@youdie006/prodex 0.40.42 → 0.40.44

package/dist/bridge-gitignore.js

@@ -2,7 +2,7 @@ import { lstat } from "node:fs/promises";
 import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 const required = [
     "tasks/*.json", "results/*.json", "sessions/*.json", "receipts/*.json",
-    "artifacts/*", "config.local.json", "receipt-key.local", "last-browser-send", "!.gitignore"
+    "artifacts/*", "diagnostics/", "config.local.json", "receipt-key.local", "last-browser-send", "!.gitignore"
 ];
 export async function ensureBridgeGitignore(filePath, validate) {
     let current = "";

package/dist/cli-args.js

@@ -404,3 +404,13 @@ export function printHelpIfRequested(args, command, stdout, printHelp, options =
     printHelp(stdout);
     return true;
 }
+/**
+ * A project is found and created by its name, so a name that is only spaces
+ * names nothing: it used to reach the browser, where --project-new typed it
+ * into ChatGPT's new-project dialog.
+ */
+export function assertProjectName(flag, value) {
+    if (value !== undefined && !value.trim()) {
+        throw new Error(`${flag} is blank; give the ChatGPT project name, or leave the option out.`);
+    }
+}

package/dist/cli-ledger.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPositionalsWithOptions, readReceiptKindFlag, readRepeatedFlag, readSessionStatusFlag, readTaskStatusFlag, resolveCwdFlag, unknownSubcommandError } from "./cli-args.js";
 import { printReceiptsHelp, printResultsHelp, printSessionsHelp, printTasksHelp } from "./cli-help.js";
 import { sourceAwareResultError } from "./cli-shared.js";
@@ -355,7 +356,8 @@ export function receiptInspectionListSuffix(receipt) {
     return "";
 }
 export async function writeTaskCompleteArtifacts(store, values) {
-    const artifacts = [];
+    const parsed = [];
+    const seen = new Set();
     for (const value of values) {
         const separator = value.indexOf("=");
         if (separator <= 0) {
@@ -366,6 +368,17 @@ export async function writeTaskCompleteArtifacts(store, values) {
         if (!artifactPath.trim()) {
             throw new Error("tasks complete --artifact requires path=text");
         }
+        // Checked before anything is written: a repeated path used to overwrite
+        // the earlier text silently and be recorded twice.
+        const key = path.posix.normalize(artifactPath.replaceAll("\\", "/"));
+        if (seen.has(key)) {
+            throw new Error(`tasks complete --artifact ${artifactPath} names a file more than once; pass each artifact path once.`);
+        }
+        seen.add(key);
+        parsed.push({ artifactPath, content });
+    }
+    const artifacts = [];
+    for (const { artifactPath, content } of parsed) {
         const storedPath = await store.writeArtifactText(artifactPath, content);
         artifacts.push({ path: storedPath, role: "result" });
     }

