@youdie006/prodex 0.40.49 → 0.40.50

package/dist/bundle.js

@@ -66,7 +66,9 @@ export async function buildDryRunBundle(root, input) {
     }
     return {
         schema_version: SCHEMA_VERSION,
-        id: makeBridgeId("sess", `${randomUUID().slice(0, 8)}-${input.prompt}`),
+        // The id is listed wherever sessions are (MCP bridge_list_sessions among
+        // them), so it carries no words from the prompt.
+        id: makeBridgeId("sess", randomUUID().slice(0, 8)),
         mode: "manual_copy",
         prompt: input.prompt,
         files,

package/dist/chatgpt-browser.js

@@ -2713,12 +2713,19 @@ export function focusPowerSliderExpression() {
  * only (the exact "Select ChatGPT model" control first, the older heuristic
  * second), and an unrendered composer is reported as not found, which the
  * caller's poll waits out.
+ *
+ * An open "Edit message" editor is a form inside the transcript, ahead of the
+ * composer in the document, and has no trigger. Measured 2026-11-03: taking it
+ * refused every follow-up that selected a model until the page was reloaded,
+ * so editors inside a message are skipped. Only message ancestors exclude one
+ * here, not aria-hidden as in the typing lookup: an open menu aria-hides the
+ * composer itself.
  */
 export function modelButtonRectExpression() {
     return `(() => {${CLICK_POINT_SNIPPET}
     const composer = [...document.querySelectorAll('#prompt-textarea,[contenteditable="true"],textarea')].find((el) => {
       const r = el.getBoundingClientRect();
-      return r.width > 0 && r.height > 0;
+      return r.width > 0 && r.height > 0 && !(el.parentElement && el.parentElement.closest('[data-message-author-role],[data-chatgpt-search-unit-key]'));
     });
     if (!composer) return { ok: false, reason: "model selector button not found: the composer has not rendered" };
     const scope = composer.closest('form');
@@ -4581,6 +4588,7 @@ export async function sendChatGptPrompt(options) {
       if (last && expandCollapsedUserTurn(last.textNode)) return false;
       return Boolean(last && userMessageText(last.textNode).includes(${JSON.stringify(`[prodex-request:${requestId}]`)}));
     })()`;
+        await options.beforePromptSubmit?.();
         // A dispatch can reach Chrome even if its acknowledgement is lost.
         submissionAttempted = true;
         await cdp.send("Input.dispatchKeyEvent", enterKeyEvent("keyDown"));
@@ -6103,9 +6111,11 @@ export function composerToolsButtonRectExpression() {
     return `(() => {${CLICK_POINT_SNIPPET}
     const legacy = document.querySelector('[data-testid="composer-plus-btn"]');
     if (legacy) return clickPoint(legacy);
+    // An open "Edit message" editor sits in the transcript ahead of the
+    // composer, in a form without this button; see modelButtonRectExpression.
     const composer = [...document.querySelectorAll('#prompt-textarea,[contenteditable="true"],textarea')].find((el) => {
       const r = el.getBoundingClientRect();
-      return r.width > 0 && r.height > 0;
+      return r.width > 0 && r.height > 0 && !(el.parentElement && el.parentElement.closest('[data-message-author-role],[data-chatgpt-search-unit-key]'));
     });
     const form = composer && composer.closest('form');
     if (!form) return { ok: false, reason: "composer tools button not found: the composer has not rendered" };
@@ -6154,11 +6164,15 @@ export function composerToolEntryRectExpression(label) {
 /** Tool tokens currently sitting in the composer. */
 export function activeComposerToolsExpression(labels) {
     const labelsJson = JSON.stringify(labels);
-    return `(() => {
+    return `(() => {${composerExpressionHelpers()}
     // The token normally lands inside the editor, but some builds render it as
     // a pill in the surrounding composer form - check both before deciding a
     // selection did not take.
-    const el = document.querySelector('#prompt-textarea,[contenteditable="true"]');
+    // Read the composer a send types into. Measured 2026-11-03: a new chat
+    // leaves the home page's composer mounted in a hidden workspace ahead of
+    // the conversation's, and the first editor in the document was that one,
+    // so a follow-up's tool was on but read as off.
