@youdie006/prodex 0.40.40 → 0.40.42

package/README.md

@@ -163,7 +163,7 @@ Power slider on this account (the slider was walked and put back):
 * 5/5  6  -  Pro
 ```
 
-- `--effort 즉시|중간|높음|"매우 높음"|Pro` picks a rung; English aliases `instant`, `medium`, `high`, `extrahigh` and `max` are accepted, and `--model Pro` reaches the same top rung. Korean and English (US) ChatGPT labels are both matched; on another display language, pass the exact label `models` shows.
+- `--effort 즉시|중간|높음|"매우 높음"|Pro` picks a rung; English aliases `instant`, `medium`, `high`, `extrahigh` and `max` are accepted, and a step name given as a model (`--model Pro`, `--model Instant`) is applied to the slider with a `model_is_now_an_effort` warning. Korean and English (US) ChatGPT labels are both matched; on another display language, pass the exact label `models` shows.
 - ChatGPT now has two surfaces, Chat and Work, with different pickers; Work's ladder ends in Max and Ultra and offers no Pro. prodex puts the browser back on Chat before a send (and says so on the receipt), so a drifted browser cannot quietly send on the wrong picker. `Max` and `Ultra` are accepted for a browser already on Work.
 - The model rows themselves (Latest, GPT-5.6 Sol, GPT-5.5) cannot be clicked by automation in the current picker; the slider is the lever, and prodex says so rather than pretending a row was chosen.
 - Selection is guarded: a control that is covered or off screen is not clicked, a menu that stays open after a pick counts as a failed pick, and any failure backs out with Escape and reports a blocker instead of sending with the wrong model. What was applied is recorded on the receipt (`metadata.selection`, project name redacted).

package/dist/chatgpt-browser.js

@@ -410,7 +410,43 @@ export const CHATGPT_RENDERED_MESSAGE_TEXT_JS = `
     // A sent user turn renders inline code as <code>, dropping its backticks
     // from innerText (measured 2026-10-07), and the request is matched against
     // what was typed. Each inline code span gets its backticks back, in page order.
+    const inlineCodes = (root) =>
+      [...root.querySelectorAll('code')].filter((code) => {
+        if (code.closest('pre')) return false;
+        const value = code.textContent || "";
+        // A fenced block in a user turn is one <code> outside any <pre>
+        // (measured); inline code is a single line.
+        return value.length > 0 && !value.includes(String.fromCharCode(10));
+      });
+    // Backtick text nodes go in beside each span for one innerText read and come
+    // straight out again, so they land where the span is. Searching the text for
+    // the span's value put them on an earlier plain occurrence of the same words
+    // and refused a request that had posted (measured 2026-10-24). All of it runs
+    // in one synchronous evaluation, so the page never renders in between.
+    const userMessageTextAtCodePositions = (root) => {
+      const doc = root.ownerDocument;
+      if (!doc || typeof doc.createTextNode !== "function") return undefined;
+      const tick = String.fromCharCode(96);
+      const inserted = [];
+      try {
+        for (const code of inlineCodes(root)) {
+          const parent = code.parentNode;
+          if (!parent || typeof parent.insertBefore !== "function") return undefined;
+          const before = doc.createTextNode(tick);
+          const after = doc.createTextNode(tick);
+          parent.insertBefore(before, code);
+          inserted.push(before);
+          parent.insertBefore(after, code.nextSibling);
+          inserted.push(after);