package/dist/cli-pro.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { BrowserProcessInspectionError } from "./browser-process.js";
 import { buildDryRunBundle } from "./bundle.js";
 import { ChatGptBrowserBlockerError, DEFAULT_CDP_PORT, resolveCdpPort, resolveConversationToDelete, resolveProjectToDelete, chatGptVisibilityBlocker, defaultChatGptProfileDir, formatDurationMs, getChatGptBrowserStatus, formatModelMenuOption, listChatGptModelOptions, deleteChatGptConversation, endWedgedBrowser, browserRecoveryPlan, findWedgedBrowser, wedgedBrowserBlocker, deleteChatGptProject, listChatGptProjectsWithIds, listRecentChatGptConversations, listChatGptSidebarProjects, normalizeChatGptTargetUrl, openChatGptBrowser, openChatGptTab, parseProMode, parseReasoningEffort, defaultTimeoutForTools, ensureVirtualDisplay, minimizeChatGptWindow, readLastBrowserLoginLaunch, resolveBrowserWindowMode, recordBrowserLoginLaunch, recoverChatGptAnswerFromThread, sendChatGptPrompt, statusMeansBrowserDead, namesPro, sendWarningsFromError, destinationVerification, chatGptProjectIdFromUrl, chatStepNamedAsModel, normalizeChatGptThreadUrl } from "./chatgpt-browser.js";
-import { ASK_PRO_BOOLEAN_FLAGS, ASK_PRO_PREVIEW_VALUE_FLAGS, ASK_PRO_VALUE_FLAGS, assertHelpRequestArgs, assertNoExtraArgs, assertOnlyOptions, findHelpFlagIndexBeforePromptDelimiter, formatCliCommand, hasAskProDryRunMode, hasAskProMode, hasAskProSendMode, isHelpSubcommand, parseAskProArgs, printHelpIfRequested, readFlag, readPortFlag, readPositionalsWithOptions, readNonNegativeIntegerFlag, readPositiveIntegerFlag, readRepeatedFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
+import { ASK_PRO_BOOLEAN_FLAGS, ASK_PRO_PREVIEW_VALUE_FLAGS, ASK_PRO_VALUE_FLAGS, assertHelpRequestArgs, assertNoExtraArgs, assertOnlyOptions, findHelpFlagIndexBeforePromptDelimiter, formatCliCommand, hasAskProDryRunMode, hasAskProMode, hasAskProSendMode, isHelpSubcommand, parseAskProArgs, printHelpIfRequested, readFlag, readPortFlag, readPositionalsWithOptions, readNonNegativeIntegerFlag, readPositiveIntegerFlag, readRepeatedFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError, assertProjectName } from "./cli-args.js";
 import { printProBrowserHelp, printProHelp } from "./cli-help.js";
 import { listRawResultsForInspection, listTasksForInspection } from "./cli-ledger.js";
 import { formatBrowserDefaults, redactServerUrl } from "./cli-server.js";
@@ -1270,6 +1270,8 @@ export async function runAskProCommand(rest, io, beforeSend) {
     const sessionKey = resolveProdexSessionKey(readFlag(parsedAskPro.optionArgs, "--session-key"));
     const explicitProject = readFlag(parsedAskPro.optionArgs, "--project");
     const explicitProjectNew = readFlag(parsedAskPro.optionArgs, "--project-new");
+    assertProjectName("--project", explicitProject);
+    assertProjectName("--project-new", explicitProjectNew);
     // Opt out of a pinned default project for one send. Without this a repo
     // that pins a project has no route back to the plain chat list.
     const suppressProject = parsedAskPro.optionArgs.includes("--no-project");
@@ -3050,9 +3052,15 @@ export function readSinceFlag(args) {
     if (relative) {
         const amount = Number(relative[1]);
         const hours = relative[2]?.toLowerCase() === "d" ? amount * 24 : amount;
-        return new Date(Date.now() - hours * 3_600_000).toISOString();
+        const since = new Date(Date.now() - hours * 3_600_000);
+        if (!Number.isFinite(since.getTime())) {
+            throw new Error(`--since ${raw} reaches too far back to be a date; use an age like 365d or a date like 2026-01-01.`);
+        }
+        return since.toISOString();
     }
-    const parsed = Date.parse(raw);
+    // Only a calendar date: Date.parse also reads a bare "7" as 2001-07-01, so a
+    // forgotten unit silently widened the report to every consult ever recorded.
+    const parsed = /^\d{4}-\d{2}-\d{2}(?:[T ]|$)/.test(raw.trim()) ? Date.parse(raw) : Number.NaN;
     if (!Number.isFinite(parsed)) {
         throw new Error(`--since expects a date or an age like 7d or 24h, not "${raw}".`);
     }