+    const el = findChatGptComposerCandidate();
     const form = el ? (el.closest("form") || el.parentElement) : null;
     const text = ((el ? el.innerText || "" : "") + String.fromCharCode(10) + (form ? form.innerText || "" : "")).toLowerCase();
     // Case-insensitively: prodex carries the label as the menu spells it

package/dist/cli-pro.js

@@ -14,7 +14,7 @@ import { getTokenExpiryStatus, loadBrowserDefaults, loadLocalConfig } from "./co
 import { sendPacingMarkerPath, withBrowserSendLock } from "./browser-send-lock.js";
 import { blockerCause, buildBlockerReport, CATCH_ALL_CODES } from "./blocker-report.js";
 import { isChatGptConversationUrl, projectIdFromSidebar, resolveContinuationThread } from "./continue-thread.js";
-import { FollowupApprovalRequired, reserveFollowup, resolveMaxAutoFollowups } from "./followup-budget.js";
+import { assertFollowupAvailable, FollowupApprovalRequired, reserveFollowup, resolveMaxAutoFollowups } from "./followup-budget.js";
 import { readBridgeRoots } from "./registry.js";
 import { ProdexRequestIdSchema, SessionKeySchema } from "./schema.js";
 import { BridgeStore, MAX_FETCHABLE_RESULT_ARTIFACT_BYTES } from "./store.js";
@@ -1170,7 +1170,10 @@ export function createBrowserSendProgressPrinter(write, heartbeatMs = 10_000) {
         write(`progress: ${PROGRESS_PHASE_LABELS[event.phase]}${event.detail ? ` (${event.detail})` : ""}`);
     };
 }
-export async function runAskProCommand(rest, io, beforeSend) {
+export async function runAskProCommand(rest, io, 
+// Runs before any task is created. The step it returns runs once the prompt
+// is typed, right before it is submitted.
+beforeSend) {
     const parsedAskPro = parseAskProArgs(rest);
     const hasDryRunMode = parsedAskPro.optionArgs.includes("--dry-run");
     const hasSendMode = parsedAskPro.optionArgs.includes("--send");
@@ -1472,11 +1475,11 @@ export async function runAskProCommand(rest, io, beforeSend) {
     if (hasSendMode) {
         // MCP approval checkpoints run after target validation but before any
         // task creation, pacing, browser recovery, or prompt send.
-        await beforeSend?.({
+        const beforePromptSubmit = (await beforeSend?.({
             store: targetStore,
             ...(normalizedTargetUrl ? { thread: normalizedTargetUrl } : {}),
             ...(continuedFromTaskId ? { continuedFrom: continuedFromTaskId } : {})
-        });
+        })) || undefined;
         const browserCommandOptions = {
             cwd: targetCwd,
             port: parsedAskPro.optionArgs.includes("--port") ? browserPort : undefined
@@ -1555,6 +1558,7 @@ export async function runAskProCommand(rest, io, beforeSend) {
                 proMode: selectionProMode,
                 effort: selectionEffort,
                 ...(allowSelectionFallback ? { allowSelectionFallback: true } : {}),
+                ...(beforePromptSubmit ? { beforePromptSubmit } : {}),
                 onProgress: createBrowserSendProgressPrinter(io.stderr)
             });
         });
@@ -1592,7 +1596,11 @@ export async function runAskProCommand(rest, io, beforeSend) {
             }
         }
         catch (error) {
-            const blocker = await withManualStepForWindowMode(sourceAwareBrowserBlocker(browserSendBlockerFromError(error), sourceCli, browserCommandOptions), resolveCdpPort(browserPort), sourceCli, browserCommandOptions);
+            // Another follow-up spent the budget while this one waited for the
+            // browser. Nothing was submitted; the caller asks the user instead.
