@youdie006/prodex 0.40.6 → 0.40.9

package/dist/cli-server.js

@@ -40,8 +40,8 @@ export async function runSetupCommand(rest, io) {
         ? await runBrowserDefaultsWizard(resolvePromptUser(io), io.stdout)
         : parseBrowserDefaultFlags(rest);
     const config = await writeLocalConfig(targetCwd, {
-        host: readFlag(rest, "--host") ?? "127.0.0.1",
-        port: readPortFlag(rest, "--port") ?? 8787,
+        host: readFlag(rest, "--host"),
+        port: readPortFlag(rest, "--port"),
         token: readFlag(rest, "--token"),
         tokenTtlHours: readPositiveNumberFlag(rest, "--token-ttl-hours"),
         browserDefaults

package/dist/cli.js

@@ -82,10 +82,6 @@ async function runInteractiveUi(io) {
             const { listRecentChatGptConversations } = await import("./chatgpt-browser.js");
             return listRecentChatGptConversations({});
         },
-        openThread: async (url) => {
-            const { navigateChatGptTabTo } = await import("./chatgpt-browser.js");
-            return navigateChatGptTabTo(url, {});
-        },
         listProjectsWithIds: async () => {
             const { listChatGptProjectsWithIds } = await import("./chatgpt-browser.js");
             return listChatGptProjectsWithIds({});
@@ -97,6 +93,7 @@ async function runInteractiveUi(io) {
         },
         runConsult: (args, onProgress) => runCli(args, {
             ...io,
+            navigateInteractiveTarget: true,
             stderr: (line) => {
                 if (line.startsWith("progress:"))
                     onProgress(line);

package/dist/config.js

@@ -102,9 +102,9 @@ export async function writeLocalConfig(cwd, input = {}) {
     await ensureBridgeLocalFiles(cwd);
     await assertLocalConfigTargetSafe(cwd);
     const now = new Date().toISOString();
-    const host = normalizeLoopbackHttpHost(input.host ?? "127.0.0.1");
-    const port = input.port ?? 8787;
     const existing = await readExistingConfig(cwd);
+    const host = normalizeLoopbackHttpHost(input.host ?? existing?.host ?? "127.0.0.1");
+    const port = input.port ?? existing?.port ?? 8787;
     // A setup re-run that only adjusts defaults/host/port must NOT rotate the
     // token - that would silently 401 every client holding the old MCP URL.
     // Rotation happens only when the caller explicitly asks for a token
@@ -275,7 +275,7 @@ export function getTokenExpiryStatus(config, now = new Date()) {
         ? {
             status: "expired",
             token_expires_at: config.token_expires_at,
-            warning: `Token expired at ${config.token_expires_at}. Run \`prodex setup\` to create a new URL.`
+            warning: `Token expired at ${config.token_expires_at}. Run \`prodex setup --token-ttl-hours <hours>\` to create a new URL, then restart \`prodex start\`.`
         }
         : { status: "valid", token_expires_at: config.token_expires_at };
 }

package/dist/continue-thread.js

@@ -125,8 +125,8 @@ export function projectIdFromSidebar(projects, name) {
  *
  * Naming a task wins over the search, because the caller who names one knows
  * which conversation they mean. Otherwise it is the most recent consult that
- * finished, in this project - fail-closed when there is none, since guessing
- * the conversation is the failure this exists to prevent.
+ * finished for this caller, in this project - fail-closed when there is none,
+ * since guessing the conversation is the failure this exists to prevent.
  */
 export function resolveContinuationThread(input) {
     const withThread = input.consults.filter((consult) => consult.thread && isChatGptConversationUrl(consult.thread));
@@ -147,10 +147,17 @@ export function resolveContinuationThread(input) {
         }
         return { target: { taskId: named.taskId, thread: named.thread } };
     }
+    if (!input.sessionKey) {
+        return {
+            error: "--continue needs a caller session key so it cannot select another client's conversation. " +
+                "Pass --session-key <id> (or PRODEX_SESSION_KEY/CODEX_THREAD_ID), or name the intended consult with --continue-task <task_id>."
+        };
+    }
     const knownProjectIds = new Set(input.project ? projectIdsByName(withThread.map((consult) => consult.thread)).get(chatGptProjectSlug(input.project)) ?? [] : []);
     if (input.projectId)
         knownProjectIds.add(input.projectId.toLowerCase());
     const candidates = withThread
+        .filter((consult) => consult.sessionKey === input.sessionKey)
         .filter((consult) => consult.status === "done")
         .filter((consult) => threadMatchesProject(consult.thread, input.project, knownProjectIds))
         .sort((a, b) => (b.createdAt ?? "").localeCompare(a.createdAt ?? ""));

