@youdie006/prodex 0.40.38 → 0.40.40

package/dist/browser-send-lock.js

@@ -15,9 +15,10 @@ function lockPath() {
 /**
  * Serialize visible-browser sends across processes. Waits up to waitMs for a
  * live holder to finish (0 = fail fast); a lock whose holder process is dead
- * is reaped immediately.
+ * is reaped immediately. budgetFlag is the option that sets waitMs for the
+ * command that is waiting, named when the wait runs out.
  */
-export async function withBrowserSendLock(waitMs, onWait, fn) {
+export async function withBrowserSendLock(waitMs, onWait, fn, budgetFlag = "--timeout-ms") {
     const file = lockPath();
     const reapClaim = path.join(path.dirname(file), `.${path.basename(file)}.reap`);
     return withCrossProcessFileLock(file, {
@@ -25,7 +26,7 @@ export async function withBrowserSendLock(waitMs, onWait, fn) {
         retryMs: 2_000,
         privateParent: true,
         onWait: (holder) => onWait(`another prodex send holds the browser (pid ${holder.pid ?? "unknown"}); waiting`),
-        busyError: (holder) => new Error(`Another prodex browser send is in progress (pid ${holder.pid ?? "unknown"}) and did not finish within the wait budget. Retry once it finishes, or raise --timeout-ms (which is also the queue budget).`),
+        busyError: (holder) => new Error(`Another prodex browser send is in progress (pid ${holder.pid ?? "unknown"}) and did not finish within the wait budget. Retry once it finishes, or raise ${budgetFlag} (which is also the queue budget).`),
         unavailableError: () => new Error(`A prodex browser send lock at ${file} is held by nothing and could not be removed, so no send can start. Stop all prodex senders and verify no request is active before deleting that file and the abandoned reaper claim at ${reapClaim}, then retry.`)
     }, fn);
 }

