pi-oracle 0.7.12 → 0.7.14

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## Unreleased
 
+## 0.7.14 - 2026-06-22
+
+### Changed
+- updated the local pi development and validation baseline to `@earendil-works/*` `0.79.10`
+- refreshed oracle docs and sanity contracts for pi `0.79.10`, and removed the obsolete fleet-tested marker
+
+### Fixed
+- used pi's exported `CONFIG_DIR_NAME` for project config and workspace-root detection instead of hardcoding `.pi`
+- clarified `oracle_preflight` path labels so isolated-session probes distinguish the current persisted session from the provider auth seed profile
+- fixed ChatGPT response completion detection for the current DOM, where assistant text uses `data-message-author-role="assistant"` without legacy `.message-bubble` nodes
+
+### Compatibility
+- reviewed the pi `0.79.10` changelog, extension lifecycle docs/types, compaction event docs, project-trust docs, and package/update docs; no oracle compaction hook changes were required
+
+### Validation
+- ran `npm run verify:oracle`, `npm run smoke:real:packed`, source-mode isolated pi model-agent smoke with the `instant` preset, and `npm run smoke:platform:all`
+
+## 0.7.13 - 2026-06-15
+
+### Added
+- added a release-blocking ChatGPT preset proof gate (`npm run release:proof:chatgpt-presets`) so publishing requires fresh loaded-extension evidence for every canonical ChatGPT preset
+
+### Fixed
+- fixed compact ChatGPT Intelligence menu handling so selected thinking tiers that close back to `Medium`, `High`, or `Extra High` composer pills are accepted only after an intentional matching menu click instead of falling through to the removed legacy effort dropdown
+- fixed `instant_auto_switch` under the compact ChatGPT UI, where the legacy auto-switch control is absent after selecting the compact `Instant` tier
+- made ChatGPT model-configuration opening tolerate slower compact-UI hydration before reporting UI drift
+- stabilized archive creation when the compression subprocess exits before tar, so the worker terminates upstream tar immediately instead of waiting for the archive timeout
+- surfaced provider rate-limit/outage modals explicitly during ChatGPT model setup, upload, send, and response waits instead of reporting generic UI drift
+
 ## 0.7.12 - 2026-06-15
 
 ### Changed

package/README.md

@@ -2,7 +2,7 @@
 
 `pi-oracle` lets a `pi` agent send hard, long-running work to ChatGPT.com or Grok through the web app, with repo archives, background execution, saved results, and a best-effort wake-up back into `pi` when the answer is ready.
 
-> Status: experimental public beta. Validated on macOS, Linux, and Windows native with Chromium-family browsers and pi `0.79.4`. Pi `0.79.4+` is the suggested tested floor for project-trust-aware package/runtime validation, but pi-bundled runtime packages remain optional wildcard peers so npm peer ranges do not block users from trying newer pi releases. Normal oracle jobs run in an isolated browser profile, not your active browser window.
+> Status: experimental public beta. Validated on macOS, Linux, and Windows native with Chromium-family browsers and pi `0.79.10`. Pi `0.79.10+` is the suggested tested floor for project-trust-aware package/runtime validation, but pi-bundled runtime packages remain optional wildcard peers so npm peer ranges do not block users from trying newer pi releases. Normal oracle jobs run in an isolated browser profile, not your active browser window.
 
 ## What a successful run looks like
 
@@ -77,7 +77,7 @@ You need:
 
 - macOS, Linux, or Windows native
 - Node.js 22 or newer
-- Suggested tested floor: `pi` 0.79.4 or newer; older pi versions are not blocked by package metadata but are outside the current validation baseline
+- Suggested tested floor: `pi` 0.79.10 or newer; older pi versions are not blocked by package metadata but are outside the current validation baseline
 - Google Chrome/Chromium or another Chromium-family browser
 - ChatGPT or Grok already signed in to the configured local browser profile for the provider you plan to use
 - `agent-browser` and `tar` available on the machine; `zstd` is also required when submitting ChatGPT `.tar.zst` archives
@@ -184,7 +184,7 @@ Agent-facing tools:
 
 Most users can start with defaults. Set an agent-level config only when you need a non-default provider, mode, preset, or browser profile.
 
-Pi 0.79.4 gates project-local inputs behind project trust. `pi-oracle` preserves its historical risk-on extension behavior for existing users: project-local `.pi/extensions/oracle.json` safe overrides still load by default for compatibility. They are ignored when you explicitly opt out of project-local inputs with `--no-approve` or save a “do not trust” decision for the project. Privileged browser/auth settings still come only from the agent-level config.
+Pi 0.79+ gates project-local inputs behind project trust. `pi-oracle` preserves its historical risk-on extension behavior for existing users: project-local `.pi/extensions/oracle.json` safe overrides still load by default for compatibility. They are ignored when you explicitly opt out of project-local inputs with `--no-approve` or save a “do not trust” decision for the project. Privileged browser/auth settings still come only from the agent-level config.
 
 `~/.pi/agent/extensions/oracle.json`
 
@@ -382,7 +382,7 @@ npm test
 npm run verify:oracle
 ```
 
-`npm publish` is guarded by `prepublishOnly`, which runs `npm run release:check`. That release gate requires doctor-first macOS, Ubuntu, and Windows native Crabbox evidence. The required Crabbox runtime suite uses packed-install proof, not source-tree `pi -e` loading.
+`npm publish` is guarded by `prepublishOnly`, which runs `npm run release:check`. That release gate now blocks unless fresh live ChatGPT preset proof exists for every canonical preset, then requires doctor-first macOS, Ubuntu, and Windows native Crabbox evidence. The required Crabbox runtime suite uses packed-install proof, not source-tree `pi -e` loading.
 
 Use the narrowest validation workflow that proves the change:
 
@@ -391,6 +391,7 @@ Use the narrowest validation workflow that proves the change:
 | Everyday local iteration | `npm run verify:oracle` |
 | Platform-sensitive changes | `npm run smoke:platform:doctor`, then a focused `node scripts/platform-smoke.mjs run --target <target> --suite <suite>` |
 | Platform matrix proof | `npm run smoke:platform:all` |
+| ChatGPT preset release proof | `npm run release:proof:chatgpt-presets` |
 | Publish/release gate | `npm run release:check` |
 
 For macOS, Ubuntu, and Windows native package/build plus packed runtime validation, use [`docs/platform-smoke.md`](docs/platform-smoke.md). The full release gate is:
@@ -399,9 +400,19 @@ For macOS, Ubuntu, and Windows native package/build plus packed runtime validati
 npm run release:check
 ```
 
+Before a release, run live jobs through the loaded extension for every ChatGPT preset in `ORACLE_SUBMIT_PRESETS`. Each prompt must make the saved response contain exact markers `PRESET <preset> OK` and `PACKAGE pi-oracle`. After every job has completed, save the job ids/job directories in `.artifacts/chatgpt-preset-proof/latest.json`; `validatedAt` must be later than the completed jobs. Start from the checked, intentionally non-valid template:
+
+```bash
+mkdir -p .artifacts/chatgpt-preset-proof
+node scripts/oracle-chatgpt-preset-proof.mjs template > .artifacts/chatgpt-preset-proof/latest.json
+npm run release:proof:chatgpt-presets
+```
+
+The proof checker is intentionally part of `release:check`; it fails if the proof is missing, stale, tied to a different package version/git head, references jobs that completed before the current commit, or lacks actual persisted ChatGPT `.tar.zst` job state and response text for any canonical preset.
+
 The real runtime suite defaults to deterministic installed-tool execution so platform proof stays bounded. Provider/model defaults remain `zai/glm-5.2` for doctor/config and for optional model-agent debugging; override with `PI_ORACLE_REAL_TEST_PROVIDER` and `PI_ORACLE_REAL_TEST_MODEL` when needed. For inner-loop source loading only, use `npm run smoke:real:source`; it is not release proof. Set `PI_ORACLE_REAL_TEST_MODEL_AGENT=1` only when debugging the slower model-agent path. The optional second real-agent negative symlink check is opt-in via `PI_ORACLE_REAL_TEST_NEGATIVE_SYMLINK=1`; `npm run sanity:oracle` covers archive/symlink rejection by default without adding another model-agent turn to the platform release gate.
 
-For manual end-to-end local-extension smoke testing, use [`docs/ORACLE_ISOLATED_PI_VALIDATION.md`](docs/ORACLE_ISOLATED_PI_VALIDATION.md). That workflow launches isolated `pi` coding-agent sessions against this checkout and uses `instant` or `thinking_light`, as required by the project validation policy.
+For manual end-to-end local-extension smoke testing, use [`docs/ORACLE_ISOLATED_PI_VALIDATION.md`](docs/ORACLE_ISOLATED_PI_VALIDATION.md). Ordinary pre-commit smoke runs can still use `instant` or `thinking_light`, but release proof must cover every canonical ChatGPT preset through the loaded extension.
 