package/dist/http-mcp.js

@@ -27,7 +27,7 @@ export async function startHttpMcpServer(options) {
                 // HOW to authorize without leaking anything token-specific.
                 writeJson(res, 401, {
                     error: "unauthorized",
-                    hint: "Provide a valid token via `?prodex_token=<token>` or `Authorization: Bearer <token>`. If your token expired, regenerate the profile with `prodex setup` and re-read the URL from `prodex status`."
+                    hint: "Provide a valid token via `?prodex_token=<token>` or `Authorization: Bearer <token>`. If your token expired, run `prodex setup --token-ttl-hours <hours>`, restart `prodex start`, and read the new URL with `prodex status --show-token --url-only`."
                 });
                 return;
             }

package/dist/issue-report.js

@@ -24,14 +24,18 @@ export function issueAreaLabel(code) {
 /**
  * Build the report. Only the failure travels: never the prompt, the answer, or
  * the summary, because a public issue must not become where a private consult
- * leaks. Everything included here is either environment or blocker metadata.
+ * leaks. Blocker prose can contain answers, paths and thread URLs, so it stays
+ * local too. Public reports carry a code and a fixed diagnostic summary.
  */
 export function buildIssueReport(consult, environment) {
     if (consult.status !== "blocked" || !consult.blocker) {
         throw new Error(`${consult.task_id} is not a failure (status ${consult.status}), so there is nothing to report.`);
     }
-    const code = (consult.blocker.code ?? "unknown").trim();
-    const message = (consult.blocker.message ?? "").trim();
+    const rawCode = (consult.blocker.code ?? "unknown").trim();
+    const code = /^[a-z][a-z0-9_]{0,79}$/.test(rawCode) ? rawCode : "unknown";
+    const message = code === "smoke_token_mismatch"
+        ? "The browser response did not match the smoke-test token."
+        : "Consult blocked; detailed diagnostics are kept in the local receipt.";
     const area = issueAreaLabel(code);
     const body = [
         "A consult was blocked. Filed from its receipt, so the prompt and the answer are not included.",
@@ -45,7 +49,8 @@ export function buildIssueReport(consult, environment) {
         `| platform | ${environment.platform} |`,
         `| node | ${environment.nodeVersion} |`,
         "",
-        ...(consult.blocker.next_step ? ["What it told the caller to do:", "", `> ${consult.blocker.next_step}`, ""] : []),
+        "Private error details and recovery instructions are omitted. Review the local receipt before sharing more context.",
+        "",
         "Receipt (local, not attached): " + consult.task_id
     ].join("\n");
     return {

