@youdie006/prodex 0.40.41 → 0.40.43

package/dist/bridge-gitignore.js

@@ -2,7 +2,7 @@ import { lstat } from "node:fs/promises";
 import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 const required = [
     "tasks/*.json", "results/*.json", "sessions/*.json", "receipts/*.json",
-    "artifacts/*", "config.local.json", "receipt-key.local", "last-browser-send", "!.gitignore"
+    "artifacts/*", "diagnostics/", "config.local.json", "receipt-key.local", "last-browser-send", "!.gitignore"
 ];
 export async function ensureBridgeGitignore(filePath, validate) {
     let current = "";

package/dist/cli-args.js

@@ -404,3 +404,13 @@ export function printHelpIfRequested(args, command, stdout, printHelp, options =
     printHelp(stdout);
     return true;
 }
+/**
+ * A project is found and created by its name, so a name that is only spaces
+ * names nothing: it used to reach the browser, where --project-new typed it
+ * into ChatGPT's new-project dialog.
+ */
+export function assertProjectName(flag, value) {
+    if (value !== undefined && !value.trim()) {
+        throw new Error(`${flag} is blank; give the ChatGPT project name, or leave the option out.`);
+    }
+}

package/dist/cli-ledger.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPositionalsWithOptions, readReceiptKindFlag, readRepeatedFlag, readSessionStatusFlag, readTaskStatusFlag, resolveCwdFlag, unknownSubcommandError } from "./cli-args.js";
 import { printReceiptsHelp, printResultsHelp, printSessionsHelp, printTasksHelp } from "./cli-help.js";
 import { sourceAwareResultError } from "./cli-shared.js";
@@ -355,7 +356,8 @@ export function receiptInspectionListSuffix(receipt) {
     return "";
 }
 export async function writeTaskCompleteArtifacts(store, values) {
-    const artifacts = [];
+    const parsed = [];
+    const seen = new Set();
     for (const value of values) {
         const separator = value.indexOf("=");
         if (separator <= 0) {
@@ -366,6 +368,17 @@ export async function writeTaskCompleteArtifacts(store, values) {
         if (!artifactPath.trim()) {
             throw new Error("tasks complete --artifact requires path=text");
         }
+        // Checked before anything is written: a repeated path used to overwrite
+        // the earlier text silently and be recorded twice.
+        const key = path.posix.normalize(artifactPath.replaceAll("\\", "/"));
+        if (seen.has(key)) {
+            throw new Error(`tasks complete --artifact ${artifactPath} names a file more than once; pass each artifact path once.`);
+        }
+        seen.add(key);
+        parsed.push({ artifactPath, content });
+    }
+    const artifacts = [];
+    for (const { artifactPath, content } of parsed) {
         const storedPath = await store.writeArtifactText(artifactPath, content);
         artifacts.push({ path: storedPath, role: "result" });
     }

