` is `1`, not `NaN`, so a plausible duration-shorthand typo silently became a 1ms browser timeout instead of falling back to the default, failing every search/scrape/health-check on that worker for the rest of its life with no warning. Replaced with a shared helper using `Number()` (which rejects trailing garbage) plus a warning log on an invalid value.
+- **`formatDuration()` could render the nonsensical "1m 60s".** Rounding `remainingSeconds` independently of `minutes` let a value like 119,601ms (1m 59.601s) round its seconds component up to 60 without rolling into the next minute. Now rounds the total seconds first and derives minutes/seconds from that integer.
+- **A theoretical symlink race on log rotation's file reopen.** After renaming the live log aside during rotation (or unlinking it during `clearLogs`), the code reopens the same path with `fs.openSync(path, 'a', 0o600)` to recreate it owner-only — a window in which a local attacker with write access to the log directory could plant a symlink at that path, causing the reopen to follow it and (re)create/chmod an arbitrary file with this process's permissions. Added `O_NOFOLLOW` to the reopen (a no-op on Windows, where the flag isn't defined) so it refuses to follow a symlink instead.
+- **Scraping a YouTube watch page could play audible audio through the host's speakers.** The general `scrape` tool drives a real stealth Firefox (Camoufox) — unlike the dedicated `youtube_transcript` tool, which only calls YouTube's API (`youtubei.js`/`timedtext`) and never touches a browser. A researcher agent scraping a `youtube.com` watch-page URL through the ordinary `scrape` tool hit YouTube's default video autoplay with no engine-level mute configured, so the browser process played sound through whatever audio sink it could reach. Reported on Linux, where both true-headless and the Xvfb-backed `'virtual'` mode keep a live PulseAudio/PipeWire/ALSA sink reachable — but headless Firefox is not guaranteed silent on macOS/Windows either, so the fix (`media.volume_scale: '0.0'` plus `media.autoplay.default: 5` in the shared Camoufox launch options) is unconditional across platforms and headless modes, not Linux-specific.
+
+### Reviewed, not changed
+
+A full CodeQL alert triage found 12 of 13 open alerts to be false positives or out-of-scope for a code fix, each verified individually rather than dismissed on assumption:
+- Two `js/missing-await` alerts in `embedder.ts` are reference-identity checks (`this.recoveryPromise === recovery`) misread as a forgotten `await` — awaiting either side would break the logic.
+- A `js/file-system-race` alert in `file-lock-service.ts` is on code that already reopens with the `'wx'` exclusive-create flag specifically to make the check-then-open atomic.
+- A `js/insecure-temporary-file` alert in `browser/cleanup-utils.ts` is a read-only liveness probe on a Firefox lock file, not a file creation.
+- Six alerts (`js/file-system-race`, `js/insecure-temporary-file`) are all in test files creating throwaway, randomly-named fixtures under `os.tmpdir()` for the test's own private use.
+- One (`js/unused-local-variable`) was a genuine unused test import; removed.
+
+Patch, not minor: every fix is an internal correctness/security/robustness
+change with no change to pi-research's own CLI, tool, or SDK contract —
+matching this project's established precedent for audit-round releases
+(1.3.1 through 1.3.4).
+
 ## [1.3.4] - 2026-08-09
 
 Two rounds on the clean 1.3.3 tree: a full-tree re-audit (10 independent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lincoln504/pi-research",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "description": "A set of web research tools (search, scrape, and others) and research agent system that uses them safely and efficiently.",
   "type": "module",
   "private": false,

package/skills/pi-research/SKILL.md

@@ -2,7 +2,7 @@
 name: pi-research
 description: "Multi-agent web research for any coding agent. Use for anything requiring current information from the internet — news, trends, product/service/company facts, statistics, people, places, events, APIs, library behavior, or 'what is X / how does X work' questions. Also use to search a local knowledge store of previously researched findings before doing live research. Powered by the pi-research engine (search, stealth scraping, security databases, Stack Exchange). Not for reading local files, running project commands, or analyzing this repository's own source."
 license: MIT
-metadata: { "author": "Lincoln Deen", "version": "1.3.4", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
+metadata: { "author": "Lincoln Deen", "version": "1.3.6", "package": "@lincoln504/pi-research", "engine": "pi-research-sdk", "openclaw": { "requires": { "bins": ["node"] } } }
 allowed-tools: Bash(node:*)
 ---
 

