From 0eb8c5b61adaa6279e76bdfdc0cdcfc084a0aa11 Mon Sep 17 00:00:00 2001
From: 16Miku <196724264+16Miku@users.noreply.github.com>
Date: Sat, 5 Sep 2026 20:15:14 +0800
Subject: [PATCH 1/5] fix(chrome): parse PDFs in offscreen document

---
 package.json                                  |   3 +-
 src/chrome/src/agent/agent.js                 |   6 +-
 src/chrome/src/agent/pdf-extraction.js        | 100 +++++++++++
 src/chrome/src/agent/pdf-tools.js             | 159 +++---------------
 src/chrome/src/offscreen/ensure.js            |   3 +-
 src/chrome/src/offscreen/offscreen.html       |   2 +
 .../src/offscreen/pdf-extraction-host.js      |  34 ++++
 src/chrome/vendor/pdfjs/README.md             |  13 +-
 test/pdf-mime-handler-e2e.mjs                 |  17 ++
 test/pdf-read.mjs                             | 153 +++++++++++++++++
 10 files changed, 348 insertions(+), 142 deletions(-)
 create mode 100644 src/chrome/src/agent/pdf-extraction.js
 create mode 100644 src/chrome/src/offscreen/pdf-extraction-host.js
 create mode 100644 test/pdf-read.mjs

diff --git a/package.json b/package.json
index da6092199..66a3a94a6 100644
--- a/package.json
+++ b/package.json
@@ -5,10 +5,11 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "test": "npm run test:provider-limits && npm run test:toolbar-guard && npm run test:pdf-selection && node test/run.js && node test/selection-scope-restoration.mjs && node scripts/benchmark-offline-relevance.mjs && npm run test:security",
+    "test": "npm run test:provider-limits && npm run test:toolbar-guard && npm run test:pdf-read && npm run test:pdf-selection && node test/run.js && node test/selection-scope-restoration.mjs && node scripts/benchmark-offline-relevance.mjs && npm run test:security",
     "test:provider-limits": "node test/provider-model-limits.mjs",
     "test:security": "node test/security/injection-corpus.mjs",
     "test:toolbar-guard": "node test/rich-text-toolbar-guard.mjs",
+    "test:pdf-read": "node test/pdf-read.mjs",
     "test:pdf-selection": "node test/pdf-selection.mjs",
     "test:pdf-mime-handler": "node test/pdf-mime-handler-e2e.mjs",
     "test:injection-bench": "node test/llm/run-scenarios.mjs --category prompt-injection",
diff --git a/src/chrome/src/agent/agent.js b/src/chrome/src/agent/agent.js
index 66bda5e3a..f8cda6f7a 100644
--- a/src/chrome/src/agent/agent.js
+++ b/src/chrome/src/agent/agent.js
@@ -27779,10 +27779,13 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
           return { success: false, error: 'read_pdf: no url provided and could not read the active tab URL.' };
         }
 
+        const provider = this._activeProvider(tabId);
+        const supportsPdfPassthrough = providerSupportsPdfPassthrough(provider);
         const result = await extractPdfText(pdfUrl, {
           fromPage: args.fromPage,
           toPage: args.toPage,
           maxChars: args.maxChars,
+          includeBytes: supportsPdfPassthrough,
         });
 
         // Tier 2 — Anthropic Claude PDF passthrough. If the active provider
@@ -27792,13 +27795,12 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
         // stringifying the tool result and pushes the document as a
         // follow-up user message (analogous to the `_attachImage` path
         // used by `screenshot`).
-        const provider = this._activeProvider(tabId);
         const bytes = result._pdfBytes;
         delete result._pdfBytes;
 
         if (
           bytes &&
-          providerSupportsPdfPassthrough(provider) &&
+          supportsPdfPassthrough &&
           bytes.length <= PDF_PASSTHROUGH_MAX_BYTES
         ) {
           let docName = result.title || '';
diff --git a/src/chrome/src/agent/pdf-extraction.js b/src/chrome/src/agent/pdf-extraction.js
new file mode 100644
index 000000000..330ef1661
--- /dev/null
+++ b/src/chrome/src/agent/pdf-extraction.js
@@ -0,0 +1,100 @@
+/**
+ * Browser-neutral PDF fetching and text extraction helpers.
+ *
+ * PDF.js itself is loaded by an extension page, not by the MV3 service
+ * worker. Keeping the extraction loop here lets the offscreen host own the
+ * browser-only PDF.js runtime while the agent facade remains lightweight.
+ */
+
+export const PDF_EXTRACTION_MESSAGE = 'offscreen-pdf-extract';
+
+export async function fetchPdfBytes(url, { timeoutMs = 60000 } = {}) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let response;
+    try {
+      response = await fetch(url, { credentials: 'include', signal: controller.signal });
+    } catch (error) {
+      if (typeof url === 'string' && url.startsWith('file://')) {
+        throw new Error(
+          'Cannot fetch local PDF from a file:// URL. WebBrain needs ' +
+          'file-URL access in Chrome: open chrome://extensions, find ' +
+          'WebBrain, click "Details", and enable "Allow access to file URLs". ' +
+          'Then reload the PDF tab and try read_pdf again.'
+        );
+      }
+      throw new Error(`PDF fetch failed: ${error.message}`);
+    }
+    if (!response.ok) {
+      throw new Error(`PDF fetch returned HTTP ${response.status} ${response.statusText}`);
+    }
+    return new Uint8Array(await response.arrayBuffer());
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+export async function extractPdfTextFromBytes(pdfjs, bytes, opts = {}) {
+  const fromPage = Math.max(1, Math.floor(opts.fromPage || 1));
+  const requestedTo = opts.toPage ? Math.floor(opts.toPage) : fromPage + 49;
+  const maxChars = Math.max(1000, Math.floor(opts.maxChars || 50000));
+
+  const loadingTask = pdfjs.getDocument({
+    data: bytes,
+    verbosity: 0,
+  });
+  const pdf = await loadingTask.promise;
+
+  const totalPages = pdf.numPages;
+  const startPage = Math.min(fromPage, totalPages);
+  const endPage = Math.min(totalPages, Math.max(startPage, requestedTo));
+
+  let title = '';
+  try {
+    const meta = await pdf.getMetadata();
+    title = meta?.info?.Title || '';
+  } catch { /* metadata is best-effort */ }
+
+  const pages = [];
+  let charCount = 0;
+  let truncated = false;
+  let lastRead = startPage - 1;
+
+  for (let pageNumber = startPage; pageNumber <= endPage; pageNumber++) {
+    const page = await pdf.getPage(pageNumber);
+    const content = await page.getTextContent();
+    const pageText = content.items
+      .map(item => (item && typeof item.str === 'string' ? item.str : ''))
+      .join(' ')
+      .replace(/\s+/g, ' ')
+      .trim();
+
+    if (charCount + pageText.length > maxChars) {
+      const remaining = Math.max(0, maxChars - charCount);
+      pages.push(pageText.slice(0, remaining) + '… [page truncated, use read_pdf with fromPage to read more]');
+      lastRead = pageNumber;
+      truncated = true;
+      page.cleanup?.();
+      break;
+    }
+
+    pages.push(pageText);
+    charCount += pageText.length;
+    lastRead = pageNumber;
+    page.cleanup?.();
+  }
+
+  return {
+    success: true,
+    title,
+    totalPages,
+    fromPage: startPage,
+    toPage: lastRead,
+    pageCount: pages.length,
+    pages,
+    hasExtractableText: pages.join('\n').length > 100,
+    truncated,
+    byteLength: bytes.length,
+  };
+}
diff --git a/src/chrome/src/agent/pdf-tools.js b/src/chrome/src/agent/pdf-tools.js
index aa0e183e3..32a521816 100644
--- a/src/chrome/src/agent/pdf-tools.js
+++ b/src/chrome/src/agent/pdf-tools.js
@@ -23,22 +23,8 @@
  * additional context.
  */
 
-let pdfjsModule = null;
-
-/**
- * Lazy-load pdfjs only on first PDF read. The legacy bundle is ~1 MB
- * and the worker is ~2.3 MB; we don't want to pay that startup cost
- * for users who never open a PDF.
- */
-async function getPdfjs() {
-  if (pdfjsModule) return pdfjsModule;
-  pdfjsModule = await import(chrome.runtime.getURL('vendor/pdfjs/pdf.mjs'));
-  // Worker URL must be set BEFORE the first getDocument() call. We resolve
-  // it via runtime.getURL so it works at any extension-id deploy target.
-  pdfjsModule.GlobalWorkerOptions.workerSrc =
-    chrome.runtime.getURL('vendor/pdfjs/pdf.worker.mjs');
-  return pdfjsModule;
-}
+import { ensureOffscreen } from '../offscreen/ensure.js';
+import { PDF_EXTRACTION_MESSAGE, fetchPdfBytes } from './pdf-extraction.js';
 
 /**
  * Cheap byte-array → base64 conversion that doesn't blow the call
@@ -79,41 +65,6 @@ export function isPdfUrl(url) {
   return false;
 }
 
