fix(pdf_reader): Auto-try blank password for encrypted PDFs without password

[GaelReinaudi]

Fix: Auto-try blank password for encrypted PDFs without password

Problem

Many PDF files are technically "encrypted" but don't require an actual password - they just need an empty string to decrypt. This is standard behavior in PDF viewers (Adobe, Preview, etc.) and other PDF libraries (PyPDF2, pikepdf, etc.).

Currently, agno's PDFReader fails immediately when encountering such PDFs, causing the "zombie document bug":

• PDF is uploaded to PostgreSQL ✅
• PDF fails to vectorize due to "password protected" error ❌
• Document exists in content DB but NOT in vector DB ❌
• Document is unsearchable despite being "uploaded" ❌

Why Can't Users Just Pass password=""?

Three blockers prevent this:

1. S3Reader hardcodes PDFReader() (line 62 in s3_reader.py):

   return PDFReader().read(pdf=BytesIO(...), name=doc_name)

   No password parameter is passed, even if S3Reader accepted one!

2. The or operator bug (line 237 in pdf_reader.py):

   pdf_password = password or self.password

   If you pass password="", it's treated as False and falls through to self.password! Empty strings are falsy in Python.

3. Users don't know the password is blank:
   How would a user know to pass password=""? PDF viewers handle this automatically - agno should too.

This fix makes agno match industry-standard behavior by auto-trying blank passwords.

Solution

Automatically try a blank password ("") when:

1. A PDF is encrypted
2. No password is provided by the user

This matches industry-standard behavior and prevents the zombie document bug.

Changes

Modified libs/agno/agno/knowledge/reader/pdf_reader.py:

• _decrypt_pdf() method now attempts blank password before failing
• Only logs error if blank password also fails
• Maintains backward compatibility with explicit password usage

Behavior

Scenario	Before	After
Not encrypted	✅ Works	✅ Works
Encrypted, no password, blank works	❌ Fails	✅ Works
Encrypted, no password, blank fails	❌ Fails	❌ Fails (same)
Encrypted, password provided	✅ Works	✅ Works

Testing

Tested with real-world encrypted-but-no-password PDF (4.BH-Bevel-Helical_Manual-1.pdf):

• Before: ERROR PDF file "X" is password protected but no password provided
• After: INFO Successfully decrypted PDF file "X" with blank password → vectorization succeeds

Impact

• S3Reader: Automatically benefits (uses PDFReader internally)
• Local uploads: Automatically benefits
• No breaking changes: Existing code with explicit passwords continues to work
• User experience: "Just works" for common encrypted PDFs

Additional Context

This is a common pattern in PDF libraries:

• PyPDF2: Automatically tries blank password
• pikepdf: Allows empty password in decrypt
• Adobe Reader: Opens "secured" PDFs without prompting for password

agno should match this industry-standard behavior.

---

How to Review

1. Check the logic flow in _decrypt_pdf()
2. Verify blank password is only tried when no password provided
3. Confirm existing password-based decryption still works
4. Test with encrypted-but-no-password PDF if available

Checklist

• Code change is minimal and focused
• Maintains backward compatibility
• Improves user experience
• Matches industry-standard behavior
• Clear commit message with context