@youdie006/prodex 0.40.50 → 0.40.51

package/dist/store.js

@@ -9,7 +9,7 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertRepoRelativePath } from "./repo.js";
-import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
+import { readVerifiedUtf8File, withCrossProcessFileLock, writeVerifiedUtf8File } from "./safe-file.js";
 import { makeBridgeId, nowIso, ReceiptSchema, ResultSchema, SCHEMA_VERSION, SessionSchema, TaskSchema } from "./schema.js";
 let storeTestHooks = {};
 export function setBridgeStoreTestHooks(hooks) {
@@ -20,23 +20,10 @@ const SESSION_ID_PATTERN = /^sess_\d{8}_\d{6}_[a-z0-9-]+$/;
 const RECEIPT_ID_PATTERN = /^receipt_\d{8}_\d{6}_[a-z0-9-]+$/;
 const BRIDGE_DIRECTORY_MODE = 0o700;
 const BRIDGE_FILE_MODE = 0o600;
-// A claim is a sub-second read-modify-write; a claim lock older than this
-// belongs to a crashed holder, not a live claimer, so it can be reaped.
-const CLAIM_LOCK_STALE_MS = 60_000;
+// A task update is a sub-second read-modify-write; one waiting longer than
+// this for another is told to try again.
+const TASK_UPDATE_LOCK_WAIT_MS = 10_000;
 const RECEIPT_INTEGRITY_KEY_BYTES = 32;
-async function claimLockIsStale(lockPath) {
-    try {
-        const info = await stat(lockPath);
-        return Date.now() - info.mtimeMs > CLAIM_LOCK_STALE_MS;
-    }
-    catch (error) {
-        // Vanished between the EEXIST and the stat (the holder just released it):
-        // treat as free so the retry can grab it.
-        if (isErrorCode(error, "ENOENT"))
-            return true;
-        throw error;
-    }
-}
 const FETCHABLE_RESULT_ARTIFACT_PREFIXES = [".bridge/artifacts/pro-consults/", ".bridge/artifacts/results/"];
 export const MAX_FETCHABLE_RESULT_ARTIFACT_BYTES = 100_000;
 const MAX_BRIDGE_ARTIFACT_READ_BYTES = 1_000_000;
@@ -161,47 +148,33 @@ export class BridgeStore {
     }
     async claimTask(taskId, claimedBy) {
         // Claiming is check-then-write, so two agents that both read "new" would
-        // otherwise both write "claimed" (a silent double-claim). Serialize the
-        // whole read-modify-write behind an O_EXCL lock file so exactly one claim
-        // wins; a concurrent claimer sees the lock (or the already-claimed status
-        // after it releases) and is rejected.
-        const lockPath = path.join(this.dir("tasks"), `.${taskId}.claim.lock`);
-        let lockHandle;
-        try {
-            lockHandle = await open(lockPath, "wx", BRIDGE_FILE_MODE);
-        }
-        catch (error) {
-            if (!isErrorCode(error, "EEXIST"))
-                throw error;
-            // A claim is a fast read-modify-write, so a lock older than the staleness
-            // window belongs to a crashed holder (killed before its finally removed
-            // it), not a live claimer - otherwise it would wedge this task's claims
-            // forever. Reap the stale lock and retry the exclusive create once.
-            if (!(await claimLockIsStale(lockPath))) {
-                throw new Error(`Task ${taskId} is already being claimed by another process`);
-            }
-            await rm(lockPath, { force: true }).catch(() => undefined);
-            try {
-                lockHandle = await open(lockPath, "wx", BRIDGE_FILE_MODE);
-            }
-            catch (retryError) {
-                if (isErrorCode(retryError, "EEXIST")) {
-                    throw new Error(`Task ${taskId} is already being claimed by another process`);
-                }
-                throw retryError;
-            }
-        }
-        try {
+        // otherwise both write "claimed" (a silent double-claim). Under the task's
+        // update lock exactly one claim wins; the next one finds it claimed.
+        return this.withTaskUpdateLock(taskId, async () => {
             const task = await this.getTask(taskId);
             if (task.status !== "new") {
                 throw new Error(`Task ${taskId} is ${task.status}, not new`);
             }
-            return await this.writeClaimedTask(taskId, task, claimedBy);
-        }
-        finally {
-            await lockHandle.close().catch(() => undefined);
-            await rm(lockPath, { force: true }).catch(() => undefined);
-        }
