codexteer 0.18.2 → 0.20.0

package/src/desktop-cloud.mjs

@@ -52,8 +52,8 @@ export async function sendDesktopCloudInput(target, text, { dryRun = false, newT
   const plan = { thread_id: id, deep_link: desktopCloudLink(id), client_message_id: clientMessageId, backend: "desktop-cloud", connection_mode: "desktop-cloud", delivery_action: newTurn ? "new-turn" : "steer", dry_run: dryRun, message_characters: [...text].length };
   if (dryRun) return { ...plan, sent: false, delivery_status: "not_sent" };
   return withStoreLock(`desktop-cloud-send-${id}`, async () => {
-    const pending = (await listRecords("desktop-cloud-sends", storage)).find(row => row.thread_id === id && row.delivery_status === "unknown");
-    if (pending) throw failure("An earlier Desktop Cloud delivery is unknown. Inspect history; it must not be replayed automatically.", "DESKTOP_CLOUD_DELIVERY_PENDING");
+    const pending = (await listRecords("desktop-cloud-sends", storage)).find(row => row.thread_id === id && row.delivery_status === "unknown" && !row.resolution);
+    if (pending) throw Object.assign(failure(`An earlier Desktop Cloud delivery is unknown and is never replayed automatically. Run history check ${id} ${pending.client_message_id}; if it stays unconfirmed, the user (not a supervisor) can release it with history mark ${id} ${pending.client_message_id} --resolve-unknown --note TEXT.`, "DESKTOP_CLOUD_DELIVERY_PENDING"), { existing_message_id: pending.client_message_id });
     let client, dispatching = false, receipt = { ...plan, prompt_sha256: hash(text), sent: false, delivery_status: "not_sent" };
     const save = () => writeRecord("desktop-cloud-sends", clientMessageId, receipt, storage);
     try {
@@ -96,3 +96,11 @@ export async function confirmDesktopCloudDelivery(entry, verification, storage =
     await writeRecord("desktop-cloud-sends", entry.client_message_id, { ...receipt, delivery_status: "accepted", sent: true, turn_id: verification.turn_id, delivery_verification: "stored" }, storage);
   }, storage);
 }
+export async function resolveDesktopCloudDelivery(target, clientMessageId, resolution, storage = {}) {
+  const id = desktopCloudId(target);
+  return withStoreLock(`desktop-cloud-send-${id}`, async () => {
+    const receipt = await readRecord("desktop-cloud-sends", clientMessageId, storage);
+    if (receipt?.thread_id !== id || receipt.delivery_status !== "unknown" || receipt.resolution) throw failure("This message has no unresolved unknown Desktop Cloud delivery.");
+    const updated = { ...receipt, resolution }; await writeRecord("desktop-cloud-sends", clientMessageId, updated, storage); return updated;
+  }, storage);
+}

package/src/desktop.mjs

@@ -61,7 +61,7 @@ export function openDesktopThread(threadId, { focusComposer = false, prompt, bac
   const deepLink = focusComposer ? threadComposerDeepLink(threadId, prompt) : threadDeepLink(threadId);
   const result = run(OPEN, buildOpenArgs(deepLink, { background }));
   if (result.status !== 0) {
-    throw new Error(result.stderr.trim() || `Failed to open ${deepLink}`);
+    throw Object.assign(new Error(result.stderr.trim() || `Failed to open ${deepLink}`), { code: "DESKTOP_UI_FAILED" });
   }
   return {
     thread_id: threadId,
@@ -74,7 +74,7 @@ export function openDesktopThread(threadId, { focusComposer = false, prompt, bac
 
 function validateWaitMs(waitMs) {
   if (!Number.isInteger(waitMs) || waitMs < 0 || waitMs > 30000) {
-    throw new Error("--wait-ms must be an integer between 0 and 30000.");
+    throw Object.assign(new Error("--wait-ms must be an integer between 0 and 30000."), { code: "OPTIONS_INVALID" });
   }
 }
 