package/dist/mcp-tools.js

@@ -4,6 +4,33 @@ import { applyRepoWriteDryRun, createRepoWriteDryRun, stageReviewedPaths } from
 export const MAX_MCP_BRIDGE_TEXT_BYTES = MAX_FETCHABLE_RESULT_ARTIFACT_BYTES;
 export const MAX_MCP_SHORT_TEXT_BYTES = 10_000;
 const MAX_MCP_LIST_ITEMS = 100;
+function redactContextText(text, privateValues = []) {
+    let redacted = text;
+    for (const value of privateValues) {
+        if (value)
+            redacted = redacted.replaceAll(value, "[redacted]");
+    }
+    return redacted.replace(/https?:\/\/(?:chatgpt\.com|chat\.openai\.com)(?![\w.-])(?:[/?#][^\s<>"'`)]*)?/gi, "[redacted ChatGPT URL]");
+}
+function redactBlockerForMcp(blocker, privateValues = []) {
+    if (!blocker)
+        return undefined;
+    const context = [blocker.thread, ...privateValues];
+    return {
+        code: blocker.code,
+        message: redactContextText(blocker.message, context),
+        retryable: blocker.retryable,
+        ...(blocker.next_step !== undefined ? { next_step: redactContextText(blocker.next_step, context) } : {})
+    };
+}
+function redactResultForMcp(result) {
+    return {
+        ...result,
+        summary: result.status === "blocked" ? redactContextText(result.summary, [result.blocker?.thread]) : result.summary,
+        blocker: redactBlockerForMcp(result.blocker),
+        warnings: result.warnings.map((warning) => redactContextText(warning, [result.blocker?.thread]))
+    };
+}
 /**
  * Drop the ChatGPT project name and thread URL before a session crosses the
  * MCP boundary. Both are personal context (the same way receipts redact the
@@ -17,6 +44,8 @@ function redactSessionForMcp(session) {
         redacted.project = undefined;
     if (Object.hasOwn(redacted, "thread"))
         redacted.thread = undefined;
+    redacted.blocker = redactBlockerForMcp(session.blocker, [session.thread, session.project]);
+    redacted.warnings = session.warnings.map((warning) => redactContextText(warning, [session.thread, session.project]));
     return redacted;
 }
 /**
@@ -27,17 +56,20 @@ function redactSessionForMcp(session) {
  * raw task file keeps them for local CLI inspection.
  */
 function redactTaskForMcp(task) {
-    if (!task || typeof task !== "object" || !("provenance" in task) || !task.provenance)
-        return task;
     const provenance = task.provenance;
-    if (!Object.hasOwn(provenance, "thread") && !Object.hasOwn(provenance, "project"))
-        return task;
     const redactedProvenance = { ...provenance };
     if (Object.hasOwn(redactedProvenance, "thread"))
         redactedProvenance.thread = undefined;
     if (Object.hasOwn(redactedProvenance, "project"))
         redactedProvenance.project = undefined;
-    return { ...task, provenance: redactedProvenance };
+    if (provenance?.warnings) {
+        redactedProvenance.warnings = provenance.warnings.map((warning) => redactContextText(warning, [provenance.thread, provenance.project]));
+    }
+    return {
+        ...task,
+        ...(provenance ? { provenance: redactedProvenance } : {}),
+        blocker: redactBlockerForMcp(task.blocker, [provenance?.thread, provenance?.project])
+    };
 }
 export function createMcpToolHandlers(context) {
     const store = new BridgeStore(context.cwd, {
@@ -71,7 +103,7 @@ export function createMcpToolHandlers(context) {
         async bridge_claim_task(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
             assertMcpTextField(input.claimed_by, "claimed_by", MAX_MCP_SHORT_TEXT_BYTES);
-            return { task: await store.claimTask(input.task_id, input.claimed_by ?? claimedBy) };
+            return { task: redactTaskForMcp(await store.claimTask(input.task_id, input.claimed_by ?? claimedBy)) };
         },
         async bridge_complete_task(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
@@ -87,7 +119,7 @@ export function createMcpToolHandlers(context) {
                 warnings: input.warnings,
                 provenance: { adapter: "mcp" }
             });
-            return { result };
+            return { result: redactResultForMcp(result) };
         },
         async bridge_block_task(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
@@ -111,14 +143,14 @@ export function createMcpToolHandlers(context) {
                 },
                 provenance: { adapter: "mcp" }
             });
-            return { result };
+            return { result: redactResultForMcp(result) };
         },
         async bridge_list_results() {
-            return { results: await store.listFinalizedResultsReadOnly() };
+            return { results: (await store.listFinalizedResultsReadOnly()).map(redactResultForMcp) };
         },
         async bridge_fetch_result(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);
-            return { result: await store.getFinalizedResultReadOnly(input.task_id) };
+            return { result: redactResultForMcp(await store.getFinalizedResultReadOnly(input.task_id)) };
         },
         async bridge_fetch_result_artifact(input) {
             assertMcpTextField(input.task_id, "task_id", MAX_MCP_SHORT_TEXT_BYTES);