+            return this.writeClaimedTask(taskId, task, claimedBy);
+        });
+    }
+    /**
+     * Every change to a task record is a read-modify-write, and only claims used
+     * to take a lock. Found 2026-11-09: a claim that read "new" while a
+     * completion ran wrote "claimed" over it, leaving a claimed task with no
+     * result_path next to a done result and its trusted receipt (11 of 30 tasks
+     * with real processes), and a claim lock left stale by a crashed claimer let
+     * two claimers both win, since each deleted it and made its own (6 of 15
+     * rounds). Claims and completions now share one lock per task, whose holder
+     * is a live process: a crashed holder's lock is taken over safely.
+     */
+    async withTaskUpdateLock(taskId, fn) {
+        return withCrossProcessFileLock(path.join(this.dir("tasks"), `.${taskId}.update.lock`), {
+            waitMs: TASK_UPDATE_LOCK_WAIT_MS,
+            retryMs: 25,
+            busyError: (holder) => new Error(`Task ${taskId} is being updated by another process (pid ${holder.pid ?? "unknown"}); try again.`),
+            unavailableError: () => new Error(`Task ${taskId} could not be locked for an update; try again.`)
+        }, fn);
     }
     async writeClaimedTask(taskId, task, claimedBy) {
         const updated = TaskSchema.parse({
@@ -231,6 +204,9 @@ export class BridgeStore {
         return updated;
     }
     async completeTask(taskId, input) {
+        return this.withTaskUpdateLock(taskId, () => this.completeTaskUnderLock(taskId, input));
+    }
+    async completeTaskUnderLock(taskId, input) {
         const task = await this.getTask(taskId);
         assertFetchableResultArtifacts(input.artifacts ?? []);
         assertDistinctArtifactPaths(input.artifacts ?? []);
@@ -689,7 +665,7 @@ export class BridgeStore {
         }
         throw untrustedResultError(this.root, taskId, `has no locally trusted legacy task_completed receipt to reseal: ${failures[0] ?? "local integrity unavailable"}`);
     }
-    async writeArtifactText(relativePath, content) {
+    async writeArtifactText(relativePath, content, options = {}) {
         await this.ensure();
         await this.assertBridgeDirIsRealDirectory();
         await this.assertArtifactsDirIsRealDirectory();
@@ -698,9 +674,41 @@ export class BridgeStore {
         await writeVerifiedUtf8File(artifactPath, content, async () => {
             await this.assertArtifactParentDirectory(path.dirname(artifactPath));
             await this.assertArtifactTargetInsideIfExists(artifactPath);
-        }, { create: true, mode: BRIDGE_FILE_MODE });
+        }, { create: true, mode: BRIDGE_FILE_MODE, ...(options.exclusive ? { exclusive: true } : {}) });
         return this.relativeToRoot(artifactPath);
     }
+    /**
+     * The files of `tasks complete --artifact path=text`, written only once the
+     * completion is known to be possible. They used to be written first, so a
+     * completion refused afterwards had already replaced the file: found
+     * 2026-11-09, completing a finished task again, or a mistyped task id,
+     * overwrote a saved answer, and an open task completed with another task's
+     * artifact path replaced that task's answer. A finished task's files are not
+     * touched (completeTask then refuses, or accepts the same result again), and
+     * a path that already holds other text is refused.
+     */
+    async writeResultArtifactTexts(taskId, texts) {
+        const task = await this.getTask(taskId);
+        const artifacts = texts.map((text) => ({ path: this.relativeToRoot(this.resolveArtifactPath(text.path)), role: "result" }));
+        assertFetchableResultArtifacts(artifacts);
+        assertDistinctArtifactPaths(artifacts);
+        if (task.status === "done" || task.status === "blocked")
+            return artifacts;
+        for (const [index, text] of texts.entries()) {
+            const stored = artifacts[index].path;
+            try {
+                await this.writeArtifactText(stored, text.content, { exclusive: true });
+            }
+            catch (error) {
+                if (!isErrorCode(error, "EEXIST"))
+                    throw error;
+                if ((await this.readArtifactText(stored)) === text.content)
