patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/dist/writeFileAtomic.js

@@ -49,21 +49,48 @@ export function writeFileAtomicSync(target, data, opts = {}) {
         else {
             fs.writeFileSync(tmp, data, { mode });
         }
-        try {
-            fs.renameSync(tmp, target);
-        }
-        catch (renameErr) {
-            // On Windows, renameSync throws EEXIST when the target already exists
-            // (unlike POSIX which atomically replaces). Unlink the target and retry.
-            if (process.platform === "win32" &&
-                renameErr.code === "EEXIST") {
-                fs.unlinkSync(target);
+        // Attempt the rename up to 4 times (immediate + 3 retries at ~50 ms).
+        // On Windows, Defender or an AV tool can hold a brief exclusive handle on
+        // the target (EPERM/EBUSY) between reads; a short backoff is enough.
+        // EEXIST means the target exists but no one holds it — unlink then retry.
+        const RETRYABLE = new Set(["EEXIST", "EPERM", "EBUSY"]);
+        let lastRenameErr;
+        for (let attempt = 0; attempt < 4; attempt++) {
+            try {
+                if (attempt > 0) {
+                    // Atomics.wait is not allowed on the main thread (throws TypeError).
+                    // Best-effort sleep: if it throws, skip the delay and retry immediately.
+                    try {
+                        const buf = new SharedArrayBuffer(4);
+                        Atomics.wait(new Int32Array(buf), 0, 0, 50);
+                    }
+                    catch {
+                        // main thread — no sleep available; retry immediately
+                    }
+                }
                 fs.renameSync(tmp, target);
+                lastRenameErr = undefined;
+                break;
             }
-            else {
-                throw renameErr;
+            catch (err) {
+                const code = err.code;
+                if (code === "EEXIST") {
+                    // EEXIST: target exists — unlink it, then retry the rename.
+                    try {
+                        fs.unlinkSync(target);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                }
+                else if (!RETRYABLE.has(code ?? "")) {
+                    throw err; // non-retryable error; propagate immediately
+                }
+                lastRenameErr = err;
             }
         }
+        if (lastRenameErr !== undefined)
+            throw lastRenameErr;
     }
     catch (err) {
         try {
@@ -98,8 +125,8 @@ export async function writeFileAtomic(target, data, opts = {}) {
         }
         catch (renameErr) {
             // Windows: rename throws EEXIST when target exists (unlike POSIX atomic replace).
-            if (process.platform === "win32" &&
-                renameErr.code === "EEXIST") {
+            // Guard not platform-restricted; POSIX rename never throws EEXIST in practice.
+            if (renameErr.code === "EEXIST") {
                 await fs.promises.unlink(target);
                 await fs.promises.rename(tmp, target);
             }