package/dist/cli-pro.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { BrowserProcessInspectionError } from "./browser-process.js";
 import { buildDryRunBundle } from "./bundle.js";
 import { ChatGptBrowserBlockerError, DEFAULT_CDP_PORT, resolveCdpPort, resolveConversationToDelete, resolveProjectToDelete, chatGptVisibilityBlocker, defaultChatGptProfileDir, formatDurationMs, getChatGptBrowserStatus, formatModelMenuOption, listChatGptModelOptions, deleteChatGptConversation, endWedgedBrowser, browserRecoveryPlan, findWedgedBrowser, wedgedBrowserBlocker, deleteChatGptProject, listChatGptProjectsWithIds, listRecentChatGptConversations, listChatGptSidebarProjects, normalizeChatGptTargetUrl, openChatGptBrowser, openChatGptTab, parseProMode, parseReasoningEffort, defaultTimeoutForTools, ensureVirtualDisplay, minimizeChatGptWindow, readLastBrowserLoginLaunch, resolveBrowserWindowMode, recordBrowserLoginLaunch, recoverChatGptAnswerFromThread, sendChatGptPrompt, statusMeansBrowserDead, namesPro, sendWarningsFromError, destinationVerification, chatGptProjectIdFromUrl, chatStepNamedAsModel, normalizeChatGptThreadUrl } from "./chatgpt-browser.js";
-import { ASK_PRO_BOOLEAN_FLAGS, ASK_PRO_PREVIEW_VALUE_FLAGS, ASK_PRO_VALUE_FLAGS, assertHelpRequestArgs, assertNoExtraArgs, assertOnlyOptions, findHelpFlagIndexBeforePromptDelimiter, formatCliCommand, hasAskProDryRunMode, hasAskProMode, hasAskProSendMode, isHelpSubcommand, parseAskProArgs, printHelpIfRequested, readFlag, readPortFlag, readPositionalsWithOptions, readNonNegativeIntegerFlag, readPositiveIntegerFlag, readRepeatedFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
+import { ASK_PRO_BOOLEAN_FLAGS, ASK_PRO_PREVIEW_VALUE_FLAGS, ASK_PRO_VALUE_FLAGS, assertHelpRequestArgs, assertNoExtraArgs, assertOnlyOptions, findHelpFlagIndexBeforePromptDelimiter, formatCliCommand, hasAskProDryRunMode, hasAskProMode, hasAskProSendMode, isHelpSubcommand, parseAskProArgs, printHelpIfRequested, readFlag, readPortFlag, readPositionalsWithOptions, readNonNegativeIntegerFlag, readPositiveIntegerFlag, readRepeatedFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError, assertProjectName } from "./cli-args.js";
 import { printProBrowserHelp, printProHelp } from "./cli-help.js";
 import { listRawResultsForInspection, listTasksForInspection } from "./cli-ledger.js";
 import { formatBrowserDefaults, redactServerUrl } from "./cli-server.js";
@@ -19,6 +19,7 @@ import { readBridgeRoots } from "./registry.js";
 import { ProdexRequestIdSchema, SessionKeySchema } from "./schema.js";
 import { BridgeStore, MAX_FETCHABLE_RESULT_ARTIFACT_BYTES } from "./store.js";
 import { CLI_VERSION } from "./cli-help.js";
+import { assertRepoRelativePath, assertResolvedRepoPathAllowed } from "./repo.js";
 import { PRODEX_ISSUE_REPO, buildIssueReport, fileGitHubIssue } from "./issue-report.js";
 function resolveBrowserProfileDirForLaunch(profileDir, launchCwd = process.cwd()) {
     const resolved = path.resolve(launchCwd, profileDir);
@@ -1208,6 +1209,21 @@ export async function runAskProCommand(rest, io, beforeSend) {
         }
         return absolute;
     });
+    // An upload leaves the machine, so it gets the same guard as --file and
+    // repo_read_file: no .env, .git or key files, and no symlink out of the
+    // repo. --attach used to check only "inside the repo and exists", so both
+    // `--attach .env` and a link to ~/.ssh reached the upload (measured
+    // 2026-10-26); MCP attach takes this route too.
+    for (const [index, absolute] of attachments.entries()) {
+        const repoPath = path.relative(targetCwd, absolute).split(path.sep).join("/");
+        try {
+            assertRepoRelativePath(repoPath);
+            await assertResolvedRepoPathAllowed(targetCwd, absolute, repoPath);
+        }
+        catch (error) {
+            throw new Error(`--attach "${readRepeatedFlag(parsedAskPro.optionArgs, "--attach")[index]}" refused: ${errorMessage(error)}.`, { cause: error });
+        }
+    }
     if (attachments.length > 0 && !hasSendMode) {
         throw new Error("--attach only applies when sending (`prodex pro browser ask`); the dry-run preview cannot upload files.");
     }
@@ -1254,6 +1270,8 @@ export async function runAskProCommand(rest, io, beforeSend) {
     const sessionKey = resolveProdexSessionKey(readFlag(parsedAskPro.optionArgs, "--session-key"));
     const explicitProject = readFlag(parsedAskPro.optionArgs, "--project");
     const explicitProjectNew = readFlag(parsedAskPro.optionArgs, "--project-new");
+    assertProjectName("--project", explicitProject);
+    assertProjectName("--project-new", explicitProjectNew);
     // Opt out of a pinned default project for one send. Without this a repo
     // that pins a project has no route back to the plain chat list.
     const suppressProject = parsedAskPro.optionArgs.includes("--no-project");
@@ -3034,9 +3052,15 @@ export function readSinceFlag(args) {
     if (relative) {
         const amount = Number(relative[1]);
         const hours = relative[2]?.toLowerCase() === "d" ? amount * 24 : amount;
-        return new Date(Date.now() - hours * 3_600_000).toISOString();
+        const since = new Date(Date.now() - hours * 3_600_000);
+        if (!Number.isFinite(since.getTime())) {
+            throw new Error(`--since ${raw} reaches too far back to be a date; use an age like 365d or a date like 2026-01-01.`);
+        }
+        return since.toISOString();
     }
-    const parsed = Date.parse(raw);
+    // Only a calendar date: Date.parse also reads a bare "7" as 2001-07-01, so a
+    // forgotten unit silently widened the report to every consult ever recorded.
+    const parsed = /^\d{4}-\d{2}-\d{2}(?:[T ]|$)/.test(raw.trim()) ? Date.parse(raw) : Number.NaN;
     if (!Number.isFinite(parsed)) {
         throw new Error(`--since expects a date or an age like 7d or 24h, not "${raw}".`);
     }