-/**
- * Fetch the PDF binary from `url`. Returns a Uint8Array.
- * Throws with a helpful message on failure — file:// URLs in Chrome
- * require the user-toggle "Allow access to file URLs" at
- * chrome://extensions, which we explain instead of leaving the
- * agent guessing.
- */
-export async function fetchPdfBytes(url) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 60000);
-  try {
-    let res;
-    try {
-      res = await fetch(url, { credentials: 'include', signal: controller.signal });
-    } catch (e) {
-      if (typeof url === 'string' && url.startsWith('file://')) {
-        throw new Error(
-          'Cannot fetch local PDF from a file:// URL. WebBrain needs ' +
-          'file-URL access in Chrome: open chrome://extensions, find ' +
-          'WebBrain, click "Details", and enable "Allow access to file URLs". ' +
-          'Then reload the PDF tab and try read_pdf again.'
-        );
-      }
-      throw new Error(`PDF fetch failed: ${e.message}`);
-    }
-    if (!res.ok) {
-      throw new Error(`PDF fetch returned HTTP ${res.status} ${res.statusText}`);
-    }
-    const buf = await res.arrayBuffer();
-    return new Uint8Array(buf);
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
 /**
  * Extract text from a PDF.
  *
@@ -130,91 +81,31 @@ export async function fetchPdfBytes(url) {
  * having to render every page to PNG ourselves.
  */
 export async function extractPdfText(url, opts = {}) {
-  const fromPage = Math.max(1, Math.floor(opts.fromPage || 1));
-  const requestedTo = opts.toPage ? Math.floor(opts.toPage) : fromPage + 49;
-  const maxChars = Math.max(1000, Math.floor(opts.maxChars || 50000));
-
-  const bytes = await fetchPdfBytes(url);
-  const pdfjs = await getPdfjs();
-
-  const loadingTask = pdfjs.getDocument({
-    data: bytes,
-    // Suppress pdfjs's noisy console.warn for "non-embedded font fallback" etc.
-    // We surface real errors via the catch below.
-    verbosity: 0,
-  });
-  const pdf = await loadingTask.promise;
-
-  const totalPages = pdf.numPages;
-  const startPage = Math.min(fromPage, totalPages);
-  const endPage = Math.min(totalPages, Math.max(startPage, requestedTo));
-
-  // Best-effort title from the document's metadata dictionary.
-  let title = '';
-  try {
-    const meta = await pdf.getMetadata();
-    title = meta?.info?.Title || '';
-  } catch { /* ignore */ }
-
-  const pages = [];
-  let charCount = 0;
-  let truncated = false;
-  // Last page actually read, so the truncation notice's "read more with
-  // fromPage" advice resolves to a page that was really covered. Reporting
-  // `endPage` after an early `break` would make a caller resume past the
-  // unread pages and silently lose them.
-  let lastRead = startPage - 1;
-
-  for (let i = startPage; i <= endPage; i++) {
-    const page = await pdf.getPage(i);
-    const content = await page.getTextContent();
-
-    // pdfjs returns text items as a flat array with positional info.
-    // For LLM consumption we just join them with spaces — preserving
-    // exact layout would be more accurate but blows the token budget.
-    const pageText = content.items
-      .map((item) => (item && typeof item.str === 'string' ? item.str : ''))
-      .join(' ')
-      .replace(/\s+/g, ' ')
-      .trim();
-
-    if (charCount + pageText.length > maxChars) {
-      const remaining = Math.max(0, maxChars - charCount);
-      pages.push(pageText.slice(0, remaining) + '… [page truncated, use read_pdf with fromPage to read more]');
-      lastRead = i;
-      truncated = true;
-      break;
+  await ensureOffscreen();
+  const extraction = chrome.runtime.sendMessage({
+    type: PDF_EXTRACTION_MESSAGE,
+    url,
+    options: {
+      fromPage: opts.fromPage,
+      toPage: opts.toPage,
+      maxChars: opts.maxChars,
+    },
+  }).then((response) => {
+    if (!response?.ok || !response.result) {
+      throw new Error(response?.error || 'The offscreen PDF parser returned no result.');
     }
+    return response.result;
+  });
 
-    pages.push(pageText);
-    charCount += pageText.length;
-    lastRead = i;
-
-    // Free per-page resources — pdfjs caches aggressively otherwise.
-    page.cleanup?.();
-  }
-
-  // Heuristic: <100 chars across the whole requested range almost certainly
-  // means the pages are scanned images with no text layer. Tell the model.
-  const hasExtractableText = pages.join('\n').length > 100;
-
-  return {
-    success: true,
-    title,
-    totalPages,
-    fromPage: startPage,
-    toPage: lastRead,
-    pageCount: pages.length,
-    pages,
-    hasExtractableText,
-    truncated,
-    byteLength: bytes.length,
-    // The raw bytes are kept on `_pdfBytes` for the Tier 2 Claude
-    // passthrough path; the batch loop strips it before stringifying
-    // so the LLM doesn't see ~1 MB of base64 nonsense in the tool
-    // result text.
-    _pdfBytes: bytes,
-  };
+  // Only Claude-compatible providers need the original bytes. Keeping this
+  // fetch in the service worker avoids sending multi-megabyte binary payloads
+  // through extension messaging for every normal PDF read.
+  const rawBytes = opts.includeBytes === true
+    ? fetchPdfBytes(url)
+    : Promise.resolve(null);
+  const [result, bytes] = await Promise.all([extraction, rawBytes]);
+  if (bytes) result._pdfBytes = bytes;
+  return result;
 }
 
 /**
diff --git a/src/chrome/src/offscreen/ensure.js b/src/chrome/src/offscreen/ensure.js
index 15f5c9ab7..269a9801e 100644
--- a/src/chrome/src/offscreen/ensure.js
+++ b/src/chrome/src/offscreen/ensure.js
@@ -5,6 +5,7 @@
  * and the set of `reasons` declared at createDocument time is fixed — you
  * cannot add reasons later. So both consumers of the offscreen document
  * (the localhost-fetch proxy in offscreen.js, local WebGPU inference worker,
+ * PDF text extraction in pdf-extraction-host.js,
  * offline SQLite/E5 retrieval workers,
  * large-file staging in
  * skill-download.js, Emergency Box downloads in emergency-download-host.js,
@@ -46,7 +47,7 @@ const OFFSCREEN_REASONS = [
   'AUDIO_PLAYBACK',
 ];
 const OFFSCREEN_JUSTIFICATION =
-  'Proxy localhost requests; run local WebGPU models and offline reference search; stage validated large downloads; capture active tab and mic; maintain a localhost controller WebSocket; play conditional watch alerts.';
+  'Proxy localhost requests; parse PDFs; run local WebGPU models and offline reference search; stage validated large downloads; capture active tab and mic; maintain a localhost controller WebSocket; play conditional watch alerts.';
 
 let ready = false;
 let inflight = null;
diff --git a/src/chrome/src/offscreen/offscreen.html b/src/chrome/src/offscreen/offscreen.html
index e42ffa64f..d53ba0b9f 100644
--- a/src/chrome/src/offscreen/offscreen.html
+++ b/src/chrome/src/offscreen/offscreen.html
@@ -4,6 +4,7 @@
   <!--
     Single offscreen document hosting:
       • offscreen.js — fetch proxy for localhost LLM servers (existing)
+      • pdf-extraction-host.js — lazy PDF.js host for Agent text extraction
       • offline-rag-host.js — worker-capable SQLite and semantic retrieval
       • vision-inference-host.js — local WebGPU model worker bridge
       • skill-download.js — validated large-file staging through OPFS + blob URLs
@@ -23,6 +24,7 @@
     AUDIO_PLAYBACK (watch alerts).
   -->
   <script src="offscreen.js"></script>
+  <script type="module" src="pdf-extraction-host.js"></script>
   <script type="module" src="offline-rag-host.js"></script>
   <script type="module" src="emergency-download-host.js"></script>
   <script type="module" src="apocalypse-download-host.js"></script>
diff --git a/src/chrome/src/offscreen/pdf-extraction-host.js b/src/chrome/src/offscreen/pdf-extraction-host.js
new file mode 100644
index 000000000..732b017f8
--- /dev/null
+++ b/src/chrome/src/offscreen/pdf-extraction-host.js
@@ -0,0 +1,34 @@
+import {
+  PDF_EXTRACTION_MESSAGE,
+  extractPdfTextFromBytes,
+  fetchPdfBytes,
+} from '../agent/pdf-extraction.js';
+let pdfjsPromise = null;
+
+function getPdfjs() {
+  if (!pdfjsPromise) {
+    pdfjsPromise = import(chrome.runtime.getURL('vendor/pdfjs/pdf.mjs')).then((pdfjs) => {
+      pdfjs.GlobalWorkerOptions.workerSrc =
+        chrome.runtime.getURL('vendor/pdfjs/pdf.worker.mjs');
+      return pdfjs;
+    });
+  }
+  return pdfjsPromise;
+}
+
+chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
+  if (message?.type !== PDF_EXTRACTION_MESSAGE) return false;
+
+  (async () => {
+    const url = String(message.url || '').trim();
+    if (!url) throw new Error('PDF extraction requires a URL.');
+    const bytes = await fetchPdfBytes(url);
+    const pdfjs = await getPdfjs();
+    const result = await extractPdfTextFromBytes(pdfjs, bytes, message.options || {});
+    sendResponse({ ok: true, result });
+  })().catch((error) => {
+    sendResponse({ ok: false, error: error?.message || String(error) });
+  });
+
+  return true;
+});
diff --git a/src/chrome/vendor/pdfjs/README.md b/src/chrome/vendor/pdfjs/README.md
index f62af8035..f9d00790c 100644
--- a/src/chrome/vendor/pdfjs/README.md
+++ b/src/chrome/vendor/pdfjs/README.md
@@ -4,7 +4,7 @@ Mozilla PDF.js, used by `src/agent/pdf-tools.js` to extract text from
 PDFs the user is viewing in their browser. The Chrome PDF viewer is a
 `chrome-extension://` page that our content scripts can't inject into,
 so instead of trying to scrape the viewer's DOM we fetch the PDF
-binary and parse it with pdfjs in the service worker.
+binary and parse it with pdfjs in the shared offscreen document.
 
 ## Source
 
@@ -31,7 +31,9 @@ differently in the worker context). Worth the size for the resilience.
 
