@youdie006/prodex 0.40.17 → 0.40.18

package/README.md

@@ -49,7 +49,9 @@ That is a real run, timings included. Every consult lands as a task, a result an
 
 ## Install
 
-Node 20 or newer, `git`, and `ripgrep` (`rg`) on PATH. A Chromium-family browser for the visible adapter: Chrome, Chromium, Edge or Brave on PATH, in the standard macOS and Windows locations, or on the Windows host under WSL are all found automatically; anything else via `PRODEX_CHROME=/path/to/browser`.
+Node 20 or newer, `git`, and `ripgrep` (`rg`) on PATH. A Chromium-family browser for the browser adapter: Chrome, Chromium, Edge or Brave on PATH or in the standard native macOS and Windows locations. Set `PRODEX_CHROME` for another executable. WSL uses a Linux browser; Windows-host Chrome is not automatically discovered or interchangeable with a Linux profile.
+
+On native Windows, generated command examples target PowerShell (PowerShell 7 for commands joined with `&&`), not `cmd.exe`. CLI/MCP subprocesses pass arguments directly without a shell.
 
 ```sh
 npm install -g @youdie006/prodex
@@ -277,7 +279,7 @@ Reports are deduplicated by blocker code, so something that stays broken adds to
 
 **Does it read my cookies or tokens?** No. It talks to the browser only over the loopback DevTools port, and only while that browser is open.
 
-**Windows and macOS?** All three platforms are targeted; the visible-browser adapter is exercised most on Linux and WSL. Open an issue with details if a browser step misbehaves elsewhere.
+**Windows and macOS?** The CI matrix targets Linux, native Windows, and macOS ARM/Intel. See [platform verification](docs/platform-verification.md) for actual results and limits. Virtual display is Linux/WSL-only; a passing OS test does not prove authenticated headless ChatGPT access. On Windows, keep the repository and browser profile in a private user directory with suitable ACLs; Unix permission bits do not make Windows storage private.
 
 ## Development
 

package/SECURITY.md

@@ -0,0 +1,45 @@
+# Security Policy
+
+`prodex` automates a **logged-in ChatGPT Pro browser session** and brokers tasks between
+coding agents, so security reports are taken seriously.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security vulnerabilities.**
+
+Report privately instead:
+
+- Preferred: GitHub [private vulnerability reporting](https://github.com/youdie006/prodex/security/advisories/new)
+- Include: affected version/commit, reproduction steps, and impact.
+
+We aim to acknowledge within 5 business days and to coordinate a fix and disclosure timeline with you.
+
+## Design intent (what we consider in scope)
+
+`prodex` is local-first and is designed never to expose your ChatGPT account, browser
+session, or bridge endpoints to other users. Findings of particular interest:
+
+- Credential, cookie, or session-token leakage from the visible-browser adapter
+- Token-bearing MCP URLs being logged, printed, or otherwise exposed
+- Bypass of the receipt-gated repo-write/apply/stage tools
+- Any default that would let a third party reach your logged-in session or `.bridge` ledger
+- Path traversal or arbitrary file access through the repo/file tools
+
+Explicitly out of scope (these are intentional non-features, see the README): hidden ChatGPT
+endpoints, cookie/token extraction, stealth automation, and public tunnel auto-setup.
+
+## Local storage permissions
+
+On POSIX filesystems ProDex applies owner-only modes to bridge directories and
+private files. Native Windows uses the directory's inherited Windows ACLs;
+Unix `0700`/`0600` mode bits do not provide owner-only access there. ProDex does
+not rewrite Windows ACLs. Keep the repository, `.bridge`, and browser profile
+under a private user-owned directory, not a shared drive or a directory writable
+by other users. Review the Windows Security permissions before storing private
+prompts or credentials. The same caution applies to mounted filesystems that
+ignore POSIX modes. Symlink/junction, file identity, and hard-link checks remain
+enabled independently of permission modes.
+
+## Supported versions
+
+`prodex` is pre-release (`0.x`). Security fixes target the latest `main`.

