@youdie006/prodex 0.40.49 → 0.40.51

package/dist/safe-file.js

@@ -1,3 +1,4 @@
+import { isUtf8 } from "node:buffer";
 import { randomUUID } from "node:crypto";
 import { constants, readFileSync } from "node:fs";
 import { chmod, link, lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
@@ -20,6 +21,8 @@ export async function withCrossProcessFileLock(filePath, options, fn) {
     let retriedMissingAtDeadline = false;
     let lease;
     for (;;) {
+        if (options.signal?.aborted)
+            throw options.abortedError?.() ?? new Error("Stopped waiting for the lock: the caller cancelled");
         lease = await tryAcquireFileLock(filePath, parentSnapshot);
         if (lease)
             break;
@@ -49,7 +52,7 @@ export async function withCrossProcessFileLock(filePath, options, fn) {
             waited = true;
             options.onWait?.(snapshot.holder);
         }
-        await delay(Math.min(retryMs, Math.max(1, deadline - Date.now())));
+        await delay(Math.min(retryMs, Math.max(1, deadline - Date.now())), options.signal);
     }
     try {
         return await fn();
@@ -58,6 +61,18 @@ export async function withCrossProcessFileLock(filePath, options, fn) {
         await releaseFileLockLease(filePath, lease, parentSnapshot);
     }
 }
+/**
+ * A file whose bytes are not UTF-8. Read as UTF-8, such bytes become U+FFFD,
+ * and writing the text back destroys them: measured 2026-11-09, an EUC-KR
+ * "한글" line came back as replacement characters through repo writes while
+ * the diff showed the line as unchanged. Writers ask for it to be refused.
+ */
+export class NotUtf8Error extends Error {
+    constructor() {
+        super("Target file is not UTF-8 text");
+        this.name = "NotUtf8Error";
+    }
+}
 export async function readVerifiedUtf8File(filePath, validate, options = {}) {
     await validate();
     const parentSnapshot = await captureParentSnapshot(filePath);
@@ -72,7 +87,7 @@ export async function readVerifiedUtf8File(filePath, validate, options = {}) {
         if (options.maxBytes !== undefined && stat.size > options.maxBytes) {
             throw new Error(`Target file is too large (${stat.size} bytes)`);
         }
-        const content = await readHandleUtf8(handle, filePath, options.maxBytes, options.decodeUtf16Bom === true);
+        const content = await readHandleUtf8(handle, filePath, options.maxBytes, options.decodeUtf16Bom === true, options.requireUtf8 === true);
         if (options.mode !== undefined) {
             await testHooks.beforeChmod?.(filePath, "read");
             await assertSafeOpenFile(handle, filePath, "read");
@@ -127,19 +142,24 @@ export async function replaceVerifiedUtf8File(filePath, content, validate, verif
     const parentSnapshot = await captureParentSnapshot(filePath);
     await testHooks.beforeOpen?.(filePath, "write");
     const handle = await openStableNoFollow(filePath, constants.O_RDWR, "write", parentSnapshot, options.mode);
+    // The replacement is a new file renamed into place, so it takes the mode of
+    // the file it replaces unless one is given: created with the default mode,
+    // an edited script lost its executable bit (found 2026-11-09).
+    let mode = options.mode;
     try {
         const currentContent = await readHandleUtf8(handle, filePath, options.maxBytes);
         await verifyCurrentContent(currentContent);
         await testHooks.beforeReplace?.(filePath);
         const latestContent = await readHandleUtf8(handle, filePath, options.maxBytes);
         await verifyCurrentContent(latestContent);
+        mode ??= (await handle.stat()).mode & 0o777;
         await testHooks.beforeWrite?.(filePath, "write");
     }
     finally {
         await handle.close();
     }
     // Windows cannot replace some files while their verification handle is open.