package/src/infrastructure/browser/browser-client.ts

@@ -12,6 +12,7 @@ import type { SearchResult } from '../../web-research/types.ts';
 import type { IScheduler } from '../../core/interfaces/scheduler-interfaces.ts';
 import { logger } from '../../logger.ts';
 import { errorTracker } from '../../utils/error-tracker.ts';
+import { redactSecrets } from '../../utils/log-utils.ts';
 import { Utf8Body } from '../../utils/http-body.ts';
 import { getClientAgent } from './client-agent.ts';
 import type { NodeError } from '../../types/index.ts';
@@ -200,8 +201,10 @@ export class BrowserClient implements IScheduler {
                             resolve(parsed);
                         }
                     } catch (_e) {
-                        // FIX (#23): Truncate response body in error to prevent data leakage
-                        const raw = collected.toString();
+                        // FIX (#23): Truncate response body in error to prevent data leakage.
+                        // Redact BEFORE truncating — slicing first can cut a secret-shaped
+                        // token mid-way, leaving a fragment too short to be recognized.
+                        const raw = redactSecrets(collected.toString());
                         const preview = raw.length > 200 ? raw.slice(0, 200) + '...' : raw;
                         const error = new Error(`Failed to parse response (status ${res.statusCode}): ${preview}`);
                         errorTracker.trackError(error, {

package/src/infrastructure/browser/thread-worker-browser.ts

@@ -193,6 +193,35 @@ export async function initBrowser(): Promise<void> {
               colorDepth: 24,
               pixelRatio: 1,
             },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              'media.volume_scale': '0.0',
+              'media.autoplay.default': 5,
+            },
           });
           // Guard with a hard timeout. We catch the launchPromise rejection so it
           // doesn't surface as an UnhandledPromiseRejection if it rejects after the

package/src/infrastructure/browser/thread-worker-messaging.ts

@@ -8,6 +8,7 @@ let workerId: string = '';
 
 import { appendFileSync } from 'node:fs';
 import { redactSecrets } from '../../utils/log-utils.ts';
+import { safeUnref } from '../../utils/safe-unref.ts';
 import { MAX_HTML_SIZE, MAX_PDF_SIZE } from '../../web-research/scraper-types.ts';
 
 /**
@@ -16,6 +17,18 @@ import { MAX_HTML_SIZE, MAX_PDF_SIZE } from '../../web-research/scraper-types.ts
  */
 let pageCreationLock = Promise.resolve();
 
+/** How long createPageSafe() waits for a straggling newPage() before force-releasing
+ * the mutex. Must stay well above the 60s soft timeout below — it exists only to
+ * bound the pathological case where newPage() never settles at all (see comment below). */
+const PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1000;
+
+/** Set when a hard-release fires while its newPage() call is still pending —
+ * identifies the context that call was creating a page on. A concurrent
+ * newPage() on that SAME context is exactly what pageCreationLock exists to
+ * prevent, so any call for this context is rejected fast (without ever
+ * calling newPage()) until the stuck call actually settles and clears this. */
+let wedgedContext: any = null;
+
 /** Exported for unit testing of the page-creation mutex's timeout behavior. */
 export async function createPageSafe(context: any): Promise<any> {
   let release!: () => void;
@@ -24,17 +37,47 @@ export async function createPageSafe(context: any): Promise<any> {
   pageCreationLock = currentLock.then(() => nextLock);
 