package/dist/chatgpt-browser.js

@@ -252,9 +252,31 @@ export const CHATGPT_RENDERED_MESSAGE_TEXT_JS = `
       // Inline math carries data-math-display="false" (measured), so the value counts, not its presence.
       const isDisplayMath = (node) => attr(node, "data-math-display") === "true" || hasClass(node, "katex-display");
       const isCodeBlock = (node) => attr(node, "data-markdown-copy") === "code-block" || tagOf(node) === "pre";
+      // A mermaid block is drawn as an SVG preview whose only text is the
+      // toolbar and node labels (measured 2026-10-21); its source is in the
+      // React props of the preview's fiber ancestors, as CodeMirror's is in
+      // its editor state.
+      const isMermaidPreview = (node) => attr(node, "data-chatgpt-mermaid-preview") !== null;
+      const mermaidBlock = (node) => {
+        let source = null;
+        try {
+          const fiberKey = Object.keys(node).find((key) => key.startsWith("__reactFiber"));
+          let fiber = fiberKey ? node[fiberKey] : null;
+          for (let depth = 0; fiber && depth < 12 && source === null; depth += 1, fiber = fiber.return) {
+            const content = fiber.memoizedProps && fiber.memoizedProps.content;
+            if (typeof content === "string" && content.trim()) source = trimEnd(content);
+          }
+        } catch (error) {
+          source = null;
+        }
+        if (source === null) return "[mermaid diagram - open the thread to see its source]";
+        const longestRun = (source.match(new RegExp(BT + "+", "g")) || []).reduce((most, run) => Math.max(most, run.length), 0);
+        const fence = BT.repeat(Math.max(3, longestRun + 1));
+        return fence + "mermaid" + NL + source + NL + fence;
+      };
       const BLOCK_TAGS = ["p", "div", "section", "article", "figure", "ul", "ol", "li", "table", "blockquote", "pre", "hr", "h1", "h2", "h3", "h4", "h5", "h6"];
       const isBlock = (node) => node.nodeType === 1 && !skipped(node) &&
-        (BLOCK_TAGS.includes(tagOf(node)) || isCodeBlock(node) || (isMath(node) && isDisplayMath(node)) ||
+        (BLOCK_TAGS.includes(tagOf(node)) || isCodeBlock(node) || isMermaidPreview(node) || (isMath(node) && isDisplayMath(node)) ||
           (tagOf(node) === "span" && findAll(node, (n) => BLOCK_TAGS.includes(tagOf(n))).length > 0));
       // The renderer web-search answers use since 2026-10-10 marks a source as a
       // badge inside a popover trigger; its urls only exist once it is opened.
@@ -362,6 +384,7 @@ export const CHATGPT_RENDERED_MESSAGE_TEXT_JS = `
         const tag = tagOf(node);
         if (isMath(node)) return isDisplayMath(node) ? "$$" + NL + mathSource(node) + NL + "$$" : "$" + mathSource(node) + "$";
         if (isCodeBlock(node)) return codeBlock(node);
+        if (isMermaidPreview(node)) return mermaidBlock(node);
         if (tag === "table") return table(node);
         if (/^h[1-6]$/.test(tag)) return "#".repeat(Number(tag[1])) + " " + inline(node).trim();
         if (tag === "ul" || tag === "ol") return list(node, depth);
@@ -6137,7 +6160,9 @@ export function transcriptContainsWholeSentPrompt(userText, sentPrompt) {
 }
 const NORMALIZED_PROMPT_MATCH_CHARS = 120;
 // The composer can autolink a url before the send, storing "[url](url)" in
-// place of the bare url (measured 2026-10-07, under load).
+// place of the bare url (measured 2026-10-07, under load). It escapes the two
+// halves differently ("Function\_(x)" vs "Function_\(x\)", measured
+// 2026-10-21), so the pattern is applied after markdown escapes are undone.
 const AUTOLINKED_URL_PATTERN = /\[(https?:\/\/[^\]\s]+)\]\(\1\)/g;
 /**
  * ChatGPT displays a sent turn's HTML entities decoded (measured 2026-10-19:
@@ -6155,7 +6180,7 @@ function decodeHtmlEntities(value) {
     });
 }
 function normalizeChatGptPromptText(value) {
-    const unescaped = decodeHtmlEntities(value).replace(AUTOLINKED_URL_PATTERN, "$1").replace(/\\([\\`*_{}[\]()#+\-.!>~|])/g, "$1");
+    const unescaped = decodeHtmlEntities(value).replace(/\\([\\`*_{}[\]()#+\-.!>~|])/g, "$1").replace(AUTOLINKED_URL_PATTERN, "$1");
     const renderedFences = unescaped.replace(/(^|\r?\n)```text[ \t]*\r?\n([\s\S]*?)\r?\n```(?=\r?\n|$)/g, "$1text\n$2");
     return renderedFences.replace(/\s+/g, " ").trim();
 }
@@ -6187,8 +6212,8 @@ export function chatGptRequestMatchesUserTurn(userText, sentPrompt, requestId) {
 }
 function withoutFenceLines(value) {
     return decodeHtmlEntities(value)
-        .replace(AUTOLINKED_URL_PATTERN, "$1")
         .replace(/\\([\\`*_{}[\]()#+\-.!>~|])/g, "$1")
+        .replace(AUTOLINKED_URL_PATTERN, "$1")
         .replace(/^[ \t]*```[\w-]*[ \t]*$/gm, "")
         .replace(/\s+/g, "");
 }

package/dist/cli-args.js

@@ -72,6 +72,12 @@ export function unknownTopLevelCommandError(command) {
     return new Error(`Unknown command: ${command}.${suggestionText} Run \`prodex help\`.`);
 }
 export function unknownOptionError(option, command, candidates) {
+    // A prompt that starts with a dash ("-5 + 3, what is it?") lands here.
+    // Anything that cannot be a flag gets the way to send it instead of a guess.
+    if (!/^--?[A-Za-z][\w-]*(=.*)?$/.test(option)) {
+        const context = command ? ` for ${command}` : "";
+        return new Error(`Unknown option${context}: ${option}. If this is the prompt, put \`--\` before it: prodex ask -- ${JSON.stringify(option)}`);
+    }
     const suggestion = closestSuggestion(option, candidates);
     const suggestionText = suggestion ? `. Did you mean \`${suggestion}\`?` : "";
     const context = command ? ` for ${command}` : "";
@@ -298,9 +304,11 @@ export const ASK_PRO_PREVIEW_VALUE_FLAGS = new Set([
     "--file",
     "--port",
     "--timeout-ms",
-    // Accepted here only so the preview path can reject it with the friendly
+    // Accepted here only so the preview path can reject them with the friendly
     // "only applies when sending" guidance instead of a raw "Unknown option".
     "--busy-wait-ms",
+    "--attach",
+    "--tool",
     "--target-url",
     ...ASK_PRO_SELECTION_VALUE_FLAGS
 ]);

package/dist/cli-help.js

@@ -17,7 +17,7 @@ First-time setup:
 