package/dist/cli-server.js

@@ -1,10 +1,10 @@
-import { lstat, mkdir } from "node:fs/promises";
+import { lstat, readFile } from "node:fs/promises";
 import path from "node:path";
 import { parseProMode, parseReasoningEffort } from "./chatgpt-browser.js";
-import { ASK_PRO_SELECTION_CLEAR_FLAGS, ASK_PRO_SELECTION_DEFAULT_FLAGS, assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPortFlag, readPositiveNumberFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
+import { ASK_PRO_SELECTION_CLEAR_FLAGS, ASK_PRO_SELECTION_DEFAULT_FLAGS, assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPortFlag, readPositiveNumberFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError, assertProjectName } from "./cli-args.js";
 import { printInitHelp, printSetupHelp, printStartHelp, printStatusHelp, printTunnelHelp, printTunnelUrlHelp } from "./cli-help.js";
 import { errorMessage, isLoopbackHost, isMissingFileError, sourceAwareSetupMessage } from "./cli-shared.js";
-import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig, composeServerUrlWithToken } from "./config.js";
+import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig, composeServerUrlWithToken, lowercaseFirst } from "./config.js";
 import { startHttpMcpServer } from "./http-mcp.js";
 import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 import { BridgeStore } from "./store.js";
@@ -245,13 +245,21 @@ export const TOKEN_BEARING_MCP_URL_AUTHORITY_WARNING = "Token-bearing MCP URL au
 export function assertTokenNotExpiredForCommand(config, sourceCli, setupHintCwd) {
     const tokenStatus = getTokenExpiryStatus(config);
     if (tokenStatus.status === "expired") {
-        throw new Error(sourceAwareSetupMessage(tokenStatus.warning.toLowerCase(), sourceCli, { cwd: setupHintCwd }));
+        throw new Error(sourceAwareSetupMessage(lowercaseFirst(tokenStatus.warning), sourceCli, { cwd: setupHintCwd }));
     }
 }
+/**
+ * Root ignores for a prodex source checkout. `.bridge/.gitignore` is written by
+ * BridgeStore.ensure() from the one shared list; this used to overwrite it with
+ * an older list that lacked last-browser-send.
+ *
+ * node_modules/ and dist/ go into the ROOT .gitignore only when the target is
+ * prodex itself: added to any repo, they silently stopped tracking new build
+ * output in projects that commit dist/ (JavaScript GitHub Actions do).
+ */
 export async function ensureBridgeGitignore(cwd) {
-    const bridgeIgnorePath = path.join(cwd, ".bridge", ".gitignore");
-    await mkdir(path.dirname(bridgeIgnorePath), { recursive: true });
-    await writeVerifiedUtf8File(bridgeIgnorePath, ["tasks/*.json", "results/*.json", "sessions/*.json", "receipts/*.json", "artifacts/*", "config.local.json", "receipt-key.local", "!.gitignore", ""].join("\n"), () => assertGitignoreTargetSafe(bridgeIgnorePath), { create: true });
+    if (!(await isProdexSourceCheckout(cwd)))
+        return;
     const rootIgnorePath = path.join(cwd, ".gitignore");
     let current = "";
     try {
@@ -267,6 +275,15 @@ export async function ensureBridgeGitignore(cwd) {
         await writeVerifiedUtf8File(rootIgnorePath, `${current}${current && !current.endsWith("\n") ? "\n" : ""}${additions.join("\n")}\n`, () => assertGitignoreTargetSafe(rootIgnorePath), { create: true });
     }
 }
+async function isProdexSourceCheckout(cwd) {
+    try {
+        const manifest = JSON.parse(await readFile(path.join(cwd, "package.json"), "utf8"));
+        return manifest.name === "@youdie006/prodex";
+    }
+    catch {
+        return false;
+    }
+}
 export function formatBrowserDefaults(defaults) {
     const parts = [];
     if (defaults.model)
@@ -324,6 +341,7 @@ export function parseBrowserDefaultFlags(args) {
     const proModeRaw = readFlag(args, "--pro-mode");
     const effortRaw = readFlag(args, "--effort");
     const project = readFlag(args, "--project");
+    assertProjectName("--project", project);
     if (proModeRaw !== undefined && effortRaw !== undefined) {
         throw new Error("setup cannot combine --pro-mode and --effort; Pro sub-modes and reasoning effort are different model axes.");
     }