 ## Project map
 

package/docs/ORACLE_DESIGN.md

@@ -7,7 +7,7 @@ Companion doc:
 - `docs/ORACLE_RECOVERY_DRILL.md` — safe expired-auth recovery validation drill
 
 Compatibility target:
-- `pi` 0.79.4+ is the suggested tested floor for current project-trust-aware package/runtime validation
+- `pi` 0.79.10+ is the suggested tested floor for current project-trust-aware package/runtime validation
 - package metadata keeps pi runtime packages as optional wildcard peers, so this suggested floor is not enforced as a hard npm install requirement
 - current extension lifecycle only; no backward-compatibility shims for removed `session_switch` / `session_fork` events
 
@@ -234,7 +234,7 @@ Merged config locations:
 - global: `~/.pi/agent/extensions/oracle.json`
 - project: `.pi/extensions/oracle.json`
 
-Project config remains restricted to safe overrides only. On Pi 0.79.4+, pi itself gates project-local inputs behind project trust, but `pi-oracle` keeps its historical risk-on extension behavior for this package-specific safe override file: `.pi/extensions/oracle.json` loads by default for compatibility, and is ignored when Pi reports the project is untrusted, including `--no-approve` or saved “do not trust” decisions. This preserves the existing extension experience while still honoring explicit opt-out/distrust decisions. Browser/auth settings remain global-only because they control local privileged browser state.
+Project config remains restricted to safe overrides only. On Pi 0.79+, pi itself gates project-local inputs behind project trust, but `pi-oracle` keeps its historical risk-on extension behavior for this package-specific safe override file: `.pi/extensions/oracle.json` loads by default for compatibility, and is ignored when Pi reports the project is untrusted, including `--no-approve` or saved “do not trust” decisions. This preserves the existing extension experience while still honoring explicit opt-out/distrust decisions. Browser/auth settings remain global-only because they control local privileged browser state.
 
 ### Current config shape
 
@@ -608,7 +608,7 @@ Live-validated after the concurrency redesign:
 
 Still to verify live after this pivot:
 
-- model-selection verification against the current ChatGPT UI under additional real-world variation
+- full ChatGPT preset release matrix evidence must be refreshed before any release; `npm run release:proof:chatgpt-presets` blocks release without one completed loaded-extension ChatGPT job for every canonical preset
 - optional richer terminal semantics for partial artifact failure (`complete_with_artifact_errors`) in more live scenarios
 
 ## Production readiness criteria
@@ -629,7 +629,7 @@ This architecture is now live-validated for the core release path:
 ### Current readiness summary
 
 Current release blockers for the validated scope:
-- none currently known
+- release is blocked until fresh loaded-extension ChatGPT preset proof passes `npm run release:proof:chatgpt-presets` for every canonical `ORACLE_SUBMIT_PRESETS` id
 
 Remaining non-blocking hardening work:
 - broaden live proof of the new lifecycle/state-machine model across more degraded paths
@@ -639,6 +639,10 @@ Remaining non-blocking hardening work:
 - keep hardening model-selection verification against future ChatGPT UI variation
 
 Recent proof points:
+- Pi 0.79.10 local gate: `npm run verify:oracle` passed on 2026-06-22 after the 0.79.10 baseline refresh and `CONFIG_DIR_NAME` cleanup
+- Pi 0.79.10 isolated extension smokes: `.artifacts/real-smoke/run-1782137209549-0xe67z` passed packed-install proof, and `.artifacts/real-smoke/run-1782137217821-95a1po` passed source model-agent proof
+- Pi 0.79.10 platform artifacts: `.artifacts/platform-smoke/run-1782137574391-7lay68` (macOS platform-build), `.artifacts/platform-smoke/run-1782137619352-gku7jz` (macOS real-extension), `.artifacts/platform-smoke/run-1782137587082-d7kg4p` (Ubuntu platform-build), `.artifacts/platform-smoke/run-1782137619176-lgxezy` (Ubuntu real-extension), `.artifacts/platform-smoke/run-1782137625964-66z0oc` (Windows native platform-build), `.artifacts/platform-smoke/run-1782137752969-pbmdj1` (Windows native real-extension)
+- Pi 0.79.10 isolated agent feedback: `.artifacts/isolated-agent-feedback/run-1782137385` confirmed local extension loading and useful `oracle_preflight` output after the path-label polish
 - Pi 0.79.1 release gate: `npm run release:check` passed on 2026-06-11 after the project-trust, prompt-history, ChatGPT selector, and send-acceptance updates, including `verify:oracle` plus Crabbox macOS, Ubuntu, and Windows native `platform-build` and `real-extension` suites
 - Pi 0.79.1 platform artifacts: `.artifacts/platform-smoke/run-1781196218405-311wzs` (macOS platform-build), `.artifacts/platform-smoke/run-1781196261807-eb0391` (macOS real-extension), `.artifacts/platform-smoke/run-1781196230636-ze1hai` (Ubuntu platform-build), `.artifacts/platform-smoke/run-1781196265638-kxiwh9` (Ubuntu real-extension), `.artifacts/platform-smoke/run-1781196255488-ucuf35` (Windows native platform-build), `.artifacts/platform-smoke/run-1781196369098-4qlzjs` (Windows native real-extension)
 - Pi 0.79.1 live source-extension send-acceptance smoke: new-chat job `4b98776f-d422-4bfb-8a6a-7aef73c31bf6` reached `https://chatgpt.com/c/6a2ac99d-fc5c-83e8-88d7-5e1e8f427499` and completed; same-thread follow-up job `abb4f590-96a1-4aab-b91a-c0a7cc15a162` completed on the unchanged conversation URL after send-acceptance evidence
@@ -653,4 +657,4 @@ Recent proof points:
 - repo-owned sanity harness: `npm run sanity:oracle`
 - real installed-extension smoke source of truth: `scripts/oracle-real-smoke.mjs`; required release proof runs packed-install mode (`npm run smoke:real:packed`) and executes installed-package `oracle_submit` deterministically, with optional slower model-agent debugging via `PI_ORACLE_REAL_TEST_MODEL_AGENT=1`; source mode (`npm run smoke:real:source`) is inner-loop/debug only
 - macOS, Ubuntu, and Windows native package/build/runtime smoke source of truth: `docs/platform-smoke.md`; use `npm run verify:oracle` for everyday local iteration, `npm run smoke:platform:doctor` plus a focused target/suite run for platform-sensitive changes, `npm run smoke:platform:all` for doctor-first platform matrix evidence, and `npm run release:check` for the full local-plus-platform release gate
-- release gate: `npm run release:check`, also used by `prepublishOnly`, combines static verification and all required Crabbox platform smokes
+- release gate: `npm run release:check`, also used by `prepublishOnly`, combines static verification, fresh loaded-extension ChatGPT preset proof via `npm run release:proof:chatgpt-presets`, and all required Crabbox platform smokes