package/dist/writeFileAtomic.js.map

@@ -1 +1 @@
-{"version":3,"file":"writeFileAtomic.js","sourceRoot":"","sources":["../src/writeFileAtomic.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,GAAG,MAAM,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAkBD;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,IAAyB,EACzB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,sEAAsE;YACtE,yEAAyE;YACzE,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC3B,SAAmC,CAAC,IAAI,KAAK,QAAQ,EACtD,CAAC;gBACD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACtB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,IAAyB,EACzB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;gBACrC,IAAI;gBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO;gBAClC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,kFAAkF;YAClF,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC3B,SAAmC,CAAC,IAAI,KAAK,QAAQ,EACtD,CAAC;gBACD,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"writeFileAtomic.js","sourceRoot":"","sources":["../src/writeFileAtomic.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,GAAG,MAAM,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAkBD;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,IAAyB,EACzB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACxD,IAAI,aAAsB,CAAC;QAC3B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBAChB,qEAAqE;oBACrE,yEAAyE;oBACzE,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;wBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC9C,CAAC;oBAAC,MAAM,CAAC;wBACP,sDAAsD;oBACxD,CAAC;gBACH,CAAC;gBACD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC3B,aAAa,GAAG,SAAS,CAAC;gBAC1B,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;gBACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,4DAA4D;oBAC5D,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtC,MAAM,GAAG,CAAC,CAAC,6CAA6C;gBAC1D,CAAC;gBACD,aAAa,GAAG,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,aAAa,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,IAAyB,EACzB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;gBACrC,IAAI;gBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO;gBAClC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,kFAAkF;YAClF,+EAA+E;YAC/E,IAAK,SAAmC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3D,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "0.2.0-beta.9.canary.92",
+  "version": "1.1.0-beta.1",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",
@@ -64,6 +64,11 @@
     "dist",
     "!dist/__tests__",
     "!dist/**/__tests__",
+    "!dist/recipes/tools/altscan.*",
+    "!dist/recipes/tools/market.*",
+    "!dist/recipes/tools/ta.*",
+    "!dist/recipes/tools/taLedger.*",
+    "!dist/recipes/tools/watchlist.*",
     "scripts/start-all.sh",
     "scripts/start-all.mjs",
     "scripts/start-all.ps1",
@@ -79,7 +84,6 @@
     "scripts/gen-claude-desktop-config.sh",
     "scripts/smoke/run-all.mjs",
     "templates",
-    "deploy",
     "LICENSE",
     "README.md"
   ],
@@ -97,6 +101,7 @@
     "test:smoke:dashboard": "node scripts/smoke/dashboard-walk.mjs",
     "schema:generate": "node scripts/generate-schemas.mjs",
     "schema:check": "node scripts/audit-schema-changes.mjs",
+    "parity:check": "node scripts/audit-parity-xfails.mjs",
     "schema:update": "node scripts/audit-schema-changes.mjs --update",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
@@ -124,7 +129,7 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.213.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.219.0",
     "@opentelemetry/resources": "^2.6.0",
     "@opentelemetry/sdk-trace-node": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",
@@ -132,7 +137,7 @@
     "ipaddr.js": "^2.3.0",
     "minimatch": "^10.0.0",
     "node-cron": "^4.2.1",
-    "undici": "^6.25.0",
+    "undici": "^6.27.0",
     "ws": "^8.18.0",
     "yaml": "^2.8.3"
   },
@@ -141,16 +146,19 @@
     "@types/node": "^22.0.0",
     "@types/node-cron": "^3.0.11",
     "@types/ws": "^8.5.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^4.1.8",
     "@vscode/ripgrep": "^1.17.1",
     "fast-check": "^4.6.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
     "tsx": "^4.0.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.8"
   },
   "lint-staged": {
     "{src,vscode-extension/src,scripts,deploy}/**/*.{ts,js,mjs,cjs,json}": "biome check --no-errors-on-unmatched"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
   }
 }

package/scripts/mcp-stdio-shim.cjs

@@ -30,57 +30,95 @@ const { randomUUID } = require("node:crypto");
 // Resolve ws from the bridge's own node_modules (script lives in scripts/)
 const { WebSocket } = require(path.join(__dirname, "..", "node_modules", "ws"));
 