-    await replaceByVerifiedTempFile(filePath, content, validate, options, {
+    await replaceByVerifiedTempFile(filePath, content, validate, { ...options, mode }, {
         beforeOpenAlreadyRan: true,
         beforeWriteAlreadyRan: true,
         parentSnapshot,
@@ -186,7 +206,7 @@ async function replaceByVerifiedTempFile(filePath, content, validate, options =
         throw error;
     }
 }
-async function readHandleUtf8(handle, filePath, maxBytes, decodeUtf16Bom = false) {
+async function readHandleUtf8(handle, filePath, maxBytes, decodeUtf16Bom = false, requireUtf8 = false) {
     await assertOpenFileMatchesPath(handle, filePath, "read");
     const stat = await handle.stat();
     if (!stat.isFile()) {
@@ -207,7 +227,10 @@ async function readHandleUtf8(handle, filePath, maxBytes, decodeUtf16Bom = false
             throw new Error(`Target file is too large (${offset} bytes)`);
         }
     }
-    return decodeFileText(buffer.subarray(0, offset), decodeUtf16Bom);
+    const bytes = buffer.subarray(0, offset);
+    if (requireUtf8 && !isUtf8(bytes))
+        throw new NotUtf8Error();
+    return decodeFileText(bytes, decodeUtf16Bom);
 }
 /**
  * UTF-8, or UTF-16 when asked and the file starts with its BOM. Windows
@@ -641,8 +664,19 @@ function linuxProcessStartTicks(pid) {
         return undefined;
     }
 }
-function delay(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+/** Resolves after ms, or as soon as signal aborts. */
+function delay(ms, signal) {
+    if (!signal)
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    return new Promise((resolve) => {
+        const done = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", done);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener("abort", done, { once: true });
+    });
 }
 function procFdPath(fd) {
     return `/proc/self/fd/${fd}`;

package/dist/store.js

@@ -9,7 +9,7 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertRepoRelativePath } from "./repo.js";
-import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
+import { readVerifiedUtf8File, withCrossProcessFileLock, writeVerifiedUtf8File } from "./safe-file.js";
 import { makeBridgeId, nowIso, ReceiptSchema, ResultSchema, SCHEMA_VERSION, SessionSchema, TaskSchema } from "./schema.js";
 let storeTestHooks = {};
 export function setBridgeStoreTestHooks(hooks) {
@@ -20,23 +20,10 @@ const SESSION_ID_PATTERN = /^sess_\d{8}_\d{6}_[a-z0-9-]+$/;
 const RECEIPT_ID_PATTERN = /^receipt_\d{8}_\d{6}_[a-z0-9-]+$/;
 const BRIDGE_DIRECTORY_MODE = 0o700;
 const BRIDGE_FILE_MODE = 0o600;
-// A claim is a sub-second read-modify-write; a claim lock older than this
-// belongs to a crashed holder, not a live claimer, so it can be reaped.
-const CLAIM_LOCK_STALE_MS = 60_000;
+// A task update is a sub-second read-modify-write; one waiting longer than
+// this for another is told to try again.
+const TASK_UPDATE_LOCK_WAIT_MS = 10_000;
 const RECEIPT_INTEGRITY_KEY_BYTES = 32;
-async function claimLockIsStale(lockPath) {
-    try {
-        const info = await stat(lockPath);
-        return Date.now() - info.mtimeMs > CLAIM_LOCK_STALE_MS;
-    }
-    catch (error) {
-        // Vanished between the EEXIST and the stat (the holder just released it):
-        // treat as free so the retry can grab it.
-        if (isErrorCode(error, "ENOENT"))
-            return true;
-        throw error;
-    }
-}
 const FETCHABLE_RESULT_ARTIFACT_PREFIXES = [".bridge/artifacts/pro-consults/", ".bridge/artifacts/results/"];
 export const MAX_FETCHABLE_RESULT_ARTIFACT_BYTES = 100_000;
 const MAX_BRIDGE_ARTIFACT_READ_BYTES = 1_000_000;
@@ -161,47 +148,33 @@ export class BridgeStore {
     }
     async claimTask(taskId, claimedBy) {
         // Claiming is check-then-write, so two agents that both read "new" would
-        // otherwise both write "claimed" (a silent double-claim). Serialize the
-        // whole read-modify-write behind an O_EXCL lock file so exactly one claim
-        // wins; a concurrent claimer sees the lock (or the already-claimed status
-        // after it releases) and is rejected.