+            const blocker = error instanceof FollowupApprovalRequired
+                ? { code: "followup_approval_required", message: error.message, retryable: false }
+                : await withManualStepForWindowMode(sourceAwareBrowserBlocker(browserSendBlockerFromError(error), sourceCli, browserCommandOptions), resolveCdpPort(browserPort), sourceCli, browserCommandOptions);
             const message = blocker.next_step ? `${blocker.message} Next: ${blocker.next_step}` : errorMessage(error);
             // The blocker text can quote the requested/default project name (e.g. a
             // "project not found" error). Local stdout/stderr keep it (useful to the
@@ -1659,6 +1667,8 @@ export async function runAskProCommand(rest, io, beforeSend) {
                     blocker
                 }, null, 2));
             }
+            if (error instanceof FollowupApprovalRequired)
+                throw error;
             throw new Error(formatBlockedConsultRecordedMessage(message, task.id, sourceCli, { cwd: targetCwd }));
         }
         const answerArtifactText = formatProConsultArtifact(consult);
@@ -2036,12 +2046,17 @@ export async function performBrowserConsultForMcp(cwd, input, onProgress) {
             if (!thread || !continuedFrom)
                 return;
             continuationTarget = { taskId: continuedFrom, thread };
-            followupBudget = await reserveFollowup(store, {
-                thread,
-                taskId: continuedFrom,
-                userApproved: input.user_approved === true,
-                limit
-            });
+            const reservation = { thread, taskId: continuedFrom, userApproved: input.user_approved === true, limit };
+            await assertFollowupAvailable(store, reservation);
+            // Spent only when the prompt is about to be submitted, and once: a retry
+            // after browser recovery is the same follow-up.
+            let reserved = false;
+            return async () => {
+                if (reserved)
+                    return;
+                followupBudget = await reserveFollowup(store, reservation);
+                reserved = true;
+            };
         });
     }
     catch (error) {

package/dist/followup-budget.js

@@ -33,7 +33,24 @@ export function resolveMaxAutoFollowups(envValue = process.env.PRODEX_MAX_AUTO_F
     }
     return value;
 }
+/**
+ * Refuse a follow-up the budget no longer covers, without spending any of it.
+ *
+ * The follow-up is reserved only once its prompt is about to be submitted.
+ * Measured 2026-11-02 in the browser container: two follow-ups in one
+ * conversation, refused as composer_not_ready before anything was typed, were
+ * recorded as its follow-ups 3 and 4 of 5. This check keeps an exhausted budget
+ * from creating a task or touching the browser at all.
+ */
+export async function assertFollowupAvailable(store, input) {
+    await withFollowupBudgetLock(store, input, async (conversationKey) => {
+        await readConversationLedger(store, { conversationKey, ...input });
+    });
+}
 export async function reserveFollowup(store, input) {
+    return withFollowupBudgetLock(store, input, async (conversationKey) => reserveFollowupUnderLock(store, { ...input, conversationKey }));
+}
+async function withFollowupBudgetLock(store, input, run) {
     assertFollowupLimit(input.limit);
     const conversationKey = conversationKeyFromThread(input.thread);
     await store.ensure();
@@ -44,9 +61,10 @@ export async function reserveFollowup(store, input) {
         privateParent: true,
         busyError: (holder) => new Error(`Another follow-up reservation is in progress (pid ${holder.pid ?? "unknown"})`),
         unavailableError: () => new Error("The follow-up budget lock could not be recovered. Stop all prodex processes before removing the lock and its matching .reap claim, then retry.")