 ## How it's loaded
 
-`pdf-tools.js` does a lazy dynamic import on the first PDF read:
+`src/offscreen/pdf-extraction-host.js` does a lazy dynamic import on the first
+PDF read. PDF.js must run in an extension page because the Chrome MV3 service
+worker rejects dynamic `import()`:
 
 ```js
 const pdfjs = await import(chrome.runtime.getURL('vendor/pdfjs/pdf.mjs'));
@@ -44,8 +46,11 @@ pdfjs.GlobalWorkerOptions.workerSrc =
   chrome.runtime.getURL('vendor/pdfjs/pdf.worker.mjs');
 ```
 
-Both files are listed in `manifest.json`'s `web_accessible_resources`
-so `chrome.runtime.getURL` returns a fetchable URL.
+The Agent's `read_pdf` facade ensures the shared offscreen document and sends
+it the PDF URL plus bounded page options. Both PDF.js files are listed in
+`manifest.json`'s `web_accessible_resources`, so `chrome.runtime.getURL`
+returns a fetchable URL without loading the multi-megabyte modules during
+ordinary service-worker startup.
 
 ## Updating
 
diff --git a/test/pdf-mime-handler-e2e.mjs b/test/pdf-mime-handler-e2e.mjs
index f470d991a..d4d33b721 100644
--- a/test/pdf-mime-handler-e2e.mjs
+++ b/test/pdf-mime-handler-e2e.mjs
@@ -159,6 +159,23 @@ async function main() {
     ));
     assert.equal(apiAvailable, true, `Chrome ${browser.version()} does not expose the public MIME handler options API.`);
 
+    const extraction = await settings.evaluate(async url => {
+      const ensured = await chrome.runtime.sendMessage({
+        target: 'background',
+        action: 'ensure_offscreen_offline_rag_host',
+      });
+      const response = await chrome.runtime.sendMessage({
+        type: 'offscreen-pdf-extract',
+        url,
+        options: { fromPage: 1, toPage: 1, maxChars: 5000 },
+      });
+      return { ensured, response };
+    }, fixture.url);
+    assert.equal(extraction.ensured?.ready, true, 'The background did not create the shared offscreen host.');
+    assert.equal(extraction.response?.ok, true, extraction.response?.error || 'The offscreen PDF parser failed.');
+    assert.equal(extraction.response.result?.totalPages, 1);
+    assert.match(extraction.response.result?.pages?.[0] || '', /WebBrain PDF MIME handler test/);
+
     await waitForNativeHandlerOption(settings, false);
     // Installation initially registers public MIME handlers as enabled. Allow
     // the post-registration reconciliation pass to settle before navigating.
diff --git a/test/pdf-read.mjs b/test/pdf-read.mjs
new file mode 100644
index 000000000..2fc1ba4fa
--- /dev/null
+++ b/test/pdf-read.mjs
@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const pdfExtractionModulePath = path.join(root, 'src', 'chrome', 'src', 'agent', 'pdf-extraction.js');
+const pdfToolsModulePath = path.join(root, 'src', 'chrome', 'src', 'agent', 'pdf-tools.js');
+const pdfExtractionHostPath = path.join(root, 'src', 'chrome', 'src', 'offscreen', 'pdf-extraction-host.js');
+const offscreenHtmlPath = path.join(root, 'src', 'chrome', 'src', 'offscreen', 'offscreen.html');
+
+async function testMv3PdfExtractionUsesTheSharedOffscreenHost() {
+  const pdfTools = await readFile(pdfToolsModulePath, 'utf8');
+  const host = await readFile(pdfExtractionHostPath, 'utf8');
+  const offscreenHtml = await readFile(offscreenHtmlPath, 'utf8');
+  assert.match(pdfTools, /ensureOffscreen\(\)/);
+  assert.match(pdfTools, /type: PDF_EXTRACTION_MESSAGE/);
+  assert.doesNotMatch(
+    pdfTools,
+    /import\(chrome\.runtime\.getURL\('vendor\/pdfjs\/pdf\.mjs'\)\)/,
+    'MV3 service workers reject dynamic import() at runtime',
+  );
+  assert.match(host, /import\(chrome\.runtime\.getURL\('vendor\/pdfjs\/pdf\.mjs'\)\)/);
+  assert.match(host, /extractPdfTextFromBytes/);
+  assert.match(offscreenHtml, /<script type="module" src="pdf-extraction-host\.js"><\/script>/);
+}
+
+async function testPdfExtractionPreservesBoundedPageMetadataAndTruncation() {
+  const { extractPdfTextFromBytes } = await import(pathToFileURL(pdfExtractionModulePath).href);
+  const cleanedPages = [];
+  const pageTexts = new Map([
+    [1, ['First', 'page']],
+    [2, ['x'.repeat(1200)]],
+  ]);
+  const pdfjs = {
+    getDocument({ data, verbosity }) {
+      assert.deepEqual(Array.from(data), [1, 2, 3]);
+      assert.equal(verbosity, 0);
+      return {
+        promise: Promise.resolve({
+          numPages: 2,
+          getMetadata: async () => ({ info: { Title: 'Fixture PDF' } }),
+          getPage: async pageNumber => ({
+            getTextContent: async () => ({
+              items: pageTexts.get(pageNumber).map(str => ({ str })),
+            }),
+            cleanup: () => cleanedPages.push(pageNumber),
+          }),
+        }),
+      };
+    },
+  };
+
+  const result = await extractPdfTextFromBytes(pdfjs, new Uint8Array([1, 2, 3]), {
+    fromPage: 1,
+    toPage: 2,
+    maxChars: 1000,
+  });
+  assert.equal(result.title, 'Fixture PDF');
+  assert.equal(result.totalPages, 2);
+  assert.equal(result.fromPage, 1);
+  assert.equal(result.toPage, 2);
+  assert.equal(result.pageCount, 2);
+  assert.equal(result.truncated, true);
+  assert.equal(result.byteLength, 3);
+  assert.match(result.pages[1], /page truncated/);
+  assert.deepEqual(cleanedPages, [1, 2]);
+}
+
+async function testPdfFacadeRequestsOffscreenExtractionAndPreservesClaudeBytes() {
+  const originalChrome = globalThis.chrome;
+  const originalFetch = globalThis.fetch;
+  const messages = [];
+  globalThis.chrome = {
+    offscreen: { hasDocument: async () => true },
+    runtime: {
+      sendMessage: async message => {
+        messages.push(message);
+        return {
+          ok: true,
+          result: {
+            success: true,
+            title: 'Facade fixture',
+            totalPages: 1,
+            fromPage: 1,
+            toPage: 1,
+            pageCount: 1,
+            pages: ['fixture text'],
+            hasExtractableText: true,
+            truncated: false,
+            byteLength: 3,
+          },
+        };
+      },
+    },
+  };
+  globalThis.fetch = async () => new Response(new Uint8Array([4, 5, 6]), {
+    status: 200,
+    headers: { 'content-type': 'application/pdf' },
+  });
+  try {
+    const { extractPdfText } = await import(pathToFileURL(pdfToolsModulePath).href);
+    const plainResult = await extractPdfText('https://example.test/document.pdf', {
+      fromPage: 2,
+      toPage: 4,
+      maxChars: 5000,
+    });
+    assert.equal(plainResult.title, 'Facade fixture');
+    assert.equal(plainResult._pdfBytes, undefined);
+
+    const claudeResult = await extractPdfText('https://example.test/document.pdf', {
+      includeBytes: true,
+    });
+    assert.deepEqual(Array.from(claudeResult._pdfBytes), [4, 5, 6]);
+    assert.deepEqual(messages, [
+      {
+        type: 'offscreen-pdf-extract',
+        url: 'https://example.test/document.pdf',
+        options: { fromPage: 2, toPage: 4, maxChars: 5000 },
+      },
+      {
+        type: 'offscreen-pdf-extract',
+        url: 'https://example.test/document.pdf',
+        options: { fromPage: undefined, toPage: undefined, maxChars: undefined },
+      },
+    ]);
+  } finally {
+    if (originalChrome === undefined) delete globalThis.chrome;
+    else globalThis.chrome = originalChrome;
+    globalThis.fetch = originalFetch;
+  }
+}
+
+const tests = [
+  ['MV3 PDF extraction uses the shared offscreen host', testMv3PdfExtractionUsesTheSharedOffscreenHost],
+  ['PDF extraction preserves bounded page metadata and truncation', testPdfExtractionPreservesBoundedPageMetadataAndTruncation],
+  ['PDF facade delegates extraction and preserves Claude bytes', testPdfFacadeRequestsOffscreenExtractionAndPreservesClaudeBytes],
+];
+
+let failed = 0;
+for (const [name, run] of tests) {
+  try {
+    await run();
+    console.log(`  ✓ ${name}`);
+  } catch (error) {
+    failed += 1;
+    console.log(`  ✗ ${name}\n    ${error.message}`);
+  }
+}
+console.log(`\n${tests.length - failed} PDF read tests passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

From 9ab4a12f2914390dcd05372851e983f7d9886229 Mon Sep 17 00:00:00 2001
From: 16Miku <196724264+16Miku@users.noreply.github.com>
Date: Sat, 5 Sep 2026 21:55:31 +0800
Subject: [PATCH 2/5] fix(chrome): harden offscreen PDF extraction

---
 src/chrome/src/agent/agent.js                 | 19 +++--
 src/chrome/src/agent/pdf-extraction.js        | 48 ++++++++++-
 src/chrome/src/agent/pdf-tools.js             | 84 ++++++++++---------
 .../src/offscreen/pdf-extraction-host.js      | 27 +++++-
 src/chrome/vendor/pdfjs/README.md             | 15 ++--
 test/pdf-mime-handler-e2e.mjs                 | 45 +++++++---
 test/pdf-read.mjs                             | 73 +++++++++++++---
 7 files changed, 229 insertions(+), 82 deletions(-)

diff --git a/src/chrome/src/agent/agent.js b/src/chrome/src/agent/agent.js
index f8cda6f7a..b97223137 100644
--- a/src/chrome/src/agent/agent.js
+++ b/src/chrome/src/agent/agent.js
@@ -27785,23 +27785,24 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
           fromPage: args.fromPage,
           toPage: args.toPage,
           maxChars: args.maxChars,
-          includeBytes: supportsPdfPassthrough,
+          includeDocument: supportsPdfPassthrough,
         });
 