package/docs/ORACLE_ISOLATED_PI_VALIDATION.md

@@ -27,7 +27,7 @@ The extension is loaded from the local checkout with:
 pi --approve --no-extensions -e "$REPO/extensions/oracle/index.ts"
 ```
 
-That ensures the session is exercising the in-repo code, not a globally installed package. `--approve` is intentional for this isolated workflow on Pi 0.79.4+: the test fixture is this trusted checkout, and non-interactive/scripted validation must not block on the project-trust prompt.
+That ensures the session is exercising the in-repo code, not a globally installed package. `--approve` is intentional for this isolated workflow on Pi 0.79+: the test fixture is this trusted checkout, and non-interactive/scripted validation must not block on the project-trust prompt.
 
 The local extension now intercepts TUI `/oracle` and `/oracle-followup` before prompt-template expansion, re-injects the compact slash request as the visible user message for prompt-history/up-arrow recall, and reads the in-repo prompt files as hidden dispatch instructions, so do not pass `--prompt-template` for normal local-extension validation. In print/json/rpc modes, the extension contributes the prompt templates itself.
 
@@ -35,15 +35,34 @@ Do not add `https://github.com/fitchmultz/pi-oracle` to this repository's `.pi/s
 
 `oracle_submit` now preflights missing, unreadable, or unverified auth seed profiles before it creates an archive or persists a job. For archive-inspection smoke tests that intentionally run without real auth, use `oracle_preflight` for the blocker path or create a test seed only in a purpose-built fixture that includes the `.oracle-seed-generation` marker.
 
-## Preset requirement
+## Preset requirements
 
-Use either:
+For ordinary pre-commit isolated smoke tests, use either:
 
 - `instant`
 - `thinking_light`
 
 The examples below use `instant` because it is the fastest smoke-test preset.
 
+For any release, and for any change that touches ChatGPT model selection, run live loaded-extension jobs for every canonical ChatGPT preset from `ORACLE_SUBMIT_PRESETS`:
+
+- `pro_standard`
+- `pro_extended`
+- `thinking_light`
+- `thinking_standard`
+- `thinking_extended`
+- `thinking_heavy`
+- `instant`
+- `instant_auto_switch`
+
+Use prompts that make each saved response contain exact markers `PRESET <preset> OK` and `PACKAGE pi-oracle`. Save the completed job ids/job directories in `.artifacts/chatgpt-preset-proof/latest.json` only after every job completes; `validatedAt` must be later than those completed jobs. The checker reads the actual persisted `job.json`, worker log, and response files. Then run:
+
+```bash
+npm run release:proof:chatgpt-presets
+```
+
+`npm run release:check` runs that proof gate before release. This is intentional: publishing is blocked until every ChatGPT preset has fresh loaded-extension evidence.
+
 ## Prerequisites
 
 - `pi` installed locally

package/docs/platform-smoke.md

@@ -49,7 +49,8 @@ Use the narrowest workflow that proves the change. Do not run the full platform
 | Everyday local iteration | `npm run verify:oracle` | Syntax, bundle, platform-smoke invariants, type checks, oracle sanity, and package dry-run pass locally. |
 | Platform-sensitive change | `npm run smoke:platform:doctor`, then `node scripts/platform-smoke.mjs run --target <target> --suite <suite>` | Target setup is ready and the affected platform/suite works without paying for unrelated targets. |
 | Platform matrix proof | `npm run smoke:platform:all` | Doctor-first packed-install proof passes on every required target and suite. |
-| Publish/release gate | `npm run release:check` | Local verification (`verify:oracle`) passes, then the doctor-first platform matrix passes. |
+| ChatGPT preset release proof | `npm run release:proof:chatgpt-presets` | Fresh loaded-extension proof exists for every canonical ChatGPT preset. |
+| Publish/release gate | `npm run release:check` | Local verification (`verify:oracle`) passes, fresh ChatGPT preset proof exists, then the doctor-first platform matrix passes. |
 
 Platform-sensitive changes include archive behavior, process cleanup, runtime/browser profile handling, package metadata, Crabbox harness code, or anything that may differ across macOS/Linux/Windows.
 
@@ -77,7 +78,7 @@ Full release gate:
 npm run release:check
 ```
 
-`release:check` runs `verify:oracle` before `smoke:platform:all`, matching the Crabbox doctor-first release order: cheap harness checks, doctor, full matrix, then artifact review. `prepublishOnly` runs `npm run release:check`.
+`release:check` runs `verify:oracle`, then `release:proof:chatgpt-presets`, then `smoke:platform:all`, matching the release order: cheap harness checks, fresh live ChatGPT preset proof, doctor, full matrix, then artifact review. `prepublishOnly` runs `npm run release:check`.
 
 ## What `platform-build` proves
 
@@ -90,7 +91,7 @@ On each required target, `platform-build`:
 5. runs `npm pack`;
 6. creates a fresh target-local pi project;
 7. runs `npm install --no-save <packed tarball>`;
-8. runs `pi install -l ./node_modules/pi-oracle --approve` so Pi 0.79.4 project-trust gating intentionally trusts the temporary fixture;
+8. runs `pi install -l ./node_modules/pi-oracle --approve` so Pi 0.79+ project-trust gating intentionally trusts the temporary fixture;
 9. runs `pi list --approve`;
 10. asserts the installed package came from `node_modules/pi-oracle` and did not use `pi -e` / source-extension shortcuts.
 

package/extensions/oracle/lib/archive.ts

@@ -578,11 +578,13 @@ async function writeNonWindowsTarArchiveFile(
       (code) => {
         targetCode = code;
         targetDone = true;
+        if (code !== 0 && tarCode === undefined) terminateChildren();
         finish();
       },
       (error) => {
         targetError = error instanceof Error ? error : new Error(String(error));
         targetDone = true;
+        if (tarCode === undefined) terminateChildren();
         finish();
       },
     );

package/extensions/oracle/lib/config.ts

@@ -6,7 +6,7 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from "@earendil-works/pi-coding-agent";
+import { CONFIG_DIR_NAME, getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from "@earendil-works/pi-coding-agent";
 import { isAbsolute, join, normalize } from "node:path";
 import {
   assertNotKnownBrowserUserDataPath,
@@ -377,7 +377,7 @@ export function getOracleConfigLoadDetails(cwd: string, options?: OracleConfigLo
   const agentDir = getAgentDir();
   const projectRoot = getProjectId(cwd);
   const agentConfigPath = join(agentDir, "extensions", "oracle.json");
-  const projectConfigPath = join(projectRoot, ".pi", "extensions", "oracle.json");
+  const projectConfigPath = join(projectRoot, CONFIG_DIR_NAME, "extensions", "oracle.json");
   const projectConfigExists = existsSync(projectConfigPath);
   const projectConfigTrusted = isProjectConfigTrusted(projectRoot, agentDir, projectConfigExists, options);
   const projectConfigLoaded = projectConfigExists && projectConfigTrusted;

package/extensions/oracle/lib/jobs.ts

@@ -4,9 +4,11 @@
 // Usage: Imported by oracle commands, tools, queue logic, poller flows, and runtime cleanup/reconciliation paths.
 // Invariants/Assumptions: Job mutations happen under per-job locks, worker identity checks defend against PID reuse, and persisted jobs remain the source of truth.
 import { createHash, randomUUID } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join, relative as relativePath, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   ACTIVE_ORACLE_JOB_STATUSES,
@@ -117,6 +119,14 @@ export interface OracleArtifactRecord {
   matchesUploadedArchive?: boolean;
 }
 
+export interface OracleExtensionProvenance {
+  schemaVersion: 1;
+  packageName: string;
+  packageVersion: string;
+  sourcePath: string;
+  gitHead?: string;
+}
+
 export interface OracleJob {
   id: string;
   status: OracleJobStatus;
@@ -135,6 +145,7 @@ export interface OracleJob {
   originSessionFile?: string;
   requestSource: "command" | "tool";
   selection: OracleResolvedSelection;
+  extensionProvenance?: OracleExtensionProvenance;
   followUpToJobId?: string;
   chatUrl?: string;
   conversationId?: string;
@@ -452,8 +463,8 @@ export async function cleanupJobResources(
 
 function getCleanupRetentionMs(job: OracleJob): { complete: number; failed: number } {
   return {
-    complete: job.config.cleanup?.completeJobRetentionMs ?? ORACLE_COMPLETE_JOB_RETENTION_MS,
-    failed: job.config.cleanup?.failedJobRetentionMs ?? ORACLE_FAILED_JOB_RETENTION_MS,
+    complete: job.config?.cleanup?.completeJobRetentionMs ?? ORACLE_COMPLETE_JOB_RETENTION_MS,
+    failed: job.config?.cleanup?.failedJobRetentionMs ?? ORACLE_FAILED_JOB_RETENTION_MS,
   };
 }
 
@@ -899,6 +910,39 @@ export async function cancelOracleJob(id: string, reason = "Cancelled by user"):
   });
 }
 
+function readExtensionProvenance(cwd: string): OracleExtensionProvenance {
+  const sourcePath = resolve(fileURLToPath(new URL("../../../", import.meta.url)));
+  let packageName = "pi-oracle";
+  let packageVersion = "unknown";
+  try {
+    const packageJson = JSON.parse(readFileSync(join(sourcePath, "package.json"), "utf8")) as { name?: string; version?: string };
+    packageName = packageJson.name || packageName;
+    packageVersion = packageJson.version || packageVersion;
+  } catch {
+    // Keep provenance present even when package metadata is unavailable in an
+    // unusual loader; release proof rejects unknown versions.
+  }
+
+  let gitHead: string | undefined;
+  try {
+    gitHead = execFileSync("git", ["rev-parse", "HEAD"], { cwd: sourcePath, encoding: "utf8" }).trim();
+  } catch {
+    try {
+      gitHead = execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" }).trim();
+    } catch {
+      gitHead = undefined;
+    }
+  }
+
+  return {
+    schemaVersion: 1,
+    packageName,
+    packageVersion,
+    sourcePath,
+    gitHead,
+  };
+}
+
 export async function createJob(
   id: string,
   input: OracleSubmitInput,
@@ -946,6 +990,7 @@ export async function createJob(
     originSessionFile: sessionFile,
     requestSource: input.requestSource,
     selection: input.selection,
+    extensionProvenance: readExtensionProvenance(cwd),
     followUpToJobId: input.followUpToJobId,
     chatUrl: input.chatUrl,
     conversationId,

