Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/CONFIGURATION.md`:
- Around line 86-92: Fix the spelling mistake in the `builtin-firecrawl-fetch`
table description: change "Firecrwawl" to "Firecrawl" in the description for
`SIBYL_FIRECRAWL_FETCH_USE_HTML` so the sentence reads "...otherwise returns the
markdown from Firecrawl with extra blank lines collapsed."
- Around line 20-22: Fix the grammar in the sentence that currently reads "one
of your custom written one!" by changing it to a correct plural or hyphenated
form; e.g., replace that fragment with "one of your custom-written plugins!" (or
"one of your custom written ones!") so it reads: "The value must match a
plugin's `name` (a builtin like `builtin-exa-search`, or one of your
custom-written plugins!)."

In `@docs/CREATING-PLUGINS.md`:
- Around line 81-96: Update the example plugin path string to fix the typo:
change the folder name `my-llm-ask-plugib` to `my-llm-ask-plugin` in the example
block so the ask function `askFn` and exported `SilbylPlugin` reference the
correct example path.

In `@README.md`:
- Around line 79-86: Remove the `ask` command row from the Commands table in
README.md so the table only documents the CLI commands actually implemented;
locate the table containing `search`, `fetch`, `ask`, `--help`, and `--version`
and delete the line starting with the `| `ask` ` row (the row that shows `sibyl
ask ...`) leaving the other rows unchanged.

In `@src/plugins/builtin-crawl4ai-fetch/main.ts`:
- Line 14: Rename the misspelled interface Craw4AiResult to Crawl4AiResult and
update all local references: change the type assertion that currently casts to
Craw4AiResult to cast to Crawl4AiResult, and update the error message text that
mentions "Crawl4AI" internals (currently referencing the old name) so it uses
the corrected spelling/format; keep existing variable names like crawl4AiUrl
unchanged. Ensure the identifier is updated consistently throughout main.ts
where that interface/type is used.

In `@src/plugins/builtin-firecrawl-fetch/main.ts`:
- Around line 25-32: The Firecrawl POST (the line creating "const res = await
fetch(...)" that sends { url, formats: [format] }) can hang; add an
AbortController and a timeout (e.g., 30s or configurable) and pass
controller.signal to fetch so the request is cancelled if it exceeds the
timeout; start a setTimeout that calls controller.abort(), clear the timeout
after fetch completes, and handle the abort/timeout by catching the error
(checking for AbortError) so the CLI fails fast instead of blocking.

In `@src/plugins/builtin-parse-htmlToMd/main.ts`:
- Around line 31-34: The ALLOWED_ATTRS entry for "a" currently permits
preserving href values without checking their scheme; update the
HTML-to-Markdown attribute-preservation logic (the code that reads ALLOWED_ATTRS
and copies anchor attributes) to validate and sanitize href values before
keeping them: allow only safe schemes (e.g., http, https, mailto) and
relative/fragment URLs, and strip or drop hrefs that start with unsafe schemes
such as javascript:, data:, vbscript:, file:, or other non-whitelisted
protocols; implement this as a small helper (e.g., sanitizeHref) invoked when
handling the "a" tag so the ALLOWED_ATTRS mechanism only retains safe hrefs.

In `@src/utils.ts`:
- Around line 31-33: The current parsing for SIBYL_SEARCH_RESULTS_LIMIT uses
Number.parseInt (variables raw/parsed), which accepts partial numerics like
"10abc" and "1.5"; replace that logic with a strict check (e.g., test raw
against /^\d+$/) and then use Number(raw) to get an integer, returning it only
if > 0, otherwise return 10; also add unit tests in the utils test file that
assert inputs "10abc" and "1.5" (and other edge cases like "0" or negative) fall
back to 10 to prevent partial numeric acceptance.

---

Outside diff comments:
In `@src/plugin-loader.test.ts`:
- Around line 188-215: The test no longer verifies that a custom parse plugin's
runtime function is invoked; update the test in src/plugin-loader.test.ts so
after obtaining customPlugin (the ParsePlugin created by parseFn and exported as
SilbylPlugin) you call its fn with a sample HTML string and a minimal context
object and assert the returned value equals the expected "parsed <html>" result,
while still asserting no console.warn/error calls; ensure you invoke
customPlugin.fn(html, context) (or await it if async) and check the output to
restore the parse-plugin invocation contract that loadPlugins() must satisfy.

---

Nitpick comments:
In `@CLAUDE.md`:
- Line 40: Update the reference on CLAUDE.md (currently line with "User-facing
docs live in `docs/` — `CONFIGURATION.md` (config + per-plugin env-var tables),
`CREATING-PLUGINS.md`, and `CONTRIBUTION.md`") to use full relative paths for
all three docs (e.g., `docs/CONFIGURATION.md`, `docs/CREATING-PLUGINS.md`,
`docs/CONTRIBUTION.md`) so the line consistently references the docs directory
like the links in README.md.

In `@src/plugins/builtin-firecrawl-search/main.ts`:
- Around line 46-50: The current handler returns "No results" when
data?.data?.web?.length is falsy but doesn't explicitly guard against a 200
response carrying success: false; update the parsing logic in
src/plugins/builtin-firecrawl-search/main.ts (around the code that assigns data
from res.json and the subsequent check) to first verify data?.success === true
(or explicitly !== false) before inspecting data.data.web; if success is false,
treat it as an error/No results path (e.g., return the same `No results for:
${query}` or throw) so that the check in this handler is defensive against 200
responses with success: false. Ensure you reference the same data variable and
preserve existing behavior for non-2xx responses.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/plugins/builtin-brightdata-fetch/main.ts`:
- Line 9: Add an explicit Promise<string> return type to the fetchFn signature
(async function fetchFn(url: string, context: PluginContext): Promise<string>)
to satisfy strict TypeScript typing; update the function signature only and
ensure all return points still return strings (or await/throw as appropriate) so
the implementation remains consistent with the new Promise<string> annotation.

In `@src/plugins/builtin-exa-fetch/main.ts`:
- Line 19: Update the fetch handler to match the FetchPlugin.fn shape by
changing the fetchFn signature to accept the second parameter, e.g. fetchFn(url:
string, context: PluginContext): Promise<string>, and add an import for
PluginContext; keep the existing implementation and return type intact so the
function still returns a Promise<string> and will accept the CLI-provided
context without runtime issues.