@@ -85,7 +85,7 @@ function requireReadyDesktop() {
     .filter(([, ok]) => !ok)
     .map(([name]) => name)
     .join(", ");
-  throw new Error(`Desktop backend is not ready: ${missing}. ${doctor.remediation ?? ""}`.trim());
+  throw Object.assign(new Error(`Desktop backend is not ready: ${missing}. ${doctor.remediation ?? ""}`.trim()), { code: "DESKTOP_UI_NOT_READY" });
 }
 
 function frontmostProcessId() {
@@ -96,7 +96,7 @@ function frontmostProcessId() {
   if (result.error) throw result.error;
   const processId = Number.parseInt(result.stdout.trim(), 10);
   if (result.status !== 0 || !Number.isInteger(processId) || processId < 1) {
-    throw new Error(result.stderr.trim() || "Could not identify the previously focused application.");
+    throw Object.assign(new Error(result.stderr.trim() || "Could not identify the previously focused application."), { code: "DESKTOP_UI_FAILED" });
   }
   return processId;
 }
@@ -105,7 +105,7 @@ function enableDesktopAccessibility() {
   const result = run(OSASCRIPT, [ACCESSIBILITY_SCRIPT, "enable"], { timeout: 5000 });
   if (result.error) throw result.error;
   if (result.status !== 0) {
-    throw new Error(result.stderr.trim() || "Could not enable the Codex accessibility tree.");
+    throw Object.assign(new Error(result.stderr.trim() || "Could not enable the Codex accessibility tree."), { code: "DESKTOP_UI_FAILED" });
   }
   return result.stdout.trim() || "unchanged";
 }
@@ -115,7 +115,7 @@ function restoreDesktopAccessibility(mode) {
   const result = run(OSASCRIPT, [ACCESSIBILITY_SCRIPT, "restore", mode], { timeout: 5000 });
   if (result.error) throw result.error;
   if (result.status !== 0) {
-    throw new Error(result.stderr.trim() || "Could not restore the Codex accessibility state.");
+    throw Object.assign(new Error(result.stderr.trim() || "Could not restore the Codex accessibility state."), { code: "DESKTOP_UI_FAILED" });
   }
 }
 
@@ -134,7 +134,7 @@ export function inspectDesktopUi(threadId, { waitMs = 1500 } = {}) {
   }
   if (result.error) throw result.error;
   if (result.status !== 0) {
-    throw new Error(result.stderr.trim() || "Could not inspect the Codex Desktop UI.");
+    throw Object.assign(new Error(result.stderr.trim() || "Could not inspect the Codex Desktop UI."), { code: "DESKTOP_UI_FAILED" });
   }
   return {
     thread_id: threadId,
@@ -181,7 +181,7 @@ export function sendDesktopMessage(
   { dryRun = false, waitMs = 1500, newTurn = false, keepFocus = false } = {},
 ) {
   if ((parseThreadTarget(threadId).hostId ?? targetHost()) !== "local") throw remoteReadOnly();
-  if (message.trim() === "") throw new Error("Message must not be empty.");
+  if (message.trim() === "") throw Object.assign(new Error("Message must not be empty."), { code: "OPTIONS_INVALID" });
   validateWaitMs(waitMs);
 
   const desktopSettings = readDesktopSettings();
@@ -202,7 +202,7 @@ export function sendDesktopMessage(
   });
   if (result.error) throw result.error;
   if (result.status !== 0) {
-    throw new Error(result.stderr.trim() || "Codex Desktop did not accept the steering message.");
+    throw Object.assign(new Error(result.stderr.trim() || "Codex Desktop did not accept the steering message."), { code: "DESKTOP_UI_FAILED" });
   }
 
   return { ...plan, dry_run: false, sent: null, delivery_status: "submitted_unverified" };

