dsh-molbio-tools 0.24.0 → 0.24.1

package/CHANGELOG.md

@@ -10,6 +10,54 @@
   改为按**包名**引用后模块缓存问题随之消失——没有拷贝，也就没有需要保持同步的版本目录。
   下文历史条目里出现的 `vN` 目录保持原样，作为当时的记录。
 
+## [0.24.1] — 2026-11-08（输入边界与数据安全加固；工具数不变）
+
+**不新增工具：工具数保持 64，benchmark 保持 65 题 / 64 覆盖。** 这一版只修“已经在产品里、
+但不会报错的错”。面板包 `0.1.9 → 0.1.10`：两个客户端产物因 `seqio.mjs` /
+`protein-structure.mjs` 的加固改动而重建，按仓库规则必须升版本号，否则会用同一版本发不同字节。
+
+### 1. 数据安全与路径语义
+
+- `molbio_paper_export_bibtex`：自定义 `file` 不以 `.json` 结尾时，旧逻辑把库路径本身当
+  输出路径，BibTeX 会**覆盖文献库**。现在始终派生独立的 `.bib`（`refs.txt` →
+  `refs.txt.bib`），库文件保持不变。
+- 相对路径读取改为按**会话工作区**解析（`sandboxPolicy.resolve(...).workspaceRoot`），
+  不再落到 provider 的 `process.cwd()`；绝对路径行为不变。
+- 文献库/记录库加载时拒绝 `null` 或标量条目，返回带文件名的输入错误，而不是
+  `paperKey()` / `record.name.trim()` 抛出的原始 `TypeError`；协议重命名与新增使用
+  同一条重名规则；`molbio_paper_update` 在标题/URL/PMID 变化后重算派生 id。
+- `molbio_batch_analyze`：显式 `paths` 也受 `max_files` 约束；无法解析的路径变成一条
+  错误行而不是整批失败；glob 先转义反斜杠，`.` 不再被当通配符（`a.fa` 不会匹配
+  `aXfa`）。
+
+### 2. 并发声明与大输入
+
+- 四个总会写默认 SVG 的工具——`molbio_helical_wheel`、`molbio_hydropathy_plot`、
+  `molbio_protein_charge`、`molbio_dotplot`——以及带 `output_path` 的
+  `molbio_fasta_fastq extract` 改为 `safe: false`。旧谓词在 `output_path` 省略时
+  声称并发安全，而默认文件仍会被并发调用互相覆盖。
+- 图表/FASTQ/蛋白剖面不再把用户规模数组展开进 `Math.min(...)`/`Math.max(...)`：
+  200,000 行表格、130,000 条 reads 与长蛋白在文档声明的上限内不再抛 `RangeError`；
+  FASTQ 汇总改为单次流式计数，不再物化全部 Phred 值。
+- `molbio_pubmed_abstract` 的 efetch 传输失败改为具名输入错误，不再让原始异常逃出工具。
+
+### 3. 发布与仓库卫生
+
+- `.github/workflows/test.yml` 增加 `permissions: contents: read`；
+  `.gitignore` 忽略 `.codex-tmp/`。
+- `preset/install.mjs` 校验 `--profile`（字母/数字开头，仅 `._-`），避免 profile 名
+  经 Windows shell 时被当作命令元字符。
+- 同步多处注释里过时的工具数（57/60/62 → 64）。
+
+### 4. 验证与边界
+
+- `npm test` 全绿：smoke 64 工具、benchmark 65 题 / 64 覆盖、`preset-health` 29 行、
+  `release` 13 项；`build/client-bundle.mjs --check` 与 `build/preset-patch.mjs --check`
+  与源一致。
+- 不新增工具、不改 preset 行清单、不改 DSH 基线（0.2.2-rc.1）。
+- `benchmark-changed` 的 POSIX 路径断言在本地沙箱因 Node 无法 spawn `git` 未执行；
+  CI 会执行。这是沙箱限制，不是仓库缺陷。
+
 ## [0.24.0] — 2026-11-05（载体/接头污染筛查；FASTQ 修剪；接头表静默错修复）
 
 **工具数 62 → 64，benchmark 63 → 65 题（64/64 覆盖）。** 两块工作都来自候选池 survey：

package/batch.mjs

@@ -46,7 +46,11 @@ export function detectBatchFormat(path, text) {
 /** Convert a simple basename glob (*, ?) to a RegExp. */
 export function globToRegExp(pattern) {
   const source = String(pattern)
-    .replace(/[.+^$()|[\]{}]/g, '\$&')
+    // A literal backslash must be escaped before anything else; otherwise the
+    // following replaceAll calls turn it into a regex escape instead of a
+    // filename character.
+    .replaceAll('\\', '\\\\')
+    .replace(/[.+^$()|[\]{}]/g, '\\$&')
     .replaceAll('*', '.*')
     .replaceAll('?', '.');
   return new RegExp('^' + source + '$', 'i');

package/benchmark/changed.mjs

@@ -19,9 +19,10 @@
  * consequences of a helper module being imported by feature modules — a real
  * dependency, but not the tool's IMPLEMENTATION.
  *
- * Measured, not guessed: 26 of the 57 tools call bindings from more than one
- * module. So a per-file → tool map is not a partition, it is a graph, and the
- * honest model is:
+ * Measured, not guessed: 26 of the tools call bindings from more than one
+ * module (measured when the suite covered 57; the graph property, not the
+ * count, is what matters). So a per-file → tool map is not a partition, it is
+ * a graph, and the honest model is:
  *
  *     changed file → the module(s) it belongs to
  *                  → every module that transitively depends on them

package/benchmark/profile.mjs

@@ -5,7 +5,7 @@
  *
  * ── Why a hand-built profile exists at all ──────────────────────────────────
  *
- * The model-facing way to get the 57 tools is the "Molecular Biology Lab" agent
+ * The model-facing way to get the 64 tools is the "Molecular Biology Lab" agent
  * preset, and the benchmark would obviously rather run THAT than a
  * reconstruction of it. It cannot: `dsh-headless` refuses a preset for a
  * structural reason, not a configuration one —

package/build/client-bundle.mjs

@@ -40,7 +40,7 @@ const checkOnly = process.argv.slice(2).includes('--check');
 /**
  * The bundles to emit. The SAME browser half ships through two channels:
  *
- * - `dsh-molbio-tools` — the plugin package: one install gives the 57 tools
+ * - `dsh-molbio-tools` — the plugin package: one install gives the 64 tools
  *   plus the panel (its host half also registers the tools).
  * - `dsh-molbio-panel` — a panel-only package: installing it adds the tab to a
  *   profile WITHOUT dragging the tools into every session of that profile,

package/build/preset-patch.mjs

@@ -101,7 +101,7 @@ const ANCHOR = [
   '#',
   '# Keep the tool in the PRESET and only the anchor here. An earlier version of',
   "# this file inserted a host row for the tool itself (`name: dsh-molbio-tools`),",
-  "# which both registered all 60 tools globally and collided with the preset's own",
+  "# which both registered every tool globally and collided with the preset's own",
   '# copy of that row:',
   '#',
   '#     broken: "tool-molbio (...): never started"',

package/build/release-preflight.mjs

@@ -41,7 +41,7 @@ import { gunzipSync } from 'node:zlib';
  * The two npm entries this repository publishes, in publish order.
  *
  * THEY DO NOT SHARE A VERSION LINE, and that is deliberate rather than an
- * oversight to be "fixed" here. The root package carries the 62 tools and moves
+ * oversight to be "fixed" here. The root package carries the 64 tools and moves
  * with every toolset release; `dsh-molbio-panel` carries only the browser panel
  * and moves when the panel's own artifact moves. The tag names the ROOT version
  * (`v0.19.0`), and each entry is checked against its own declared version —

package/charts.mjs

@@ -60,6 +60,25 @@ import {
   textRun,
 } from './svgio.mjs';
 