+                    continue;
+                throw new Error(`${stored} already exists with other content; give this result an artifact path of its own.`);
+            }
+        }
+        return artifacts;
+    }
     async hasArtifactText(relativePath) {
         const artifactPath = this.resolveArtifactPath(relativePath);
         try {
@@ -758,10 +766,21 @@ export class BridgeStore {
         await this.assertBridgeDirIsRealDirectory();
         await this.assertArtifactsDirIsRealDirectory();
         const artifactPath = this.resolveArtifactPath(relativePath);
-        await this.assertArtifactParentDirectory(path.dirname(artifactPath));
-        return readVerifiedUtf8File(artifactPath, () => this.assertArtifactTargetInside(artifactPath), {
-            maxBytes: options.maxBytes ?? MAX_BRIDGE_ARTIFACT_READ_BYTES
-        });
+        try {
+            await this.assertArtifactParentDirectory(path.dirname(artifactPath));
+            return await readVerifiedUtf8File(artifactPath, () => this.assertArtifactTargetInside(artifactPath), {
+                maxBytes: options.maxBytes ?? MAX_BRIDGE_ARTIFACT_READ_BYTES
+            });
+        }
+        catch (error) {
+            // The raw error named the machine's absolute path, often of the parent
+            // directory rather than the file, and went out to MCP clients as it was
+            // (found 2026-11-09). The code stays ENOENT for callers that test it.
+            if (isErrorCode(error, "ENOENT")) {
+                throw Object.assign(new Error(`Artifact not found: ${this.relativeToRoot(artifactPath)}`), { code: "ENOENT" });
+            }
+            throw error;
+        }
     }
     async writeReceipt(input) {
         await this.ensure();
@@ -889,9 +908,9 @@ export class BridgeStore {
     // The key file holds one 32-byte hex key per line: the first line signs new
     // receipts, later lines are legacy keys kept so pre-rotation receipts verify.
     async readReceiptIntegrityKeys() {
-        const lines = (await readVerifiedUtf8File(this.receiptIntegrityKeyPath(), () => this.assertReceiptIntegrityKeyTargetSafe({ allowMissing: false }), {
+        const lines = (await readReplacedFileText(() => readVerifiedUtf8File(this.receiptIntegrityKeyPath(), () => this.assertReceiptIntegrityKeyTargetSafe({ allowMissing: false }), {
             mode: BRIDGE_FILE_MODE
-        }))
+        })))
             .split(/\r?\n/)
             .map((line) => line.trim())
             .filter((line) => line.length > 0);
@@ -1004,7 +1023,7 @@ export class BridgeStore {
             if (options.cleanupTempHardLinks ?? true) {
                 await this.cleanupRecordTempHardLinks(kind, filePath);
             }
-            const raw = await readVerifiedUtf8File(filePath, () => this.assertRecordTargetInside(kind, filePath));
+            const raw = await readReplacedFileText(() => readVerifiedUtf8File(filePath, () => this.assertRecordTargetInside(kind, filePath)));
             try {
                 return JSON.parse(raw);
             }
@@ -1467,6 +1486,26 @@ function recordLabel(kind) {
             return "Receipt";
     }
 }
+// Records and the receipt key are replaced by renaming a new file over them,
+// and a read that opened the old file and then found the new one at the path
+// failed as "Target path changed during read file operation": found
+// 2026-11-09, 115 of 908 reads failed while another process rewrote a
+// session, and `tasks list` failed the same way during a consult. Reading
+// again opens the new file and runs every check again; any other failure,
+// a symlink swap among them, is not retried.
+const REPLACED_FILE_READ_ATTEMPTS = 5;
+export async function readReplacedFileText(read) {
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            return await read();
+        }
+        catch (error) {
+            const replaced = error instanceof Error && error.message === "Target path changed during read file operation";
+            if (!replaced || attempt >= REPLACED_FILE_READ_ATTEMPTS)
+                throw error;
+        }
+    }
+}
 function isErrorCode(error, code) {
     return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }

package/dist/tui-run.js

@@ -10,7 +10,7 @@ import readline from "node:readline";
 import { renderBanner } from "./banner.js";
 import { shellQuote } from "./cli-args.js";
 import { destinationChoices, effortChoices, SEND_KINDS } from "./tui-flow.js";
-import { consultArgsFromChoices, conversationsInProject, conversationThreadUrl, moveCursor, parseAttachmentLine, progressLabel, renderContextPanel, renderProgressBar, renderSelectList } from "./tui.js";
+import { consultArgsFromChoices, conversationsInProject, conversationThreadUrl, displayWidth, moveCursor, parseAttachmentLine, progressLabel, renderContextPanel, renderProgressBar, renderSelectList } from "./tui.js";
 const ESC = "";
 const CLEAR = `${ESC}[2J${ESC}[H`;
 // The alternate screen buffer: the terminal comes back exactly as it was, so a
@@ -20,6 +20,15 @@ const ALT_SCREEN_OFF = `${ESC}[?1049l`;
 const CLEAR_LINE = `${ESC}[2K\r`;
 const HIDE_CURSOR = `${ESC}[?25l`;
 const SHOW_CURSOR = `${ESC}[?25h`;
+// Bracketed paste: the terminal wraps a paste in ESC[200~ ... ESC[201~, which
+// readline reports as "paste-start" and "paste-end" keys and otherwise ignores.
+const BRACKETED_PASTE_ON = `${ESC}[?2004h`;
+const BRACKETED_PASTE_OFF = `${ESC}[?2004l`;
+// How long an Enter at the prompt waits before it ends the prompt. A terminal
+// that does not mark pastes sends one as typed keys, its line breaks included,
+// and the rest of it follows in the same read or milliseconds later; a person
+// does not type the next key that fast.
+const PASTE_SETTLE_MS = 100;
 /**
  * Keys are queued by one long-lived listener rather than a listener attached
  * per read.
@@ -136,19 +145,37 @@ function numericChoice(key, length) {
         return undefined;
     return digit - 1;
 }
-/** Read one line with the terminal back in cooked mode, so editing works. */
-async function askLine(io, question) {
+/**
+ * Read one answer with the terminal back in line-editing mode, so editing works.
+ *
+ * `multiline` is for the prompt, which is often pasted. readline ends a line at
+ * every line break, so a pasted stack trace used to be sent as its first line
+ * and the rest dropped. With it, a paste's line breaks stay in the answer and
+ * only an Enter typed on its own ends it.
+ */
+async function askLine(io, question, options = {}) {
     io.input.setRawMode?.(false);
-    const rl = readline.createInterface({ input: io.input, output: process.stdout, terminal: true });
+    const rl = readline.createInterface({ input: io.input, output: process.stdout, terminal: true, historySize: 0 });
+    // Later lines of a prompt sit under its first line, not at the margin.
+    const continuation = " ".repeat(displayWidth(question.slice(question.lastIndexOf("\n") + 1)));
     try {
+        if (options.multiline)
+            io.write(BRACKETED_PASTE_ON);
         const answer = await new Promise((resolve) => {
+            const lines = [];
+            let pasting = false;
+            let previousKey;
+            let ending;
             let settled = false;
             function settle(value) {
                 if (settled)
                     return;
                 settled = true;
+                clearTimeout(ending);
                 rl.off("SIGINT", onInterrupt);
                 rl.off("close", onClose);
+                rl.off("line", onLine);
+                io.input.off("keypress", onKey);
                 resolve(value);
             }
             function onInterrupt() {
@@ -157,14 +184,50 @@ async function askLine(io, question) {
             function onClose() {
                 settle(undefined);
             }
+            // Sees each key before readline does.
+            function onKey(_text, key) {
+                const name = key?.name;
+                // A line feed straight after a carriage return is the same Enter.
+                const sameEnter = name === "enter" && previousKey === "return";
+                previousKey = name;
+                // Input right behind an Enter means the Enter was a line break inside a
+                // paste the terminal did not mark, so the prompt goes on.
+                if (ending !== undefined && !sameEnter) {
+                    clearTimeout(ending);
+                    ending = undefined;
+                }
+                if (name === "paste-start")
+                    pasting = true;
+                else if (name === "paste-end")
+                    pasting = false;
+            }
+            function onLine(line) {
+                if (!options.multiline) {
+                    settle(line);
+                    return;
+                }
+                lines.push(line);
+                rl.setPrompt(continuation);
+                rl.prompt();
+                if (!pasting)
+                    ending = setTimeout(() => settle(lines.join("\n")), PASTE_SETTLE_MS);
+            }
             rl.once("SIGINT", onInterrupt);
             rl.once("close", onClose);
-            rl.question(question, (value) => settle(value));
