codex-overleaf-link 2.5.1 → 2.6.5

package/extension/src/shared/sessionState.js

@@ -12,12 +12,13 @@
       require('./subagentActivityModel'),
       require('./writebackIntent'),
       require('./directoryCleanupProof'),
-      require('./undoOperations')
+      require('./undoOperations'),
+      require('./contextUsage')
     );
   } else {
     root.CodexOverleafModuleRegistry.define(
       'SessionState',
-      ['I18n', 'SettlementFacts', 'RunInputQueue', 'SelectionContext', 'LineReferences', 'PathRedaction', 'SessionTitle', 'RunActivityModel', 'SubagentActivityModel', 'WritebackIntent', 'DirectoryCleanupProof', 'UndoOperations'],
+      ['I18n', 'SettlementFacts', 'RunInputQueue', 'SelectionContext', 'LineReferences', 'PathRedaction', 'SessionTitle', 'RunActivityModel', 'SubagentActivityModel', 'WritebackIntent', 'DirectoryCleanupProof', 'UndoOperations', 'ContextUsage'],
       factory
     );
   }
@@ -33,7 +34,8 @@
   SubagentActivityModel,
   WritebackIntent,
   DirectoryCleanupProof,
-  UndoOperations
+  UndoOperations,
+  ContextUsage
 ) {
   'use strict';
 
@@ -250,6 +252,7 @@
       selectionContext: SelectionContext.normalize(session.selectionContext),
       projectReferenceFiles: normalizeProjectReferenceFiles(session.projectReferenceFiles),
       codexThreadId: typeof session.codexThreadId === 'string' ? session.codexThreadId : '',
+      contextUsage: ContextUsage.normalize(session.contextUsage),
       forkedFromSessionId: typeof session.forkedFromSessionId === 'string' ? session.forkedFromSessionId : '',
       forkedFromRunId: typeof session.forkedFromRunId === 'string' ? session.forkedFromRunId : '',
       pendingInputs: normalizePendingInputs(
@@ -330,6 +333,7 @@
       focusFiles: normalizeFocusFiles(active.focusFiles),
       projectReferenceFiles: normalizeProjectReferenceFiles(active.projectReferenceFiles),
       codexThreadId: active.codexThreadId || '',
+      contextUsage: ContextUsage.normalize(active.contextUsage),
       providerId: state.providerId || 'builtin'
     };
     state.runs = Array.isArray(active.runs) ? active.runs : [];
@@ -374,6 +378,7 @@
       selectionContext: SelectionContext.normalize(overrides.selectionContext),
       projectReferenceFiles: normalizeProjectReferenceFiles(overrides.projectReferenceFiles),
       codexThreadId: typeof overrides.codexThreadId === 'string' ? overrides.codexThreadId : '',
+      contextUsage: ContextUsage.normalize(overrides.contextUsage),
       forkedFromSessionId: typeof overrides.forkedFromSessionId === 'string' ? overrides.forkedFromSessionId : '',
       forkedFromRunId: typeof overrides.forkedFromRunId === 'string' ? overrides.forkedFromRunId : '',
       pendingInputs: normalizePendingInputs(overrides.pendingInputs)
@@ -439,6 +444,34 @@
     });
   }
 
+  // Composer input changes only the draft on an already normalized state.
+  // Keep live run/event objects intact so typing cannot detach their writers.
+  function updateActiveSessionDraft(state, task) {
+    const active = getActiveSession(state);
+    if (!active) {
+      return mirrorActiveSession({ ...state });
+    }
+    const draft = sanitizeAssistantVisibleText(task);
+    if (draft === active.task && draft === state.task) {
+      return state;
+    }
+    const rawTitle = typeof active.title === 'string' ? active.title.trim() : '';
+    const derivedTitle = deriveSessionTitle(active.runs, task);
+    const titleSource = normalizeTitleSource(active.titleSource, rawTitle, derivedTitle);
+    const next = {
+      ...active,
+      task: draft,
+      updatedAt: new Date().toISOString(),
+      title: normalizeSessionTitle(rawTitle, derivedTitle, titleSource),
+      titleSource
+    };
+    return {
+      ...state,
+      sessions: state.sessions.map(session => session === active ? next : session),
+      task: next.task
+    };
+  }
+
   function setActiveSession(state, sessionId) {
     if (!(state.sessions || []).some(session => session.id === sessionId)) {
       return mirrorActiveSession(state);
@@ -665,7 +698,17 @@
       ...(value.directoryCleanup === true ? { directoryCleanup: true, ...(value.coreRetained === true ? { coreRetained: true } : {}) } : {}) };
   }
 