 Ask / consult commands:
   prodex ask [same flags as pro browser ask] "prompt"  # top-level shortcut for pro browser ask
-  prodex pro ask [--dry-run] [--cwd /absolute/path/to/repo] [--file path] [--attach path] [--tool deep-research|web-search|create-image] "prompt"  # dry-run preview
+  prodex pro ask [--dry-run] [--cwd /absolute/path/to/repo] [--file path] "prompt"  # dry-run preview
   prodex pro debate-prompt [--topic "..."] [--rounds 2] [--source-cli /absolute/path/to/dist/cli.js]  # print an agent prompt for a structured GPT Pro debate
   prodex pro browser login [--cwd /absolute/path/to/repo] [--dry-run] [--source-cli /absolute/path/to/dist/cli.js] [--profile-dir path] [--port 9333] [--url https://chatgpt.com/...] [--launch-timeout-ms 5000] [--wait|--no-wait] [--headed|--headless|--minimized|--virtual-display] [--wait-timeout-ms 300000] [--background] [--recover-visible]  # preview/open browser login
   prodex pro browser help [--source-cli /absolute/path/to/dist/cli.js]
@@ -35,7 +35,7 @@ Ask / consult commands:
 
 Bridge ledger (durable tasks/results/receipts/sessions under .bridge/):
   prodex init [--cwd /absolute/path/to/repo]
-  prodex tasks create [--cwd /absolute/path/to/repo] --title "Title" --prompt "Prompt" [--repo-id id] [--file path] [--attach path] [--tool deep-research|web-search|create-image]
+  prodex tasks create [--cwd /absolute/path/to/repo] --title "Title" --prompt "Prompt" [--repo-id id] [--file path]
   prodex tasks list [--status new|claimed|done|blocked] [--cwd /absolute/path/to/repo] [--json]
   prodex tasks show <task-id|latest> [--cwd /absolute/path/to/repo]
   prodex tasks claim <task-id> [--cwd /absolute/path/to/repo] [--by codex]
@@ -163,7 +163,7 @@ export function printProHelp(stdout) {
     stdout(`prodex pro
 
 Commands:
-  prodex pro ask [--dry-run] [--cwd /absolute/path/to/repo] [--file path] [--attach path] [--tool deep-research|web-search|create-image] "prompt"
+  prodex pro ask [--dry-run] [--cwd /absolute/path/to/repo] [--file path] "prompt"
   prodex pro debate-prompt [--topic "..."] [--rounds 2] [--source-cli /absolute/path/to/dist/cli.js]
   prodex pro browser help [--source-cli /absolute/path/to/dist/cli.js]
   prodex pro browser login [--cwd /absolute/path/to/repo] [--dry-run] [--source-cli /absolute/path/to/dist/cli.js] [--launch-timeout-ms 5000] [--wait|--no-wait] [--headed|--headless|--minimized|--virtual-display] [--wait-timeout-ms 300000] [--background] [--recover-visible]
@@ -209,7 +209,7 @@ export function printTasksHelp(stdout) {
     stdout(`prodex tasks
 
 Commands:
-  prodex tasks create [--cwd /absolute/path/to/repo] --title "Title" --prompt "Prompt" [--repo-id id] [--file path] [--attach path] [--tool deep-research|web-search|create-image]
+  prodex tasks create [--cwd /absolute/path/to/repo] --title "Title" --prompt "Prompt" [--repo-id id] [--file path]
   prodex tasks list [--status new|claimed|done|blocked] [--cwd /absolute/path/to/repo] [--json]
   prodex tasks show <task-id|latest> [--cwd /absolute/path/to/repo]
   prodex tasks claim <task-id> [--cwd /absolute/path/to/repo] [--by codex]

