@youdie006/prodex 0.40.6 → 0.40.9

package/dist/cli-pro.js

@@ -1,8 +1,8 @@
-import { existsSync, statSync } from "node:fs";
+import { existsSync, realpathSync, statSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { buildDryRunBundle } from "./bundle.js";
-import { DEFAULT_CDP_PORT, resolveCdpPort, resolveConversationToDelete, resolveProjectToDelete, chatGptVisibilityBlocker, defaultChatGptProfileDir, formatDurationMs, getChatGptBrowserStatus, formatModelMenuOption, listChatGptModelOptions, deleteChatGptConversation, endWedgedBrowser, browserRecoveryPlan, findWedgedBrowser, wedgedBrowserBlocker, deleteChatGptProject, listChatGptProjectsWithIds, listRecentChatGptConversations, listChatGptSidebarProjects, normalizeChatGptTargetUrl, openChatGptBrowser, openChatGptTab, parseProMode, parseReasoningEffort, defaultTimeoutForTools, ensureVirtualDisplay, minimizeChatGptWindow, readLastBrowserLoginLaunch, resolveVirtualDisplayPreference, resolveBrowserWindowMode, resolveHeadlessPreference, recordBrowserLoginLaunch, recoverChatGptAnswerFromThread, sendChatGptPrompt, statusMeansBrowserDead, namesPro, sendWarningsFromError, destinationVerification, chatGptProjectIdFromUrl } from "./chatgpt-browser.js";
+import { DEFAULT_CDP_PORT, resolveCdpPort, resolveConversationToDelete, resolveProjectToDelete, chatGptVisibilityBlocker, defaultChatGptProfileDir, formatDurationMs, getChatGptBrowserStatus, formatModelMenuOption, listChatGptModelOptions, deleteChatGptConversation, endWedgedBrowser, browserRecoveryPlan, findWedgedBrowser, wedgedBrowserBlocker, deleteChatGptProject, listChatGptProjectsWithIds, listRecentChatGptConversations, listChatGptSidebarProjects, normalizeChatGptTargetUrl, openChatGptBrowser, openChatGptTab, parseProMode, parseReasoningEffort, defaultTimeoutForTools, ensureVirtualDisplay, minimizeChatGptWindow, readLastBrowserLoginLaunch, resolveBrowserWindowMode, recordBrowserLoginLaunch, recoverChatGptAnswerFromThread, sendChatGptPrompt, statusMeansBrowserDead, namesPro, sendWarningsFromError, destinationVerification, chatGptProjectIdFromUrl } from "./chatgpt-browser.js";
 import { ASK_PRO_BOOLEAN_FLAGS, ASK_PRO_PREVIEW_VALUE_FLAGS, ASK_PRO_VALUE_FLAGS, assertHelpRequestArgs, assertNoExtraArgs, assertOnlyOptions, findHelpFlagIndexBeforePromptDelimiter, formatCliCommand, hasAskProDryRunMode, hasAskProMode, hasAskProSendMode, isHelpSubcommand, parseAskProArgs, printHelpIfRequested, readFlag, readPortFlag, readPositionalsWithOptions, readNonNegativeIntegerFlag, readPositiveIntegerFlag, readRepeatedFlag, resolveCwdFlag, resolveOptionalFileFlag, unknownSubcommandError } from "./cli-args.js";
 import { printProBrowserHelp, printProHelp } from "./cli-help.js";
 import { listRawResultsForInspection, listTasksForInspection } from "./cli-ledger.js";
@@ -13,9 +13,19 @@ import { withBrowserSendLock } from "./browser-send-lock.js";
 import { blockerCause, buildBlockerReport, CATCH_ALL_CODES } from "./blocker-report.js";
 import { projectIdFromSidebar, resolveContinuationThread } from "./continue-thread.js";
 import { readBridgeRoots } from "./registry.js";
+import { ProdexRequestIdSchema, SessionKeySchema } from "./schema.js";
 import { BridgeStore, MAX_FETCHABLE_RESULT_ARTIFACT_BYTES } from "./store.js";
 import { CLI_VERSION } from "./cli-help.js";
 import { PRODEX_ISSUE_REPO, buildIssueReport, fileGitHubIssue } from "./issue-report.js";
+function resolveBrowserProfileDirForLaunch(profileDir, launchCwd = process.cwd()) {
+    const resolved = path.resolve(launchCwd, profileDir);
+    try {
+        return statSync(resolved).isDirectory() ? realpathSync(resolved) : resolved;
+    }
+    catch {
+        return resolved;
+    }
+}
 export async function runChatgptCommand(rest, io) {
     const [subcommand, ...chatgptArgs] = rest;
     if (!subcommand || isHelpSubcommand(subcommand)) {
@@ -195,23 +205,45 @@ export async function runProCommand(rest, io, runCliFn) {
         if (browserSubcommand === "login") {
             if (printProBrowserHelpIfRequested(browserArgs, "pro browser login", io, {
                 valueFlags: ["--cwd", "--profile-dir", "--port", "--url", "--source-cli", "--launch-timeout-ms", "--wait-timeout-ms"],
-                booleanFlags: ["--dry-run", "--wait", "--no-wait", "--headless", "--minimized", "--virtual-display"]
+                booleanFlags: ["--dry-run", "--wait", "--no-wait", "--headed", "--headless", "--minimized", "--virtual-display"]
             })) {
                 return 0;
             }
-            assertOnlyOptions(browserArgs, "pro browser login", ["--cwd", "--profile-dir", "--port", "--url", "--source-cli", "--launch-timeout-ms", "--wait-timeout-ms"], ["--dry-run", "--wait", "--no-wait", "--headless", "--minimized", "--virtual-display"]);
+            assertOnlyOptions(browserArgs, "pro browser login", ["--cwd", "--profile-dir", "--port", "--url", "--source-cli", "--launch-timeout-ms", "--wait-timeout-ms"], ["--dry-run", "--wait", "--no-wait", "--headed", "--headless", "--minimized", "--virtual-display"]);
             if (browserArgs.includes("--wait") && browserArgs.includes("--no-wait")) {
                 throw new Error("pro browser login cannot combine --wait and --no-wait");
             }
             const loginUrl = readChatGptBrowserUrlFlag(browserArgs);
             const sourceCli = resolveOptionalFileFlag(io.cwd, browserArgs, "--source-cli");
             const targetCwd = readFlag(browserArgs, "--cwd") ? resolveCwdFlag(io.cwd, browserArgs) : undefined;
-            const profileDir = readFlag(browserArgs, "--profile-dir");
+            const requestedProfileFlag = readFlag(browserArgs, "--profile-dir");
+            const requestedProfileDir = requestedProfileFlag
+                ? resolveBrowserProfileDirForLaunch(requestedProfileFlag)
+                : undefined;
             const port = resolveCdpPort(readPortFlag(browserArgs, "--port"));
             const launchTimeoutMs = readPositiveIntegerFlag(browserArgs, "--launch-timeout-ms");
+            const savedLaunch = await readLastBrowserLoginLaunch();
+            // A saved launch belongs to a control port. Reusing its profile for a
+            // different port would silently widen the existing custom-port rules.