package/dist/config.js

@@ -280,10 +280,18 @@ export function getTokenExpiryStatus(config, now = new Date()) {
         }
         : { status: "valid", token_expires_at: config.token_expires_at };
 }
+/**
+ * "Token expired ..." reads as "failed token expired ..." after a status
+ * prefix. Only the first letter: lowercasing the whole message printed the
+ * expiry as "2026-10-26t00:00:00.000z", which is no longer an ISO time.
+ */
+export function lowercaseFirst(message) {
+    return message.charAt(0).toLowerCase() + message.slice(1);
+}
 export function assertTokenNotExpired(config, now = new Date()) {
     const status = getTokenExpiryStatus(config, now);
     if (status.status === "expired") {
-        throw new Error(status.warning.toLowerCase());
+        throw new Error(lowercaseFirst(status.warning));
     }
 }
 const MAX_TOKEN_EXPIRES_AT_MS = Date.parse("9999-12-31T23:59:59.999Z");

package/dist/http-mcp.js

@@ -13,7 +13,16 @@ export async function startHttpMcpServer(options) {
     const transports = new Map();
     const server = http.createServer(async (req, res) => {
         try {
-            const requestUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+            // Only the path and query are read, so the base is fixed: taking it from
+            // the Host header turned a malformed header into a 500.
+            let requestUrl;
+            try {
+                requestUrl = new URL(req.url ?? "/", "http://localhost");
+            }
+            catch {
+                writeJson(res, 400, { error: "bad_request" });
+                return;
+            }
             if (requestUrl.pathname === "/health") {
                 writeJson(res, 200, { ok: true, name: "prodex" });
                 return;
@@ -241,8 +250,9 @@ function isAuthorized(req, url, token, tokenExpiresAt) {
     const provided = url.searchParams.get("prodex_token");
     if (provided !== null && safeEqual(provided, token))
         return true;
-    const authorization = headerValue(req.headers.authorization);
-    return authorization !== undefined && safeEqual(authorization, `Bearer ${token}`);
+    // The scheme is case-insensitive (RFC 7235): "bearer <token>" is the same.
+    const bearer = /^bearer +(.+)$/i.exec(headerValue(req.headers.authorization) ?? "");
+    return bearer !== null && safeEqual(bearer[1], token);
 }
 function isExpired(tokenExpiresAt) {
     const expiresAtMs = Date.parse(tokenExpiresAt);

