pi-oracle 0.5.0 → 0.6.1

package/extensions/oracle/lib/runtime.ts

@@ -7,7 +7,7 @@ import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { constants as fsConstants, existsSync, realpathSync, readFileSync } from "node:fs";
 import { access, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { delimiter, dirname, join } from "node:path";
 import { jobBlocksAdmission } from "../shared/job-coordination-helpers.mjs";
 import { isTrackedProcessAlive } from "../shared/process-helpers.mjs";
 import type { OracleConfig } from "./config.js";
@@ -21,6 +21,14 @@ const AGENT_BROWSER_BIN = [process.env.AGENT_BROWSER_PATH, "/opt/homebrew/bin/ag
 ) || "agent-browser";
 const PROFILE_CLONE_TIMEOUT_MS = 120_000;
 const ORACLE_SUBPROCESS_KILL_GRACE_MS = 2_000;
+const WORKSPACE_ROOT_MARKERS = [
+  ".pi/extensions/oracle.json",
+] as const;
+const REQUIRED_ORACLE_DEPENDENCIES = [
+  { name: "agent-browser", command: AGENT_BROWSER_BIN },
+  { name: "tar", command: "tar" },
+  { name: "zstd", command: "zstd" },
+] as const;
 
 export interface OracleRuntimeLeaseMetadata {
   jobId: string;
@@ -51,7 +59,7 @@ export interface OracleConversationLeaseAttempt {
   blocker?: OracleConversationLeaseMetadata;
 }
 
-export function getProjectId(cwd: string): string {
+function resolveRealCwd(cwd: string): string {
   try {
     return realpathSync(cwd);
   } catch {
@@ -59,6 +67,26 @@ export function getProjectId(cwd: string): string {
   }
 }
 
+function hasWorkspaceRootMarker(path: string): boolean {
+  return WORKSPACE_ROOT_MARKERS.some((marker) => existsSync(join(path, marker)));
+}
+
+function resolveWorkspaceRoot(realCwd: string): string {
+  let current = realCwd;
+  let nearestMarkerRoot: string | undefined;
+  while (true) {
+    if (existsSync(join(current, ".git"))) return current;
+    if (!nearestMarkerRoot && hasWorkspaceRootMarker(current)) nearestMarkerRoot = current;
+    const parent = dirname(current);
+    if (parent === current) return nearestMarkerRoot ?? realCwd;
+    current = parent;
+  }
+}
+
+export function getProjectId(cwd: string): string {
+  return resolveWorkspaceRoot(resolveRealCwd(cwd));
+}
+
 export function hasPersistedSessionFile(originSessionFile: string | undefined): originSessionFile is string {
   return Boolean(originSessionFile);
 }
@@ -110,6 +138,99 @@ function unreadableAuthSeedProfileMessage(seedDir: string): string {
   return `Oracle auth seed profile is not readable: ${seedDir}. Fix its permissions or rerun /oracle-auth.`;
 }
 
