Codex adversarial pass on the implementation diff flagged five robustness
gaps, all fixed here:
- emoji-gate skipped green in CI when poppler/font prerequisites were absent,
which could let the tofu regression ship behind a green build. Missing
prerequisites are now a HARD FAILURE when process.env.CI is set; local dev
still skips cleanly.
- execFileSync children (make-pdf, pdffonts, pdftoppm, fc-match) had no
timeout; a wedged binary or hostile GSTACK_*_BIN override could hang the
job past Bun's test timeout. Each child now has a 25s ceiling.
- PPM parser trusted header tokens blindly; malformed/variant output gave a
silently-wrong count. Now validates magic/dimensions/maxval and pixel-buffer
length, handles header comments, throws a hard diagnostic on mismatch.
- predictable /tmp paths were collision/symlink-prone; now mkdtempSync under
/tmp (kept under /tmp for browse's validateOutputPath allowlist).
- only apt-get update was timeout-wrapped; dnf/pacman/apk installs and apt
install can hang on locks/mirrors. All package installs now timeout-bound.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
pdftotext is a false oracle for emoji: Skia preserves the Unicode in the
text cluster even when the glyph drew as .notdef tofu, so extraction passes
on a broken render. The gate instead asserts (1) pdffonts shows an emoji
family embedded and (2) pdftoppm rasterizes the page to color (measured
~1650 saturated pixels vs ~0 for tofu). pdfimages is not used: macOS embeds
color emoji as Type 3 fonts, so it lists nothing even on a correct render.
Adds resolvePopplerTool() (DRY resolver, returns null for clean skips) and
a fixture exercising FE0F variation-selector emoji. Skips cleanly when
poppler tools or a color-emoji font are unavailable.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Garry Tan