@youdie006/prodex 0.40.6 → 0.40.8

package/dist/issue-report.js

@@ -24,14 +24,18 @@ export function issueAreaLabel(code) {
 /**
  * Build the report. Only the failure travels: never the prompt, the answer, or
  * the summary, because a public issue must not become where a private consult
- * leaks. Everything included here is either environment or blocker metadata.
+ * leaks. Blocker prose can contain answers, paths and thread URLs, so it stays
+ * local too. Public reports carry a code and a fixed diagnostic summary.
  */
 export function buildIssueReport(consult, environment) {
     if (consult.status !== "blocked" || !consult.blocker) {
         throw new Error(`${consult.task_id} is not a failure (status ${consult.status}), so there is nothing to report.`);
     }
-    const code = (consult.blocker.code ?? "unknown").trim();
-    const message = (consult.blocker.message ?? "").trim();
+    const rawCode = (consult.blocker.code ?? "unknown").trim();
+    const code = /^[a-z][a-z0-9_]{0,79}$/.test(rawCode) ? rawCode : "unknown";
+    const message = code === "smoke_token_mismatch"
+        ? "The browser response did not match the smoke-test token."
+        : "Consult blocked; detailed diagnostics are kept in the local receipt.";
     const area = issueAreaLabel(code);
     const body = [
         "A consult was blocked. Filed from its receipt, so the prompt and the answer are not included.",
@@ -45,7 +49,8 @@ export function buildIssueReport(consult, environment) {
         `| platform | ${environment.platform} |`,
         `| node | ${environment.nodeVersion} |`,
         "",
-        ...(consult.blocker.next_step ? ["What it told the caller to do:", "", `> ${consult.blocker.next_step}`, ""] : []),
+        "Private error details and recovery instructions are omitted. Review the local receipt before sharing more context.",
+        "",
         "Receipt (local, not attached): " + consult.task_id
     ].join("\n");
     return {

package/dist/mcp-tools.js

@@ -4,6 +4,33 @@ import { applyRepoWriteDryRun, createRepoWriteDryRun, stageReviewedPaths } from
 export const MAX_MCP_BRIDGE_TEXT_BYTES = MAX_FETCHABLE_RESULT_ARTIFACT_BYTES;
 export const MAX_MCP_SHORT_TEXT_BYTES = 10_000;
 const MAX_MCP_LIST_ITEMS = 100;
+function redactContextText(text, privateValues = []) {
+    let redacted = text;
+    for (const value of privateValues) {
+        if (value)
+            redacted = redacted.replaceAll(value, "[redacted]");
+    }
+    return redacted.replace(/https?:\/\/(?:chatgpt\.com|chat\.openai\.com)(?![\w.-])(?:[/?#][^\s<>"'`)]*)?/gi, "[redacted ChatGPT URL]");
+}
+function redactBlockerForMcp(blocker, privateValues = []) {
+    if (!blocker)
+        return undefined;
+    const context = [blocker.thread, ...privateValues];
+    return {
+        code: blocker.code,
+        message: redactContextText(blocker.message, context),
+        retryable: blocker.retryable,
+        ...(blocker.next_step !== undefined ? { next_step: redactContextText(blocker.next_step, context) } : {})
+    };
+}
+function redactResultForMcp(result) {
+    return {
+        ...result,
+        summary: result.status === "blocked" ? redactContextText(result.summary, [result.blocker?.thread]) : result.summary,
+        blocker: redactBlockerForMcp(result.blocker),
+        warnings: result.warnings.map((warning) => redactContextText(warning, [result.blocker?.thread]))
+    };
+}
 /**
  * Drop the ChatGPT project name and thread URL before a session crosses the
  * MCP boundary. Both are personal context (the same way receipts redact the
@@ -17,6 +44,8 @@ function redactSessionForMcp(session) {
         redacted.project = undefined;
     if (Object.hasOwn(redacted, "thread"))
         redacted.thread = undefined;
+    redacted.blocker = redactBlockerForMcp(session.blocker, [session.thread, session.project]);
+    redacted.warnings = session.warnings.map((warning) => redactContextText(warning, [session.thread, session.project]));
     return redacted;
 }
 /**
@@ -27,17 +56,20 @@ function redactSessionForMcp(session) {
  * raw task file keeps them for local CLI inspection.
  */
 function redactTaskForMcp(task) {
-    if (!task || typeof task !== "object" || !("provenance" in task) || !task.provenance)
-        return task;
     const provenance = task.provenance;
-    if (!Object.hasOwn(provenance, "thread") && !Object.hasOwn(provenance, "project"))
-        return task;
     const redactedProvenance = { ...provenance };
     if (Object.hasOwn(redactedProvenance, "thread"))
         redactedProvenance.thread = undefined;
     if (Object.hasOwn(redactedProvenance, "project"))
         redactedProvenance.project = undefined;
-    return { ...task, provenance: redactedProvenance };
+    if (provenance?.warnings) {
+        redactedProvenance.warnings = provenance.warnings.map((warning) => redactContextText(warning, [provenance.thread, provenance.project]));
+    }
+    return {
+        ...task,
+        ...(provenance ? { provenance: redactedProvenance } : {}),
+        blocker: redactBlockerForMcp(task.blocker, [provenance?.thread, provenance?.project])
+    };
 }
 export function createMcpToolHandlers(context) {
     const store = new BridgeStore(context.cwd, {
@@ -71,7 +103,7 @@ export function createMcpToolHandlers(context) {
         async bridge_claim_task(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
             assertMcpTextField(input.claimed_by, "claimed_by", MAX_MCP_SHORT_TEXT_BYTES);
-            return { task: await store.claimTask(input.task_id, input.claimed_by ?? claimedBy) };
+            return { task: redactTaskForMcp(await store.claimTask(input.task_id, input.claimed_by ?? claimedBy)) };
         },
         async bridge_complete_task(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
@@ -87,7 +119,7 @@ export function createMcpToolHandlers(context) {
                 warnings: input.warnings,
                 provenance: { adapter: "mcp" }
             });
-            return { result };
+            return { result: redactResultForMcp(result) };
         },
         async bridge_block_task(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
@@ -111,14 +143,14 @@ export function createMcpToolHandlers(context) {
                 },
                 provenance: { adapter: "mcp" }
             });
-            return { result };
+            return { result: redactResultForMcp(result) };
         },
         async bridge_list_results() {
-            return { results: await store.listFinalizedResultsReadOnly() };
+            return { results: (await store.listFinalizedResultsReadOnly()).map(redactResultForMcp) };
         },
         async bridge_fetch_result(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
-            return { result: await store.getFinalizedResultReadOnly(input.task_id) };
+            return { result: redactResultForMcp(await store.getFinalizedResultReadOnly(input.task_id)) };
         },
         async bridge_fetch_result_artifact(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);