package/extensions/oracle/lib/runtime.ts

@@ -8,6 +8,7 @@ import { spawn } from "node:child_process";
 import { constants as fsConstants, existsSync, realpathSync, readFileSync } from "node:fs";
 import { access, cp as copyDirectory, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { delimiter, dirname, join } from "node:path";
+import { CONFIG_DIR_NAME } from "@earendil-works/pi-coding-agent";
 import { assertNotKnownBrowserUserDataPath, sweetCookieSafeStoragePasswordScrubbedEnv } from "../shared/browser-profile-helpers.mjs";
 import { jobBlocksAdmission } from "../shared/job-coordination-helpers.mjs";
 import { isTrackedProcessAlive } from "../shared/process-helpers.mjs";
@@ -42,8 +43,8 @@ function killProcess(child: ReturnType<typeof spawn>): void {
   child.kill("SIGKILL");
 }
 const WORKSPACE_ROOT_MARKERS = [
-  ".pi/extensions/oracle.json",
-  ".pi",
+  join(CONFIG_DIR_NAME, "extensions", "oracle.json"),
+  CONFIG_DIR_NAME,
   "AGENTS.md",
 ] as const;
 function cpCommand(): string {

package/extensions/oracle/lib/tools.ts

@@ -677,10 +677,10 @@ function formatOraclePreflightResponse(details: OraclePreflightDetails): string
   if (details.ready) {
     return [
       `Oracle preflight ready for ${providerLabel}.`,
-      details.session.sessionFile ? `Persisted session: ${details.session.sessionFile}` : undefined,
-      details.auth.seedProfileDir ? `Auth seed profile: ${details.auth.seedProfileDir}` : undefined,
+      details.session.sessionFile ? `Persisted pi session (current run): ${details.session.sessionFile}` : undefined,
+      details.auth.seedProfileDir ? `Auth seed profile (${providerLabel} login source): ${details.auth.seedProfileDir}` : undefined,
       `Preflight validates the persisted pi session, local oracle config, and ${providerLabel} auth seed created by oracle_auth.`,
-      "You can continue with oracle context gathering and submission.",
+      "If you are dispatching an oracle job, continue with context gathering and submission.",
     ].filter(Boolean).join("\n");
   }
 

package/extensions/oracle/worker/chatgpt-ui-helpers.d.mts

@@ -13,10 +13,12 @@ export declare function buildAllowedChatGptOrigins(chatUrl: string, authUrl?: st
 export declare function stripChatGptResponseChrome(value: string | undefined): string;
 export declare function matchesModelFamilyLabel(label: string | undefined, family: OracleUiModelFamily): boolean;
 export declare function matchesRequestedModelControlLabel(label: string | undefined, selection: OracleUiSelection): boolean;
+export declare function matchesCompactIntelligenceControlLabel(label: string | undefined): boolean;
 export declare function matchesCompactIntelligenceOpenerLabel(label: string | undefined): boolean;
 export declare function requestedEffortLabel(selection: OracleUiSelection): string | undefined;
 export declare function effortSelectionVisible(snapshot: string, effortLabel: string | undefined): boolean;
 export declare function thinkingChipVisible(snapshot: string): boolean;
+export declare function snapshotHasClosedCompactSelection(snapshot: string, selection: OracleUiSelection): boolean;
 export declare function snapshotHasModelConfigurationUi(snapshot: string): boolean;
 export declare function snapshotHasUsableComposerControls(snapshot: string): boolean;
 export declare function snapshotHasModelOpener(snapshot: string): boolean;

package/extensions/oracle/worker/chatgpt-ui-helpers.mjs

@@ -248,9 +248,29 @@ function hasLegacyEffortCombobox(entries) {
   });
 }
 
-function compactSelectionFromEntry(entry, _entries, _options = {}) {
-  if (entry.disabled || !COMPACT_INTELLIGENCE_CONTROL_KINDS.has(entry.kind || "")) return undefined;
-  return parseCompactIntelligenceSelection(entry.label);
+function compactSelectionFromEntry(entry, _entries, options = {}) {
+  if (entry.disabled) return undefined;
+  const kind = entry.kind || "";
+  if (COMPACT_INTELLIGENCE_CONTROL_KINDS.has(kind)) return parseCompactIntelligenceSelection(entry.label);
+  if (options.allowClosedButtons && kind === "button" && !/\bexpanded=true\b/.test(String(entry.line || ""))) {
+    return parseCompactIntelligenceSelection(entry.label);
+  }
+  return undefined;
+}
+
+export function matchesCompactIntelligenceControlLabel(label) {
+  return Boolean(parseCompactIntelligenceSelection(label));
+}
+
+export function snapshotHasClosedCompactSelection(snapshot, selection) {
+  /** @type {SnapshotEntry[]} */
+  const entries = parseSnapshotEntries(snapshot);
+  if (hasRemovableComposerModelChip(entries) || hasLegacyEffortCombobox(entries) || hasCompactIntelligenceMenuContext(entries)) return false;
+  return entries.some((entry) => {
+    if (entry.kind !== "button" || entry.disabled) return false;
+    const compactSelection = compactSelectionFromEntry(entry, entries, { allowClosedButtons: true });
+    return compactSelectionMatchesRequestedInSnapshot(snapshot, selection, compactSelection);
+  });
 }
 
 function compactSelectionMatchesRequested(selection, compactSelection) {

package/extensions/oracle/worker/run-job.mjs

@@ -23,12 +23,14 @@ import { extractArtifactLabels, FILE_LABEL_PATTERN_SOURCE, GENERIC_ARTIFACT_LABE
 import {
   buildAllowedChatGptOrigins,
   deriveAssistantCompletionSignature,
+  matchesCompactIntelligenceControlLabel,
   matchesCompactIntelligenceOpenerLabel,
   matchesModelFamilyLabel,
   matchesRequestedModelControlLabel,
   requestedEffortLabel,
   effortSelectionVisible,
   snapshotCanSafelySkipModelConfiguration,
+  snapshotHasClosedCompactSelection,
   snapshotHasModelConfigurationUi,
   snapshotHasModelOpener,
   snapshotHasUsableComposerControls,
@@ -78,6 +80,7 @@ const ARTIFACT_DOWNLOAD_TIMEOUT_MS = 90_000;
 const ARTIFACT_DOWNLOAD_MAX_ATTEMPTS = 2;
 const AGENT_BROWSER_CLOSE_TIMEOUT_MS = 10_000;
 const PROFILE_CLONE_TIMEOUT_MS = 120_000;
+const MODEL_CONFIGURATION_OPEN_TIMEOUT_MS = 45_000;
 const MODEL_CONFIGURATION_SETTLE_TIMEOUT_MS = 20_000;
 const MODEL_CONFIGURATION_SETTLE_POLL_MS = 250;
 const MODEL_CONFIGURATION_CLOSE_RETRY_MS = 1_000;
@@ -1091,15 +1094,9 @@ function classifyChatPage({ job, url, snapshot, body, probe }) {
     return { state: "challenge_blocking", message: "ChatGPT is showing a challenge/verification page" };
   }
 
-  const outagePatterns = [
-    /something went wrong/i,
-    /a network error occurred/i,
-    /an error occurred while connecting to the websocket/i,
-    /try again later/i,
-    /rate limit/i,
-  ];
-  if (outagePatterns.some((pattern) => pattern.test(text))) {
-    return { state: "transient_outage_error", message: "ChatGPT is showing a transient outage/error page" };
+  const outageText = detectProviderTransientErrorText(text);
+  if (outageText) {
+    return { state: "transient_outage_error", message: `ChatGPT is showing a transient outage/rate-limit page: ${outageText}` };
   }
 
   const allowedOrigins = buildAllowedChatGptOrigins(job.config.browser.chatUrl, job.config.browser.authUrl);
@@ -1162,8 +1159,9 @@ function classifyGrokPage({ url, snapshot, body }) {
   if (/captcha|cloudflare|verify you are human|unusual activity|suspicious activity/i.test(text)) {
     return { state: "challenge_blocking", message: "Grok is showing a challenge/verification page" };
   }
-  if (/something went wrong|network error|try again later|rate limit/i.test(text)) {
-    return { state: "transient_outage_error", message: "Grok is showing a transient outage/error page" };
+  const outageText = detectProviderTransientErrorText(text);
+  if (outageText) {
+    return { state: "transient_outage_error", message: `Grok is showing a transient outage/rate-limit page: ${outageText}` };
   }
   const onGrokOrigin = typeof url === "string" && url.startsWith("https://grok.com");
   if (onGrokOrigin && hasGrokLoginCta(text)) {
@@ -1250,6 +1248,42 @@ function detectUploadErrorText(text) {
   return patterns.find((pattern) => text.toLowerCase().includes(pattern.toLowerCase()));
 }
 