package/dist/bridge-gitignore.js

@@ -0,0 +1,47 @@
+import { lstat } from "node:fs/promises";
+import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
+const required = [
+    "tasks/*.json", "results/*.json", "sessions/*.json", "receipts/*.json",
+    "artifacts/*", "config.local.json", "receipt-key.local", "last-browser-send", "!.gitignore"
+];
+export async function ensureBridgeGitignore(filePath, validate) {
+    let current = "";
+    try {
+        current = await readVerifiedUtf8File(filePath, validate);
+    }
+    catch (error) {
+        if (!hasCode(error, "ENOENT"))
+            throw error;
+    }
+    const updated = `${Array.from(new Set([...current.split(/\r?\n/).filter(Boolean), ...required])).join("\n")}\n`;
+    if (updated === current) {
+        try {
+            await validate();
+            const stat = await lstat(filePath);
+            if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink > 1) {
+                throw new Error("Bridge gitignore must be a regular file without links");
+            }
+            return;
+        }
+        catch (error) {
+            if (!hasCode(error, "ENOENT"))
+                throw error;
+        }
+    }
+    try {
+        await writeVerifiedUtf8File(filePath, updated, validate, { create: true });
+    }
+    catch (error) {
+        // Windows may refuse replacement while another initializer holds the file.
+        // A verified, identical completed write already satisfies this operation.
+        if (process.platform === "win32" && hasCode(error, "EPERM")) {
+            const installed = await readVerifiedUtf8File(filePath, validate).catch(() => undefined);
+            if (installed === updated)
+                return;
+        }
+        throw error;
+    }
+}
+function hasCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}

package/dist/browser-handoff.js

@@ -1,8 +1,8 @@
-import { spawnSync } from "node:child_process";
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import WebSocket from "ws";
-import { ChatGptBrowserBlockerError, attachmentPresenceExpression, composerTextStateExpression, detectChatGptPageBlocker, findLaunchedBrowserProcesses, inferChatGptPageLoggedInLikely, statusExpression } from "./chatgpt-browser.js";
+import { BrowserProcessInspectionError, browserProcessFlagValue, browserProcessHasFlag, findMatchingBrowserProcesses, inspectBrowserProcesses, isMainBrowserProcess } from "./browser-process.js";
+import { ChatGptBrowserBlockerError, attachmentPresenceExpression, composerTextStateExpression, detectChatGptPageBlocker, inferChatGptPageLoggedInLikely, statusExpression } from "./chatgpt-browser.js";
 const VISIBLE_AUTH_BLOCKERS = new Set(["login_required", "cloudflare_check", "captcha_required", "permission_required"]);
 function blocked(message) {
     throw new ChatGptBrowserBlockerError({
@@ -11,21 +11,25 @@ function blocked(message) {
     });
 }
 function browserIdentity(port, profileDir) {
-    const listed = spawnSync("ps", ["-Ao", "user,pid,command"], { encoding: "utf8", timeout: 5_000 });
-    if (listed.status !== 0 || typeof listed.stdout !== "string")
+    let processes;
+    try {
+        processes = inspectBrowserProcesses();
+    }
+    catch (error) {
+        if (!(error instanceof BrowserProcessInspectionError))
+            throw error;
         blocked("Could not verify the dedicated browser process.");
-    const pids = findLaunchedBrowserProcesses(listed.stdout, { port, profileDir });
-    const mains = listed.stdout.split(/\r?\n/).filter((line) => {
-        const pid = Number(/^\s*\S+\s+(\d+)\s/.exec(line)?.[1]);
-        return pids.includes(pid) && !/\s--type=/.test(line) && new RegExp(`--remote-debugging-port=${port}(?!\\d)`).test(line);
-    });
+    }
+    const matching = findMatchingBrowserProcesses(processes, { port, profileDir });
+    const mains = matching.filter(isMainBrowserProcess);
     if (mains.length !== 1)
         blocked("Could not identify exactly one dedicated browser for this port.");
-    if (/\s--(?:incognito|guest)(?:\s|=|$)/.test(mains[0]))
+    const main = mains[0];
+    if (browserProcessHasFlag(main, "incognito") || browserProcessHasFlag(main, "guest"))
         blocked("An incognito or guest browser cannot preserve its login through a restart.");
-    if (/\s--profile-directory(?:\s|=|$)/.test(mains[0]))
+    if (browserProcessHasFlag(main, "profile-directory"))
         blocked("An explicitly selected Chrome sub-profile cannot be preserved by this handoff; no browser was closed.");
-    const actualProfile = /--user-data-dir=(.*?)(?=\s--|$)/.exec(mains[0])?.[1];