package/dist/mcp.js

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import process from "node:process";
@@ -6,7 +7,7 @@ import { serializeMessage } from "@modelcontextprotocol/sdk/shared/stdio.js";
 import { JSONRPCMessageSchema } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { createMcpToolHandlers, MAX_MCP_BRIDGE_TEXT_BYTES, MAX_MCP_SHORT_TEXT_BYTES, staleServerWarning, withServerVersionNotice } from "./mcp-tools.js";
-import { ReceiptKindSchema } from "./schema.js";
+import { ProdexRequestIdSchema, ReceiptKindSchema, SessionKeySchema } from "./schema.js";
 const McpBridgeTextSchema = z.string().max(MAX_MCP_BRIDGE_TEXT_BYTES);
 const McpShortTextSchema = z.string().max(MAX_MCP_SHORT_TEXT_BYTES);
 const BridgeFileInputSchema = z.object({
@@ -51,6 +52,7 @@ function serverVersionNotice() {
 }
 export function createServer(cwd = process.cwd(), options = {}) {
     const server = new McpServer({ name: "prodex", version: mcpPackageJson.version ?? "0.0.0" });
+    const mcpSessionKey = `mcp-${randomUUID()}`;
     const handlers = createMcpToolHandlers({
         cwd,
         source: options.source,
@@ -167,9 +169,10 @@ export function createServer(cwd = process.cwd(), options = {}) {
     const browserConsult = options.browserConsult;
     if (browserConsult) {
         server.registerTool("pro_consult", {
-            description: "Ask the user's logged-in ChatGPT (Pro) in the visible browser and wait for the full answer. This drives a real browser send: it can take minutes (Pro extended reasoning), is human-paced, and records a durable receipt under .bridge/. Requires a running `prodex pro browser login` session. By default the consult continues in whatever thread the browser tab is showing - EXCEPT when a project applies (passed here, or pinned as a saved default), because entering a project starts a new chat in it. To follow up on a previous consult, pass continue_thread:true: it resolves the thread from prodex's own records - the newest finished consult of the same project - instead of trusting the shared tab, and continue_task with a task_id names one exactly. Pass new_chat:true to start a fresh thread for a genuinely new topic. If the thread is still generating a previous answer, the send automatically queues behind it (up to the timeout budget) - long 'tab busy' progress is normal, not stuck. `project` and `model` come from saved defaults (per-repo config, or PRODEX_DEFAULT_PROJECT / PRODEX_DEFAULT_MODEL env vars) when omitted - do NOT pass them per-call unless deliberately overriding. Returns task_id, thread URL, and the answer text.",
+            description: "Ask the user's logged-in ChatGPT (Pro) in the visible browser and wait for the full answer. This drives a real browser send: it can take minutes (Pro extended reasoning), is human-paced, and records a durable receipt under .bridge/. Requires a running `prodex pro browser login` session. Every ordinary consult starts a fresh chat, including inside a passed or saved default project; new_chat:false never opts into the shared current tab. To follow up, pass continue_thread:true: it resolves only the newest finished consult with this caller's session_key and project. Each MCP connection gets one default session_key. Logical agents sharing one connection must pass distinct explicit keys and preserve them for follow-ups; an explicit key also preserves identity across MCP restarts. continue_task deliberately names one task across session boundaries. If the thread is still generating a previous answer, the send queues behind it up to the timeout budget. `project` and `model` come from saved defaults when omitted. Returns task_id, thread URL, session_key, request correlation evidence, and the answer text.",
             inputSchema: {
                 prompt: McpBridgeTextSchema.min(1),
+                session_key: SessionKeySchema.optional().describe("Stable logical-caller identifier for scoped continue_thread lookup. Omit to share this MCP connection's default key; logical agents sharing one connection should pass distinct keys and preserve them for follow-ups."),
                 model: McpShortTextSchema.optional(),
                 // pro_mode is deliberately NOT advertised: ChatGPT's 2026-07 update
                 // removed Pro sub-modes, and agents that saw the field passed
@@ -183,7 +186,7 @@ export function createServer(cwd = process.cwd(), options = {}) {
                     .array(McpShortTextSchema)
                     .max(4)
                     .optional()
-                    .describe("ChatGPT composer tools to enable for this consult: \"deep-research\" (a browsed report; prodex presses start and waits out the run, which takes about ten minutes, so the timeout rises to 30 minutes automatically and the FULL report comes back as the answer - if the budget still runs out, the blocker carries the thread and pro_recover collects the report later), \"web-search\" (current facts, with the sources kept as links), \"create-image\". Deep research sometimes replies with a CLARIFYING QUESTION instead; answer it with a normal follow-up consult in the same thread."),
+                    .describe("Rendered ChatGPT composer tools: \"web-search\" or \"create-image\". Only rendered answer content is returned. Automatic deep-research report retrieval is unsupported; requesting \"deep-research\" stops before sending. Use Deep research manually in the ChatGPT UI."),
                 attach: z
                     .array(McpShortTextSchema)
                     .max(10)
@@ -192,11 +195,11 @@ export function createServer(cwd = process.cwd(), options = {}) {
                 new_chat: z
                     .boolean()
                     .optional()
-                    .describe("Start a fresh thread for a new topic."),
+                    .describe("Start a fresh thread. Ordinary consults already do this by default; false does not reuse the shared tab."),
                 continue_thread: z
                     .boolean()
                     .optional()
-                    .describe("Follow up inside the conversation a previous consult is already in, resolved from prodex's records: the newest finished consult of the same project. This is the reliable way to keep a follow-up in one conversation - the tab is shared, and a project default starts a new chat on every send. Fails rather than guessing when this project has no finished consult yet."),
+                    .describe("Follow up inside this caller session_key's newest finished consult of the same project. Fails rather than using another MCP/Codex session or the shared browser tab."),
                 continue_task: z
                     .string()
                     .min(1)
@@ -227,15 +230,16 @@ export function createServer(cwd = process.cwd(), options = {}) {
                         // Progress delivery must never break the consult.
                     });
                 };
-            return asText(withServerVersionNotice(await browserConsult(input, onProgress), serverVersionNotice()));
+            return asText(withServerVersionNotice(await browserConsult({ ...input, session_key: input.session_key ?? mcpSessionKey }, onProgress), serverVersionNotice()));
         });
     }
     const browserRecover = options.browserRecover;
     if (browserRecover) {
         server.registerTool("pro_recover", {
-            description: "Fetch a ChatGPT answer that finished AFTER a consult stopped waiting, and record it as a normal consult receipt. Use this whenever pro_consult came back with a timeout or a still-running blocker: those carry the thread URL, and the answer is almost always sitting in that thread. This is also how a deep research report is collected - a research run takes about ten minutes and keeps going even when the consult that started it has already returned. It sends no prompt, but it does navigate the visible tab to that thread, so it waits for any consult still streaming rather than walking the browser off it.",
+            description: "Read a stable, finished assistant answer rendered in the requested ChatGPT thread after a consult stopped waiting, and record a receipt. Pass the request_id returned by pro_consult to verify the answer follows that exact marked user turn. Without it, legacy recovery returns request_verified:false and an explicit warning. It sends no prompt and acquires the shared send lock before navigating. Wrong-thread, wrong-request, generating, missing, or changing answers are refused.",
             inputSchema: {
                 thread: McpShortTextSchema.min(1).describe("The ChatGPT conversation URL from the blocker (its `thread` field)."),
+                request_id: ProdexRequestIdSchema.optional().describe("The 32-character request_id returned by the original pro_consult."),
                 timeout_ms: z.number().int().positive().max(600_000).optional()
             }
         }, async (input) => asText(withServerVersionNotice(await browserRecover(input), serverVersionNotice())));