+// process.kill(pid, 0) probes liveness without delivering a signal: it throws
+// ESRCH when the process is gone and EPERM when it exists but isn't ours (still
+// alive). A stale lock whose bridge has exited would otherwise be "selected"
+// (newest mtime within its tier) and every connect would hang on a refused port
+// until backoff gives up — the multi-bridge footgun. Mirrors the shared
+// src/bridgeLockDiscovery.ts isLive() check.
+function isAlive(pid) {
+  if (typeof pid !== "number" || !Number.isFinite(pid)) return true; // unknown pid → don't exclude
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+
+// Remembers the last lock we logged a selection for, so the diagnostic below
+// fires once at startup (and again only when the selection actually changes)
+// rather than on every poll tick.
+let lastSelectedLockPath = null;
+
+// True when `cwd` is the workspace root or a descendant of it. Used (only when
+// no --workspace filter is set) to prefer the bridge for the project the shim is
+// actually running in, rather than whichever lock has the newest mtime. Mirrors
+// cwdInWorkspace() in src/bridgeLockDiscovery.ts (unit-tested there).
+function cwdInWorkspace(cwd, workspace) {
+  if (!workspace) return false;
+  const rel = path.relative(workspace, cwd);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
 function findLockFile() {
   const lockDir = path.join(
     process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"),
     "ide",
   );
-  // Three-tier preference: orchestrator > bridge > any lock (each by newest mtime).
-  // Orchestrator locks win because child bridge restarts produce newer lock files,
-  // which would hijack the shim away from the orchestrator if we only used mtime.
-  let orchestratorLock = null;
-  let orchestratorMtime = 0;
-  let bridgeLock = null;
-  let bridgeMtime = 0;
-  let fallbackLock = null;
-  let fallbackMtime = 0;
+  const cwd = process.cwd();
+  // Three-tier preference: orchestrator > bridge > any lock. Within a tier, a
+  // lock whose workspace contains the cwd wins (so a no---workspace shim attaches
+  // to the project it is running in); ties break on newest mtime. Orchestrator
+  // locks still win across tiers because child bridge restarts produce newer
+  // lock files that would otherwise hijack the shim away from the orchestrator.
+  const orchestrator = { path: null, mtime: 0, data: null, cwdMatch: false };
+  const bridge = { path: null, mtime: 0, data: null, cwdMatch: false };
+  const fallback = { path: null, mtime: 0, data: null, cwdMatch: false };
   try {
     for (const f of fs.readdirSync(lockDir)) {
       if (!f.endsWith(".lock")) continue;
       const fullPath = path.join(lockDir, f);
       try {
         const stat = fs.statSync(fullPath);
-        let isBridge = false;
-        let isOrchestrator = false;
+        let data = null;
         try {
-          const data = JSON.parse(fs.readFileSync(fullPath, "utf8"));
-          isBridge = data.isBridge === true;
-          isOrchestrator = data.orchestrator === true;
-          // Skip locks that don't match the requested workspace
-          if (
-            workspaceFilter &&
-            data.workspace &&
-            data.workspace !== workspaceFilter
-          )
-            continue;
+          data = JSON.parse(fs.readFileSync(fullPath, "utf8"));
         } catch {
-          // unparseable — treat as non-bridge
+          // unparseable — treated as a fallback lock with no metadata
         }
-        if (isOrchestrator) {
-          if (stat.mtimeMs > orchestratorMtime) {
-            orchestratorMtime = stat.mtimeMs;
-            orchestratorLock = fullPath;
-          }
-        } else if (isBridge) {
-          if (stat.mtimeMs > bridgeMtime) {
-            bridgeMtime = stat.mtimeMs;
-            bridgeLock = fullPath;
-          }
-        } else {
-          if (stat.mtimeMs > fallbackMtime) {
-            fallbackMtime = stat.mtimeMs;
-            fallbackLock = fullPath;
-          }
+        // Skip locks whose owning bridge process has exited. Without this a
+        // wedged/stale lock can be picked and the connection hangs.
+        if (data && !isAlive(data.pid)) continue;
+        // When a workspace filter is set, require an EXACT workspace match — a
+        // lock with a missing/blank workspace field must not be picked under the
+        // filter (otherwise the shim can latch onto an unrelated bridge).
+        if (workspaceFilter && (!data || data.workspace !== workspaceFilter))
+          continue;
+        const isBridge = data ? data.isBridge === true : false;
+        const isOrchestrator = data ? data.orchestrator === true : false;
+        const tier = isOrchestrator
+          ? orchestrator
+          : isBridge
+            ? bridge
+            : fallback;
+        // When no --workspace filter is set, prefer a lock whose workspace
+        // contains the cwd over a non-matching one; otherwise fall back to
+        // newest mtime. (With a filter, every survivor already exact-matches,
+        // so cwdMatch is uniformly false and this reduces to newest-mtime.)
+        const cwdMatch =
+          !workspaceFilter &&
+          !!data &&
+          cwdInWorkspace(cwd, data.workspace || "");
+        const better =
+          tier.path === null ||
+          (cwdMatch && !tier.cwdMatch) ||
+          (cwdMatch === tier.cwdMatch && stat.mtimeMs > tier.mtime);
+        if (better) {
+          tier.mtime = stat.mtimeMs;
+          tier.path = fullPath;
+          tier.data = data;
+          tier.cwdMatch = cwdMatch;
         }
       } catch {
         // skip unreadable files
@@ -90,7 +128,25 @@ function findLockFile() {
     // lock dir doesn't exist
   }
   // Prefer orchestrator > bridge > fallback (each newest mtime within tier)
-  return orchestratorLock ?? bridgeLock ?? fallbackLock;
+  const chosen = orchestrator.path
+    ? orchestrator
+    : bridge.path
+      ? bridge
+      : fallback.path
+        ? fallback
+        : null;
+  // One-line stderr diagnostic so operators can see which bridge/workspace the
+  // shim latched onto — silent wrong-bridge selection was a real footgun. stderr
+  // is not the JSON-RPC stream, so this never corrupts protocol traffic.
+  if (chosen && chosen.path !== lastSelectedLockPath) {
+    lastSelectedLockPath = chosen.path;
+    const wsName = chosen.data?.workspace || "(unknown workspace)";
+    const pid = chosen.data?.pid || "?";
+    process.stderr.write(
+      `mcp-stdio-shim: selected ${path.basename(chosen.path)} (workspace=${wsName}, pid=${pid})\n`,
+    );
+  }
+  return chosen ? chosen.path : null;
 }
 