-        const lockPath = path.join(this.dir("tasks"), `.${taskId}.claim.lock`);
-        let lockHandle;
-        try {
-            lockHandle = await open(lockPath, "wx", BRIDGE_FILE_MODE);
-        }
-        catch (error) {
-            if (!isErrorCode(error, "EEXIST"))
-                throw error;
-            // A claim is a fast read-modify-write, so a lock older than the staleness
-            // window belongs to a crashed holder (killed before its finally removed
-            // it), not a live claimer - otherwise it would wedge this task's claims
-            // forever. Reap the stale lock and retry the exclusive create once.
-            if (!(await claimLockIsStale(lockPath))) {
-                throw new Error(`Task ${taskId} is already being claimed by another process`);
-            }
-            await rm(lockPath, { force: true }).catch(() => undefined);
-            try {
-                lockHandle = await open(lockPath, "wx", BRIDGE_FILE_MODE);
-            }
-            catch (retryError) {
-                if (isErrorCode(retryError, "EEXIST")) {
-                    throw new Error(`Task ${taskId} is already being claimed by another process`);
-                }
-                throw retryError;
-            }
-        }
-        try {
+        // otherwise both write "claimed" (a silent double-claim). Under the task's
+        // update lock exactly one claim wins; the next one finds it claimed.
+        return this.withTaskUpdateLock(taskId, async () => {
             const task = await this.getTask(taskId);
             if (task.status !== "new") {
                 throw new Error(`Task ${taskId} is ${task.status}, not new`);
             }
-            return await this.writeClaimedTask(taskId, task, claimedBy);
-        }
-        finally {
-            await lockHandle.close().catch(() => undefined);
-            await rm(lockPath, { force: true }).catch(() => undefined);
-        }
+            return this.writeClaimedTask(taskId, task, claimedBy);
+        });
+    }
+    /**
+     * Every change to a task record is a read-modify-write, and only claims used
+     * to take a lock. Found 2026-11-09: a claim that read "new" while a
+     * completion ran wrote "claimed" over it, leaving a claimed task with no
+     * result_path next to a done result and its trusted receipt (11 of 30 tasks
+     * with real processes), and a claim lock left stale by a crashed claimer let
+     * two claimers both win, since each deleted it and made its own (6 of 15
+     * rounds). Claims and completions now share one lock per task, whose holder
+     * is a live process: a crashed holder's lock is taken over safely.
+     */
+    async withTaskUpdateLock(taskId, fn) {
+        return withCrossProcessFileLock(path.join(this.dir("tasks"), `.${taskId}.update.lock`), {
+            waitMs: TASK_UPDATE_LOCK_WAIT_MS,
+            retryMs: 25,
+            busyError: (holder) => new Error(`Task ${taskId} is being updated by another process (pid ${holder.pid ?? "unknown"}); try again.`),
+            unavailableError: () => new Error(`Task ${taskId} could not be locked for an update; try again.`)
+        }, fn);
     }
     async writeClaimedTask(taskId, task, claimedBy) {
         const updated = TaskSchema.parse({
@@ -231,6 +204,9 @@ export class BridgeStore {
         return updated;
     }
     async completeTask(taskId, input) {
+        return this.withTaskUpdateLock(taskId, () => this.completeTaskUnderLock(taskId, input));
+    }
+    async completeTaskUnderLock(taskId, input) {
         const task = await this.getTask(taskId);
         assertFetchableResultArtifacts(input.artifacts ?? []);
         assertDistinctArtifactPaths(input.artifacts ?? []);
@@ -689,7 +665,7 @@ export class BridgeStore {
         }