+function detectProviderTransientErrorText(text) {
+  const patterns = [
+    "Too many requests",
+    "rate limit",
+    "try again later",
+    "Something went wrong",
+    "A network error occurred",
+    "An error occurred while connecting to the websocket",
+  ];
+  return patterns.find((pattern) => text.toLowerCase().includes(pattern.toLowerCase()));
+}
+
+function detectProviderVisibleBlockerText(text) {
+  const patterns = [
+    "Too many requests",
+    "rate limit",
+  ];
+  return patterns.find((pattern) => text.toLowerCase().includes(pattern.toLowerCase()));
+}
+
+function formatProviderTransientErrorMessage(job, errorText, context) {
+  const providerLabel = isGrokJob(job) ? "Grok" : "ChatGPT";
+  return `${providerLabel} is showing a transient outage/rate-limit page${context ? ` while ${context}` : ""}: ${errorText}`;
+}
+
+function providerTransientErrorMessage(job, text, context) {
+  const errorText = detectProviderVisibleBlockerText(text);
+  if (!errorText) return "";
+  return formatProviderTransientErrorMessage(job, errorText, context);
+}
+
+function throwIfProviderTransientError(job, text, context) {
+  const message = providerTransientErrorMessage(job, text, context);
+  if (message) throw new Error(message);
+}
+
 function detectResponseFailureText(text) {
   const patterns = [
     "Message delivery timed out",
@@ -1289,6 +1323,7 @@ async function waitForUploadConfirmed(job, fileLabel, baselineCount) {
   while (Date.now() < timeoutAt) {
     await heartbeat();
     const [snapshot, body] = await Promise.all([snapshotText(job), pageText(job).catch(() => "")]);
+    throwIfProviderTransientError(job, snapshot, "uploading the archive");
 
     const errorText = detectUploadErrorText(`${snapshot}\n${body}`);
     if (errorText) {
@@ -1323,6 +1358,7 @@ async function waitForSendReady(job) {
     await heartbeat();
     const snapshot = await snapshotText(job);
     const body = await pageText(job).catch(() => "");
+    throwIfProviderTransientError(job, snapshot, "waiting for send readiness");
     const errorText = detectUploadErrorText(`${snapshot}\n${body}`);
     if (errorText) {
       throw new Error(`Upload error detected: ${errorText}`);
@@ -1366,6 +1402,7 @@ async function sendAcceptanceState(job, baselineAssistantCount) {
     urlKnown: urlResult.ok,
     assistantCount: Math.max(baselineAssistantCount, messages.length),
     stopStreaming: isGrokJob(job) ? snapshot.includes(GROK_LABELS.stop) : snapshot.includes("Stop streaming"),
+    transientErrorText: detectProviderVisibleBlockerText(snapshot) || "",
   };
 }
 
@@ -1386,6 +1423,7 @@ async function waitForSendAccepted(job, beforeSend, options = {}) {
   while (Date.now() < timeoutAt) {
     await heartbeat();
     const afterSend = await sendAcceptanceState(job, beforeSend.assistantCount || 0);
+    if (afterSend.transientErrorText) throw new Error(formatProviderTransientErrorMessage(job, afterSend.transientErrorText, "waiting for send acceptance"));
     if (providerSendAccepted(beforeSend, afterSend)) return true;
     await sleep(500);
   }
@@ -1420,12 +1458,13 @@ async function dismissProFeedbackModal(job, snapshot) {
 }
 
 async function openModelConfiguration(job) {
-  const timeoutAt = Date.now() + 15_000;
+  const timeoutAt = Date.now() + MODEL_CONFIGURATION_OPEN_TIMEOUT_MS;
   let lastSnapshot = "";
 
   while (Date.now() < timeoutAt) {
     const initialSnapshot = await snapshotText(job);
     lastSnapshot = initialSnapshot;
+    throwIfProviderTransientError(job, initialSnapshot, "opening model configuration");
     if (snapshotHasModelConfigurationUi(initialSnapshot)) return initialSnapshot;
     if (await dismissProFeedbackModal(job, initialSnapshot)) continue;
 
@@ -1438,6 +1477,7 @@ async function openModelConfiguration(job) {
       await agentBrowser(job, "wait", "800");
       const after = await snapshotText(job);
       lastSnapshot = after;
+      throwIfProviderTransientError(job, after, "opening model configuration");
       if (snapshotHasModelConfigurationUi(after)) return after;
       if (canUseOpenModelMenuForSelection(after, job.selection)) return after;
 
@@ -1451,6 +1491,7 @@ async function openModelConfiguration(job) {
         await agentBrowser(job, "wait", "1200");
         const postConfigure = await snapshotText(job);
         lastSnapshot = postConfigure;
+        throwIfProviderTransientError(job, postConfigure, "opening model configuration");
         if (snapshotHasModelConfigurationUi(postConfigure)) return postConfigure;
         if (canUseOpenModelMenuForSelection(postConfigure, job.selection)) return postConfigure;
       }
@@ -1544,22 +1585,28 @@ async function configureModel(job) {
     throw new Error(`Could not find model family control for ${job.selection.modelFamily}`);
   }
 
+  let compactSelectionVerifiedAfterClick = false;
   if (!alreadyConfiguredInUi && !familyAlreadySelectedInUi && familyEntry) {
+    const clickedCompactControl = matchesCompactIntelligenceControlLabel(familyEntry.label);
     await clickRef(job, familyEntry.ref);
     await agentBrowser(job, "wait", "800");
     familySnapshot = await snapshotText(job);
     verificationSnapshot = familySnapshot;
+    compactSelectionVerifiedAfterClick = clickedCompactControl && snapshotHasClosedCompactSelection(familySnapshot, job.selection);
+    if (compactSelectionVerifiedAfterClick) {
+      await log(`Verified compact ChatGPT selection after menu close for family=${job.selection.modelFamily} effort=${job.selection?.effort || "(none)"}`);
+    }
     const postClickControlOptions = {
       ignoreCompactTierButtons: snapshotHasCompactIntelligenceMenuControls(familySnapshot),
       ignoreCompactOnlyButtons: snapshotHasLegacyEffortCombobox(familySnapshot),
     };
     familyEntry = findEntry(familySnapshot, (candidate) => matchesRequestedModelControl(candidate, job.selection, postClickControlOptions));
-    if (!familyEntry && !snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection)) {
+    if (!compactSelectionVerifiedAfterClick && !familyEntry && !snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection)) {
       throw new Error(`Requested model family did not remain selected: ${job.selection.modelFamily}`);
     }
   }
 
-  if (job.selection.modelFamily === "thinking" || job.selection.modelFamily === "pro") {
+  if ((job.selection.modelFamily === "thinking" || job.selection.modelFamily === "pro") && !compactSelectionVerifiedAfterClick) {
     const effortLabel = requestedEffortLabel(job.selection);
     if (effortLabel && !effortSelectionVisible(familySnapshot, effortLabel)) {
       const opened = await openEffortDropdown(job);
@@ -1589,7 +1636,8 @@ async function configureModel(job) {
   if (job.selection.modelFamily === "instant") {
     const desiredAutoSwitchState = job.selection.autoSwitchToThinking === true;
     const currentAutoSwitchState = autoSwitchToThinkingSelectionVisible(familySnapshot);
-    const compactInstantAlreadyVerified = desiredAutoSwitchState && currentAutoSwitchState === undefined && snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection);
+    const compactInstantAlreadyVerified = compactSelectionVerifiedAfterClick
+      || (desiredAutoSwitchState && currentAutoSwitchState === undefined && snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection));
     if (!compactInstantAlreadyVerified && currentAutoSwitchState !== desiredAutoSwitchState && (desiredAutoSwitchState || currentAutoSwitchState === true)) {
       await clickAutoSwitchToThinkingControl(job);
       await agentBrowser(job, "wait", "400");
@@ -1598,7 +1646,7 @@ async function configureModel(job) {
     }
   }
 
