@youdie006/prodex 0.16.20 → 0.16.21

package/dist/browser-send-lock.js

@@ -1,4 +1,4 @@
-import { mkdir, open, readFile, rm } from "node:fs/promises";
+import { link, mkdir, open, readFile, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 // One visible-browser send at a time per machine: the dedicated Chrome is a
@@ -17,25 +17,69 @@ function holderIsAlive(pid) {
         process.kill(pid, 0);
         return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        // EPERM: the process exists but is owned by another user -> alive. Only
+        // ESRCH (no such process) means the holder is truly dead and reapable.
+        return error.code === "EPERM";
     }
 }
-async function readHolderPid(file) {
+async function readHolder(file) {
     try {
         const parsed = JSON.parse(await readFile(file, "utf8"));
-        return typeof parsed.pid === "number" ? parsed.pid : undefined;
+        return {
+            pid: typeof parsed.pid === "number" ? parsed.pid : undefined,
+            started_at: typeof parsed.started_at === "string" ? parsed.started_at : undefined
+        };
     }
     catch {
         return undefined;
     }
 }
+// A holder whose process is alive but has held the lock far longer than any real
+// send (default 60 min, well beyond the 15-min Pro timeout) is treated as wedged
+// and reapable, so a hung browser cannot block every send on the machine forever.
+// Deliberately generous so it never reaps a genuinely in-flight send; override
+// with PRODEX_SEND_LOCK_STALE_MS.
+function staleMs() {
+    const raw = Number(process.env.PRODEX_SEND_LOCK_STALE_MS);
+    return Number.isFinite(raw) && raw > 0 ? raw : 3_600_000;
+}
+function holderIsStale(startedAt) {
+    if (!startedAt)
+        return false;
+    const started = Date.parse(startedAt);
+    if (Number.isNaN(started))
+        return false;
+    return Date.now() - started > staleMs();
+}
+// Release only our own lock: if ours was already reaped (e.g. as stale) and a
+// new holder took over, we must not delete their lock on the way out.
+async function releaseIfOwned(file) {
+    const holder = await readHolder(file);
+    if (holder?.pid === process.pid) {
+        await rm(file, { force: true }).catch(() => undefined);
+    }
+}
+let acquireSeq = 0;
 async function tryAcquire(file) {
     await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    // Publish atomically: write the pid into a temp file, then hard-link it into
+    // place. link() fails with EEXIST when a holder already exists (our exclusivity
+    // check) and, unlike open("wx")+writeFile, the lock file is never observed
+    // empty - so a concurrent waiter can never mistake a mid-publish lock for a
+    // dead one and reap it out from under us (which let two clients send at once).
+    // The temp name is unique per acquisition (pid + seq) so two concurrent
+    // same-process acquires never share a temp inode and truncate each other.
+    const temp = `${file}.${process.pid}.${(acquireSeq += 1)}.tmp`;
+    const handle = await open(temp, "w", 0o600);
     try {
-        const handle = await open(file, "wx", 0o600);
         await handle.writeFile(`${JSON.stringify({ pid: process.pid, started_at: new Date().toISOString() })}\n`);
+    }
+    finally {
         await handle.close();
+    }
+    try {
+        await link(temp, file);
         return true;
     }
     catch (error) {
@@ -43,6 +87,9 @@ async function tryAcquire(file) {
             throw error;
         return false;
     }
+    finally {
+        await rm(temp, { force: true }).catch(() => undefined);
+    }
 }
 /**
  * Serialize visible-browser sends across processes. Waits up to waitMs for a
@@ -56,17 +103,23 @@ export async function withBrowserSendLock(waitMs, onWait, fn) {
     for (;;) {
         if (await tryAcquire(file))
             break;
-        const holder = await readHolderPid(file);
-        if (holder === undefined || !holderIsAlive(holder)) {
-            await rm(file, { force: true }).catch(() => undefined);
+        const holder = await readHolder(file);
+        const reapable = holder === undefined || holder.pid === undefined || !holderIsAlive(holder.pid) || holderIsStale(holder.started_at);
+        if (reapable) {
+            // Re-verify the same holder still owns the file before removing it, so we
+            // don't delete a fresh lock another reaper just acquired in between.
+            const current = await readHolder(file);
+            if (current?.pid === holder?.pid) {
+                await rm(file, { force: true }).catch(() => undefined);
+            }
             continue;
         }
         if (Date.now() >= deadline) {
-            throw new Error(`Another prodex browser send is in progress (pid ${holder}). Wait for it to finish, or pass --busy-wait-ms to queue behind it.`);
+            throw new Error(`Another prodex browser send is in progress (pid ${holder.pid}). Wait for it to finish, or pass --busy-wait-ms to queue behind it.`);
         }
         if (!waited) {
             waited = true;
-            onWait(`another prodex send holds the browser (pid ${holder}); waiting`);
+            onWait(`another prodex send holds the browser (pid ${holder.pid}); waiting`);
         }
         await new Promise((resolve) => setTimeout(resolve, 2_000));
     }
@@ -74,6 +127,6 @@ export async function withBrowserSendLock(waitMs, onWait, fn) {
         return await fn();
     }
     finally {
-        await rm(file, { force: true }).catch(() => undefined);
+        await releaseIfOwned(file);
     }
 }

