fix(search): avoid mutating read-only error.message; harden redaction fallback (BUG-007)

Addresses a second Copilot review on PR #136:
- Build a redacted Error instead of assigning to error.message. The timeout path's
  AbortController abort rejects fetch with a DOMException whose `message` is
  getter-only, so the in-place mutation threw a secondary TypeError that masked the
  real error. The new Error preserves code/cause for createNetworkError; a
  DOMException regression test guards it.
- Widen the URL()-parse-failure fallback to strip userinfo through the last `@` in
  the authority ([^/]*@) so multi-@ authorities cannot leak later segments.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Codex <noreply@openai.com>

Author: 3 people

__tests__/unit/search.test.ts

@@ -969,6 +969,28 @@ async function runTests() {
     envManager.restore();
   }, results);
 
+  await testFunction('read-only error message (aborted request) does not throw a secondary TypeError', async () => {
+    clearSearxngInstanceStateForTests();
+    envManager.set('SEARXNG_URL', 'https://user:pass@abort.example.com');
+
+    const mockServer = createMockServer();
+    fetchMocker.mock(async () => {
+      throw new DOMException('This operation was aborted', 'AbortError');
+    });
+
+    try {
+      await performWebSearch(mockServer as any, 'abort');
+      assert.fail('Expected a handled network error');
+    } catch (error: any) {
+      assert.ok(!/only a getter|set property message/.test(error.message), error.message);
+      assert.match(error.message, /^🌐 Network Error:/);
+      assert.ok(!error.message.includes('user:pass@'), error.message);
+    }
+
+    fetchMocker.restore();
+    envManager.restore();
+  }, results);
+
   await testFunction('SEARXNG_TIMEOUT_MS env override is respected (50 ms fires before 500 ms mock)', async () => {
     envManager.set('SEARXNG_URL', 'https://test-searx.example.com');
     envManager.set('SEARXNG_TIMEOUT_MS', '50');

__tests__/unit/searxng-instances.test.ts

@@ -98,6 +98,15 @@ async function runTests() {
     assert.ok(!redacted.includes('pass'), redacted);
   }, results);
 
+  await testFunction('redactSearxngInstanceUrl strips multi-at userinfo from unparsable URL strings', () => {
+    const redacted = redactSearxngInstanceUrl('https://a:b@c@ho st.example.com');
+
+    assert.equal(redacted, 'https://ho st.example.com');
+    assert.ok(redacted.includes('ho st.example.com'), redacted);
+    assert.ok(!redacted.includes('a:b'), redacted);
+    assert.ok(!redacted.includes('@c'), redacted);
+  }, results);
+
   await testFunction('redactSearxngInstanceUrl leaves non-URL strings unchanged after parse failure', () => {
     assert.equal(redactSearxngInstanceUrl('not a url'), 'not a url');
   }, results);

src/search.ts

@@ -150,17 +150,20 @@ async function fetchWithSearchTimeout(
       signal: controller.signal,
     });
   } catch (error: any) {
-    if (typeof error.message === "string") {
-      error.message = error.message.replaceAll(rawUrl, redactedUrl);
-    }
-    logMessage(mcpServer, "error", `Network error during search request: ${error.message}`, { query, url: redactedUrl });
+    const safeMessage = typeof error?.message === "string"
+      ? error.message.replaceAll(rawUrl, redactedUrl)
+      : error?.message;
+    const safeError = new Error(safeMessage);
+    (safeError as any).code = error?.code;
+    (safeError as any).cause = error?.cause;
+    logMessage(mcpServer, "error", `Network error during search request: ${safeMessage}`, { query, url: redactedUrl });
     const context: ErrorContext = {
       url: redactedUrl,
       searxngUrl: redactSearxngInstanceUrl(searxngUrl),
       proxyAgent: !!(requestOptions as any).dispatcher,
       username: process.env.AUTH_USERNAME,
     };
-    throw createNetworkError(error, context);
+    throw createNetworkError(safeError, context);
   } finally {
     clearTimeout(timeoutId);
   }

src/searxng-instances.ts

@@ -65,7 +65,7 @@ export function redactSearxngInstanceUrl(raw: string): string {
     url.password = "";
     return url.toString();
   } catch {
-    return raw.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/@]*@/, "$1");
+    return raw.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/]*@/, "$1");
   }
 }