package/dist/cli-server.js

@@ -1,10 +1,10 @@
-import { lstat, mkdir } from "node:fs/promises";
+import { lstat, readFile } from "node:fs/promises";
 import path from "node:path";
 import { parseProMode, parseReasoningEffort } from "./chatgpt-browser.js";
-import { ASK_PRO_SELECTION_CLEAR_FLAGS, ASK_PRO_SELECTION_DEFAULT_FLAGS, assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPortFlag, readPositiveNumberFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
+import { ASK_PRO_SELECTION_CLEAR_FLAGS, ASK_PRO_SELECTION_DEFAULT_FLAGS, assertNoExtraArgs, assertOnlyOptions, isHelpSubcommand, printHelpIfRequested, readFlag, readPortFlag, readPositiveNumberFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError, assertProjectName } from "./cli-args.js";
 import { printInitHelp, printSetupHelp, printStartHelp, printStatusHelp, printTunnelHelp, printTunnelUrlHelp } from "./cli-help.js";
 import { errorMessage, isLoopbackHost, isMissingFileError, sourceAwareSetupMessage } from "./cli-shared.js";
-import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig, composeServerUrlWithToken } from "./config.js";
+import { getTokenExpiryStatus, loadLocalConfig, writeLocalConfig, composeServerUrlWithToken, lowercaseFirst } from "./config.js";
 import { startHttpMcpServer } from "./http-mcp.js";
 import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 import { BridgeStore } from "./store.js";
@@ -245,13 +245,21 @@ export const TOKEN_BEARING_MCP_URL_AUTHORITY_WARNING = "Token-bearing MCP URL au
 export function assertTokenNotExpiredForCommand(config, sourceCli, setupHintCwd) {
     const tokenStatus = getTokenExpiryStatus(config);
     if (tokenStatus.status === "expired") {
-        throw new Error(sourceAwareSetupMessage(tokenStatus.warning.toLowerCase(), sourceCli, { cwd: setupHintCwd }));
+        throw new Error(sourceAwareSetupMessage(lowercaseFirst(tokenStatus.warning), sourceCli, { cwd: setupHintCwd }));
     }
 }
+/**
+ * Root ignores for a prodex source checkout. `.bridge/.gitignore` is written by
+ * BridgeStore.ensure() from the one shared list; this used to overwrite it with
+ * an older list that lacked last-browser-send.
+ *
+ * node_modules/ and dist/ go into the ROOT .gitignore only when the target is
+ * prodex itself: added to any repo, they silently stopped tracking new build
+ * output in projects that commit dist/ (JavaScript GitHub Actions do).
+ */
 export async function ensureBridgeGitignore(cwd) {
-    const bridgeIgnorePath = path.join(cwd, ".bridge", ".gitignore");
-    await mkdir(path.dirname(bridgeIgnorePath), { recursive: true });
-    await writeVerifiedUtf8File(bridgeIgnorePath, ["tasks/*.json", "results/*.json", "sessions/*.json", "receipts/*.json", "artifacts/*", "config.local.json", "receipt-key.local", "!.gitignore", ""].join("\n"), () => assertGitignoreTargetSafe(bridgeIgnorePath), { create: true });
+    if (!(await isProdexSourceCheckout(cwd)))
+        return;
     const rootIgnorePath = path.join(cwd, ".gitignore");
     let current = "";
     try {
@@ -267,6 +275,15 @@ export async function ensureBridgeGitignore(cwd) {
         await writeVerifiedUtf8File(rootIgnorePath, `${current}${current && !current.endsWith("\n") ? "\n" : ""}${additions.join("\n")}\n`, () => assertGitignoreTargetSafe(rootIgnorePath), { create: true });
     }
 }
+async function isProdexSourceCheckout(cwd) {
+    try {
+        const manifest = JSON.parse(await readFile(path.join(cwd, "package.json"), "utf8"));
+        return manifest.name === "@youdie006/prodex";
+    }
+    catch {
+        return false;
+    }
+}
 export function formatBrowserDefaults(defaults) {
     const parts = [];
     if (defaults.model)
@@ -324,6 +341,7 @@ export function parseBrowserDefaultFlags(args) {
     const proModeRaw = readFlag(args, "--pro-mode");
     const effortRaw = readFlag(args, "--effort");
     const project = readFlag(args, "--project");
+    assertProjectName("--project", project);
     if (proModeRaw !== undefined && effortRaw !== undefined) {
         throw new Error("setup cannot combine --pro-mode and --effort; Pro sub-modes and reasoning effort are different model axes.");
     }

package/dist/config.js

@@ -280,10 +280,18 @@ export function getTokenExpiryStatus(config, now = new Date()) {
         }
         : { status: "valid", token_expires_at: config.token_expires_at };
 }
+/**
+ * "Token expired ..." reads as "failed token expired ..." after a status
+ * prefix. Only the first letter: lowercasing the whole message printed the
+ * expiry as "2026-10-26t00:00:00.000z", which is no longer an ISO time.
+ */
+export function lowercaseFirst(message) {
+    return message.charAt(0).toLowerCase() + message.slice(1);
+}
 export function assertTokenNotExpired(config, now = new Date()) {
     const status = getTokenExpiryStatus(config, now);
     if (status.status === "expired") {
-        throw new Error(status.warning.toLowerCase());
+        throw new Error(lowercaseFirst(status.warning));
     }
 }
 const MAX_TOKEN_EXPIRES_AT_MS = Date.parse("9999-12-31T23:59:59.999Z");