+function missingBrowserExecutableMessage(executablePath: string): string {
+  return `Configured oracle browser executable does not exist: ${executablePath}. Fix browser.executablePath or install Chrome there.`;
+}
+
+function nonExecutableBrowserMessage(executablePath: string): string {
+  return `Configured oracle browser executable is not executable: ${executablePath}. Fix browser.executablePath permissions or point it at a runnable Chrome binary.`;
+}
+
+function missingLocalDependencyMessage(name: string): string {
+  return `Oracle prerequisite not found on PATH: ${name}. Install ${name} and retry.`;
+}
+
+function unwritableOracleDirectoryMessage(label: "runtime profiles" | "jobs", path: string): string {
+  return `Oracle ${label} directory is not writable: ${path}. Fix its permissions or configure a writable path, then retry.`;
+}
+
+async function resolveExecutableOnPath(command: string): Promise<string | undefined> {
+  if (!command) return undefined;
+  if (command.includes("/")) {
+    try {
+      await access(command, fsConstants.X_OK);
+      return command;
+    } catch {
+      return undefined;
+    }
+  }
+
+  const pathValue = process.env.PATH ?? "";
+  for (const segment of pathValue.split(delimiter)) {
+    if (!segment) continue;
+    const candidate = join(segment, command);
+    try {
+      await access(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return undefined;
+}
+
+async function assertConfiguredBrowserExecutableReady(executablePath: string | undefined): Promise<void> {
+  if (!executablePath) return;
+  let executableStats;
+  try {
+    executableStats = await stat(executablePath);
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
+    if (code === "ENOENT") throw new Error(missingBrowserExecutableMessage(executablePath));
+    if (code === "EACCES" || code === "EPERM") throw new Error(nonExecutableBrowserMessage(executablePath));
+    throw new Error(`Failed to inspect configured oracle browser executable ${executablePath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+
+  if (!executableStats.isFile()) {
+    throw new Error(nonExecutableBrowserMessage(executablePath));
+  }
+
+  try {
+    await access(executablePath, fsConstants.X_OK);
+  } catch {
+    throw new Error(nonExecutableBrowserMessage(executablePath));
+  }
+}
+
+async function assertRequiredLocalDependencyReady(name: string, command: string): Promise<void> {
+  const resolved = await resolveExecutableOnPath(command);
+  if (!resolved) throw new Error(missingLocalDependencyMessage(name));
+}
+
+async function assertWritableDirectory(path: string, label: "runtime profiles" | "jobs"): Promise<void> {
+  try {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+  } catch {
+    throw new Error(unwritableOracleDirectoryMessage(label, path));
+  }
+
+  let directoryStats;
+  try {
+    directoryStats = await stat(path);
+  } catch {
+    throw new Error(unwritableOracleDirectoryMessage(label, path));
+  }
+  if (!directoryStats.isDirectory()) {
+    throw new Error(unwritableOracleDirectoryMessage(label, path));
+  }
+
+  try {
+    await access(path, fsConstants.W_OK | fsConstants.X_OK);
+  } catch {
+    throw new Error(unwritableOracleDirectoryMessage(label, path));
+  }
+}
+
 export async function assertOracleAuthSeedProfileReady(config: OracleConfig): Promise<void> {
   const seedDir = config.browser.authSeedProfileDir;
   let seedStats;
@@ -135,6 +256,12 @@ export async function assertOracleAuthSeedProfileReady(config: OracleConfig): Pr
 
 export async function assertOracleSubmitPrerequisites(config: OracleConfig): Promise<void> {
   await assertOracleAuthSeedProfileReady(config);
+  await assertConfiguredBrowserExecutableReady(config.browser.executablePath);
+  for (const dependency of REQUIRED_ORACLE_DEPENDENCIES) {
+    await assertRequiredLocalDependencyReady(dependency.name, dependency.command);
+  }
+  await assertWritableDirectory(config.browser.runtimeProfilesDir, "runtime profiles");
+  await assertWritableDirectory(ORACLE_JOBS_DIR, "jobs");
 }
 
 export function getSeedGeneration(config: OracleConfig): string | undefined {

package/extensions/oracle/lib/tools.ts

@@ -7,6 +7,7 @@ import { randomUUID } from "node:crypto";
 import { lstat, mkdtemp, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join, posix } from "node:path";
+import { runOracleAuthBootstrap } from "./auth.js";
 import type { ExtensionAPI, ExtensionContext } from "@mariozechner/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 import { formatOracleJobSummary, formatOracleSubmitResponse } from "../shared/job-observability-helpers.mjs";
@@ -58,7 +59,11 @@ import {
 
 const ORACLE_SUBMIT_PARAMS = Type.Object({
   prompt: Type.String({ description: "Prompt text to send to ChatGPT web." }),
-  files: Type.Array(Type.String({ description: "Project-relative file or directory path to include in the archive." }), {
+  files: Type.Array(Type.String({
+    description: "Project-relative file or directory path to include in the archive.",
+    minLength: 1,
+    pattern: ".*\\S.*",
+  }), {
     description: "Exact project-relative files/directories to include in the oracle archive.",
     minItems: 1,
   }),
@@ -150,6 +155,20 @@ type ArchiveCreationResult = {
   includedEntries: string[];
 };
 