+// ── data-sized min/max ──────────────────────────────────────────────────────
+//
+// A table this module accepts can hold MAX_ROWS (200 000) values. Spreading an
+// array that large into Math.min/Math.max overflows the engine's argument limit
+// with a RangeError, so the data-sized extrema are computed with loops. Fixed-
+// size arrays (bins, colour stops, density grids) still use the spread form.
+
+function minData(values) {
+  let min = Infinity;
+  for (const value of values) if (value < min) min = value;
+  return min;
+}
+
+function maxData(values) {
+  let max = -Infinity;
+  for (const value of values) if (value > max) max = value;
+  return max;
+}
+
 // ── canvas ──────────────────────────────────────────────────────────────────
 
 export const CHART_WIDTH = 720;
@@ -130,8 +149,8 @@ export function histogramBins(values, requestedBins) {
   const finite = values.filter((value) => Number.isFinite(value));
   if (finite.length === 0) throw new MolbioInputError('a histogram needs at least one finite value');
   const n = finite.length;
-  const min = Math.min(...finite);
-  const max = Math.max(...finite);
+  const min = minData(finite);
+  const max = maxData(finite);
   let binCount;
   let rule;
   if (requestedBins !== undefined) {
@@ -634,9 +653,9 @@ export function renderBoxPlot({ title, x_label, y_label, series }) {
     const stats = boxStats(validateFinite(entry.values, `series ${index + 1} values`));
     return { label, stats, color: entry.color ?? SERIES_COLORS[index % SERIES_COLORS.length] };
   });
-  const lows = prepared.map((entry) => Math.min(entry.stats.whisker_low, ...entry.stats.outliers, entry.stats.min));
-  const highs = prepared.map((entry) => Math.max(entry.stats.whisker_high, ...entry.stats.outliers, entry.stats.max));
-  const [domainMin, domainMax] = padDomain(Math.min(...lows), Math.max(...highs));
+  const lows = prepared.map((entry) => Math.min(entry.stats.whisker_low, minData(entry.stats.outliers), entry.stats.min));
+  const highs = prepared.map((entry) => Math.max(entry.stats.whisker_high, maxData(entry.stats.outliers), entry.stats.max));
+  const [domainMin, domainMax] = padDomain(minData(lows), maxData(highs));
   const { parts, plot } = frame(title);
   const y = yAxis(parts, plot, domainMin, domainMax, y_label);
   const slot = plot.width / prepared.length;
@@ -695,8 +714,8 @@ export function renderLineChart({ title, x_label, y_label, series, markers = tru
   });
   const allX = prepared.flatMap((entry) => entry.xs);
   const allY = prepared.flatMap((entry) => entry.ys);
-  const [xMin, xMax] = padDomain(Math.min(...allX), Math.max(...allX));
-  const [yMin, yMax] = padDomain(Math.min(...allY), Math.max(...allY));
+  const [xMin, xMax] = padDomain(minData(allX), maxData(allX));
+  const [yMin, yMax] = padDomain(minData(allY), maxData(allY));
   const { parts, plot } = frame(title);
   const y = yAxis(parts, plot, yMin, yMax, y_label);
   const x = linearScale([xMin, xMax], [plot.x, plot.x + plot.width]);
@@ -719,11 +738,11 @@ export function renderLineChart({ title, x_label, y_label, series, markers = tru
   return {
     svg,
     stats: {
-      series: prepared.map((entry) => ({ label: entry.label, points: entry.xs.length, x_min: Math.min(...entry.xs), x_max: Math.max(...entry.xs), y_min: Math.min(...entry.ys), y_max: Math.max(...entry.ys) })),
+      series: prepared.map((entry) => ({ label: entry.label, points: entry.xs.length, x_min: minData(entry.xs), x_max: maxData(entry.xs), y_min: minData(entry.ys), y_max: maxData(entry.ys) })),
       series_count: prepared.length,
       point_count: prepared.reduce((sum, entry) => sum + entry.xs.length, 0),
-      x_range: [Math.min(...allX), Math.max(...allX)],
-      y_range: [Math.min(...allY), Math.max(...allY)],
+      x_range: [minData(allX), maxData(allX)],
+      y_range: [minData(allY), maxData(allY)],
     },
     marks: prepared.reduce((sum, entry) => sum + entry.xs.length, 0),
     plot,
@@ -815,7 +834,7 @@ export function renderViolinPlot({ title, x_label, y_label, series, bandwidth, s
   });
   const lows = prepared.map((entry) => entry.stats.min);
   const highs = prepared.map((entry) => entry.stats.max);
-  const [domainMin, domainMax] = padDomain(Math.min(...lows), Math.max(...highs));
+  const [domainMin, domainMax] = padDomain(minData(lows), maxData(highs));
   const { parts, plot } = frame(title);
   const y = yAxis(parts, plot, domainMin, domainMax, y_label);
   const slot = plot.width / prepared.length;
@@ -890,8 +909,8 @@ export function renderVolcanoPlot({ title, x_label, y_label, points, fold_change
   const significant = (point) => Math.abs(point.fold) >= fold_change_threshold && point.p <= p_threshold;
   const xs = prepared.map((point) => point.fold);
   const ys = prepared.map((point) => point.significance);
-  const [xMin, xMax] = padDomain(Math.min(0, ...xs), Math.max(0, ...xs));
-  const [yMin, yMax] = padDomain(0, Math.max(...ys, -Math.log10(p_threshold)));
+  const [xMin, xMax] = padDomain(Math.min(0, minData(xs)), Math.max(0, maxData(xs)));
+  const [yMin, yMax] = padDomain(0, Math.max(maxData(ys), -Math.log10(p_threshold)));
   const { parts, plot } = frame(title);
   const y = yAxis(parts, plot, yMin, yMax, y_label ?? '-log10 p');
   const x = linearScale([xMin, xMax], [plot.x, plot.x + plot.width]);
@@ -936,7 +955,7 @@ export function renderVolcanoPlot({ title, x_label, y_label, points, fold_change
       down_count: prepared.filter((point) => significant(point) && point.fold < 0).length,
       fold_change_threshold,
       p_threshold,
-      max_significance: Math.max(...ys),
+      max_significance: maxData(ys),
       labelled: [...labelled],
     },
     marks: prepared.length,
@@ -1000,8 +1019,8 @@ export function renderHeatmap({ title, x_label, y_label, rows, columns, matrix,
   }
   const flat = values.flat().filter((value) => value !== null);
   if (flat.length === 0) throw new MolbioInputError('the matrix has no finite values to draw');
-  const min = Math.min(...flat);
-  const max = Math.max(...flat);
+  const min = minData(flat);
+  const max = maxData(flat);
   const ramp = color_scale ?? (min < 0 ? 'divergingRedBlue' : 'viridis');
   if (COLOR_RAMPS[ramp] === undefined) {
     throw new MolbioInputError(`unknown color_scale ${JSON.stringify(color_scale)}; use ${Object.keys(COLOR_RAMPS).join(', ')}`);

package/cordis.patch.yml

@@ -21,7 +21,7 @@
 #
 # Keep the tool in the PRESET and only the anchor here. An earlier version of
 # this file inserted a host row for the tool itself (`name: dsh-molbio-tools`),
-# which both registered all 60 tools globally and collided with the preset's own
+# which both registered every tool globally and collided with the preset's own
 # copy of that row:
 #
 #     broken: "tool-molbio (...): never started"

package/docs/client-panel.md

@@ -243,7 +243,7 @@ dsh plugin --profile <profile> add dsh-molbio-tools              # 或 npm 包
 `/plugins/dsh-molbio-tools/client.js?rev=<hash>` → 页面刷新时按需拉取、物化、执行
 `apply`。**不需要重建 Web 应用**（这正是客户端模块体系的设计目的）。
 
-与 preset 渠道共存时：preset 提供 57 个工具，bundle 提供面板；同名工具由 preset 层
+与 preset 渠道共存时：preset 提供 64 个工具，bundle 提供面板；同名工具由 preset 层
 shadow（无冲突），面板的 `remote`/`slot` 服务不受影响。
 