   await currentLock;
+  if (context === wedgedContext) {
+    // Release immediately so the queue keeps flowing for OTHER contexts (or
+    // this one, once the stuck call clears wedgedContext) instead of stalling
+    // every future caller behind the still-pending call.
+    release();
+    throw new Error('Browser context is wedged from a prior page-creation call that never settled; a new browser context is required.');
+  }
   const pagePromise = context.newPage();
-  // Release the mutex only once newPage() itself has actually settled — NOT when
-  // the timeout race below settles. Releasing in an outer `finally` (the old
-  // shape) fired as soon as the 60s timeout won the race, while newPage() was
-  // still pending in the background — so the NEXT queued caller started its OWN
+  // Release the mutex once newPage() itself has actually settled — NOT when the
+  // timeout race below settles. Releasing in an outer `finally` (the old shape)
+  // fired as soon as the 60s timeout won the race, while newPage() was still
+  // pending in the background — so the NEXT queued caller started its OWN
   // newPage() concurrently with this still-unsettled one, exactly the concurrent-
   // newPage() scenario this lock exists to prevent (see the comment above), and
   // it happens precisely when the browser is already under the stress that
   // causes 60s+ page-creation stalls in the first place. Attached before the
   // race starts so it's independent of which branch below returns/throws.
-  pagePromise.then(release, release);
+  //
+  // A hard release timer bounds the case where newPage() never settles at all
+  // (rather than just being slow) — without it, a single wedged newPage() call
+  // would hold this lock forever and livelock every future createPageSafe() call
+  // on this worker thread. It marks the context wedged rather than letting the
+  // next caller straight through: a merely-slow (not hung) newPage() would
+  // otherwise still be in flight when a new one starts on the same context.
+  let hardReleased = false;
+  const releaseOnce = (): void => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
+    release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile('WARN', '[ThreadWorker] page-creation mutex force-released — newPage() did not settle within the hard timeout');
+    wedgedContext = context;
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  safeUnref(hardReleaseTimer);
+  pagePromise.then(
+    () => { if (wedgedContext === context) wedgedContext = null; releaseOnce(); },
+    () => { if (wedgedContext === context) wedgedContext = null; releaseOnce(); },
+  );
   pagePromise.catch((err: Error) => logToDebugFile('DEBUG', `[ThreadWorker] Background page creation rejection: ${err.message}`));
 
   let timeoutId: NodeJS.Timeout | undefined;
@@ -63,6 +106,22 @@ export function setWorkerId(id: string): void {
   workerId = id;
 }
 
+/**
+ * Parse a millisecond timeout from an env var. Uses Number() rather than
+ * parseInt() so trailing garbage is REJECTED rather than silently truncated —
+ * parseInt('1m', 10) === 1, which turned a plausible duration-shorthand typo
+ * into a near-instant timeout instead of falling back to the default.
+ */
+function parseTimeoutMs(envVar: string | undefined, def: number): number {
+  if (envVar === undefined || envVar.trim() === '') return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile('WARN', `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
+
 /**
  * Log to debug file
  */
@@ -205,7 +264,7 @@ export async function executeSearchTask(
   query: string
 ): Promise<{ results: any[]; jitter: number }> {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env['PI_RESEARCH_SEARCH_TIMEOUT_MS'] || '45000', 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env['PI_RESEARCH_SEARCH_TIMEOUT_MS'], 45000);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
 
@@ -322,7 +381,7 @@ export async function executeScrapeTask(
   signal?: AbortSignal
 ): Promise<{ contentType: string; html?: string; bufferB64?: string; jitter: number }> {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env['PI_RESEARCH_SCRAPE_TIMEOUT_MS'] || '15000', 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env['PI_RESEARCH_SCRAPE_TIMEOUT_MS'], 15000);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
 
@@ -666,7 +725,7 @@ export async function executeHealthCheck(
 ): Promise<{ success: boolean; navMs: number }> {
   // Nav timeout: read from env (passed through getBrowserEnv), floor at 10s.
   // The outer BrowserTaskScheduler.runHealthCheck() has its own 45s hard deadline.
-  const configuredMs = parseInt(process.env['PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS'] || '0', 10);
+  const configuredMs = parseTimeoutMs(process.env['PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS'], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(10000, configuredMs) : 10000;
 