package/src/directive.mjs

@@ -1,5 +1,6 @@
 import { collectEvidence, verifyEvidence } from "./evidence.mjs";
-import { decodeCursor, threadSnapshot, fetchThread } from "./observe.mjs";
+import { threadSnapshot, fetchThread } from "./observe.mjs";
+import { parseCursor } from "./cursor.mjs";
 import { getCheckpoint, verifyCheckpoint } from "./checkpoint.mjs";
 import { verifyPagedFreshness } from "./paged-read.mjs";
 import { assertFindingSend, getFinding } from "./findings.mjs";
@@ -11,11 +12,11 @@ export async function prepareDirective(threadId, body, options, id, storage = {}
   if (!source && !kind && !evidence.length && !basedOn && !supersedes && !retracts && !expiresAt && !checkpoint && !finding && !supervisor) return { wireText: body, metadata: null };
   const concern = finding ? await assertFindingSend(threadId, finding, storage) : null;
   if (checkpoint) await getCheckpoint(threadId, checkpoint, storage);
-  if (supersedes && retracts) throw new Error("Use either supersedes or retracts, not both.");
-  if (expiresAt && (!/(Z|[+-]\d{2}:\d{2})$/.test(expiresAt) || !Number.isFinite(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) throw new Error("--expires-at must be a future ISO timestamp with timezone.");
-  if (kind && !Object.hasOwn(kindLabels, kind)) throw new Error("--kind must be decision, review, hypothesis, or suggestion.");
-  if (source != null && (!source.trim() || source.length > 80 || /[\r\n\x00-\x1f]/.test(source))) throw new Error("--source must be a non-empty single line (up to 80 characters).");
-  const observed = basedOn ? decodeCursor(basedOn, threadId) : null;
+  if (supersedes && retracts) throw Object.assign(new Error("Use either supersedes or retracts, not both."), { code: "OPTIONS_INVALID" });
+  if (expiresAt && (!/(Z|[+-]\d{2}:\d{2})$/.test(expiresAt) || !Number.isFinite(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) throw Object.assign(new Error("--expires-at must be a future ISO timestamp with timezone."), { code: "OPTIONS_INVALID" });
+  if (kind && !Object.hasOwn(kindLabels, kind)) throw Object.assign(new Error("--kind must be decision, review, hypothesis, or suggestion."), { code: "OPTIONS_INVALID" });
+  if (source != null && (!source.trim() || source.length > 80 || /[\r\n\x00-\x1f]/.test(source))) throw Object.assign(new Error("--source must be a non-empty single line (up to 80 characters)."), { code: "OPTIONS_INVALID" });
+  const observed = basedOn ? parseCursor(basedOn, threadId) : null;
   const refs = await collectEvidence(evidence);
   const metadata = { source: source ?? "external", kind: kind ?? "review", evidence: refs, based_on: basedOn ?? null, supersedes: supersedes ?? null, retracts: retracts ?? null, expires_at: expiresAt ?? null, checkpoint_id: checkpoint ?? null,
     ...(concern ? { finding_id: concern.id, finding_revision: concern.revision } : {}), ...(supervisor ? { supervisor_id: supervisor } : {}) };

package/src/distribution.mjs

@@ -1,6 +1,6 @@
 import { constants } from "node:fs";
 import { lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm } from "node:fs/promises";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
@@ -77,6 +77,25 @@ async function readSafe(file, privateMode) {
   } finally { await handle.close(); }
 }
 
