feat: Playwright fallback extractor for JS-heavy URL ingestion

[Copilot]

JS-rendered pages return empty content from the fast-path HTTP extractor, causing ob add <url> to ingest nothing useful. This adds an opt-in Playwright fallback that fires only when primary extraction falls below a configurable content-length threshold.

New modules

• src/lib/ingestion/extractor.ts — Extractor interface + ExtractResult type shared by all extractors
• src/lib/ingestion/extractor-fetch.ts — Fast-path primary extractor (fetch + HTML-to-text strip)
• src/lib/ingestion/extractor-playwright.ts — PlaywrightExtractor: headless Chromium/Firefox/WebKit, fresh context per run (no credential leakage), configurable timeout, graceful degradation if playwright is absent or launch fails
• src/lib/ingestion/service.ts — IngestionService orchestrating primary → fallback with structured telemetry on every invocation
• src/cli/commands/add.ts — ob add <url> CLI entry point

Opt-in / threshold behaviour

// Config-driven
const svc = new IngestionService(primary, playwright, { playwrightFallback: true, minContentLength: 200 });

// Or via environment variable (no config change needed)
// OB_PLAYWRIGHT_FALLBACK=1 ob add https://js-heavy-site.example.com

Fallback only runs when primaryResult.text.length < minContentLength (default 200). Without the flag, no browser process is ever spawned.

Dependency

playwright declared as an optional peer dependency — existing installs are unaffected. The import is guarded by a dynamic import() at runtime; a missing package logs a warning and falls through to the primary result.

Testing

47 unit tests using constructor-injected stub browser objects — no real browser, no network. Playwright's loadPlaywrightFn is injectable via the constructor to sidestep ESM module spy limitations.

const extractor = new PlaywrightExtractor(
  { browser: 'chromium', timeoutMs: 5000 },
  logger,
  async () => fakeBrowserModule   // injected stub — no real playwright import
);

Telemetry shape emitted on every ingest() call:

{
  event: 'playwright_fallback',
  triggered: boolean,
  primaryContentLength: number,
  fallbackContentLength: number,
  durationMs: number,
  success: boolean,
  errorType: 'launch_failed' | 'timeout' | 'navigation_error' | null,
  provider: 'playwright'
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh issue create --repo TheWizardsCode/ContextHub --title Sample --body-file - (http block)
  • Triggering command: /usr/bin/gh gh issue create --repo TheWizardsCode/ContextHub --title Sample --body-file - /wt k/ContextHub/Conrev-parse bash i/mo�� show-toplevel /tmp/wl-wt-err-wo4xgR/local-repo/.worklog/tmp-worktree-W2QQZD/wt in/bash -z --show-toplevel i/mock-bin/bash bash (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)