package/dist/registry.js

@@ -46,6 +46,24 @@ async function directoryExists(dir) {
         return false;
     }
 }
+/**
+ * Which directory a path names, independent of how it is spelled. realpath
+ * resolves symlinks but keeps the letter case it was given, so on a
+ * case-insensitive drive (WSL /mnt/d, macOS) /mnt/d/MyProject/x and
+ * /mnt/d/myproject/x are one directory under two names. Undefined when the
+ * path is not a directory, or the filesystem reports no inode to compare.
+ */
+async function directoryIdentity(dir) {
+    try {
+        const stat = await fs.stat(dir, { bigint: true });
+        if (!stat.isDirectory() || stat.ino === 0n)
+            return undefined;
+        return `${stat.dev}:${stat.ino}`;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Every bridge root this machine knows about. The registry has only ever been
  * written; reading it is what lets a report span the repos where the failures
@@ -67,14 +85,24 @@ export async function readBridgeRoots() {
     if (!Array.isArray(raw))
         return [];
     const roots = [];
+    const identities = new Set();
     for (const entry of raw.slice(0, MAX_REGISTRY_ROOTS)) {
         const value = typeof entry === "string" ? entry : entry?.path;
         if (typeof value !== "string" || value.length === 0)
             continue;
         if (!(await directoryExists(path.join(value, ".bridge"))))
             continue;
-        if (!roots.includes(value))
-            roots.push(value);
+        if (roots.includes(value))
+            continue;
+        // One bridge listed under two spellings was read twice: measured, a
+        // machine-wide `pro blockers` counted 1247 consults where 648 exist.
+        const identity = await directoryIdentity(value);
+        if (identity !== undefined) {
+            if (identities.has(identity))
+                continue;
+            identities.add(identity);
+        }
+        roots.push(value);
     }
     return roots;
 }
@@ -111,10 +139,15 @@ async function registerBridgeRootInner(root) {
             // A genuinely new root: opportunistically prune entries whose directory
             // is gone (cheap here since this path only runs on first registration,
             // not on every ensure()) and cap total growth, keeping the newest.
+            const identity = await directoryIdentity(abs);
             const survivors = [];
             for (const existing of roots) {
-                if (await directoryExists(existing))
-                    survivors.push(existing);
+                if (!(await directoryExists(existing)))
+                    continue;
+                // Already listed under another spelling (see directoryIdentity).
+                if (identity !== undefined && (await directoryIdentity(existing)) === identity)
+                    return;
+                survivors.push(existing);
             }
             survivors.push(abs);
             roots = survivors.length > MAX_REGISTRY_ROOTS ? survivors.slice(survivors.length - MAX_REGISTRY_ROOTS) : survivors;

package/dist/safe-file.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { constants } from "node:fs";
+import { constants, readFileSync } from "node:fs";
 import { chmod, link, lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 let testHooks = {};
 export function setSafeFileTestHooks(hooks) {
@@ -38,7 +39,7 @@ export async function withCrossProcessFileLock(filePath, options, fn) {
             continue;
         }
         retriedMissingAtDeadline = false;
-        const holderAlive = snapshot.holder.pid !== undefined && processIsAlive(snapshot.holder.pid);
+        const holderAlive = snapshot.holder.pid !== undefined && processIsAlive(snapshot.holder.pid) && !pidReusedSince(snapshot.holder);
         if (!holderAlive && (await reapFileLockSnapshot(filePath, snapshot, parentSnapshot)))
             continue;
         if (Date.now() >= deadline) {
@@ -589,6 +590,42 @@ function processIsAlive(pid) {
         return error.code === "EPERM";
     }
 }
+/**
+ * Whether the holder's pid now names a process that started after the lock was
+ * written, so the writer is gone. A send that dies with the machine, the WSL VM
+ * or its container leaves the lock behind, and after a restart pids are handed
+ * out again: measured, a 2020 lock naming pid 1 held off every send for its
+ * whole wait budget because pid 1 was alive - as a different process.
+ */
+function pidReusedSince(holder) {
+    const writtenAt = Date.parse(holder.started_at ?? "");
+    if (holder.pid === undefined || !Number.isFinite(writtenAt))
+        return false;
+    const processStartedAt = linuxProcessStartMs(holder.pid);
+    // A holder writes the lock after it starts; a few seconds absorb clock steps.
+    if (processStartedAt !== undefined)
+        return processStartedAt > writtenAt + 5_000;
+    // No per-process start time here: nothing alive now predates the boot.
+    return writtenAt < Date.now() - os.uptime() * 1000 - 60_000;
+}
+function linuxProcessStartMs(pid) {
+    if (process.platform !== "linux")
+        return undefined;
+    try {
+        const btime = /^btime (\d+)$/m.exec(readFileSync("/proc/stat", "utf8"))?.[1];
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        // Field 22 (starttime, in clock ticks since boot) counted after the
+        // parenthesised command name, which may itself contain spaces.
+        const ticks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
+        if (!btime || !Number.isFinite(ticks))
+            return undefined;
+        // USER_HZ is 100 on every Linux ABI Node supports.
+        return Number(btime) * 1000 + ticks * 10;
+    }
+    catch {
+        return undefined;
+    }
+}
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/dist/store.js

