github · VSCode-Perplexity-MCP95dd7a60ad85

Evidence

const filePath = join(downloadDir, file.filename);

        writeFileSync(filePath, body);

        file.localPath = filePath;

        console.error(`[perplexity-mcp] Saved: ${filePath} (${body.length} bytes)`);

      } catch (err: any) {

        console.error(`[perplexity-mcp] Download error for ${file.filename}: ${err.message?.slice(0, 100)}`);

      }

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

// and opaque IDs safe to log; no tokens / bearers / cookies pass through

      // this path. Keeping resource context in the trace lets operators correlate

      // cache hits with /token exchanges in audit.log when debugging consent UX.

      console.error(`[trace] oauth consent cache hit clientId=${client.client_id} redirectUri=${params.redirectUri} resource=${resource ?? "<unbound>"}`);

      try {

        this.options.onConsentCacheHit?.({

          clientId: client.client_id,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

}

    console.error(`[perplexity-mcp] ASI blocks: ${[...allBlockUsages].join(", ")}`);

    console.error(`[perplexity-mcp] ASI item types: ${[...allItemTypes].join(", ")}`);

    console.error(`[perplexity-mcp] ASI payload types: ${[...allPayloadTypes].join(", ")}`);

    if (!finalData) {

      console.error("[perplexity-mcp] ASI: No FINAL event found in reconnect stream.");

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

const path = rawPath.split("?")[0] ?? rawPath;

      const status = res.statusCode;

      const hasAuth = typeof req.headers?.authorization === "string";

      console.error(`[trace] http ${req.method} ${path} auth=${hasAuth ? "yes" : "no"} status=${status} dur=${durationMs}ms ip=${ctx.ip ?? "?"} ua=${(ctx.userAgent ?? "").slice(0, 40)}`);

      // Only audit admin + /mcp endpoints, not homepage/static.

      if (path.startsWith("/daemon") || path.startsWith("/mcp") || path.startsWith("/authoriz

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

if (!shouldCapture(url)) return;

      const reason = request.failure()?.errorText || "unknown";

      const endpoint = extractEndpointName(url);

      console.log(

        `${C.red}✗ FAIL${C.reset} ${request.method()} ${C.dim}${endpoint}${C.reset} ${C.red}${reason}${C.reset}`,

      );

      captured.errors.push({

        at: new Date().toISOString(),

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

const sc = statusColor(status);

      const tag = num ? `#${String(num).padStart(3, "0")}` : "   ";

      const sseTag = sse ? ` ${C.magenta}SSE${C.reset}` : "";

      console.log(

        `${C.dim}${tag}${C.reset}   ${sc}← ${status}${C.reset}${sseTag} ${C.dim}${endpoint}${C.reset}` +

          (status >= 400 && typeof body === "string" ? `\n     ${C.red}${body.slice(0, 200)}${C.reset}` : ""),

      );

      schedulePersist();

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

console.error(`[perplexity-mcp] ASI payload types: ${[...allPayloadTypes].join(", ")}`);

    if (!finalData) {

      console.error("[perplexity-mcp] ASI: No FINAL event found in reconnect stream.");

      return {

        answer: `ASI task may still be running. View results at: ${PERPLEXITY_URL}/search/${threadSlug}`,

        sources: [],

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Remediation

Typosquat: verify you meant the popular package. If so, correct the spelling; if you truly intended the less-common name, suppress with an inline waiver. Stale release: check whether the package has a maintained fork or successor. If no patched release exists, vendor the code or migrate to an active alternative before the unmaintained code accrues unfixed CVEs.

Evidence

try {

        const result: any = await page.evaluate(async (u: string) => {

          try {

            const r = await fetch(u, { credentials: "include" });

            const ct = r.headers.get("content-type") ?? "";

            if (!r.ok || !ct.includes("application/json")) {

              return { ok: false, status: r.status, contentType: ct };

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

try {

        const rawJson: string = await this.page.evaluate(

          async (url: string) => {

            const resp = await fetch(url, { credentials: "include" });

            return await resp.text();

          },

          THREAD_ENDPOINT(threadSlug)

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

const email = process.env.PERPLEXITY_TEST_AUTO_LOGIN_EMAIL;

    await page.evaluate(async ({ origin, email }) => {

      await fetch(`${origin}/login/email`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email }) });

      await fetch(`${origin}/login/otp`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email, otp: "123456" }) });

    }, { origin: ORIGIN, email });

  }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

try {

        const rawJson: string = await this.page.evaluate(

          async (url: string) => {

            const resp = await fetch(url, { credentials: "include" });

            return await resp.text();

          },

          THREAD_ENDPOINT(threadSlug)

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

if (process.env.PERPLEXITY_TEST_AUTO_LOGIN_EMAIL) {

    const email = process.env.PERPLEXITY_TEST_AUTO_LOGIN_EMAIL;

    await page.evaluate(async ({ origin, email }) => {

      await fetch(`${origin}/login/email`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email }) });

      await fetch(`${origin}/login/otp`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email, otp: "123456" }) });

    }, { origin: ORIGIN,

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

- `CloudSyncOptions` gains an optional `getClient` (lazy getter) used by the daemon to defer init until impit-fallback is needed; the `client` (eager) form is preserved for the CLI and other callers that already paid for init.