-    }, async () => reserveFollowupUnderLock(store, { ...input, conversationKey }));
+    }, async () => run(conversationKey));
 }
-async function reserveFollowupUnderLock(store, input) {
+/** The conversation's ledger so far; throws when the budget does not cover another follow-up. */
+async function readConversationLedger(store, input) {
     const reservations = await readTrustedReservations(store);
     const conversationReservations = reservations
         .filter((reservation) => reservation.metadata.conversation_key === input.conversationKey)
@@ -59,6 +77,10 @@ async function reserveFollowupUnderLock(store, input) {
             remaining: 0
         });
     }
+    return previous;
+}
+async function reserveFollowupUnderLock(store, input) {
+    const previous = await readConversationLedger(store, input);
     const budget = input.userApproved === true
         ? { limit: input.limit, used: 0, remaining: input.limit }
         : {

package/docs/clients.md

@@ -52,12 +52,17 @@ follow-up checkpoint (integer 0-1000; default 5). For example:
 PRODEX_MAX_AUTO_FOLLOWUPS = "8"
 ```
 
-The initial fresh consult is not a follow-up. Reservations are counted before sends
-and persist across reconnects, older task references, and different session keys in
-the same bridge and conversation. Failed/uncertain attempts count too. At the limit,
+The initial fresh consult is not a follow-up. A follow-up is reserved once its prompt
+is typed, right before it is submitted, and reservations persist across reconnects,
+older task references, and different session keys in the same bridge and
+conversation. A send refused before that point, such as `composer_not_ready`, does
+not count; an attempt that fails or is uncertain after submitting does. At the limit,
 the tool returns `status: "awaiting_user"`, `task_id: null`, the intended continuation
 arguments, and `followup_budget: {limit, used, remaining}` without creating a consult
-task or sending a prompt. This response-only status is not a ledger task status.
+task or sending a prompt. This response-only status is not a ledger task status. If
+another follow-up in the same conversation uses the last of the budget while this one
+waits for the browser, this one stops before submitting with the same response, and
+its consult task is recorded as blocked with `followup_approval_required`.
 
 Ask the user whether to continue. Only after an explicit user request/approval may
 the caller send that continuation with `user_approved: true`. This human-directed

package/docs/releasing.md

@@ -16,6 +16,107 @@ Release target: `v0.40.13` on `main`. The GitHub Release records the resolved co
 
 The release adds a guarded, opt-in transition and more accurate blocker reporting. It does not claim that headless Pro consultation is verified on either deployment target or that authentication can be retained indefinitely.
 
+## 0.40.49 Release Record
+
+Release commit `74b9c4d` on `main` (cut after PRs #79-#83, last merge `be947df`, docs `7b6a3bd`); tag `v0.40.49`, published 2026-11-01. Released on the user's go-ahead as a batch: #79 (the page's render error saved as the answer), #80 (blank `--tool`), #81 (`--continue` matching a project by the end of its name) and #83 (projects behind the sidebar's "Show more"). #82 changed a test only and has no changelog entry.
+
+**Before the cut**
+- `main` CI on `7b6a3bd` (docs only) failed on macOS Intel: `npm test` ran past the release check's 15-minute budget on a slow runner, with no failing test. On the four runs before it that step took 10.5 to 11.8 minutes. The failed job was rerun and passed.
+
+**Publishing**
+- `npm run release:verify` passed on the release commit after a build.
+- `publish.yml` run 41283791768 passed all six platforms, then npm publish with SLSA v1 provenance and the GitHub Release, which lists the four entries from `CHANGELOG.md`.
+
+**Installed**
+- WSL, M3, Mac mini: `prodex --version` reports 0.40.49.
+- The maintainer watchdog checkout was pulled to `74b9c4d` and rebuilt.
+- MacBook M4 (`m4`), added to the install targets this release. It had two copies:
+  - `~/.local/bin/prodex`, which its Codex MCP entry runs directly, links into `~/.gemini/harness-antigravity/runtime-prodex` (an npm project, 0.40.32). It was updated there with `npm i @youdie006/prodex@0.40.49`.
+  - A global copy under `/opt/homebrew` (0.40.0) was updated with `npm i -g --prefix /opt/homebrew`.
+  - The link pointed at `dist/cli.js`, which is not executable in the new install, because the package's executable has been `prodex.mjs` since 0.40.18. Run directly, it failed with "permission denied", so Codex could not have started the MCP server again. The link now points at the runtime's `node_modules/.bin/prodex`. Through it, `--version` reports 0.40.49 and `prodex mcp` answers `initialize` as 0.40.49.
+- Running services were not restarted. They keep the old code until their client starts them again:
+  - M4: Codex's `prodex mcp`, started before the install.