         throw untrustedResultError(this.root, taskId, `has no locally trusted legacy task_completed receipt to reseal: ${failures[0] ?? "local integrity unavailable"}`);
     }
-    async writeArtifactText(relativePath, content) {
+    async writeArtifactText(relativePath, content, options = {}) {
         await this.ensure();
         await this.assertBridgeDirIsRealDirectory();
         await this.assertArtifactsDirIsRealDirectory();
@@ -698,9 +674,41 @@ export class BridgeStore {
         await writeVerifiedUtf8File(artifactPath, content, async () => {
             await this.assertArtifactParentDirectory(path.dirname(artifactPath));
             await this.assertArtifactTargetInsideIfExists(artifactPath);
-        }, { create: true, mode: BRIDGE_FILE_MODE });
+        }, { create: true, mode: BRIDGE_FILE_MODE, ...(options.exclusive ? { exclusive: true } : {}) });
         return this.relativeToRoot(artifactPath);
     }
+    /**
+     * The files of `tasks complete --artifact path=text`, written only once the
+     * completion is known to be possible. They used to be written first, so a
+     * completion refused afterwards had already replaced the file: found
+     * 2026-11-09, completing a finished task again, or a mistyped task id,
+     * overwrote a saved answer, and an open task completed with another task's
+     * artifact path replaced that task's answer. A finished task's files are not
+     * touched (completeTask then refuses, or accepts the same result again), and
+     * a path that already holds other text is refused.
+     */
+    async writeResultArtifactTexts(taskId, texts) {
+        const task = await this.getTask(taskId);
+        const artifacts = texts.map((text) => ({ path: this.relativeToRoot(this.resolveArtifactPath(text.path)), role: "result" }));
+        assertFetchableResultArtifacts(artifacts);
+        assertDistinctArtifactPaths(artifacts);
+        if (task.status === "done" || task.status === "blocked")
+            return artifacts;
+        for (const [index, text] of texts.entries()) {
+            const stored = artifacts[index].path;
+            try {
+                await this.writeArtifactText(stored, text.content, { exclusive: true });
+            }
+            catch (error) {
+                if (!isErrorCode(error, "EEXIST"))
+                    throw error;
+                if ((await this.readArtifactText(stored)) === text.content)
+                    continue;
+                throw new Error(`${stored} already exists with other content; give this result an artifact path of its own.`);
+            }
+        }
+        return artifacts;
+    }
     async hasArtifactText(relativePath) {
         const artifactPath = this.resolveArtifactPath(relativePath);
         try {
@@ -758,10 +766,21 @@ export class BridgeStore {
         await this.assertBridgeDirIsRealDirectory();
         await this.assertArtifactsDirIsRealDirectory();
         const artifactPath = this.resolveArtifactPath(relativePath);
-        await this.assertArtifactParentDirectory(path.dirname(artifactPath));
-        return readVerifiedUtf8File(artifactPath, () => this.assertArtifactTargetInside(artifactPath), {
-            maxBytes: options.maxBytes ?? MAX_BRIDGE_ARTIFACT_READ_BYTES
-        });
+        try {
+            await this.assertArtifactParentDirectory(path.dirname(artifactPath));
+            return await readVerifiedUtf8File(artifactPath, () => this.assertArtifactTargetInside(artifactPath), {
+                maxBytes: options.maxBytes ?? MAX_BRIDGE_ARTIFACT_READ_BYTES
+            });
+        }
+        catch (error) {
+            // The raw error named the machine's absolute path, often of the parent
+            // directory rather than the file, and went out to MCP clients as it was
+            // (found 2026-11-09). The code stays ENOENT for callers that test it.