package/dist/cli-pro.js

@@ -974,6 +974,7 @@ export async function runProCommand(rest, io, runCliFn) {
         const report = buildIssueReport({
             task_id: record.result.task_id,
             status: record.result.status,
+            blockedAt: record.result.created_at,
             ...(record.result.blocker ? { blocker: record.result.blocker } : {})
         }, { version: CLI_VERSION, platform: process.platform, nodeVersion: process.version });
         io.stdout(`title: ${report.title}`);
@@ -1175,14 +1176,17 @@ export async function runAskProCommand(rest, io, beforeSend) {
     const targetCwd = resolveCwdFlag(io.cwd, parsedAskPro.optionArgs);
     const targetStore = new BridgeStore(targetCwd);
     const files = readRepeatedFlag(parsedAskPro.optionArgs, "--file").map((file) => {
-        if (!path.isAbsolute(file))
-            return file;
-        // Accept an absolute --file that points INSIDE the repo by converting it to
-        // the repo-relative path the reader requires (agents naturally pass absolute
-        // paths); reject one that escapes the repo so a file outside the project
-        // (secrets, ~/.ssh, ...) is not attached to a consult by mistake.
-        const rel = path.relative(targetCwd, path.resolve(file));
-        if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) {
+        // Accept a --file that points INSIDE the repo, absolute or relative (even
+        // ../repo/x), by converting it to the repo-relative path the reader
+        // requires; reject one that escapes the repo so a file outside the project
+        // (secrets, ~/.ssh, ...) is not attached to a consult by mistake. A
+        // relative escape used to reach the reader and fail with its internal
+        // "repo-relative root" wording instead of this guidance.
+        const rel = path.relative(targetCwd, path.resolve(targetCwd, file));
+        if (rel === "") {
+            throw new Error(`--file "${file}" is the repo root itself (${targetCwd}). Pass a file inside it.`);
+        }
+        if (rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
             throw new Error(`--file "${file}" is outside the repo root (${targetCwd}). Pass a path inside the repo (absolute or relative), or point --cwd at that repo.`);
         }
         return rel;
@@ -1193,7 +1197,7 @@ export async function runAskProCommand(rest, io, beforeSend) {
     const attachments = readRepeatedFlag(parsedAskPro.optionArgs, "--attach").map((file) => {
         const absolute = path.resolve(targetCwd, file);
         const rel = path.relative(targetCwd, absolute);
-        if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) {
+        if (rel === "" || rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
             throw new Error(`--attach "${file}" is outside the repo root (${targetCwd}). Pass a path inside the repo, or point --cwd at that repo.`);
         }
         if (!existsSync(absolute) || !statSync(absolute).isFile()) {
@@ -2305,7 +2309,7 @@ async function recoverBrowserUnderSendLock(stderr, options) {
     }
 }
 async function completeVisibleAuthRecovery(io, options) {
-    return withBrowserSendLock(5_000, (detail) => io.stderr(`recovery: ${detail}`), async () => {
+    return withBrowserSendLock(options.timeoutMs, (detail) => io.stderr(`recovery: ${detail}`), async () => {
         const { closeBlockedHeadlessBrowserForVisibleAuth, getDedicatedBrowserHeadlessMode } = await import("./browser-handoff.js");
         io.stderr("recovery: verifying the blocked headless browser before graceful visible handoff...");
         let url;
@@ -2342,10 +2346,26 @@ async function completeVisibleAuthRecovery(io, options) {
             headedLoginCommand: formatHeadedBrowserLoginCommand(options.sourceCli, { ...options.commandOptions, profileDir: opened.profileDir, port: opened.port })
         });
         return ready ? 0 : 1;
-    });
+    }, "--wait-timeout-ms");
+}
+/**
+ * Why a headless handoff sat on Cloudflare's check, and the way out. Measured
+ * 2026-10-20 on M3: headless Chrome reported "HeadlessChrome/155.0.0.0" and an
+ * 800x600 screen and stayed on "Just a moment", right after a visible sign-in.
+ * WSL works because its browser is ordinary Chrome on a virtual display.
+ */
+export function headlessCloudflareHint(code, platform) {
+    if (code !== "cloudflare_check")
+        return undefined;
+    const cause = "Cloudflare keeps headless Chrome on its check (it identifies itself as HeadlessChrome), so another login or handoff will not get past it.";
+    return platform === "darwin"
+        ? `${cause} macOS has no virtual display for Chrome; run the dedicated browser in the browser container instead (docs/container-browser.md), or keep a visible window open behind your other windows.`
+        : `${cause} Run it on a virtual display instead, with no window on screen: \`prodex pro browser login --virtual-display\`.`;
 }
 async function completeBackgroundBrowserLogin(io, options) {
-    return withBrowserSendLock(5_000, (detail) => io.stderr(`background: ${detail}`), async () => {
+    // An agent sending consults back to back left no 5 s gap (measured
+    // 2026-10-20 on M3), so the handoff queues for its turn like a send does.
+    return withBrowserSendLock(options.timeoutMs, (detail) => io.stderr(`background: ${detail}`), async () => {
         const { closeIdleChatGptBrowserForHandoff, getDedicatedBrowserHeadlessMode } = await import("./browser-handoff.js");
         io.stderr("background: checking the dedicated browser before graceful handoff...");
         const { url } = await closeIdleChatGptBrowserForHandoff({ port: options.port, profileDir: options.profileDir });
@@ -2367,13 +2387,16 @@ async function completeBackgroundBrowserLogin(io, options) {
         if (!ready) {
             const status = await getChatGptBrowserStatus({ port: opened.port, timeoutMs: 5_000 }).catch(() => undefined);
             io.stderr(`background: NOT READY (${status?.blocker?.code ?? "not_ready"}). The same profile was kept; this is not proof that your saved login was lost. No prompt was sent.`);
+            const hint = headlessCloudflareHint(status?.blocker?.code, process.platform);
+            if (hint)
+                io.stderr(`background: ${hint}`);
             return 1;
         }
         if (!getDedicatedBrowserHeadlessMode({ port: opened.port, profileDir: opened.profileDir }))
             throw new Error("The replacement browser is not actually headless; background readiness was not confirmed.");
         io.stdout("background: READY - the saved login works headless, with no visible window. You may close this terminal; later consults reuse this mode.");
         return 0;
-    });
+    }, "--wait-timeout-ms");
 }
 function needsVisibleAuthRecovery(code) {
     return code !== undefined && ["login_required", "cloudflare_check", "captcha_required", "permission_required"].includes(code);