package/dist/chatgpt-browser.js

@@ -892,17 +892,49 @@ export function proSubmenuExpanderRectExpression() {
     return clickPoint(best);
   })()`;
 }
+// The sidebar project option button's aria-label wraps the project name:
+// English "Open project options for <name>", Korean "<name> 프로젝트 옵션 열기".
+export function projectOptionButtonName(ariaLabel) {
+    return (ariaLabel || "").replace(/^open project options for /i, "").replace(/\s*프로젝트 옵션 열기$/, "").trim();
+}
+// Resolve which sidebar project button matches `wanted`, mirroring the in-page
+// logic in projectItemRectExpression: exact name match first, then a unique
+// case-insensitive match; ambiguity refuses rather than guessing. Matching by
+// EQUALITY (not substring) is what keeps "Codex" from selecting "Codex Review".
+// Returns the matched index, -1 when not found, or "ambiguous".
+export function matchProjectOptionName(ariaLabels, wanted) {
+    const names = ariaLabels.map(projectOptionButtonName);
+    const exact = names.flatMap((n, i) => (n === wanted ? [i] : []));
+    if (exact.length === 1)
+        return exact[0];
+    if (exact.length > 1)
+        return "ambiguous";
+    const ci = names.flatMap((n, i) => (n.toLowerCase() === wanted.toLowerCase() ? [i] : []));
+    if (ci.length === 1)
+        return ci[0];
+    if (ci.length > 1)
+        return "ambiguous";
+    return -1;
+}
 export function projectItemRectExpression(name) {
     return `(() => {${CLICK_POINT_SNIPPET}
     // Korean: "<name> 프로젝트 옵션 열기"; English: "Open project options for <name>".
     const wanted = ${JSON.stringify(name)};
+    // Extract the project name from the aria-label wrapper, then match by
+    // EQUALITY (mirror of matchProjectOptionName). A bare .includes() let
+    // "Codex" select "Codex Review" (substring) and silently sent the prompt
+    // into the wrong project.
+    const projName = (b) => (b.getAttribute("aria-label") || "").replace(/^open project options for /i, "").replace(/\\s*프로젝트 옵션 열기$/, "").trim();
     const optionButtons = [...document.querySelectorAll('[aria-label*="프로젝트 옵션"],[aria-label*="project options" i]')];
-    let opt = optionButtons.find((b) => (b.getAttribute("aria-label") || "").includes(wanted));
-    if (!opt) {
+    let opt = null;
+    const exact = optionButtons.filter((b) => projName(b) === wanted);
+    if (exact.length === 1) opt = exact[0];
+    else if (exact.length > 1) return { ok: false, reason: "project name matches multiple sidebar projects; rename one to disambiguate" };
+    else {
       // Case-insensitive fallback: sidebar names are user-typed ("Codex") and
       // an agent asking for "codex" should still resolve when unambiguous.
       // Ambiguity fails loudly rather than guessing.
-      const ci = optionButtons.filter((b) => (b.getAttribute("aria-label") || "").toLowerCase().includes(wanted.toLowerCase()));
+      const ci = optionButtons.filter((b) => projName(b).toLowerCase() === wanted.toLowerCase());
       if (ci.length === 1) opt = ci[0];
       else if (ci.length > 1) return { ok: false, reason: "project name matches multiple sidebar projects case-insensitively; use the exact name" };
     }
@@ -1201,8 +1233,12 @@ async function selectProject(cdp, options) {
         const alreadyInRequestedProject = await cdp.evaluate(`(() => {
         if (!/^https:\\/\\/chatgpt\\.com\\/g\\/g-p-/.test(location.href)) return false;
         const name = ${JSON.stringify(options.project)};
-        if ((document.title || "").includes(name)) return true;
-        return [...document.querySelectorAll('h1,[role="heading"]')].some((h) => (h.innerText || "").includes(name));
+        // Equality, not substring: a stalled cross-project navigation must not
+        // be accepted just because the current project's name CONTAINS the
+        // requested one (e.g. sitting on "Research Lab" while "Research" was
+        // requested), which would silently send into the wrong project.
+        if ((document.title || "").trim() === name) return true;
+        return [...document.querySelectorAll('h1,[role="heading"]')].some((h) => (h.innerText || "").trim() === name);
       })()`);
         if (!alreadyInRequestedProject) {
             throw new Error(`Clicking project "${options.project}" did not navigate the visible tab. If the tab is already inside this project, omit --project and retry.`);