package/dist/http-mcp.js

@@ -13,7 +13,16 @@ export async function startHttpMcpServer(options) {
     const transports = new Map();
     const server = http.createServer(async (req, res) => {
         try {
-            const requestUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+            // Only the path and query are read, so the base is fixed: taking it from
+            // the Host header turned a malformed header into a 500.
+            let requestUrl;
+            try {
+                requestUrl = new URL(req.url ?? "/", "http://localhost");
+            }
+            catch {
+                writeJson(res, 400, { error: "bad_request" });
+                return;
+            }
             if (requestUrl.pathname === "/health") {
                 writeJson(res, 200, { ok: true, name: "prodex" });
                 return;
@@ -241,8 +250,9 @@ function isAuthorized(req, url, token, tokenExpiresAt) {
     const provided = url.searchParams.get("prodex_token");
     if (provided !== null && safeEqual(provided, token))
         return true;
-    const authorization = headerValue(req.headers.authorization);
-    return authorization !== undefined && safeEqual(authorization, `Bearer ${token}`);
+    // The scheme is case-insensitive (RFC 7235): "bearer <token>" is the same.
+    const bearer = /^bearer +(.+)$/i.exec(headerValue(req.headers.authorization) ?? "");
+    return bearer !== null && safeEqual(bearer[1], token);
 }
 function isExpired(tokenExpiresAt) {
     const expiresAtMs = Date.parse(tokenExpiresAt);

package/dist/registry.js

@@ -46,6 +46,24 @@ async function directoryExists(dir) {
         return false;
     }
 }
+/**
+ * Which directory a path names, independent of how it is spelled. realpath
+ * resolves symlinks but keeps the letter case it was given, so on a
+ * case-insensitive drive (WSL /mnt/d, macOS) /mnt/d/MyProject/x and
+ * /mnt/d/myproject/x are one directory under two names. Undefined when the
+ * path is not a directory, or the filesystem reports no inode to compare.
+ */
+async function directoryIdentity(dir) {
+    try {
+        const stat = await fs.stat(dir, { bigint: true });
+        if (!stat.isDirectory() || stat.ino === 0n)
+            return undefined;
+        return `${stat.dev}:${stat.ino}`;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Every bridge root this machine knows about. The registry has only ever been
  * written; reading it is what lets a report span the repos where the failures
@@ -67,14 +85,24 @@ export async function readBridgeRoots() {
     if (!Array.isArray(raw))
         return [];
     const roots = [];
+    const identities = new Set();
     for (const entry of raw.slice(0, MAX_REGISTRY_ROOTS)) {
         const value = typeof entry === "string" ? entry : entry?.path;
         if (typeof value !== "string" || value.length === 0)
             continue;
         if (!(await directoryExists(path.join(value, ".bridge"))))
             continue;
-        if (!roots.includes(value))
-            roots.push(value);
+        if (roots.includes(value))
+            continue;
+        // One bridge listed under two spellings was read twice: measured, a
+        // machine-wide `pro blockers` counted 1247 consults where 648 exist.
+        const identity = await directoryIdentity(value);
+        if (identity !== undefined) {
+            if (identities.has(identity))
+                continue;
+            identities.add(identity);
+        }
+        roots.push(value);
     }
     return roots;
 }
@@ -111,10 +139,15 @@ async function registerBridgeRootInner(root) {
             // A genuinely new root: opportunistically prune entries whose directory
             // is gone (cheap here since this path only runs on first registration,
             // not on every ensure()) and cap total growth, keeping the newest.
+            const identity = await directoryIdentity(abs);
             const survivors = [];
             for (const existing of roots) {
-                if (await directoryExists(existing))
-                    survivors.push(existing);
+                if (!(await directoryExists(existing)))
+                    continue;
+                // Already listed under another spelling (see directoryIdentity).
+                if (identity !== undefined && (await directoryIdentity(existing)) === identity)
+                    return;
+                survivors.push(existing);
             }
             survivors.push(abs);
             roots = survivors.length > MAX_REGISTRY_ROOTS ? survivors.slice(survivors.length - MAX_REGISTRY_ROOTS) : survivors;