 ## 7. 下一步

package/docs/history.md

@@ -16,6 +16,7 @@
 
 | 包版本 | preset 版本 | 内容 | 工具数 |
 | --- | --- | --- | --- |
+| 0.24.1 | — | **输入边界与数据安全加固**：BibTeX 不再覆盖文献库、相对读取按会话工作区、批量/glob/并发声明修复、20 万行输入不再 `RangeError`；工具数不变 | 64 |
 | 0.24.0 | — | **数据卫生版**：新增 `molbio_contamination_screen`（内置载体/接头短签名，双链、0–2 错配）与 `molbio_fastq_trim`（质量/接头/引物/poly/N/长度，写 FASTQ/FASTA）；修 FASTQ QC 接头表 Small RNA 5' 的 RNA→DNA 静默错 | 62 → 64 |
 | 0.23.0 | — | **2.0 遗留修复 + 2.9a 调用卡 + 两个候选池工具**：跨内含子引物报告真实反向分子（F 在 R 上游）、logo/gRNA 调用卡、`molbio_protein_charge`、`molbio_dotplot`；同版完成 **DSH 0.2.2-rc.1 适配**（删掉上游已移除的 `list-agents` 子路径行、subagent 模型选择改用新键、守卫补上 specifier 解析） | 60 → 62 |
 | 0.22.2 | — | **DSH 0.2.1-rc.5 适配**：基线 rc.3 → rc.5（上游 standard 逐字节未变）；contract 声明守卫兼容桌面版裁掉 `lib/types` 的打包形态（+突变自检）；engines.node 与 CI 降到 24 | 60 |
@@ -49,6 +50,29 @@
 
 ---
 
+## v0.24.1（2026-11-08，包 0.24.1）
+
+**三条教训，都是“合法输入 + 默认路径”才会暴露的错。**
+
+**(1) “自定义文件名”不能等于“库文件本身”。** `molbio_paper_export_bibtex` 的默认输出是
+`path.replace(/\.json$/i, '.bib')`；当用户传 `file: refs.txt` 时这个替换是 no-op，
+于是导出的 BibTeX **直接覆盖文献库**。修法不是拒绝 `refs.txt`，而是先判断 `.json` 是否存在，
+不存在就追加 `.bib`。教训：**默认值必须是“另一个文件”的证明**，不能依赖字符串替换恰好命中。
+
+**(2) 用户规模数组不能 spread 进 `Math.min`/`Math.max`。** 图表接受 200,000 行、
+FASTQ QC 接受约 200,000 条 reads，而 `Math.min(...values)` 在这些规模上会以
+`RangeError` 失败；错误发生在参数个数上限，不是算法。现在所有可能跟随输入增长的极值
+都用循环；固定的 64 项密码子表之类仍可 spread。教训：**先问数组的上界是谁定的**，再决定写法。
+
+**(3) `safe` 声明要照着“默认写入”写，不是照着“参数是否为空”写。** 四个画图工具在
+`output_path` 省略时仍会写默认 SVG，旧谓词却返回 `true`；并发调用会互相覆盖文件。
+同样的问题在 `molbio_fasta_fastq extract` 带 `output_path` 时也存在。教训：**并发安全
+是“这次调用碰不碰共享状态”，默认值也算碰。**
+
+**顺带记录**：两个客户端产物因 `seqio.mjs` / `protein-structure.mjs` 改动而重建，
+面板包按仓库规则 `0.1.9 → 0.1.10`；工具数保持 64，preset 行清单与 DSH 基线不变。
+`benchmark-changed` 的 POSIX 路径断言在本地沙箱因 Node 无法 spawn `git` 未执行，CI 会执行。
+
 ## v0.24.0（2026-11-05，包 0.24.0）
 
 **三条教训，都关于“表/边界看起来对、实际不对”。**

package/docs/maintainer.md

@@ -32,7 +32,7 @@
 
 - **包**：`dsh-molbio-tools`，零依赖 DSH 插件包，**64 个 `molbio_*` 工具**（其中
   `molbio_plot` 一个工具承载 8 种图表）。
-- **基线**：DSH **0.2.2-rc.1**；`package.json` 版本 0.24.0（DSH 桌面版内嵌 Node 24.21.0）。
+- **基线**：DSH **0.2.2-rc.1**；`package.json` 版本 0.24.1（DSH 桌面版内嵌 Node 24.21.0）。
 - **两条分发渠道**：根包（工具 + 面板）与 `packages/molbio-panel`（只面板），
   **两个独立的 npm 条目、两条独立的版本线**，必须分别发布。
 - **工具只在专属模式里出现**（设计如此）：bundle 的 `cordis.patch.yml` 只插一行**惰性宿主锚点**

package/docs/roadmap.md

@@ -10,7 +10,7 @@ L = 需要新机制或外部资源）。
 
 ---
 
-## 1. 当前状态（0.23.0）
+## 1. 当前状态（0.24.1）
 
 - 64 个 `molbio_*` 工具，零依赖，随 preset 分发（见 [README](../README.md)）。
 - 离线测试金字塔 + 组合漂移守卫全绿；`benchmark/` 提供**模型使用**维度的评估
@@ -45,6 +45,10 @@ L = 需要新机制或外部资源）。
   的 key 解析顺序变为 **`api_key` 参数 → DSH 凭据库 → 环境变量**（环境变量会被 agent 自己的 shell
   子进程继承，凭据库不会）；同时插件详情页出现 **PubMed API key** 表单，用户不必改 YAML。
   没有凭据库的组合行为与 0.22.0 相同。
+- **0.24.1 是输入边界与数据安全加固版（工具数不变）**：修掉 BibTeX 导出覆盖文献库、
+  相对路径按 provider cwd 解析、四个默认写 SVG 的工具被误标并发安全、批量 glob /
+  `max_files` / 坏路径、文献与协议库坏条目，以及 20 万行表格 / 13 万条 reads 触发的
+  `Math.min(...)` RangeError。面板包 `0.1.9 → 0.1.10`（客户端产物重建）。
 - **0.24.0 是数据卫生版**：新增 survey #11 载体/接头污染筛查与 #12 FASTQ 修剪/过滤；
   同时修掉 FASTQ QC 接头表里 Small RNA 5' 的 RNA→DNA 归一化静默错（旧表在 DNA reads 上
   只能命中反向互补）。工具 62 → 64，benchmark 63 → 65；客户端产物仅因

package/docs/store-evidence.md

@@ -150,9 +150,9 @@ pnpm 的 hoisted linker 会在 `node_modules/` 留下一个指向仓库目录的
 ```
 node test/contract.mjs       → 17 checks passed（host 契约、client 产物、tarball 覆盖、声明回退的突变自检）
 node test/preset-health.mjs  → all 29 rows load on dsh 0.2.2-rc.1
-node test/smoke.mjs          → registered 62 tools, all smoke tests passed
+node test/smoke.mjs          → registered 64 tools, all smoke tests passed
 node test/drift-probe.mjs    → 16/16（15 个突变全部被抓到）
-node benchmark/run.mjs --offline → 63 tasks checked against the shipped tools
+node benchmark/run.mjs --offline → 65 tasks checked against the shipped tools
 ```
 
 `test/release.mjs` 在完整权限的本地会话里整套通过（包括末尾的 npm 版本探测）；

package/fastq-qc.mjs

@@ -115,7 +115,10 @@ function entropyOf(counts) {
  * that tapers is not mistaken for a quality drop.
  */
 function perPosition(entries, maxBases) {
-  const longest = Math.max(...entries.map((entry) => entry.sequence.length));
+  // A loop, not Math.max(...lengths): a 200k-read run is within the supported
+  // cap and would otherwise overflow the argument limit with a RangeError.
+  let longest = 0;
+  for (const entry of entries) if (entry.sequence.length > longest) longest = entry.sequence.length;
   const length = Math.min(longest, maxBases);
   const rows = [];
   for (let position = 0; position < length; position++) {
@@ -411,9 +414,24 @@ export function fastqQcReport(entries, options = {}) {
   }
 