package/dist/cli-args.js

@@ -263,6 +263,9 @@ export const ASK_PRO_PREVIEW_VALUE_FLAGS = new Set([
     "--file",
     "--port",
     "--timeout-ms",
+    // Accepted here only so the preview path can reject it with the friendly
+    // "only applies when sending" guidance instead of a raw "Unknown option".
+    "--busy-wait-ms",
     "--target-url",
     ...ASK_PRO_SELECTION_VALUE_FLAGS
 ]);

package/dist/cli-help.js

@@ -174,7 +174,7 @@ Use \`prodex pro ask\` for dry-run/manual previews.
 Use \`prodex pro browser ask\` only when you want an explicit visible-browser send.
 Model/project selection (visible-browser send):
   --model "label"              Pick the composer model by its exact menu label (verified: Pro). Submenu models (e.g. the GPT-5.6 Sol variants) are rejected for now.
-  --pro-mode 기본 | 확장          Pro sub-mode (only when the model is Pro); 확장 raises the default timeout to 300000 ms
+  --pro-mode 기본 | 확장          Pro sub-mode (only when the model is Pro); a Pro selection raises the default timeout to 900000 ms
   --effort 즉시|중간|높음|매우 높음   Reasoning effort (aliases: instant/medium/high/max); picking one deselects Pro
   --project "name"             Enter an existing sidebar project first (cannot combine with --target-url)
 Labels are matched in both the Korean and English (US) UI; run \`prodex pro browser models\` to list what your account shows.
@@ -268,7 +268,7 @@ Commands:
 Visible-browser sends require a manual browser session and stop on login, captcha, Cloudflare, permission, rate-limit, or usage-limit blockers.
 Model/project selection (ask):
   --model      Composer model to pick by its exact menu label (verified: Pro). Models whose menu entry opens a submenu of variants are rejected with a clear error for now.
-  --pro-mode   Pro sub-mode: 기본 (standard) or 확장 (extended), used when the model is Pro. 확장 raises the default --timeout-ms to 300000.
+  --pro-mode   Pro sub-mode: 기본 (standard) or 확장 (extended), used when the model is Pro. A Pro selection raises the default --timeout-ms to 900000.
   --effort     Reasoning effort: 즉시 / 중간 / 높음 / 매우 높음 (aliases: instant/medium/high/max). Picking an effort switches the composer to the standard reasoning model, deselecting Pro.
   --project    Enter an existing sidebar project before sending. Cannot be combined with --target-url.
 --pro-mode and --effort cannot be combined. Labels are matched in both the Korean and English (US) ChatGPT UI (e.g. 높음/High, Pro 확장/Pro Extended).

package/dist/cli-pro.js

@@ -703,12 +703,25 @@ export async function runAskProCommand(rest, io) {
         catch (error) {
             const blocker = sourceAwareBrowserBlocker(browserSendBlockerFromError(error), sourceCli, browserCommandOptions);
             const message = blocker.next_step ? `${blocker.message} Next: ${blocker.next_step}` : errorMessage(error);
+            // The blocker text can quote the requested/default project name (e.g. a
+            // "project not found" error). Local stdout/stderr keep it (useful to the
+            // operator), but the persisted task/session cross the MCP boundary, so
+            // scrub the project name there the same way provenance.project is redacted.
+            const redactProject = (text) => {
+                const name = selectionMetadata.project;
+                return name ? text.split(name).join("<project>") : text;
+            };
+            const persistedBlocker = {
+                ...blocker,
+                message: redactProject(blocker.message),
+                ...(blocker.next_step ? { next_step: redactProject(blocker.next_step) } : {})
+            };
             try {
                 await targetStore.completeTask(task.id, {
                     status: "blocked",
-                    summary: message,
+                    summary: redactProject(message),
                     commands: ["visible ChatGPT browser consult"],
-                    blocker
+                    blocker: persistedBlocker
                 });
                 await writeSessionBestEffort(targetStore, {
                     id: bundle.id,
@@ -717,7 +730,7 @@ export async function runAskProCommand(rest, io) {
                     task_id: task.id,
                     thread: normalizedTargetUrl,
                     status: "blocked",
-                    blocker,
+                    blocker: persistedBlocker,
                     warnings: []
                 }, io);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.16.20",
+  "version": "0.16.21",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",