+  // Normalization makes UI copies of the same record. This identity is page-local:
+  // it never travels through JSON/storage and is never shared by a replacement run.
+  const runIdentities = new WeakMap();
+  function sameRunIdentity(left, right) {
+    return Boolean(left && right && (left === right
+      || (runIdentities.has(left) && runIdentities.get(left) === runIdentities.get(right))));
+  }
+
   function normalizeRun(run, options = {}) {
+    const sourceRun = run;
+
     if (options.restoreRunningRuns === true || options.recoverSettledRuns === true) run = recoverSettledRunningRun(run);
     run = recoverRecordedRunFailure(run, options.locale);
     const shouldStopRestoredRun = options.restoreRunningRuns === true && run.status === 'running';
@@ -681,6 +724,12 @@
         status: 'failed',
         kind: 'report',
         detail: i18n.t(locale, 'restoredRunStoppedDetail'),
+        detailStructured: {
+          conclusion: i18n.t(locale, 'restoredRunStoppedDetail'),
+          conclusionSource: { origin: 'product', key: 'reload_interrupted' },
+          // Ask forbids writeback; an interrupted Auto run has no zero-write proof.
+          meta: run.mode === 'ask' ? [{ key: 'writeResult', value: 'wrote 0 items, skipped 0 items' }] : []
+        },
         failure: { code: 'native_request_failed', source: 'panel_reload' },
         timestamp: new Date().toISOString()
       });
@@ -715,7 +764,9 @@
       undoStatus: sanitizeAssistantVisibleText(run.undoStatus),
       ...(run.undoOwnerProtocol === 1 ? { undoOwnerProtocol: 1 } : {}),
       nativeRequestId: sanitizeAssistantVisibleText(run.nativeRequestId),
+      ...(run.operation === 'compact' ? { operation: 'compact' } : {}),
       codexThreadId: sanitizeAssistantVisibleText(run.codexThreadId), codexTurnId: sanitizeAssistantVisibleText(run.codexTurnId),
+      contextUsage: run.forkSnapshot === true ? null : ContextUsage.normalize(run.contextUsage),
       forkSnapshot: run.forkSnapshot === true,
       forkSourceRunId: sanitizeAssistantVisibleText(run.forkSourceRunId),
       nativeEventSeq: Number.isFinite(Number(run.nativeEventSeq)) ? Number(run.nativeEventSeq) : 0,
@@ -744,6 +795,9 @@
     applyTrackedChangeStatus(normalized, run.trackedChangeStatus);
     Object.assign(normalized, pickWritebackRecovery(run));
 
+    const identity = runIdentities.get(sourceRun) || {};
+    runIdentities.set(sourceRun, identity);
+    runIdentities.set(normalized, identity);
     return normalized;
   }
 