+            rl.on("line", onLine);
+            if (options.multiline)
+                io.input.prependListener("keypress", onKey);
+            rl.setPrompt(question);
+            rl.prompt();
         });
         return answer?.trim();
     }
     finally {
         rl.close();
+        // Turned off on every way out, ctrl-c and end of input included: left on,
+        // the shell would receive the markers around every later paste.
+        if (options.multiline)
+            io.write(BRACKETED_PASTE_OFF);
         // Closing the line reader detaches the keypress plumbing and pauses the
         // stream, so the next picker would sit there ignoring every key. Re-arm both.
         io.input.setRawMode?.(true);
@@ -196,6 +259,18 @@ export async function runInteractiveConsult(io, deps) {
     keys = new KeyQueue(io.input);
     io.write(ALT_SCREEN_ON + HIDE_CURSOR);
     let header = "";
+    // Why the picker stopped is written once the alternate screen is gone.
+    // Written while it was up, the reason vanished with it and the picker exited
+    // with nothing on screen.
+    let farewell = "";
+    const leave = (message, code) => {
+        farewell = message;
+        return code;
+    };
+    const cancel = () => leave("Cancelled.\n", 130);
+    // Leaving it twice put the cursor back where the picker opened, and the
+    // shell prompt was drawn over the echoed command (found 2026-11-09).
+    let onAltScreen = true;
     try {
         // The logo is the program saying which program it is; the panel says what
         // this send will use. Both belong above the first question, not nowhere.
@@ -216,7 +291,7 @@ export async function runInteractiveConsult(io, deps) {
             options: SEND_KINDS.map((kind) => ({ label: kind.label, ...(kind.hint ? { hint: kind.hint } : {}) }))
         }, banner);
         if (kindChoice === undefined)
-            return cancel(io);
+            return cancel();
         const tools = SEND_KINDS[kindChoice].tools;
         // Only an ordinary chat has a reasoning level to choose: the tool kinds
         // bring their own pipeline, and an effort would deselect Pro under them.
@@ -231,7 +306,7 @@ export async function runInteractiveConsult(io, deps) {
                 options: efforts.map((entry) => ({ label: entry.label, ...(entry.hint ? { hint: entry.hint } : {}) }))
             }, banner);
             if (chosen === undefined)
-                return cancel(io);
+                return cancel();
             effort = efforts[chosen].effort;
         }
         const rows = (await contextPromise) ?? [];
@@ -247,37 +322,34 @@ export async function runInteractiveConsult(io, deps) {
             options: destinations.map((entry) => ({ label: entry.label, ...(entry.hint ? { hint: entry.hint } : {}) }))
         }, header);
         if (destinationChoice === undefined)
-            return cancel(io);
+            return cancel();
         const destination = destinations[destinationChoice].id;
         let projectMode = "current";
         let projectName;
         let targetUrl;
         if (destination === "continue") {
             const conversations = (await conversationsPromise) ?? [];
-            if (conversations.length === 0) {
-                io.write("\nNo recent conversations were readable. Start a new chat instead.\n");
-                return 1;
-            }
+            if (conversations.length === 0)
+                return leave("No recent conversations were readable. Start a new chat instead.\n", 1);
             const chosen = await pick(io, { title: "Which conversation?", options: conversations.map((entry) => ({ label: entry.title })) }, header);
             if (chosen === undefined)
-                return cancel(io);
+                return cancel();
             targetUrl = conversationThreadUrl(conversations[chosen].id);
         }
         else if (destination === "project") {
             const detailed = (await deps.listProjectsWithIds?.()) ?? [];
             const projects = detailed.length > 0 ? detailed : (await deps.listProjects()).map((name) => ({ id: "", name }));
-            if (projects.length === 0) {
-                io.write("\nNo projects are visible in the ChatGPT sidebar.\n");
-                return 1;
-            }
+            if (projects.length === 0)
+                return leave("No projects are visible in the ChatGPT sidebar.\n", 1);
             const chosen = await pick(io, { title: "Which project?", options: projects.map((entry) => ({ label: entry.name })) }, header);
             if (chosen === undefined)
-                return cancel(io);
+                return cancel();
             projectMode = "existing";
             projectName = projects[chosen].name;
             // Entering a project usually means going back to something in it, so
-            // offer its chats before starting yet another one.
-            const inside = conversationsInProject((await conversationsPromise) ?? [], projects[chosen].id || undefined);
