@youdie006/prodex 0.19.0 → 0.19.1

package/dist/cli-server.js

@@ -4,7 +4,7 @@ import { parseProMode, parseReasoningEffort } from "./chatgpt-browser.js";
 import { ASK_PRO_SELECTION_CLEAR_FLAGS, ASK_PRO_SELECTION_DEFAULT_FLAGS, assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPortFlag, readPositiveNumberFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
 import { printInitHelp, printSetupHelp, printStartHelp, printStatusHelp, printTunnelHelp, printTunnelUrlHelp } from "./cli-help.js";
 import { errorMessage, isLoopbackHost, isMissingFileError, sourceAwareSetupMessage } from "./cli-shared.js";
-import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig } from "./config.js";
+import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig, composeServerUrlWithToken } from "./config.js";
 import { startHttpMcpServer } from "./http-mcp.js";
 import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 import { BridgeStore } from "./store.js";
@@ -49,7 +49,7 @@ export async function runSetupCommand(rest, io) {
     io.stdout("Saved local ChatGPT Developer Mode MCP profile.");
     io.stdout(`Server URL: ${redactServerUrl(config.server_url)}`);
     io.stdout(formatTokenExpiryLine(config));
-    io.stdout("Full URL is stored in .bridge/config.local.json.");
+    io.stdout("The token is stored (once) in .bridge/config.local.json; print the full URL with `prodex status --show-token --url-only`.");
     if (config.browser_defaults) {
         io.stdout(`Browser send defaults: ${formatBrowserDefaults(config.browser_defaults)}`);
     }
@@ -102,7 +102,10 @@ export async function runStatusCommand(rest, io) {
     const nonExpiringRevealWarning = showToken && allowNonExpiringTokenReveal && tokenStatus.status === "non_expiring"
         ? sourceAwareSetupMessage("Showing a non-expiring token. Keep this local-only and rotate it with `prodex setup --token-ttl-hours <hours>` before any tunnel or ChatGPT Project use.", sourceCli, { cwd: setupHintCwd })
         : undefined;
-    const serverUrl = formatServerUrlForOutput(config.server_url, { showToken });
+    // The token is no longer persisted inside server_url, so compose the
+    // usable URL here; masking still applies when the caller did not ask for
+    // the token.
+    const serverUrl = formatServerUrlForOutput(composeServerUrlWithToken(config), { showToken });
     if (rest.includes("--url-only")) {
         if (showToken)
             io.stderr(TOKEN_BEARING_MCP_URL_AUTHORITY_WARNING);

package/dist/cli.js

@@ -10,7 +10,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { renderBanner, shouldColorize } from "./banner.js";
 import { getChatGptBrowserStatus, resolveCdpPort } from "./chatgpt-browser.js";
-import { getTokenExpiryStatus, loadLocalConfig } from "./config.js";
+import { getTokenExpiryStatus, loadLocalConfig, resolveProdexCwd } from "./config.js";
 import { startHttpMcpServer } from "./http-mcp.js";
 import { createMcpToolHandlers } from "./mcp-tools.js";
 import { runMcpServer } from "./mcp.js";
@@ -216,7 +216,10 @@ export async function runCli(args, io = defaultIo()) {
 }
 function defaultIo() {
     return {
-        cwd: process.cwd(),
+        // PRODEX_CWD wins over a working directory prodex cannot use (a /dev/fd
+        // pipe path from an agent harness, a deleted directory); --cwd still wins
+        // over both where a command accepts it.
+        cwd: resolveProdexCwd(),
         stdout: (line) => console.log(line),
         stderr: (line) => console.error(line),
         isInteractive: process.stdout.isTTY === true,