-  const stronglyVerified = snapshotStronglyMatchesRequestedModel(verificationSnapshot, job.selection);
+  const stronglyVerified = compactSelectionVerifiedAfterClick || snapshotStronglyMatchesRequestedModel(verificationSnapshot, job.selection);
   if (!stronglyVerified) {
     throw new Error(`Could not verify requested model settings in configuration UI for ${job.selection.modelFamily}`);
   }
@@ -1742,12 +1790,15 @@ async function grokAssistantMessages(job) {
         return text;
       };
       const bubbles = Array.from(document.querySelectorAll('.message-bubble'));
+      const roleMessages = Array.from(document.querySelectorAll('[data-message-author-role="assistant"]'));
       const sourceNodes = bubbles.length > 0
         ? bubbles
-        : Array.from(document.querySelectorAll('div')).filter((node) => {
-            const classText = String(node.className || '');
-            return classText.includes('group') && classText.includes('flex') && classText.includes('flex-col') && classText.includes('justify-center');
-          });
+        : roleMessages.length > 0
+          ? roleMessages
+          : Array.from(document.querySelectorAll('div')).filter((node) => {
+              const classText = String(node.className || '');
+              return classText.includes('group') && classText.includes('flex') && classText.includes('flex-col') && classText.includes('justify-center');
+            });
       const messages = sourceNodes
         .map((node) => node.closest('[data-message-author-role], [data-testid*="message"], .group') || node)
         .filter((node, index, all) => all.indexOf(node) === index)
@@ -1793,6 +1844,7 @@ async function waitForChatCompletion(job, baselineAssistantCount) {
     const hasStopStreaming = isGrokJob(job) ? snapshot.includes(GROK_LABELS.stop) : snapshot.includes("Stop streaming");
     const hasRetryButton = snapshot.includes('button "Retry"');
     const copyResponseCount = isGrokJob(job) ? (snapshot.match(/button "Copy"/g) || []).length : (snapshot.match(/Copy response/g) || []).length;
+    throwIfProviderTransientError(job, snapshot, "waiting for response completion");
     const responseFailureText = detectResponseFailureText(`${snapshot}\n${body}`);
     const messages = await assistantMessages(job);
     const targetMessage = messages[baselineAssistantCount];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-oracle",
-  "version": "0.7.12",
+  "version": "0.7.14",
   "description": "ChatGPT and Grok web-oracle extension for pi with isolated browser auth, async jobs, and project-context archives.",
   "private": false,
   "license": "MIT",
@@ -36,7 +36,8 @@
     "platform-smoke.config.mjs",
     "scripts/platform-smoke.mjs",
     "scripts/platform-smoke",
-    "scripts/oracle-real-smoke.mjs"
+    "scripts/oracle-real-smoke.mjs",
+    "scripts/oracle-chatgpt-preset-proof.mjs"
   ],
   "pi": {
     "extensions": [
@@ -49,7 +50,7 @@
     "typecheck:worker-helpers": "tsc --noEmit -p tsconfig.worker-helpers.json",
     "sanity:oracle": "node scripts/oracle-sanity-runner.mjs",
     "pack:check": "npm pack --dry-run",
-    "verify:oracle": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run typecheck && npm run typecheck:worker-helpers && npm run sanity:oracle && npm run pack:check",
+    "verify:oracle": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run check:oracle-release-proof && npm run typecheck && npm run typecheck:worker-helpers && npm run sanity:oracle && npm run pack:check",
     "test": "npm run verify:oracle",
     "prepublishOnly": "npm run release:check",
     "check:platform-smoke": "node --check scripts/platform-smoke.mjs && node --check scripts/platform-smoke/assertions.mjs && node --check scripts/platform-smoke/artifacts.mjs && node --check scripts/platform-smoke/crabbox-runner.mjs && node --check scripts/platform-smoke/doctor.mjs && node --check scripts/platform-smoke/targets.mjs && node scripts/platform-smoke/invariants.mjs",
@@ -61,12 +62,14 @@
     "smoke:platform:windows-native": "node scripts/platform-smoke.mjs run --target windows-native",
     "smoke:real": "npm run smoke:real:packed",
     "smoke:real:doctor": "node scripts/oracle-real-smoke.mjs doctor",
-    "release:check": "npm run verify:oracle && npm run smoke:platform:all",
+    "release:check": "npm run verify:oracle && npm run release:proof:chatgpt-presets && npm run smoke:platform:all",
     "check:oracle-real-smoke": "node --check scripts/oracle-real-smoke.mjs",
+    "check:oracle-release-proof": "node --check scripts/oracle-chatgpt-preset-proof.mjs",
+    "release:proof:chatgpt-presets": "node scripts/oracle-chatgpt-preset-proof.mjs check",
     "smoke:real:packed": "node scripts/oracle-real-smoke.mjs run --mode packed",
     "smoke:real:source": "node scripts/oracle-real-smoke.mjs run --mode source",
     "sanity:oracle:platform": "node scripts/oracle-sanity-runner.mjs --mode platform",
-    "verify:oracle:platform": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run sanity:oracle:platform && npm run pack:check"
+    "verify:oracle:platform": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run check:oracle-release-proof && npm run sanity:oracle:platform && npm run pack:check"
   },
   "dependencies": {
     "@steipete/sweet-cookie": "^0.3.0"
@@ -80,8 +83,8 @@
     "protobufjs": "7.6.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.79.4",
-    "@earendil-works/pi-coding-agent": "0.79.4",
+    "@earendil-works/pi-ai": "^0.79.10",
+    "@earendil-works/pi-coding-agent": "^0.79.10",
     "@types/node": "^22.19.19",
     "esbuild": "^0.28.0",
     "tsx": "^4.22.3",

package/platform-smoke.config.mjs

@@ -23,7 +23,7 @@ export default {
       commands: ["npm run smoke:platform:all"],
     },
     release: {
-      description: "Full release gate: local verification plus the doctor-first platform matrix.",
+      description: "Full release gate: local verification, fresh ChatGPT preset proof, plus the doctor-first platform matrix.",
       commands: ["npm run release:check"],
     },
   },