+function appendArchiveEntries(target: string[], source: Iterable<string>): void {
+  for (const entry of source) target.push(entry);
+}
+
+function mergeArchiveEntryGroups(groups: Iterable<Iterable<string>>): string[] {
+  const merged: string[] = [];
+  for (const group of groups) appendArchiveEntries(merged, group);
+  return merged;
+}
+
+export function mergeArchiveEntryGroupsForTesting(groups: Iterable<Iterable<string>>): string[] {
+  return mergeArchiveEntryGroups(groups);
+}
+
 function pathContainsSequence(relativePath: string, sequence: readonly string[]): boolean {
   const segments = relativePath.split("/").filter(Boolean);
   if (sequence.length === 0 || segments.length < sequence.length) return false;
@@ -263,7 +282,7 @@ async function expandArchiveEntries(cwd: string, relativePath: string, options?:
     for (const child of children.sort((a, b) => a.name.localeCompare(b.name))) {
       const childRelative = child.name;
       if (await shouldExcludeArchiveChild(join(cwd, childRelative), childRelative, child)) continue;
-      if (child.isDirectory()) results.push(...await expandArchiveEntries(cwd, childRelative));
+      if (child.isDirectory()) appendArchiveEntries(results, await expandArchiveEntries(cwd, childRelative));
       else results.push(childRelative);
     }
     return results;
@@ -279,7 +298,7 @@ async function expandArchiveEntries(cwd: string, relativePath: string, options?:
   for (const child of children.sort((a, b) => a.name.localeCompare(b.name))) {
     const childRelative = posix.join(normalized, child.name);
     if (await shouldExcludeArchiveChild(join(cwd, childRelative), childRelative, child, { forceInclude: options?.forceIncludeSubtree })) continue;
-    if (child.isDirectory()) results.push(...await expandArchiveEntries(cwd, childRelative, { forceIncludeSubtree: options?.forceIncludeSubtree }));
+    if (child.isDirectory()) appendArchiveEntries(results, await expandArchiveEntries(cwd, childRelative, { forceIncludeSubtree: options?.forceIncludeSubtree }));
     else results.push(childRelative);
   }
   return results;
@@ -289,11 +308,12 @@ async function resolveExpandedArchiveEntriesFromInputs(
   cwd: string,
   entries: Array<{ absolute: string; relative: string }>,
 ): Promise<string[]> {
-  return Array.from(new Set((await Promise.all(entries.map(async (entry) => {
+  const expandedGroups = await Promise.all(entries.map(async (entry) => {
     const statEntry = await lstat(entry.absolute);
     const forceIncludeSubtree = statEntry.isDirectory() && entry.relative !== "." && shouldExcludeArchivePath(entry.relative, true);
     return expandArchiveEntries(cwd, entry.relative, { forceIncludeSubtree });
-  }))).flat())).sort();
+  }));
+  return Array.from(new Set(mergeArchiveEntryGroups(expandedGroups))).sort();
 }
 
 export async function resolveExpandedArchiveEntries(cwd: string, files: string[]): Promise<string[]> {
@@ -568,7 +588,7 @@ function resolveFollowUp(previousJobId: string | undefined, cwd: string): {
   };
 }
 
-type OracleToolName = "oracle_submit" | "oracle_read" | "oracle_cancel";
+type OracleToolName = "oracle_auth" | "oracle_submit" | "oracle_read" | "oracle_cancel";
 type OracleToolErrorSource = OracleToolName | "oracle_preflight";
 type OracleQueueSnapshot = { queued: boolean; position?: number; depth?: number };
 type OracleToolErrorDetails = {
@@ -587,7 +607,7 @@ type OracleToolJobDetailsOptions = {
   responseAvailable?: boolean;
 };
 