   if (initMs > 3000) {

package/src/infrastructure/browser/thread-worker.mjs

@@ -45,7 +45,15 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let out = message;
+  const rawLength = message.length;
+  let scanEnd = REDACT_SCAN_LENGTH;
+  if (rawLength > scanEnd) {
+    const extensionLimit = Math.min(rawLength, scanEnd + REDACT_SCAN_EXTENSION_MAX);
+    while (scanEnd < extensionLimit && TOKEN_CHAR_PATTERN.test(message.charAt(scanEnd))) {
+      scanEnd += 1;
+    }
+  }
+  let out = rawLength > scanEnd ? message.slice(0, scanEnd) : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -62,14 +70,14 @@ function redactSecrets(message) {
     if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
   }
   if (out.length > MAX_LOG_MESSAGE_LENGTH) {
-    out = `${out.slice(0, keep)}\u2026[truncated ${out.length - keep} chars]`;
+    out = `${out.slice(0, keep)}\u2026[truncated ${Math.max(rawLength, out.length) - keep} chars]`;
   }
   return out;
 }
 function stripTerminalEscapes(message) {
   return message.replace(TERMINAL_ESCAPE_PATTERN, "").replace(CONTROL_CHARS_PATTERN, " ");
 }
-var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, TERMINAL_ESCAPE_PATTERN;
+var logContextStorage, MAX_LOG_MESSAGE_LENGTH, ANSI_PATTERN, URL_CREDENTIALS_PATTERN, COOKIE_HEADER_PATTERN, SENSITIVE_KV_PATTERN, KNOWN_TOKEN_PATTERN, JWT_PATTERN, BASIC_AUTH_PATTERN, BEARER_AUTH_PATTERN, PROVIDER_TOKEN_PATTERN, LONG_HEX_SECRET_PATTERN, CONTROL_CHARS_PATTERN, REDACT_SCAN_LENGTH, TOKEN_CHAR_PATTERN, REDACT_SCAN_EXTENSION_MAX, TERMINAL_ESCAPE_PATTERN;
 var init_log_utils = __esm({
   "src/utils/log-utils.ts"() {
     "use strict";
@@ -86,6 +94,9 @@ var init_log_utils = __esm({
     PROVIDER_TOKEN_PATTERN = /\b(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]{20,}|[sp]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g;
     LONG_HEX_SECRET_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
     CONTROL_CHARS_PATTERN = /[\x00-\x1f\x7f]/g;
+    REDACT_SCAN_LENGTH = MAX_LOG_MESSAGE_LENGTH * 4;
+    TOKEN_CHAR_PATTERN = /[A-Za-z0-9_\-./+=]/;
+    REDACT_SCAN_EXTENSION_MAX = 2048;
     TERMINAL_ESCAPE_PATTERN = new RegExp(
       "\\x1b\\[[0-?]*[ -/]*[@-~]?|\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)?|\\x1b[PX^_][^\\x1b]*(?:\\x1b\\\\)?|\\x1b.?",
       "g"
@@ -357,10 +368,26 @@ var init_error_tracker = __esm({
 // src/utils/log-rotation.ts
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
-var LogRotation;
+function touchOwnerOnly(filePath, mode) {
+  let fd;
+  try {
+    fd = fs2.openSync(filePath, APPEND_CREATE_NOFOLLOW_FLAGS, mode);
+    fs2.fchmodSync(fd, mode);
+  } catch {
+  } finally {
+    if (fd !== void 0) {
+      try {
+        fs2.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+var APPEND_CREATE_NOFOLLOW_FLAGS, LogRotation;
 var init_log_rotation = __esm({
   "src/utils/log-rotation.ts"() {
     "use strict";
+    APPEND_CREATE_NOFOLLOW_FLAGS = fs2.constants.O_WRONLY | fs2.constants.O_APPEND | fs2.constants.O_CREAT | (typeof fs2.constants.O_NOFOLLOW === "number" ? fs2.constants.O_NOFOLLOW : 0);
     LogRotation = class {
       MAX_LOG_SIZE = 10 * 1024 * 1024;
       // 10MB max file size
@@ -378,14 +405,7 @@ var init_log_rotation = __esm({
         try {
           if (fs2.existsSync(logFile)) {
             fs2.unlinkSync(logFile);
-            try {
-              fs2.closeSync(fs2.openSync(logFile, "a", 384));
-            } catch {
-            }
-            try {
-              fs2.chmodSync(logFile, 384);
-            } catch {
-            }
+            touchOwnerOnly(logFile, 384);
           }
           const files = fs2.readdirSync(logDir);
           const baseName = path2.basename(logFile);
@@ -421,14 +441,7 @@ var init_log_rotation = __esm({
             this.logger.log("[Logger] Log rotation skipped (rename failed; file likely in use):", renameErr);
             return;
           }
-          try {
-            fs2.closeSync(fs2.openSync(logFile, "a", 384));
-          } catch {
-          }
-          try {
-            fs2.chmodSync(logFile, 384);
-          } catch {
-          }
+          touchOwnerOnly(logFile, 384);
           try {
             const files = fs2.readdirSync(logDir);
             const logFiles = files.filter((f) => f.startsWith(path2.basename(logFile)) && f !== path2.basename(logFile)).sort();
@@ -1917,10 +1930,21 @@ import { platform as platform2 } from "node:os";
 