         // Tier 2 — Anthropic Claude PDF passthrough. If the active provider
         // can natively consume PDFs as a `document` content block AND the
-        // file fits under the size cap, attach the raw bytes via
-        // `_attachDocument`. The batch loop strips this field before
+        // file fits under the size cap, attach base64 encoded from the same
+        // bytes used for text extraction via `_attachDocument`. The batch
+        // loop strips this private field before
         // stringifying the tool result and pushes the document as a
         // follow-up user message (analogous to the `_attachImage` path
         // used by `screenshot`).
-        const bytes = result._pdfBytes;
-        delete result._pdfBytes;
+        const pdfBase64 = result._pdfBase64;
+        delete result._pdfBase64;
 
         if (
-          bytes &&
+          pdfBase64 &&
           supportsPdfPassthrough &&
-          bytes.length <= PDF_PASSTHROUGH_MAX_BYTES
+          result.byteLength <= PDF_PASSTHROUGH_MAX_BYTES
         ) {
           let docName = result.title || '';
           if (!docName) {
@@ -27810,11 +27811,11 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
               docName = decodeURIComponent(u.pathname.split('/').pop() || 'document.pdf');
             } catch { docName = 'document.pdf'; }
           }
-          const docBlock = buildClaudeDocumentBlock(bytes, docName);
+          const docBlock = buildClaudeDocumentBlock(pdfBase64, docName);
           return {
             ...result,
             method: 'pdf_text+claude_document',
-            description: `PDF text extracted (${result.pageCount} pages); raw bytes also attached as Claude document block for full-fidelity reading.`,
+            description: `PDF text extracted (${result.pageCount} pages); the same PDF bytes are also attached as a Claude document block for full-fidelity reading.`,
             _attachDocument: docBlock,
           };
         }
diff --git a/src/chrome/src/agent/pdf-extraction.js b/src/chrome/src/agent/pdf-extraction.js
index 330ef1661..7a6134f00 100644
--- a/src/chrome/src/agent/pdf-extraction.js
+++ b/src/chrome/src/agent/pdf-extraction.js
@@ -7,16 +7,54 @@
  */
 
 export const PDF_EXTRACTION_MESSAGE = 'offscreen-pdf-extract';
+export const PDF_EXTRACTION_READY_MESSAGE = 'offscreen-pdf-extract-ready';
+export const PDF_PASSTHROUGH_MAX_BYTES = 16 * 1024 * 1024;
+
+const ALLOWED_PDF_PROTOCOLS = new Set(['http:', 'https:', 'file:']);
+const BASE64_MAX_INPUT_BYTES = 32 * 1024 * 1024;
+
+export function normalizePdfUrl(value) {
+  let url;
+  try {
+    url = new URL(String(value || '').trim());
+  } catch {
+    throw new Error('PDF extraction requires a valid URL.');
+  }
+  if (!ALLOWED_PDF_PROTOCOLS.has(url.protocol)) {
+    throw new Error('PDF URL must use http:, https:, or file:.');
+  }
+  return url.href;
+}
+
+export function isTrustedPdfExtractionSender(sender, runtime = globalThis.chrome?.runtime) {
+  if (!runtime?.id || typeof runtime.getURL !== 'function') return false;
+  return sender?.id === runtime.id
+    && sender?.tab == null
+    && sender?.url === runtime.getURL('src/background.js');
+}
+
+export function bytesToBase64(bytes) {
+  if (bytes.length > BASE64_MAX_INPUT_BYTES) {
+    throw new Error(`PDF too large for base64 conversion (${bytes.length} bytes, cap ${BASE64_MAX_INPUT_BYTES}).`);
+  }
+  let binary = '';
+  const chunkSize = 0x8000;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    binary += String.fromCharCode.apply(null, bytes.subarray(offset, offset + chunkSize));
+  }
+  return btoa(binary);
+}
 
 export async function fetchPdfBytes(url, { timeoutMs = 60000 } = {}) {
+  const normalizedUrl = normalizePdfUrl(url);
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
     let response;
     try {
-      response = await fetch(url, { credentials: 'include', signal: controller.signal });
+      response = await fetch(normalizedUrl, { credentials: 'include', signal: controller.signal });
     } catch (error) {
-      if (typeof url === 'string' && url.startsWith('file://')) {
+      if (normalizedUrl.startsWith('file:')) {
         throw new Error(
           'Cannot fetch local PDF from a file:// URL. WebBrain needs ' +
           'file-URL access in Chrome: open chrome://extensions, find ' +
@@ -40,6 +78,10 @@ export async function extractPdfTextFromBytes(pdfjs, bytes, opts = {}) {
   const requestedTo = opts.toPage ? Math.floor(opts.toPage) : fromPage + 49;
   const maxChars = Math.max(1000, Math.floor(opts.maxChars || 50000));
 
+  // PDF.js may transfer this buffer to its worker, detaching the caller's
+  // Uint8Array. Capture the length before getDocument() so metadata remains
+  // accurate after parsing.
+  const byteLength = bytes.length;
   const loadingTask = pdfjs.getDocument({
     data: bytes,
     verbosity: 0,
@@ -95,6 +137,6 @@ export async function extractPdfTextFromBytes(pdfjs, bytes, opts = {}) {
     pages,
     hasExtractableText: pages.join('\n').length > 100,
     truncated,
-    byteLength: bytes.length,
+    byteLength,
   };
 }
diff --git a/src/chrome/src/agent/pdf-tools.js b/src/chrome/src/agent/pdf-tools.js
index 32a521816..9eafe5a02 100644
--- a/src/chrome/src/agent/pdf-tools.js
+++ b/src/chrome/src/agent/pdf-tools.js
@@ -24,25 +24,37 @@
  */
 
 import { ensureOffscreen } from '../offscreen/ensure.js';
-import { PDF_EXTRACTION_MESSAGE, fetchPdfBytes } from './pdf-extraction.js';
+import {
+  PDF_EXTRACTION_MESSAGE,
+  PDF_EXTRACTION_READY_MESSAGE,
+  PDF_PASSTHROUGH_MAX_BYTES,
+  bytesToBase64,
+} from './pdf-extraction.js';
 
-/**
- * Cheap byte-array → base64 conversion that doesn't blow the call
- * stack on multi-MB PDFs. fromCharCode.apply has a per-call argument
- * limit (~64k in V8), so we chunk.
- */
-const BASE64_MAX_INPUT_BYTES = 32 * 1024 * 1024; // 32 MB safety cap
+// chrome.offscreen.createDocument() resolves when the document exists, not
+// when its module scripts have registered their listeners. Probe the PDF host
+// for up to one second so the first read after a cold start cannot race it.
+const PDF_HOST_READY_ATTEMPTS = 40;
+const PDF_HOST_READY_RETRY_MS = 25;
 
-function bytesToBase64(bytes) {
-  if (bytes.length > BASE64_MAX_INPUT_BYTES) {
-    throw new Error(`PDF too large for base64 conversion (${bytes.length} bytes, cap ${BASE64_MAX_INPUT_BYTES}).`);
-  }
-  let bin = '';
-  const chunk = 0x8000;
-  for (let i = 0; i < bytes.length; i += chunk) {
-    bin += String.fromCharCode.apply(null, bytes.subarray(i, i + chunk));
+function wait(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function waitForPdfExtractionHost() {
+  let lastError = null;
+  for (let attempt = 0; attempt < PDF_HOST_READY_ATTEMPTS; attempt++) {
+    try {
+      const response = await chrome.runtime.sendMessage({ type: PDF_EXTRACTION_READY_MESSAGE });
+      if (response?.ready === true) return;
+      if (response?.error) lastError = new Error(response.error);
+    } catch (error) {
+      lastError = error;
+    }
+    if (attempt + 1 < PDF_HOST_READY_ATTEMPTS) await wait(PDF_HOST_READY_RETRY_MS);
   }
-  return btoa(bin);
+  const detail = lastError?.message ? ` ${lastError.message}` : '';
+  throw new Error(`The offscreen PDF parser did not become ready.${detail}`);
 }
 
 /**
@@ -82,30 +94,21 @@ export function isPdfUrl(url) {
  */
 export async function extractPdfText(url, opts = {}) {
   await ensureOffscreen();
-  const extraction = chrome.runtime.sendMessage({
+  await waitForPdfExtractionHost();
+  const response = await chrome.runtime.sendMessage({
     type: PDF_EXTRACTION_MESSAGE,
     url,
     options: {
       fromPage: opts.fromPage,
       toPage: opts.toPage,
       maxChars: opts.maxChars,
+      includeBase64: opts.includeDocument === true,
     },
-  }).then((response) => {
-    if (!response?.ok || !response.result) {
-      throw new Error(response?.error || 'The offscreen PDF parser returned no result.');
-    }
-    return response.result;
   });
-
-  // Only Claude-compatible providers need the original bytes. Keeping this
-  // fetch in the service worker avoids sending multi-megabyte binary payloads
-  // through extension messaging for every normal PDF read.
-  const rawBytes = opts.includeBytes === true
-    ? fetchPdfBytes(url)
-    : Promise.resolve(null);
-  const [result, bytes] = await Promise.all([extraction, rawBytes]);
-  if (bytes) result._pdfBytes = bytes;
-  return result;
+  if (!response?.ok || !response.result) {
+    throw new Error(response?.error || 'The offscreen PDF parser returned no result.');
+  }
+  return response.result;
 }
 
 /**
@@ -127,21 +130,24 @@ export function providerSupportsPdfPassthrough(provider) {
 }
 