+    const actualProfile = browserProcessFlagValue(main, "user-data-dir");
     if (!actualProfile || !path.isAbsolute(actualProfile))
         blocked("The browser profile could not be verified.");
     try {
@@ -37,7 +41,11 @@ function browserIdentity(port, profileDir) {
             throw error;
         blocked("The browser profile path could not be verified.");
     }
-    return { main: Number(/^\s*\S+\s+(\d+)\s/.exec(mains[0])[1]), pids, headless: /\s--headless(?:\s|=|$)/.test(mains[0]) };
+    return {
+        main: main.processId,
+        pids: matching.map((processInfo) => processInfo.processId),
+        headless: browserProcessHasFlag(main, "headless")
+    };
 }
 export function getDedicatedBrowserHeadlessMode(options) {
     return browserIdentity(options.port, options.profileDir).headless;
@@ -209,10 +217,15 @@ function alive(pid) {
     }
 }
 function matchingBrowserPids(port, profileDir) {
-    const listed = spawnSync("ps", ["-Ao", "user,pid,command"], { encoding: "utf8", timeout: 5_000 });
-    if (listed.status !== 0 || typeof listed.stdout !== "string")
+    try {
+        return findMatchingBrowserProcesses(inspectBrowserProcesses(), { port, profileDir })
+            .map((processInfo) => processInfo.processId);
+    }
+    catch (error) {
+        if (!(error instanceof BrowserProcessInspectionError))
+            throw error;
         blocked("Could not verify that the dedicated browser stayed closed.");
-    return findLaunchedBrowserProcesses(listed.stdout, { port, profileDir });
+    }
 }
 async function waitForQuietShutdown(identity, port, profileDir) {
     const deadline = Date.now() + 12_000;

package/dist/browser-process.js

@@ -0,0 +1,196 @@
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+export class BrowserProcessInspectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BrowserProcessInspectionError";
+    }
+}
+const WINDOWS_CIM_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    "[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)",
+    "$items = @(Get-CimInstance -ClassName Win32_Process -Filter \"Name = 'chrome.exe' OR Name = 'chromium.exe' OR Name = 'msedge.exe' OR Name = 'brave.exe'\" -Property ExecutablePath,ProcessId,CommandLine | Select-Object ExecutablePath,ProcessId,CommandLine)",
+    "ConvertTo-Json -Compress -InputObject $items"
+].join("; ");
+const WINDOWS_PROCESS_ARGS = [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    WINDOWS_CIM_SCRIPT
+];
+const POSIX_MAIN_EXECUTABLES = [
+    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+    "/Applications/Chromium.app/Contents/MacOS/Chromium",
+    "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+    "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"
+];
+const MAC_HELPER_EXECUTABLE = /^\/Applications\/(?:Google Chrome|Chromium|Microsoft Edge|Brave Browser)\.app\/Contents\/Frameworks\/.*?\/Helpers\/(?:Google Chrome|Chromium|Microsoft Edge|Brave Browser) Helper(?: \([^)]*\))?/i;
+const BROWSER_BASENAME = /^(?:google[ -]?chrome|chromium(?:-browser)?|chrome|microsoft[ -]edge|msedge|brave[ -]browser|brave)(?:\.exe)?$/i;
+function resultText(value) {
+    if (typeof value === "string")
+        return value;
+    if (Buffer.isBuffer(value))
+        return value.toString("utf8");
+    return undefined;
+}
+function defaultProcessListRunner(command, args, options) {
+    return spawnSync(command, args, options);
+}
+/** Read process identity without passing a port, profile, or other user data to a shell. */
+export function inspectBrowserProcesses(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const run = options.run ?? defaultProcessListRunner;
+    const command = platform === "win32" ? "powershell.exe" : "ps";
+    const args = platform === "win32" ? WINDOWS_PROCESS_ARGS : ["-Ao", "user,pid,command"];
+    const listed = run(command, [...args], {
+        encoding: "utf8",
+        timeout: 10_000,
+        maxBuffer: 8 * 1024 * 1024,
+        windowsHide: true
+    });
+    const stdout = resultText(listed.stdout);
+    if (listed.error || listed.status !== 0 || stdout === undefined) {
+        throw new BrowserProcessInspectionError("Could not inspect browser processes.");
+    }
+    return platform === "win32" ? parseWindowsCimProcessJson(stdout) : parsePosixProcessList(stdout);
+}
+export function parseWindowsCimProcessJson(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw.trim() || "[]");
+    }
+    catch {
+        throw new BrowserProcessInspectionError("Windows browser process inspection returned invalid JSON.");
+    }