package/dist/mcp.js

@@ -183,7 +183,7 @@ export function createServer(cwd = process.cwd(), options = {}) {
                     .array(McpShortTextSchema)
                     .max(4)
                     .optional()
-                    .describe("ChatGPT composer tools to enable for this consult: \"deep-research\" (a browsed report; prodex presses start and waits out the run, which takes about ten minutes, so the timeout rises to 30 minutes automatically and the FULL report comes back as the answer - if the budget still runs out, the blocker carries the thread and pro_recover collects the report later), \"web-search\" (current facts, with the sources kept as links), \"create-image\". Deep research sometimes replies with a CLARIFYING QUESTION instead; answer it with a normal follow-up consult in the same thread."),
+                    .describe("Rendered ChatGPT composer tools: \"web-search\" or \"create-image\". Only rendered answer content is returned. Automatic deep-research report retrieval is unsupported; requesting \"deep-research\" stops before sending. Use Deep research manually in the ChatGPT UI."),
                 attach: z
                     .array(McpShortTextSchema)
                     .max(10)
@@ -233,7 +233,7 @@ export function createServer(cwd = process.cwd(), options = {}) {
     const browserRecover = options.browserRecover;
     if (browserRecover) {
         server.registerTool("pro_recover", {
-            description: "Fetch a ChatGPT answer that finished AFTER a consult stopped waiting, and record it as a normal consult receipt. Use this whenever pro_consult came back with a timeout or a still-running blocker: those carry the thread URL, and the answer is almost always sitting in that thread. This is also how a deep research report is collected - a research run takes about ten minutes and keeps going even when the consult that started it has already returned. It sends no prompt, but it does navigate the visible tab to that thread, so it waits for any consult still streaming rather than walking the browser off it.",
+            description: "Read a stable, finished assistant answer rendered in the requested ChatGPT thread after a consult stopped waiting, and record a receipt. It sends no prompt and acquires the shared send lock before navigating. Wrong-thread, generating, missing, or changing answers are refused. Hidden transcripts and deep-research report retrieval are unsupported; inspect those manually in ChatGPT.",
             inputSchema: {
                 thread: McpShortTextSchema.min(1).describe("The ChatGPT conversation URL from the blocker (its `thread` field)."),
                 timeout_ms: z.number().int().positive().max(600_000).optional()