@@ -1231,6 +1285,7 @@
       selectionContext: SelectionContext.normalize(session.selectionContext),
       projectReferenceFiles: normalizeProjectReferenceFiles(session.projectReferenceFiles),
       codexThreadId: typeof session.codexThreadId === 'string' ? session.codexThreadId : '',
+      contextUsage: ContextUsage.normalize(session.contextUsage),
       forkedFromSessionId: normalizeTextField(session.forkedFromSessionId, 160),
       forkedFromRunId: normalizeTextField(session.forkedFromRunId, 160),
       pendingInputs: normalizePendingInputs(session.pendingInputs)
@@ -1319,7 +1374,7 @@
       events: compactRunEvents(run.events, limits),
       ...(run.subagents?.length ? { subagents: SubagentActivityModel.normalize(run.subagents, sanitizeAssistantVisibleText) } : {}),
       attachments: compactRunAttachmentsForStorage(run.attachments, limits),
-      appliedOperations: [],
+      appliedOperations: UndoOperations.compactUnavailableUndoOperations(run),
       undoOperations: undoPayload.undoOperations,
       undoBaseFiles: undoPayload.undoBaseFiles,
       undoTrackedChanges: undoPayload.undoTrackedChanges,
@@ -1332,7 +1387,9 @@
       undoStatus: summarizeTextForStorage(run.undoStatus, 'undo status'),
       ...(run.undoOwnerProtocol === 1 ? { undoOwnerProtocol: 1 } : {}),
       nativeRequestId: normalizeTextField(run.nativeRequestId, 160),
+      ...(run.operation === 'compact' ? { operation: 'compact' } : {}),
       codexThreadId: normalizeTextField(run.codexThreadId, 160), codexTurnId: normalizeTextField(run.codexTurnId, 160),
+      contextUsage: run.forkSnapshot === true ? null : ContextUsage.normalize(run.contextUsage),
       forkSnapshot: run.forkSnapshot === true,
       forkSourceRunId: normalizeTextField(run.forkSourceRunId, 160),
       nativeEventSeq: Number.isFinite(Number(run.nativeEventSeq)) ? Number(run.nativeEventSeq) : 0,
@@ -1744,6 +1801,7 @@
   }
 
   return {
+    sameRunIdentity,
     normalizeRecoveryRetention,
     pruneRunRecoveryScope,
     pickWritebackRecovery,
@@ -1759,6 +1817,7 @@
     selectVisibleSessionsForList,
     setActiveSession,
     updateActiveSession,
+    updateActiveSessionDraft,
     normalizeRuns,
     normalizeRunStatus,
     recoverRecordedRunFailure,

package/extension/src/shared/sessionTitle.js

@@ -25,6 +25,19 @@
   }
 
   function fromPrompt(value, { sanitize = text => text, maxChars = 24 } = {}) {
+    let title = projectPrompt(value, { sanitize, maxChars });
+    // Display titles pass through normalization again on unrelated callbacks.
+    // Finish removing nested formatting/prefixes now, before acknowledging a title.
+    // The bound guards against an input that never settles.
+    for (let pass = 0; pass < 8; pass += 1) {
+      const next = projectPrompt(title, { sanitize, maxChars });
+      if (next === title) return title;
+      title = next;
+    }
+    return title;
+  }
+
+  function projectPrompt(value, { sanitize, maxChars }) {
     if (typeof value !== 'string' || !value.trim()) return '';
     const source = String(sanitize(value.slice(0, INPUT_LIMIT)) || '');
     let fence = null;
@@ -75,7 +88,7 @@
       .replace(/\[(?:REDACTED_SECRET|local path(?::\d+)?)\]/gi, ' ')
       .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
       .replace(/\s+/g, ' ').trim()
-      .replace(/^(?:\u8bf7(?:\u4f60)?\u5e2e\u6211|\u8bf7\u4f60|\u5e2e\u6211|\u9ebb\u70e6\u4f60(?:\u5e2e\u6211)?|\u9ebb\u70e6\u5e2e\u6211|please\s+)\s*/i, '');
+      .replace(/^(?:(?:\u8bf7(?:\u4f60)?\u5e2e\u6211|\u8bf7\u4f60|\u5e2e\u6211|\u9ebb\u70e6\u4f60(?:\u5e2e\u6211)?|\u9ebb\u70e6\u5e2e\u6211|please\s+)\s*)+/i, '');
   }
 