+    const entries = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" ? [parsed] : undefined;
+    if (!entries)
+        throw new BrowserProcessInspectionError("Windows browser process inspection returned an invalid result.");
+    return entries.map((entry) => {
+        if (!entry || typeof entry !== "object") {
+            throw new BrowserProcessInspectionError("Windows could not provide complete browser process identity.");
+        }
+        const record = entry;
+        if (typeof record.ExecutablePath !== "string" || record.ExecutablePath.length === 0 ||
+            !Number.isInteger(record.ProcessId) || Number(record.ProcessId) <= 0 ||
+            typeof record.CommandLine !== "string" || record.CommandLine.length === 0) {
+            throw new BrowserProcessInspectionError("Windows could not provide complete browser process identity.");
+        }
+        return {
+            executablePath: record.ExecutablePath,
+            processId: Number(record.ProcessId),
+            commandLine: record.CommandLine
+        };
+    });
+}
+export function parsePosixProcessList(raw) {
+    const processes = [];
+    for (const line of raw.split(/\r?\n/)) {
+        const match = /^\s*\S+\s+(\d+)\s+(.+?)\s*$/.exec(line);
+        if (!match)
+            continue;
+        const processId = Number(match[1]);
+        const commandLine = match[2];
+        const executablePath = posixBrowserExecutable(commandLine);
+        if (!executablePath || !Number.isSafeInteger(processId) || processId <= 0)
+            continue;
+        processes.push({ executablePath, processId, commandLine });
+    }
+    return processes;
+}
+function posixBrowserExecutable(commandLine) {
+    for (const executable of POSIX_MAIN_EXECUTABLES) {
+        if (commandLine === executable || (commandLine.startsWith(executable) && /^\s--/.test(commandLine.slice(executable.length)))) {
+            return executable;
+        }
+    }
+    const helper = MAC_HELPER_EXECUTABLE.exec(commandLine)?.[0];
+    if (helper && (helper.length === commandLine.length || /^\s--/.test(commandLine.slice(helper.length))))
+        return helper;
+    const firstToken = commandLine.split(/\s+/, 1)[0];
+    return BROWSER_BASENAME.test(path.posix.basename(firstToken)) ? firstToken : undefined;
+}
+function flagValue(commandLine, flag) {
+    const escapedFlag = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const wholeArgumentQuoted = new RegExp(`(?:^|\\s)\"--${escapedFlag}=([^\"]*)\"(?=\\s|$)`, "i").exec(commandLine);
+    if (wholeArgumentQuoted)
+        return wholeArgumentQuoted[1].trim();
+    const match = new RegExp(`(?:^|\\s)--${escapedFlag}=(?:\"([^\"]*)\"|'([^']*)'|(.+?))(?=\\s+\"?--[A-Za-z0-9-]+(?:=|\\s|$)|\\s*$)`, "i").exec(commandLine);
+    return match ? (match[1] ?? match[2] ?? match[3])?.trim() : undefined;
+}
+export function browserProcessFlagValue(processInfo, flag) {
+    return flagValue(processInfo.commandLine, flag);
+}
+export function browserProcessHasFlag(processInfo, flag) {
+    const escapedFlag = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(?:^|\\s)(?:\"--${escapedFlag}(?:=[^\"]*)?\"|--${escapedFlag})(?==|\\s|$)`, "i").test(processInfo.commandLine);
+}
+function isMainBrowserExecutable(processInfo) {
+    const normalized = processInfo.executablePath.replaceAll("\\", "/");
+    if (/\/Helpers\//i.test(normalized))
+        return false;
+    return BROWSER_BASENAME.test(path.posix.basename(normalized)) || POSIX_MAIN_EXECUTABLES.includes(normalized);
+}
+export function isMainBrowserProcess(processInfo) {
+    return isMainBrowserExecutable(processInfo) && !browserProcessHasFlag(processInfo, "type");
+}
+export function assertLaunchedBrowserMainProcess(processes, launchedProcessId) {
+    const mains = processes.filter(isMainBrowserProcess);
+    if (!Number.isSafeInteger(launchedProcessId) || launchedProcessId <= 0 ||
+        mains.length !== 1 || mains[0].processId !== launchedProcessId) {
+        throw new BrowserProcessInspectionError("The inspected browser main process does not match the process launched by prodex.");
+    }
+    return mains[0];
+}
+function isBrowserProcess(processInfo) {
+    const normalized = processInfo.executablePath.replaceAll("\\", "/");
+    return BROWSER_BASENAME.test(path.posix.basename(normalized)) || MAC_HELPER_EXECUTABLE.test(normalized);
+}
+function normalizedProfile(value, platform) {
+    if (platform === "win32")
+        return path.win32.normalize(value).toLocaleLowerCase("en-US");
+    return path.posix.normalize(value);
+}
+export function findMatchingBrowserProcesses(processes, input) {