   const perBase = perPosition(selected, settings.max_plot_bases);
-  const summaryQualities = selected.flatMap((entry) => [...entry.quality].map(phredOf));
-  const q20 = summaryQualities.filter((value) => value >= 20).length;
-  const q30 = summaryQualities.filter((value) => value >= 30).length;
+  // One streaming pass over the qualities. The previous version materialised
+  // every Phred score of every sampled read in one array (200k reads x 150 bp
+  // is 30 million numbers) and then filtered it twice; the counters need none
+  // of that memory, and the statistics are unchanged.
+  let qualitySum = 0;
+  let qualityCount = 0;
+  let q20 = 0;
+  let q30 = 0;
+  for (const entry of selected) {
+    for (const character of entry.quality) {
+      const value = phredOf(character);
+      qualitySum += value;
+      qualityCount++;
+      if (value >= 20) q20++;
+      if (value >= 30) q30++;
+    }
+  }
+  if (qualityCount === 0) throw new MolbioInputError('the FASTQ reads contain no quality values');
   const gcCount = selected.reduce((sum, entry) => {
     let gc = 0;
     for (const base of entry.sequence) if (base === 'G' || base === 'C') gc++;
@@ -441,9 +459,9 @@ export function fastqQcReport(entries, options = {}) {
     gc_percent: Math.round(gcFraction * 10000) / 100,
     n_bases: nCount,
     n_percent: Math.round((nCount / allBases) * 10000) / 100,
-    quality_mean: Math.round(mean(summaryQualities) * 100) / 100,
-    quality_q20_percent: Math.round((q20 / summaryQualities.length) * 10000) / 100,
-    quality_q30_percent: Math.round((q30 / summaryQualities.length) * 10000) / 100,
+    quality_mean: Math.round((qualitySum / qualityCount) * 100) / 100,
+    quality_q20_percent: Math.round((q20 / qualityCount) * 10000) / 100,
+    quality_q30_percent: Math.round((q30 / qualityCount) * 10000) / 100,
     quality_tail_below_30: tailPosition(perBase, 30),
     quality_tail_below_20: tailPosition(perBase, 20),
     per_base: perBase,

package/host.mjs

@@ -27,8 +27,8 @@
  *
  * ── WHY NOT JUST ANCHOR ON index.mjs ───────────────────────────────────────
  *
- * `index.mjs` is the TOOL plugin: importing it must register 57 tools and a
- * prompt section. A host row naming it would put every tool back into every
+ * `index.mjs` is the TOOL plugin: importing it must register all 64 tools and
+ * a prompt section. A host row naming it would put every tool back into every
  * session, which is the thing the preset split exists to avoid. This anchor is
  * deliberately inert.
  *

package/index.mjs

@@ -2211,7 +2211,14 @@ function fsService(ctx) {
 
 async function readFileBytes(ctx, exec, path) {
   const fs = fsService(ctx);
-  const target = await fs.resolve(path);
+  // Resolve a model-supplied relative name against the SESSION workspace, not
+  // the provider's process cwd. `ctx.fs.resolve(path)` alone uses the backend
+  // default (process.cwd()), which is why tool-fs asks `workingDirectory` for
+  // the agent's cwd; the sandbox policy carries the same root here. Absolute
+  // paths are still accepted unchanged (workspaceFilePath leaves them alone).
+  const sandboxPolicyService = ctx.get('sandboxPolicy');
+  const policy = sandboxPolicyService?.resolve({ ...exec?.agent !== undefined ? { session: exec.agent.session } : {} });
+  const target = await fs.resolve(workspaceFilePath(path, exec, policy?.workspaceRoot), { signal: exec?.signal });
   return await fs.readBytes(target, exec?.signal, MAX_DNA_BYTES);
 }
 
@@ -3547,6 +3554,8 @@ const proteinPropsTool = define({
 });
 
 const proteinChargeTool = (ctx) => define({
+  // Always writes protein-charge.svg and may open a viewer.
+  safe: false,
   name: 'molbio_protein_charge',
   description: 'Plot a protein\'s net charge across a pH range and report the isoelectric point on the same curve (Henderson-Hasselbalch summation over the terminal groups, K/R/H positive and D/E/C/Y negative). pka_set selects the pK table: bjellqvist (the set molbio_protein_props uses, so the pI matches) or emboss (the Epk.dat values). The SVG is written to the workspace and opened with the OS default viewer (auto_view, default true); the sampled curve and the charge at pH 7.4 are returned too. pI is an estimate and is only meaningful together with the named pK set.',
   parameters: {
@@ -3620,6 +3629,8 @@ const proteinChargeTool = (ctx) => define({
 });
 
 const dotplotTool = (ctx) => define({
+  // Always writes dotplot.svg and may open a viewer.
+  safe: false,
   name: 'molbio_dotplot',
   description: 'Compute and draw a self-comparison dotplot of a DNA sequence by exact word matching: a black cell at (i,j) means the k-mer at i equals the k-mer at j (direct repeat); a red cell means it equals the REVERSE COMPLEMENT of the k-mer at j (inverted repeat). word defaults to 8 (4-12); lower words find shorter repeats and produce more dots. The plot is binned to a fixed grid so a repetitive sequence cannot produce an enormous file; direct/inverted match counts and any scan/plot caps are reported. The SVG is written and opened with the OS default viewer (auto_view, default true). Exact k-mer view — not a windowed identity/scoring dotplot.',
   parameters: {
@@ -3803,7 +3814,9 @@ const WHEEL_RESIDUE_SCHEMA = {
 };
 
 const helicalWheelTool = (ctx) => define({
-  safe: (args) => args.output_path === undefined || args.output_path === '',
+  // It always writes the SVG (output_path only chooses the name), so it is
+  // never concurrency-safe; the old predicate marked the common case safe.
+  safe: false,
   name: 'molbio_helical_wheel',
   description: 'Draw the helical wheel (Schiffer-Edmundson projection) of a peptide or protein stretch and analyse it: residues are placed 100° apart on the circle (3.6 residues per turn of an ideal alpha-helix), coloured by residue class (hydrophobic/polar/acidic/basic), with the Eisenberg hydrophobic moment μH of the stretch and the maximum μH over every window of moment_window residues (11 by default). An amphipathic helix shows one hydrophobic face and one polar face. The tool WRITES an SVG file and opens it with the OS default viewer (auto_view, default true); all values are sequence-propensity estimates from published scales, not a structure prediction.',
   parameters: {
@@ -3922,7 +3935,8 @@ const HYDROPATHY_PEAK_SCHEMA = {
 };
 
 const hydropathyTool = (ctx) => define({
-  safe: (args) => args.output_path === undefined || args.output_path === '',
+  // Always writes the SVG; see the helical-wheel note.
+  safe: false,
   name: 'molbio_hydropathy_plot',
   description: 'Plot the Kyte-Doolittle hydropathy profile of a protein: a sliding-window average (window, default 9; use 19-21 for transmembrane spans), the GRAVY value, and every peak whose window average reaches the threshold (default 1.6, the classic membrane-spanning cutoff). The tool WRITES an SVG file and opens it with the OS default viewer (auto_view, default true); the per-residue profile is also returned so it can feed further analysis. Values are the Kyte-Doolittle propensity scale, not a topology prediction.',
   parameters: {
@@ -5484,7 +5498,10 @@ function validateGrnaOptions(args) {
 }
 