+        }
+        return root.innerText || "";
+      } finally {
+        for (const node of inserted) node.parentNode?.removeChild(node);
+      }
+    };
     const userMessageText = (root) => {
+      const placed = userMessageTextAtCodePositions(root);
+      if (placed !== undefined) return placed;
       let text = root.innerText || "";
       const tick = String.fromCharCode(96);
       let cursor = 0;
@@ -1254,23 +1290,48 @@ export function proModeNotAppliedWarning(proMode, sliderEffort) {
  */
 export function pickerSelectionPlan(input) {
     const plan = {};
-    const modelIsNowAnEffort = input.model !== undefined && /^\s*pro\s*$/i.test(input.model);
+    const modelAsEffort = input.model !== undefined ? chatStepNamedAsModel(input.model) : undefined;
     if (input.effort !== undefined)
         plan.sliderLabel = input.effort;
-    else if (modelIsNowAnEffort)
-        plan.sliderLabel = input.model;
-    if (input.model !== undefined && !modelIsNowAnEffort)
+    else if (modelAsEffort !== undefined)
+        plan.sliderLabel = modelAsEffort;
+    if (input.model !== undefined && modelAsEffort === undefined)
         plan.modelLabel = input.model;
-    if (modelIsNowAnEffort) {
+    if (modelAsEffort !== undefined) {
         plan.warning =
-            `model_is_now_an_effort: ChatGPT's picker lists Pro as an effort step, not a model, so --model ${input.model} was ` +
+            `model_is_now_an_effort: ChatGPT's picker lists ${input.model.trim()} as an effort step, not a model, so --model ${input.model} was ` +
                 (input.effort === undefined
-                    ? "applied to the effort slider instead. Say --effort Pro to be explicit"
+                    ? `applied to the effort slider instead. Say --effort ${input.model.trim()} to be explicit`
                     : `ignored in favour of --effort ${input.effort}`) +
                 ", or clear a saved default with `prodex setup --clear-model`.";
     }
     return plan;
 }
+/**
+ * The Chat slider step a --model value names, if it names one.
+ *
+ * Pro was the first model to become a step, but Instant through Extra High sit
+ * on the same slider: `--model Instant` warned "does not offer" and went out on
+ * whatever step was saved, so a request for a fast answer waited on Pro
+ * reasoning (measured 2026-10-22). Max and Ultra are Work-only rungs that a
+ * model name does not reach, so they stay model names.
+ */
+export function chatStepNamedAsModel(model) {
+    let step;
+    try {
+        step = parseReasoningEffort(model);
+    }
+    catch {
+        return undefined;
+    }
+    if (step === "Max" || step === "Ultra")
+        return undefined;
+    // "max" is an alias of 매우 높음 for --effort, but a model called Max is
+    // asking for the Work rung, not for Extra High.
+    if (/^\s*max\s*$/i.test(model))
+        return undefined;
+    return step;
+}
 export function chatGptBusyBlocker(state) {
     // Waiting for a choice is not generating. Conflating them turned a click
     // away from ready into a full send budget spent on "still generating".
@@ -1460,6 +1521,28 @@ export function normalizeChatGptTargetUrl(value) {
     url.pathname = url.pathname.replace(/\/+$/, "") || "/";
     return url.toString();
 }
+/**
+ * A conversation URL, the only thing recovery can read an answer from.
+ *
+ * Recovery navigates the shared tab to its target. A URL that only passed the
+ * host check (`/c/abc def`, the home page, a project page) took the send lock
+ * and moved the tab somewhere no answer could be (measured 2026-10-26).