+            // offer its chats before starting yet another one. A project listed by
+            // name alone has no id to match them by, so it goes straight to a new chat.
+            const inside = conversationsInProject((await conversationsPromise) ?? [], projects[chosen].id);
             if (inside.length > 0) {
                 const options = [
                     { label: "Start a new chat in this project" },
@@ -285,7 +357,7 @@ export async function runInteractiveConsult(io, deps) {
                 ];
                 const picked = await pick(io, { title: `${projects[chosen].name}`, options }, header);
                 if (picked === undefined)
-                    return cancel(io);
+                    return cancel();
                 if (picked > 0) {
                     targetUrl = conversationThreadUrl(inside[picked - 1].id);
                     projectMode = "current";
@@ -296,9 +368,9 @@ export async function runInteractiveConsult(io, deps) {
         else if (destination === "project-new") {
             projectName = await askLine(io, `${CLEAR}${header}New project\n\n  name: `);
             if (projectName === undefined)
-                return cancel(io);
+                return cancel();
             if (!projectName)
-                return cancel(io);
+                return cancel();
             projectMode = "new";
         }
         else if (destination === "no-project") {
@@ -307,14 +379,12 @@ export async function runInteractiveConsult(io, deps) {
         // The prompt comes last: what you type depends on what you just decided.
         io.write(CLEAR + header + SHOW_CURSOR);
         const kindLabel = SEND_KINDS[kindChoice].label;
-        const prompt = await askLine(io, `${kindLabel}   Step ${steps} of ${steps}\n\n  prompt: `);
+        const prompt = await askLine(io, `${kindLabel}   Step ${steps} of ${steps}\n\n  prompt: `, { multiline: true });
         io.write(HIDE_CURSOR);
         if (prompt === undefined)
-            return cancel(io);
-        if (prompt.length === 0) {
-            io.write("Nothing to ask.\n");
-            return 1;
-        }
+            return cancel();
+        if (prompt.length === 0)
+            return leave("Nothing to ask.\n", 1);
         // Uploading a file is the only way ChatGPT can open a pdf, pptx, xlsx or
         // image, and the picker had no way to say so. Asked after the prompt, and
         // skipped by pressing enter, so the common case costs one keystroke.
@@ -322,7 +392,7 @@ export async function runInteractiveConsult(io, deps) {
         const attachmentLine = await askLine(io, "\n  attach files? repo-relative paths, space separated, enter to skip\n  files: ");
         io.write(HIDE_CURSOR);
         if (attachmentLine === undefined)
-            return cancel(io);
+            return cancel();
         const attachments = parseAttachmentLine(attachmentLine);
         const choices = {
             prompt,
@@ -338,6 +408,7 @@ export async function runInteractiveConsult(io, deps) {
         // Leave the alternate screen before the send: the answer, the receipt id
         // and any blocker belong in the scrollback the user keeps.
         io.write(ALT_SCREEN_OFF + SHOW_CURSOR);
+        onAltScreen = false;
         // Hand the terminal back too. Raw mode is what let the pickers read single
         // keys, and it also turns off the terminal's own ctrl-c: the key arrives as
         // a keypress nothing is waiting for. The progress bar promises "ctrl-c to
@@ -352,11 +423,18 @@ export async function runInteractiveConsult(io, deps) {
         const timer = setInterval(() => {
             tick += 1;
             io.write(CLEAR_LINE +
-                renderProgressBar({ elapsedMs: now() - startedAt, budgetMs, label, tick, width: Math.min(28, terminalWidth() - 52) }));
+                renderProgressBar({
+                    elapsedMs: now() - startedAt,
+                    budgetMs,
+                    label,
+                    tick,
+                    width: Math.min(28, terminalWidth() - 52),
+                    columns: process.stdout.columns ?? 100
+                }));
         }, 250);
         try {
             const code = await deps.runConsult(args, (line) => {
-                label = progressLabel(line).slice(0, 60);
+                label = progressLabel(line);
             });
             clearInterval(timer);
             io.write(CLEAR_LINE);
@@ -371,15 +449,11 @@ export async function runInteractiveConsult(io, deps) {
     finally {
         keys?.dispose();
         keys = undefined;
-        io.write(ALT_SCREEN_OFF + SHOW_CURSOR);
+        io.write((onAltScreen ? ALT_SCREEN_OFF : "") + SHOW_CURSOR + farewell);
         io.input.setRawMode?.(false);
         io.input.pause();
     }
 }
-function cancel(io) {
-    io.write("\nCancelled.\n");
-    return 130;
-}
 /** Quote only what a shell would need quoted, so the echo can be pasted. */
 export function formatCommand(args) {
     return args.map((arg) => shellQuote(arg)).join(" ");