+const present = file => lstat(file).then(() => true, e => { if (e.code !== "ENOENT") throw e; return false; });
+
+// An abandoned lock is never stolen. A concurrent caller can reuse the
+// completed placement after its owner releases this lock.
+async function exclusively(lock, operation) {
+  let lockInfo;
+  for (let attempt = 0; attempt < 100; attempt++) {
+    try { await mkdir(lock, { mode: 0o700 }); lockInfo = await ownedDirectory(lock); break; }
+    catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      await ownedDirectory(lock).catch(e => { if (e.code !== "ENOENT") throw e; });
+      await delay(50);
+    }
+  }
+  if (!lockInfo) throw failure(`Placement is busy or an earlier placement was interrupted. Inspect ${lock} before retrying.`, "DEPLOYMENT_BUSY");
+  try { return await operation(); }
+  finally { if (sameFile(lockInfo, await lstat(lock).catch(() => ({})))) await rm(lock, { recursive: true }); }
+}
+
 async function writeExclusive(file, bytes, mode) {
   const handle = await open(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, mode);
   try { await handle.writeFile(bytes); await handle.sync(); } finally { await handle.close(); }
@@ -155,38 +174,44 @@ export async function prepareDeployment(home, { sourceRoot = PACKAGE_ROOT } = {}
   const canonicalHome = await prepareCodexHome(home);
   const stateRoot = path.join(canonicalHome, "codex-steer"), root = path.join(stateRoot, "runtimes");
   await ownedDirectory(stateRoot, true); await ownedDirectory(root, true);
-  const target = path.join(root, distribution.id), lock = path.join(root, `.install-${distribution.id}`);
-  let lockInfo;
-  // An abandoned lock is never stolen. A concurrent caller can reuse the
-  // completed distribution after its installer releases this lock.
-  for (let attempt = 0; attempt < 100; attempt++) {
-    try { await mkdir(lock, { mode: 0o700 }); lockInfo = await ownedDirectory(lock); break; }
-    catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      await ownedDirectory(lock).catch(e => { if (e.code !== "ENOENT") throw e; });
-      await delay(50);
+  const target = path.join(root, distribution.id);
+  return exclusively(path.join(root, `.install-${distribution.id}`), async () => {
+    let stage, stageInfo;
+    try {
+      if (await present(target)) return { ...await verifyDeployment(target, distribution), codex_home: canonicalHome, reused: true };
+      stage = await mkdtemp(path.join(root, ".stage-")); stageInfo = await ownedDirectory(stage);
+      for (const file of distribution.manifest.files) {
+        const parts = file.path.split("/"); parts.pop(); let parent = stage;
+        for (const part of parts) { parent = path.join(parent, part); await ownedDirectory(parent, true); }
+        await writeExclusive(path.join(stage, file.path), distribution.contents.get(file.path), file.mode);
+      }
+      await writeExclusive(path.join(stage, RECORD), JSON.stringify({ manifest: distribution.manifest, sha256: distribution.sha256 }) + "\n", 0o600);
+      await verifyDeployment(stage, distribution);
+      // All cooperating installers hold the exclusive lock, and the parent is
+      // private. Refuse even an empty existing directory rather than replacing it.
+      if (await present(target)) throw failure("Deployment destination appeared during placement.");
+      await rename(stage, target); stage = null;
+      return { ...await verifyDeployment(target, distribution), codex_home: canonicalHome, reused: false };
+    } finally {
+      if (stage && sameFile(stageInfo, await lstat(stage).catch(() => ({})))) await rm(stage, { recursive: true });
     }
-  }
-  if (!lockInfo) throw failure("Runtime placement is busy or an earlier installation was interrupted. Inspect the installation lock before retrying.", "DEPLOYMENT_BUSY");
-  let stage, stageInfo;
-  try {
-    const existing = await lstat(target).catch(e => { if (e.code !== "ENOENT") throw e; return null; });
-    if (existing) return { ...await verifyDeployment(target, distribution), codex_home: canonicalHome, reused: true };
-    stage = await mkdtemp(path.join(root, ".stage-")); stageInfo = await ownedDirectory(stage);
-    for (const file of distribution.manifest.files) {
-      const parts = file.path.split("/"); parts.pop(); let parent = stage;
-      for (const part of parts) { parent = path.join(parent, part); await ownedDirectory(parent, true); }
-      await writeExclusive(path.join(stage, file.path), distribution.contents.get(file.path), file.mode);
+  });
+}
+
+// A launcher is named by its own content, so reuse and tamper detection are
+// one comparison. An existing file is verified, never rewritten.
+export async function placeLauncher(deployment, kind, script) {
+  const bytes = Buffer.from(script), stateRoot = path.join(deployment.codex_home, "codex-steer"), bin = path.join(stateRoot, "bin");
+  await ownedDirectory(stateRoot); await ownedDirectory(bin, true);
+  const name = `codexteer-${kind}-${hash(bytes).slice(0, 12)}`, file = path.join(bin, name);
+  return exclusively(path.join(bin, `.install-${name}`), async () => {
+    if (!await present(file)) {
+      const stage = path.join(bin, `.stage-${randomBytes(8).toString("hex")}`);
+      try { await writeExclusive(stage, bytes, 0o700); await rename(stage, file); }
+      finally { await rm(stage, { force: true }); }
     }
-    await writeExclusive(path.join(stage, RECORD), JSON.stringify({ manifest: distribution.manifest, sha256: distribution.sha256 }) + "\n", 0o600);
-    await verifyDeployment(stage, distribution);
-    // All cooperating installers hold the exclusive lock, and the parent is
-    // private. Refuse even an empty existing directory rather than replacing it.
-    if (await lstat(target).catch(e => { if (e.code !== "ENOENT") throw e; return null; })) throw failure("Deployment destination appeared during placement.");
-    await rename(stage, target); stage = null;
-    return { ...await verifyDeployment(target, distribution), codex_home: canonicalHome, reused: false };
-  } finally {
-    if (stage && sameFile(stageInfo, await lstat(stage).catch(() => ({})))) await rm(stage, { recursive: true });
-    if (sameFile(lockInfo, await lstat(lock).catch(() => ({})))) await rm(lock, { recursive: true });
-  }
+    const { bytes: found, info } = await readSafe(file, true);
+    if ((info.mode & 0o777) !== 0o700 || !found.equals(bytes)) throw failure(`The launcher ${file} differs from the one this CLI generates. It was left unchanged; ask the user to inspect or remove it before generating again.`, "LAUNCHER_MODIFIED");
+    return file;
+  });
 }