package/dist/registry.js

@@ -1,6 +1,8 @@
+import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 const SCHEMA_VERSION = 1;
 /**
  * Central registry of every bridge root on this machine, so local indexers
@@ -86,6 +88,7 @@ async function registerBridgeRootInner(root) {
     try {
         const file = bridgesRegistryPath();
         const abs = await canonicalize(root);
+        const parentRealPath = await preparePrivateRegistryParent(file);
         // Read-modify-write with a bounded verify-retry: rename gives torn-write
         // atomicity but not lost-update safety - two processes registering
         // DIFFERENT roots at the same instant would each read the old list and
@@ -95,7 +98,7 @@ async function registerBridgeRootInner(root) {
         for (let attempt = 0; attempt < 5; attempt++) {
             let roots = [];
             try {
-                const parsed = JSON.parse(await fs.readFile(file, "utf8"));
+                const parsed = JSON.parse(await readRegistryFileForWrite(file, parentRealPath));
                 if (Array.isArray(parsed?.roots)) {
                     roots = parsed.roots.filter((r) => typeof r === "string");
                 }
@@ -115,13 +118,19 @@ async function registerBridgeRootInner(root) {
             }
             survivors.push(abs);
             roots = survivors.length > MAX_REGISTRY_ROOTS ? survivors.slice(survivors.length - MAX_REGISTRY_ROOTS) : survivors;
-            await fs.mkdir(path.dirname(file), { recursive: true });
-            const tmp = `${file}.${process.pid}.${attempt}.tmp`;
-            await fs.writeFile(tmp, `${JSON.stringify({ schema_version: SCHEMA_VERSION, roots }, null, 2)}\n`, "utf8");
-            await fs.rename(tmp, file);
+            const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
+            try {
+                await writeVerifiedUtf8File(tmp, `${JSON.stringify({ schema_version: SCHEMA_VERSION, roots }, null, 2)}\n`, () => assertRegistryWritePathsSafe(file, parentRealPath), { create: true, exclusive: true, mode: 0o600 });
+                await assertRegistryWritePathsSafe(file, parentRealPath);
+                await fs.rename(tmp, file);
+            }
+            catch (error) {
+                await cleanupRegistryTemp(tmp, parentRealPath);
+                throw error;
+            }
             // Verify our root survived a concurrent writer's rename.
             try {
-                const check = JSON.parse(await fs.readFile(file, "utf8"));
+                const check = JSON.parse(await readRegistryFileForWrite(file, parentRealPath));
                 if (Array.isArray(check?.roots) && check.roots.includes(abs))
                     return;
             }
@@ -134,3 +143,42 @@ async function registerBridgeRootInner(root) {
         // Advisory registry - never let it fail a bridge operation.
     }
 }
+async function preparePrivateRegistryParent(file) {
+    const parent = path.dirname(file);
+    await fs.mkdir(parent, { recursive: true, mode: 0o700 });
+    const parentStat = await fs.lstat(parent);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+        throw new Error("Registry parent must be a real directory and must not be a symlink");
+    }
+    await fs.chmod(parent, 0o700);
+    return fs.realpath(parent);
+}
+async function assertRegistryWritePathsSafe(file, parentRealPath) {
+    const parent = path.dirname(file);
+    const parentStat = await fs.lstat(parent);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory() || (await fs.realpath(parent)) !== parentRealPath) {
+        throw new Error("Registry parent changed during write");
+    }
+    try {
+        const targetStat = await fs.lstat(file);
+        if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+            throw new Error("Registry target must be a regular file and must not be a symlink");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+function readRegistryFileForWrite(file, parentRealPath) {
+    return readVerifiedUtf8File(file, () => assertRegistryWritePathsSafe(file, parentRealPath), { maxBytes: 1_000_000 });
+}
+async function cleanupRegistryTemp(tmp, parentRealPath) {
+    try {
+        if ((await fs.realpath(path.dirname(tmp))) === parentRealPath)
+            await fs.rm(tmp, { force: true });
+    }
+    catch {
+        // Do not follow a parent that changed while the advisory write was in flight.
+    }
+}

