p2: fence document tags, atomic fleetctx, harden workspace

Neutralise </document and <document in page text. Counters are
atomic.Uint64. Workspace names are [A-Za-z0-9_-] and PathEscaped;
foreign workspace_id rows are dropped. Wayback closest.url must be
https://web.archive.org. archive.today snapshot_at is Memento-Datetime
or null.

internal/fleetctx/fleetctx.go

@@ -8,7 +8,10 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
+	"regexp"
 	"strings"
+	"sync/atomic"
 	"time"
 	"unicode/utf8"
 )
@@ -32,15 +35,21 @@ type Client struct {
 	Allow    []string
 	HTTP     *http.Client
 	Log      *slog.Logger
-	Calls    uint64
-	Hits     uint64
-	Failures uint64
+	Calls    atomic.Uint64
+	Hits     atomic.Uint64
+	Failures atomic.Uint64
 }
 
 func refused(ws string) bool {
 	return strings.EqualFold(strings.TrimSpace(ws), Forbidden)
 }
 
+var workspaceName = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
+
+func workspaceOK(ws string) bool {
+	return workspaceName.MatchString(ws)
+}
+
 func allowed(ws string, allow []string) bool {
 	if refused(ws) {
 		return false
@@ -63,23 +72,27 @@ func (c *Client) Search(ctx context.Context, workspace, query string) (items []I
 		if c.Log != nil {
 			c.Log.Warn("context refused", "workspace", workspace)
 		}
-		c.Failures++
+		c.Failures.Add(1)
 		return nil, "context refused: workspace"
 	}
+	if !workspaceOK(workspace) {
+		c.Failures.Add(1)
+		return nil, "context skipped: workspace"
+	}
 	if !allowed(workspace, c.Allow) {
 		if c.Log != nil {
 			c.Log.Warn("context workspace not allowlisted", "workspace", workspace)
 		}
 		return nil, "context skipped: workspace"
 	}
-	c.Calls++
+	c.Calls.Add(1)
 	sctx, cancel := context.WithTimeout(ctx, Timeout)
 	defer cancel()
-	url := strings.TrimRight(c.Base, "/") + "/v3/workspaces/" + workspace + "/search"
+	path := strings.TrimRight(c.Base, "/") + "/v3/workspaces/" + url.PathEscape(workspace) + "/search"
 	payload, _ := json.Marshal(map[string]any{"query": query, "limit": Limit})
-	req, err := http.NewRequestWithContext(sctx, http.MethodPost, url, bytes.NewReader(payload))
+	req, err := http.NewRequestWithContext(sctx, http.MethodPost, path, bytes.NewReader(payload))
 	if err != nil {
-		c.Failures++
+		c.Failures.Add(1)
 		return nil, "context failed"
 	}
 	req.Header.Set("Content-Type", "application/json")
@@ -89,12 +102,12 @@ func (c *Client) Search(ctx context.Context, workspace, query string) (items []I
 	}
 	resp, err := httpClient.Do(req)
 	if err != nil {
-		c.Failures++
+		c.Failures.Add(1)
 		return nil, "context failed"
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != 200 {
-		c.Failures++
+		c.Failures.Add(1)
 		return nil, "context failed"
 	}
 	var raw []struct {
@@ -105,10 +118,13 @@ func (c *Client) Search(ctx context.Context, workspace, query string) (items []I
 		WorkspaceID string `json:"workspace_id"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&raw); err != nil {
-		c.Failures++
+		c.Failures.Add(1)
 		return nil, "context failed"
 	}
 	for _, m := range raw {
+		if m.WorkspaceID != workspace {
+			continue
+		}
 		content := m.Content
 		if utf8.RuneCountInString(content) > MaxChars {
 			r := []rune(content)
@@ -122,7 +138,7 @@ func (c *Client) Search(ctx context.Context, workspace, query string) (items []I
 		})
 	}
 	if len(items) > 0 {
-		c.Hits++
+		c.Hits.Add(1)
 	}
 	return items, ""
 }