 /**
- * Build the `document` content block for the Anthropic Messages API
- * from raw PDF bytes. Caller is responsible for size-checking — Claude's
- * cap is ~32 MB base64 / ~24 MB binary as of writing, but we cap
- * lower (16 MB binary) to leave room for the rest of the conversation.
+ * Build the `document` content block for the Anthropic Messages API from
+ * raw PDF bytes or base64 produced from those same bytes. Caller is
+ * responsible for size-checking — Claude's cap is ~32 MB base64 / ~24 MB
+ * binary as of writing, but we cap lower (16 MB binary) to leave room for
+ * the rest of the conversation.
  */
-export function buildClaudeDocumentBlock(bytes, name) {
+export function buildClaudeDocumentBlock(bytesOrBase64, name) {
   return {
     type: 'document',
     source: {
       type: 'base64',
       media_type: 'application/pdf',
-      data: bytesToBase64(bytes),
+      data: typeof bytesOrBase64 === 'string'
+        ? bytesOrBase64
+        : bytesToBase64(bytesOrBase64),
     },
     ...(name ? { title: name } : {}),
   };
 }
 
-export const PDF_PASSTHROUGH_MAX_BYTES = 16 * 1024 * 1024; // 16 MB
+export { PDF_PASSTHROUGH_MAX_BYTES };
diff --git a/src/chrome/src/offscreen/pdf-extraction-host.js b/src/chrome/src/offscreen/pdf-extraction-host.js
index 732b017f8..ccbfe9703 100644
--- a/src/chrome/src/offscreen/pdf-extraction-host.js
+++ b/src/chrome/src/offscreen/pdf-extraction-host.js
@@ -1,7 +1,12 @@
 import {
   PDF_EXTRACTION_MESSAGE,
+  PDF_EXTRACTION_READY_MESSAGE,
+  PDF_PASSTHROUGH_MAX_BYTES,
+  bytesToBase64,
   extractPdfTextFromBytes,
   fetchPdfBytes,
+  isTrustedPdfExtractionSender,
+  normalizePdfUrl,
 } from '../agent/pdf-extraction.js';
 let pdfjsPromise = null;
 
@@ -16,15 +21,29 @@ function getPdfjs() {
   return pdfjsPromise;
 }
 
-chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
-  if (message?.type !== PDF_EXTRACTION_MESSAGE) return false;
+chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
+  if (![PDF_EXTRACTION_MESSAGE, PDF_EXTRACTION_READY_MESSAGE].includes(message?.type)) return false;
+  if (!isTrustedPdfExtractionSender(sender)) {
+    sendResponse({ ok: false, ready: false, error: 'Unauthorized PDF extraction sender.' });
+    return false;
+  }
+  if (message.type === PDF_EXTRACTION_READY_MESSAGE) {
+    sendResponse({ ok: true, ready: true });
+    return false;
+  }
 