 function parseLock(lockPath) {
@@ -199,11 +255,16 @@ function scheduleBackoffReconnect(errorType) {
 // Parse named flags first so they don't pollute positional port/token detection.
 const args = process.argv.slice(2);
 let workspaceFilter = null;
+let pingMode = false;
 for (let i = 0; i < args.length; i++) {
-  if (args[i] === "--workspace" && args[i + 1]) {
+  if (args[i] === "--ping" || args[i] === "--probe") {
+    pingMode = true;
+    args.splice(i, 1);
+    i--;
+  } else if (args[i] === "--workspace" && args[i + 1] !== undefined) {
     workspaceFilter = args[i + 1];
     args.splice(i, 2);
-    break;
+    i--;
   }
 }
 const explicitPort = args[0] && args[1] ? Number(args[0]) : null;
@@ -369,8 +430,104 @@ function startPoll() {
   }, POLL_INTERVAL_MS);
 }
 
-// --- Initial connection ---
-if (explicitPort !== null) {
+// --- Ping mode: one-shot probe, then exit ---
+// `grok mcp doctor` (and similar stdio MCP verifiers) hang on this shim because
+// it is a long-lived relay that only exits on stdin EOF. `--ping` / `--probe`
+// gives those tools a clean check: connect, run initialize + tools/list, print a
+// one-line summary, and exit. It skips the relay, lock watcher, and reconnect
+// loops entirely.
+if (pingMode) {
+  let pingPort = explicitPort;
+  let pingToken = explicitToken;
+  if (pingPort === null) {
+    const lockFile = findLockFile();
+    if (!lockFile) {
+      process.stderr.write("mcp-stdio-shim: --ping: no bridge lock found.\n");
+      process.exit(1);
+    }
+    try {
+      const parsed = parseLock(lockFile);
+      pingPort = parsed.port;
+      pingToken = parsed.authToken;
+    } catch (err) {
+      process.stderr.write(
+        `mcp-stdio-shim: --ping: lock unreadable (${err.message}).\n`,
+      );
+      process.exit(1);
+    }
+  }
+  let pingDone = false;
+  const pingWs = new WebSocket(`ws://127.0.0.1:${pingPort}`, {
+    headers: {
+      "x-claude-code-ide-authorization": pingToken,
+      "x-claude-code-session-id": CLIENT_SESSION_ID,
+    },
+  });
+  const failPing = (msg) => {
+    if (pingDone) return;
+    pingDone = true;
+    process.stderr.write(`mcp-stdio-shim: --ping: ${msg}\n`);
+    try {
+      pingWs.terminate();
+    } catch {
+      /* ignore */
+    }
+    process.exit(1);
+  };
+  const pingTimer = setTimeout(
+    () => failPing(`timed out after 5s (port ${pingPort})`),
+    5000,
+  );
+  pingWs.on("open", () => {
+    pingWs.send(
+      JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-06-18",
+          capabilities: {},
+          clientInfo: { name: "shim-ping", version: "1" },
+        },
+      }),
+    );
+  });
+  pingWs.on("message", (raw) => {
+    let msg;
+    try {
+      msg = JSON.parse(raw.toString());
+    } catch {
+      return;
+    }
+    if (msg.id === 1) {
+      pingWs.send(
+        JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+      );
+      pingWs.send(
+        JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
+      );
+    } else if (msg.id === 2) {
+      clearTimeout(pingTimer);
+      pingDone = true;
+      const n =
+        msg.result && Array.isArray(msg.result.tools)