   function isScaffolding(value) {

package/extension/src/shared/sharedSessionBridge.js

@@ -160,7 +160,9 @@
       Object.defineProperty(record, BASE, { value: base, enumerable: true });
       return record;
     }
-    async function list(projectId = '', adopt = true) {
+    // List reads keep a per-record merge base without changing the visible view's
+    // baseline. Hydration explicitly adopts; passive refresh adopts after apply.
+    async function list(projectId = '', adopt = false) {
       const value = capture(projectId);
       await migrate(value);
       const result = []; let after = '';
@@ -185,29 +187,94 @@
       return Boolean(base && (session.updatedAt !== base.updatedAt || session.task !== base.task));
     }
     function wasStored(id) { return baselines.has(cacheKey(capture(), id)); }
+    function acknowledgeReviewBaseline(base, record, receipt, runIds) {
+      if (!base || !receipt) return base;
+      // Only this caller's acknowledged review fields have been submitted.
+      // The envelope base still describes its own view, never the latest read.
+      return { ...base, runs: (base.runs || []).map(run => {
+        const proposed = record.runs?.find(item => item.id === run.id);
+        const saved = receipt.runs?.find(item => item.id === run.id);
+        return runIds.includes(run.id) && proposed && saved
+          && legacy.reviewStateSnapshot(proposed) === legacy.reviewStateSnapshot(saved)
+          ? legacy.copyRunReviewState(run, proposed) : run;
+      }) };
+    }
     async function put(records, options = {}) {
       if (!records.length) return [];
       const value = capture(records[0].projectId, records[0].accountScopeId);
       if (records.some(record => record.projectId !== value.projectId || record.accountScopeId !== value.accountScopeId))
         throw failure('shared_store_scope_mismatch', 'A session batch must belong to one account and project.');
       return withWrite(value, async () => {
-        const entries = records.map(record => ({
-          record: clean(record),
-          base: record[BASE] || baselines.get(cacheKey(value, record.id)) || null
-        }));
+        const entries = records.map(record => {
+          let base = record[BASE] || baselines.get(cacheKey(value, record.id)) || null;
+          const receipt = options.reviewReceipts?.find(saved => saved.id === record.id
+            && saved.projectId === record.projectId && saved.accountScopeId === record.accountScopeId);
+          base = acknowledgeReviewBaseline(base, record, receipt, options.reviewRunIds || []);
+          return { record: clean(record), base };
+        });
         const transfer = await Transfer.encode(entries);
         const written = await request(transfer.method, value, { ...transfer.payload, reviewRunIds: options.reviewRunIds || [] });
         // Keep the caller's submitted view as its merge baseline. A merged
         // remote change has not necessarily been applied to the visible UI.
-        for (const entry of entries) baselines.set(cacheKey(value, entry.record.id), clean(entry.record));
+        if (options.adopt !== false)
+          for (const entry of entries) baselines.set(cacheKey(value, entry.record.id), clean(entry.record));
         return written;
       });
     }
-    async function get(id) {
+    async function get(id, options = {}) {
       const value = capture();
       await migrate(value);
       const record = await request('get', value, { id });
-      return tag(record, value, !heldLocks.has(lockKey('state', value)));
+      return tag(record, value, options.adopt !== false && !heldLocks.has(lockKey('state', value)));
+    }
+    async function putSessionReviewState(record, runIds) {
+      const value = capture(record.projectId, record.accountScopeId);
+      const ids = new Set(runIds);
+      const assertOwners = () => {
+        assertScope(value);
+        for (const runId of ids) {
+          const owner = heldLocks.get(lockKey('review', { ...value, runId }));
+          if (!owner || owner.lost) throw failure('storage_lock_lost', 'The shared review owner disconnected.');
+        }
+      };
+      assertOwners();
+      return withWrite(value, async () => {
+        assertOwners();
+        const latest = await request('get', value, { id: record.id });
+        if (!latest) throw failure('shared_session_deleted', 'The session no longer exists.');