package/dist/config.js

@@ -286,6 +286,7 @@ export function assertTokenNotExpired(config, now = new Date()) {
         throw new Error(status.warning.toLowerCase());
     }
 }
+const MAX_TOKEN_EXPIRES_AT_MS = Date.parse("9999-12-31T23:59:59.999Z");
 function computeTokenExpiresAt(tokenTtlHours, nowIso) {
     if (tokenTtlHours === undefined)
         return undefined;
@@ -296,6 +297,11 @@ function computeTokenExpiresAt(tokenTtlHours, nowIso) {
     if (!Number.isFinite(expiresAtMs)) {
         throw new Error("token ttl produced an invalid expiry time");
     }
+    // Past year 9999 the ISO date gains a sign and six-digit year, which the
+    // config schema rejects with a raw validation dump (measured 2026-10-21).
+    if (expiresAtMs > MAX_TOKEN_EXPIRES_AT_MS) {
+        throw new Error("--token-ttl-hours is too large: the token would expire after year 9999. Use a smaller value, such as 8760 for a year.");
+    }
     return new Date(expiresAtMs).toISOString();
 }
 function isTokenExpired(tokenExpiresAt, now) {

package/dist/issue-report.js

@@ -37,6 +37,9 @@ export function buildIssueReport(consult, environment) {
         ? "The browser response did not match the smoke-test token."
         : "Consult blocked; detailed diagnostics are kept in the local receipt.";
     const area = issueAreaLabel(code);
+    // Only a bare timestamp travels: the field comes from a local record, and
+    // anything else in it stays local like the rest of the blocker prose.
+    const blockedAt = consult.blockedAt && /^\d{4}-\d{2}-\d{2}T[\d:.]+Z$/.test(consult.blockedAt) ? consult.blockedAt : "(not recorded)";
     const body = [
         "A consult was blocked. Filed from its receipt, so the prompt and the answer are not included.",
         "",
@@ -45,7 +48,10 @@ export function buildIssueReport(consult, environment) {
         `| blocker | \`${code}\` |`,
         `| message | ${message || "(none)"} |`,
         `| retryable | ${consult.blocker.retryable === true ? "yes" : "no"} |`,
-        `| prodex | ${environment.version} |`,
+        `| blocked at | ${blockedAt} |`,
+        // Records do not store the version that ran the consult, so name this one
+        // for what it is; the time above places the failure among releases.
+        `| prodex filing this report | ${environment.version} |`,
         `| platform | ${environment.platform} |`,
         `| node | ${environment.nodeVersion} |`,
         "",