package/scripts/oracle-chatgpt-preset-proof.mjs

@@ -0,0 +1,352 @@
+#!/usr/bin/env node
+// Purpose: Release-blocking proof gate for live ChatGPT preset selection.
+// Responsibilities: Validate that a fresh manual/live oracle job matrix covered every canonical ChatGPT preset before publish.
+// Scope: Maintainer release safety only; the script does not submit jobs or touch provider accounts.
+// Usage: npm run release:proof:chatgpt-presets, or `node scripts/oracle-chatgpt-preset-proof.mjs template`.
+
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(SCRIPT_DIR, "..");
+const DEFAULT_PROOF_PATH = ".artifacts/chatgpt-preset-proof/latest.json";
+const PROOF_PATH_ENV = "PI_ORACLE_CHATGPT_PRESET_PROOF";
+const JOBS_DIR_ENV = "PI_ORACLE_JOBS_DIR";
+const MAX_AGE_HOURS_ENV = "PI_ORACLE_CHATGPT_PRESET_PROOF_MAX_AGE_HOURS";
+const DEFAULT_MAX_AGE_HOURS = 72;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+
+function usage() {
+  console.log(`Usage: node scripts/oracle-chatgpt-preset-proof.mjs <check|template>
+
+Commands:
+  check      Validate release-blocking live ChatGPT preset proof. Default.
+  template   Print a non-valid proof-file template for the current package version/git head.
+
+Environment:
+  ${PROOF_PATH_ENV}                 Proof JSON path (default: ${DEFAULT_PROOF_PATH})
+  ${JOBS_DIR_ENV}                            Oracle jobs root for job lookup (default also checks /tmp)
+  ${MAX_AGE_HOURS_ENV}       Freshness window in hours (default: ${DEFAULT_MAX_AGE_HOURS})
+
+Proof file contract:
+  The proof must reference live oracle job state produced by the loaded extension
+  after the current git HEAD. It must include one completed ChatGPT job per
+  canonical ORACLE_SUBMIT_PRESETS id. Shape-only proof is rejected.
+`);
+}
+
+function fail(message) {
+  console.error(message);
+  process.exitCode = 1;
+}
+
+function readJson(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+function git(args) {
+  return execFileSync("git", args, { cwd: REPO_ROOT, encoding: "utf8" }).trim();
+}
+
+function packageMetadata() {
+  const pkg = readJson(resolve(REPO_ROOT, "package.json"));
+  return { name: pkg.name, version: pkg.version };
+}
+
+function currentGitHead() {
+  return git(["rev-parse", "HEAD"]);
+}
+
+function currentGitHeadCommittedAt() {
+  return git(["show", "-s", "--format=%cI", "HEAD"]);
+}
+
+function currentGitStatus() {
+  return git(["status", "--short"]);
+}
+
+function canonicalPresets() {
+  const configSource = readFileSync(resolve(REPO_ROOT, "extensions/oracle/lib/config.ts"), "utf8");
+  const registryMatch = configSource.match(/export const ORACLE_SUBMIT_PRESETS = \{([\s\S]*?)\n\} as const;/);
+  if (!registryMatch) throw new Error("Could not locate ORACLE_SUBMIT_PRESETS registry in extensions/oracle/lib/config.ts");
+  const entries = [...registryMatch[1].matchAll(
+    /^\s{2}([a-z0-9_]+):\s*\{\s*label:\s*"[^"]+",\s*modelFamily:\s*"([a-z]+)"\s+as const(?:,\s*effort:\s*"([a-z]+)"\s+as const)?,\s*autoSwitchToThinking:\s*(true|false)\s*\}/gm,
+  )];
+  if (entries.length === 0) throw new Error("Could not parse ORACLE_SUBMIT_PRESETS registry entries");
+  return Object.fromEntries(entries.map((match) => [match[1], {
+    modelFamily: match[2],
+    effort: match[3],
+    autoSwitchToThinking: match[4] === "true",
+  }]));
+}
+
+function canonicalPresetIds() {
+  return Object.keys(canonicalPresets());
+}
+
+function proofPath() {
+  return resolve(REPO_ROOT, process.env[PROOF_PATH_ENV] || DEFAULT_PROOF_PATH);
+}
+
+function maxAgeHours() {
+  const raw = process.env[MAX_AGE_HOURS_ENV];
+  if (!raw) return DEFAULT_MAX_AGE_HOURS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) throw new Error(`${MAX_AGE_HOURS_ENV} must be a positive number of hours`);
+  return parsed;
+}
+
+function isIsoDate(value) {
+  if (typeof value !== "string" || !value.trim()) return false;
+  const millis = Date.parse(value);
+  return Number.isFinite(millis) && new Date(millis).toISOString() === value;
+}
+
+function parseIsoMillis(value) {
+  return isIsoDate(value) ? Date.parse(value) : undefined;
+}
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+function candidateJobJsonPaths(jobId, proofJob) {
+  const paths = [];
+  if (typeof proofJob.jobJsonPath === "string" && proofJob.jobJsonPath.trim()) {
+    paths.push(resolve(REPO_ROOT, proofJob.jobJsonPath));
+  }
+  if (typeof proofJob.jobDir === "string" && proofJob.jobDir.trim()) {
+    paths.push(resolve(REPO_ROOT, proofJob.jobDir, "job.json"));
+  }
+  if (process.env[JOBS_DIR_ENV]) {
+    paths.push(resolve(process.env[JOBS_DIR_ENV], `oracle-${jobId}`, "job.json"));
+  }
+  paths.push(resolve("/tmp", `oracle-${jobId}`, "job.json"));
+  return unique(paths);
+}
+
+function loadOracleJobState(jobId, proofJob) {
+  const candidates = candidateJobJsonPaths(jobId, proofJob);
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue;
+    return { path: candidate, state: readJson(candidate) };
+  }
+  return { path: undefined, state: undefined, candidates };
+}
+
+function requireActualJobEvidence({ preset, canonicalPreset, proofJob, packageName, packageVersion, gitHead, gitHeadCommittedAtMs, proofValidatedAtMs, errors }) {
+  if (!proofJob || typeof proofJob !== "object" || Array.isArray(proofJob)) {
+    errors.push(`missing jobs.${preset}`);
+    return;
+  }
+  if (proofJob.preset !== preset) errors.push(`jobs.${preset}.preset must be ${preset}`);
+  if (proofJob.provider !== "chatgpt") errors.push(`jobs.${preset}.provider must be chatgpt`);
+
+  const jobId = proofJob.jobId;
+  if (typeof jobId !== "string" || !UUID_PATTERN.test(jobId) || jobId === ZERO_UUID) {
+    errors.push(`jobs.${preset}.jobId must be a real oracle UUID job id, not a placeholder`);
+    return;
+  }
+
+  const loaded = loadOracleJobState(jobId, proofJob);
+  if (!loaded.state) {
+    errors.push(`jobs.${preset} could not find actual oracle job.json for ${jobId}; checked ${loaded.candidates.join(", ")}`);
+    return;
+  }
+
+  const state = loaded.state;
+  const responsePath = typeof state.responsePath === "string" ? state.responsePath : undefined;
+  const workerLogPath = typeof state.workerLogPath === "string" ? state.workerLogPath : undefined;
+  const response = responsePath && existsSync(responsePath) ? readFileSync(responsePath, "utf8") : "";
+  const workerLog = workerLogPath && existsSync(workerLogPath) ? readFileSync(workerLogPath, "utf8") : "";
+  const completedAtMs = parseIsoMillis(state.completedAt || state.phaseAt);
+
+  if (state.id !== jobId) errors.push(`jobs.${preset} job.json id mismatch: expected ${jobId}, got ${state.id || "<missing>"}`);
+  if (state.status !== "complete") errors.push(`jobs.${preset} actual job status must be complete, got ${state.status || "<missing>"}`);
+  if (state.phase !== "complete") errors.push(`jobs.${preset} actual job phase must be complete, got ${state.phase || "<missing>"}`);
+  if (state.selection?.provider !== "chatgpt") errors.push(`jobs.${preset} actual provider must be chatgpt`);
+  if (state.selection?.preset !== preset) errors.push(`jobs.${preset} actual preset must be ${preset}, got ${state.selection?.preset || "<missing>"}`);
+  if (state.selection?.modelFamily !== canonicalPreset.modelFamily) errors.push(`jobs.${preset} actual modelFamily must be ${canonicalPreset.modelFamily}, got ${state.selection?.modelFamily || "<missing>"}`);
+  if ((state.selection?.effort || undefined) !== canonicalPreset.effort) errors.push(`jobs.${preset} actual effort must be ${canonicalPreset.effort || "<unset>"}, got ${state.selection?.effort || "<unset>"}`);
+  if (state.selection?.autoSwitchToThinking !== canonicalPreset.autoSwitchToThinking) errors.push(`jobs.${preset} actual autoSwitchToThinking must be ${canonicalPreset.autoSwitchToThinking}`);
+  if (state.cwd !== REPO_ROOT) errors.push(`jobs.${preset} actual cwd must be this repo (${REPO_ROOT}), got ${state.cwd || "<missing>"}`);
+  if (state.projectId !== REPO_ROOT) errors.push(`jobs.${preset} actual projectId must be this repo (${REPO_ROOT}), got ${state.projectId || "<missing>"}`);
+  if (state.requestSource !== "tool" && state.requestSource !== "command") errors.push(`jobs.${preset} actual requestSource must be tool or command`);
+  if (typeof state.sessionId !== "string" || !state.sessionId.trim()) errors.push(`jobs.${preset} actual job must record sessionId`);
+  if (typeof state.originSessionFile !== "string" || !existsSync(state.originSessionFile)) errors.push(`jobs.${preset} actual originSessionFile must exist`);
+  if (typeof state.promptPath !== "string" || !existsSync(state.promptPath)) errors.push(`jobs.${preset} actual promptPath must exist`);
+  if (typeof state.logsDir !== "string" || !existsSync(state.logsDir)) errors.push(`jobs.${preset} actual logsDir must exist`);
+  if (typeof state.runtimeId !== "string" || !state.runtimeId.trim()) errors.push(`jobs.${preset} actual job must record runtimeId`);
+  if (typeof state.runtimeSessionName !== "string" || !state.runtimeSessionName.trim()) errors.push(`jobs.${preset} actual job must record runtimeSessionName`);
+  if (!state.config?.browser || !state.config?.worker || !state.config?.cleanup) errors.push(`jobs.${preset} actual job must include persisted oracle config with browser, worker, and cleanup sections`);
+  const lifecycleKinds = new Set(Array.isArray(state.lifecycleEvents) ? state.lifecycleEvents.map((event) => event?.kind) : []);