package/dist/tui.js

@@ -120,10 +120,13 @@ export function projectsWithIdsExpression() {
   return out;
 })()`;
 }
-/** The conversations that live inside a project, or all of them without one. */
+/**
+ * The conversations that live inside a project. A project whose id is unknown
+ * claims none: returning all of them listed unrelated chats under its name.
+ */
 export function conversationsInProject(conversations, projectId) {
     if (!projectId)
-        return conversations;
+        return [];
     return conversations.filter((conversation) => conversation.gizmoId === projectId);
 }
 /**
@@ -358,12 +361,26 @@ export function renderProgressBar(input) {
     // Saying how to abort belongs on the waiting line itself: a consult can run
     // for many minutes and the only other thing on screen is the bar.
     const stop = "ctrl-c to stop";
-    if (!input.budgetMs || input.budgetMs <= 0)
-        return `${spinner} ${input.label}  ${elapsed}  ${stop}`;
-    const width = Math.max(4, input.width ?? 28);
-    const ratio = input.elapsedMs / input.budgetMs;
-    const filled = Math.min(width, Math.round(Math.min(ratio, 1) * width));
-    const bar = `${"#".repeat(filled)}${"-".repeat(width - filled)}`;
-    const over = ratio > 1 ? "  over budget" : "";
-    return `${spinner} [${bar}] ${elapsed} / ${formatElapsed(input.budgetMs)}  ${input.label}${over}  ${stop}`;
+    let compose;
+    if (!input.budgetMs || input.budgetMs <= 0) {
+        compose = (label) => `${spinner} ${label}  ${elapsed}  ${stop}`;
+    }
+    else {
+        const width = Math.max(4, input.width ?? 28);
+        const ratio = input.elapsedMs / input.budgetMs;
+        const filled = Math.min(width, Math.round(Math.min(ratio, 1) * width));
+        const bar = `${"#".repeat(filled)}${"-".repeat(width - filled)}`;
+        const over = ratio > 1 ? "  over budget" : "";
+        const budget = formatElapsed(input.budgetMs);
+        compose = (label) => `${spinner} [${bar}] ${elapsed} / ${budget}  ${label}${over}  ${stop}`;
+    }
+    const line = compose(input.label);
+    if (input.columns === undefined || displayWidth(line) < input.columns)
+        return line;
+    // The line is redrawn in place, and one that wraps leaves a row behind on
+    // every redraw (found 2026-11-09: 102 columns at 80, a new row every 250
+    // ms). The label gives way first; a terminal too narrow even for the rest
+    // gets the line cut.
+    const room = input.columns - 1 - displayWidth(compose(""));
+    return truncateToWidth(compose(room > 0 ? truncateToWidth(input.label, room) : ""), input.columns - 1);
 }