+ */
+export function normalizeChatGptThreadUrl(value) {
+    const describe = `It must be a ChatGPT conversation URL such as https://chatgpt.com/c/<id> (or https://chatgpt.com/g/<project>/c/<id>), not ${JSON.stringify(value)}.`;
+    let url;
+    try {
+        url = normalizeChatGptTargetUrl(value);
+    }
+    catch {
+        throw new Error(`Recovery target is not a ChatGPT URL. ${describe}`);
+    }
+    const pathname = new URL(url).pathname;
+    if (!/^(?:\/g\/[A-Za-z0-9_-]+)?\/c\/[A-Za-z0-9][A-Za-z0-9_-]*$/.test(pathname)) {
+        throw new Error(`Recovery target is not a conversation URL. ${describe}`);
+    }
+    return url;
+}
 export function chatGptUrlsReferToSameTarget(currentUrl, expectedUrl) {
     try {
         return normalizeChatGptTargetUrl(currentUrl) === normalizeChatGptTargetUrl(expectedUrl);
@@ -3741,7 +3824,7 @@ export async function recoverChatGptAnswerFromThread(options) {
     }
     const port = resolveCdpPort(options.port);
     const timeoutMs = Math.max(1_000, options.timeoutMs ?? 60_000);
-    const url = normalizeChatGptTargetUrl(options.targetUrl);
+    const url = normalizeChatGptThreadUrl(options.targetUrl);
     const page = await findChatGptPage(port, 3_000);
     if (!page.ok || !page.page) {
         throw new ChatGptBrowserBlockerError(page.blocker ?? {

package/dist/cli-pro.js

@@ -4,7 +4,7 @@ import { createServer as createNetServer } from "node:net";
 import path from "node:path";
 import { BrowserProcessInspectionError } from "./browser-process.js";
 import { buildDryRunBundle } from "./bundle.js";
-import { ChatGptBrowserBlockerError, DEFAULT_CDP_PORT, resolveCdpPort, resolveConversationToDelete, resolveProjectToDelete, chatGptVisibilityBlocker, defaultChatGptProfileDir, formatDurationMs, getChatGptBrowserStatus, formatModelMenuOption, listChatGptModelOptions, deleteChatGptConversation, endWedgedBrowser, browserRecoveryPlan, findWedgedBrowser, wedgedBrowserBlocker, deleteChatGptProject, listChatGptProjectsWithIds, listRecentChatGptConversations, listChatGptSidebarProjects, normalizeChatGptTargetUrl, openChatGptBrowser, openChatGptTab, parseProMode, parseReasoningEffort, defaultTimeoutForTools, ensureVirtualDisplay, minimizeChatGptWindow, readLastBrowserLoginLaunch, resolveBrowserWindowMode, recordBrowserLoginLaunch, recoverChatGptAnswerFromThread, sendChatGptPrompt, statusMeansBrowserDead, namesPro, sendWarningsFromError, destinationVerification, chatGptProjectIdFromUrl } from "./chatgpt-browser.js";
+import { ChatGptBrowserBlockerError, DEFAULT_CDP_PORT, resolveCdpPort, resolveConversationToDelete, resolveProjectToDelete, chatGptVisibilityBlocker, defaultChatGptProfileDir, formatDurationMs, getChatGptBrowserStatus, formatModelMenuOption, listChatGptModelOptions, deleteChatGptConversation, endWedgedBrowser, browserRecoveryPlan, findWedgedBrowser, wedgedBrowserBlocker, deleteChatGptProject, listChatGptProjectsWithIds, listRecentChatGptConversations, listChatGptSidebarProjects, normalizeChatGptTargetUrl, openChatGptBrowser, openChatGptTab, parseProMode, parseReasoningEffort, defaultTimeoutForTools, ensureVirtualDisplay, minimizeChatGptWindow, readLastBrowserLoginLaunch, resolveBrowserWindowMode, recordBrowserLoginLaunch, recoverChatGptAnswerFromThread, sendChatGptPrompt, statusMeansBrowserDead, namesPro, sendWarningsFromError, destinationVerification, chatGptProjectIdFromUrl, chatStepNamedAsModel, normalizeChatGptThreadUrl } from "./chatgpt-browser.js";
 import { ASK_PRO_BOOLEAN_FLAGS, ASK_PRO_PREVIEW_VALUE_FLAGS, ASK_PRO_VALUE_FLAGS, assertHelpRequestArgs, assertNoExtraArgs, assertOnlyOptions, findHelpFlagIndexBeforePromptDelimiter, formatCliCommand, hasAskProDryRunMode, hasAskProMode, hasAskProSendMode, isHelpSubcommand, parseAskProArgs, printHelpIfRequested, readFlag, readPortFlag, readPositionalsWithOptions, readNonNegativeIntegerFlag, readPositiveIntegerFlag, readRepeatedFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
 import { printProBrowserHelp, printProHelp } from "./cli-help.js";