+            const savedLaunchForPort = savedLaunch?.port === port ? savedLaunch : undefined;
+            const savedProfileDir = savedLaunchForPort?.profile_dir
+                ? resolveBrowserProfileDirForLaunch(savedLaunchForPort.profile_dir)
+                : undefined;
+            const profileDir = requestedProfileDir ?? savedProfileDir;
+            const windowMode = resolveBrowserWindowMode({
+                flags: {
+                    ...(browserArgs.includes("--headed") ? { headed: true } : {}),
+                    ...(browserArgs.includes("--headless") ? { headless: true } : {}),
+                    ...(browserArgs.includes("--virtual-display") ? { virtualDisplay: true } : {}),
+                    ...(browserArgs.includes("--minimized") ? { minimized: true } : {})
+                },
+                // Window mode is a user preference across launches; only the saved
+                // profile and display identity are scoped to this resolved port.
+                ...(savedLaunch ? { lastLogin: savedLaunch } : {})
+            });
             const commandOptions = {
                 ...(targetCwd ? { cwd: targetCwd } : {}),
-                ...(profileDir ? { profileDir } : {}),
+                ...(requestedProfileDir ? { profileDir: requestedProfileDir } : {}),
                 ...(port !== DEFAULT_CDP_PORT ? { port } : {}),
                 ...(readFlag(browserArgs, "--url") ? { url: loginUrl } : {}),
                 ...(launchTimeoutMs !== undefined ? { launchTimeoutMs } : {})
@@ -219,6 +251,8 @@ export async function runProCommand(rest, io, runCliFn) {
             if (browserArgs.includes("--dry-run")) {
                 printBrowserLoginGuide(io.stdout, {
                     opened: false,
+                    headless: windowMode.headless,
+                    virtualDisplay: windowMode.virtualDisplay,
                     loginUrl,
                     profileDir: profileDir ?? defaultChatGptProfileDir(),
                     port,
@@ -231,48 +265,41 @@ export async function runProCommand(rest, io, runCliFn) {
             // again: Chrome's singleton would just open ANOTHER window (the recurring
             // "extra windows" problem, which then blocks sends as
             // ambiguous_chatgpt_tabs). Reuse the running instance instead.
-            if (browserArgs.includes("--virtual-display") && browserArgs.includes("--headless")) {
-                throw new Error("pro browser login cannot combine --headless and --virtual-display (a virtual display already hides the window).");
-            }
-            // Reopen the browser the way it was last opened unless a flag or the
-            // environment says otherwise. A virtual-display user who follows the
-            // `browser_unreachable` advice used to get a visible window back.
-            const savedLaunch = await readLastBrowserLoginLaunch();
-            const windowMode = resolveBrowserWindowMode({
-                flags: {
-                    ...(browserArgs.includes("--headless") ? { headless: true } : {}),
-                    ...(browserArgs.includes("--virtual-display") ? { virtualDisplay: true } : {}),
-                    ...(browserArgs.includes("--minimized") ? { minimized: true } : {})
-                },
-                ...(savedLaunch ? { lastLogin: savedLaunch } : {})
-            });
             const headless = windowMode.headless;
-            // A real browser on a virtual X display: no window anywhere, and
-            // Cloudflare sees an ordinary headed Chrome (headless it rejects).
             const wantsVirtualDisplay = windowMode.virtualDisplay;
-            const virtualDisplay = wantsVirtualDisplay
-                ? await ensureVirtualDisplay(savedLaunch?.virtual_display !== undefined && !browserArgs.includes("--virtual-display")
-                    ? { displayNumber: savedLaunch.virtual_display }
-                    : {})
-                : undefined;
             const alreadyRunning = (await getChatGptBrowserStatus({ port })).reachable;
             if (alreadyRunning) {
+                if (requestedProfileDir &&
+                    savedProfileDir &&
+                    requestedProfileDir !== savedProfileDir) {
+                    throw new Error(`A ChatGPT browser is already running on port ${port} with profile ${savedProfileDir}; a different profile was requested. Close the existing browser yourself, then rerun with the intended profile.`);
+                }
                 // One Chrome profile cannot serve a headed and a headless instance at
                 // once, and reusing the running one would silently ignore the
                 // requested mode. Say so instead of pretending the switch took.
-                const previous = await readLastBrowserLoginLaunch();
-                const runningHeadless = previous?.port === port ? previous.headless === true : undefined;
+                const runningHeadless = savedLaunchForPort ? savedLaunchForPort.headless === true : undefined;
                 if (runningHeadless !== undefined && runningHeadless !== headless) {
-                    throw new Error(`A ${runningHeadless ? "headless" : "headed"} ChatGPT browser is already running on port ${port}, but ${headless ? "headless" : "headed"} was requested. Close it first (\`pkill -f "remote-debugging-port=${port}"\`), then rerun.`);
+                    throw new Error(`A ${runningHeadless ? "headless" : "headed"} ChatGPT browser is already running on port ${port}, but ${headless ? "headless" : "headed"} was requested. Close the existing browser yourself, then rerun; prodex will not end it.`);
                 }
                 // Same for the display: a browser already on your desktop cannot be
                 // moved onto a virtual display by reusing it, and silently reusing
                 // it would leave the window exactly where the user asked it not to be.
-                const runningVirtual = previous?.port === port ? previous.virtual_display !== undefined : undefined;
+                const runningVirtual = savedLaunchForPort ? savedLaunchForPort.virtual_display !== undefined : undefined;
                 if (runningVirtual !== undefined && runningVirtual !== wantsVirtualDisplay) {
-                    throw new Error(`A ChatGPT browser is already running on port ${port} on ${runningVirtual ? "a virtual display" : "your desktop"}, but ${wantsVirtualDisplay ? "a virtual display" : "your desktop"} was requested. Close it first (\`pkill -f "remote-debugging-port=${port}"\`), then rerun.`);
+                    throw new Error(`A ChatGPT browser is already running on port ${port} on ${runningVirtual ? "a virtual display" : "your desktop"}, but ${wantsVirtualDisplay ? "a virtual display" : "your desktop"} was requested. Close the existing browser yourself, then rerun; prodex will not end it.`);
+                }
+                if (savedLaunchForPort?.minimized === true && !windowMode.minimized) {
+                    throw new Error(`A minimized ChatGPT browser is already running on port ${port}, but a visible headed browser was requested. Close the existing browser yourself, then rerun with --headed; prodex will not end it or pretend the minimized window was restored.`);
                 }
             }
+            // Allocate/rejoin a display only for a new browser. An already-running
+            // virtual browser owns its saved display identity and needs no new X
+            // server just because login was invoked again.
+            const virtualDisplay = wantsVirtualDisplay && !alreadyRunning
+                ? await ensureVirtualDisplay(savedLaunchForPort?.virtual_display !== undefined
+                    ? { displayNumber: savedLaunchForPort.virtual_display }
+                    : {})
+                : undefined;
             // A wedged browser is unreachable, so without this login would launch a
             // second Chrome onto the same profile and leave the first one burning
             // CPU - the same mistake the unattended recovery path made. Checked
@@ -291,7 +318,9 @@ export async function runProCommand(rest, io, runCliFn) {
                     port,
                     profileDir,
                     url: loginUrl,
-                    ...(headless ? { headless } : {}),
+                    // Pass false too: openChatGptBrowser otherwise consults the env
+                    // again and can resurrect a mode the shared resolver disabled.