+    const platform = input.platform ?? process.platform;
+    const expectedProfile = normalizedProfile(input.profileDir, platform);
+    const sameProfile = (processInfo) => {
+        const profile = browserProcessFlagValue(processInfo, "user-data-dir");
+        return profile !== undefined && normalizedProfile(profile, platform) === expectedProfile;
+    };
+    const mains = processes.filter((processInfo) => {
+        if (!isMainBrowserProcess(processInfo) || !sameProfile(processInfo))
+            return false;
+        const port = browserProcessFlagValue(processInfo, "remote-debugging-port");
+        return port !== undefined && Number(port) === input.port && /^\d+$/.test(port);
+    });
+    if (mains.length === 0)
+        return [];
+    const mainIds = new Set(mains.map((processInfo) => processInfo.processId));
+    const children = processes.filter((processInfo) => {
+        return !mainIds.has(processInfo.processId) && isBrowserProcess(processInfo) && sameProfile(processInfo);
+    });
+    return [...mains, ...children];
+}
+export function findBrowserProcessesByPort(processes, input) {
+    const mains = processes.filter((processInfo) => {
+        if (!isMainBrowserProcess(processInfo))
+            return false;
+        const port = browserProcessFlagValue(processInfo, "remote-debugging-port");
+        return port !== undefined && /^\d+$/.test(port) && Number(port) === input.port;
+    });
+    if (mains.length === 0)
+        return [];
+    if (mains.length !== 1) {
+        throw new BrowserProcessInspectionError("More than one browser main process claims the requested debugging port.");
+    }
+    const profileDir = browserProcessFlagValue(mains[0], "user-data-dir") ?? input.fallbackProfileDir;
+    if (!profileDir) {
+        throw new BrowserProcessInspectionError("The browser on the requested debugging port did not expose its profile identity.");
+    }
+    return findMatchingBrowserProcesses(processes, {
+        platform: input.platform,
+        port: input.port,
+        profileDir
+    });
+}

package/dist/chatgpt-browser.js

@@ -7,6 +7,7 @@ import path from "node:path";
 import WsWebSocket from "ws";
 import { captureBrowserDiagnostics, diagnosticsEnabled, diagnosticsNote } from "./browser-diagnostics.js";
 import { withCrossProcessFileLock, writeVerifiedUtf8File } from "./safe-file.js";
+import { findBrowserProcessesByPort, findMatchingBrowserProcesses, inspectBrowserProcesses, parsePosixProcessList } from "./browser-process.js";
 import os from "node:os";
 import { answeredDialogWarning, chatSurfaceState, effortNeedsWorkSurface, javascriptDialogResponse, menuKeyboardStep, readPowerSliderSelection, sliderRestoreStep, surfaceFromProbe, sliderPressOutcome, sliderDidNotRespond } from "./picker-interaction.js";
 import { projectsWithIdsExpression, recentConversationTitlesExpression } from "./tui.js";
@@ -996,6 +997,20 @@ export function detectChatGptBlocker(text, visibleButtonLabels = []) {
     }
     return undefined;
 }
+function looksLikeObservedCloudflare502(text) {
+    const normalized = text.replace(/\s+/g, " ").trim();
+    return (/\bbad gateway\b/i.test(normalized) &&
+        /\berror code 502\b/i.test(normalized) &&
+        /\bvisit cloudflare\.com for more information\b/i.test(normalized));
+}
+function chatGptServiceErrorBlocker() {
+    return {
+        code: "chatgpt_service_error",
+        message: "ChatGPT rendered a Cloudflare 502 Bad Gateway service error. This is not evidence that the ChatGPT session expired.",
+        retryable: true,
+        next_step: "Wait for the ChatGPT service to recover, then check the original conversation before retrying."
+    };
+}
 export function detectChatGptPageBlocker(state) {
     // Blocker scan uses the nav-excluded sample so a sidebar chat title cannot
     // fake a blocker; fall back to the nav-included sample / full text when the
@@ -1003,6 +1018,15 @@ export function detectChatGptPageBlocker(state) {
     const rendered = detectChatGptBlocker(state.blockerScanTextSample ?? state.blockerTextSample ?? state.textSample, state.visibleButtonLabels);
     if (rendered)
         return rendered;
+    // Cloudflare's 502 page is an upstream service failure, not a challenge or
+    // evidence that the ChatGPT session expired. Match only the measured
+    // template in message-excluded page text. A status read proves the composer
+    // is absent; answer polling has no composer field, so its equally narrow
+    // evidence is the dedicated nav-and-message-excluded blocker scan.