+  - M3: a `prodex mcp` running since 2026-09-15.
+  - Mac mini and WSL: none on the host. WSL's MCP entry goes through the browser container.
+
+**Verified live on installed 0.40.49 (WSL host browser, scratch repo)**
+- `pro browser projects` listed 25 projects; 0.40.48 listed 9 of the same 25.
+- `pro browser smoke` returned `requestVerified: true`.
+
+**After the release**
+- PR #84 (merge `b7b5d61`, unreleased): session ids no longer carry the start of the prompt.
+
+**Container**
+- `container/redesign-patches` `f2d13e6` ports #84 on top of the ports of #79-#83 (`f93b63f`, `661b2c6`, `106bd0a`, `facd4fd`) and the 1024 process limit (`55f2f3e`). tsc, the full suite (2161 tests) and `release:verify` pass on it.
+- The agent's permission classifier refused the WSL `docker compose build`, so the user ran the build-and-swap scripts. Both images were built from `f2d13e6`. Both swaps waited for the container's send lock to be free.
+- M3 (colima `prodex-check`): image `4bc8fac19752`, started 07:57 UTC.
+  - It came up healthy with the 1024 process limit, using 146.
+  - `pro browser check` reported logged in with a composer.
+  - `pro browser smoke` answered `PRODEX_PRO_SMOKE_OK` with its request verified.
+  - A dry-run `pro ask "Draft the payroll memo"` (nothing sent) got the id `sess_20261101_075935_93598ff4`, with no prompt words in it.
+- WSL: image `e2e3523b640a`.
+  - The first run built the image but did not swap, because a Pro consult from another session had held the send lock since 07:54 UTC.
+  - The swap waited for that consult, which finished `done`. The lock cleared at 08:06:32, and the container was recreated at 08:06:35.
+  - It came up healthy with the 1024 process limit, using 177, and logged no thread errors.
+  - `pro browser check`, `smoke` and the dry-run id check gave the same results as on M3 (id `sess_20261101_080804_33e445d8`).
+  - The swap dropped every MCP client of the WSL container, so each WSL Claude Code session needs `/mcp`.
+- Both containers' `prodex --version` still prints 0.40.18, because the container branch never bumps its version.
+
+**MCP clients kept connected across container swaps (2026-11-01, after the swaps)**
+- Both swaps had dropped every MCP client of their container: `scripts/container-client.mjs mcp` piped the client into `docker exec` and ended with it, so each Claude Code session needed `/mcp` typed by hand.
+- `container/redesign-patches` `964b847` turns that command into a relay that reconnects:
+  - it answers requests in flight with an error that names `pro_recover`;
+  - it runs `docker exec` again until the container is back, holding new requests for up to 60 seconds;
+  - it replays the client's handshake, tells the client its tools may have changed, and then passes the held requests on.
+- Verified:
+  - 6 new tests; suite 2167 passed; `release:verify` ok.
+  - On a throwaway container from the same image, one client connection listed 20 tools, survived a restart and then a delete-and-recreate, and listed 20 tools again each time.
+- WSL deployment:
+  - The prodex MCP entries used to run the script from `/mnt/d/myproject/gptprouse`, a checkout another task keeps on its own branch.
+  - Three Claude configs now run it from a checkout pinned for this purpose, `~/.local/share/prodex-maint/container-src` at `964b847`: `~/.claude.json` and the two swapdex slot configs that had the entry.
+  - The Codex config (`~/.codex/config.toml`) was changed the same way.
+  - `claude mcp get prodex` reports Connected. A handshake through it reached the WSL container (server 0.40.18, 20 tools).
+- M3 deployment:
+  - Its Claude and Codex configs run an installed copy, `~/.local/share/prodex/container-installed-8d7a094-wP3RK2/container-client.mjs`.
+  - That file was replaced in place with `964b847`'s; the old one is kept beside it as `container-client.mjs.8d7a094.bak`. The configs are unchanged.
+  - A handshake through it reached the M3 container.
+- Sessions that were open during the swaps still need one `/mcp`. After that, a container restart or swap no longer disconnects them.