 // src/infrastructure/browser/thread-worker-messaging.ts
 init_log_utils();
-init_scraper_types();
 import { appendFileSync as appendFileSync2 } from "node:fs";
+
+// src/utils/safe-unref.ts
+function safeUnref(timer) {
+  if (timer && typeof timer.unref === "function") {
+    timer.unref();
+  }
+}
+
+// src/infrastructure/browser/thread-worker-messaging.ts
+init_scraper_types();
 var workerId2 = "";
 var pageCreationLock = Promise.resolve();
+var PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1e3;
+var wedgedContext = null;
 async function createPageSafe(context2) {
   let release;
   const nextLock = new Promise((resolve) => {
@@ -1929,8 +1953,34 @@ async function createPageSafe(context2) {
   const currentLock = pageCreationLock;
   pageCreationLock = currentLock.then(() => nextLock);
   await currentLock;
+  if (context2 === wedgedContext) {
+    release();
+    throw new Error("Browser context is wedged from a prior page-creation call that never settled; a new browser context is required.");
+  }
   const pagePromise = context2.newPage();
-  pagePromise.then(release, release);
+  let hardReleased = false;
+  const releaseOnce = () => {
+    if (hardReleased) return;
+    hardReleased = true;
+    clearTimeout(hardReleaseTimer);
+    release();
+  };
+  const hardReleaseTimer = setTimeout(() => {
+    logToDebugFile2("WARN", "[ThreadWorker] page-creation mutex force-released \u2014 newPage() did not settle within the hard timeout");
+    wedgedContext = context2;
+    releaseOnce();
+  }, PAGE_CREATION_HARD_RELEASE_MS);
+  safeUnref(hardReleaseTimer);
+  pagePromise.then(
+    () => {
+      if (wedgedContext === context2) wedgedContext = null;
+      releaseOnce();
+    },
+    () => {
+      if (wedgedContext === context2) wedgedContext = null;
+      releaseOnce();
+    }
+  );
   pagePromise.catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Background page creation rejection: ${err.message}`));
   let timeoutId;
   try {
@@ -1957,6 +2007,15 @@ async function createPageSafe(context2) {
 function setWorkerId2(id) {
   workerId2 = id;
 }
+function parseTimeoutMs(envVar, def) {
+  if (envVar === void 0 || envVar.trim() === "") return def;
+  const n = Number(envVar.trim());
+  if (!Number.isFinite(n) || n < 0) {
+    logToDebugFile2("WARN", `[ThreadWorker] Invalid timeout value "${envVar}", using default: ${def}ms`);
+    return def;
+  }
+  return n;
+}
 function logToDebugFile2(level, ...args) {
   const logFile = process.env["PI_RESEARCH_LOG_FILE"];
   if (!logFile) return;
@@ -2066,7 +2125,7 @@ async function extractSearchResults(page) {
 }
 async function executeSearchTask(_context, query) {
   const page = await createPageSafe(_context);
-  const SEARCH_TIMEOUT = parseInt(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"] || "45000", 10);
+  const SEARCH_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SEARCH_TIMEOUT_MS"], 45e3);
   page.setDefaultTimeout(SEARCH_TIMEOUT);
   page.setDefaultNavigationTimeout(SEARCH_TIMEOUT);
   try {
@@ -2135,7 +2194,7 @@ function seedSubresourceVerdict(validatedUrl) {
 }
 async function executeScrapeTask(_context, url, signal) {
   const page = await createPageSafe(_context);
-  const SCRAPE_TIMEOUT = parseInt(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"] || "15000", 10);
+  const SCRAPE_TIMEOUT = parseTimeoutMs(process.env["PI_RESEARCH_SCRAPE_TIMEOUT_MS"], 15e3);
   page.setDefaultTimeout(SCRAPE_TIMEOUT);
   page.setDefaultNavigationTimeout(SCRAPE_TIMEOUT);
   const onAbort = () => {
@@ -2301,7 +2360,7 @@ async function executeHealthCheckAttempt(_context, navTimeoutMs, url = HEALTH_PR
   }
 }
 async function executeHealthCheck(_context, initMs) {
-  const configuredMs = parseInt(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"] || "0", 10);
+  const configuredMs = parseTimeoutMs(process.env["PI_RESEARCH_HEALTH_CHECK_TIMEOUT_MS"], 0);
   const HEALTH_TIMEOUT = configuredMs > 0 ? Math.max(1e4, configuredMs) : 1e4;
   if (initMs > 3e3) {
     logToDebugFile2("WARN", `[Worker-${workerId2}] Browser init was slow: ${initMs}ms \u2014 leaving less headroom for DDG navigation.`);
@@ -2594,6 +2653,35 @@ async function initBrowser() {
               height: 1080,
               colorDepth: 24,
               pixelRatio: 1
+            },
+            // Mute all audio output at the engine level. The general scrape
+            // path drives a REAL Firefox (Camoufox), and a researcher can be
+            // pointed at a youtube.com watch page through the ordinary
+            // `scrape` tool (as opposed to the dedicated `youtube_transcript`
+            // tool, which never touches the browser) — YouTube watch pages
+            // autoplay video with sound, so without an explicit mute the
+            // process plays audible audio through the host's sound device.
+            //
+            // media.volume_scale forces the browser's effective output
+            // volume to 0 regardless of per-tab mute/autoplay state or any
+            // page script re-enabling audio — the most reliable, engine-level
+            // mute available for headless Firefox/Camoufox (the same pref
+            // Selenium/Playwright Firefox test grids use to silence CI runs).
+            // media.autoplay.default=5 additionally blocks autoplay outright
+            // (belt-and-suspenders; some sites route around the volume scale
+            // via Web Audio gain nodes). Neither pref affects rendering — the
+            // page still loads and paints normally, only the audio output
+            // device is silenced.
+            //
+            // Set on every platform/headless-mode combination, not just
+            // Linux: this was only *observed* on Linux (true headless and
+            // Xvfb-backed 'virtual' mode both retain a real PulseAudio/
+            // PipeWire/ALSA sink for the Firefox process to play through),
+            // but headless Firefox on macOS/Windows is not guaranteed to be
+            // silent either, so the mute is applied unconditionally.
+            firefox_user_prefs: {
+              "media.volume_scale": "0.0",
+              "media.autoplay.default": 5
             }
           });
           launchPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser launch rejection: ${err.message}`));