 import { listRawResultsForInspection, listTasksForInspection } from "./cli-ledger.js";
@@ -19,6 +19,7 @@ import { readBridgeRoots } from "./registry.js";
 import { ProdexRequestIdSchema, SessionKeySchema } from "./schema.js";
 import { BridgeStore, MAX_FETCHABLE_RESULT_ARTIFACT_BYTES } from "./store.js";
 import { CLI_VERSION } from "./cli-help.js";
+import { assertRepoRelativePath, assertResolvedRepoPathAllowed } from "./repo.js";
 import { PRODEX_ISSUE_REPO, buildIssueReport, fileGitHubIssue } from "./issue-report.js";
 function resolveBrowserProfileDirForLaunch(profileDir, launchCwd = process.cwd()) {
     const resolved = path.resolve(launchCwd, profileDir);
@@ -652,6 +653,9 @@ export async function runProCommand(rest, io, runCliFn) {
             if (!targetUrl) {
                 throw new Error("pro browser recover requires --target-url <thread-url> - the ChatGPT conversation URL whose finished answer to recover (e.g. the thread from a send_timeout blocker).");
             }
+            // Checked here, before the send lock and the navigation it guards, and
+            // outside the catch below that dresses errors as browser failures.
+            normalizeChatGptThreadUrl(targetUrl);
             const recoverPort = readPortFlag(browserArgs, "--port");
             const recoverTimeoutMs = readPositiveIntegerFlag(browserArgs, "--timeout-ms");
             const recoverRequestIdRaw = readFlag(browserArgs, "--request-id");
@@ -1205,6 +1209,21 @@ export async function runAskProCommand(rest, io, beforeSend) {
         }
         return absolute;
     });
+    // An upload leaves the machine, so it gets the same guard as --file and
+    // repo_read_file: no .env, .git or key files, and no symlink out of the
+    // repo. --attach used to check only "inside the repo and exists", so both
+    // `--attach .env` and a link to ~/.ssh reached the upload (measured
+    // 2026-10-26); MCP attach takes this route too.
+    for (const [index, absolute] of attachments.entries()) {
+        const repoPath = path.relative(targetCwd, absolute).split(path.sep).join("/");
+        try {
+            assertRepoRelativePath(repoPath);
+            await assertResolvedRepoPathAllowed(targetCwd, absolute, repoPath);
+        }
+        catch (error) {
+            throw new Error(`--attach "${readRepeatedFlag(parsedAskPro.optionArgs, "--attach")[index]}" refused: ${errorMessage(error)}.`, { cause: error });
+        }
+    }
     if (attachments.length > 0 && !hasSendMode) {
         throw new Error("--attach only applies when sending (`prodex pro browser ask`); the dry-run preview cannot upload files.");
     }
@@ -2626,7 +2645,9 @@ export function resolveSelectionAxes(input) {
     const { explicit } = input;
     const defaults = input.defaults;
     const reasoningAxisChosen = explicit.proMode !== undefined || explicit.effort !== undefined;
-    const explicitlyPro = explicit.model !== undefined && namesPro(explicit.model);
+    // Pro, and any other Chat step given as a model, is a position of the same
+    // slider a saved effort sets, so asking for it answers the effort question.
+    const explicitlyPro = explicit.model !== undefined && (namesPro(explicit.model) || chatStepNamedAsModel(explicit.model) !== undefined);
     const model = explicit.model ?? (explicit.effort !== undefined ? undefined : defaults?.model);
     const proMode = explicit.proMode ?? (reasoningAxisChosen ? undefined : defaults?.pro_mode);
     const effort = explicit.effort ?? (reasoningAxisChosen || explicitlyPro ? undefined : defaults?.effort);

package/docs/cli-reference.md

@@ -174,7 +174,7 @@ prodex pro browser models
 ```
 
 - `--effort 즉시|중간|높음|"매우 높음"|Max|Ultra|Pro` sets the rung. English aliases `instant`/`light`, `medium`, `high`, `extrahigh`/`max`, `ultra` are accepted, and both the Korean and the English (US) ChatGPT labels are matched. `Max` and `Ultra` belong to the Work surface's ladder and apply only when the browser is already on Work; every other value is sent on Chat, whose top step is Pro.