 const fastaFastqTool = (ctx) => define({
-  safe: (args) => args.action !== 'convert' && args.action !== 'extract',
+  // convert always writes; extract writes only when output_path is given, so
+  // stats/qc (and extract without a path) are the pure cases.
+  safe: (args) => !(args.action === 'convert'
+    || (args.action === 'extract' && args.output_path !== undefined && args.output_path !== '')),
   name: 'molbio_fasta_fastq',
   description: 'Work with FASTA/FASTQ files in the workspace. action=stats: per-entry and overall statistics (length/GC). action=extract: pull entries by id (exact or substring) and optionally write them to a FASTA file. action=convert: FASTQ → FASTA (output_path required). action=qc: FASTQ quality statistics (mean/min/max Phred, low-quality fraction, per-position means).',
   parameters: {
@@ -5652,13 +5669,22 @@ async function batchFileList(ctx, exec, args, policy, root) {
   const files = [];
   let truncated = false;
   if (Array.isArray(args.paths) && args.paths.length > 0) {
-    for (const supplied of args.paths) {
+    // The directory walk enforces max_files; the explicit list must too, or the
+    // documented 1-500 bound disappears for the easier input form.
+    const maxFiles = Math.min(args.max_files ?? 50, BATCH_LIMITS.maxFiles);
+    for (const supplied of args.paths.slice(0, maxFiles)) {
       const absolute = workspaceFilePath(supplied, exec, root);
-      const target = await fs.resolve(absolute);
       const label = relative(root, absolute).split(sep).join('/');
-      files.push({ target, label });
+      try {
+        const target = await fs.resolve(absolute);
+        files.push({ target, label });
+      } catch (error) {
+        // A bad explicit path is one error ROW, not a failed batch: the same
+        // contract the directory walk provides for files it cannot parse.
+        files.push({ label, resolveError: error instanceof Error ? error.message : String(error) });
+      }
     }
-    return { fs, files, truncated, maxBytes };
+    return { fs, files, truncated: args.paths.length > files.length, maxBytes };
   }
   if (typeof fs.listDir !== 'function') {
     throw new MolbioInputError('this harness fs service has no listDir; pass an explicit paths array instead of a directory');
@@ -5818,6 +5844,10 @@ const batchAnalyzeTool = (ctx) => define({
     const rows = [];
     for (const file of files) {
       const format = detectBatchFormat(file.label, '');
+      if (file.resolveError !== undefined) {
+        rows.push(batchErrorRow(file.label, format, file.resolveError));
+        continue;
+      }
       try {
         const info = file.size === undefined ? await fs.stat(file.target) : { size: file.size };
         if (info?.size !== undefined && info.size > maxBytes) {
@@ -7441,7 +7471,14 @@ const pubmedAbstractTool = (ctx) => define({
     }
     const apiKey = await pubmedKey(args, ctx);
     const url = pubmedFetchUrl(pmids, apiKey);
-    const result = await web.fetch({ url }, exec?.signal);
+    let result;
+    try {
+      result = await web.fetch({ url }, exec?.signal);
+    } catch (error) {
+      // Same contract as eutilsRequest: a transport failure is a tool-input
+      // error the caller can report, not a raw exception escaping the tool.
+      throw new MolbioInputError(`PubMed efetch could not be reached: ${error instanceof Error ? error.message : String(error)}`);
+    }
     const body = result?.body?.content;
     if (typeof body !== 'string' || body === '') {
       throw new MolbioInputError(`efetch returned no content (status ${result?.statusCode ?? 'unknown'})`);
@@ -7501,9 +7538,13 @@ const bibtexTool = (ctx) => define({
     const { fs, path, policy } = paperServiceDeps(ctx, exec, args);
     const library = await loadLibrary(fs, path);
     const bibtex = toBibtex(library.papers, args.tag_filter);
+    // Never fall back to the LIBRARY path itself: a custom `file` without a
+    // .json suffix used to make this replace a no-op, so the export overwrote
+    // the library with BibTeX. Always derive a distinct .bib name.
+    const defaultOutput = /\.json$/i.test(path) ? path.replace(/\.json$/i, '.bib') : `${path}.bib`;
     const output = args.output_path !== undefined && args.output_path !== ''
       ? workspaceFilePath(args.output_path, exec, policy?.workspaceRoot)
-      : path.replace(/\.json$/i, '.bib');
+      : defaultOutput;
     await writeWorkspaceFile(fs, output, bibtex, policy);
     return { output_path: output, count: bibtex.trim() === '' ? 0 : library.papers.filter((paper) => args.tag_filter === undefined || args.tag_filter.length === 0 || (paper.tags !== undefined && args.tag_filter.some((tag) => paper.tags.includes(tag)))).length };
   },

package/lib/client.js

@@ -4976,10 +4976,23 @@ window.__ModuleLoader__.load({
 
 			/** Summary statistics over parsed entries. */
 			function entryStats(entries, qualityMode = false) {
-			  const lengths = entries.map((entry) => entry.sequence.length);
+			  // Count in a loop instead of spreading into Math.min/Math.max: a large FASTQ
+			  // can hold hundreds of thousands of reads (and millions of quality
+			  // characters), and spreading such an array overflows the engine's argument
+			  // limit with a RangeError. The numbers are identical; only the failure mode
+			  // changes.
+			  let totalBases = 0;
+			  let minLength = entries.length === 0 ? 0 : Infinity;
+			  let maxLength = 0;
+			  let longest = 0;
 			  let gc = 0;
 			  let at = 0;
 			  for (const entry of entries) {
+			    const length = entry.sequence.length;
+			    totalBases += length;
+			    if (length < minLength) minLength = length;
+			    if (length > maxLength) maxLength = length;
+			    if (length > longest) longest = length;
 			    for (const base of entry.sequence) {
 			      if (base === 'G' || base === 'C') gc++;
 			      else if (base === 'A' || base === 'T') at++;
@@ -4987,22 +5000,34 @@ window.__ModuleLoader__.load({
 			  }
 			  const stats = {
 			    entries: entries.length,
-			    total_bases: lengths.reduce((sum, len) => sum + len, 0),
-			    min_length: Math.min(...lengths),
-			    max_length: Math.max(...lengths),
-			    mean_length: Math.round((lengths.reduce((sum, len) => sum + len, 0) / lengths.length) * 100) / 100,
+			    total_bases: totalBases,
+			    min_length: minLength,
+			    max_length: maxLength,
+			    mean_length: entries.length === 0 ? 0 : Math.round((totalBases / entries.length) * 100) / 100,
 			    gc_percent: gc + at === 0 ? 0 : Math.round((gc / (gc + at)) * 1000) / 10,
 			  };
 			  if (qualityMode) {
-			    const allQ = entries.flatMap((entry) => [...entry.quality].map((ch) => ch.charCodeAt(0) - 33));
-			    if (allQ.length > 0) {
-			      const mean = allQ.reduce((sum, q) => sum + q, 0) / allQ.length;
-			      const low = allQ.filter((q) => q < 20).length / allQ.length;
-			      stats.quality_mean = Math.round(mean * 100) / 100;
-			      stats.quality_min = Math.min(...allQ);
-			      stats.quality_max = Math.max(...allQ);
-			      stats.low_quality_fraction = Math.round(low * 1000) / 1000;
-			      const maxLen = Math.min(150, Math.max(...entries.map((e) => e.sequence.length)));
+			    let qualitySum = 0;
+			    let qualityCount = 0;
+			    let lowCount = 0;
+			    let qualityMin = Infinity;
+			    let qualityMax = -Infinity;
+			    for (const entry of entries) {
+			      for (const ch of entry.quality) {
+			        const q = ch.charCodeAt(0) - 33;
+			        qualitySum += q;
+			        qualityCount++;
+			        if (q < 20) lowCount++;
+			        if (q < qualityMin) qualityMin = q;
+			        if (q > qualityMax) qualityMax = q;
+			      }
+			    }
+			    if (qualityCount > 0) {
+			      stats.quality_mean = Math.round((qualitySum / qualityCount) * 100) / 100;
+			      stats.quality_min = qualityMin;
+			      stats.quality_max = qualityMax;
+			      stats.low_quality_fraction = Math.round((lowCount / qualityCount) * 1000) / 1000;
+			      const maxLen = Math.min(150, longest);
 			      const perPosition = [];
 			      for (let pos = 0; pos < maxLen; pos++) {
 			        const values = entries.filter((e) => e.sequence.length > pos).map((e) => e.quality.charCodeAt(pos) - 33);
@@ -7797,14 +7822,22 @@ window.__ModuleLoader__.load({
 			  }
 			  if (current !== null) peaks.push(current);
 			  const total = points.reduce((sum, point) => sum + point.hydropathy, 0);
+			  // Loop rather than Math.min(...points): the protein length is not capped and
+			  // a long input would overflow the argument limit with a RangeError.
+			  let minimumHydropathy = Infinity;
+			  let maximumHydropathy = -Infinity;
+			  for (const point of points) {
+			    if (point.hydropathy < minimumHydropathy) minimumHydropathy = point.hydropathy;
+			    if (point.hydropathy > maximumHydropathy) maximumHydropathy = point.hydropathy;
+			  }
 			  return {
 			    length: sequence.length,
 			    window,
 			    threshold,
 			    gravy: sequence.length === 0 ? 0 : round2([...sequence].reduce((sum, aa) => sum + KYTE_DOOLITTLE[aa], 0) / sequence.length),
 			    mean_profile: round3(total / points.length),
-			    minimum_hydropathy: round3(Math.min(...points.map((point) => point.hydropathy))),
-			    maximum_hydropathy: round3(Math.max(...points.map((point) => point.hydropathy))),
+			    minimum_hydropathy: round3(minimumHydropathy),
+			    maximum_hydropathy: round3(maximumHydropathy),
 			    peaks: peaks.map((peak) => ({ ...peak, maximum: round3(peak.maximum), length: peak.end - peak.start + 1 })),
 			    points,
 			  };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-molbio-tools",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "Zero-dependency molecular-biology plugin bundle for the DeepSeek Harness: sequence analysis, primer design (incl. cross-intron qPCR primers, TaqMan hydrolysis/MGB probes with ordering CSV and multiplex compatibility), in-silico PCR, cloning simulation, SnapGene .dna parsing and plasmid maps, Sanger verification, protein tools (incl. helical wheel, hydropathy and charge-pH plots), methylation-aware restriction analysis with double-digest buffer checks, qPCR analysis and plotting, multiple sequence alignment that conserves every input residue, conservation analysis, sequence logos, codon-usage analysis, phylogenetic trees with bootstrap support, Newick I/O and long-name label wrapping, CpG-island/GC-skew composition analysis, k-mer dotplots, read-level FASTQ QC, vector/adapter contamination screening, FASTQ trimming/filtering, batch file analysis with CSV export, silent restriction-site mutagenesis, family-aware CRISPR gRNA design (SpCas9/SaCas9/Cas12a/Cas13) with off-target search, an opt-in hand-off that shows a generated plot to the model as an attached image, plus a browser-side right-sidebar panel (plasmid maps and sequence logos drawn in the Web GUI) and a literature/protocol/experiment record system.",
   "type": "module",
   "main": "index.mjs",