package/dist/registry.js

@@ -1,6 +1,8 @@
+import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 const SCHEMA_VERSION = 1;
 /**
  * Central registry of every bridge root on this machine, so local indexers
@@ -86,6 +88,7 @@ async function registerBridgeRootInner(root) {
     try {
         const file = bridgesRegistryPath();
         const abs = await canonicalize(root);
+        const parentRealPath = await preparePrivateRegistryParent(file);
         // Read-modify-write with a bounded verify-retry: rename gives torn-write
         // atomicity but not lost-update safety - two processes registering
         // DIFFERENT roots at the same instant would each read the old list and
@@ -95,7 +98,7 @@ async function registerBridgeRootInner(root) {
         for (let attempt = 0; attempt < 5; attempt++) {
             let roots = [];
             try {
-                const parsed = JSON.parse(await fs.readFile(file, "utf8"));
+                const parsed = JSON.parse(await readRegistryFileForWrite(file, parentRealPath));
                 if (Array.isArray(parsed?.roots)) {
                     roots = parsed.roots.filter((r) => typeof r === "string");
                 }
@@ -115,13 +118,19 @@ async function registerBridgeRootInner(root) {
             }
             survivors.push(abs);
             roots = survivors.length > MAX_REGISTRY_ROOTS ? survivors.slice(survivors.length - MAX_REGISTRY_ROOTS) : survivors;
-            await fs.mkdir(path.dirname(file), { recursive: true });
-            const tmp = `${file}.${process.pid}.${attempt}.tmp`;
-            await fs.writeFile(tmp, `${JSON.stringify({ schema_version: SCHEMA_VERSION, roots }, null, 2)}\n`, "utf8");
-            await fs.rename(tmp, file);
+            const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
+            try {
+                await writeVerifiedUtf8File(tmp, `${JSON.stringify({ schema_version: SCHEMA_VERSION, roots }, null, 2)}\n`, () => assertRegistryWritePathsSafe(file, parentRealPath), { create: true, exclusive: true, mode: 0o600 });
+                await assertRegistryWritePathsSafe(file, parentRealPath);
+                await fs.rename(tmp, file);
+            }
+            catch (error) {
+                await cleanupRegistryTemp(tmp, parentRealPath);
+                throw error;
+            }
             // Verify our root survived a concurrent writer's rename.
             try {
-                const check = JSON.parse(await fs.readFile(file, "utf8"));
+                const check = JSON.parse(await readRegistryFileForWrite(file, parentRealPath));
                 if (Array.isArray(check?.roots) && check.roots.includes(abs))
                     return;
             }
@@ -134,3 +143,42 @@ async function registerBridgeRootInner(root) {
         // Advisory registry - never let it fail a bridge operation.
     }
 }
+async function preparePrivateRegistryParent(file) {
+    const parent = path.dirname(file);
+    await fs.mkdir(parent, { recursive: true, mode: 0o700 });
+    const parentStat = await fs.lstat(parent);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+        throw new Error("Registry parent must be a real directory and must not be a symlink");
+    }
+    await fs.chmod(parent, 0o700);
+    return fs.realpath(parent);
+}
+async function assertRegistryWritePathsSafe(file, parentRealPath) {
+    const parent = path.dirname(file);
+    const parentStat = await fs.lstat(parent);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory() || (await fs.realpath(parent)) !== parentRealPath) {
+        throw new Error("Registry parent changed during write");
+    }
+    try {
+        const targetStat = await fs.lstat(file);
+        if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+            throw new Error("Registry target must be a regular file and must not be a symlink");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+function readRegistryFileForWrite(file, parentRealPath) {
+    return readVerifiedUtf8File(file, () => assertRegistryWritePathsSafe(file, parentRealPath), { maxBytes: 1_000_000 });
+}
+async function cleanupRegistryTemp(tmp, parentRealPath) {
+    try {
+        if ((await fs.realpath(path.dirname(tmp))) === parentRealPath)
+            await fs.rm(tmp, { force: true });
+    }
+    catch {
+        // Do not follow a parent that changed while the advisory write was in flight.
+    }
+}