package/dist/repo-write.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
+import { realpath } from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 import { assertResolvedRepoPathAllowed, resolveRepoPath } from "./repo.js";
-import { readVerifiedUtf8File, replaceVerifiedUtf8File } from "./safe-file.js";
+import { readVerifiedUtf8File, replaceVerifiedUtf8File, withCrossProcessFileLock } from "./safe-file.js";
 const execFileAsync = promisify(execFile);
 const MAX_WRITE_BYTES = 1_000_000;
 let testHooks = {};
@@ -73,8 +74,28 @@ export async function applyRepoWriteDryRun(root, store, input) {
     if (metadata.preimage_sha256 !== input.preimage_sha256) {
         throw new Error(`Expected preimage does not match dry-run receipt`);
     }
+    const newContent = await readDryRunReplacementContent(store, metadata);
+    const resolvedPath = resolveRepoPath(root, metadata.path);
+    await assertResolvedRepoPathAllowed(root, resolvedPath, metadata.path);
+    const canonicalTarget = await realpath(resolvedPath);
+    const canonicalRoot = await realpath(root);
+    const lockFile = path.join(canonicalRoot, ".bridge", `.repo-write-${sha256(canonicalTarget)}.lock`);
+    // This ownership interval closes races among prodex applies. An editor that
+    // does not participate in the lock protocol can still replace the path.
+    return withCrossProcessFileLock(lockFile, {
+        waitMs: 30_000,
+        retryMs: 25,
+        privateParent: true,
+        busyError: (holder) => new Error(`Another prodex repo write for ${metadata.path} is in progress (pid ${holder.pid ?? "unknown"})`),
+        unavailableError: () => new Error(`The prodex repo write lock at ${lockFile} could not be recovered. Stop all writers before removing that lock and its matching .reap claim, then retry.`)
+    }, () => applyRepoWriteUnderLock(root, store, input, metadata, newContent, canonicalTarget));
+}
+async function applyRepoWriteUnderLock(root, store, input, metadata, newContent, canonicalTarget) {
     await assertGitHead(root, input.expected_head);
     const current = await readWritableExistingFile(root, metadata.path);
+    if ((await realpath(current.resolved)) !== canonicalTarget) {
+        throw new Error(`File target changed for ${metadata.path}`);
+    }
     const currentPreimage = sha256(current.content);
     if (currentPreimage !== input.preimage_sha256) {
         // A retry after a successful apply sees the file already holding the new
@@ -85,7 +106,6 @@ export async function applyRepoWriteDryRun(root, store, input) {
         }
         throw new Error(`File preimage changed for ${metadata.path}`);
     }
-    const newContent = await readDryRunReplacementContent(store, metadata);
     let receipt;
     try {
         await replaceVerifiedUtf8File(current.resolved, newContent, async () => {