package/papers.mjs

@@ -51,6 +51,12 @@ export async function loadLibrary(fs, path) {
     if (typeof parsed !== 'object' || parsed === null || !Array.isArray(parsed.papers)) {
       throw new Error('expected an object with a "papers" array');
     }
+    // A hand-edited library can contain a null or scalar entry. Without this
+    // check, paperKey()/render() would throw a raw TypeError; a clear input
+    // error names the file instead.
+    if (!parsed.papers.every((paper) => typeof paper === 'object' && paper !== null && !Array.isArray(paper))) {
+      throw new Error('every entry in "papers" must be an object');
+    }
     return parsed;
   } catch (error) {
     throw new MolbioInputError(`the paper library at ${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
@@ -115,6 +121,10 @@ export function updatePaper(library, id, changes) {
   if (Array.isArray(changes.tags)) {
     paper.tags = changes.tags.filter((tag) => typeof tag === 'string').map((tag) => tag.trim()).filter((tag) => tag !== '');
   }
+  // The id is DERIVED from pmid, then url, then title+year. Recompute it after
+  // an update: leaving the old title-based id in place means adding the renamed
+  // paper later is not recognised as a duplicate.
+  paper.id = paperKey(paper);
   return paper;
 }
 

package/plot.mjs

@@ -70,6 +70,20 @@ function validateNumbers(values, label) {
   return values;
 }
 
+/** Smallest datum, by loop: spreading a long series into Math.min overflows the argument limit. */
+function minValue(values) {
+  let min = Infinity;
+  for (const value of values) if (value < min) min = value;
+  return min;
+}
+
+/** Largest datum, by loop (same reason as {@link minValue}). */
+function maxValue(values) {
+  let max = -Infinity;
+  for (const value of values) if (value > max) max = value;
+  return max;
+}
+
 function frameParts(title, xLabel, yLabel) {
   const parts = [];
   parts.push(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${WIDTH} ${HEIGHT}" font-family="${FIGURE_FONT}" role="img">`);
@@ -110,11 +124,13 @@ export function renderBarChart({ title, x_label, y_label, labels, values, errors
     }
     errs = errors;
   }
-  let min = Math.min(0, ...vals);
-  let max = Math.max(0, ...vals);
+  let min = Math.min(0, minValue(vals));
+  let max = Math.max(0, maxValue(vals));
   if (errs !== undefined) {
-    min = Math.min(min, ...vals.map((v, i) => v - errs[i]));
-    max = Math.max(max, ...vals.map((v, i) => v + errs[i]));
+    for (let index = 0; index < vals.length; index++) {
+      min = Math.min(min, vals[index] - errs[index]);
+      max = Math.max(max, vals[index] + errs[index]);
+    }
   }
   if (max === min) max = min + 1;
   const parts = frameParts(title, x_label, y_label);
@@ -158,15 +174,15 @@ export function renderScatterChart({ title, x_label, y_label, x, y, fit }) {
     }
     fitLine = fit;
   }
-  let xMin = Math.min(...xs);
-  let xMax = Math.max(...xs);
+  let xMin = minValue(xs);
+  let xMax = maxValue(xs);
   if (xMax === xMin) {
     const pad = Math.abs(xMax) * 0.1 + 1;
     xMin -= pad;
     xMax += pad;
   }
-  let yMin = Math.min(...ys);
-  let yMax = Math.max(...ys);
+  let yMin = minValue(ys);
+  let yMax = maxValue(ys);
   if (fitLine !== undefined) {
     yMin = Math.min(yMin, fitLine.intercept + fitLine.slope * xMin, fitLine.intercept + fitLine.slope * xMax);
     yMax = Math.max(yMax, fitLine.intercept + fitLine.slope * xMin, fitLine.intercept + fitLine.slope * xMax);

package/preset/install.mjs

@@ -55,6 +55,14 @@ function flag(name) {
 }
 
 const profile = flag('profile') === undefined ? 'web' : String(flag('profile'));
+// DSH profile names are directory names under <dshHome>/profiles. Reject
+// separators/control characters before the value can reach a child process:
+// on Windows this script runs through a shell, where an unquoted metacharacter
+// (for example "web & calc") would be a command injection.
+if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(profile) || profile === '.' || profile === '..') {
+  console.error(`invalid --profile ${JSON.stringify(profile)}: start with a letter or digit, then letters, digits, ".", "_" or "-"`);
+  process.exit(2);
+}
 const checkOnly = flag('check') === true;
 const dshHomeFlag = flag('dsh-home');
 const dshHome = resolve(

package/protein-structure.mjs

@@ -278,14 +278,22 @@ export function hydropathyProfile(rawSequence, options = {}) {
   }
   if (current !== null) peaks.push(current);
   const total = points.reduce((sum, point) => sum + point.hydropathy, 0);
+  // Loop rather than Math.min(...points): the protein length is not capped and
+  // a long input would overflow the argument limit with a RangeError.
+  let minimumHydropathy = Infinity;
+  let maximumHydropathy = -Infinity;
+  for (const point of points) {
+    if (point.hydropathy < minimumHydropathy) minimumHydropathy = point.hydropathy;
+    if (point.hydropathy > maximumHydropathy) maximumHydropathy = point.hydropathy;
+  }
   return {
     length: sequence.length,
     window,
     threshold,
     gravy: sequence.length === 0 ? 0 : round2([...sequence].reduce((sum, aa) => sum + KYTE_DOOLITTLE[aa], 0) / sequence.length),
     mean_profile: round3(total / points.length),
-    minimum_hydropathy: round3(Math.min(...points.map((point) => point.hydropathy))),
-    maximum_hydropathy: round3(Math.max(...points.map((point) => point.hydropathy))),
+    minimum_hydropathy: round3(minimumHydropathy),
+    maximum_hydropathy: round3(maximumHydropathy),
     peaks: peaks.map((peak) => ({ ...peak, maximum: round3(peak.maximum), length: peak.end - peak.start + 1 })),
     points,
   };