package/src/evidence.mjs

@@ -8,11 +8,11 @@ import { remoteFingerprintFile } from "./remote-io.mjs";
 export async function fingerprintFile(input) {
   if (targetHost() !== "local") return remoteFingerprintFile(input);
   const ref = path.resolve(input), canonical = await realpath(ref), before = await stat(canonical);
-  if (!before.isFile()) throw new Error("Evidence must be a file or an http(s)/codex URL.");
+  if (!before.isFile()) throw Object.assign(new Error("Evidence must be a file or an http(s)/codex URL."), { code: "OPTIONS_INVALID" });
   const hash = createHash("sha256");
   for await (const data of createReadStream(canonical)) hash.update(data);
   const after = await stat(canonical);
-  if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || (await realpath(ref)) !== canonical) throw new Error("File changed while being fingerprinted. Try again after editing finishes.");
+  if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || (await realpath(ref)) !== canonical) throw Object.assign(new Error("File changed while being fingerprinted. Try again after editing finishes."), { code: "STALE_EVIDENCE" });
   return { type: "file", ref, path: canonical, size: after.size, mode: after.mode & 0o777, sha256: hash.digest("hex") };
 }
 
@@ -20,7 +20,7 @@ export async function collectEvidence(refs = []) {
   return Promise.all(refs.map(async ref => {
     if (/^(https?|codex):\/\//i.test(ref)) {
       const url = new URL(ref);
-      if (url.username || url.password) throw new Error("Evidence URLs must not contain credentials.");
+      if (url.username || url.password) throw Object.assign(new Error("Evidence URLs must not contain credentials."), { code: "OPTIONS_INVALID" });
       return { type: "url", ref: url.href, verification: "reference_only" };
     }
     return fingerprintFile(ref);

package/src/findings.mjs

@@ -2,7 +2,8 @@ import { randomUUID } from "node:crypto";
 import { normalizeTaskId } from "./task-id.mjs";
 import { readRecord, writeRecord, listRecords, withStoreLock } from "./store.mjs";
 import { collectEvidence } from "./evidence.mjs";
-import { decodeCursor, digest } from "./observe.mjs";
+import { digest } from "./observe.mjs";
+import { parseCursor, withCursorReference } from "./cursor.mjs";
 import { verifyCheckpoint } from "./checkpoint.mjs";
 
 const failure = (message, code) => Object.assign(new Error(message), { code });
@@ -14,6 +15,7 @@ const text = (value, label, max = 8000) => {
 // A cursor can advance because our own intervention appeared as a userMessage.
 // It is observation context, never sufficient evidence for another intervention.
 const contextHash = record => digest({ condition: record.condition, evidence: record.evidence });
+const presentFinding = record => ({ ...withCursorReference(record), ...(Array.isArray(record.revisions) ? { revisions: record.revisions.map(withCursorReference) } : {}) });
 
 export async function getFinding(threadInput, id, storage = {}) {
   const threadId = normalizeTaskId(threadInput), record = await readRecord("findings", id, storage);
@@ -33,7 +35,7 @@ export async function createFinding(threadInput, { key, title, condition, eviden
   const threadId = normalizeTaskId(threadInput);
   if (typeof key !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,150}$/.test(key)) throw failure("--key requires a stable short identifier for this concern.", "FINDING_INVALID");
   text(title, "--title", 240); text(condition, "--condition");
-  const refs = await collectEvidence(evidence), observed = basedOn ? decodeCursor(basedOn, threadId) : null;
+  const refs = await collectEvidence(evidence), observed = basedOn ? parseCursor(basedOn, threadId) : null;
   return withStoreLock(`message-${threadId}`, async () => {
     const existing = (await listRecords("findings", storage)).find(record => record?.thread_id === threadId && record.key === key);
     if (existing) return { ...await findingStatus(threadId, existing.id, storage), reused: true };
@@ -42,16 +44,19 @@ export async function createFinding(threadInput, { key, title, condition, eviden
       evidence: refs, based_on: basedOn ?? null, user_revision: observed?.user_revision ?? null, disposition: "open", resolution: null,
       evaluation: { rating: "unrated" }, revisions: [], created_at: now, updated_at: now };
     await writeRecord("findings", record.id, record, storage);
-    return { ...record, status: "open", messages: [], verification: null, reused: false };
+    return presentFinding({ ...record, status: "open", messages: [], verification: null, reused: false });
   }, storage);
 }
 