+        if (latest.projectId !== value.projectId || latest.accountScopeId !== value.accountScopeId)
+          throw failure('shared_store_scope_mismatch', 'The session does not belong to the captured account and project.');
+        const proposed = new Map((record.runs || []).map(run => [run.id, run]));
+        const identity = run => JSON.stringify(['id', 'runProjectId', 'runAccountScopeId', 'startedAt', 'nativeEventSeq',
+          'codexThreadId', 'codexTurnId', 'executionSnapshot', 'forkSnapshot'].map(key => run[key] ?? null));
+        for (const id of ids) {
+          const current = latest.runs?.find(run => run.id === id), incoming = proposed.get(id);
+          if (!current || !incoming || incoming.runProjectId !== value.projectId
+            || (incoming.runAccountScopeId && incoming.runAccountScopeId !== value.accountScopeId)
+            || identity(current) !== identity(incoming))
+            throw failure('review_context_changed', 'The shared review run is no longer available in its original scope.');
+        }
+        const next = { ...clean(latest), runs: latest.runs.map(run => {
+          if (!ids.has(run.id) || run.undoStatus === 'applied' || ['accepted', 'rejected'].includes(run.trackedChangeStatus)) return run;
+          return legacy.copyRunReviewState(run, proposed.get(run.id));
+        }) };
+        const transfer = await Transfer.encode([{ record: next, base: clean(latest) }]);
+        assertOwners();
+        await request(transfer.method, value, { ...transfer.payload, reviewRunIds: [...ids] });
+        const saved = await request('get', value, { id: record.id });
+        assertOwners();
+        if (!saved || saved.projectId !== value.projectId || saved.accountScopeId !== value.accountScopeId
+          || [...ids].some(id => {
+            const run = saved.runs?.find(run => run.id === id);
+            return !run || identity(run) !== identity(proposed.get(id))
+              || legacy.reviewStateSnapshot(run) !== legacy.reviewStateSnapshot(proposed.get(id));
+          })) throw failure('review_state_not_persisted', 'The review outcome was not durably saved. Check Overleaf before retrying.');
+        // A later envelope retry must also recognize the review already saved,
+        // without adopting any peer envelope fields from this readback.
+        const key = cacheKey(value, record.id), base = baselines.get(key);
+        if (base) baselines.set(key, acknowledgeReviewBaseline(base, record, saved, [...ids]));
+        return saved;
+      });
     }
     async function erase(method, projectId = '', id, accountScopeId) {
       const value = capture(projectId, accountScopeId);
@@ -228,7 +295,7 @@
         return record;
       });
       route('getAllSessions', () => list());
-      route('getRecord', (store, id) => store === 'sessions' ? get(id) : api.getRecord(store, id));
+      route('getRecord', (store, id, options) => store === 'sessions' ? get(id, options) : api.getRecord(store, id));
       route('getAllByIndex', async (store, index, value) => {
         if (store !== 'sessions') return api.getAllByIndex(store, index, value);
         const records = await list(index === 'projectId' ? value : '');
@@ -236,10 +303,10 @@
       });
       route('claimSessionsForAccount', async (projectId, accountScopeId, deleted = []) => {
         capture(projectId, accountScopeId);
-        return (await list(projectId)).filter(record => !deleted.includes(record.id));
+        return (await list(projectId, true)).filter(record => !deleted.includes(record.id));
       });
-      route('putRecord', async (store, record) =>
-        store === 'sessions' ? (await put([record]))[0] : api.putRecord(store, record));
+      route('putRecord', async (store, record, options) =>
+        store === 'sessions' ? (await put([record], options))[0] : api.putRecord(store, record));
       route('putRecords', (store, records, options) =>
         store === 'sessions' ? put(records, options) : api.putRecords(store, records));
       route('deleteRecord', (store, id, expectedScope) =>
@@ -280,7 +347,8 @@
         readSharedProjectSnapshot: projectId => list(projectId, false),
         adoptSharedSessionBaseline: adopt,
         hasUnpersistedSharedSession: hasLocalChanges,
-        wasSharedSessionStored: wasStored
+        wasSharedSessionStored: wasStored,
+        putSessionReviewState
       });
       return wrapped;
     }