-- `--model Pro` reaches the same top rung. The model rows in the picker (Latest, GPT-5.6 Sol, GPT-5.5) refuse automation clicks in the current UI - they carry `pointer-events: none` - so `--model` with any other label reports `model_not_applied` rather than pretending. On a display language other than Korean or English, pass the exact label `models` prints.
+- `--model Pro` reaches the same top rung, and so does any other Chat step given as a model (`--model Instant`, `--model High`): it is applied to the slider with a `model_is_now_an_effort` warning. Max and Ultra are not, because they are Work rungs. The model rows in the picker (Latest, GPT-5.6 Sol, GPT-5.5) refuse automation clicks in the current UI - they carry `pointer-events: none` - so `--model` with any other label reports `model_not_applied` rather than pretending. On a display language other than Korean or English, pass the exact label `models` prints.
 - `--pro-mode 기본|확장` selects a Pro sub-mode where the picker still exposes one (the GPT-5.5 generation); with a single Pro rung it fails with guidance. `--pro-mode` and `--effort` are different axes of the same control and cannot be combined. Any Pro selection raises the default `--timeout-ms` to 1200000, because Pro reasoning routinely runs for many minutes; an explicit `--timeout-ms` always wins.
 - ChatGPT keeps two surfaces, Chat and Work, with different pickers; Work's ladder has no Pro. A send puts the browser back on Chat first and notes it on the receipt, so a browser that drifted onto Work does not quietly send on the wrong picker.
 - `--project "name"` enters an existing sidebar project before sending. `--project-new "name"` creates a new project (sidebar 새 프로젝트 popover, committed with Enter) and sends inside it. Neither can be combined with `--target-url` (the project step would navigate away from the confirmed tab), and `--project-new` never comes from saved defaults - creating a project is always an explicit per-ask choice.

package/docs/releasing.md

@@ -35,6 +35,57 @@ The release adds a guarded, opt-in transition and more accurate blocker reportin
 **Open**
 - A long-running headless browser ends up behind Cloudflare's check (also noted on WSL, where the Xvfb display is used instead). On macOS there is no virtual display, and a minimized window counts as hidden, so the remaining no-headless option there is a window kept behind others. Changing the headless preference is a design decision that was not made here.
 
+## 0.40.41 Release Record
+
+Release commit `e0ea707` on `main` (cut after PRs #45-#47, last merge `6911f3e`); tag `v0.40.41`. Released ahead of the usual batch for PR #46, which withheld answers from requests that had posted.
+
+**Publishing**
+- `publish.yml` run 40274938156 passed all six platforms, then npm publish with SLSA v1 provenance and the GitHub Release (2026-10-26 05:34 UTC start).
+- `npm run release:verify` passed on the release commit after a build. The release script now refuses to tag when the release section has duplicate lines or an `## Unreleased` section survives the rename; the GitHub Release lists the same three entries as `CHANGELOG.md`.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.41. Running services were not restarted: no host stdio MCP servers on WSL and 1 on M3; the Mac mini had none.
+- The maintainer watchdog checkout was pulled to `e0ea707` and rebuilt.
+
+**Verified live on installed 0.40.41 (WSL)**
+- `Reply with only OK. Run npm test first, then \`npm test\` again.`: `request_verified: yes` (0.40.40 refused it as `request_mismatch`). Before the fix, the 2026-10-24 thread whose two sends had been refused also matched when re-read with the fixed extraction.
+- `--model Instant` in a repo with a saved Pro effort: applied to the slider with `model_is_now_an_effort`, answered in 9 s.
+- `pro browser recover --target-url "https://chatgpt.com/c/abc def"`: refused before the send lock; the shared tab did not move.