package/dist/mcp.js

@@ -140,11 +140,11 @@ export function createServer(cwd = process.cwd(), options = {}) {
         }
     }, async (input) => asText(await handlers.repo_read_file(input)));
     server.registerTool("repo_search", {
-        description: "Search the current repo with ripgrep. Read-only.",
+        description: "Search the current repo with ripgrep. The query is a regular expression: escape ( ) [ ] . * + ? with a backslash to match them literally. Read-only.",
         inputSchema: { query: McpBridgeTextSchema.min(1), glob: McpShortTextSchema.optional() }
     }, async (input) => asText(await handlers.repo_search(input)));
     server.registerTool("repo_write_file_dry_run", {
-        description: "Create a receipt-gated write preview for an existing repo-relative text file. Does not modify files.",
+        description: "Create a receipt-gated write preview for an existing repo-relative text file. Does not modify files. The file keeps its CRLF line endings and UTF-8 BOM when the new content leaves them out.",
         inputSchema: {
             path: McpShortTextSchema,
             content: z.string().max(1_000_000),

package/dist/repo-write.js

@@ -11,21 +11,38 @@ let testHooks = {};
 export function setRepoWriteTestHooks(hooks) {
     testHooks = hooks;
 }
+/**
+ * repo_read_file hands an agent "\n" endings for a CRLF file, so writing the
+ * edited text back turned every line into a change (measured 2026-10-21), and
+ * a UTF-8 BOM was dropped the same way. Keep what the file already uses, as an
+ * editor does: CRLF only when the file uses it throughout and the new content
+ * carries no CR of its own, and a BOM only when the new content has none.
+ */
+export function keepFileConventions(current, next) {
+    let content = next;
+    const crlf = current.includes("\r\n") && !/(^|[^\r])\n/.test(current);
+    if (crlf && !content.includes("\r"))
+        content = content.replace(/\n/g, "\r\n");
+    if (current.startsWith("\uFEFF") && !content.startsWith("\uFEFF"))
+        content = `\uFEFF${content}`;
+    return content;
+}
 export async function createRepoWriteDryRun(root, store, input) {
     const head = await assertGitHead(root, input.expected_head);
     if (Buffer.byteLength(input.content, "utf8") > MAX_WRITE_BYTES) {
         throw new Error(`New content is too large to write through repo tools`);
     }
     const current = await readWritableExistingFile(root, input.path);
-    if (current.content === input.content) {
+    const content = keepFileConventions(current.content, input.content);
+    if (current.content === content) {
         throw new Error(`No changes for ${input.path}`);
     }
     const preimage = sha256(current.content);
-    const newSha = sha256(input.content);
-    const diff = buildSimpleDiff(input.path, current.content, input.content);
+    const newSha = sha256(content);
+    const diff = buildSimpleDiff(input.path, current.content, content);
     const candidateArtifactPath = `.bridge/artifacts/repo-writes/${newSha}.txt`;
     const artifactAlreadyExisted = await store.hasArtifactText(candidateArtifactPath);
-    const artifactPath = await store.writeArtifactText(candidateArtifactPath, input.content);
+    const artifactPath = await store.writeArtifactText(candidateArtifactPath, content);
     const metadata = {
         path: input.path,
         expected_head: head,

package/dist/repo.js

@@ -70,7 +70,8 @@ export async function readRepoFile(root, repoPath, options = {}) {
     const resolved = resolveRepoPath(root, repoPath);
     await assertResolvedRepoPathAllowed(root, resolved, repoPath);
     const text = await readVerifiedUtf8File(resolved, () => assertResolvedRepoPathAllowed(root, resolved, repoPath), {
-        maxBytes: MAX_REPO_READ_BYTES
+        maxBytes: MAX_REPO_READ_BYTES,
+        decodeUtf16Bom: true
     }).catch((error) => {
         if (error instanceof Error && /too large/.test(error.message)) {
             throw new Error(`Path ${repoPath} is too large to read through repo tools`);
@@ -181,9 +182,21 @@ export async function searchRepoWithMetadata(root, query, glob) {
         }
         if (maybe.code === 1)
             return { matches: [], truncated: false, limit: MAX_REPO_SEARCH_MATCHES };
+        // An invalid pattern used to surface as "Command failed: <rg path> ..."
+        // with rg's parse error buried in it (measured 2026-10-21, query "(").
+        const reason = ripgrepRegexError(error.stderr);
+        if (reason) {
+            throw new Error(`repo_search treats the query as a regular expression, and ${JSON.stringify(query)} is not valid (${reason}). Escape characters such as ( ) [ ] { } . * + ? | with a backslash to search for them literally.`);
+        }
         throw error;
     }
 }
+function ripgrepRegexError(stderr) {
+    if (!stderr || !/regex parse error/i.test(stderr))
+        return undefined;
+    const detail = stderr.split("\n").map((line) => line.trim()).find((line) => /^error:/i.test(line));
+    return detail ? detail.replace(/^error:\s*/i, "") : "regex parse error";
+}
 function parseRipgrepJsonMatch(line) {
     let event;
     try {