package/src/security/osv-types.ts

@@ -237,7 +237,7 @@ export function mapOsvItemToVulnerability(item: OsvVulnerability): Vulnerability
       for (const cwe of item.database_specific.cwe) {
         if (typeof cwe === 'string') {
           cwes.push(cwe);
-        } else if (typeof cwe === 'object' && typeof (cwe as { id?: string }).id === 'string') {
+        } else if (typeof cwe === 'object' && cwe !== null && typeof (cwe as { id?: string }).id === 'string') {
           cwes.push((cwe as { id: string }).id);
         }
       }

package/src/skill-install/skill-installer.ts

@@ -631,6 +631,22 @@ export function reconcileSkillInstalls(opts: InstallOptions = {}): ReconcileResu
       continue;
     }
 
+    // Sweep any `.{base}.new-*` staging leftover from a previous crashed
+    // symlink-repoint attempt at this path, unconditionally — a process kill
+    // between copyDir succeeding and the final renameSync below can leave one
+    // behind, and this branch is not guaranteed to run again for the same
+    // entry (a crash also often leaves isSymlinkPresent() false, pruning the
+    // entry on the very next line before it would otherwise get a chance to).
+    const dir = path.dirname(e.path);
+    const base = path.basename(e.path);
+    try {
+      for (const name of fs.readdirSync(dir)) {
+        if (name.startsWith(`.${base}.new-`)) {
+          fs.rmSync(path.join(dir, name), { recursive: true, force: true });
+        }
+      }
+    } catch { /* hygiene only */ }
+
     // Link the user deleted by hand — nothing on disk; drop the stale entry.
     if (!isSymlinkPresent(e.path)) { result.pruned.push(e.path); continue; }
 