+                    headless,
                     ...(virtualDisplay ? { virtualDisplay: { displayNumber: virtualDisplay.displayNumber, xauthority: virtualDisplay.xauthority } } : {})
                 });
             if (!alreadyRunning) {
@@ -302,10 +331,9 @@ export async function runProCommand(rest, io, runCliFn) {
             // Minimize BEFORE recording, so the record reflects what actually
             // happened (a desktop that hides minimized windows gets restored and
             // recorded as a normal window).
-            const wantsMinimized = browserArgs.includes("--minimized") || resolveMinimizeWindowPreference();
             let minimized = false;
             let minimizeNote;
-            if (wantsMinimized && !headless) {
+            if (windowMode.minimized && !headless) {
                 try {
                     const outcome = await minimizeChatGptWindow({ port: opened.port });
                     minimized = outcome.minimized;
@@ -317,20 +345,31 @@ export async function runProCommand(rest, io, runCliFn) {
                     minimizeNote = `window: could not minimize (${errorMessage(error)}); leaving it as it is.`;
                 }
             }
-            await recordBrowserLoginLaunch({
-                profile_dir: opened.profileDir,
-                port: opened.port,
-                headless,
-                minimized,
-                ...(virtualDisplay ? { virtual_display: virtualDisplay.displayNumber } : {})
-            });
-            if (virtualDisplay) {
-                io.stdout(`window: none - running on virtual display :${virtualDisplay.displayNumber}${virtualDisplay.startedNow ? " (started now)" : " (reused)"}.`);
+            // A reused browser with neither an explicit nor saved profile is
+            // reachable, but its actual profile cannot be inferred from the port.
+            // Do not overwrite a useful launch record with an invented default.
+            if (!alreadyRunning || profileDir) {
+                await recordBrowserLoginLaunch({
+                    profile_dir: opened.profileDir,
+                    port: opened.port,
+                    headless,
+                    minimized,
+                    ...(virtualDisplay
+                        ? { virtual_display: virtualDisplay.displayNumber }
+                        : wantsVirtualDisplay && savedLaunchForPort?.virtual_display !== undefined
+                            ? { virtual_display: savedLaunchForPort.virtual_display }
+                            : {})
+                });
+            }
+            const virtualDisplayNumber = virtualDisplay?.displayNumber ?? savedLaunchForPort?.virtual_display;
+            if (wantsVirtualDisplay && virtualDisplayNumber !== undefined) {
+                io.stdout(`window: none - running on virtual display :${virtualDisplayNumber}${virtualDisplay?.startedNow ? " (started now)" : " (reused)"}.`);
             }
             printBrowserLoginGuide(io.stdout, {
                 opened: !alreadyRunning,
                 reused: alreadyRunning,
                 headless,
+                virtualDisplay: wantsVirtualDisplay,
                 loginUrl,
                 profileDir: opened.profileDir,
                 port: opened.port,
@@ -345,7 +384,12 @@ export async function runProCommand(rest, io, runCliFn) {
                 // Verify it here (bounded, no human to wait for) instead of letting
                 // the first consult fail with a confusing not-logged-in blocker.
                 const headlessWaitMs = readPositiveIntegerFlag(browserArgs, "--wait-timeout-ms") ?? 30_000;
-                const headlessReady = await waitForChatGptLoginReady(io.stderr, { port: opened.port, timeoutMs: headlessWaitMs });
+                const headlessReady = await waitForChatGptLoginReady(io.stderr, {
+                    port: opened.port,
+                    timeoutMs: headlessWaitMs,
+                    windowMode,
+                    headedLoginCommand: formatHeadedBrowserLoginCommand(sourceCli, commandOptions)
+                });
                 if (!headlessReady) {
                     // Name the real cause. Cloudflare rejects headless Chrome by
                     // design (its docs list headless browsers as unsupported), and
@@ -355,8 +399,8 @@ export async function runProCommand(rest, io, runCliFn) {
                     const challenged = finalStatus?.blocker?.code === "cloudflare_check" || /just a moment/i.test(finalStatus?.title ?? "");
                     io.stdout("");
                     io.stdout(challenged
-                        ? "headless: Cloudflare challenged the headless browser and never let ChatGPT load. This is expected - Cloudflare lists headless browsers as unsupported. Run without --headless, or run a real headed Chrome on a virtual display (Xvfb) and point prodex at it with DISPLAY."
-                        : `headless: the profile is not signed in. Run \`${formatBrowserLoginCommand(sourceCli, commandOptions)}\` WITHOUT --headless once, sign in, close that window, then rerun with --headless.`);
+                        ? `headless: Cloudflare challenged the headless browser and never let ChatGPT load. Run \`${formatHeadedBrowserLoginCommand(sourceCli, commandOptions)}\` for a visible interactive check; headless browsers are not supported by Cloudflare.`
+                        : `headless: the profile is not signed in. Run \`${formatHeadedBrowserLoginCommand(sourceCli, commandOptions)}\` for a visible interactive login, sign in, close that browser yourself, then rerun with --headless.`);
                     return 1;
                 }
                 io.stdout("headless: signed-in session confirmed - consults will run with no visible window.");
@@ -370,7 +414,12 @@ export async function runProCommand(rest, io, runCliFn) {
             if (!shouldWaitForReady)
                 return 0;
             const waitTimeoutMs = readPositiveIntegerFlag(browserArgs, "--wait-timeout-ms") ?? 300_000;
-            const ready = await waitForChatGptLoginReady(io.stderr, { port: opened.port, timeoutMs: waitTimeoutMs });
+            const ready = await waitForChatGptLoginReady(io.stderr, {
+                port: opened.port,
+                timeoutMs: waitTimeoutMs,
+                windowMode,
+                headedLoginCommand: formatHeadedBrowserLoginCommand(sourceCli, commandOptions)
+            });
             return ready ? 0 : 1;
         }
         if (browserSubcommand === "ask") {
@@ -523,9 +572,9 @@ export async function runProCommand(rest, io, runCliFn) {
             return 0;
         }
         if (browserSubcommand === "recover") {
-            if (printProBrowserHelpIfRequested(browserArgs, "pro browser recover", io, { valueFlags: ["--cwd", "--port", "--timeout-ms", "--target-url", "--source-cli"] }))
+            if (printProBrowserHelpIfRequested(browserArgs, "pro browser recover", io, { valueFlags: ["--cwd", "--port", "--timeout-ms", "--target-url", "--request-id", "--source-cli"] }))
                 return 0;
-            assertOnlyOptions(browserArgs, "pro browser recover", ["--cwd", "--port", "--timeout-ms", "--target-url", "--source-cli"]);
+            assertOnlyOptions(browserArgs, "pro browser recover", ["--cwd", "--port", "--timeout-ms", "--target-url", "--request-id", "--source-cli"]);
             const recoverCwd = resolveCwdFlag(io.cwd, browserArgs);
             const recoverSourceCli = resolveOptionalFileFlag(io.cwd, browserArgs, "--source-cli");
             const targetUrl = readFlag(browserArgs, "--target-url");
@@ -534,6 +583,10 @@ export async function runProCommand(rest, io, runCliFn) {
             }
             const recoverPort = readPortFlag(browserArgs, "--port");
             const recoverTimeoutMs = readPositiveIntegerFlag(browserArgs, "--timeout-ms");
+            const recoverRequestIdRaw = readFlag(browserArgs, "--request-id");
+            const recoverRequestId = recoverRequestIdRaw === undefined
+                ? undefined
+                : validatedProdexRequestId(recoverRequestIdRaw, "--request-id");
             const recoverResolvedPort = resolveCdpPort(recoverPort);
             let consult;
             try {
@@ -542,7 +595,12 @@ export async function runProCommand(rest, io, runCliFn) {
                 // send is streaming into, which is the consult it would destroy - and
                 // recovery is exactly what gets run after a send appears to hang, so
                 // the two meeting is a when rather than an if.