package/dist/safe-file.js

@@ -71,7 +71,7 @@ export async function readVerifiedUtf8File(filePath, validate, options = {}) {
         if (options.maxBytes !== undefined && stat.size > options.maxBytes) {
             throw new Error(`Target file is too large (${stat.size} bytes)`);
         }
-        const content = await readHandleUtf8(handle, filePath, options.maxBytes);
+        const content = await readHandleUtf8(handle, filePath, options.maxBytes, options.decodeUtf16Bom === true);
         if (options.mode !== undefined) {
             await testHooks.beforeChmod?.(filePath, "read");
             await assertSafeOpenFile(handle, filePath, "read");
@@ -185,7 +185,7 @@ async function replaceByVerifiedTempFile(filePath, content, validate, options =
         throw error;
     }
 }
-async function readHandleUtf8(handle, filePath, maxBytes) {
+async function readHandleUtf8(handle, filePath, maxBytes, decodeUtf16Bom = false) {
     await assertOpenFileMatchesPath(handle, filePath, "read");
     const stat = await handle.stat();
     if (!stat.isFile()) {
@@ -206,7 +206,24 @@ async function readHandleUtf8(handle, filePath, maxBytes) {
             throw new Error(`Target file is too large (${offset} bytes)`);
         }
     }
-    return buffer.subarray(0, offset).toString("utf8");
+    return decodeFileText(buffer.subarray(0, offset), decodeUtf16Bom);
+}
+/**
+ * UTF-8, or UTF-16 when asked and the file starts with its BOM. Windows
+ * Notepad's "Unicode" saves UTF-16 LE with a BOM, and reading that as UTF-8
+ * turned every other byte into a NUL (measured 2026-10-20: --file refused it
+ * as "not a text file"). Only readers opt in, so nothing is re-encoded on write.
+ */
+export function decodeFileText(bytes, decodeUtf16Bom = false) {
+    if (decodeUtf16Bom && bytes.length >= 2) {
+        if (bytes[0] === 0xff && bytes[1] === 0xfe)
+            return bytes.subarray(2).toString("utf16le");
+        if (bytes[0] === 0xfe && bytes[1] === 0xff) {
+            const body = Buffer.from(bytes.subarray(2, 2 + ((bytes.length - 2) & ~1)));
+            return body.swap16().toString("utf16le");
+        }
+    }
+    return bytes.toString("utf8");
 }
 async function writeHandleUtf8(handle, filePath, content) {
     const replacement = Buffer.from(content, "utf8");

package/docs/releasing.md

@@ -16,6 +16,64 @@ Release target: `v0.40.13` on `main`. The GitHub Release records the resolved co
 
 The release adds a guarded, opt-in transition and more accurate blocker reporting. It does not claim that headless Pro consultation is verified on either deployment target or that authentication can be retained indefinitely.
 