+          ? msg.result.tools.length
+          : "?";
+      process.stdout.write(`bridge OK — port ${pingPort}, ${n} tools\n`);
+      try {
+        pingWs.close();
+      } catch {
+        /* ignore */
+      }
+      process.exit(0);
+    }
+  });
+  pingWs.on("error", (err) => failPing(`connect failed (${err.message})`));
+  pingWs.on("close", (code) =>
+    failPing(`closed before tools/list (code ${code})`),
+  );
+} else if (explicitPort !== null) {
+  // --- Initial connection ---
   connect(explicitPort, explicitToken);
 } else {
   const lockFile = findLockFile();
@@ -398,7 +555,7 @@ if (explicitPort !== null) {
 // Watches ~/.claude/ide/ for .lock file changes. When a new bridge lock appears
 // on a different port, reconnects automatically. This means Claude Desktop never
 // needs to be restarted when the bridge restarts on a new port.
-if (explicitPort === null) {
+if (!pingMode && explicitPort === null) {
   const lockDir = path.join(
     process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"),
     "ide",
@@ -439,52 +596,38 @@ if (explicitPort === null) {
 
 // --- stdin → bridge (newline-delimited JSON-RPC) ---
 // Messages that arrive before the WebSocket is open are queued and flushed on connect.
-process.stdin.setEncoding("utf8");
-process.stdin.on("data", (chunk) => {
-  buffer += chunk;
-  const lines = buffer.split("\n");
-  buffer = lines.pop() ?? "";
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    if (ws && ws.readyState === WebSocket.OPEN) {
-      try {
-        ws.send(trimmed);
-      } catch (sendErr) {
+// Skipped in --ping mode — the one-shot probe manages its own lifecycle and exits.
+if (!pingMode) {
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => {
+    buffer += chunk;
+    const lines = buffer.split("\n");
+    buffer = lines.pop() ?? "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      if (ws && ws.readyState === WebSocket.OPEN) {
+        try {
+          ws.send(trimmed);
+        } catch (sendErr) {
+          process.stderr.write(
+            `mcp-stdio-shim: ws.send failed (${sendErr.message}) — queuing message.\n`,
+          );
+          if (pendingLines.length < MAX_PENDING_LINES) {
+            pendingLines.push(trimmed);
+          }
+        }
+      } else if (pendingLines.length < MAX_PENDING_LINES) {
+        pendingLines.push(trimmed);
+      } else {
         process.stderr.write(
-          `mcp-stdio-shim: ws.send failed (${sendErr.message}) — queuing message.\n`,
+          `mcp-stdio-shim: pendingLines overflow (${MAX_PENDING_LINES}) — dropping message (bridge not connected)\n`,
         );
-        if (pendingLines.length < MAX_PENDING_LINES) {
-          pendingLines.push(trimmed);
-        }
       }
-    } else if (pendingLines.length < MAX_PENDING_LINES) {
-      pendingLines.push(trimmed);
-    } else {
-      process.stderr.write(
-        `mcp-stdio-shim: pendingLines overflow (${MAX_PENDING_LINES}) — dropping message (bridge not connected)\n`,
-      );
     }
-  }
-});
-
-process.stdin.on("end", () => {
-  if (ws) {
-    try {
-      ws.close();
-    } catch {
-      /* ignore */
-    }
-  }
-  process.exit(0);
-});
+  });
 