-                consult = await withBrowserSendLock(recoverTimeoutMs ?? 60_000, (detail) => io.stderr(`progress: ${detail}`), () => recoverChatGptAnswerFromThread({ port: recoverPort, targetUrl, timeoutMs: recoverTimeoutMs }));
+                consult = await withBrowserSendLock(recoverTimeoutMs ?? 60_000, (detail) => io.stderr(`progress: ${detail}`), () => recoverChatGptAnswerFromThread({
+                    port: recoverPort,
+                    targetUrl,
+                    timeoutMs: recoverTimeoutMs,
+                    ...(recoverRequestId ? { requestId: recoverRequestId } : {})
+                }));
             }
             catch (error) {
                 const blocker = sourceAwareBrowserBlocker(browserSendBlockerFromError(error), recoverSourceCli, {
@@ -568,6 +626,12 @@ export async function runProCommand(rest, io, runCliFn) {
             catch (error) {
                 io.stderr(`answer_artifact_warning: ${errorMessage(error)}`);
             }
+            for (const warning of consult.warnings)
+                io.stderr(warning);
+            if (consult.requestId)
+                io.stderr(`request_id: ${consult.requestId}`);
+            if (consult.requestVerified !== undefined)
+                io.stderr(`request_verified: ${consult.requestVerified ? "yes" : "no"}`);
             await recoverStore.completeTask(recoveredTask.id, {
                 status: "done",
                 summary: consult.answer,
@@ -575,8 +639,8 @@ export async function runProCommand(rest, io, runCliFn) {
                     ? [{ path: recoveredArtifactPath, role: "result", bytes: Buffer.byteLength(recoveredArtifactText, "utf8") }]
                     : [],
                 commands: ["recovered ChatGPT answer from thread"],
-                warnings: [],
-                provenance: { thread: consult.url, warnings: [] }
+                warnings: consult.warnings,
+                provenance: { thread: consult.url, warnings: consult.warnings }
             });
             io.stdout(`${recoveredTask.id}\tdone\t${consult.url}`);
             io.stdout("");
@@ -933,16 +997,31 @@ export async function runProCommand(rest, io, runCliFn) {
 export async function runConsultsCommand(rest, io) {
     throw new Error("The legacy `consults` alias is retired. Use `prodex pro list`, `prodex pro latest`, or `prodex pro show <task-id|latest>`.");
 }
-// PRODEX_MINIMIZE_WINDOW=1 gives the no-window setup to every entry point,
-// including the MCP server's auto-recovery, without a CLI flag.
-export function resolveMinimizeWindowPreference(env = process.env) {
-    const raw = (env.PRODEX_MINIMIZE_WINDOW ?? "").trim().toLowerCase();
-    return raw === "1" || raw === "true" || raw === "yes";
-}
 function autoLoginDisabledByEnv(env = process.env) {
     const raw = (env.PRODEX_NO_AUTO_LOGIN ?? "").trim().toLowerCase();
     return raw === "1" || raw === "true" || raw === "yes";
 }
+function validatedSessionKey(value, source) {
+    const parsed = SessionKeySchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    throw new Error(`${source} must be a non-empty identifier of at most 128 characters using letters, digits, '.', '_', ':', '@', '/', or '-'.`);
+}
+export function resolveProdexSessionKey(explicit, env = process.env) {
+    if (explicit !== undefined)
+        return validatedSessionKey(explicit, "--session-key");
+    if (env.PRODEX_SESSION_KEY !== undefined)
+        return validatedSessionKey(env.PRODEX_SESSION_KEY, "PRODEX_SESSION_KEY");
+    if (env.CODEX_THREAD_ID !== undefined)
+        return validatedSessionKey(env.CODEX_THREAD_ID, "CODEX_THREAD_ID");
+    return undefined;
+}
+function validatedProdexRequestId(value, source) {
+    const parsed = ProdexRequestIdSchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    throw new Error(`${source} must be the 32-character lowercase hex request identifier returned by prodex.`);
+}
 // Retired browser subcommands map to the one that replaced them. Every value
 // here must be a subcommand that actually exists, so the error is a single hop
 // to a runnable command.
@@ -1094,6 +1173,7 @@ export async function runAskProCommand(rest, io) {
         promptText = prompt ? `${prompt}\n\n--- piped input (stdin) ---\n${piped}` : piped;
     }
     const browserDefaults = await loadBrowserDefaults(targetCwd);
+    const sessionKey = resolveProdexSessionKey(readFlag(parsedAskPro.optionArgs, "--session-key"));
     const explicitProject = readFlag(parsedAskPro.optionArgs, "--project");
     const explicitProjectNew = readFlag(parsedAskPro.optionArgs, "--project-new");
     // Opt out of a pinned default project for one send. Without this a repo
@@ -1117,6 +1197,9 @@ export async function runAskProCommand(rest, io) {
     const continueRequested = parsedAskPro.optionArgs.includes("--continue");
     const continueTaskId = readFlag(parsedAskPro.optionArgs, "--continue-task");
     if (continueRequested || continueTaskId !== undefined) {
+        if (continueTaskId === undefined && sessionKey === undefined) {
+            throw new Error("--continue needs --session-key <id> (or PRODEX_SESSION_KEY/CODEX_THREAD_ID) so it cannot use another client's conversation. Use --continue-task <task_id> to name one explicitly.");
+        }
         const conflict = [
             parsedAskPro.optionArgs.includes("--new-chat") ? "--new-chat" : undefined,
             targetUrl !== undefined ? "--target-url" : undefined,
@@ -1146,12 +1229,14 @@ export async function runAskProCommand(rest, io) {
         const resolved = resolveContinuationThread({
             consults: (await targetStore.listSessionsReadOnly()).map((session) => ({
                 taskId: session.task_id ?? "",
+                ...(session.session_key ? { sessionKey: session.session_key } : {}),
                 ...(session.thread ? { thread: session.thread } : {}),
                 status: session.status,
                 ...(session.created_at ? { createdAt: session.created_at } : {})
             })),
             ...(continuationProject ? { project: continuationProject } : {}),
             ...(continuationProjectId ? { projectId: continuationProjectId } : {}),
+            ...(sessionKey ? { sessionKey } : {}),
             ...(continueTaskId !== undefined ? { taskId: continueTaskId } : {})
         });
         if ("error" in resolved)
@@ -1163,7 +1248,8 @@ export async function runAskProCommand(rest, io) {
         normalizedTargetUrl = normalizeChatGptTargetUrl(resolved.target.thread);
         io.stderr(`progress: continuing ${resolved.target.taskId}`);
     }
-    const newChat = parsedAskPro.optionArgs.includes("--new-chat");
+    const explicitlyRequestedNewChat = parsedAskPro.optionArgs.includes("--new-chat");
+    const newChat = explicitlyRequestedNewChat || normalizedTargetUrl === undefined;
     // A temporary chat is not saved, so there is nothing to come back to: the
     // recovery path every timeout message points at cannot fetch it later.
