@youdie006/prodex 0.40.43 → 0.40.44

package/dist/safe-file.js

@@ -420,6 +420,9 @@ async function tryAcquireFileLock(filePath, parentSnapshot) {
         nonce: randomUUID(),
         started_at: new Date().toISOString()
     };
+    const pidStart = linuxProcessStartTicks(process.pid);
+    if (pidStart !== undefined)
+        owner.pid_start = pidStart;
     const tokenPath = fileLockTokenPath(filePath, owner);
     const handle = await openStableNoFollow(tokenPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, "write", parentSnapshot, 0o600);
     try {
@@ -488,7 +491,8 @@ function parseFileLockHolder(content) {
         return {
             pid: Number.isSafeInteger(parsed.pid) && Number(parsed.pid) > 0 ? Number(parsed.pid) : undefined,
             nonce: typeof parsed.nonce === "string" && /^[A-Za-z0-9-]{1,128}$/.test(parsed.nonce) ? parsed.nonce : undefined,
-            started_at: typeof parsed.started_at === "string" ? parsed.started_at : undefined
+            started_at: typeof parsed.started_at === "string" ? parsed.started_at : undefined,
+            pid_start: typeof parsed.pid_start === "string" && /^\d{1,20}$/.test(parsed.pid_start) ? parsed.pid_start : undefined
         };
     }
     catch {
@@ -498,7 +502,12 @@ function parseFileLockHolder(content) {
 function parseFileLockOwner(holder) {
     if (holder.pid === undefined || holder.nonce === undefined)
         return undefined;
-    return { pid: holder.pid, nonce: holder.nonce, started_at: holder.started_at };
+    return {
+        pid: holder.pid,
+        nonce: holder.nonce,
+        started_at: holder.started_at,
+        ...(holder.pid_start !== undefined ? { pid_start: holder.pid_start } : {})
+    };
 }
 async function releaseFileLockLease(filePath, lease, parentSnapshot) {
     try {
@@ -591,36 +600,42 @@ function processIsAlive(pid) {
     }
 }
 /**
- * Whether the holder's pid now names a process that started after the lock was
- * written, so the writer is gone. A send that dies with the machine, the WSL VM
- * or its container leaves the lock behind, and after a restart pids are handed
- * out again: measured, a 2020 lock naming pid 1 held off every send for its
- * whole wait budget because pid 1 was alive - as a different process.
+ * Whether the holder's pid now names a different process than the one that
+ * wrote the lock, so the writer is gone. A send that dies with the machine,
+ * the WSL VM or its container leaves the lock behind, and after a restart pids
+ * are handed out again: measured, a 2020 lock naming pid 1 held off every send
+ * for its whole wait budget because pid 1 was alive - as a different process.
+ *
+ * The lock records its writer's start time in clock ticks since boot, and that
+ * is compared with the pid's start ticks now: boot clock against boot clock.
+ * 0.40.43 converted the start to wall time through /proc/stat btime instead,
+ * and on WSL2 btime moves (measured 30 minutes over one day: the VM's boot
+ * clock stops while the host sleeps, then the wall clock is resynced), so a
+ * live holder looked newer than its own lock and its lock was reaped mid-send.
  */
 function pidReusedSince(holder) {
+    if (holder.pid === undefined)
+        return false;
+    if (holder.pid_start !== undefined) {
+        const current = linuxProcessStartTicks(holder.pid);
+        return current !== undefined && current !== holder.pid_start;
+    }
+    // A lock from a prodex that did not record start ticks: the only safe call is
+    // that nothing alive now was running before the last boot.
     const writtenAt = Date.parse(holder.started_at ?? "");
-    if (holder.pid === undefined || !Number.isFinite(writtenAt))
+    if (!Number.isFinite(writtenAt))
         return false;
-    const processStartedAt = linuxProcessStartMs(holder.pid);
-    // A holder writes the lock after it starts; a few seconds absorb clock steps.
-    if (processStartedAt !== undefined)
-        return processStartedAt > writtenAt + 5_000;
-    // No per-process start time here: nothing alive now predates the boot.
     return writtenAt < Date.now() - os.uptime() * 1000 - 60_000;
 }
-function linuxProcessStartMs(pid) {
+function linuxProcessStartTicks(pid) {
     if (process.platform !== "linux")
         return undefined;
     try {
-        const btime = /^btime (\d+)$/m.exec(readFileSync("/proc/stat", "utf8"))?.[1];
         const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-        // Field 22 (starttime, in clock ticks since boot) counted after the
-        // parenthesised command name, which may itself contain spaces.
-        const ticks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
-        if (!btime || !Number.isFinite(ticks))
-            return undefined;
-        // USER_HZ is 100 on every Linux ABI Node supports.
-        return Number(btime) * 1000 + ticks * 10;
+        // Field 22 (starttime) counted after the parenthesised command name, which
+        // may itself contain spaces.
+        const ticks = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+        return ticks !== undefined && /^\d+$/.test(ticks) ? ticks : undefined;
     }
     catch {
         return undefined;