package/extension/src/shared/staleGuard.js

@@ -7,6 +7,63 @@
 })(typeof globalThis !== 'undefined' ? globalThis : window, function staleGuardFactory() {
   'use strict';
 
+  const DOCUMENT_PROVENANCE_OTHER_MIN = 0.9;
+  const DOCUMENT_PROVENANCE_CLAIMED_MAX = 0.5;
+  const DOCUMENT_PROVENANCE_EDGE_LIMIT = 64 * 1024;
+
+  function assessDocumentProvenance(input = {}) {
+    const { path, projectId, documentIdentity } = input || {};
+    if (documentIdentity !== undefined) {
+      const valid = documentIdentity && typeof documentIdentity === 'object' && !Array.isArray(documentIdentity)
+        && documentIdentity.version === 1 && documentIdentity.source === 'cm-ranges-v1'
+        && typeof projectId === 'string' && projectId.length > 0 && documentIdentity.projectId === projectId
+        && typeof path === 'string' && path.length > 0 && documentIdentity.path === path
+        && typeof documentIdentity.documentId === 'string' && typeof documentIdentity.targetDocumentId === 'string'
+        && /^[a-f0-9]{24}$/.test(documentIdentity.documentId)
+        && /^[a-f0-9]{24}$/.test(documentIdentity.targetDocumentId)
+        && documentIdentity.documentId === documentIdentity.targetDocumentId;
+      return valid ? { ok: true, identityState: 'match' }
+        : { ok: false, code: 'document_identity_mismatch', identityState: 'mismatch' };
+    }
+    try {
+      const { path, text, references } = input || {};
+      if (typeof text !== 'string' || !references) return { ok: true, identityState: 'fallback' };
+      const entries = references instanceof Map ? references : Object.entries(references);
+      const claimed = references instanceof Map ? references.get(path)
+        : Object.prototype.hasOwnProperty.call(references, path) ? references[path] : undefined;
+      if (text === claimed) return { ok: true, identityState: 'fallback' };
+      let matchedPath, bestScore = -1;
+      for (const [otherPath, reference] of entries) {
+        if (otherPath === path || typeof reference !== 'string') continue;
+        if (text === reference) return { ok: false, code: 'document_identity_mismatch', identityState: 'fallback', matchedPath: otherPath };
+        const score = documentSimilarity(text, reference);
+        if (score > bestScore) { bestScore = score; matchedPath = otherPath; }
+      }
+      if (bestScore >= DOCUMENT_PROVENANCE_OTHER_MIN
+        && (typeof claimed !== 'string' || documentSimilarity(text, claimed) < DOCUMENT_PROVENANCE_CLAIMED_MAX)) {
+        return { ok: false, code: 'document_identity_mismatch', identityState: 'fallback', matchedPath };
+      }
+    } catch (_error) {
+      // Unavailable references supply no contradictory evidence.
+    }
+    return { ok: true, identityState: 'fallback' };
+  }
+
+  // Shared prefix + non-overlapping suffix / longer length. For large files,
+  // sample at most 64 Ki UTF-16 units at each edge and cap the denominator at
+  // twice that limit. Exact equality above still compares the complete text.
+  // No token arrays or quadratic diff: total work is O(total reference text),
+  // with bounded per-reference similarity work and constant auxiliary memory.
+  function documentSimilarity(left, right) {
+    const length = Math.min(left.length, right.length);
+    let prefix = 0, suffix = 0;
+    while (prefix < Math.min(length, DOCUMENT_PROVENANCE_EDGE_LIMIT) && left[prefix] === right[prefix]) prefix++;
+    while (suffix < Math.min(length - prefix, DOCUMENT_PROVENANCE_EDGE_LIMIT)
+      && left[left.length - suffix - 1] === right[right.length - suffix - 1]) suffix++;
+    const denominator = Math.min(Math.max(left.length, right.length), 2 * DOCUMENT_PROVENANCE_EDGE_LIMIT);
+    return denominator ? (prefix + suffix) / denominator : 1;
+  }
+
   function buildBaseFileLookup(files) {
     if (!Array.isArray(files) || files.length === 0) {
       return null;
@@ -45,72 +102,62 @@
     const baseContent = normalizeText(baseFileLookup.get(filePath));
     const current = normalizeText(currentContent);
     if (current !== baseContent) {
-      if (typeof console !== 'undefined') {
-        console.warn('[codex-overleaf] staleGuard: STALE', filePath,
-          'base.length:', baseContent.length, 'current.length:', current.length,
-          'base[0..80]:', JSON.stringify(baseContent.slice(0, 80)),
-          'current[0..80]:', JSON.stringify(current.slice(0, 80)));
+      if (Array.isArray(operation.patches) && operation.patches.length) {
+        const preparedPatches = prepareOperationPatches(operation, currentContent, baseFileLookup);
+        if (preparedPatches.ok) return { ok: true, reconciled: true, strategy: 'change-envelope', preparedPatches };
       }
-      const patchRangeFreshness = checkPatchRangeFreshness(operation, currentContent, baseFileLookup);
-      if (patchRangeFreshness) {
-        return patchRangeFreshness;
-      }
-      return {
-        ok: false,
-        code: 'stale_snapshot',
-        reasonKey: 'staleSnapshot',
-        reasonParams: { filePath },
-        reason: `${filePath} 在任务执行期间被你或协作者改过，Codex 没有覆盖它。请查看差异后重试。`
-      };
+      return staleSourceChanged(filePath);
     }
 