     // Requiring --new-chat keeps that explicit rather than quietly turning a
@@ -1178,7 +1264,7 @@ export async function runAskProCommand(rest, io) {
     if (temporary && !newChat) {
         throw new Error("--temporary starts a throwaway chat, so it needs --new-chat. A temporary chat cannot be continued or recovered later.");
     }
-    if (newChat && normalizedTargetUrl) {
+    if (explicitlyRequestedNewChat && normalizedTargetUrl) {
         throw new Error("ask-pro cannot combine --new-chat with --target-url: --new-chat navigates to a fresh chat while --target-url pins the confirmed tab.");
     }
     const explicitModel = readFlag(parsedAskPro.optionArgs, "--model");
@@ -1293,6 +1379,7 @@ export async function runAskProCommand(rest, io) {
                 id: bundle.id,
                 direction: "codex_to_chatgpt",
                 backend: "chatgpt-control",
+                ...(sessionKey ? { session_key: sessionKey } : {}),
                 task_id: task.id,
                 thread: normalizedTargetUrl,
                 status: "running",
@@ -1328,9 +1415,9 @@ export async function runAskProCommand(rest, io) {
             port: browserPort,
             prompt: bundle.sendText,
             targetUrl: normalizedTargetUrl,
-            // A thread prodex resolved from its own records is reached by
-            // navigating; a --target-url the person confirmed is not moved.
-            ...(continuedFromTaskId ? { navigateToTargetUrl: true } : {}),
+            // Continuations and explicit TUI picks navigate while this lock is
+            // held. Direct CLI targets keep their existing verification-only semantics.
+            ...(continuedFromTaskId || (io.navigateInteractiveTarget === true && normalizedTargetUrl) ? { navigateToTargetUrl: true } : {}),
             timeoutMs: browserTimeoutMs,
             ...(attachments.length > 0 ? { attachments } : {}),
             ...(tools.length > 0 ? { tools } : {}),
@@ -1363,7 +1450,9 @@ export async function runAskProCommand(rest, io) {
             }
             catch (error) {
                 const firstBlocker = browserSendBlockerFromError(error);
-                if (firstBlocker.code !== "browser_unreachable" || !autoLoginAllowed)
+                // Loss while reading an already-submitted prompt must not send it again.
+                if (firstBlocker.code !== "browser_unreachable" ||
+                    !firstBlocker.retryable || firstBlocker.thread || !autoLoginAllowed)
                     throw error;
                 const recovered = await attemptBrowserAutoRecovery(io.stderr, {
                     ...(browserPort !== undefined ? { port: browserPort } : {}),
@@ -1420,6 +1509,7 @@ export async function runAskProCommand(rest, io) {
                     id: bundle.id,
                     direction: "codex_to_chatgpt",
                     backend: "chatgpt-control",
+                    ...(sessionKey ? { session_key: sessionKey } : {}),
                     task_id: task.id,
                     thread: blockedThread,
                     status: "blocked",
@@ -1433,7 +1523,15 @@ export async function runAskProCommand(rest, io) {
             // Keep stdout machine-parseable for --json consumers on the blocked
             // path too; the human-readable error still goes to stderr via throw.
             if (jsonOutput) {
-                io.stdout(JSON.stringify({ task_id: task.id, status: "blocked", thread: blockedThread ?? null, answer: null, warnings: blockedWarnings, blocker }, null, 2));
+                io.stdout(JSON.stringify({
+                    task_id: task.id,
+                    status: "blocked",
+                    thread: blockedThread ?? null,
+                    answer: null,
+                    ...(sessionKey ? { session_key: sessionKey } : {}),
+                    warnings: blockedWarnings,
+                    blocker
+                }, null, 2));
             }
             throw new Error(formatBlockedConsultRecordedMessage(message, task.id, sourceCli, { cwd: targetCwd }));
         }
@@ -1470,6 +1568,10 @@ export async function runAskProCommand(rest, io) {
             io.stderr(warning);
         if (consult.modelSlug)
             io.stderr(`model_used: ${consult.modelSlug}`);
+        if (consult.requestId)
+            io.stderr(`request_id: ${consult.requestId}`);
+        if (consult.requestVerified !== undefined)
+            io.stderr(`request_verified: ${consult.requestVerified ? "yes" : "no"}`);
         // Which conversation this followed, and where the answer actually landed.
         // The progress line that says it is filtered out of MCP notes, so an
         // agent asking for a follow-up had no way to know which thread it got -
@@ -1518,6 +1620,8 @@ export async function runAskProCommand(rest, io) {
                     // receipt used to record only what prodex asked for.
                     ...(consult.modelSlug ? { model_used: consult.modelSlug } : {}),
                     ...(proVerified !== undefined ? { pro_verified: proVerified } : {}),
+                    ...(consult.requestId ? { request_id: consult.requestId } : {}),
+                    ...(consult.requestVerified !== undefined ? { request_verified: consult.requestVerified } : {}),
                     // Intent and evidence, kept apart. `selection` is what was asked
                     // for; this is where the answer turned out to be, and whether
                     // anything actually confirmed it.