+            if (isErrorCode(error, "ENOENT")) {
+                throw Object.assign(new Error(`Artifact not found: ${this.relativeToRoot(artifactPath)}`), { code: "ENOENT" });
+            }
+            throw error;
+        }
     }
     async writeReceipt(input) {
         await this.ensure();
@@ -889,9 +908,9 @@ export class BridgeStore {
     // The key file holds one 32-byte hex key per line: the first line signs new
     // receipts, later lines are legacy keys kept so pre-rotation receipts verify.
     async readReceiptIntegrityKeys() {
-        const lines = (await readVerifiedUtf8File(this.receiptIntegrityKeyPath(), () => this.assertReceiptIntegrityKeyTargetSafe({ allowMissing: false }), {
+        const lines = (await readReplacedFileText(() => readVerifiedUtf8File(this.receiptIntegrityKeyPath(), () => this.assertReceiptIntegrityKeyTargetSafe({ allowMissing: false }), {
             mode: BRIDGE_FILE_MODE
-        }))
+        })))
             .split(/\r?\n/)
             .map((line) => line.trim())
             .filter((line) => line.length > 0);
@@ -1004,7 +1023,7 @@ export class BridgeStore {
             if (options.cleanupTempHardLinks ?? true) {
                 await this.cleanupRecordTempHardLinks(kind, filePath);
             }
-            const raw = await readVerifiedUtf8File(filePath, () => this.assertRecordTargetInside(kind, filePath));
+            const raw = await readReplacedFileText(() => readVerifiedUtf8File(filePath, () => this.assertRecordTargetInside(kind, filePath)));
             try {
                 return JSON.parse(raw);
             }
@@ -1467,6 +1486,26 @@ function recordLabel(kind) {
             return "Receipt";
     }
 }
+// Records and the receipt key are replaced by renaming a new file over them,
+// and a read that opened the old file and then found the new one at the path
+// failed as "Target path changed during read file operation": found
+// 2026-11-09, 115 of 908 reads failed while another process rewrote a
+// session, and `tasks list` failed the same way during a consult. Reading
+// again opens the new file and runs every check again; any other failure,
+// a symlink swap among them, is not retried.
+const REPLACED_FILE_READ_ATTEMPTS = 5;
+export async function readReplacedFileText(read) {
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            return await read();
+        }
+        catch (error) {
+            const replaced = error instanceof Error && error.message === "Target path changed during read file operation";
+            if (!replaced || attempt >= REPLACED_FILE_READ_ATTEMPTS)
+                throw error;
+        }
+    }
+}
 function isErrorCode(error, code) {
     return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }

package/dist/tui-run.js

@@ -10,7 +10,7 @@ import readline from "node:readline";
 import { renderBanner } from "./banner.js";
 import { shellQuote } from "./cli-args.js";
 import { destinationChoices, effortChoices, SEND_KINDS } from "./tui-flow.js";
-import { consultArgsFromChoices, conversationsInProject, conversationThreadUrl, moveCursor, parseAttachmentLine, progressLabel, renderContextPanel, renderProgressBar, renderSelectList } from "./tui.js";
+import { consultArgsFromChoices, conversationsInProject, conversationThreadUrl, displayWidth, moveCursor, parseAttachmentLine, progressLabel, renderContextPanel, renderProgressBar, renderSelectList } from "./tui.js";
 const ESC = "";
 const CLEAR = `${ESC}[2J${ESC}[H`;
 // The alternate screen buffer: the terminal comes back exactly as it was, so a
@@ -20,6 +20,15 @@ const ALT_SCREEN_OFF = `${ESC}[?1049l`;
 const CLEAR_LINE = `${ESC}[2K\r`;
 const HIDE_CURSOR = `${ESC}[?25l`;
 const SHOW_CURSOR = `${ESC}[?25h`;
+// Bracketed paste: the terminal wraps a paste in ESC[200~ ... ESC[201~, which
+// readline reports as "paste-start" and "paste-end" keys and otherwise ignores.
+const BRACKETED_PASTE_ON = `${ESC}[?2004h`;
+const BRACKETED_PASTE_OFF = `${ESC}[?2004l`;
+// How long an Enter at the prompt waits before it ends the prompt. A terminal
+// that does not mark pastes sends one as typed keys, its line breaks included,
+// and the rest of it follows in the same read or milliseconds later; a person
+// does not type the next key that fast.
+const PASTE_SETTLE_MS = 100;
 /**
  * Keys are queued by one long-lived listener rather than a listener attached
  * per read.