@@ -233,6 +233,7 @@ export class BridgeStore {
     async completeTask(taskId, input) {
         const task = await this.getTask(taskId);
         assertFetchableResultArtifacts(input.artifacts ?? []);
+        assertDistinctArtifactPaths(input.artifacts ?? []);
         const retryResult = ResultSchema.parse({
             schema_version: SCHEMA_VERSION,
             task_id: taskId,
@@ -834,7 +835,7 @@ export class BridgeStore {
     }
     async ensureReceiptIntegrityKey() {
         try {
-            const [activeKey] = await this.readReceiptIntegrityKeys();
+            const [activeKey] = await this.readReceiptIntegrityKeysAfterCreate();
             return activeKey;
         }
         catch (error) {
@@ -857,10 +858,27 @@ export class BridgeStore {
         catch (error) {
             if (!isErrorCode(error, "EEXIST"))
                 throw error;
-            const [activeKey] = await this.readReceiptIntegrityKeys();
+            const [activeKey] = await this.readReceiptIntegrityKeysAfterCreate();
             return activeKey;
         }
     }
+    // The key is created exclusively and THEN written, so another store opening
+    // the same fresh repo can read it in between and find it empty. Measured on
+    // CI: that read was reported as "receipt-key.local is corrupt. Move it
+    // aside", advice that would discard a good key. An empty file is a write in
+    // progress for a short while; only after that is it corrupt.
+    async readReceiptIntegrityKeysAfterCreate() {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                return await this.readReceiptIntegrityKeys();
+            }
+            catch (error) {
+                if (!(error instanceof ReceiptKeyFileEmptyError) || attempt >= 40)
+                    throw error;
+                await new Promise((resolve) => setTimeout(resolve, 50));
+            }
+        }
+    }
     // The key file holds one 32-byte hex key per line: the first line signs new
     // receipts, later lines are legacy keys kept so pre-rotation receipts verify.
     async readReceiptIntegrityKeys() {
@@ -870,7 +888,9 @@ export class BridgeStore {
             .split(/\r?\n/)
             .map((line) => line.trim())
             .filter((line) => line.length > 0);
-        if (lines.length === 0 || !lines.every((line) => /^[a-f0-9]{64}$/.test(line))) {
+        if (lines.length === 0)
+            throw new ReceiptKeyFileEmptyError();
+        if (!lines.every((line) => /^[a-f0-9]{64}$/.test(line))) {
             throw new Error(".bridge/receipt-key.local is corrupt. Move it aside and recreate write receipts.");
         }
         return lines;
@@ -1462,6 +1482,23 @@ function assertFetchableResultArtifacts(artifacts) {
         }
     }
 }
+// Two entries for one file record one content under two names: the file holds
+// whichever was written last, and a reader asking for "the" result artifact is
+// told there are several.
+function assertDistinctArtifactPaths(artifacts) {
+    const seen = new Set();
+    for (const artifact of artifacts) {
+        if (seen.has(artifact.path)) {
+            throw new Error(`Artifact ${artifact.path} is listed more than once; list each artifact once.`);
+        }
+        seen.add(artifact.path);
+    }
+}
+class ReceiptKeyFileEmptyError extends Error {
+    constructor() {
+        super(".bridge/receipt-key.local is corrupt. Move it aside and recreate write receipts.");
+    }
+}
 function parseTaskRecord(expectedId, value) {
     const task = TaskSchema.parse(value);
     assertMatchingRecordIdentity("task", expectedId, task.id);

package/docs/releasing.md

@@ -35,6 +35,53 @@ The release adds a guarded, opt-in transition and more accurate blocker reportin
 **Open**
 - A long-running headless browser ends up behind Cloudflare's check (also noted on WSL, where the Xvfb display is used instead). On macOS there is no virtual display, and a minimized window counts as hidden, so the remaining no-headless option there is a window kept behind others. Changing the headless preference is a design decision that was not made here.
 