@@ -1562,6 +1666,7 @@ export async function runAskProCommand(rest, io) {
             id: bundle.id,
             direction: "codex_to_chatgpt",
             backend: "chatgpt-control",
+            ...(sessionKey ? { session_key: sessionKey } : {}),
             task_id: task.id,
             thread: consult.url,
             status: "done",
@@ -1573,6 +1678,9 @@ export async function runAskProCommand(rest, io) {
                 status: result.status,
                 thread: consult.url,
                 answer: result.summary,
+                ...(sessionKey ? { session_key: sessionKey } : {}),
+                ...(consult.requestId ? { request_id: consult.requestId } : {}),
+                ...(consult.requestVerified !== undefined ? { request_verified: consult.requestVerified } : {}),
                 ...(continuedFromTaskId ? { continued_from: continuedFromTaskId } : {}),
                 destination: {
                     observed: destination.destination,
@@ -1596,6 +1704,7 @@ export async function runAskProCommand(rest, io) {
             id: bundle.id,
             direction: "codex_to_chatgpt",
             backend: "manual",
+            ...(sessionKey ? { session_key: sessionKey } : {}),
             status: "preview",
             warnings: []
         }, io);
@@ -1648,6 +1757,14 @@ Rules:
 
 Write the debate in the language of the topic.`;
 }
+function browserMetadataFromNotes(notes) {
+    const requestId = notes.find((line) => line.startsWith("request_id: "))?.slice("request_id: ".length).trim();
+    const verified = notes.find((line) => line.startsWith("request_verified: "))?.slice("request_verified: ".length).trim();
+    return {
+        ...(requestId ? { request_id: requestId } : {}),
+        ...(verified === "yes" ? { request_verified: true } : verified === "no" ? { request_verified: false } : {})
+    };
+}
 /**
  * MCP-side counterpart to `pro browser recover`. A consult that outlives its
  * budget hands back the thread it landed in, but until now the only way to act
@@ -1662,6 +1779,7 @@ export async function performBrowserRecoverForMcp(cwd, input) {
         "recover",
         "--target-url",
         input.thread,
+        ...(input.request_id !== undefined ? ["--request-id", input.request_id] : []),
         ...(input.timeout_ms !== undefined ? ["--timeout-ms", String(input.timeout_ms)] : [])
     ];
     await runProCommand(argv, {
@@ -1671,11 +1789,13 @@ export async function performBrowserRecoverForMcp(cwd, input) {
     }, async () => 0);
     const header = stdoutLines[0] ?? "";
     const [taskId = "", status = "", thread = ""] = header.split("\t");
+    const metadata = browserMetadataFromNotes(stderrLines);
     return {
         task_id: taskId,
         status,
         thread,
         answer: stdoutLines.slice(2).join("\n"),
+        ...metadata,
         notes: stderrLines
     };
 }
@@ -1706,6 +1826,7 @@ export function answerRescuedFromFailedPersistence(stdoutLines) {
 export async function performBrowserConsultForMcp(cwd, input, onProgress) {
     const stdoutLines = [];
     const stderrLines = [];
+    const sessionKey = resolveProdexSessionKey(input.session_key);
     const argv = [
         "--send",
         // MCP callers have no terminal, so the interactive auto-recovery gate
@@ -1718,6 +1839,7 @@ export async function performBrowserConsultForMcp(cwd, input, onProgress) {
         ...(input.pro_mode !== undefined ? ["--pro-mode", input.pro_mode] : []),
         ...(input.effort !== undefined ? ["--effort", input.effort] : []),
         ...(input.project !== undefined ? ["--project", input.project] : []),
+        ...(sessionKey !== undefined ? ["--session-key", sessionKey] : []),
         ...(input.timeout_ms !== undefined ? ["--timeout-ms", String(input.timeout_ms)] : []),
         ...(input.files ?? []).flatMap((file) => ["--file", file]),
         ...(input.attach ?? []).flatMap((file) => ["--attach", file]),
@@ -1750,25 +1872,31 @@ export async function performBrowserConsultForMcp(cwd, input, onProgress) {
         const rescued = answerRescuedFromFailedPersistence(stdoutLines);
         if (!rescued)
             throw error;
+        const notes = [
+            ...stderrLines.filter((line) => !line.startsWith("progress:")),
+            `answer_not_saved: ${errorMessage(error)}`
+        ];
         return {
             task_id: rescued.taskId,
             status: "answered_not_saved",
             thread: rescued.thread,
             answer: rescued.answer,
-            notes: [
-                ...stderrLines.filter((line) => !line.startsWith("progress:")),
-                `answer_not_saved: ${errorMessage(error)}`
-            ]
+            ...(sessionKey ? { session_key: sessionKey } : {}),
+            ...browserMetadataFromNotes(notes),
+            notes
         };
     }
     const header = stdoutLines[0] ?? "";
     const [taskId = "", status = "", thread = ""] = header.split("\t");
+    const notes = stderrLines.filter((line) => !line.startsWith("progress:"));
     return {
         task_id: taskId,
         status,
         thread,
         answer: stdoutLines.slice(2).join("\n"),
-        notes: stderrLines.filter((line) => !line.startsWith("progress:"))
+        ...(sessionKey ? { session_key: sessionKey } : {}),
+        ...browserMetadataFromNotes(notes),
+        notes
     };
 }
 /**
@@ -1801,6 +1929,12 @@ function autoClearDisabledByEnv(env = process.env) {
     const raw = (env.PRODEX_NO_AUTO_CLEAR ?? "").trim().toLowerCase();
     return raw === "1" || raw === "true" || raw === "yes";
 }
+function reportResidualBrowserRecoveryBlocker(stderr, pids, port) {
+    const blocker = wedgedBrowserBlocker([...new Set(pids)].sort((left, right) => left - right), port);
+    stderr(`recover: failed - ${blocker.message}`);
+    stderr(`recover: ${blocker.next_step}`);
+    return false;
+}
 /**
  * What recovery did to the browser, in the words the receipt keeps.
  *
@@ -1825,9 +1959,26 @@ export async function attemptBrowserAutoRecovery(stderr, options) {
     // scanning the DEFAULT profile for a custom-profile user put a second,
     // healthy browser's renderers on the list this function kills.
     const lastLogin = await readLastBrowserLoginLaunch().catch(() => undefined);
+    const recoveryPort = resolveCdpPort(options.port);
+    const savedIdentityBelongsToAnotherPort = lastLogin?.port !== undefined &&
+        lastLogin.port !== recoveryPort &&
+        (lastLogin.profile_dir !== undefined || lastLogin.virtual_display !== undefined);
+    if (savedIdentityBelongsToAnotherPort) {
+        stderr(`recover: failed - saved browser identity belongs to port ${lastLogin.port}, not requested port ${recoveryPort}. Run \`prodex pro browser login --port ${recoveryPort} --headed\` with the intended profile before retrying; prodex will not launch an unknown account.`);
+        return false;
+    }
+    const lastLoginForPort = lastLogin?.port === undefined || lastLogin.port === recoveryPort ? lastLogin : undefined;
+    let windowMode;
+    try {
+        windowMode = resolveBrowserWindowMode({ ...(lastLogin ? { lastLogin } : {}) });
+    }
+    catch (error) {
+        stderr(`recover: failed - ${errorMessage(error)}`);
+        return false;
+    }
     const scanFor = {
         ...(options.port !== undefined ? { port: options.port } : {}),
-        ...(lastLogin?.profile_dir ? { profileDir: lastLogin.profile_dir } : {})
+        ...(lastLoginForPort?.profile_dir ? { profileDir: lastLoginForPort.profile_dir } : {})
     };
     const wedged = findWedgedBrowser(scanFor);
     if (wedged.length > 0) {
@@ -1847,17 +1998,25 @@ export async function attemptBrowserAutoRecovery(stderr, options) {
             return false;
         }
         stderr(`recover: the browser stopped answering; ending it (pid ${wedged.join(", ")}) and starting a fresh one...`);
-        // Ending someone's browser is not a progress line to scroll past: it goes on
-        // the receipt, where an agent or a person reading `pro latest` will see it.
-        options.notes?.push(browserRecoveredNote(wedged));
-        await endWedgedBrowser(wedged);
+        // Keep the attempt even if launch fails; completion is recorded after READY.
+        options.notes?.push(`browser_recovery_started: prodex began restarting the unresponsive dedicated browser (pid ${wedged.join(", ")}).`);
+        const termination = await endWedgedBrowser(wedged);
+        if (termination.failed.length > 0) {
+            return reportResidualBrowserRecoveryBlocker(stderr, termination.failed, recoveryPort);
+        }
         // Wait for the profile lock to actually clear rather than guessing at a
         // delay: the replacement launch fails outright if the old process still
         // holds it, which is how the first self-heal attempt ended.