+- When `container-client.mjs` changes again, both copies must be updated:
+  - WSL: move the pinned checkout to the new commit;
+  - M3: replace the installed copy.
+
+## Container consults ran on the last model selected (2026-11-01)
+
+**What happened**
+- The user reported that some sessions' consults did not use Pro but whatever model the browser last had.
+- In the WSL container's results, 20 consults since 2026-10-10 carry `model_selection_warning: no model/effort was selected`. Today's 07:54 UTC Pro consult from another session is one of them.
+- Cause: a consult that names no model, with no saved or environment default, keeps the picker's current selection. That is the designed fallback, but in a shared browser the current selection is whatever another session (or an Instant smoke test) picked last.
+  - The container's MCP server had neither default. `container-client.mjs mcp` passed no variables into the container, so an MCP entry's env block could not reach it, and the bridge in the container had no saved config.
+  - The host entries on WSL that run `prodex mcp` directly set `PRODEX_DEFAULT_MODEL=Pro` and were not affected.
+
+**Fixes**
+- `container/redesign-patches` `cd3b671`: `mcp` passes the client's `PRODEX_DEFAULT_MODEL`, `_EFFORT`, `_PRO_MODE` and `_PROJECT` into the container, and adds `PRODEX_DEFAULT_MODEL=Pro` when none of them names a model or a reasoning step. A consult's own `model` or `effort` still wins.
+  - Verified: 3 new tests, suite 2170 passed, `release:verify` ok.
+  - In the container, the resolved defaults went from `null` to `{"model":"Pro"}`.
+  - A consult that named no model, sent through the new client, came back done.
+- Deployed to the WSL pinned checkout (`~/.local/share/prodex-maint/container-src` at `cd3b671`) and to the M3 installed copy.
+- The 16 WSL sessions had reconnected (17:35-17:37 KST) before `cd3b671` was in place, so their relays still run the version without the default.
+  - So the bridge inside each container now saves Pro: `setup --cwd /home/node/bridge --model Pro` on WSL and M3. That writes `.bridge/config.local.json` with a loopback HTTP profile; no HTTP server runs there.
+  - Each consult reads this default, so it applies to connected clients at once. A consult through one of the old relays, naming no model, came back done from Pro.
+- Each such consult carries the warning `model_is_now_an_effort`, because the current picker has Pro as an effort step. The model default is kept because a model or effort the consult names itself overrides it. A saved effort default would be applied on top of a model the consult names.
+
+**M4 and Mac mini (host `prodex mcp`, 2026-11-03)**
+- Neither machine's Claude or Codex entry set `PRODEX_DEFAULT_MODEL`. On M4, `.bridge/results` held one consult of five with the no-model warning (`~/.gemini/harness-antigravity/verification`).
+- M4:
+  - `~/.claude.json` now has `env: {PRODEX_DEFAULT_MODEL: Pro}`, set with `claude mcp remove` and `add-json`.
+  - `~/.codex/config.toml` `[mcp_servers.prodex]` now has `env = { PRODEX_DEFAULT_MODEL = "Pro" }`. A backup is kept as `config.toml.bak-prodex-default-20261103`, and `codex mcp get prodex` parses it.
+  - The three running `prodex mcp` processes keep their old environment until their clients restart them.
+- Mac mini: the same change, made on the user's explicit request after the first attempt was refused:
+  - Claude `~/.claude.json` now carries `env: {PRODEX_DEFAULT_MODEL: Pro}`.
+  - Codex `~/.codex/config.toml` has the same `env` line, with the backup `config.toml.bak-prodex-default-20261103`. `codex mcp get prodex` shows the variable set.
+  - No `prodex mcp` was running there, so the next client start uses it.
+- A WSL Codex session started on 2026-10-28 still runs the client from the old path until it restarts. Its config, `~/.codex/config.toml` (linked from every swapdex slot), already points at the pinned checkout.
+
 ## Browser Incident 2026-10-30: WSL browser container out of threads
 
 **What happened**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.40.49",
+  "version": "0.40.50",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",