{
  "upstream": {
    "repo": "https://github.com/fivetaku/insane-search",
    "commit": "49306346b59aa89b5e96d98e1104da0890deed72",
    "license": "MIT"
  },
  "vendoredAt": "2026-06-23",
  "includedPaths": [
    "skills/insane-search/engine/**",
    "skills/insane-search/engine/templates/**",
    "LICENSE"
  ],
  "excludedPaths": [
    "setup/setup.sh",
    "setup/gptaku-update-check.cjs",
    ".claude-plugin/**",
    "skills/insane-search/SKILL.md",
    "skills/insane-search/references/**",
    "skills/insane-search/tests/**"
  ],
  "exclusionRationale": "Excludes upstream install hooks (SessionStart settings.json mutation), GitHub star-baiting (gh api user/starred), the update-notifier, and the past-session transcript-language scanner. Only the runtime Phase 0-3 engine and its Playwright/stealth templates are vendored.",
  "localPatches": [
    "engine/content_safety.py + FetchResult trust/risk metadata (content_trust, prompt_injection_risk, prompt_injection_signals, untrusted_content_boundary) and to_untrusted_text(): cherry-picked from insane-search a16f7c1 (upstream PR #5, v0.9.0). Adds prompt-injection labelling to the JSON surface (to_dict); the default CLI text output is intentionally left unchanged (plain content preserved, no envelope).",
    "engine/phase0.py _ytdlp_argv() console-script→module fallback + engine/bias_check.py rel.as_posix() Windows exemption + engine/tests/test_u9.py: cherry-picked from insane-search 33f898d (upstream PR #6, released v0.9.2). Cross-platform yt-dlp resolution; no capability or site logic added.",
    "engine/validators.py TERMINAL_NONSUCCESS drops Verdict.RATE_LIMITED + engine/fetch_chain.py _rate_limit_backoff(resp) and grid-loop 429 skip-and-continue + probe-phase 429 backoff: local P0 fix. Upstream treated 429 as terminal, so a single rate-limited probe or candidate aborted the whole fetch chain (no grid diversity, no Playwright fallback, no backoff), contradicting the transient-429 routing hints the same module already emitted. Backoff is linear (INSANE_RATE_LIMIT_BACKOFF_S, default 2s, x1..x5) and honours the server-provided Retry-After header (numeric, capped at 30s) on every 429 path (probe and grid). The configured base is validated and clamped (fetch_chain._clamp_rate_limit_base) and the final per-attempt delay is hard-capped to 30s, so a hostile or mis-set INSANE_RATE_LIMIT_BACKOFF_S (non-numeric, NaN, infinite, negative, or huge) can neither crash the chain, hang time.sleep, nor bypass the advertised bound; backoff sleeps stay finite and <=30s so a cancellation (KeyboardInterrupt) between attempts is honoured promptly. No capability or site logic added. Regression coverage: engine/tests/test_rate_limit_backoff.py (deterministic, mocked sleep; includes base-validation and cancellation/timeout regressions).",
    "engine/transport.py SessionPool.warmup(): bind allow_private = safety.allow_private_default() before use and qualify safety.DEFAULT_MAX_REDIRECTS: local fix for two NameErrors on the same call. warmup() raised NameError on every invocation that passed the safety gate, so per-(host, impersonate) root warmup never actually ran and engine/tests/test_u4.py failed on the vendored tree. Matches the already-correct qualification at transport.py get_or_create(). No capability or site logic added.",
    "engine/bias_check.py URL_ALLOWLIST adds funcaptcha.com/api.funcaptcha.com (Arkose Labs WAF challenge endpoints already referenced by validators.py and waf_profiles.yaml) and r.jina.ai/jina.ai (generic headless rendering endpoint): local fix so the No-Site-Name gate passes on vendored code. Allowlist-only; both are vendor/infrastructure artifacts, not target-site preferences."
  ],
  "notes": "Runtime engine is invoked via `python3 -m engine \"<url>\" --json` with cwd=this directory and PYTHONPATH pointed at this directory. Phase 0-2 require python3 + curl_cffi; Phase 3 requires node + playwright/playwright-extra/puppeteer-extra-plugin-stealth installed under engine/templates. GJC never auto-installs these dependencies."
}