@@ -136,19 +145,37 @@ function numericChoice(key, length) {
         return undefined;
     return digit - 1;
 }
-/** Read one line with the terminal back in cooked mode, so editing works. */
-async function askLine(io, question) {
+/**
+ * Read one answer with the terminal back in line-editing mode, so editing works.
+ *
+ * `multiline` is for the prompt, which is often pasted. readline ends a line at
+ * every line break, so a pasted stack trace used to be sent as its first line
+ * and the rest dropped. With it, a paste's line breaks stay in the answer and
+ * only an Enter typed on its own ends it.
+ */
+async function askLine(io, question, options = {}) {
     io.input.setRawMode?.(false);
-    const rl = readline.createInterface({ input: io.input, output: process.stdout, terminal: true });
+    const rl = readline.createInterface({ input: io.input, output: process.stdout, terminal: true, historySize: 0 });
+    // Later lines of a prompt sit under its first line, not at the margin.
+    const continuation = " ".repeat(displayWidth(question.slice(question.lastIndexOf("\n") + 1)));
     try {
+        if (options.multiline)
+            io.write(BRACKETED_PASTE_ON);
         const answer = await new Promise((resolve) => {
+            const lines = [];
+            let pasting = false;
+            let previousKey;
+            let ending;
             let settled = false;
             function settle(value) {
                 if (settled)
                     return;
                 settled = true;
+                clearTimeout(ending);
                 rl.off("SIGINT", onInterrupt);
                 rl.off("close", onClose);
+                rl.off("line", onLine);
+                io.input.off("keypress", onKey);
                 resolve(value);
             }
             function onInterrupt() {
@@ -157,14 +184,50 @@ async function askLine(io, question) {
             function onClose() {
                 settle(undefined);
             }
+            // Sees each key before readline does.
+            function onKey(_text, key) {
+                const name = key?.name;
+                // A line feed straight after a carriage return is the same Enter.
+                const sameEnter = name === "enter" && previousKey === "return";
+                previousKey = name;
+                // Input right behind an Enter means the Enter was a line break inside a
+                // paste the terminal did not mark, so the prompt goes on.
+                if (ending !== undefined && !sameEnter) {
+                    clearTimeout(ending);
+                    ending = undefined;
+                }
+                if (name === "paste-start")
+                    pasting = true;
+                else if (name === "paste-end")
+                    pasting = false;
+            }
+            function onLine(line) {
+                if (!options.multiline) {
+                    settle(line);
+                    return;
+                }
+                lines.push(line);
+                rl.setPrompt(continuation);
+                rl.prompt();
+                if (!pasting)
+                    ending = setTimeout(() => settle(lines.join("\n")), PASTE_SETTLE_MS);
+            }
             rl.once("SIGINT", onInterrupt);
             rl.once("close", onClose);
-            rl.question(question, (value) => settle(value));
+            rl.on("line", onLine);
+            if (options.multiline)
+                io.input.prependListener("keypress", onKey);
+            rl.setPrompt(question);
+            rl.prompt();
         });
         return answer?.trim();
     }
     finally {
         rl.close();
+        // Turned off on every way out, ctrl-c and end of input included: left on,
+        // the shell would receive the markers around every later paste.
+        if (options.multiline)
+            io.write(BRACKETED_PASTE_OFF);
         // Closing the line reader detaches the keypress plumbing and pauses the
         // stream, so the next picker would sit there ignoring every key. Re-arm both.
         io.input.setRawMode?.(true);
@@ -196,6 +259,18 @@ export async function runInteractiveConsult(io, deps) {
     keys = new KeyQueue(io.input);
     io.write(ALT_SCREEN_ON + HIDE_CURSOR);
     let header = "";
+    // Why the picker stopped is written once the alternate screen is gone.
+    // Written while it was up, the reason vanished with it and the picker exited
+    // with nothing on screen.