     return { ok: true };
   }
 
-  function checkPatchRangeFreshness(operation, currentContent, baseFileLookup) {
-    const prepared = prepareOperationPatches(operation, currentContent, baseFileLookup);
-    if (!prepared.ok) {
-      return { ...prepared, code: 'stale_patch_range', reasonKey: 'stalePatchConflict' };
-    }
-    const patches = prepared.patches;
-    if (!patches.length) {
-      return null;
-    }
-
-    const current = String(currentContent ?? '');
-    for (const rawPatch of patches) {
-      const from = Number(rawPatch?.from);
-      const to = Number(rawPatch?.to);
-      const expected = String(rawPatch?.expected ?? '');
-      if (!Number.isInteger(from) || !Number.isInteger(to) || from < 0 || to < from || to > current.length) {
-        return {
-          ok: false,
-          code: 'stale_patch_range',
-          reasonKey: 'stalePatchLocation',
-          reason: 'Codex 要修改的位置已经无法和当前 Overleaf 内容对齐，所以没有写入。请重新运行任务。'
-        };
-      }
-      if (current.slice(from, to) !== expected) {
-        return {
-          ok: false,
-          code: 'stale_patch_range',
-          reasonKey: 'stalePatchConflict',
-          reason: 'Codex 要修改的具体位置已经被你或协作者改过，所以没有覆盖它。请查看差异后重试。'
-        };
-      }
-    }
-
+  function staleSourceChanged(filePath) {
     return {
-      ok: true,
-      reconciled: true,
-      strategy: 'patch-range'
+      ok: false,
+      code: 'stale_snapshot',
+      reasonKey: 'staleSnapshot',
+      reasonParams: { filePath },
+      reason: `${filePath} 在任务执行期间被你或协作者改过，Codex 没有覆盖它。请查看差异后重试。`
     };
   }
 
-  // Bridge the raw Native baseline to the editor's line-ending representation.
-  // Logical LF offsets are only an intermediate coordinate system: both the
-  // range check and the eventual editor dispatch use the same raw patches.
+  // Rebase only ranges wholly in a common prefix/suffix. All patches use the
+  // same envelope before any of them are applied to the editor.
   function prepareOperationPatches(operation, currentContent, baseFileLookup) {
+    const path = normalizePath(operation?.path), base = baseFileLookup?.get(path);
+    const current = String(currentContent ?? '');
+    const envelope = typeof base === 'string' ? changedEnvelope(normalizeText(base), normalizeText(current)) : null;
+    const prepared = mapOperationPatches(operation, current, baseFileLookup, envelope);
+    return !prepared.ok && envelope ? staleSourceChanged(path) : prepared;
+  }
+
+  function changedEnvelope(base, current) {
+    if (base === current) return null;
+    let prefix = 0, suffix = 0;
+    while (prefix < base.length && prefix < current.length && base[prefix] === current[prefix]) prefix++;
+    while (suffix < base.length - prefix && suffix < current.length - prefix
+      && base[base.length - suffix - 1] === current[current.length - suffix - 1]) suffix++;
+    return { prefix, end: base.length - suffix, delta: current.length - base.length };
+  }
+
+  function mapEnvelopeRange(from, to, envelope, insertion = from === to) {
+    if (!envelope) return { from, to };
+    if (insertion && (from === envelope.prefix || from === envelope.end)) return null;
+    if (to <= envelope.prefix) return { from, to };
+    if (from >= envelope.end) return { from: from + envelope.delta, to: to + envelope.delta };
+    return null;
+  }
+
+  // Historical checkpoints already refer to observed applied offsets. This
+  // compatibility converter never authorizes a new forward write or rebase.
+  function prepareStoredInversePatches(operation, currentContent, baseFileLookup) {
+    return mapOperationPatches(operation, currentContent, baseFileLookup, null);
+  }
+
+  // Logical LF offsets bridge raw Native and editor coordinates. Expand split
+  // CRLF edges before dispatch; keep unchanged editor line endings intact.
+  function mapOperationPatches(operation, currentContent, baseFileLookup, envelope) {
     const patches = Array.isArray(operation?.patches) ? operation.patches : [];
     const current = String(currentContent ?? '');
     const path = normalizePath(operation?.path);
@@ -120,8 +167,21 @@
     }
     const baseMap = lineEndingMap(base);
     const currentMap = lineEndingMap(current);
-    // With no CRLF on either side, retain the existing raw range semantics.
-    if (!baseMap.removed.length && !currentMap.removed.length) return { ok: true, patches };
+    if (!baseMap.removed.length && !currentMap.removed.length) {
+      if (!envelope) return { ok: true, patches };
+      const mapped = [];
+      let previousTo = 0;
+      for (const patch of patches) {
+        const from = Number(patch?.from), to = Number(patch?.to), expected = String(patch?.expected ?? '');
+        if (!Number.isInteger(from) || !Number.isInteger(to) || from < previousTo || to < from || to > base.length
+          || base.slice(from, to) !== expected) return patchMappingFailure('stale_patch');
+        previousTo = to;
+        const range = mapEnvelopeRange(from, to, envelope);
+        if (!range || current.slice(range.from, range.to) !== expected) return patchMappingFailure('stale_patch');
+        mapped.push({ ...range, expected, insert: String(patch.insert ?? '') });
+      }
+      return { ok: true, patches: mapped };
+    }
 