package/dist/repo-write.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
+import { realpath } from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 import { assertResolvedRepoPathAllowed, resolveRepoPath } from "./repo.js";
-import { readVerifiedUtf8File, replaceVerifiedUtf8File } from "./safe-file.js";
+import { readVerifiedUtf8File, replaceVerifiedUtf8File, withCrossProcessFileLock } from "./safe-file.js";
 const execFileAsync = promisify(execFile);
 const MAX_WRITE_BYTES = 1_000_000;
 let testHooks = {};
@@ -73,8 +74,28 @@ export async function applyRepoWriteDryRun(root, store, input) {
     if (metadata.preimage_sha256 !== input.preimage_sha256) {
         throw new Error(`Expected preimage does not match dry-run receipt`);
     }
+    const newContent = await readDryRunReplacementContent(store, metadata);
+    const resolvedPath = resolveRepoPath(root, metadata.path);
+    await assertResolvedRepoPathAllowed(root, resolvedPath, metadata.path);
+    const canonicalTarget = await realpath(resolvedPath);
+    const canonicalRoot = await realpath(root);
+    const lockFile = path.join(canonicalRoot, ".bridge", `.repo-write-${sha256(canonicalTarget)}.lock`);
+    // This ownership interval closes races among prodex applies. An editor that
+    // does not participate in the lock protocol can still replace the path.
+    return withCrossProcessFileLock(lockFile, {
+        waitMs: 30_000,
+        retryMs: 25,
+        privateParent: true,
+        busyError: (holder) => new Error(`Another prodex repo write for ${metadata.path} is in progress (pid ${holder.pid ?? "unknown"})`),
+        unavailableError: () => new Error(`The prodex repo write lock at ${lockFile} could not be recovered. Stop all writers before removing that lock and its matching .reap claim, then retry.`)
+    }, () => applyRepoWriteUnderLock(root, store, input, metadata, newContent, canonicalTarget));
+}
+async function applyRepoWriteUnderLock(root, store, input, metadata, newContent, canonicalTarget) {
     await assertGitHead(root, input.expected_head);
     const current = await readWritableExistingFile(root, metadata.path);
+    if ((await realpath(current.resolved)) !== canonicalTarget) {
+        throw new Error(`File target changed for ${metadata.path}`);
+    }
     const currentPreimage = sha256(current.content);
     if (currentPreimage !== input.preimage_sha256) {
         // A retry after a successful apply sees the file already holding the new
@@ -85,7 +106,6 @@ export async function applyRepoWriteDryRun(root, store, input) {
         }
         throw new Error(`File preimage changed for ${metadata.path}`);
     }
-    const newContent = await readDryRunReplacementContent(store, metadata);
     let receipt;
     try {
         await replaceVerifiedUtf8File(current.resolved, newContent, async () => {