+        let residualPids = [];
         for (let attempt = 0; attempt < 10; attempt += 1) {
-            if (findWedgedBrowser(scanFor).length === 0)
+            residualPids = findWedgedBrowser(scanFor);
+            if (residualPids.length === 0)
                 break;
-            await sleep(1_000);
+            if (attempt < 9)
+                await sleep(1_000);
+        }
+        if (residualPids.length > 0) {
+            return reportResidualBrowserRecoveryBlocker(stderr, residualPids, recoveryPort);
         }
     }
     stderr("recover: browser is not running - launching the dedicated ChatGPT browser (Ctrl+C aborts)...");
@@ -1865,37 +2024,50 @@ export async function attemptBrowserAutoRecovery(stderr, options) {
         // Reuse the profile the user last logged in with; launching the default
         // profile for a custom-profile user would wait on the wrong (logged-out)
         // profile or, worse, silently send to a different account.
-        // Relaunch in the SAME window mode the user chose: silently reopening a
-        // visible window for someone running headless would be exactly the
-        // surprise window they turned headless to avoid.
-        const headless = resolveHeadlessPreference(lastLogin?.headless);
-        // Rejoin the same virtual display the user set up, so recovery does not
-        // put a window back on a desktop they deliberately keep empty.
-        const virtualDisplay = lastLogin?.virtual_display !== undefined || resolveVirtualDisplayPreference()
-            ? await ensureVirtualDisplay(lastLogin?.virtual_display !== undefined ? { displayNumber: lastLogin.virtual_display } : {}).catch(() => undefined)
+        // Recovery follows the same precedence as login. In particular, one
+        // supplied false env setting selects the env group and disables saved
+        // modes instead of being mistaken for "not configured".
+        const virtualDisplay = windowMode.virtualDisplay
+            ? await ensureVirtualDisplay(lastLoginForPort?.virtual_display !== undefined ? { displayNumber: lastLoginForPort.virtual_display } : {})
             : undefined;
         const opened = openChatGptBrowser({
             ...(options.port !== undefined ? { port: options.port } : {}),
-            ...(lastLogin?.profile_dir ? { profileDir: lastLogin.profile_dir } : {}),
-            ...(headless ? { headless } : {}),
+            ...(lastLoginForPort?.profile_dir ? { profileDir: lastLoginForPort.profile_dir } : {}),
+            // Always pass the resolved boolean. Omitting false lets the browser
+            // boundary re-read PRODEX_HEADLESS and revive stale environment state.
+            headless: windowMode.headless,
             ...(virtualDisplay ? { virtualDisplay: { displayNumber: virtualDisplay.displayNumber, xauthority: virtualDisplay.xauthority } } : {})
         });
         await assertBrowserLaunchStayedAlive(opened);
-        const ready = await waitForChatGptLoginReady(stderr, { port: opened.port, timeoutMs: 120_000 });
-        if (!ready)
-            return false;
-        // Restore the no-window setup too: someone who runs minimized does not
-        // want recovery to leave a window sitting on their desktop.
-        if (!headless && (lastLogin?.minimized === true || resolveMinimizeWindowPreference())) {
+        let minimized = false;
+        if (windowMode.minimized) {
             const outcome = await minimizeChatGptWindow({ port: opened.port }).catch(() => undefined);
-            if (outcome?.minimized)
+            minimized = outcome?.minimized === true;
+            if (minimized)
                 stderr("recover: window minimized again");
         }
+        // Record the actual launch before waiting for authentication. A manual
+        // login must target this profile and display even if readiness is blocked.
+        await recordBrowserLoginLaunch({
+            profile_dir: opened.profileDir,
+            port: opened.port,
+            headless: windowMode.headless,
+            minimized,
+            ...(virtualDisplay ? { virtual_display: virtualDisplay.displayNumber } : {})
+        });
+        const ready = await waitForChatGptLoginReady(stderr, {
+            port: opened.port,
+            timeoutMs: 120_000,
+            windowMode,
+            headedLoginCommand: formatHeadedBrowserLoginCommand(undefined, {
+                profileDir: opened.profileDir,
+                ...(opened.port !== DEFAULT_CDP_PORT ? { port: opened.port } : {})
+            })
+        });
+        if (!ready)
+            return false;
         stderr("recover: browser READY - retrying the send...");
-        // The wedged branch above records what it ended; this branch records that
-        // the browser was gone and this answer came from one prodex started.
-        if (wedged.length === 0)
-            options.notes?.push(browserRecoveredNote([]));
+        options.notes?.push(browserRecoveredNote(wedged));
         return true;
     }
     catch (error) {
@@ -1915,8 +2087,13 @@ export async function waitForChatGptLoginReady(stderr, options, deps = {}) {
     const openTabFn = deps.openTabFn ?? openChatGptTab;
     const timeoutMs = options.timeoutMs ?? 300_000;
     const pollMs = options.pollMs ?? 2_000;
+    const hasInteractiveWindow = options.windowMode?.headless !== true && options.windowMode?.virtualDisplay !== true;
+    const headedLoginCommand = options.headedLoginCommand ?? "prodex pro browser login --headed";
+    const headedLoginHint = ` No interactive window is available; run \`${headedLoginCommand}\` to complete login, captcha, or human verification visibly.`;
     const startedAt = now();
-    stderr("login: waiting for a logged-in ChatGPT tab (finish login in the dedicated Chrome window; Ctrl+C stops waiting)...");
+    stderr(hasInteractiveWindow
+        ? "login: waiting for a logged-in ChatGPT tab (finish login in the dedicated Chrome browser; Ctrl+C stops waiting)..."
+        : `login: waiting for a logged-in ChatGPT tab (no interactive window; use \`${headedLoginCommand}\` if login or verification is required; Ctrl+C stops waiting)...`);
     let lastState = "";
     let openMissingTabAttempts = 0;
     while (now() - startedAt < timeoutMs) {
@@ -1933,19 +2110,26 @@ export async function waitForChatGptLoginReady(stderr, options, deps = {}) {
                 ? "login: the running Chrome had no ChatGPT tab - opening a ChatGPT tab in it..."
                 : `login: still no ChatGPT tab - opening one again (attempt ${attempt})...`);
             const opened = await openTabFn(options.port);
-            if (opened === false)
-                stderr("login: could not open a ChatGPT tab through the debug port; open https://chatgpt.com/ in that window.");
+            if (opened === false) {
+                stderr(hasInteractiveWindow
+                    ? "login: could not open a ChatGPT tab through the debug port; open https://chatgpt.com/ in that browser."
+                    : `login: could not open a ChatGPT tab through the debug port; run \`${headedLoginCommand}\` to open it visibly.`);
+            }
             await sleepFn(pollMs);
             continue;
         }
         const state = !status.reachable
             ? "login: browser starting..."
             : status.blocker
-                ? `login: blocked - ${status.blocker.message}`
+                ? `login: blocked - ${status.blocker.message}${hasInteractiveWindow ? "" : headedLoginHint}`
                 : !status.loggedInLikely
-                    ? "login: waiting for ChatGPT login in the opened window..."