+// The user's noted resolution of an unknown delivery releases it; absence alone never does.
+export const releasedDelivery = entry => entry.delivery_status === "unknown" && Boolean(entry.resolution);
+
 export async function assertFindingSend(threadInput, id, storage = {}) {
   const record = await getFinding(threadInput, id, storage);
   if (record.disposition !== "open") throw failure("This finding is closed. Reopen it with new evidence or a changed requirement before sending again.", "FINDING_CLOSED");
   // The journal is the reservation: even a crash before writing a receipt leaves
   // an unknown attempt here. Never infer not-sent from a missing response.
-  const previous = (await findingMessages(record, storage)).find(message => message.delivery_status !== "not_sent");
+  const previous = (await findingMessages(record, storage)).find(message => message.delivery_status !== "not_sent" && !releasedDelivery(message));
   if (previous) throw Object.assign(failure("This finding revision already has a pending or accepted intervention. Check its history; do not resend it.", "DUPLICATE_INTERVENTION"), { existing_message_id: previous.id });
   return record;
 }
@@ -60,7 +65,7 @@ export async function findingStatus(threadInput, id, storage = {}) {
   const record = await getFinding(threadInput, id, storage), entries = await findingMessages(record, storage);
   const messages = entries.map(entry => ({ id: entry.id, delivery_status: entry.delivery_status, attempt_state: entry.attempt_state,
     response: entry.response, stored: entry.verification?.status ?? "unchecked" }));
-  const latest = entries.filter(entry => entry.delivery_status !== "not_sent").at(-1);
+  const latest = entries.filter(entry => entry.delivery_status !== "not_sent" && !releasedDelivery(entry)).at(-1);
   let status = record.disposition, verification = null;
   if (record.disposition === "open" && latest) status = latest.delivery_status === "unknown" ? "delivery_unknown"
     : latest.response?.status === "applied" ? "awaiting_verification" : "awaiting_response";
@@ -73,7 +78,7 @@ export async function findingStatus(threadInput, id, storage = {}) {
     } catch (error) { verification = { valid: false, checkpoint_id: record.resolution.checkpoint_id, error_code: error.code ?? "CHECKPOINT_UNAVAILABLE", condition_assessment: "explicit_report" }; }
     if (!verification.valid && record.disposition === "resolved") status = "needs_review";
   }
-  return { ...record, status, messages, verification };
+  return presentFinding({ ...record, status, messages, verification });
 }
 
 export async function listFindings(threadInput, { all = false, limit = 50, ...storage } = {}) {
@@ -100,7 +105,7 @@ async function changeFinding(threadInput, id, update, storage) {
 }
 
 async function knownDelivery(record, storage) {
-  if ((await findingMessages(record, storage)).some(entry => entry.delivery_status === "unknown")) throw failure("Delivery is unknown. Reconcile the existing message before closing or revising this finding.", "FINDING_DELIVERY_UNKNOWN");
+  if ((await findingMessages(record, storage)).some(entry => entry.delivery_status === "unknown" && !releasedDelivery(entry))) throw failure("Delivery is unknown. Reconcile the existing message before closing or revising this finding.", "FINDING_DELIVERY_UNKNOWN");
 }
 
 export async function resolveFinding(threadInput, id, { checkpoint, note, ...storage }) {
@@ -127,7 +132,7 @@ export async function reopenFinding(threadInput, id, { reason, evidence, basedOn
   const threadId = normalizeTaskId(threadInput);
   text(reason, "--reason"); if (condition !== undefined) text(condition, "--condition");
   const refs = evidence === undefined ? undefined : await collectEvidence(evidence);
-  const observed = basedOn === undefined ? undefined : decodeCursor(basedOn, threadId);
+  const observed = basedOn === undefined ? undefined : parseCursor(basedOn, threadId);
   return changeFinding(threadId, id, async record => {
     await knownDelivery(record, storage);
     const updated = { ...record, condition: condition ?? record.condition, evidence: refs ?? record.evidence, based_on: basedOn ?? record.based_on, user_revision: observed?.user_revision ?? record.user_revision };