+## Browser Incident 2026-10-20: M3 headless browser behind Cloudflare
+
+**What happened**
+- A read-only `prodex pro browser check` on M3 (0.40.38) reported `cloudflare_check`: the dedicated browser had run headless since 2026-09-16 and its ChatGPT tab sat on Cloudflare's human-verification page. Consults from M3's stdio MCP servers could not send.
+- `login --headed --recover-visible` could not take it over (`Chrome DevTools command timed out: Runtime.enable` on the stuck tab), and `reset` declined because the browser itself still answered.
+
+**Recovery**
+- The dedicated browser was closed with CDP `Browser.close` (send lock idle), then started with a window. Cloudflare passed. `--minimized` was not kept: this macOS desktop reports a minimized window as hidden, so prodex restored it.
+- The profile's ChatGPT login had expired; the maintainer signed in on the Mac. `pro browser check` then reported `ok logged_in=true composer=true`, and `pro browser smoke` answered `PRODEX_PRO_SMOKE_OK`.
+
+**Headless handoff, then the cause (same day)**
+- `login --background` handed the signed-in profile to headless (after PR #35's lock-wait problem was worked around by retrying), and the headless tab was immediately back on Cloudflare's "Just a moment" page (`NOT READY - cloudflare_check ... not ready headlessly`).
+- Read over CDP: the headless browser reports `HeadlessChrome/155.0.0.0` in its user agent and an 800x600 screen. WSL never runs headless - its dedicated browser is ordinary Chrome on the Xvfb display - which is why the same account works there. macOS has no Xvfb. Faking the user agent was not done: the container design excludes stealth settings.
+- M3's Claude and Codex MCP configs already use the browser container (`container-client.mjs --context colima-prodex-check mcp`), which runs ordinary Chromium on Xvfb and was logged in and ready. Three long-running sessions (two Claude, started via cmux with `--resume`, and a Codex running since 2026-09-15) still held host `prodex mcp` connections; they reach the container after a `/mcp` reconnect.
+- M3's container was rebuilt from `container/redesign-patches` `a870b0c` (image `feb5a47aae06`, restart `unless-stopped`) under the container's send-lock check. Its login was kept, the ChatGPT tab opened by itself, `pro browser check` was ok and the smoke answered `PRODEX_PRO_SMOKE_OK`. The container's `prodex --version` still prints 0.40.18 because that branch never bumped its version.
+
+**Open**
+- A long-running headless browser ends up behind Cloudflare's check (also noted on WSL, where the Xvfb display is used instead). On macOS there is no virtual display, and a minimized window counts as hidden, so the remaining no-headless option there is a window kept behind others. Changing the headless preference is a design decision that was not made here.
+
+## 0.40.39 Release Record
+
+Release commit `c8a170f` on `main` (cut after PRs #33-#37, last merge `09ad42e`); tag `v0.40.39`. First batched release: five fixes merged on green CI and released together.
+
+**Publishing**
+- `publish.yml` run 39525668044 passed all six platforms, then npm publish with SLSA v1 provenance and the GitHub Release (2026-10-21 01:09 UTC start).
+- `npm run release:verify` passed on the release commit after a build.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.39. Running services were not restarted: 10 stdio MCP servers on WSL and 4 on M3 keep older code until their clients reconnect. The Mac mini had none running.
+- The maintainer watchdog checkout was pulled to `c8a170f` and rebuilt.
+
+**Verified live**
+- Installed 0.40.39 on WSL: `prodex ask "- list these"` refuses with the hint to put `--` before the prompt.
+
+**Browser container**
+- `container/redesign-patches` `d3d7b66` ports PRs #34-#37 (UTF-16 decoding from #33 was already on the branch). The mermaid serializer was applied by hand because the container's transcript helpers differ from `main`. Branch suite: 2061 passed, 3 skipped.
+- WSL: image `67b473c3e850`, swapped under the send lock check. Live: a prompt asking for a mermaid flowchart saved the answer with a ```` ```mermaid ```` fence and its source.
+- M3 (colima `prodex-check`): image `ad0746f93e40`, swapped under the send lock check; `pro browser smoke` in the container returned `requestVerified: true`.
+
+## 0.40.38 Release Record
+
+Release commit `9541727` on `main` (cut after PR #32, merge `2c049b5`); tag `v0.40.38`.
+
+**Publishing**
+- `publish.yml` run 39362699716 passed all six platforms on the first attempt, then npm publish with SLSA v1 provenance and the GitHub Release (2026-10-20 03:08 UTC).
+- `npm run release:verify` passed on the release commit after a build.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.38. Running services were not restarted: 9 stdio MCP servers on WSL and 3 on M3 keep older code until their clients reconnect. The Mac mini had none running.
+- The maintainer watchdog checkout was pulled to `9541727` and rebuilt.
+
+**Verified live**
+- Over a fresh stdio MCP server on installed 0.40.38: a `pro_consult` with a 15 s timeout returned `status: "blocked"` (`send_timeout`) with `recover`, and `pro_recover` with `recover.arguments` returned `status: "done"`. On 0.40.37 the same consult returned only error text naming a CLI command.
+- Earlier the same day over MCP: `files`, `continue_thread`, and refusals for a path outside the repo, `.env`, a missing attachment, `new_chat` with `continue_thread`, and `deep-research` all behaved as documented.
+
+**Browser container**
+- `container/redesign-patches` `9c8a3d9` ports PR #32. Image `7486d2054a82`; branch suite 2049 passed, 3 skipped. Swapped under the send lock check. Live over MCP in the container: the same timeout returned `recover`, and `pro_recover` returned `done`.
+
 ## 0.40.37 Release Record
 
 Release commit `437590d` on `main` (cut after PR #31, merge `fd0ef2e`); tag `v0.40.37`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.40.38",
+  "version": "0.40.40",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",