-const ORACLE_TOOL_NAMES = new Set<OracleToolName>(["oracle_submit", "oracle_read", "oracle_cancel"]);
+const ORACLE_TOOL_NAMES = new Set<OracleToolName>(["oracle_auth", "oracle_submit", "oracle_read", "oracle_cancel"]);
 
 function asRecord(value: unknown): Record<string, unknown> | undefined {
   return typeof value === "object" && value !== null && !Array.isArray(value)
@@ -682,7 +702,7 @@ function buildOracleToolErrorDetails(toolName: OracleToolErrorSource, error: unk
       code: "auth_seed_profile_missing",
       message,
       rejectedValue: message.replace(/^Oracle auth seed profile not found: /, "").replace(/\. Run \/oracle-auth first\.$/, ""),
-      suggestedNextStep: "Run /oracle-auth first, then retry the oracle tool call.",
+      suggestedNextStep: "Call oracle_auth or run /oracle-auth once, then retry the oracle tool call.",
     };
   }
 
@@ -691,7 +711,7 @@ function buildOracleToolErrorDetails(toolName: OracleToolErrorSource, error: unk
       code: "auth_seed_profile_unreadable",
       message,
       rejectedValue: message.replace(/^Oracle auth seed profile is not readable: /, "").replace(/\. Fix its permissions or rerun \/oracle-auth\.$/, ""),
-      suggestedNextStep: "Fix the auth seed profile permissions or rerun /oracle-auth, then retry.",
+      suggestedNextStep: "Fix the auth seed profile permissions or call oracle_auth / rerun /oracle-auth once, then retry.",
     };
   }
 
@@ -700,7 +720,7 @@ function buildOracleToolErrorDetails(toolName: OracleToolErrorSource, error: unk
       code: "auth_seed_profile_invalid_type",
       message,
       rejectedValue: message.replace(/^Oracle auth seed profile is not a directory: /, "").replace(/\. Remove the invalid path or rerun \/oracle-auth\.$/, ""),
-      suggestedNextStep: "Remove the invalid auth seed path or rerun /oracle-auth to recreate it.",
+      suggestedNextStep: "Remove the invalid auth seed path or call oracle_auth / rerun /oracle-auth once to recreate it.",
     };
   }
 
@@ -712,6 +732,52 @@ function buildOracleToolErrorDetails(toolName: OracleToolErrorSource, error: unk
     };
   }
 
+  if (message.startsWith("Configured oracle browser executable does not exist: ")) {
+    return {
+      code: "browser_executable_missing",
+      message,
+      rejectedValue: message.replace(/^Configured oracle browser executable does not exist: /, "").replace(/\. Fix browser\.executablePath or install Chrome there\.$/, ""),
+      suggestedNextStep: "Fix browser.executablePath or install Chrome at that path, then retry.",
+    };
+  }
+
+  if (message.startsWith("Configured oracle browser executable is not executable: ")) {
+    return {
+      code: "browser_executable_not_executable",
+      message,
+      rejectedValue: message.replace(/^Configured oracle browser executable is not executable: /, "").replace(/\. Fix browser\.executablePath permissions or point it at a runnable Chrome binary\.$/, ""),
+      suggestedNextStep: "Fix browser.executablePath permissions or point it at a runnable Chrome binary, then retry.",
+    };
+  }
+
+  if (message.startsWith("Oracle prerequisite not found on PATH: ")) {
+    const rejectedValue = message.replace(/^Oracle prerequisite not found on PATH: /, "").replace(/\. Install .*$/, "");
+    return {
+      code: "local_dependency_missing",
+      message,
+      rejectedValue,
+      suggestedNextStep: `Install ${rejectedValue || "the missing dependency"} and retry.`,
+    };
+  }
+
+  if (message.startsWith("Oracle runtime profiles directory is not writable: ")) {
+    return {
+      code: "runtime_profiles_dir_unwritable",
+      message,
+      rejectedValue: message.replace(/^Oracle runtime profiles directory is not writable: /, "").replace(/\. Fix its permissions or configure a writable path, then retry\.$/, ""),
+      suggestedNextStep: "Fix browser.runtimeProfilesDir permissions or configure a writable directory, then retry.",
+    };
+  }
+
+  if (message.startsWith("Oracle jobs directory is not writable: ")) {
+    return {
+      code: "jobs_dir_unwritable",
+      message,
+      rejectedValue: message.replace(/^Oracle jobs directory is not writable: /, "").replace(/\. Fix its permissions or configure a writable path, then retry\.$/, ""),
+      suggestedNextStep: "Fix PI_ORACLE_JOBS_DIR permissions or point it at a writable directory, then retry.",
+    };
+  }
+
   if (toolName === "oracle_submit" && message === "oracle_submit requires at least one file or directory to archive") {
     return {
       code: "archive_input_required",
@@ -720,6 +786,22 @@ function buildOracleToolErrorDetails(toolName: OracleToolErrorSource, error: unk
     };
   }
 