package/docs/clients.md

@@ -91,6 +91,17 @@ ChatGPT is still generating. Recover that marked request instead of resending it
 The separate `prodex start` HTTP server runs in the foreground and also needs its
 own process kept alive; neither command installs a background service.
 
+Cancelling a `pro_consult` (Esc in the client, or the client's own tool timeout,
+both of which send `notifications/cancelled`) stops it while its prompt has not been
+submitted: nothing is sent, the consult is recorded as blocked with
+`consult_cancelled`, and a follow-up spends none of its budget. After the prompt is
+submitted, cancelling changes nothing on prodex's side: the answer is still waited
+for and saved to the consult's record.
+
+One stdio message may be up to 128 MiB, which covers the largest call any tool
+accepts. A larger one ends the server with exit code 1 and a one-line reason on
+stderr, so the client sees the server go away instead of waiting on it.
+
 ## Claude Code
 
 See [claude.md](claude.md), or:

package/docs/http-mcp.md

@@ -19,6 +19,7 @@ Typical use:
 
 The server is personal and local-first. Do not expose it as a shared service.
 HTTP MCP requests are bounded: malformed JSON returns `400`, and request bodies over 1 MiB are rejected with `413`.
+Sessions are bounded too. A session with no request for 30 minutes and no stream open is closed, and at most 100 sessions are kept: initializing one more closes the least recently used. A request carrying a closed session's `Mcp-Session-Id` gets `404`, as an unknown id does, and MCP clients answer that by initializing a new session.
 
 ## Build And Prepare
 
@@ -193,8 +194,9 @@ The HTTP server exposes the same tool catalog as stdio MCP:
 Writes are deliberately gated and require a git worktree with a committed HEAD:
 
 1. `repo_write_file_dry_run` previews replacing an existing repo-relative text file. It records the diff, git HEAD, preimage hash, and a replacement-text artifact under `.bridge/artifacts/repo-writes/`.
+   The file keeps its CRLF line endings, UTF-8 BOM and final newline when the new content leaves them out, and apply keeps its file mode, so an edited script stays executable. A file that is not UTF-8 text (EUC-KR, Latin-1, UTF-16) is refused rather than re-encoded.
 2. `repo_write_file_apply` applies that exact receipt only if git HEAD, file path, preimage hash, and artifact content still match.
-3. `repo_stage_reviewed_paths` stages only files backed by matching applied write receipts.
+3. `repo_stage_reviewed_paths` stages only files backed by matching applied write receipts. Their paths reach git literally, so a name such as `pages/[id].tsx` stages that file and nothing it would match as a pattern.
 
 There is no direct ungated write tool and no shell execution tool.