package/dist/config.js

@@ -59,6 +59,33 @@ export function localConfigPath(cwd) {
 export function makeServerUrl(host, port, token) {
     return `http://${host}:${port}/mcp?prodex_token=${encodeURIComponent(token)}`;
 }
+/**
+ * The endpoint WITHOUT the token, which is what gets persisted. The token used
+ * to be stored twice - as `token` and inside `server_url` - so an operator's
+ * redaction that masked the key still leaked the secret from the URL (field
+ * report). One field is the only shape where masking the token masks it.
+ */
+export function makeServerUrlBase(host, port) {
+    return `http://${host}:${port}/mcp`;
+}
+/** The token-bearing URL, composed on demand for clients that need it. */
+export function composeServerUrlWithToken(config) {
+    const url = new URL(config.server_url);
+    url.searchParams.set("prodex_token", config.token);
+    return url.toString();
+}
+/** Strip a token that an older config (or a hand edit) left in the URL. */
+export function stripTokenFromServerUrl(serverUrl) {
+    try {
+        const url = new URL(serverUrl);
+        url.searchParams.delete("prodex_token");
+        url.search = url.searchParams.toString();
+        return url.toString();
+    }
+    catch {
+        return serverUrl;
+    }
+}
 export function normalizeLoopbackHttpHost(host) {
     const normalized = host.trim().toLowerCase();
     const isLocalhost = normalized === "localhost";
@@ -90,7 +117,7 @@ export async function writeLocalConfig(cwd, input = {}) {
         host,
         port,
         token,
-        server_url: makeServerUrl(host, port, token),
+        server_url: makeServerUrlBase(host, port),
         ...(tokenExpiresAt ? { token_expires_at: tokenExpiresAt } : {}),
         ...(browserDefaults ? { browser_defaults: browserDefaults } : {}),
         created_at: existing?.created_at ?? now,
@@ -126,7 +153,26 @@ export async function loadLocalConfig(cwd) {
     }
     assertLoopbackHttpHost(config.host);
     assertLoopbackHttpHost(new URL(config.server_url).hostname);
+    // Configs written before the split still carry the token in the URL. Drop it
+    // in memory AND rewrite the file: leaving it on disk is the whole problem
+    // being fixed - an operator reading config.local.json would still find the
+    // secret twice, and any redaction keyed to `token` would miss one copy.
+    const strippedServerUrl = stripTokenFromServerUrl(config.server_url);
+    const carriedDuplicate = strippedServerUrl !== config.server_url;
+    config = { ...config, server_url: strippedServerUrl };
     assertServerUrlMatchesConfig(config);
+    if (carriedDuplicate) {
+        // Best effort: a read-only checkout or a concurrent writer must not turn
+        // a working config into a failed command.
+        try {
+            await writeVerifiedUtf8File(localConfigPath(cwd), `${JSON.stringify(config, null, 2)}\n`, () => assertLocalConfigTargetSafe(cwd), {
+                mode: 0o600
+            });
+        }
+        catch {
+            // The in-memory strip above already keeps prodex from printing it.
+        }
+    }
     return config;
 }
 // Global browser-selection defaults from the environment, used when a repo has
@@ -217,13 +263,13 @@ function isTokenExpired(tokenExpiresAt, now) {
 }
 function assertServerUrlMatchesConfig(config) {
     const serverUrl = new URL(config.server_url);
-    const tokenParams = serverUrl.searchParams.getAll("prodex_token");
     const hostMatches = normalizeLoopbackHttpHost(serverUrl.hostname) === normalizeLoopbackHttpHost(config.host);
     const portMatches = effectiveUrlPort(serverUrl) === config.port;
-    const tokenMatches = tokenParams.length === 1 && tokenParams[0] === config.token;
-    const shapeMatches = serverUrl.protocol === "http:" && serverUrl.pathname === "/mcp" && Array.from(serverUrl.searchParams.keys()).length === 1;
-    if (!hostMatches || !portMatches || !tokenMatches || !shapeMatches) {
-        throw new Error(".bridge/config.local.json server_url must match host, port, and token. Run `prodex setup` to replace it.");
+    // The persisted URL must carry NO query at all: the token lives in `token`
+    // and nowhere else.
+    const shapeMatches = serverUrl.protocol === "http:" && serverUrl.pathname === "/mcp" && Array.from(serverUrl.searchParams.keys()).length === 0;
+    if (!hostMatches || !portMatches || !shapeMatches) {
+        throw new Error(".bridge/config.local.json server_url must be the token-free endpoint for host and port. Run `prodex setup` to replace it.");
     }
 }
 function effectiveUrlPort(url) {
@@ -359,3 +405,16 @@ async function assertDirectoryHandle(handle, label) {
         throw new Error(`${label} must be a real directory`);
     }
 }
+/**
+ * The repo prodex should operate on. Defaults to the process working
+ * directory, but PRODEX_CWD (absolute paths only) wins: the MCP server takes
+ * no flags, so when an agent harness starts it from a pipe path or a deleted
+ * directory, the env var is the only way an operator can pin the repo without
+ * changing how that harness spawns the server.
+ */
+export function resolveProdexCwd(fallback = process.cwd(), env = process.env) {
+    const raw = (env.PRODEX_CWD ?? "").trim();
+    if (raw.length === 0 || !path.isAbsolute(raw))
+        return fallback;
+    return raw;
+}

package/dist/store.js

@@ -35,6 +35,26 @@ async function claimLockIsStale(lockPath) {
 const FETCHABLE_RESULT_ARTIFACT_PREFIXES = [".bridge/artifacts/pro-consults/", ".bridge/artifacts/results/"];
 export const MAX_FETCHABLE_RESULT_ARTIFACT_BYTES = 100_000;
 const MAX_BRIDGE_ARTIFACT_READ_BYTES = 1_000_000;
+// A bridge root has to be a real directory in a real filesystem. Field report
+// (macOS): an agent harness started `prodex mcp` with a working directory of
+// /dev/fd/<n> - a file-descriptor path - so every call failed with a raw
+// ENOENT/ENOTDIR on <root>/tasks, /sessions, /receipts, with a different
+// number each time, and the operator had no way to tell what prodex had
+// resolved or how to override it.
+const NON_REPO_ROOT_PREFIXES = ["/dev/", "/proc/", "/sys/"];
+export async function assertUsableBridgeRoot(root) {
+    const looksLikeDevicePath = NON_REPO_ROOT_PREFIXES.some((prefix) => root.startsWith(prefix));
+    let isDirectory = false;
+    try {
+        isDirectory = (await stat(root)).isDirectory();
+    }
+    catch {
+        isDirectory = false;
+    }
+    if (isDirectory && !looksLikeDevicePath)
+        return;
+    throw new Error(`Bridge root is not a usable repo directory: ${root}${looksLikeDevicePath ? " (that is a file-descriptor/device path, not a repo)" : ""}. prodex uses the process working directory when no --cwd is given, so a server started from a pipe or a deleted directory lands here. Pass --cwd /absolute/path/to/repo, or set PRODEX_CWD=/absolute/path/to/repo (works for the MCP server, which takes no flags).`);
+}
 export class BridgeStore {
     root;
     bridgeDir;
@@ -43,6 +63,7 @@ export class BridgeStore {
         this.bridgeDir = path.join(root, ".bridge");
     }
     async ensure() {
+        await assertUsableBridgeRoot(this.root);
         await ensurePrivateDirectory(this.bridgeDir, "Bridge directory");
         await Promise.all([
             ensurePrivateDirectory(this.dir("tasks"), "Bridge storage directory .bridge/tasks"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",