+    const messageExcluded = state.blockerScanTextSample ?? state.blockerTextSample;
+    if (state.hasComposer !== true && messageExcluded !== undefined && looksLikeObservedCloudflare502(messageExcluded)) {
+        return chatGptServiceErrorBlocker();
+    }
     // The interstitial can have an empty body. Never use a conversation title
     // alone when the composer exists or its state was not actually checked.
     if (state.hasComposer === false && /^(?:just a moment|잠시만 기다리십시오)(?:\.{0,3}|…)$/i.test(state.title?.trim() ?? "")) {
@@ -1375,6 +1399,7 @@ export function openChatGptBrowser(options = {}) {
     return {
         command,
         args,
+        processId: child.pid,
         profileDir,
         port,
         waitForEarlyExit: (timeoutMs = 1000) => {
@@ -1544,6 +1569,9 @@ async function openChatGptThread(cdp, url) {
     const conversationId = conversationIdFromThreadUrl(url);
     if (!conversationId)
         throw new Error(`Not a ChatGPT conversation URL: ${url}`);
+    // A same-thread follow-up must not discard a ready composer and start a new load.
+    if (await cdp.evaluate(chatGptThreadReadyExpression(conversationId)))
+        return;
     await cdp.evaluate(`location.assign(${JSON.stringify(url)})`);
     const deadline = Date.now() + RELOAD_SETTLE_TIMEOUT_MS;
     while (Date.now() < deadline) {
@@ -1559,17 +1587,12 @@ async function openChatGptThread(cdp, url) {
                 throw error;
         }
     }
+    const state = await cdp.evaluate(statusExpression());
+    const blocker = detectChatGptPageBlocker(state);
+    if (blocker)
+        throw new ChatGptBrowserBlockerError({ ...blocker, thread: url });
     throw new ChatGptBrowserBlockerError(chatGptThreadUnavailableBlocker(url));
 }
-/**
- * The conversation a follow-up names cannot be opened.
- *
- * Retrying cannot undelete a thread, and the generic "resolve the visible
- * browser issue manually" this used to fall back to describes a browser that
- * is working fine - measured on a thread whose project had been deleted: the
- * cause was named in the message and then thrown away by the catch-all next
- * step underneath it.
- */
 /**
  * The composer's model selector never rendered.
  *
@@ -1589,11 +1612,11 @@ export function chatGptComposerNotReadyBlocker(reason) {
 }
 export function chatGptThreadUnavailableBlocker(url) {
     return {
-        code: "thread_unavailable",
-        message: `ChatGPT did not open the conversation to continue (${url}). It may have been deleted, or its project was.`,
-        retryable: false,
-        next_step: "That conversation cannot be reached, and retrying will not bring it back. Send without --continue to start a new one, " +
-            "or name a different consult with --continue-task <task_id> (`prodex pro list` shows them).",
+        code: "thread_not_ready",
+        message: `ChatGPT did not finish opening the conversation to continue (${url}) within the readiness wait. Nothing was sent.`,
+        retryable: true,
+        next_step: "Wait for that conversation to finish loading and check its readiness before retrying the same --continue-task. " +
+            "If it remains unavailable, inspect its access or project state; a loading timeout alone does not prove deletion.",
         thread: url
     };
 }
@@ -1859,7 +1882,9 @@ export function reloadedDocumentReadyExpression(extraCondition = "true") {
  */
 export function chatGptThreadReadyExpression(conversationId) {
     return `(() => {${composerExpressionHelpers()}
-    if (!location.href.includes(${JSON.stringify(conversationId)})) return false;
+    const current = new URL(location.href);
+    const match = /\\/c\\/([0-9a-f-]{16,})\\/?$/i.exec(current.pathname);
+    if (current.origin !== "https://chatgpt.com" || match?.[1].toLowerCase() !== ${JSON.stringify(conversationId.toLowerCase())}) return false;
     return Boolean(findChatGptComposerCandidate());
   })()`;
 }
@@ -4031,47 +4056,11 @@ export function resolveConversationToDelete(conversations, request) {
  * The port cannot tell a dead browser from an absent one; the process list can.
  */
 export function findLaunchedBrowserProcesses(psOutput, input) {
-    // `ps -Ao user,pid,command` leads with a user NAME, not a uid.
-    const pidOf = (line) => {
-        const match = /^\s*\S+\s+(\d+)\s/.exec(line);
-        return match ? Number(match[1]) : undefined;
-    };
-    // Mentioning the flag is not being the browser: a shell, an editor, or the
-    // very tool running this scan can carry it on its command line, and this list
-    // is what gets SIGTERM. Caught live - the probe matched its own node process.