package/records.mjs

@@ -27,6 +27,11 @@ export async function loadRecords(fs, path, key) {
     if (typeof parsed !== 'object' || parsed === null || !Array.isArray(parsed[key])) {
       throw new Error(`expected an object with a "${key}" array`);
     }
+    // See papers.mjs: a null/scalar entry would otherwise reach
+    // record.name.trim() (protocols) as a raw TypeError.
+    if (!parsed[key].every((record) => typeof record === 'object' && record !== null && !Array.isArray(record))) {
+      throw new Error(`every entry in "${key}" must be an object`);
+    }
     return parsed;
   } catch (error) {
     throw new MolbioInputError(`${path} is not a valid record file: ${error instanceof Error ? error.message : String(error)}`);
@@ -54,7 +59,7 @@ export function addProtocol(records, entry) {
   if (typeof entry !== 'object' || entry === null || typeof entry.name !== 'string' || entry.name.trim() === '') {
     throw new MolbioInputError('each protocol needs a non-empty "name"');
   }
-  if (records.some((record) => record.name.trim().toLowerCase() === entry.name.trim().toLowerCase())) {
+  if (records.some((record) => typeof record?.name === 'string' && record.name.trim().toLowerCase() === entry.name.trim().toLowerCase())) {
     throw new MolbioInputError(`a protocol named ${JSON.stringify(entry.name)} already exists`);
   }
   const protocol = {
@@ -78,7 +83,17 @@ export function addProtocol(records, entry) {
 export function updateProtocol(records, id, changes) {
   const protocol = records.find((record) => record.id === id);
   if (protocol === undefined) return undefined;
-  if (typeof changes.name === 'string' && changes.name.trim() !== '') protocol.name = changes.name.trim();
+  if (typeof changes.name === 'string' && changes.name.trim() !== '') {
+    const nextName = changes.name.trim();
+    // addProtocol enforces unique names; update must too, or a rename can
+    // create a duplicate the next add refuses to explain.
+    if (records.some((record) => record !== protocol
+      && typeof record?.name === 'string'
+      && record.name.trim().toLowerCase() === nextName.toLowerCase())) {
+      throw new MolbioInputError(`a protocol named ${JSON.stringify(nextName)} already exists`);
+    }
+    protocol.name = nextName;
+  }
   if (typeof changes.category === 'string' && changes.category.trim() !== '') protocol.category = changes.category.trim();
   if (Array.isArray(changes.steps)) {
     protocol.steps = changes.steps.filter((step) => typeof step === 'string').map((step) => step.trim()).filter((step) => step !== '');

package/seqio.mjs

@@ -96,10 +96,23 @@ export function toFastq(entries) {
 
 /** Summary statistics over parsed entries. */
 export function entryStats(entries, qualityMode = false) {
-  const lengths = entries.map((entry) => entry.sequence.length);
+  // Count in a loop instead of spreading into Math.min/Math.max: a large FASTQ
+  // can hold hundreds of thousands of reads (and millions of quality
+  // characters), and spreading such an array overflows the engine's argument
+  // limit with a RangeError. The numbers are identical; only the failure mode
+  // changes.
+  let totalBases = 0;
+  let minLength = entries.length === 0 ? 0 : Infinity;
+  let maxLength = 0;
+  let longest = 0;
   let gc = 0;
   let at = 0;
   for (const entry of entries) {
+    const length = entry.sequence.length;
+    totalBases += length;
+    if (length < minLength) minLength = length;
+    if (length > maxLength) maxLength = length;
+    if (length > longest) longest = length;
     for (const base of entry.sequence) {
       if (base === 'G' || base === 'C') gc++;
       else if (base === 'A' || base === 'T') at++;
@@ -107,22 +120,34 @@ export function entryStats(entries, qualityMode = false) {
   }
   const stats = {
     entries: entries.length,
-    total_bases: lengths.reduce((sum, len) => sum + len, 0),
-    min_length: Math.min(...lengths),
-    max_length: Math.max(...lengths),
-    mean_length: Math.round((lengths.reduce((sum, len) => sum + len, 0) / lengths.length) * 100) / 100,
+    total_bases: totalBases,
+    min_length: minLength,
+    max_length: maxLength,
+    mean_length: entries.length === 0 ? 0 : Math.round((totalBases / entries.length) * 100) / 100,
     gc_percent: gc + at === 0 ? 0 : Math.round((gc / (gc + at)) * 1000) / 10,
   };
   if (qualityMode) {
-    const allQ = entries.flatMap((entry) => [...entry.quality].map((ch) => ch.charCodeAt(0) - 33));
-    if (allQ.length > 0) {
-      const mean = allQ.reduce((sum, q) => sum + q, 0) / allQ.length;
-      const low = allQ.filter((q) => q < 20).length / allQ.length;
-      stats.quality_mean = Math.round(mean * 100) / 100;
-      stats.quality_min = Math.min(...allQ);
-      stats.quality_max = Math.max(...allQ);
-      stats.low_quality_fraction = Math.round(low * 1000) / 1000;
-      const maxLen = Math.min(150, Math.max(...entries.map((e) => e.sequence.length)));
+    let qualitySum = 0;
+    let qualityCount = 0;
+    let lowCount = 0;
+    let qualityMin = Infinity;
+    let qualityMax = -Infinity;
+    for (const entry of entries) {
+      for (const ch of entry.quality) {
+        const q = ch.charCodeAt(0) - 33;
+        qualitySum += q;
+        qualityCount++;
+        if (q < 20) lowCount++;
+        if (q < qualityMin) qualityMin = q;
+        if (q > qualityMax) qualityMax = q;
+      }
+    }
+    if (qualityCount > 0) {
+      stats.quality_mean = Math.round((qualitySum / qualityCount) * 100) / 100;
+      stats.quality_min = qualityMin;
+      stats.quality_max = qualityMax;
+      stats.low_quality_fraction = Math.round((lowCount / qualityCount) * 1000) / 1000;
+      const maxLen = Math.min(150, longest);
       const perPosition = [];
       for (let pos = 0; pos < maxLen; pos++) {
         const values = entries.filter((e) => e.sequence.length > pos).map((e) => e.quality.charCodeAt(pos) - 33);

package/test/charts.mjs

@@ -284,6 +284,17 @@ test('histogram binning honours an explicit count and degenerates safely', () =>
   assert.ok(tiny.bin_count >= 1 && Number.isFinite(tiny.bin_width), 'a two-value sample still gets a usable bin');
 });
 
+test('a table at the row cap does not overflow the argument limit', () => {
+  // 130k exceeds the engine's argument limit for Math.min(...values); the
+  // chart helpers must use a loop. 130000 is below MAX_ROWS (200000), so the
+  // input is one the tool advertises as supported.
+  const values = Array.from({ length: 130000 }, (_, index) => index % 1000);
+  const shape = histogramBins(values, 10);
+  assert.equal(shape.bins.reduce((sum, bin) => sum + bin.count, 0), values.length);
+  assert.equal(shape.bins[0].start, 0);
+  assert.equal(shape.bins.at(-1).end, 999);
+});
+
 // ── CSV / TSV reader ────────────────────────────────────────────────────────
 
 test('the reader detects the delimiter and keeps quoted fields intact', () => {

package/test/smoke.mjs

@@ -35,6 +35,8 @@ const plugin = await import('../index.mjs');
 const lib = await import('../lib.mjs');
 const view = await import('../view.mjs');
 const snapgene = await import('../snapgene.mjs');
+const { fastqQcReport } = await import('../fastq-qc.mjs');
+const { entryStats } = await import('../seqio.mjs');
 const { reverseComplement: reverseComplementOf } = lib;
 
 // The auto-view opener would spawn real viewer processes on the machine
@@ -1461,6 +1463,33 @@ function makeTemplate(n, seed = 42) {
   const qc = await run('molbio_fasta_fastq', { path: at('reads.fq'), action: 'qc' });
   assert.equal(qc.stats.quality_mean, 39.5);
   assert.equal(qc.stats.low_quality_fraction, 0);
+
+  // Large-input guards: these arrays are within the documented limits, and the
+  // old Math.min(...)/Math.max(...) forms threw RangeError on them.
+  const manyReads = Array.from({ length: 1000 }, (_, index) => ({
+    id: `bulk-${index}`,
+    description: '',
+    sequence: 'ACGT'.repeat(37) + 'AC',
+    quality: 'I'.repeat(150),
+  }));
+  const bulkStats = entryStats(manyReads, true);
+  assert.equal(bulkStats.entries, 1000);
+  assert.equal(bulkStats.quality_mean, 40);
+  assert.equal(bulkStats.quality_per_position_mean.length, 150);
+
+  const bulkQc = fastqQcReport(Array.from({ length: 130000 }, (_, index) => ({
+    id: `read-${index}`,
+    sequence: 'ACGTACGTAC',
+    quality: 'IIIIIIIIII',
+  })));
+  assert.equal(bulkQc.reads, 130000);
+  assert.equal(bulkQc.quality_mean, 40);
+  assert.equal(bulkQc.per_base.length, 10);
+
+  // A relative path is a SESSION-workspace path, not a provider-cwd path.
+  memFs.files.set(shown('relative.fa'), '>rel1\nACGT\n');
+  const relative = await run('molbio_fasta_fastq', { path: 'relative.fa', action: 'stats' });
+  assert.equal(relative.stats.entries, 1);
 }
 