   (async () => {
-    const url = String(message.url || '').trim();
-    if (!url) throw new Error('PDF extraction requires a URL.');
+    const url = normalizePdfUrl(message.url);
     const bytes = await fetchPdfBytes(url);
+    // PDF.js can transfer and detach the input buffer. Encode the optional
+    // Claude document before parsing so text and document use the same fetch.
+    const pdfBase64 = message.options?.includeBase64 === true
+      && bytes.length <= PDF_PASSTHROUGH_MAX_BYTES
+      ? bytesToBase64(bytes)
+      : '';
     const pdfjs = await getPdfjs();
     const result = await extractPdfTextFromBytes(pdfjs, bytes, message.options || {});
+    if (pdfBase64) result._pdfBase64 = pdfBase64;
     sendResponse({ ok: true, result });
   })().catch((error) => {
     sendResponse({ ok: false, error: error?.message || String(error) });
diff --git a/src/chrome/vendor/pdfjs/README.md b/src/chrome/vendor/pdfjs/README.md
index f9d00790c..beb3d7d58 100644
--- a/src/chrome/vendor/pdfjs/README.md
+++ b/src/chrome/vendor/pdfjs/README.md
@@ -46,11 +46,16 @@ pdfjs.GlobalWorkerOptions.workerSrc =
   chrome.runtime.getURL('vendor/pdfjs/pdf.worker.mjs');
 ```
 
-The Agent's `read_pdf` facade ensures the shared offscreen document and sends
-it the PDF URL plus bounded page options. Both PDF.js files are listed in
-`manifest.json`'s `web_accessible_resources`, so `chrome.runtime.getURL`
-returns a fetchable URL without loading the multi-megabyte modules during
-ordinary service-worker startup.
+The Agent's `read_pdf` facade ensures the shared offscreen document, waits for
+an explicit ready response, and then sends the PDF URL plus bounded page
+options. The host accepts requests only from the extension's background
+service worker and only fetches `http:`, `https:`, or `file:` URLs. For Claude
+passthrough, it encodes the same fetched bytes before PDF.js transfers the
+buffer to its worker, so text extraction and the document attachment cannot
+diverge. Both PDF.js files are listed in `manifest.json`'s
+`web_accessible_resources`, so `chrome.runtime.getURL` returns a fetchable URL
+without loading the multi-megabyte modules during ordinary service-worker
+startup.
 
 ## Updating
 
diff --git a/test/pdf-mime-handler-e2e.mjs b/test/pdf-mime-handler-e2e.mjs
index d4d33b721..8594a99f0 100644
--- a/test/pdf-mime-handler-e2e.mjs
+++ b/test/pdf-mime-handler-e2e.mjs
@@ -65,12 +65,14 @@ function createMinimalPdf() {
 
 async function startPdfServer() {
   const pdf = createMinimalPdf();
+  let requestCount = 0;
   const server = createServer((request, response) => {
     const url = new URL(request.url || '/', 'http://127.0.0.1');
     if (url.pathname !== '/document.pdf') {
       response.writeHead(404).end('not found');
       return;
     }
+    requestCount += 1;
     response.writeHead(200, {
       'content-type': pdfMimeType,
       'content-length': String(pdf.byteLength),
@@ -87,6 +89,8 @@ async function startPdfServer() {
   assert.ok(address && typeof address === 'object');
   return {
     server,
+    pdf,
+    requestCount: () => requestCount,
     url: `http://127.0.0.1:${address.port}/document.pdf`,
   };
 }
@@ -159,22 +163,41 @@ async function main() {
     ));
     assert.equal(apiAvailable, true, `Chrome ${browser.version()} does not expose the public MIME handler options API.`);
 
-    const extraction = await settings.evaluate(async url => {
-      const ensured = await chrome.runtime.sendMessage({
+    const ensured = await settings.evaluate(async () => chrome.runtime.sendMessage({
         target: 'background',
         action: 'ensure_offscreen_offline_rag_host',
-      });
-      const response = await chrome.runtime.sendMessage({
+      }));
+    assert.equal(ensured?.ready, true, 'The background did not create the shared offscreen host.');
+
+    const rejected = await settings.evaluate(async url => chrome.runtime.sendMessage({
         type: 'offscreen-pdf-extract',
         url,
         options: { fromPage: 1, toPage: 1, maxChars: 5000 },
-      });
-      return { ensured, response };
-    }, fixture.url);
-    assert.equal(extraction.ensured?.ready, true, 'The background did not create the shared offscreen host.');
-    assert.equal(extraction.response?.ok, true, extraction.response?.error || 'The offscreen PDF parser failed.');
-    assert.equal(extraction.response.result?.totalPages, 1);
-    assert.match(extraction.response.result?.pages?.[0] || '', /WebBrain PDF MIME handler test/);
+      }), fixture.url);
+    assert.equal(rejected?.ok, false, 'An extension page bypassed the background-only PDF extraction gate.');
+    assert.match(rejected?.error || '', /Unauthorized PDF extraction sender/);
+    assert.equal(fixture.requestCount(), 0, 'An unauthorized PDF extraction request reached the network.');
+
+    const backgroundUrl = `chrome-extension://${extensionId}/src/background.js`;
+    const background = context.serviceWorkers().find(worker => worker.url() === backgroundUrl);
+    assert.ok(background, 'The WebBrain service worker was not available for the PDF extraction test.');
+    const ready = await background.evaluate(async () => chrome.runtime.sendMessage({
+      type: 'offscreen-pdf-extract-ready',
+    }));
+    assert.equal(ready?.ready, true, ready?.error || 'The offscreen PDF parser did not become ready.');
+
+    const requestsBeforeExtraction = fixture.requestCount();
+    const extraction = await background.evaluate(async url => chrome.runtime.sendMessage({
+      type: 'offscreen-pdf-extract',
+      url,
+      options: { fromPage: 1, toPage: 1, maxChars: 5000, includeBase64: true },
+    }), fixture.url);
+    assert.equal(extraction?.ok, true, extraction?.error || 'The offscreen PDF parser failed.');
+    assert.equal(fixture.requestCount() - requestsBeforeExtraction, 1, 'Claude-compatible extraction fetched the PDF more than once.');
+    assert.equal(extraction.result?.totalPages, 1);
+    assert.equal(extraction.result?.byteLength, fixture.pdf.byteLength);
+    assert.match(extraction.result?.pages?.[0] || '', /WebBrain PDF MIME handler test/);
+    assert.deepEqual(Buffer.from(extraction.result?._pdfBase64 || '', 'base64'), fixture.pdf);
 
     await waitForNativeHandlerOption(settings, false);
     // Installation initially registers public MIME handlers as enabled. Allow
diff --git a/test/pdf-read.mjs b/test/pdf-read.mjs
index 2fc1ba4fa..4e8856bf5 100644
--- a/test/pdf-read.mjs
+++ b/test/pdf-read.mjs
@@ -16,6 +16,7 @@ async function testMv3PdfExtractionUsesTheSharedOffscreenHost() {
   const host = await readFile(pdfExtractionHostPath, 'utf8');
   const offscreenHtml = await readFile(offscreenHtmlPath, 'utf8');
   assert.match(pdfTools, /ensureOffscreen\(\)/);
+  assert.match(pdfTools, /PDF_EXTRACTION_READY_MESSAGE/);
   assert.match(pdfTools, /type: PDF_EXTRACTION_MESSAGE/);
   assert.doesNotMatch(
     pdfTools,
@@ -24,9 +25,45 @@ async function testMv3PdfExtractionUsesTheSharedOffscreenHost() {
   );
   assert.match(host, /import\(chrome\.runtime\.getURL\('vendor\/pdfjs\/pdf\.mjs'\)\)/);
   assert.match(host, /extractPdfTextFromBytes/);
+  assert.match(host, /isTrustedPdfExtractionSender\(sender\)/);
   assert.match(offscreenHtml, /<script type="module" src="pdf-extraction-host\.js"><\/script>/);
 }
 
+async function testPdfUrlAndSenderBoundaries() {
+  const {
+    fetchPdfBytes,
+    isTrustedPdfExtractionSender,
+    normalizePdfUrl,
+  } = await import(pathToFileURL(pdfExtractionModulePath).href);
+  const runtime = {
+    id: 'trusted-extension',
+    getURL: path => `chrome-extension://trusted-extension/${path}`,
+  };
+  const backgroundUrl = runtime.getURL('src/background.js');
+  assert.equal(isTrustedPdfExtractionSender({ id: runtime.id, url: backgroundUrl }, runtime), true);
+  assert.equal(isTrustedPdfExtractionSender({ id: runtime.id, url: runtime.getURL('src/ui/settings.html') }, runtime), false);
+  assert.equal(isTrustedPdfExtractionSender({ id: runtime.id, url: backgroundUrl, tab: { id: 7 } }, runtime), false);
+  assert.equal(isTrustedPdfExtractionSender({ id: 'other-extension', url: backgroundUrl }, runtime), false);
+
+  assert.equal(normalizePdfUrl('https://example.test/document.pdf'), 'https://example.test/document.pdf');
+  assert.equal(normalizePdfUrl('file:///tmp/document.pdf'), 'file:///tmp/document.pdf');
+  assert.throws(() => normalizePdfUrl('data:application/pdf;base64,JVBERg=='), /must use http.*https.*file/i);
+  assert.throws(() => normalizePdfUrl('javascript:alert(1)'), /must use http.*https.*file/i);
+
+  let fetchCalls = 0;
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => {
+    fetchCalls += 1;
+    throw new Error('disallowed URL reached fetch');
+  };
+  try {
+    await assert.rejects(fetchPdfBytes('chrome-extension://trusted-extension/private.pdf'), /must use http.*https.*file/i);
+    assert.equal(fetchCalls, 0, 'Disallowed schemes must be rejected before fetch.');
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
 async function testPdfExtractionPreservesBoundedPageMetadataAndTruncation() {
   const { extractPdfTextFromBytes } = await import(pathToFileURL(pdfExtractionModulePath).href);
   const cleanedPages = [];
@@ -73,11 +110,17 @@ async function testPdfFacadeRequestsOffscreenExtractionAndPreservesClaudeBytes()
   const originalChrome = globalThis.chrome;
   const originalFetch = globalThis.fetch;
   const messages = [];
+  let readyAttempts = 0;
+  let fetchCalls = 0;
   globalThis.chrome = {
     offscreen: { hasDocument: async () => true },
     runtime: {
       sendMessage: async message => {
         messages.push(message);
+        if (message.type === 'offscreen-pdf-extract-ready') {
+          readyAttempts += 1;
+          return readyAttempts < 3 ? undefined : { ok: true, ready: true };
+        }
         return {
           ok: true,
           result: {
@@ -91,39 +134,46 @@ async function testPdfFacadeRequestsOffscreenExtractionAndPreservesClaudeBytes()
             hasExtractableText: true,
             truncated: false,
             byteLength: 3,
+            ...(message.options?.includeBase64 ? { _pdfBase64: 'BAUG' } : {}),
           },
         };
       },
     },
   };
-  globalThis.fetch = async () => new Response(new Uint8Array([4, 5, 6]), {
-    status: 200,
-    headers: { 'content-type': 'application/pdf' },
-  });
+  globalThis.fetch = async () => {
+    fetchCalls += 1;
+    throw new Error('The service-worker facade must not fetch the PDF.');
+  };
   try {
-    const { extractPdfText } = await import(pathToFileURL(pdfToolsModulePath).href);
+    const { buildClaudeDocumentBlock, extractPdfText } = await import(pathToFileURL(pdfToolsModulePath).href);
     const plainResult = await extractPdfText('https://example.test/document.pdf', {
       fromPage: 2,
       toPage: 4,
       maxChars: 5000,
     });
     assert.equal(plainResult.title, 'Facade fixture');
-    assert.equal(plainResult._pdfBytes, undefined);
+    assert.equal(plainResult._pdfBase64, undefined);
 
     const claudeResult = await extractPdfText('https://example.test/document.pdf', {
-      includeBytes: true,
+      includeDocument: true,
     });
-    assert.deepEqual(Array.from(claudeResult._pdfBytes), [4, 5, 6]);
+    assert.equal(claudeResult._pdfBase64, 'BAUG');