-    const isBrowserCommand = (line) => {
-        const command = line.replace(/^\s*\S+\s+\d+\s+/, "").trim();
-        // Linux/PATH executables cannot contain spaces, so only the first token is
-        // eligible. This keeps a node/shell argument that names a browser from
-        // becoming a process prodex may terminate.
-        const firstToken = command.split(/\s+/, 1)[0];
-        if (/(^|[/\\])(google[ -]?chrome(?:\.exe)?|chromium(?:-browser)?|chrome(?:\.exe)?|microsoft[ -]edge|msedge\.exe|brave[ -]browser)$/i.test(firstToken)) {
-            return true;
-        }
-        // macOS app executables and helpers have spaces in their absolute path.
-        // Match only anchored, known bundle layouts and require the next token to
-        // be a flag (or end-of-line), never arbitrary argument text.
-        return /^\/Applications\/(?:Google Chrome\.app\/Contents\/MacOS\/Google Chrome|Chromium\.app\/Contents\/MacOS\/Chromium|Microsoft Edge\.app\/Contents\/MacOS\/Microsoft Edge|Brave Browser\.app\/Contents\/MacOS\/Brave Browser|(?:Google Chrome|Chromium|Microsoft Edge|Brave Browser)\.app\/Contents\/Frameworks\/.*?\/Helpers\/(?:Google Chrome|Chromium|Microsoft Edge|Brave Browser) Helper(?: \([^)]*\))?)(?=\s--|$)/i.test(command);
-    };
-    const lines = psOutput.split(/\r?\n/).filter((line) => !/\bgrep\b/.test(line) && isBrowserCommand(line));
-    // Exactly this port: a plain substring test let port 9 match 9333.
-    const portFlag = new RegExp(`--remote-debugging-port=${input.port}(?!\\d)`);
-    const mains = lines.filter((line) => portFlag.test(line));
-    // The port is the instance's identity. A browser sharing the profile while
-    // listening on another port belongs to someone else, and treating it as ours
-    // made a check against an unused port report a healthy Chrome as wedged.
-    if (mains.length === 0)
-        return [];
-    // Which profile the helpers belong to is the browser's answer, not the
-    // caller's: `check` has only a port, and matching against the profile it
-    // assumed both missed this browser's renderers and collected a stranger's.
-    // Read it off the process that answered to the port; fall back to what the
-    // caller passed only when the command line does not say.
-    // Stop at the next flag, so a profile path containing spaces survives.
-    const profileOf = (line) => /--user-data-dir=(.*?)(?=\s+-{1,2}\w|\s*$)/.exec(line)?.[1];
-    const profileDir = profileOf(mains[0]) ?? input.profileDir;
-    const helpers = profileDir.length > 0 ? lines.filter((line) => profileOf(line) === profileDir && !mains.includes(line)) : [];
-    return [...mains, ...helpers].map(pidOf).filter((pid) => pid !== undefined);
+    return findBrowserProcessesByPort(parsePosixProcessList(psOutput), {
+        platform: "linux",
+        port: input.port,
+        fallbackProfileDir: input.profileDir
+    }).map((processInfo) => processInfo.processId);
 }
 /**
  * A browser that is running but deaf is a different problem from one that is
@@ -4084,13 +4073,12 @@ export function findLaunchedBrowserProcesses(psOutput, input) {
  */
 export function findWedgedBrowser(input = {}) {
     const port = resolveCdpPort(input.port);
-    const profileDir = input.profileDir ?? defaultChatGptProfileDir();
-    // -A over every user's processes is deliberate: the browser may have been
-    // launched by another shell session than the one asking.