 {
@@ -1501,6 +1530,15 @@ function makeTemplate(n, seed = 42) {
   const bib = memFs.files.get(at('papers.bib')).toString('utf8');
   assert.ok(bib.includes('@article{pmid111,'));
   assert.ok(bib.includes('title = {Alpha},'));
+
+  // A custom library name without .json must still get a DISTINCT .bib output,
+  // not overwrite the library with BibTeX.
+  await run('molbio_paper_add', { file: at('refs.txt'), papers: [{ title: 'Gamma' }] });
+  const custom = await run('molbio_paper_export_bibtex', { file: at('refs.txt') });
+  assert.equal(custom.output_path, at('refs.txt.bib'));
+  const stillLibrary = await run('molbio_paper_list', { file: at('refs.txt') });
+  assert.equal(stillLibrary.papers.length, 1);
+  assert.equal(stillLibrary.papers[0].title, 'Gamma');
 }
 
 {
@@ -1530,6 +1568,13 @@ function makeTemplate(n, seed = 42) {
   const experiments = await run('molbio_experiment_list', { file: at('experiments2.json') });
   assert.equal(experiments.experiments[0].title, 'Clone #12 miniprep');
   assert.equal(experiments.experiments[0].protocol_id, listed.protocols[0].id);
+
+  // Renaming onto an existing protocol is refused, matching addProtocol.
+  const second = await run('molbio_protocol_add', { file: at('protocols2.json'), name: 'Midiprep' });
+  await assert.rejects(
+    () => run('molbio_protocol_update', { file: at('protocols2.json'), id: second.protocol.id, name: 'miniprep' }),
+    /already exists/,
+  );
 }
 
 // ── official-convention compliance ──────────────────────────────────────────
@@ -1556,6 +1601,15 @@ function makeTemplate(n, seed = 42) {
   assert.equal(tool('molbio_clone_simulate').isConcurrencySafe({ save_path: at('x.fa') }), false);
   assert.equal(tool('molbio_fasta_fastq').isConcurrencySafe({ action: 'stats' }), true);
   assert.equal(tool('molbio_fasta_fastq').isConcurrencySafe({ action: 'convert' }), false);
+  assert.equal(tool('molbio_fasta_fastq').isConcurrencySafe({ action: 'extract', output_path: at('x.fa') }), false);
+  // Every tool that writes a DEFAULT svg file is unsafe even when output_path
+  // is omitted; these four predicates used to claim the opposite.
+  assert.equal(tool('molbio_helical_wheel').isConcurrencySafe({}), false);
+  assert.equal(tool('molbio_hydropathy_plot').isConcurrencySafe({}), false);
+  assert.equal(tool('molbio_protein_charge').isConcurrencySafe({}), false);
+  assert.equal(tool('molbio_dotplot').isConcurrencySafe({}), false);
+  assert.equal(tool('molbio_extract_region').isConcurrencySafe({ output_path: at('x.fa') }), false);
+  assert.equal(tool('molbio_qpcr_efficiency').isConcurrencySafe({ plot_path: at('x.svg') }), false);
 }
 
 // ── IIS enzymes and cross-intron primer design ──────────────────────────────
@@ -2075,6 +2129,15 @@ delete process.env.MOLBIO_NCBI_API_KEY;
   assert.equal(out.abstracts[0].error, '');
   assert.equal(out.abstracts[0].title, 'Test Article Title');
   assert.ok(mockWeb.calls.length === 1 && mockWeb.calls[0].includes('/efetch.fcgi') && mockWeb.calls[0].includes('api_key=test-key-123'));
+
+  // A transport failure is reported as a tool-input error, not a raw throw.
+  const originalFetch = mockWeb.fetch;
+  mockWeb.fetch = async () => { throw new Error('network down'); };
+  try {
+    await assert.rejects(() => run('molbio_pubmed_abstract', { pmids: ['12345678'], api_key: 'test-key' }), /could not be reached/);
+  } finally {
+    mockWeb.fetch = originalFetch;
+  }
 }
 
 // Restore whatever the developer machine had exported.
@@ -2114,6 +2177,21 @@ if (savedNcbiEnv.MOLBIO_NCBI_API_KEY !== undefined) process.env.MOLBIO_NCBI_API_
 
   const finalList = await run('molbio_paper_list', { file });
   assert.equal(finalList.papers.length, 1);
+
+  // An update that changes the title must re-derive a title-based id, or a
+  // later add of the renamed paper would not be recognised as a duplicate.
+  const renamedFile = at('paper-rename.json');
+  await run('molbio_paper_add', { file: renamedFile, papers: [{ title: 'Old title', year: '2020' }] });
+  const renamed = await run('molbio_paper_update', { file: renamedFile, id: 'title:Old title:2020', title: 'New title' });
+  assert.equal(renamed.found, true);
+  assert.equal(renamed.paper.id, 'title:New title:2020');
+
+  // A hand-edited library with a null entry is rejected with a named input
+  // error, not a raw TypeError from paperKey()/render().
+  memFs.files.set(at('bad-papers.json'), JSON.stringify({ papers: [null] }));
+  await assert.rejects(() => run('molbio_paper_list', { file: at('bad-papers.json') }), /every entry in "papers" must be an object/);
+  memFs.files.set(at('bad-protocols.json'), JSON.stringify({ protocols: [null] }));
+  await assert.rejects(() => run('molbio_protocol_list', { file: at('bad-protocols.json') }), /every entry in "protocols" must be an object/);
 }
 
 // ── v13: reaction-condition knobs (salt / primer concentration) ─────────────
@@ -2740,6 +2818,11 @@ if (savedNcbiEnv.MOLBIO_NCBI_API_KEY !== undefined) process.env.MOLBIO_NCBI_API_
   assert.equal(goodDna.feature_count, 10);
   assert.ok(batchDna.files.find((row) => row.path.endsWith('bad.dna')).error.length > 0);
 
+  // A glob is a glob: the dot in "a.fa" is literal, not a regex wildcard.
+  memFs.files.set(at('batch/aXfa'), '>x1\nACGT\n');
+  const literal = await run('molbio_batch_analyze', { directory: 'batch', pattern: 'a.fa', output_path: at('literal.csv') });
+  assert.deepEqual(literal.files.map((row) => row.path), ['batch/a.fa']);
+
   // Recursion is opt-in; the nested file appears only with recursive: true.
   const flat = await run('molbio_batch_analyze', { directory: 'batch', pattern: '*.fa', output_path: at('flat.csv') });
   assert.deepEqual(flat.files.map((row) => row.path), ['batch/a.fa', 'batch/b.fa']);
@@ -2750,6 +2833,13 @@ if (savedNcbiEnv.MOLBIO_NCBI_API_KEY !== undefined) process.env.MOLBIO_NCBI_API_
   const limited = await run('molbio_batch_analyze', { directory: 'batch', pattern: '*.fa', max_files: 1, output_path: at('limited.csv') });
   assert.equal(limited.file_count, 1);
   assert.equal(limited.truncated, true);
+  const limitedPaths = await run('molbio_batch_analyze', {
+    paths: [at('batch/a.fa'), at('batch/b.fa')],
+    max_files: 1,
+    output_path: at('limited-paths.csv'),
+  });
+  assert.equal(limitedPaths.file_count, 1, 'max_files also bounds an explicit paths list');
+  assert.equal(limitedPaths.truncated, true);
 
   await assert.rejects(() => run('molbio_batch_analyze', { directory: 'batch', analysis: 'enzymes' }), /non-empty enzymes array/);
   await assert.rejects(() => run('molbio_batch_analyze', { directory: 'batch', analysis: 'enzymes', enzymes: ['NotAnEnzyme'] }), /unknown enzyme/);