+
+**Browser container**
+- `container/redesign-patches` `60a49da` ports #45, `5154330` ports #46 (applied by hand: the container's message helpers differ from `main`), `6a9ea08` ports #47. Branch suite at `6a9ea08`: 2080 passed, 3 skipped; `release:verify` ok.
+- WSL images `1ce5bcde0ace` (#45, `--model Instant` applied live), `88bd2a8f427a` (#46, the backtick repro verified), `e83a90389d02` (#47, bad URL refused, smoke `requestVerified: true`).
+- M3 (colima `prodex-check`) images `c289e00e756d`, `ee6f98e1588d` (backtick repro verified), `5cd5a5642917` (bad URL refused, smoke ok). Every swap waited for an idle send lock.
+
+**Incidents**
+- 2026-10-22: the WSL disk filled to 100% from another project's session scratch data, so command output stopped being written mid-port. Nothing in prodex was involved; the #45 container port resumed after that session's data was cleaned up on its side.
+- 2026-10-26: probing recovery input with `--target-url "https://chatgpt.com/c/abc def"` on 0.40.40 moved the shared ChatGPT tab to that URL (the bug PR #47 fixes); no send was in flight and the tab was moved back to the home page.
+
+## 0.40.40 Release Record
+
+Release commit `3d671f5` on `main` (cut after PRs #38-#44, last merge `5609f4c`); tag `v0.40.40`.
+
+**Publishing**
+- `publish.yml` run 39563515199 passed all six platforms, then npm publish with SLSA v1 provenance and the GitHub Release (2026-10-21 07:39 UTC start).
+- `npm run release:verify` passed on the release commit after a build.
+
+**Changelog defect**
+- The released `CHANGELOG.md` (also inside the npm tarball) repeats five entries in the 0.40.40 section and leaves the token TTL fix (#44) under a stray `## Unreleased` heading below it. Cause: the script that resolved CHANGELOG conflicts while rebasing queued PRs copied the branch's whole Unreleased section, which already held the entries merged before it, and #44's branch added a second Unreleased section. `main` was corrected right after the release, and the GitHub Release notes were replaced with the corrected eight entries. The npm tarball cannot be changed. The rebase script now carries only lines missing from `main` and stops on duplicate lines or a second Unreleased section; the release script stops if an Unreleased section survives the rename.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.40. Running services were not restarted: 9 stdio MCP servers on WSL and 1 on M3 keep older code until their clients reconnect. The Mac mini had none running.
+- The maintainer watchdog checkout was pulled to `3d671f5` and rebuilt.
+
+**Verified live**
+- Installed 0.40.40 on WSL: a prompt with `[the docs](https://en.wikipedia.org/wiki/Function_(mathematics))`, refused twice as `request_mismatch` by 0.40.39, returned `done` with `request_verified: yes`.
+- Over MCP on installed 0.40.40: `repo_search "("` explains that the query is a regular expression.
+- `pro report-issue` preview shows `blocked at` and `prodex filing this report`; `pro ask --tool web-search` names the send command.
+
+**Browser container**
+- `container/redesign-patches` `1f4baa6` ports PRs #38-#41 and `5812053` ports PRs #42-#44. Branch suite at `5812053`: 2074 passed, 3 skipped; `release:verify` ok. One full run failed `project-sidebar-current-ui` "retries a covered target three times" (untouched; passed 3/3 alone and on the rerun).
+- WSL: image `75828cfb7ed5` after #38-#41 (the autolink prompt went through live with `request_verified: yes`), then `6042260bebe7` after #42-#44 (smoke `requestVerified: true`). Both swapped under the send lock check.
+- M3 (colima `prodex-check`): image `59fd7b2f0e89`, then `2ab687763354`; smoke `requestVerified: true` after each swap, under the send lock check.
+
 ## 0.40.39 Release Record
 
 Release commit `c8a170f` on `main` (cut after PRs #33-#37, last merge `09ad42e`); tag `v0.40.39`. First batched release: five fixes merged on green CI and released together.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.40.40",
+  "version": "0.40.42",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",