+    let farewell = "";
+    const leave = (message, code) => {
+        farewell = message;
+        return code;
+    };
+    const cancel = () => leave("Cancelled.\n", 130);
+    // Leaving it twice put the cursor back where the picker opened, and the
+    // shell prompt was drawn over the echoed command (found 2026-11-09).
+    let onAltScreen = true;
     try {
         // The logo is the program saying which program it is; the panel says what
         // this send will use. Both belong above the first question, not nowhere.
@@ -216,7 +291,7 @@ export async function runInteractiveConsult(io, deps) {
             options: SEND_KINDS.map((kind) => ({ label: kind.label, ...(kind.hint ? { hint: kind.hint } : {}) }))
         }, banner);
         if (kindChoice === undefined)
-            return cancel(io);
+            return cancel();
         const tools = SEND_KINDS[kindChoice].tools;
         // Only an ordinary chat has a reasoning level to choose: the tool kinds
         // bring their own pipeline, and an effort would deselect Pro under them.
@@ -231,7 +306,7 @@ export async function runInteractiveConsult(io, deps) {
                 options: efforts.map((entry) => ({ label: entry.label, ...(entry.hint ? { hint: entry.hint } : {}) }))
             }, banner);
             if (chosen === undefined)
-                return cancel(io);
+                return cancel();
             effort = efforts[chosen].effort;
         }
         const rows = (await contextPromise) ?? [];
@@ -247,37 +322,34 @@ export async function runInteractiveConsult(io, deps) {
             options: destinations.map((entry) => ({ label: entry.label, ...(entry.hint ? { hint: entry.hint } : {}) }))
         }, header);
         if (destinationChoice === undefined)
-            return cancel(io);
+            return cancel();
         const destination = destinations[destinationChoice].id;
         let projectMode = "current";
         let projectName;
         let targetUrl;
         if (destination === "continue") {
             const conversations = (await conversationsPromise) ?? [];
-            if (conversations.length === 0) {
-                io.write("\nNo recent conversations were readable. Start a new chat instead.\n");
-                return 1;
-            }
+            if (conversations.length === 0)
+                return leave("No recent conversations were readable. Start a new chat instead.\n", 1);
             const chosen = await pick(io, { title: "Which conversation?", options: conversations.map((entry) => ({ label: entry.title })) }, header);
             if (chosen === undefined)
-                return cancel(io);
+                return cancel();
             targetUrl = conversationThreadUrl(conversations[chosen].id);
         }
         else if (destination === "project") {
             const detailed = (await deps.listProjectsWithIds?.()) ?? [];
             const projects = detailed.length > 0 ? detailed : (await deps.listProjects()).map((name) => ({ id: "", name }));
-            if (projects.length === 0) {
-                io.write("\nNo projects are visible in the ChatGPT sidebar.\n");
-                return 1;
-            }
+            if (projects.length === 0)
+                return leave("No projects are visible in the ChatGPT sidebar.\n", 1);
             const chosen = await pick(io, { title: "Which project?", options: projects.map((entry) => ({ label: entry.name })) }, header);
             if (chosen === undefined)
-                return cancel(io);
+                return cancel();
             projectMode = "existing";
             projectName = projects[chosen].name;
             // Entering a project usually means going back to something in it, so
-            // offer its chats before starting yet another one.
-            const inside = conversationsInProject((await conversationsPromise) ?? [], projects[chosen].id || undefined);
+            // offer its chats before starting yet another one. A project listed by
+            // name alone has no id to match them by, so it goes straight to a new chat.