package/dist/safe-file.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { constants } from "node:fs";
+import { constants, readFileSync } from "node:fs";
 import { chmod, link, lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 let testHooks = {};
 export function setSafeFileTestHooks(hooks) {
@@ -38,7 +39,7 @@ export async function withCrossProcessFileLock(filePath, options, fn) {
             continue;
         }
         retriedMissingAtDeadline = false;
-        const holderAlive = snapshot.holder.pid !== undefined && processIsAlive(snapshot.holder.pid);
+        const holderAlive = snapshot.holder.pid !== undefined && processIsAlive(snapshot.holder.pid) && !pidReusedSince(snapshot.holder);
         if (!holderAlive && (await reapFileLockSnapshot(filePath, snapshot, parentSnapshot)))
             continue;
         if (Date.now() >= deadline) {
@@ -419,6 +420,9 @@ async function tryAcquireFileLock(filePath, parentSnapshot) {
         nonce: randomUUID(),
         started_at: new Date().toISOString()
     };
+    const pidStart = linuxProcessStartTicks(process.pid);
+    if (pidStart !== undefined)
+        owner.pid_start = pidStart;
     const tokenPath = fileLockTokenPath(filePath, owner);
     const handle = await openStableNoFollow(tokenPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, "write", parentSnapshot, 0o600);
     try {
@@ -487,7 +491,8 @@ function parseFileLockHolder(content) {
         return {
             pid: Number.isSafeInteger(parsed.pid) && Number(parsed.pid) > 0 ? Number(parsed.pid) : undefined,
             nonce: typeof parsed.nonce === "string" && /^[A-Za-z0-9-]{1,128}$/.test(parsed.nonce) ? parsed.nonce : undefined,
-            started_at: typeof parsed.started_at === "string" ? parsed.started_at : undefined
+            started_at: typeof parsed.started_at === "string" ? parsed.started_at : undefined,
+            pid_start: typeof parsed.pid_start === "string" && /^\d{1,20}$/.test(parsed.pid_start) ? parsed.pid_start : undefined
         };
     }
     catch {
@@ -497,7 +502,12 @@ function parseFileLockHolder(content) {
 function parseFileLockOwner(holder) {
     if (holder.pid === undefined || holder.nonce === undefined)
         return undefined;
-    return { pid: holder.pid, nonce: holder.nonce, started_at: holder.started_at };
+    return {
+        pid: holder.pid,
+        nonce: holder.nonce,
+        started_at: holder.started_at,
+        ...(holder.pid_start !== undefined ? { pid_start: holder.pid_start } : {})
+    };
 }
 async function releaseFileLockLease(filePath, lease, parentSnapshot) {
     try {
@@ -589,6 +599,48 @@ function processIsAlive(pid) {
         return error.code === "EPERM";
     }
 }
+/**
+ * Whether the holder's pid now names a different process than the one that
+ * wrote the lock, so the writer is gone. A send that dies with the machine,
+ * the WSL VM or its container leaves the lock behind, and after a restart pids
+ * are handed out again: measured, a 2020 lock naming pid 1 held off every send
+ * for its whole wait budget because pid 1 was alive - as a different process.
+ *
+ * The lock records its writer's start time in clock ticks since boot, and that
+ * is compared with the pid's start ticks now: boot clock against boot clock.
+ * 0.40.43 converted the start to wall time through /proc/stat btime instead,
+ * and on WSL2 btime moves (measured 30 minutes over one day: the VM's boot
+ * clock stops while the host sleeps, then the wall clock is resynced), so a
+ * live holder looked newer than its own lock and its lock was reaped mid-send.
+ */
+function pidReusedSince(holder) {
+    if (holder.pid === undefined)
+        return false;
+    if (holder.pid_start !== undefined) {
+        const current = linuxProcessStartTicks(holder.pid);
+        return current !== undefined && current !== holder.pid_start;
+    }
+    // A lock from a prodex that did not record start ticks: the only safe call is
+    // that nothing alive now was running before the last boot.
+    const writtenAt = Date.parse(holder.started_at ?? "");
+    if (!Number.isFinite(writtenAt))
+        return false;
+    return writtenAt < Date.now() - os.uptime() * 1000 - 60_000;
+}
+function linuxProcessStartTicks(pid) {
+    if (process.platform !== "linux")
+        return undefined;
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        // Field 22 (starttime) counted after the parenthesised command name, which
+        // may itself contain spaces.
+        const ticks = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+        return ticks !== undefined && /^\d+$/.test(ticks) ? ticks : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/dist/store.js