+  if (toolName === "oracle_submit" && message === "Archive input must be a non-empty project-relative path") {
+    return {
+      code: "archive_input_blank",
+      message,
+      suggestedNextStep: "Retry with a non-empty project-relative file or directory path. Use '.' only when you intentionally want a whole-repo archive.",
+    };
+  }
+
+  if (toolName === "oracle_submit" && message === "Archive input must use '.' exactly for a whole-repo archive") {
+    return {
+      code: "archive_input_whole_repo_sentinel_invalid",
+      message,
+      suggestedNextStep: "If you want a whole-repo archive, pass '.' exactly. Otherwise pass an exact project-relative path without extra padding.",
+    };
+  }
+
   if (toolName === "oracle_submit" && message.startsWith("Archive input does not exist: ")) {
     return {
       code: "archive_input_missing",
@@ -815,7 +897,13 @@ function buildOracleToolErrorResult(
 ) {
   const errorDetails = buildOracleToolErrorDetails(toolName, error, params);
   return {
-    content: [{ type: "text" as const, text: errorDetails.message }],
+    content: [{
+      type: "text" as const,
+      text: [
+        errorDetails.message,
+        errorDetails.suggestedNextStep ? `Suggested next step: ${errorDetails.suggestedNextStep}` : undefined,
+      ].filter(Boolean).join("\n"),
+    }],
     details: {
       job: options?.job ? redactJobDetails(options.job, options.jobDetails) : undefined,
       error: errorDetails,
@@ -887,15 +975,16 @@ async function runOraclePreflight(ctx: ExtensionContext): Promise<OraclePrefligh
   try {
     await assertOracleSubmitPrerequisites(config);
   } catch (error) {
+    const errorDetails = buildOracleToolErrorDetails("oracle_preflight", error, {});
     return {
       ready: false,
       session: { persisted: true, sessionFile },
       config: { ready: true },
       auth: {
-        ready: false,
+        ready: !["auth_seed_profile_missing", "auth_seed_profile_unreadable", "auth_seed_profile_invalid_type"].includes(errorDetails.code),
         seedProfileDir: config.browser.authSeedProfileDir,
       },
-      error: buildOracleToolErrorDetails("oracle_preflight", error, {}),
+      error: errorDetails,
     };
   }
 
@@ -910,7 +999,7 @@ async function runOraclePreflight(ctx: ExtensionContext): Promise<OraclePrefligh
   };
 }
 
-export function registerOracleTools(pi: ExtensionAPI, workerPath: string): void {
+export function registerOracleTools(pi: ExtensionAPI, workerPath: string, authWorkerPath = workerPath): void {
   pi.on("tool_result", async (event) => {
     if (!ORACLE_TOOL_NAMES.has(event.toolName as OracleToolName)) return;
     if (event.isError) return;
@@ -939,6 +1028,34 @@ export function registerOracleTools(pi: ExtensionAPI, workerPath: string): void
     },
   });
 