+            const inside = conversationsInProject((await conversationsPromise) ?? [], projects[chosen].id);
             if (inside.length > 0) {
                 const options = [
                     { label: "Start a new chat in this project" },
@@ -285,7 +357,7 @@ export async function runInteractiveConsult(io, deps) {
                 ];
                 const picked = await pick(io, { title: `${projects[chosen].name}`, options }, header);
                 if (picked === undefined)
-                    return cancel(io);
+                    return cancel();
                 if (picked > 0) {
                     targetUrl = conversationThreadUrl(inside[picked - 1].id);
                     projectMode = "current";
@@ -296,9 +368,9 @@ export async function runInteractiveConsult(io, deps) {
         else if (destination === "project-new") {
             projectName = await askLine(io, `${CLEAR}${header}New project\n\n  name: `);
             if (projectName === undefined)
-                return cancel(io);
+                return cancel();
             if (!projectName)
-                return cancel(io);
+                return cancel();
             projectMode = "new";
         }
         else if (destination === "no-project") {
@@ -307,14 +379,12 @@ export async function runInteractiveConsult(io, deps) {
         // The prompt comes last: what you type depends on what you just decided.
         io.write(CLEAR + header + SHOW_CURSOR);
         const kindLabel = SEND_KINDS[kindChoice].label;
-        const prompt = await askLine(io, `${kindLabel}   Step ${steps} of ${steps}\n\n  prompt: `);
+        const prompt = await askLine(io, `${kindLabel}   Step ${steps} of ${steps}\n\n  prompt: `, { multiline: true });
         io.write(HIDE_CURSOR);
         if (prompt === undefined)
-            return cancel(io);
-        if (prompt.length === 0) {
-            io.write("Nothing to ask.\n");
-            return 1;
-        }
+            return cancel();
+        if (prompt.length === 0)
+            return leave("Nothing to ask.\n", 1);
         // Uploading a file is the only way ChatGPT can open a pdf, pptx, xlsx or
         // image, and the picker had no way to say so. Asked after the prompt, and
         // skipped by pressing enter, so the common case costs one keystroke.
@@ -322,7 +392,7 @@ export async function runInteractiveConsult(io, deps) {
         const attachmentLine = await askLine(io, "\n  attach files? repo-relative paths, space separated, enter to skip\n  files: ");
         io.write(HIDE_CURSOR);
         if (attachmentLine === undefined)
-            return cancel(io);
+            return cancel();
         const attachments = parseAttachmentLine(attachmentLine);
         const choices = {
             prompt,
@@ -338,6 +408,7 @@ export async function runInteractiveConsult(io, deps) {
         // Leave the alternate screen before the send: the answer, the receipt id
         // and any blocker belong in the scrollback the user keeps.
         io.write(ALT_SCREEN_OFF + SHOW_CURSOR);
+        onAltScreen = false;
         // Hand the terminal back too. Raw mode is what let the pickers read single
         // keys, and it also turns off the terminal's own ctrl-c: the key arrives as
         // a keypress nothing is waiting for. The progress bar promises "ctrl-c to
@@ -352,11 +423,18 @@ export async function runInteractiveConsult(io, deps) {
         const timer = setInterval(() => {
             tick += 1;
             io.write(CLEAR_LINE +
-                renderProgressBar({ elapsedMs: now() - startedAt, budgetMs, label, tick, width: Math.min(28, terminalWidth() - 52) }));
+                renderProgressBar({
+                    elapsedMs: now() - startedAt,
+                    budgetMs,
+                    label,
+                    tick,
+                    width: Math.min(28, terminalWidth() - 52),
+                    columns: process.stdout.columns ?? 100
+                }));
         }, 250);
         try {
             const code = await deps.runConsult(args, (line) => {
-                label = progressLabel(line).slice(0, 60);
+                label = progressLabel(line);
             });
             clearInterval(timer);
             io.write(CLEAR_LINE);
@@ -371,15 +449,11 @@ export async function runInteractiveConsult(io, deps) {
     finally {
         keys?.dispose();
         keys = undefined;
-        io.write(ALT_SCREEN_OFF + SHOW_CURSOR);
+        io.write((onAltScreen ? ALT_SCREEN_OFF : "") + SHOW_CURSOR + farewell);
         io.input.setRawMode?.(false);
         io.input.pause();
     }
 }
-function cancel(io) {
-    io.write("\nCancelled.\n");
-    return 130;
-}
 /** Quote only what a shell would need quoted, so the echo can be pasted. */
 export function formatCommand(args) {
     return args.map((arg) => shellQuote(arg)).join(" ");