-    const listed = spawnSync("ps", ["-Ao", "user,pid,command"], { encoding: "utf8", timeout: 10_000 });
-    if (listed.status !== 0 || typeof listed.stdout !== "string")
-        return [];
-    return findLaunchedBrowserProcesses(listed.stdout, { port, profileDir });
+    const processes = inspectBrowserProcesses();
+    const matching = input.profileDir === undefined
+        ? findBrowserProcessesByPort(processes, { port, fallbackProfileDir: defaultChatGptProfileDir() })
+        : findMatchingBrowserProcesses(processes, { port, profileDir: input.profileDir });
+    return matching
+        .map((processInfo) => processInfo.processId);
 }
 const realSignals = {
     kill: (pid, signal) => process.kill(pid, signal),

package/dist/cli-args.js

@@ -104,8 +104,14 @@ export function editDistance(left, right) {
     }
     return previous[right.length];
 }
-export function shellQuote(value) {
-    return /^[A-Za-z0-9_./:@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+export function shellQuote(value, platform = process.platform) {
+    const shellSafe = /^[A-Za-z0-9_./:@=-]+$/.test(value);
+    if (shellSafe && (platform !== "win32" || !value.startsWith("@")))
+        return value;
+    const escaped = platform === "win32"
+        ? value.replaceAll("'", "''")
+        : value.replaceAll("'", "'\\''");
+    return `'${escaped}'`;
 }
 export function formatCliCommand(sourceCli) {
     return sourceCli ? `node ${shellQuote(sourceCli)}` : "prodex";

package/dist/cli-pro.js

@@ -1,6 +1,7 @@
 import { existsSync, realpathSync, statSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { BrowserProcessInspectionError } from "./browser-process.js";
 import { buildDryRunBundle } from "./bundle.js";
 import { ChatGptBrowserBlockerError, DEFAULT_CDP_PORT, resolveCdpPort, resolveConversationToDelete, resolveProjectToDelete, chatGptVisibilityBlocker, defaultChatGptProfileDir, formatDurationMs, getChatGptBrowserStatus, formatModelMenuOption, listChatGptModelOptions, deleteChatGptConversation, endWedgedBrowser, browserRecoveryPlan, findWedgedBrowser, wedgedBrowserBlocker, deleteChatGptProject, listChatGptProjectsWithIds, listRecentChatGptConversations, listChatGptSidebarProjects, normalizeChatGptTargetUrl, openChatGptBrowser, openChatGptTab, parseProMode, parseReasoningEffort, defaultTimeoutForTools, ensureVirtualDisplay, minimizeChatGptWindow, readLastBrowserLoginLaunch, resolveBrowserWindowMode, recordBrowserLoginLaunch, recoverChatGptAnswerFromThread, sendChatGptPrompt, statusMeansBrowserDead, namesPro, sendWarningsFromError, destinationVerification, chatGptProjectIdFromUrl } from "./chatgpt-browser.js";
 import { ASK_PRO_BOOLEAN_FLAGS, ASK_PRO_PREVIEW_VALUE_FLAGS, ASK_PRO_VALUE_FLAGS, assertHelpRequestArgs, assertNoExtraArgs, assertOnlyOptions, findHelpFlagIndexBeforePromptDelimiter, formatCliCommand, hasAskProDryRunMode, hasAskProMode, hasAskProSendMode, isHelpSubcommand, parseAskProArgs, printHelpIfRequested, readFlag, readPortFlag, readPositionalsWithOptions, readNonNegativeIntegerFlag, readPositiveIntegerFlag, readRepeatedFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
@@ -3225,10 +3226,24 @@ export async function printProductCheck(store, io, args, configCwd = io.cwd) {
             // report both as "not running": the browser really is gone, or it is still
             // there and has stopped answering. The second keeps burning CPU until
             // somebody notices, and nobody notices a message that says it is absent.
-            const wedged = statusMeansBrowserDead(browserStatus)
-                ? findWedgedBrowser({ ...(browserCommandOptions.port !== undefined ? { port: browserCommandOptions.port } : {}) })
-                : [];
-            const blocker = wedged.length > 0 ? wedgedBrowserBlocker(wedged, browserCommandOptions.port ?? DEFAULT_CDP_PORT) : browserStatus.blocker;
+            let blocker = browserStatus.blocker;
+            if (statusMeansBrowserDead(browserStatus)) {
+                try {
+                    const wedged = findWedgedBrowser({ ...(browserCommandOptions.port !== undefined ? { port: browserCommandOptions.port } : {}) });
+                    if (wedged.length > 0)
+                        blocker = wedgedBrowserBlocker(wedged, browserCommandOptions.port ?? DEFAULT_CDP_PORT);
+                }
+                catch (error) {
+                    if (!(error instanceof BrowserProcessInspectionError))
+                        throw error;
+                    blocker = {
+                        code: "browser_process_unverified",
+                        message: "The operating system could not verify browser process identity.",
+                        retryable: false,
+                        next_step: `Leave the existing browser unchanged. Check OS process-inspection permissions, then run \`${formatBrowserCheckCommand(sourceCli, browserCommandOptions)}\`.`
+                    };
+                }
+            }
             io.stdout(`chatgpt: ${blocker?.code ?? "unreachable"} - ${blocker?.message ?? "browser is not reachable"}`);
             const nextStep = productCheckBrowserNextStep(blocker?.next_step, sourceCli, browserCommandOptions);
             if (nextStep)