@@ -647,10 +663,36 @@ export function reconcileSkillInstalls(opts: InstallOptions = {}): ReconcileResu
         // Re-point to the current package source (handles update/reinstall).
         try {
           fs.unlinkSync(e.path);
+        } catch { keep.push(e); continue; /* old link untouched; retry next startup */ }
+        try {
           fs.symlinkSync(source, e.path, process.platform === 'win32' ? 'junction' : 'dir');
           keep.push({ ...e, type: 'symlink', source });
           result.repointed.push(e.path);
-        } catch { keep.push(e); /* leave entry; retry next startup */ }
+        } catch {
+          // The old link is already gone at this point (unlinkSync above
+          // succeeded). Mirror installSkill()'s fallback: try a copy rather than
+          // leaving the skill MISSING on disk while the manifest still claims
+          // it's installed (e.g. a Windows cross-volume junction failure).
+          // Stage into a dot-prefixed temp dir and rename into place, same as
+          // the copy-refresh path above — copying directly into e.path left a
+          // partial, SKILL.md-less directory permanently orphaned on disk
+          // (unrecognized by isOwnedCopy) when copyDir failed partway (disk
+          // full, interrupted process).
+          const suffix = crypto.randomBytes(4).toString('hex');
+          const fresh = path.join(dir, `.${base}.new-${suffix}`);
+          try {
+            copyDir(source, fresh);
+            fs.renameSync(fresh, e.path);
+            keep.push({ ...e, type: 'copy', source });
+            result.repointed.push(e.path);
+          } catch {
+            try { fs.rmSync(fresh, { recursive: true, force: true }); } catch { /* best effort */ }
+            // Both the re-point and the copy fallback failed — the skill really
+            // is gone from disk now. Drop the entry instead of leaving the
+            // manifest claiming a missing skill is still installed.
+            result.pruned.push(e.path);
+          }
+        }
       } else if (!targetLive) {
         // Dangling with no resolvable source (package fully removed): remove the
         // dead link and drop the entry so the agent's skills dir stays clean.

package/src/tools/research-tool-definition.ts

@@ -24,6 +24,7 @@ import { ServiceNames } from '../core/service-interfaces.ts';
 import type { IResearchOrchestration, IResearchSynthesisService } from '../core/service-interfaces.ts';
 import { metrics, MetricsRegistry, runWithRunRegistry } from '../utils/metrics.ts';
 import { createResearchRunId, logger, createLogger, isVerboseFromEnv, runWithLogger } from '../logger.ts';
+import { redactSecrets } from '../utils/log-utils.ts';
 import { exportResearchReport, appendExportMessage } from '../utils/research-export.ts';
 import { validateAndSanitizeQuery } from '../utils/input-validation.ts';
 import { validateInitialLinks, MAX_INITIAL_LINKS, MAX_INITIAL_LINK_CHARS } from '../utils/url-utils.ts';
@@ -507,14 +508,14 @@ export function createResearchTool(iface?: ConfigInterface): ToolDefinition {
             return {
                 content: [{
                     type: 'text',
-                    text: `[SYSTEM MESSAGE]: The research operation was halted gracefully because an API rate limit (HTTP 429) was reached. Please inform the user that the operation was stopped due to provider rate limits and they should wait a moment before trying again.\n\nDetails: ${String(error)}`
+                    text: `[SYSTEM MESSAGE]: The research operation was halted gracefully because an API rate limit (HTTP 429) was reached. Please inform the user that the operation was stopped due to provider rate limits and they should wait a moment before trying again.\n\nDetails: ${redactSecrets(String(error))}`
                 }],
                 details: {}
             };
         }
 
         logger.error('[research] run failed', error);
-        return { content: [{ type: 'text', text: `Research failed: ${String(error)}` }], details: {} };
+        return { content: [{ type: 'text', text: `Research failed: ${redactSecrets(String(error))}` }], details: {} };
       } finally {
         // Guarantees panel teardown even when the run fails before the inner
         // research loop is reached (e.g. health-check failure), where the inner