-process.stdin.on("error", (err) => {
-  // EPIPE / ERR_STREAM_DESTROYED means the MCP host closed the pipe — clean shutdown.
-  if (err.code === "EPIPE" || err.code === "ERR_STREAM_DESTROYED") {
-    process.stderr.write(
-      `mcp-stdio-shim: stdin closed (${err.code}) — shutting down.\n`,
-    );
+  process.stdin.on("end", () => {
     if (ws) {
       try {
         ws.close();
@@ -493,6 +636,23 @@ process.stdin.on("error", (err) => {
       }
     }
     process.exit(0);
-  }
-  process.stderr.write(`mcp-stdio-shim: stdin error: ${err.message}\n`);
-});
+  });
+
+  process.stdin.on("error", (err) => {
+    // EPIPE / ERR_STREAM_DESTROYED means the MCP host closed the pipe — clean shutdown.
+    if (err.code === "EPIPE" || err.code === "ERR_STREAM_DESTROYED") {
+      process.stderr.write(
+        `mcp-stdio-shim: stdin closed (${err.code}) — shutting down.\n`,
+      );
+      if (ws) {
+        try {
+          ws.close();
+        } catch {
+          /* ignore */
+        }
+      }
+      process.exit(0);
+    }
+    process.stderr.write(`mcp-stdio-shim: stdin error: ${err.message}\n`);
+  });
+}

package/templates/CLAUDE.bridge.md

@@ -110,7 +110,7 @@ Workflow:
 
 **If bridge tools are missing from your tool list inside Cowork:** you're in the wrong context. Exit, run the prompt in regular chat, then return.
 
-Full details: [docs/cowork-workflow.md](docs/cowork-workflow.md)
+Full details: [docs/cowork.md](docs/cowork.md)
 
 **Cowork uses git worktrees:** Cowork sessions operate in an isolated git worktree (separate branch/working copy), not the main workspace root. Files written by Cowork land in the worktree. Always add "write all files to the workspace root, not a subdirectory" as the first instruction in your CLAUDE.md when using Cowork with a synced workspace. After Cowork finishes, review and merge the worktree branch back to main.
 

package/templates/recipes/dependency-bump.yaml

@@ -0,0 +1,33 @@
+# yaml-language-server: $schema=https://patchwork.dev/schemas/recipe.v1.json
+# Body for the Dependency Upkeep Worker
+# (templates/workers/dependency-upkeep.worker.yaml). Weekly cron — reviews the
+# open dependency-update PRs rather than opening them (autonomyCeiling L3: a
+# human still merges).
+apiVersion: patchwork.sh/v1
+name: dependency-bump
+description: Weekly — list open dependency-update PRs and summarize which look safe to merge.
+trigger:
+  type: cron
+  at: "0 9 * * MON"
+steps:
+  - tool: github.list_prs
+    max: 30
+    into: prs
+  - agent:
+      prompt: |
+        Open pull requests:
+        {{prs}}
+
+        Identify the dependency-update PRs (dependabot / renovate / "bump …"
+        titles). For each, note the package, the version jump (patch / minor /
+        major), and a recommendation: SAFE to merge (patch/minor with green CI)
+        or NEEDS REVIEW (major, or a security-sensitive dependency). Output a
+        short markdown table; if there are none, say "No dependency PRs open."
+      driver: claude-code
+      into: review
+  - tool: file.write
+    path: ~/.patchwork/inbox/dependency-review-{{date}}.md
+    content: |
+      # Dependency PR review — {{date}}
+
+      {{review}}