+  pi.registerTool({
+    name: "oracle_auth",
+    label: "Oracle Auth",
+    description: "Refresh the shared oracle auth seed profile by importing ChatGPT cookies from your configured real Chrome profile.",
+    promptSnippet: "Refresh oracle auth before retrying a login-required oracle run.",
+    promptGuidelines: [
+      "Call oracle_auth when an oracle run failed because ChatGPT login is required, the worker said to rerun /oracle-auth, or stale auth appears to be blocking submission execution.",
+      "At most once per user request, refresh auth and then retry the blocked oracle submission.",
+      "If oracle_auth itself fails, stop and report the failure instead of looping.",
+    ],
+    parameters: Type.Object({}),
+    async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
+      try {
+        const projectCwd = getProjectId(ctx.cwd);
+        const message = await runOracleAuthBootstrap(authWorkerPath, projectCwd);
+        return {
+          content: [{ type: "text" as const, text: message }],
+          details: {
+            refreshed: true,
+            authSeedProfileDir: loadOracleConfig(projectCwd).browser.authSeedProfileDir,
+          },
+        };
+      } catch (error) {
+        return buildOracleToolErrorResult("oracle_auth", error, {});
+      }
+    },
+  });
+
   pi.registerTool({
     name: "oracle_submit",
     label: "Oracle Submit",
@@ -948,9 +1065,11 @@ export function registerOracleTools(pi: ExtensionAPI, workerPath: string): void
     promptSnippet: "Dispatch a background ChatGPT web oracle job after gathering repo context.",
     promptGuidelines: [
       "Gather context before calling oracle_submit.",
-      "By default, archive the whole repo by passing '.'; default archive exclusions apply automatically, including common bulky outputs and obvious credentials/private data like .env files, key material, credential dotfiles, local database files, and nested secrets directories anywhere in the repo.",
-      "Only narrow file selection when the user explicitly asks, the task is clearly scoped smaller, or privacy/sensitivity requires it.",
-      "For very targeted asks like a single function or stack trace, a smaller archive is preferable.",
+      "If the immediately preceding oracle run failed because ChatGPT login is required or the worker explicitly said to rerun /oracle-auth, call oracle_auth once before retrying the submission. Do not loop auth refreshes.",
+      "Prefer context-rich archives up to the 250 MB ceiling because more relevant surrounding context is usually better than less.",
+      "By default, archive the whole repo by passing '.' for broad or unclear requests; default archive exclusions apply automatically, including common bulky outputs and obvious credentials/private data like .env files, key material, credential dotfiles, local database files, and nested secrets directories anywhere in the repo.",
+      "For narrower asks, still include nearby tests, docs, configs, and adjacent modules when they may improve answer quality. Only narrow aggressively when the user explicitly asks, privacy/sensitivity requires it, or size pressure forces it.",
+      "Do not default to a one-file archive for a single function, file, or stack trace if the relevant surrounding context still fits comfortably within the limit.",
       "When files='.' and the post-exclusion archive is still too large, submit automatically prunes the largest nested directories matching generic generated-output names like build/, dist/, out/, coverage/, and tmp/ outside obvious source roots like src/ and lib/ until the archive fits or no candidate remains; successful submissions report what was pruned.",
       "If a submitted oracle job later fails because upload is rejected, retry smaller: remove the largest obviously irrelevant/generated content first, then narrow to modified files plus adjacent files plus directly relevant subtrees, then explain the cut or ask the user if still needed.",
       "If oracle_submit itself fails because the local archive still exceeds the upload limit after default exclusions and automatic generic generated-output-dir pruning, or for any other submit-time error, stop and report the error instead of retrying automatically.",
@@ -961,18 +1080,19 @@ export function registerOracleTools(pi: ExtensionAPI, workerPath: string): void
     parameters: ORACLE_SUBMIT_PARAMS,
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
       try {
-        const config = loadOracleConfig(ctx.cwd);
+        const projectCwd = getProjectId(ctx.cwd);
+        const config = loadOracleConfig(projectCwd);
         const originSessionFile = requirePersistedSessionFile(getSessionFile(ctx), "submit oracle jobs");
-        const projectId = getProjectId(ctx.cwd);
+        const projectId = getProjectId(projectCwd);
         const sessionId = getSessionId(originSessionFile, projectId);
         const presetId = typeof params.preset === "string" ? coerceOracleSubmitPresetId(params.preset) : config.defaults.preset;
         const selection = resolveOracleSubmitPreset(presetId);
-        const followUp = resolveFollowUp(params.followUpJobId, ctx.cwd);
+        const followUp = resolveFollowUp(params.followUpJobId, projectCwd);
         // Validate caller-specified archive paths before surfacing unrelated local setup failures such as a missing auth seed profile.
-        resolveArchiveInputs(ctx.cwd, params.files);
+        resolveArchiveInputs(projectCwd, params.files);
         await assertOracleSubmitPrerequisites(config);
         try {
-          await withGlobalReconcileLock({ processPid: process.pid, source: "oracle_submit", cwd: ctx.cwd }, async () => {
+          await withGlobalReconcileLock({ processPid: process.pid, source: "oracle_submit", cwd: projectCwd }, async () => {
             await reconcileStaleOracleJobs();
             await pruneTerminalOracleJobs();
           });
@@ -993,7 +1113,7 @@ export function registerOracleTools(pi: ExtensionAPI, workerPath: string): void
         let spawnedWorker: Awaited<ReturnType<typeof spawnWorker>> | undefined;
 