@@ -233,6 +233,7 @@ export class BridgeStore {
     async completeTask(taskId, input) {
         const task = await this.getTask(taskId);
         assertFetchableResultArtifacts(input.artifacts ?? []);
+        assertDistinctArtifactPaths(input.artifacts ?? []);
         const retryResult = ResultSchema.parse({
             schema_version: SCHEMA_VERSION,
             task_id: taskId,
@@ -834,7 +835,7 @@ export class BridgeStore {
     }
     async ensureReceiptIntegrityKey() {
         try {
-            const [activeKey] = await this.readReceiptIntegrityKeys();
+            const [activeKey] = await this.readReceiptIntegrityKeysAfterCreate();
             return activeKey;
         }
         catch (error) {
@@ -857,10 +858,27 @@ export class BridgeStore {
         catch (error) {
             if (!isErrorCode(error, "EEXIST"))
                 throw error;
-            const [activeKey] = await this.readReceiptIntegrityKeys();
+            const [activeKey] = await this.readReceiptIntegrityKeysAfterCreate();
             return activeKey;
         }
     }
+    // The key is created exclusively and THEN written, so another store opening
+    // the same fresh repo can read it in between and find it empty. Measured on
+    // CI: that read was reported as "receipt-key.local is corrupt. Move it
+    // aside", advice that would discard a good key. An empty file is a write in
+    // progress for a short while; only after that is it corrupt.
+    async readReceiptIntegrityKeysAfterCreate() {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                return await this.readReceiptIntegrityKeys();
+            }
+            catch (error) {
+                if (!(error instanceof ReceiptKeyFileEmptyError) || attempt >= 40)
+                    throw error;
+                await new Promise((resolve) => setTimeout(resolve, 50));
+            }
+        }
+    }
     // The key file holds one 32-byte hex key per line: the first line signs new
     // receipts, later lines are legacy keys kept so pre-rotation receipts verify.
     async readReceiptIntegrityKeys() {
@@ -870,7 +888,9 @@ export class BridgeStore {
             .split(/\r?\n/)
             .map((line) => line.trim())
             .filter((line) => line.length > 0);
-        if (lines.length === 0 || !lines.every((line) => /^[a-f0-9]{64}$/.test(line))) {
+        if (lines.length === 0)
+            throw new ReceiptKeyFileEmptyError();
+        if (!lines.every((line) => /^[a-f0-9]{64}$/.test(line))) {
             throw new Error(".bridge/receipt-key.local is corrupt. Move it aside and recreate write receipts.");
         }
         return lines;
@@ -1462,6 +1482,23 @@ function assertFetchableResultArtifacts(artifacts) {
         }
     }
 }
+// Two entries for one file record one content under two names: the file holds
+// whichever was written last, and a reader asking for "the" result artifact is
+// told there are several.
+function assertDistinctArtifactPaths(artifacts) {
+    const seen = new Set();
+    for (const artifact of artifacts) {
+        if (seen.has(artifact.path)) {
+            throw new Error(`Artifact ${artifact.path} is listed more than once; list each artifact once.`);
+        }
+        seen.add(artifact.path);
+    }
+}
+class ReceiptKeyFileEmptyError extends Error {
+    constructor() {
+        super(".bridge/receipt-key.local is corrupt. Move it aside and recreate write receipts.");
+    }
+}
 function parseTaskRecord(expectedId, value) {
     const task = TaskSchema.parse(value);
     assertMatchingRecordIdentity("task", expectedId, task.id);

package/dist/tui.js

@@ -63,10 +63,15 @@ export function consultArgsFromChoices(choices) {
  */
 export function parseAttachmentLine(line) {
     const out = [];
-    const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    // An unquoted word may carry backslash escapes: dropping a file onto a macOS
+    // terminal types `My\ File.pdf`, which used to split into two paths that do
+    // not exist. Only a space or shell punctuation counts as escaped, so a
+    // Windows separator (a backslash before a letter or another backslash) stays.
+    const pattern = /"([^"]*)"|'([^']*)'|((?:\\[ ()\[\]{}'"&;!$`*?#~<>|]|\S)+)/g;
     let match;
     while ((match = pattern.exec(line)) !== null) {
-        const value = (match[1] ?? match[2] ?? match[3] ?? "").trim();
+        const unquoted = match[3]?.replace(/\\([ ()\[\]{}'"&;!$`*?#~<>|])/g, "$1");
+        const value = (match[1] ?? match[2] ?? unquoted ?? "").trim();
         if (value.length > 0)
             out.push(value);
     }