package/dist/tui.js

@@ -63,10 +63,15 @@ export function consultArgsFromChoices(choices) {
  */
 export function parseAttachmentLine(line) {
     const out = [];
-    const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    // An unquoted word may carry backslash escapes: dropping a file onto a macOS
+    // terminal types `My\ File.pdf`, which used to split into two paths that do
+    // not exist. Only a space or shell punctuation counts as escaped, so a
+    // Windows separator (a backslash before a letter or another backslash) stays.
+    const pattern = /"([^"]*)"|'([^']*)'|((?:\\[ ()\[\]{}'"&;!$`*?#~<>|]|\S)+)/g;
     let match;
     while ((match = pattern.exec(line)) !== null) {
-        const value = (match[1] ?? match[2] ?? match[3] ?? "").trim();
+        const unquoted = match[3]?.replace(/\\([ ()\[\]{}'"&;!$`*?#~<>|])/g, "$1");
+        const value = (match[1] ?? match[2] ?? unquoted ?? "").trim();
         if (value.length > 0)
             out.push(value);
     }

package/docs/releasing.md

@@ -35,6 +35,28 @@ The release adds a guarded, opt-in transition and more accurate blocker reportin
 **Open**
 - A long-running headless browser ends up behind Cloudflare's check (also noted on WSL, where the Xvfb display is used instead). On macOS there is no virtual display, and a minimized window counts as hidden, so the remaining no-headless option there is a window kept behind others. Changing the headless preference is a design decision that was not made here.
 
+## 0.40.43 Release Record
+
+Release commit `834e3e2` on `main` (cut after PRs #49-#58, last merge `a6bbf85`); tag `v0.40.43`. Ten fixes, including two that block or corrupt work: a send lock left by a dead send whose pid was reused blocked every later send (#54), and two processes opening a fresh repo could fail one with a false "receipt-key.local is corrupt" (#58).
+
+**Publishing**
+- `publish.yml` run 40451563636 first failed on macOS 15 Intel only: `tests/cli.test.ts` "uses an explicit --cwd target for local HTTP MCP start" timed out at 90 s; the same commit passed on the five other platforms and in PR CI. The failed job was rerun and passed, then npm publish with SLSA v1 provenance and the GitHub Release ran. The GitHub Release lists the ten entries from `CHANGELOG.md`.
+- `npm run release:verify` passed on the release commit after a build.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.43. Running services were not restarted: no host stdio MCP servers on WSL, 1 on M3, none on the Mac mini.
+- The maintainer watchdog checkout was pulled to `834e3e2` and rebuilt.
+
+**Container**
+- `container/redesign-patches` `f72862c` ports #49-#58; full suite (164 files, 2098 tests) and `release:verify` pass on it.
+- WSL: image rebuilt and the container swapped to `1d48d753fbf7`; the in-container send lock was idle before and after.
+- M3: not rebuilt in this release. The build over ssh was refused by the agent's permission classifier; the M3 container still runs the 0.40.42 port.
+
+**Verified live on installed 0.40.43 (WSL)**
+- `pro blockers --since 7` refused: "--since expects a date or an age like 7d or 24h".
+- `pro blockers --json` across the machine: 21 roots and 657 consults (before: 27 roots, about twice the consults, counting case-variant paths of the same repo).
+- `ask --project "  "` refused: "--project is blank".
+
 ## 0.40.42 Release Record
 
 Release commit `9c97a14` on `main` (cut after PR #48, merge `cc129d8`); tag `v0.40.42`. Released on its own: before it, `--attach` and MCP `attach` uploaded `.env`, `.git` contents, key files and outward symlinks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.40.43",
+  "version": "0.40.44",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",