         try {
-          archive = await createArchive(ctx.cwd, params.files, tempArchivePath);
+          archive = await createArchive(projectCwd, params.files, tempArchivePath);
           const currentArchive = archive;
           await withLock("admission", "global", { jobId, processPid: process.pid }, async () => {
             await promoteQueuedJobsWithinAdmissionLock({ workerPath, source: "oracle_submit" });
@@ -1036,7 +1156,7 @@ export function registerOracleTools(pi: ExtensionAPI, workerPath: string): void
                   chatUrl: followUp.chatUrl,
                   requestSource: "tool",
                 },
-                ctx.cwd,
+                projectCwd,
                 originSessionFile,
                 config,
                 runtime,
@@ -1079,7 +1199,7 @@ export function registerOracleTools(pi: ExtensionAPI, workerPath: string): void
                 chatUrl: followUp.chatUrl,
                 requestSource: "tool",
               },
-              ctx.cwd,
+              projectCwd,
               originSessionFile,
               config,
               runtime,

package/extensions/oracle/shared/job-observability-helpers.mjs

@@ -111,11 +111,11 @@ export function buildOracleWakeupNotificationContent(job, options = {}) {
   const artifactsPath = options.artifactsPath ?? `artifacts unavailable for ${job.id}`;
   return [
     `Oracle job ${job.id} is ${job.status}.`,
-    `Use oracle_read with jobId ${job.id} to open the response and settle wake-up retries.`,
+    `Use /oracle-read ${job.id} to inspect the saved response preview. /oracle-status ${job.id} still shows saved job metadata. Agent callers can use oracle_read({ jobId: "${job.id}" }) if they need tool output in the current turn.`,
     responseLine,
     `Artifacts: ${artifactsPath}`,
     formatOracleLifecycleEvent(getLatestOracleJobLifecycleEvent(job)) ? `Last event: ${formatOracleLifecycleEvent(getLatestOracleJobLifecycleEvent(job))}` : undefined,
-    job.error ? `Error: ${job.error}` : "After oracle_read, continue from the oracle output.",
+    job.error ? `Error: ${job.error}` : "After opening the saved result, continue from the oracle output.",
   ].filter(Boolean).join("\n");
 }
 

package/extensions/oracle/worker/auth-flow-helpers.mjs

@@ -69,7 +69,7 @@ export function classifyChatAuthPage(args) {
   const hasAddFiles = args.snapshot.includes(`button "${addFilesLabel}"`);
   const hasModelControl =
     args.snapshot.includes('button "Model selector"') ||
-    /button "(Instant|Thinking|Pro)(?: [^"]*)?"/.test(args.snapshot);
+    /button "(?:Instant|(?:(?:Light|Standard|Extended|Heavy) )?Thinking|(?:(?:Light|Standard|Extended|Heavy) )?Pro)(?:, click to remove)?"/i.test(args.snapshot);
 
   const challengePatterns = [
     /just a moment/i,