package/docs/releasing.md

@@ -35,6 +35,49 @@ The release adds a guarded, opt-in transition and more accurate blocker reportin
 **Open**
 - A long-running headless browser ends up behind Cloudflare's check (also noted on WSL, where the Xvfb display is used instead). On macOS there is no virtual display, and a minimized window counts as hidden, so the remaining no-headless option there is a window kept behind others. Changing the headless preference is a design decision that was not made here.
 
+## 0.40.43 Release Record
+
+Release commit `834e3e2` on `main` (cut after PRs #49-#58, last merge `a6bbf85`); tag `v0.40.43`. Ten fixes, including two that block or corrupt work: a send lock left by a dead send whose pid was reused blocked every later send (#54), and two processes opening a fresh repo could fail one with a false "receipt-key.local is corrupt" (#58).
+
+**Publishing**
+- `publish.yml` run 40451563636 first failed on macOS 15 Intel only: `tests/cli.test.ts` "uses an explicit --cwd target for local HTTP MCP start" timed out at 90 s; the same commit passed on the five other platforms and in PR CI. The failed job was rerun and passed, then npm publish with SLSA v1 provenance and the GitHub Release ran. The GitHub Release lists the ten entries from `CHANGELOG.md`.
+- `npm run release:verify` passed on the release commit after a build.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.43. Running services were not restarted: no host stdio MCP servers on WSL, 1 on M3, none on the Mac mini.
+- The maintainer watchdog checkout was pulled to `834e3e2` and rebuilt.
+
+**Container**
+- `container/redesign-patches` `f72862c` ports #49-#58; full suite (164 files, 2098 tests) and `release:verify` pass on it.
+- WSL: image rebuilt and the container swapped to `1d48d753fbf7`; the in-container send lock was idle before and after.
+- M3: not rebuilt in this release. The build over ssh was refused by the agent's permission classifier; the M3 container still runs the 0.40.42 port.
+
+**Verified live on installed 0.40.43 (WSL)**
+- `pro blockers --since 7` refused: "--since expects a date or an age like 7d or 24h".
+- `pro blockers --json` across the machine: 21 roots and 657 consults (before: 27 roots, about twice the consults, counting case-variant paths of the same repo).
+- `ask --project "  "` refused: "--project is blank".
+
+## 0.40.42 Release Record
+
+Release commit `9c97a14` on `main` (cut after PR #48, merge `cc129d8`); tag `v0.40.42`. Released on its own: before it, `--attach` and MCP `attach` uploaded `.env`, `.git` contents, key files and outward symlinks.
+
+**Publishing**
+- `publish.yml` run 40284687723 passed all six platforms, then npm publish with SLSA v1 provenance and the GitHub Release (2026-10-26 07:15 UTC start). The GitHub Release lists the one entry from `CHANGELOG.md`.
+- `npm run release:verify` passed on the release commit after a build.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.42. Running services were not restarted: no host stdio MCP servers on WSL, 1 on M3, none on the Mac mini.
+- The maintainer watchdog checkout was pulled to `9c97a14` and rebuilt.
+
+**Verified live on installed 0.40.42 (WSL, scratch repo)**
+- `--attach .env` refused: "Path .env is sensitive and cannot be read through repo tools".
+- `--attach link.pdf` (symlink to a file outside the repo) refused: "escapes the repository root after resolving symlinks".
+- `--attach note.txt` still uploads; ChatGPT answered with the code word from the file, `request_verified: yes`.
+
+**Browser container**
+- `container/redesign-patches` `41c34de` ports PR #48. Branch suite: 2081 passed, 3 skipped; `release:verify` ok.
+- WSL image `491971a34a26` and M3 image `59747258b693`, each swapped after an idle send-lock check; in both, `--attach .env.probe` is refused and smoke returned `requestVerified: true`.
+
 ## 0.40.41 Release Record
 
 Release commit `e0ea707` on `main` (cut after PRs #45-#47, last merge `6911f3e`); tag `v0.40.41`. Released ahead of the usual batch for PR #46, which withheld answers from requests that had posted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.40.42",
+  "version": "0.40.44",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",