package/dist/safe-file.js

@@ -1,11 +1,62 @@
 import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat, open, realpath, rename, rm } from "node:fs/promises";
+import { chmod, link, lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
 import path from "node:path";
 let testHooks = {};
 export function setSafeFileTestHooks(hooks) {
     testHooks = hooks;
 }
+/**
+ * Serialize cooperating processes through a complete, atomically published
+ * lock record. A live process is never evicted based on elapsed time: callers
+ * must cancel their own work before releasing the lease.
+ */
+export async function withCrossProcessFileLock(filePath, options, fn) {
+    const parentSnapshot = await prepareFileLockParent(filePath, options.privateParent === true);
+    const deadline = Date.now() + Math.max(0, options.waitMs);
+    const retryMs = Math.max(1, options.retryMs ?? 50);
+    let waited = false;
+    let retriedMissingAtDeadline = false;
+    let lease;
+    for (;;) {
+        lease = await tryAcquireFileLock(filePath, parentSnapshot);
+        if (lease)
+            break;
+        const snapshot = await readFileLockSnapshot(filePath, parentSnapshot);
+        if (!snapshot) {
+            // The holder commonly disappears between our failed link and inspection.
+            // Retry that acquisition once even at the deadline, but do not let a
+            // rapidly flapping path bypass a bounded caller's wait budget forever.
+            if (Date.now() >= deadline) {
+                if (retriedMissingAtDeadline)
+                    throw options.unavailableError();
+                retriedMissingAtDeadline = true;
+            }
+            else {
+                await delay(Math.min(10, Math.max(1, deadline - Date.now())));
+            }
+            continue;
+        }
+        retriedMissingAtDeadline = false;
+        const holderAlive = snapshot.holder.pid !== undefined && processIsAlive(snapshot.holder.pid);
+        if (!holderAlive && (await reapFileLockSnapshot(filePath, snapshot, parentSnapshot)))
+            continue;
+        if (Date.now() >= deadline) {
+            throw holderAlive ? options.busyError(snapshot.holder) : options.unavailableError();
+        }
+        if (!waited) {
+            waited = true;
+            options.onWait?.(snapshot.holder);
+        }
+        await delay(Math.min(retryMs, Math.max(1, deadline - Date.now())));
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await releaseFileLockLease(filePath, lease, parentSnapshot);
+    }
+}
 export async function readVerifiedUtf8File(filePath, validate, options = {}) {
     await validate();
     const parentSnapshot = await captureParentSnapshot(filePath);
@@ -286,9 +337,206 @@ async function openNoFollow(filePath, flags, operation, mode) {
         throw error;
     }
 }
+async function prepareFileLockParent(filePath, makePrivate) {
+    const parentPath = path.dirname(filePath);
+    await mkdir(parentPath, { recursive: true, mode: 0o700 });
+    const parentStat = await lstat(parentPath);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+        throw new Error("Lock parent must be a real directory and must not be a symlink");
+    }
+    if (makePrivate)
+        await chmod(parentPath, 0o700);
+    const snapshot = await captureParentSnapshot(filePath);
+    if (!snapshot)
+        throw new Error("Lock files cannot use a descriptor-backed parent path");
+    await assertParentSnapshotStable(snapshot);
+    return snapshot;
+}
+async function tryAcquireFileLock(filePath, parentSnapshot) {
+    const owner = {
+        pid: process.pid,
+        nonce: randomUUID(),
+        started_at: new Date().toISOString()
+    };
+    const tokenPath = fileLockTokenPath(filePath, owner);
+    const handle = await openStableNoFollow(tokenPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, "write", parentSnapshot, 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(owner)}\n`, "utf8");
+        await handle.chmod(0o600);
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await assertParentSnapshotStable(parentSnapshot);
+        await link(tokenPath, filePath);
+        return { owner, tokenPath };
+    }
+    catch (error) {
+        await rm(tokenPath, { force: true }).catch(() => undefined);
+        if (isErrorCode(error, "EEXIST"))
+            return undefined;
+        throw error;
+    }
+}
+async function readFileLockSnapshot(filePath, parentSnapshot) {
+    let pathIdentity;
+    try {
+        const pathStat = await lstat(filePath, { bigint: true });
+        pathIdentity = { dev: pathStat.dev, ino: pathStat.ino };
+        if (pathStat.isSymbolicLink() || !pathStat.isFile()) {
+            return { identity: pathIdentity, holder: {}, unsafe: true };
+        }
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return undefined;
+        throw error;
+    }
+    let handle;
+    try {
+        handle = await openStableNoFollow(filePath, constants.O_RDONLY, "read", parentSnapshot);
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return undefined;
+        return { identity: pathIdentity, holder: {}, unsafe: true };
+    }
+    try {
+        const stat = await handle.stat({ bigint: true });
+        if (!stat.isFile())
+            return { identity: pathIdentity, holder: {}, unsafe: true };
+        const identity = { dev: stat.dev, ino: stat.ino };
+        if (stat.size > 16384n)
+            return { identity, holder: {} };
+        const content = await handle.readFile({ encoding: "utf8" });