### Fixed

- **Stealth flags pruned** ([client.ts](packages/mcp-server/src/client.ts), [refresh.ts](packages/mcp-server/src/refresh.ts)) — `--disable-web-security`, `--disable-features=IsolateOrigins,site-per-process`, and `--disable-site-isolation-trials` removed; the rat

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

browser.on("disconnected", () => { cfClosed = true; });

  // Navigate to the login page so the page has a same-origin context for

  // subsequent credentialed fetch() calls. Going to ORIGIN's root path can

  // land on a marketing page that may not set a usable document origin for

  // in-page fetch. Path is env-var-configurable for the mock server tests.

  try { await page.goto(`${ORIGIN}${LOGIN_PATH}`, { waitUntil: "domcontentloaded", timeout: 30_000 }); }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

* WHATWG fetch spec blocks a fixed list of "bad ports" (25, 6667, 10080, …).

 * When the caller asks for `port: 0` the OS picks an ephemeral port at

 * random — on rare occasions it hands back one of these blocked ports, and

 * every subsequent `fetch(daemon.url)` throws `bad port`. That's how the

 * OAuth-conformance tests flake in CI.

 *

 * Retry the listen up to 5 times when port is 0 and the OS assigns a

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

if (this.authenticated) {

        const fetchOk = async (url: string) => {

          try {

            const r = await fetch(url, { credentials: "include" });

            return r.ok ? await r.json() : null;

          } catch {

            return null;

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

const STEALTH_ARGS = [

  "--disable-blink-features=AutomationControlled",

  // NOTE: `--disable-web-security` was removed (2026-04-27 public-hardening

  // audit). All in-page `fetch()` calls used by the cookie-refresh tier hit

  // the same Perplexity origin, so CORS is not a factor; keeping the flag

  // would needlessly weaken the browser's same-origin policy. The off-origin

  // ASI download path lives in client.ts and now uses APIRequestContext.

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

const STEALTH_ARGS = [

  "--disable-blink-features=AutomationControlled",

  // NOTE: `--disable-web-security` was removed (2026-04-27 public-hardening

  // audit). All in-page `fetch()` calls in this file are same-origin

  // (perplexity.ai) — the only off-origin downloader (`downloadASIFiles`)

  // now uses Playwright's `APIRequestContext` (`context.request.get`) which

  // runs outside the page context and is not subject to CORS. Re-adding this

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

try {

        return await this.page!.evaluate(

          async (u: string) => {

            const r = await fetch(u, { credentials: "include" });

            if (!r.ok) return null;

            return r.json();

          },

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

//                      canonicalizes headers from {object} → [[k,v]] tuples

  //                      before forwarding to the native binding. THIS is what

  //                      package.json["main"] points at.

  //   index.js         — the raw NAPI binding loader; calling .fetch() with

  //                      a plain object on this throws "Given napi value is

  //                      not an array on RequestInit.headers" because the

  //                      binding-side check only accept

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

* Download files generated by ASI tasks.

   *

   * Uses Playwright's `APIRequestContext` (`context.request.get`) instead of

   * an in-page `fetch()`. ASI assets typically live on off-origin CDN buckets

   * (e.g. `pplx-res.cloudinary.com`, GCS, S3); fetching them from inside the

   * Perplexity origin would trip CORS unless the browser was launched with

   * `--disable-web-security` — which we no longer do (see STEALTH_ARGS note).

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// Check auth while headed

      const authData: any = await page.evaluate(async (url: string) => {

        try {

          const r = await fetch(url, { credentials: "include" });

          return await r.json();

        } catch {

          return null;

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

const rawJson: string = await this.page.evaluate(

      async (url: string) => {

        const response = await fetch(url, { credentials: "include" });

        return response.text();

      },

      THREAD_ENDPOINT(threadSlug),

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

    // Unlucky ephemeral assignment: close and retry. Final attempt returns

    // the blocked port anyway so callers that can't fetch() will see the

    // real problem rather than silently hanging.

    await new Promise<void>((resolve) => server.close(() => resolve()));

  }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

if (!this.page) return;

    try {

      const data = await this.page.evaluate(async (url: string) => {

        const r = await fetch(url, { credentials: "include" });

        return r.json();

      }, AUTH_SESSION_ENDPOINT);