+                    ? hasInteractiveWindow
+                        ? "login: waiting for ChatGPT login in the dedicated Chrome browser..."
+                        : `login: waiting for a saved ChatGPT login.${headedLoginHint}`
                     : !status.hasComposer
-                        ? "login: logged in; open a chat so the prompt composer is visible..."
+                        ? hasInteractiveWindow
+                            ? "login: logged in; open a chat so the prompt composer is visible..."
+                            : `login: logged in, but no prompt composer is ready.${headedLoginHint}`
                         : "";
         if (state === "") {
             stderr(`login: READY - logged-in ChatGPT tab with composer detected (${Math.round((now() - startedAt) / 1000)}s).`);
@@ -1960,7 +2144,9 @@ export async function waitForChatGptLoginReady(stderr, options, deps = {}) {
             break;
         await sleepFn(Math.min(pollMs, Math.max(1, remainingMs)));
     }
-    stderr(`login: not ready after ${Math.round(timeoutMs / 1000)}s. Finish login in the browser, then verify with \`prodex pro browser check\`.`);
+    stderr(hasInteractiveWindow
+        ? `login: not ready after ${Math.round(timeoutMs / 1000)}s. Finish login in the browser, then verify with \`prodex pro browser check\`.`
+        : `login: not ready after ${Math.round(timeoutMs / 1000)}s. Run \`${headedLoginCommand}\` to complete login, captcha, or human verification visibly, then retry.`);
     return false;
 }
 export async function assertBrowserLaunchStayedAlive(opened, timeoutMs) {
@@ -2120,10 +2306,17 @@ export function browserSendBlockerFromError(error) {
     const thread = typeof error === "object" && error !== null && "thread" in error && typeof error.thread === "string"
         ? (error.thread)
         : undefined;
+    const requestId = typeof error === "object" &&
+        error !== null &&
+        "requestId" in error &&
+        typeof error.requestId === "string" &&
+        ProdexRequestIdSchema.safeParse(error.requestId).success
+        ? error.requestId
+        : undefined;
     const timedOut = message.match(/Timed out after [\s\S]*?(\d+)\s*ms/);
     if (timedOut) {
-        // Suggest a concrete doubled budget so the user can paste a rerun command
-        // instead of guessing what "raise --timeout-ms" means in milliseconds.
+        // Marked sends recover the exact request. Legacy timeout errors retain a
+        // concrete doubled budget so the user need not guess one.
         const usedMs = Number(timedOut[1]);
         const suggestedMs = Number.isFinite(usedMs) && usedMs > 0 ? usedMs * 2 : 600_000;
         return {
@@ -2131,10 +2324,12 @@ export function browserSendBlockerFromError(error) {
             message,
             retryable: true,
             ...(thread ? { thread } : {}),
-            next_step: `Rerun with a bigger budget (${formatDurationMs(suggestedMs)}): \`prodex pro browser ask --timeout-ms ${suggestedMs} "<same prompt>"\`.` +
-                (thread
-                    ? ` ChatGPT often finishes after prodex gives up - fetch that answer instead of re-asking: \`prodex pro browser recover --target-url ${thread}\`.`
-                    : "")
+            next_step: thread && requestId
+                ? `Do not resend automatically. ChatGPT often finishes after prodex gives up; recover that exact request instead: \`prodex pro browser recover --target-url ${thread} --request-id ${requestId}\`.`
+                : `Rerun with a bigger budget (${formatDurationMs(suggestedMs)}): \`prodex pro browser ask --timeout-ms ${suggestedMs} "<same prompt>"\`.` +
+                    (thread
+                        ? ` ChatGPT often finishes after prodex gives up - fetch that answer instead of re-asking: \`prodex pro browser recover --target-url ${thread}\`.`
+                        : "")
         };
     }
     // A CDP command timeout means the page's renderer stalled, which in the
@@ -2551,9 +2746,14 @@ export async function listConsultListEntries(store, options = { readOnly: true }
     }
     return entries;
 }
+function formatHeadedBrowserLoginCommand(sourceCli, options = {}) {
+    return `${formatBrowserLoginCommand(sourceCli, options)} --headed`;
+}
 export function printBrowserLoginGuide(stdout, input) {
-    const windowAvailable = (input.opened || input.reused === true) && input.headless !== true;
+    const noInteractiveWindow = input.headless === true || input.virtualDisplay === true;
+    const windowAvailable = (input.opened || input.reused === true) && !noInteractiveWindow;
     const loginCommand = formatBrowserLoginCommand(input.sourceCli, input.commandOptions);
+    const headedLoginCommand = formatHeadedBrowserLoginCommand(input.sourceCli, input.commandOptions);
     const runtimeCommandOptions = {
         ...(input.commandOptions?.cwd ? { cwd: input.commandOptions.cwd } : {}),
         ...(input.commandOptions?.port ? { port: input.commandOptions.port } : {})
@@ -2565,13 +2765,18 @@ export function printBrowserLoginGuide(stdout, input) {
         ? input.reused
             ? "Headless ChatGPT browser is already running - reusing it (no window)."
             : "Started the dedicated ChatGPT browser headless (no window). It reuses the profile you signed in with."
-        : input.reused
-            ? "Chrome is already running for ChatGPT - reusing it (no new window opened)."
-            : input.opened
-                ? "Opened the dedicated Chrome window for ChatGPT."
-                : "Dry run: no browser was opened.");
-    if (input.headless && (input.opened || input.reused)) {
+        : input.virtualDisplay && (input.opened || input.reused)
+            ? input.reused
+                ? "ChatGPT browser is already running on its saved virtual display - reusing it (no visible window)."
+                : "Started the dedicated ChatGPT browser on a virtual display (no visible window)."
+            : input.reused
+                ? "Chrome is already running for ChatGPT - reusing it (no new window opened)."
+                : input.opened
+                    ? "Opened the dedicated Chrome window for ChatGPT."
+                    : "Dry run: no browser was opened.");
+    if (noInteractiveWindow && (input.opened || input.reused)) {
         stdout("");
+        stdout(`If ChatGPT needs login, captcha, or human verification, run \`${headedLoginCommand}\` to handle it in a visible window.`);
         stdout(`Next: run \`${checkCommand}\` to confirm the session, then consult as usual.`);
         return;
     }
@@ -2587,7 +2792,9 @@ export function printBrowserLoginGuide(stdout, input) {
         stdout(`7. Run \`${smokeCommand}\` to verify a real Pro response path.`);
     }
     else {
-        stdout(`1. Run \`${loginCommand}\` without \`--dry-run\` to open the dedicated Chrome window.`);
+        stdout(noInteractiveWindow
+            ? `1. Run \`${headedLoginCommand}\` to open a visible dedicated Chrome window for login or verification.`
+            : `1. Run \`${loginCommand}\` without \`--dry-run\` to open the dedicated Chrome window.`);
         stdout(`2. Log in manually at ${input.loginUrl} in that Chrome window.`);
         stdout("3. If ChatGPT asks for captcha, Cloudflare/human verification, permission, or account verification, complete it in the browser.");
         stdout("4. For usage limit, message limit, model limit, or rate limit, wait for the reset or choose an available model in the browser.");