+    assert.equal(buildClaudeDocumentBlock(claudeResult._pdfBase64, 'fixture.pdf').source.data, 'BAUG');
+    assert.equal(fetchCalls, 0);
     assert.deepEqual(messages, [
+      { type: 'offscreen-pdf-extract-ready' },
+      { type: 'offscreen-pdf-extract-ready' },
+      { type: 'offscreen-pdf-extract-ready' },
       {
         type: 'offscreen-pdf-extract',
         url: 'https://example.test/document.pdf',
-        options: { fromPage: 2, toPage: 4, maxChars: 5000 },
+        options: { fromPage: 2, toPage: 4, maxChars: 5000, includeBase64: false },
       },
+      { type: 'offscreen-pdf-extract-ready' },
       {
         type: 'offscreen-pdf-extract',
         url: 'https://example.test/document.pdf',
-        options: { fromPage: undefined, toPage: undefined, maxChars: undefined },
+        options: { fromPage: undefined, toPage: undefined, maxChars: undefined, includeBase64: true },
       },
     ]);
   } finally {
@@ -135,8 +185,9 @@ async function testPdfFacadeRequestsOffscreenExtractionAndPreservesClaudeBytes()
 
 const tests = [
   ['MV3 PDF extraction uses the shared offscreen host', testMv3PdfExtractionUsesTheSharedOffscreenHost],
+  ['PDF extraction rejects unsafe URLs and untrusted senders', testPdfUrlAndSenderBoundaries],
   ['PDF extraction preserves bounded page metadata and truncation', testPdfExtractionPreservesBoundedPageMetadataAndTruncation],
-  ['PDF facade delegates extraction and preserves Claude bytes', testPdfFacadeRequestsOffscreenExtractionAndPreservesClaudeBytes],
+  ['PDF facade waits for host readiness and reuses Claude bytes', testPdfFacadeRequestsOffscreenExtractionAndPreservesClaudeBytes],
 ];
 
 let failed = 0;

From ee4e10445586baeb879c68f8132289de9c95c7e9 Mon Sep 17 00:00:00 2001
From: 16Miku <196724264+16Miku@users.noreply.github.com>
Date: Sat, 5 Sep 2026 23:01:40 +0800
Subject: [PATCH 3/5] docs(chrome): explain PDF base64 overhead

---
 src/chrome/src/offscreen/pdf-extraction-host.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/chrome/src/offscreen/pdf-extraction-host.js b/src/chrome/src/offscreen/pdf-extraction-host.js
index ccbfe9703..e5c37d22a 100644
--- a/src/chrome/src/offscreen/pdf-extraction-host.js
+++ b/src/chrome/src/offscreen/pdf-extraction-host.js
@@ -37,6 +37,8 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     const bytes = await fetchPdfBytes(url);
     // PDF.js can transfer and detach the input buffer. Encode the optional
     // Claude document before parsing so text and document use the same fetch.
+    // The ~4/3 base64 message overhead is intentional to preserve that
+    // single-fetch, byte-identical guarantee.
     const pdfBase64 = message.options?.includeBase64 === true
       && bytes.length <= PDF_PASSTHROUGH_MAX_BYTES
       ? bytesToBase64(bytes)

From aa8c6fb8ff1620e443ebd8d3b55d681a63544989 Mon Sep 17 00:00:00 2001
From: Codex release-state test <codex-release-test@example.invalid>
Date: Sat, 5 Sep 2026 18:33:31 +0300
Subject: [PATCH 4/5] fix(chrome): harden PDF host readiness, sender gate, and
 handler URLs

Four fixes from a review pass over the offscreen extraction path.

- waitForPdfExtractionHost() treated every non-ready response as transient.
  An "Unauthorized PDF extraction sender." refusal is permanent, but it
  burned all 40 attempts and then surfaced as "did not become ready", which
  points a debugger at the wrong subsystem. It also never re-ensured the
  document, so an offscreen page that went away between ensureOffscreen()
  and the probe failed read_pdf permanently instead of recreating the host.
- isTrustedPdfExtractionSender() hardcoded 'src/background.js', duplicating
  the manifest. Renaming the service worker entry would have rejected every
  extraction with that same misleading error, and no test would have caught
  it. The path now comes from getManifest().
- The scheme allowlist hard-failed on our own viewer tabs. With the native
  MIME handler on, a PDF tab's URL is src/ui/pdf-handler.html?url=..., and
  read_pdf falls back to the tab URL, so it returned "PDF URL must use
  http:, https:, or file:." normalizePdfUrl() now unwraps the inner URL for
  that page only, and the unwrapped URL still passes the allowlist.
- The passthrough base64 was encoded before parsing, so a corrupt PDF that
  threw in getDocument() still paid for a string nobody reads. The bytes are
  copied before parsing, preserving the single-fetch guarantee, and encoded
  only after extraction succeeds.

Also waits for the service worker in the MIME-handler e2e: serviceWorkers()
is a snapshot, so the lookup could miss a worker Chrome had idled out.

node test/run.js: 2198 passed, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196wte9FS1SnsrKvrQUbB7m
---
 src/chrome/src/agent/pdf-extraction.js        | 36 +++++++++++++++++--
 src/chrome/src/agent/pdf-tools.js             | 14 +++++++-
 .../src/offscreen/pdf-extraction-host.js      | 19 +++++-----
 test/pdf-mime-handler-e2e.mjs                 | 10 +++++-
 test/pdf-read.mjs                             | 24 +++++++++++++
 5 files changed, 90 insertions(+), 13 deletions(-)

diff --git a/src/chrome/src/agent/pdf-extraction.js b/src/chrome/src/agent/pdf-extraction.js
index 7a6134f00..70a8d89ca 100644
--- a/src/chrome/src/agent/pdf-extraction.js
+++ b/src/chrome/src/agent/pdf-extraction.js
@@ -11,26 +11,58 @@ export const PDF_EXTRACTION_READY_MESSAGE = 'offscreen-pdf-extract-ready';
 export const PDF_PASSTHROUGH_MAX_BYTES = 16 * 1024 * 1024;
 
 const ALLOWED_PDF_PROTOCOLS = new Set(['http:', 'https:', 'file:']);
+const PDF_HANDLER_PAGE = 'src/ui/pdf-handler.html';
 const BASE64_MAX_INPUT_BYTES = 32 * 1024 * 1024;
 
-export function normalizePdfUrl(value) {
+// When the native MIME handler owns a PDF tab, the tab URL is our own viewer
+// page wrapping the real URL in ?url=. read_pdf falls back to the tab URL when
+// called without an explicit one, so unwrap it before the scheme check.
+function unwrapPdfHandlerUrl(url, runtime = globalThis.chrome?.runtime) {
+  if (url.protocol !== 'chrome-extension:' && url.protocol !== 'moz-extension:') return url;
+  if (typeof runtime?.getURL !== 'function') return url;
+  let handler;
+  try {
+    handler = new URL(runtime.getURL(PDF_HANDLER_PAGE));
+  } catch {
+    return url;
+  }
+  if (url.origin !== handler.origin || url.pathname !== handler.pathname) return url;
+  const inner = url.searchParams.get('url');
+  if (!inner) return url;
+  try {
+    return new URL(inner);
+  } catch {
+    return url;
+  }
+}
+
+export function normalizePdfUrl(value, runtime = globalThis.chrome?.runtime) {
   let url;
   try {
     url = new URL(String(value || '').trim());
   } catch {
     throw new Error('PDF extraction requires a valid URL.');
   }
+  url = unwrapPdfHandlerUrl(url, runtime);
   if (!ALLOWED_PDF_PROTOCOLS.has(url.protocol)) {
     throw new Error('PDF URL must use http:, https:, or file:.');
   }
   return url.href;
 }
 
+// Derived from the manifest rather than hardcoded: a rename of the service
+// worker entry would otherwise reject every extraction with a "not ready"
+// error that points at the wrong subsystem.
+function backgroundScriptPath(runtime) {
+  const manifest = typeof runtime?.getManifest === 'function' ? runtime.getManifest() : null;
+  return manifest?.background?.service_worker || 'src/background.js';
+}
+
 export function isTrustedPdfExtractionSender(sender, runtime = globalThis.chrome?.runtime) {
   if (!runtime?.id || typeof runtime.getURL !== 'function') return false;
   return sender?.id === runtime.id
     && sender?.tab == null
-    && sender?.url === runtime.getURL('src/background.js');
+    && sender?.url === runtime.getURL(backgroundScriptPath(runtime));
 }
 
 export function bytesToBase64(bytes) {
diff --git a/src/chrome/src/agent/pdf-tools.js b/src/chrome/src/agent/pdf-tools.js
index 9eafe5a02..7795af98a 100644
--- a/src/chrome/src/agent/pdf-tools.js
+++ b/src/chrome/src/agent/pdf-tools.js
@@ -44,13 +44,25 @@ function wait(ms) {
 async function waitForPdfExtractionHost() {
   let lastError = null;
   for (let attempt = 0; attempt < PDF_HOST_READY_ATTEMPTS; attempt++) {
+    let refusal = null;
     try {
       const response = await chrome.runtime.sendMessage({ type: PDF_EXTRACTION_READY_MESSAGE });
       if (response?.ready === true) return;
-      if (response?.error) lastError = new Error(response.error);
+      // An explicit error means the host answered and refused. Retrying cannot
+      // change the outcome, and reporting it as "not ready" sends whoever is
+      // debugging to the wrong subsystem.
+      if (response?.error) refusal = new Error(response.error);
     } catch (error) {
+      // No listener: the document went away between ensureOffscreen() seeing it
+      // and this probe. Recreate it rather than retrying into a dead channel.
       lastError = error;
+      try {
+        await ensureOffscreen();
+      } catch (ensureError) {
+        lastError = ensureError;
+      }
     }
+    if (refusal) throw refusal;
     if (attempt + 1 < PDF_HOST_READY_ATTEMPTS) await wait(PDF_HOST_READY_RETRY_MS);
   }
   const detail = lastError?.message ? ` ${lastError.message}` : '';
diff --git a/src/chrome/src/offscreen/pdf-extraction-host.js b/src/chrome/src/offscreen/pdf-extraction-host.js
index e5c37d22a..26332406b 100644
--- a/src/chrome/src/offscreen/pdf-extraction-host.js
+++ b/src/chrome/src/offscreen/pdf-extraction-host.js
@@ -35,17 +35,18 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
   (async () => {
     const url = normalizePdfUrl(message.url);
     const bytes = await fetchPdfBytes(url);
-    // PDF.js can transfer and detach the input buffer. Encode the optional
-    // Claude document before parsing so text and document use the same fetch.
-    // The ~4/3 base64 message overhead is intentional to preserve that
-    // single-fetch, byte-identical guarantee.
-    const pdfBase64 = message.options?.includeBase64 === true
-      && bytes.length <= PDF_PASSTHROUGH_MAX_BYTES
-      ? bytesToBase64(bytes)
-      : '';
+    // PDF.js can transfer and detach the input buffer, so keep a copy of the
+    // optional Claude document taken before parsing: text and document then
+    // come from the same fetch. The ~4/3 base64 message overhead is
+    // intentional to preserve that single-fetch, byte-identical guarantee.
+    // The encode itself is deferred until parsing succeeds, so a corrupt PDF
+    // that throws in getDocument() does not pay for a string nobody reads.
+    const wantsBase64 = message.options?.includeBase64 === true
+      && bytes.length <= PDF_PASSTHROUGH_MAX_BYTES;
+    const passthrough = wantsBase64 ? bytes.slice() : null;
     const pdfjs = await getPdfjs();
     const result = await extractPdfTextFromBytes(pdfjs, bytes, message.options || {});
-    if (pdfBase64) result._pdfBase64 = pdfBase64;
+    if (passthrough) result._pdfBase64 = bytesToBase64(passthrough);
     sendResponse({ ok: true, result });
   })().catch((error) => {
     sendResponse({ ok: false, error: error?.message || String(error) });
diff --git a/test/pdf-mime-handler-e2e.mjs b/test/pdf-mime-handler-e2e.mjs
index 8594a99f0..fa769bc7e 100644
--- a/test/pdf-mime-handler-e2e.mjs
+++ b/test/pdf-mime-handler-e2e.mjs