+        const holder = parseFileLockHolder(content);
+        return { identity, holder, owner: parseFileLockOwner(holder) };
+    }
+    catch {
+        return { identity: pathIdentity, holder: {} };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function parseFileLockHolder(content) {
+    try {
+        const parsed = JSON.parse(content);
+        return {
+            pid: Number.isSafeInteger(parsed.pid) && Number(parsed.pid) > 0 ? Number(parsed.pid) : undefined,
+            nonce: typeof parsed.nonce === "string" && /^[A-Za-z0-9-]{1,128}$/.test(parsed.nonce) ? parsed.nonce : undefined,
+            started_at: typeof parsed.started_at === "string" ? parsed.started_at : undefined
+        };
+    }
+    catch {
+        return {};
+    }
+}
+function parseFileLockOwner(holder) {
+    if (holder.pid === undefined || holder.nonce === undefined)
+        return undefined;
+    return { pid: holder.pid, nonce: holder.nonce, started_at: holder.started_at };
+}
+async function releaseFileLockLease(filePath, lease, parentSnapshot) {
+    try {
+        const [current, tokenIdentity] = await Promise.all([
+            readFileLockSnapshot(filePath, parentSnapshot),
+            readRegularFileIdentity(lease.tokenPath)
+        ]);
+        if (current?.owner?.pid === lease.owner.pid &&
+            current.owner.nonce === lease.owner.nonce &&
+            tokenIdentity &&
+            sameFileIdentity(current.identity, tokenIdentity)) {
+            await rm(filePath, { force: true });
+        }
+    }
+    catch {
+        // A release is best-effort; the unique token cleanup below cannot affect a successor.
+    }
+    finally {
+        await rm(lease.tokenPath, { force: true }).catch(() => undefined);
+    }
+}
+async function reapFileLockSnapshot(filePath, snapshot, parentSnapshot) {
+    if (snapshot.unsafe)
+        return false;
+    return reapClaimedFileLock(filePath, snapshot, parentSnapshot);
+}
+async function reapClaimedFileLock(filePath, snapshot, parentSnapshot) {
+    const claimPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.reap`);
+    try {
+        await link(filePath, claimPath);
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return true;
+        // An interrupted reaper requires manual cleanup after all users stop.
+        // Reaping this claim recursively would reintroduce successor-unlink races.
+        if (isErrorCode(error, "EEXIST"))
+            return false;
+        throw error;
+    }
+    try {
+        await testHooks.afterLockReapClaim?.(filePath);
+        const [claimIdentity, current, ownerTokenIdentity] = await Promise.all([
+            readRegularFileIdentity(claimPath),
+            readFileLockSnapshot(filePath, parentSnapshot),
+            snapshot.owner ? readRegularFileIdentity(fileLockTokenPath(filePath, snapshot.owner)) : undefined
+        ]);
+        if (!claimIdentity ||
+            !current ||
+            !sameFileIdentity(claimIdentity, snapshot.identity) ||
+            !sameFileIdentity(current.identity, snapshot.identity)) {
+            return false;
+        }
+        await rm(filePath, { force: true });
+        if (snapshot.owner && ownerTokenIdentity && sameFileIdentity(ownerTokenIdentity, snapshot.identity)) {
+            await rm(fileLockTokenPath(filePath, snapshot.owner), { force: true }).catch(() => undefined);
+        }
+        return true;
+    }
+    finally {
+        await rm(claimPath, { force: true }).catch(() => undefined);
+    }
+}
+async function readRegularFileIdentity(filePath) {
+    try {
+        const stat = await lstat(filePath, { bigint: true });
+        if (stat.isSymbolicLink() || !stat.isFile())
+            return undefined;
+        return { dev: stat.dev, ino: stat.ino };
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return undefined;
+        throw error;
+    }
+}
+function fileLockTokenPath(filePath, owner) {
+    return path.join(path.dirname(filePath), `.${path.basename(filePath)}.${owner.pid}.${owner.nonce}.owner`);
+}
+function sameFileIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function procFdPath(fd) {
     return `/proc/self/fd/${fd}`;
 }
 function isMissingFileError(error) {
     return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
+function isErrorCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}

package/dist/store.js

@@ -389,7 +389,13 @@ export class BridgeStore {
         if (artifact.sha256 && sha256(content) !== artifact.sha256) {
             throw new Error(`Result artifact changed after finalization for ${taskId}: ${artifact.path} sha256 mismatch`);
         }
-        return { artifact, content };
+        return {
+            artifact,
+            content,
+            ...(!artifact.sha256 ? {
+                warnings: ["legacy_artifact_unverified: this artifact has no recorded sha256; its current contents cannot be verified against finalization."]
+            } : {})
+        };
     }
     async withResultArtifactHashes(artifacts) {
         const withHashes = [];

package/dist/tui-flow.js

@@ -10,7 +10,6 @@
  */
 export const SEND_KINDS = [
     { id: "chat", label: "Normal chat", hint: "ordinary Pro answer", tools: [] },
-    { id: "deep-research", label: "Deep research", hint: "browsed report, runs about 10 minutes", tools: ["deep-research"] },
     { id: "web-search", label: "Web search", hint: "current facts, with sources", tools: ["web-search"] },
     { id: "create-image", label: "Create image", tools: ["create-image"] }
 ];