+## 0.40.42 Release Record
+
+Release commit `9c97a14` on `main` (cut after PR #48, merge `cc129d8`); tag `v0.40.42`. Released on its own: before it, `--attach` and MCP `attach` uploaded `.env`, `.git` contents, key files and outward symlinks.
+
+**Publishing**
+- `publish.yml` run 40284687723 passed all six platforms, then npm publish with SLSA v1 provenance and the GitHub Release (2026-10-26 07:15 UTC start). The GitHub Release lists the one entry from `CHANGELOG.md`.
+- `npm run release:verify` passed on the release commit after a build.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.42. Running services were not restarted: no host stdio MCP servers on WSL, 1 on M3, none on the Mac mini.
+- The maintainer watchdog checkout was pulled to `9c97a14` and rebuilt.
+
+**Verified live on installed 0.40.42 (WSL, scratch repo)**
+- `--attach .env` refused: "Path .env is sensitive and cannot be read through repo tools".
+- `--attach link.pdf` (symlink to a file outside the repo) refused: "escapes the repository root after resolving symlinks".
+- `--attach note.txt` still uploads; ChatGPT answered with the code word from the file, `request_verified: yes`.
+
+**Browser container**
+- `container/redesign-patches` `41c34de` ports PR #48. Branch suite: 2081 passed, 3 skipped; `release:verify` ok.
+- WSL image `491971a34a26` and M3 image `59747258b693`, each swapped after an idle send-lock check; in both, `--attach .env.probe` is refused and smoke returned `requestVerified: true`.
+
+## 0.40.41 Release Record
+
+Release commit `e0ea707` on `main` (cut after PRs #45-#47, last merge `6911f3e`); tag `v0.40.41`. Released ahead of the usual batch for PR #46, which withheld answers from requests that had posted.
+
+**Publishing**
+- `publish.yml` run 40274938156 passed all six platforms, then npm publish with SLSA v1 provenance and the GitHub Release (2026-10-26 05:34 UTC start).
+- `npm run release:verify` passed on the release commit after a build. The release script now refuses to tag when the release section has duplicate lines or an `## Unreleased` section survives the rename; the GitHub Release lists the same three entries as `CHANGELOG.md`.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.41. Running services were not restarted: no host stdio MCP servers on WSL and 1 on M3; the Mac mini had none.
+- The maintainer watchdog checkout was pulled to `e0ea707` and rebuilt.
+
+**Verified live on installed 0.40.41 (WSL)**
+- `Reply with only OK. Run npm test first, then \`npm test\` again.`: `request_verified: yes` (0.40.40 refused it as `request_mismatch`). Before the fix, the 2026-10-24 thread whose two sends had been refused also matched when re-read with the fixed extraction.
+- `--model Instant` in a repo with a saved Pro effort: applied to the slider with `model_is_now_an_effort`, answered in 9 s.
+- `pro browser recover --target-url "https://chatgpt.com/c/abc def"`: refused before the send lock; the shared tab did not move.
+
+**Browser container**
+- `container/redesign-patches` `60a49da` ports #45, `5154330` ports #46 (applied by hand: the container's message helpers differ from `main`), `6a9ea08` ports #47. Branch suite at `6a9ea08`: 2080 passed, 3 skipped; `release:verify` ok.
+- WSL images `1ce5bcde0ace` (#45, `--model Instant` applied live), `88bd2a8f427a` (#46, the backtick repro verified), `e83a90389d02` (#47, bad URL refused, smoke `requestVerified: true`).
+- M3 (colima `prodex-check`) images `c289e00e756d`, `ee6f98e1588d` (backtick repro verified), `5cd5a5642917` (bad URL refused, smoke ok). Every swap waited for an idle send lock.
+
+**Incidents**
+- 2026-10-22: the WSL disk filled to 100% from another project's session scratch data, so command output stopped being written mid-port. Nothing in prodex was involved; the #45 container port resumed after that session's data was cleaned up on its side.
+- 2026-10-26: probing recovery input with `--target-url "https://chatgpt.com/c/abc def"` on 0.40.40 moved the shared ChatGPT tab to that URL (the bug PR #47 fixes); no send was in flight and the tab was moved back to the home page.
+
 ## 0.40.40 Release Record
 
 Release commit `3d671f5` on `main` (cut after PRs #38-#44, last merge `5609f4c`); tag `v0.40.40`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.40.41",
+  "version": "0.40.43",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",