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

title: "Perplexity Search",

        description: "Search the web using Perplexity AI with automatic anonymous or authenticated defaults.",

        inputSchema: {

          query: z.string().describe("The search query or question to ask."),

          sources: z.array(z.enum(["web", "scholar", "social"])).optional(),

          language: z.string().optional(),

        },

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

title: "Perplexity Reason",

        description: "Use a reasoning model for multi-step analysis and explanation.",

        inputSchema: {

          query: z.string(),

          sources: z.array(z.enum(["web", "scholar", "social"])).optional(),

          language: z.string().optional(),

          model: z.string().optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

title: "Perplexity Compute",

        description: "Run a task using Perplexity Computer mode (ASI).",

        inputSchema: {

          query: z.string(),

          model: z.string().optional(),

          language: z.string().optional(),

        },

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

title: "Perplexity Ask",

        description: "Query Perplexity with explicit control over model, mode, and follow-up context.",

        inputSchema: {

          query: z.string(),

          model: z.string().optional(),

          mode: z.enum(["concise", "copilot"]).optional(),

          sources: z.array(z.enum(["web", "scholar", "social"])).optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

title: "Perplexity Research",

        description: "Run a deep research task with the long-form research model.",

        inputSchema: {

          query: z.string(),

          sources: z.array(z.enum(["web", "scholar", "social"])).optional(),

          language: z.string().optional(),

        },

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

shell: bash

    steps:

      # ── Setup ──────────────────────────────────────────────────

      - uses: actions/checkout@v4

        with:

          fetch-depth: 0

          token: ${{ secrets.GITHUB_TOKEN }}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

run:

        shell: bash

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4

        with:

          node-version: ${{ matrix.node-version }}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

git config user.name "github-actions[bot]"

          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - uses: actions/setup-node@v4

        with:

          node-version: "22"

          cache: npm

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

shell: bash

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4

        with:

          node-version: ${{ matrix.node-version }}

          cache: npm

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

}

  try {

    writeFileSync(summaryPath, lines.join("\n"));

  } catch {}

}

// ─── Main ───────────────────────────────────────────────────────

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

let gitSha = "unknown";

try {

  gitSha = execFileSync("git", ["rev-parse", "--short", "HEAD"], { encoding: "utf-8" }).trim();

} catch {}

const outDir = join(__dirname, "../dist/mcp");

mkdirSync(outDir, { recursive: true });

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

console.log(`${C.green}║${C.reset}  Summary:    ${C.dim}${summaryPath}${C.reset}`);

    console.log(`${C.bold}${C.green}╚══════════════════════════════════════════════════════════╝${C.reset}`);

    try { await context.close(); } catch {}

    process.exit(0);

  };

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if (metaUrl) {

    try {

      candidates.push(fileURLToPath(new URL("../../package.json", metaUrl)));

    } catch {}

    try {

      candidates.push(fileURLToPath(new URL("../package.json", metaUrl)));

    } catch {}

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

* the same resolution rules without duplicating the candidate ladder.

 */

export function resolveNodePath(): string {

  const log = (msg: string) => { try { console.error(`[resolveNodePath] ${msg}`); } catch {} };

  log(`process.execPath = ${process.execPath}`);

  log(`process.platform = ${process.platform}`);

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

console.log(`${C.magenta}  WS ${arrow}${C.reset} ${C.dim}${data}${C.reset}`);

      }

      schedulePersist();

    } catch {}

  };

  ws.on("framesent", (f) => record("sent", f));

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

try {

    await page.goto(`${ORIGIN}${LOGIN_PATH}`, { waitUntil: "domcontentloaded", timeout: 30_000 });

  } catch {}

  if (!localOrigin) await minimizePageWindow(page);

  const ready = await waitForLoginReady(page);

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if (process.env.PERPLEXITY_DEBUG !== "1") return;

  if (category === "http" && process.env.PERPLEXITY_DEBUG_VERBOSE !== "1") return;

  const entry = { ts: new Date().toISOString(), source: "mcp" as const, category, event, data, ...(error ? { error: String(error) } : {}) };

  try { process.stderr.write("[DEBUG]" + JSON.stringify(entry) + "\n"); } catch {}

}

export function traceToolHandler<TArgs, TResult>(toolName: string, handler: (args: TArgs) => Promise<TResult>): (args: TArgs) => Promise<TRe

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

} catch {}

    try {

      candidates.push(fileURLToPath(new URL("../package.json", metaUrl)));

    } catch {}

  }

  return candidates;

}

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

const paths = getProfilePaths(PROFILE);

        if (!existsSync(paths.dir)) mkdirSync(paths.dir, { recursive: true });

        writeFileSync(paths.modelsCache, JSON.stringify(metadata.cache, null, 2));

      } catch {}

    }

  } finally {

    await browser.close().catch(() => {});

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

try {

        if (contentType.includes("json")) json = await response.json();

        else text = (await response.text()).slice(0, 500);

      } catch {}

      return {

        ok: response.ok,

        status: response.status,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

return {

    dispose() {

      if (timer) { clearTimeout(timer); timer = null; }

      try { w.close(); } catch {}

    },

  };

}

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

let parsed = body;

      if (typeof body === "string" && body && !body.startsWith("[")) {

        try { parsed = JSON.parse(body); } catch {}

      }

      captured.responses.push({

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

reason,

      });

      schedulePersist();

    } catch {}

  });

  // ─── Navigate the initial page ───────────────────────────────

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if (!String(filename).endsWith(".reinit")) return;

    if (!existsSync(target)) return;

    if (timer) clearTimeout(timer);

    timer = setTimeout(() => { timer = null; try { callback(); } catch {} }, debounceMs);

  });

  return {

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

version = pkg.version;

        break;

      }

    } catch {}

  }

  results.push({

    category: CATEGORY,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.