     const groups = [];
     let previousTo = 0;
@@ -132,6 +192,11 @@
       }
       if (base.slice(from, to) !== String(patch.expected ?? '')) return patchMappingFailure('stale_patch');
       previousTo = to;
+      // Check each insertion boundary even if CRLF expansion later merges it
+      // with an adjacent nonempty range.
+      if (!mapEnvelopeRange(baseMap.toLogical(from), baseMap.toLogical(to), envelope, from === to)) {
+        return patchMappingFailure('stale_patch');
+      }
       // Expand only a split CRLF or a new pair formed across an edit edge.
       // Other neighbouring newlines belong to the editor and stay untouched.
       let start = from, end = to;
@@ -147,9 +212,9 @@
 
     const mapped = [], sourceChanges = [];
     for (const group of groups) {
-      const logicalFrom = baseMap.toLogical(group.start), logicalTo = baseMap.toLogical(group.end);
-      if (logicalTo > currentMap.length) return patchMappingFailure('invalid_patch');
-      const from = currentMap.toRaw(logicalFrom), to = currentMap.toRaw(logicalTo);
+      const range = mapEnvelopeRange(baseMap.toLogical(group.start), baseMap.toLogical(group.end), envelope);
+      if (!range || range.from < 0 || range.to > currentMap.length) return patchMappingFailure('stale_patch');
+      const from = currentMap.toRaw(range.from), to = currentMap.toRaw(range.to);
       const expected = current.slice(from, to);
       if (normalizeText(expected) !== normalizeText(base.slice(group.start, group.end))) {
         return patchMappingFailure('stale_patch');
@@ -173,13 +238,13 @@
       while (oldEnd > prefix && newEnd > prefix && expected[oldEnd - 1] === insert[newEnd - 1]) { oldEnd -= 1; newEnd -= 1; }
       mapped.push({ from: from + prefix, to: from + oldEnd, expected: expected.slice(prefix, oldEnd), insert: insert.slice(prefix, newEnd) });
     }
-    // A later operation in the same batch still addresses the original
-    // representation, so advance its baseline separately from editor text.
+    // Preserve source coordinates for line-ending-only conversion. A rebased
+    // entry instead advances to its actual verified editor post-image.
     let sourceContent = base;
     for (const patch of sourceChanges.reverse()) {
       sourceContent = sourceContent.slice(0, patch.from) + patch.insert + sourceContent.slice(patch.to);
     }
-    return { ok: true, patches: mapped, sourceContent };
+    return { ok: true, patches: mapped, ...(!envelope ? { sourceContent } : {}) };
   }
 
   function patchMappingFailure(code) {
@@ -254,9 +319,11 @@
   }
 
   return {
+    assessDocumentProvenance,
     buildBaseFileLookup,
     checkOperationFreshness,
     prepareOperationPatches,
+    prepareStoredInversePatches,
     updateExpectedFileContent,
     removeExpectedFile,
     moveExpectedFile,