@@ -179,7 +179,15 @@ async function main() {
     assert.equal(fixture.requestCount(), 0, 'An unauthorized PDF extraction request reached the network.');
 
     const backgroundUrl = `chrome-extension://${extensionId}/src/background.js`;
-    const background = context.serviceWorkers().find(worker => worker.url() === backgroundUrl);
+    // serviceWorkers() is a snapshot: Playwright may not have observed the
+    // worker yet, and Chrome can idle it out during the steps above.
+    let background = context.serviceWorkers().find(worker => worker.url() === backgroundUrl);
+    if (!background) {
+      background = await context.waitForEvent('serviceworker', {
+        predicate: worker => worker.url() === backgroundUrl,
+        timeout: 10000,
+      }).catch(() => null);
+    }
     assert.ok(background, 'The WebBrain service worker was not available for the PDF extraction test.');
     const ready = await background.evaluate(async () => chrome.runtime.sendMessage({
       type: 'offscreen-pdf-extract-ready',
diff --git a/test/pdf-read.mjs b/test/pdf-read.mjs
index 4e8856bf5..88e876701 100644
--- a/test/pdf-read.mjs
+++ b/test/pdf-read.mjs
@@ -45,11 +45,35 @@ async function testPdfUrlAndSenderBoundaries() {
   assert.equal(isTrustedPdfExtractionSender({ id: runtime.id, url: backgroundUrl, tab: { id: 7 } }, runtime), false);
   assert.equal(isTrustedPdfExtractionSender({ id: 'other-extension', url: backgroundUrl }, runtime), false);
 
+  // The trusted path follows the manifest, so renaming the service worker
+  // entry cannot silently start rejecting every extraction.
+  const renamedRuntime = {
+    ...runtime,
+    getManifest: () => ({ background: { service_worker: 'src/sw/main.js' } }),
+  };
+  assert.equal(isTrustedPdfExtractionSender(
+    { id: runtime.id, url: renamedRuntime.getURL('src/sw/main.js') }, renamedRuntime), true);
+  assert.equal(isTrustedPdfExtractionSender(
+    { id: runtime.id, url: backgroundUrl }, renamedRuntime), false);
+
   assert.equal(normalizePdfUrl('https://example.test/document.pdf'), 'https://example.test/document.pdf');
   assert.equal(normalizePdfUrl('file:///tmp/document.pdf'), 'file:///tmp/document.pdf');
   assert.throws(() => normalizePdfUrl('data:application/pdf;base64,JVBERg=='), /must use http.*https.*file/i);
   assert.throws(() => normalizePdfUrl('javascript:alert(1)'), /must use http.*https.*file/i);
 
+  // A PDF tab owned by the native MIME handler reports our viewer page as its
+  // URL; read_pdf falls back to that, so the real URL must be unwrapped.
+  const handlerUrl = `${runtime.getURL('src/ui/pdf-handler.html')}?url=${encodeURIComponent('https://example.test/paper.pdf')}&tabId=7`;
+  assert.equal(normalizePdfUrl(handlerUrl, runtime), 'https://example.test/paper.pdf');
+  assert.throws(
+    () => normalizePdfUrl(`${runtime.getURL('src/ui/settings.html')}?url=${encodeURIComponent('https://example.test/x.pdf')}`, runtime),
+    /must use http.*https.*file/i,
+    'Only the PDF handler page may unwrap an inner URL.');
+  assert.throws(
+    () => normalizePdfUrl(`${runtime.getURL('src/ui/pdf-handler.html')}?url=${encodeURIComponent('javascript:alert(1)')}`, runtime),
+    /must use http.*https.*file/i,
+    'An unwrapped inner URL must still pass the scheme allowlist.');
+
   let fetchCalls = 0;
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async () => {

From e2ccc2e92a6f649bc882ca82e433f3d41ee630c0 Mon Sep 17 00:00:00 2001
From: Codex release-state test <codex-release-test@example.invalid>
Date: Sun, 6 Sep 2026 17:58:07 +0300
Subject: [PATCH 5/5] fix(chrome): retry PDF.js import, derive viewer path,
 guard double response
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three follow-ups on the offscreen PDF extraction host:

getPdfjs() memoized its rejection as well as its result. The old pdf-tools.js
assigned the module only after the await succeeded, so a failed import retried
on the next call. Because the offscreen document outlives any single read, one
transient failure of the vendor/pdfjs/pdf.mjs import made every later read_pdf
fail with the same stale error until the document was torn down. Clear the
promise on rejection to restore the retry.

PDF_HANDLER_PAGE hardcoded the viewer path, duplicating the manifest's
mime_types_handler handler_url — the same duplication we removed for
background.service_worker. Renaming the viewer would have made read_pdf on our
own PDF tabs fail with a misleading scheme error. Derive it from getManifest(),
keeping the literal as a fallback for runtime stubs without getManifest.

A throwing sendResponse on the success path fell through to the catch, which
responded a second time on a closed channel; that second throw became an
unhandled rejection and swallowed the original error. Route both replies
through a single-shot respond().

Also hoists the per-message message-type array into a module-level Set, matching
vision-inference-host.js.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FrohYGnD3GTHtRXsA1vhh1
---
 src/chrome/src/agent/pdf-extraction.js        | 12 +++++--
 .../src/offscreen/pdf-extraction-host.js      | 33 ++++++++++++++++---
 test/pdf-read.mjs                             | 19 +++++++++++
 3 files changed, 57 insertions(+), 7 deletions(-)

diff --git a/src/chrome/src/agent/pdf-extraction.js b/src/chrome/src/agent/pdf-extraction.js
index 70a8d89ca..27c951545 100644
--- a/src/chrome/src/agent/pdf-extraction.js
+++ b/src/chrome/src/agent/pdf-extraction.js
@@ -11,9 +11,17 @@ export const PDF_EXTRACTION_READY_MESSAGE = 'offscreen-pdf-extract-ready';
 export const PDF_PASSTHROUGH_MAX_BYTES = 16 * 1024 * 1024;
 
 const ALLOWED_PDF_PROTOCOLS = new Set(['http:', 'https:', 'file:']);
-const PDF_HANDLER_PAGE = 'src/ui/pdf-handler.html';
+const DEFAULT_PDF_HANDLER_PAGE = 'src/ui/pdf-handler.html';
 const BASE64_MAX_INPUT_BYTES = 32 * 1024 * 1024;
 
+// Derived from the manifest for the same reason as the background path below:
+// renaming the viewer page would otherwise make read_pdf report a bogus
+// "must use http:, https:, or file:" on our own PDF tabs.
+function pdfHandlerPage(runtime) {
+  const manifest = typeof runtime?.getManifest === 'function' ? runtime.getManifest() : null;
+  return manifest?.mime_types_handler?.['application/pdf']?.handler_url || DEFAULT_PDF_HANDLER_PAGE;
+}
+
 // When the native MIME handler owns a PDF tab, the tab URL is our own viewer
 // page wrapping the real URL in ?url=. read_pdf falls back to the tab URL when
 // called without an explicit one, so unwrap it before the scheme check.
@@ -22,7 +30,7 @@ function unwrapPdfHandlerUrl(url, runtime = globalThis.chrome?.runtime) {
   if (typeof runtime?.getURL !== 'function') return url;
   let handler;
   try {
-    handler = new URL(runtime.getURL(PDF_HANDLER_PAGE));
+    handler = new URL(runtime.getURL(pdfHandlerPage(runtime)));
   } catch {
     return url;
   }
diff --git a/src/chrome/src/offscreen/pdf-extraction-host.js b/src/chrome/src/offscreen/pdf-extraction-host.js
index 26332406b..6287eb1bc 100644
--- a/src/chrome/src/offscreen/pdf-extraction-host.js
+++ b/src/chrome/src/offscreen/pdf-extraction-host.js
@@ -8,6 +8,9 @@ import {
   isTrustedPdfExtractionSender,
   normalizePdfUrl,
 } from '../agent/pdf-extraction.js';
+
+const PDF_MESSAGE_TYPES = new Set([PDF_EXTRACTION_MESSAGE, PDF_EXTRACTION_READY_MESSAGE]);
+
 let pdfjsPromise = null;
 
 function getPdfjs() {
@@ -17,18 +20,38 @@ function getPdfjs() {
         chrome.runtime.getURL('vendor/pdfjs/pdf.worker.mjs');
       return pdfjs;
     });
+    // The offscreen document outlives any single read, so never memoize a
+    // rejection: one transient import failure would otherwise make every
+    // later read_pdf fail until the document is torn down.
+    pdfjsPromise.catch(() => { pdfjsPromise = null; });
   }
   return pdfjsPromise;
 }
 
 chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
-  if (![PDF_EXTRACTION_MESSAGE, PDF_EXTRACTION_READY_MESSAGE].includes(message?.type)) return false;
+  if (!PDF_MESSAGE_TYPES.has(message?.type)) return false;
+
+  // A 16 MB PDF answers with ~21 MB of base64, and an oversized or
+  // unserializable reply makes sendResponse throw. Without this guard that
+  // throw would reach the catch below and call sendResponse a second time on
+  // an already-closed channel, hiding the original failure.
+  let responded = false;
+  const respond = (payload) => {
+    if (responded) return;
+    responded = true;
+    try {
+      sendResponse(payload);
+    } catch (error) {
+      console.warn('[pdf-extraction-host] failed to deliver response', error);
+    }
+  };
+
   if (!isTrustedPdfExtractionSender(sender)) {
-    sendResponse({ ok: false, ready: false, error: 'Unauthorized PDF extraction sender.' });
+    respond({ ok: false, ready: false, error: 'Unauthorized PDF extraction sender.' });
     return false;
   }
   if (message.type === PDF_EXTRACTION_READY_MESSAGE) {
-    sendResponse({ ok: true, ready: true });
+    respond({ ok: true, ready: true });
     return false;
   }
 
@@ -47,9 +70,9 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     const pdfjs = await getPdfjs();
     const result = await extractPdfTextFromBytes(pdfjs, bytes, message.options || {});
     if (passthrough) result._pdfBase64 = bytesToBase64(passthrough);
-    sendResponse({ ok: true, result });
+    respond({ ok: true, result });
   })().catch((error) => {
-    sendResponse({ ok: false, error: error?.message || String(error) });
+    respond({ ok: false, error: error?.message || String(error) });
   });
 
   return true;
diff --git a/test/pdf-read.mjs b/test/pdf-read.mjs
index 88e876701..32742a4a4 100644
--- a/test/pdf-read.mjs
+++ b/test/pdf-read.mjs
@@ -27,6 +27,9 @@ async function testMv3PdfExtractionUsesTheSharedOffscreenHost() {
   assert.match(host, /extractPdfTextFromBytes/);
   assert.match(host, /isTrustedPdfExtractionSender\(sender\)/);
   assert.match(offscreenHtml, /<script type="module" src="pdf-extraction-host\.js"><\/script>/);
+  // The offscreen document outlives any single read, so a failed PDF.js import
+  // must not be memoized into every later read_pdf.
+  assert.match(host, /pdfjsPromise\.catch\(\(\) => \{ pdfjsPromise = null; \}\);/);
 }
 
 async function testPdfUrlAndSenderBoundaries() {
@@ -74,6 +77,22 @@ async function testPdfUrlAndSenderBoundaries() {
     /must use http.*https.*file/i,
     'An unwrapped inner URL must still pass the scheme allowlist.');
 
+  // The viewer page follows the manifest too, so renaming it cannot start
+  // rejecting our own PDF tabs with a bogus scheme error.
+  const renamedHandlerRuntime = {
+    ...runtime,
+    getManifest: () => ({ mime_types_handler: { 'application/pdf': { handler_url: 'src/ui/viewer.html' } } }),
+  };
+  assert.equal(
+    normalizePdfUrl(
+      `${runtime.getURL('src/ui/viewer.html')}?url=${encodeURIComponent('https://example.test/paper.pdf')}&tabId=7`,
+      renamedHandlerRuntime),
+    'https://example.test/paper.pdf');
+  assert.throws(
+    () => normalizePdfUrl(handlerUrl, renamedHandlerRuntime),
+    /must use http.*https.*file/i,
+    'Only the manifest-declared viewer page may unwrap an inner URL.');
+
   let fetchCalls = 0;
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async () => {