+  const lifecyclePhases = new Set(Array.isArray(state.lifecycleEvents) ? state.lifecycleEvents.map((event) => event?.phase) : []);
+  if (!lifecycleKinds.has("created")) errors.push(`jobs.${preset} lifecycle events must include job creation`);
+  if (!lifecyclePhases.has("configuring_model")) errors.push(`jobs.${preset} lifecycle events must include configuring_model phase`);
+  if (!lifecyclePhases.has("complete")) errors.push(`jobs.${preset} lifecycle events must include complete phase`);
+  if (state.extensionProvenance?.schemaVersion !== 1) errors.push(`jobs.${preset} actual job must record extensionProvenance.schemaVersion=1`);
+  if (state.extensionProvenance?.packageName !== packageName) errors.push(`jobs.${preset} actual extension packageName must be ${packageName}`);
+  if (state.extensionProvenance?.packageVersion !== packageVersion) errors.push(`jobs.${preset} actual extension packageVersion must be ${packageVersion}`);
+  if (state.extensionProvenance?.gitHead !== gitHead) errors.push(`jobs.${preset} actual extension gitHead must be ${gitHead}`);
+  if (state.extensionProvenance?.sourcePath !== REPO_ROOT) errors.push(`jobs.${preset} actual extension sourcePath must be this repo (${REPO_ROOT}), got ${state.extensionProvenance?.sourcePath || "<missing>"}`);
+  if (typeof state.archivePath !== "string" || !state.archivePath.endsWith(".tar.zst")) errors.push(`jobs.${preset} actual archivePath must end with .tar.zst`);
+  if (typeof state.archiveSha256 !== "string" || !/^[0-9a-f]{64}$/i.test(state.archiveSha256)) errors.push(`jobs.${preset} actual job must record archiveSha256`);
+  if (typeof state.conversationId !== "string" || !state.conversationId.trim()) errors.push(`jobs.${preset} actual job must record conversationId`);
+  if (typeof state.chatUrl !== "string" || !state.chatUrl.startsWith("https://chatgpt.com/c/")) errors.push(`jobs.${preset} actual job must record a ChatGPT conversation URL`);
+  if (!responsePath || !existsSync(responsePath)) errors.push(`jobs.${preset} actual responsePath must exist`);
+  if (!workerLogPath || !existsSync(workerLogPath)) errors.push(`jobs.${preset} actual workerLogPath must exist`);
+  if (!response.includes(`PRESET ${preset} OK`)) errors.push(`jobs.${preset} actual response must include PRESET ${preset} OK`);
+  if (!response.includes(`PACKAGE ${packageName}`)) errors.push(`jobs.${preset} actual response must include PACKAGE ${packageName}`);
+  if (!workerLog.includes(`Configuring model family=${state.selection?.modelFamily}`) && !workerLog.includes("Model already appears configured")) {
+    errors.push(`jobs.${preset} worker log must show model configuration or an explicit already-configured skip`);
+  }
+  if (!workerLog.includes("Job completed successfully") && !workerLog.includes(`Job ${jobId} complete`)) errors.push(`jobs.${preset} worker log must show successful completion`);
+
+  if (completedAtMs === undefined) {
+    errors.push(`jobs.${preset} actual completedAt/phaseAt must be an ISO timestamp`);
+  } else {
+    if (completedAtMs <= gitHeadCommittedAtMs) errors.push(`jobs.${preset} must complete after current git HEAD commit time`);
+    if (proofValidatedAtMs !== undefined && completedAtMs > proofValidatedAtMs) errors.push(`jobs.${preset} completed after proof validatedAt`);
+    const maxAgeMs = maxAgeHours() * 60 * 60 * 1000;
+    if (Date.now() - completedAtMs > maxAgeMs) errors.push(`jobs.${preset} completedAt is older than ${maxAgeHours()} hours`);
+  }
+
+  if (typeof proofJob.conversation === "string" && proofJob.conversation.trim() && proofJob.conversation !== state.conversationId && proofJob.conversation !== state.chatUrl) {
+    errors.push(`jobs.${preset}.conversation does not match actual conversationId/chatUrl`);
+  }
+}
+
+function validateProof(proof, path) {
+  const errors = [];
+  const { name, version } = packageMetadata();
+  const gitHead = currentGitHead();
+  const gitHeadCommittedAt = currentGitHeadCommittedAt();
+  const gitHeadCommittedAtMs = Date.parse(gitHeadCommittedAt);
+  const gitStatus = currentGitStatus();
+  const presetRegistry = canonicalPresets();
+  const requiredPresets = Object.keys(presetRegistry);
+  const allowedPresets = new Set(requiredPresets);
+
+  if (gitStatus) {
+    errors.push(`working tree must be clean before release proof is accepted; current changes:\n${gitStatus}`);
+  }
+
+  if (!proof || typeof proof !== "object" || Array.isArray(proof)) {
+    errors.push("proof root must be a JSON object");
+    return errors;
+  }
+
+  if (proof.schemaVersion !== 1) errors.push("schemaVersion must be 1");
+  if (proof.packageName !== name) errors.push(`packageName must be ${name}`);
+  if (proof.packageVersion !== version) errors.push(`packageVersion must match package.json version ${version}`);
+  if (proof.gitHead !== gitHead) errors.push(`gitHead must match current HEAD ${gitHead}`);
+  if (proof.provider !== "chatgpt") errors.push('provider must be "chatgpt"');
+  if (proof.extensionUnderTest !== "loaded-extension") errors.push('extensionUnderTest must be "loaded-extension"');
+
+  let proofValidatedAtMs;
+  if (!isIsoDate(proof.validatedAt)) {
+    errors.push("validatedAt must be an ISO-8601 UTC timestamp from new Date().toISOString()");
+  } else {
+    proofValidatedAtMs = Date.parse(proof.validatedAt);
+    const ageMs = Date.now() - proofValidatedAtMs;
+    const maxAgeMs = maxAgeHours() * 60 * 60 * 1000;
+    if (ageMs < 0) errors.push("validatedAt must not be in the future");
+    if (ageMs > maxAgeMs) errors.push(`validatedAt is older than ${maxAgeHours()} hours`);
+    if (proofValidatedAtMs <= gitHeadCommittedAtMs) errors.push("validatedAt must be after current git HEAD commit time");
+  }
+
+  const jobs = proof.jobs;
+  if (!jobs || typeof jobs !== "object" || Array.isArray(jobs)) {
+    errors.push("jobs must be an object keyed by canonical preset id");
+    return errors;
+  }
+
+  for (const preset of requiredPresets) {
+    requireActualJobEvidence({
+      preset,
+      canonicalPreset: presetRegistry[preset],
+      proofJob: jobs[preset],
+      packageName: name,
+      packageVersion: version,
+      gitHead,
+      gitHeadCommittedAtMs,
+      proofValidatedAtMs,
+      errors,
+    });
+  }
+
+  for (const preset of Object.keys(jobs)) {
+    if (!allowedPresets.has(preset)) errors.push(`jobs.${preset} is not a canonical ORACLE_SUBMIT_PRESETS id`);
+  }
+
+  if (errors.length === 0) {
+    console.log(`ChatGPT preset release proof accepted: ${path}`);
+    console.log(`Validated presets: ${requiredPresets.join(", ")}`);
+  }
+
+  return errors;
+}
+
+function template() {
+  const { name, version } = packageMetadata();
+  const gitHead = currentGitHead();
+  const jobs = Object.fromEntries(canonicalPresetIds().map((preset) => [preset, {
+    preset,
+    provider: "chatgpt",
+    jobId: `replace-with-completed-${preset}-job-uuid`,
+    jobDir: `/tmp/oracle-replace-with-completed-${preset}-job-uuid`,
+    conversation: "replace-with-actual-conversation-id-or-chat-url",
+  }]));
+
+  console.log(JSON.stringify({
+    schemaVersion: 1,
+    packageName: name,
+    packageVersion: version,
+    gitHead,
+    provider: "chatgpt",
+    extensionUnderTest: "loaded-extension",
+    validatedAt: new Date().toISOString(),
+    jobs,
+  }, null, 2));
+}
+
+function main() {
+  const command = process.argv[2] || "check";
+  if (command === "--help" || command === "-h") {
+    usage();
+    return;
+  }
+  if (command === "template") {
+    template();
+    return;
+  }
+  if (command !== "check") {
+    usage();
+    fail(`Unknown command: ${command}`);
+    return;
+  }
+
+  const path = proofPath();
+  if (!existsSync(path)) {
+    fail(`Missing ChatGPT preset release proof: ${path}\n\nRun live loaded-extension oracle jobs for every canonical ChatGPT preset, then save proof JSON.\nCreate a non-valid starting template with:\n  mkdir -p .artifacts/chatgpt-preset-proof\n  node scripts/oracle-chatgpt-preset-proof.mjs template > ${DEFAULT_PROOF_PATH}\n\nThis gate is intentional: releases are blocked until every preset has fresh live proof backed by actual oracle job state.`);
+    return;
+  }
+
+  let proof;
+  try {
+    proof = readJson(path);
+  } catch (error) {
+    fail(`Could not read proof JSON at ${path}: ${error.message}`);
+    return;
+  }
+
+  const errors = validateProof(proof, path);
+  if (errors.length > 0) {
+    fail(`ChatGPT preset release proof rejected: ${path}\n- ${errors.join("\n- ")}`);
+  }
+}
+
+main();

package/scripts/platform-smoke/invariants.mjs

@@ -92,7 +92,7 @@ function testCanonicalWorkflowConfig() {
   assert.deepEqual(config.workflows?.release?.commands, ["npm run release:check"], "release workflow should use the full local-plus-platform release gate");
   assert.equal(config.requiredCrabbox?.minVersion, "0.26.0", "Crabbox baseline should match the documented provider contract");
   assert.equal(pkg.scripts["smoke:platform:all"], "npm run smoke:platform:doctor && node scripts/platform-smoke.mjs run --target macos,ubuntu,windows-native", "full platform smoke should remain doctor-first and cover all required targets");
-  assert.match(pkg.scripts["release:check"], /npm run verify:oracle && npm run smoke:platform:all/, "release check should combine local verification and full platform smoke");
+  assert.match(pkg.scripts["release:check"], /npm run verify:oracle && npm run release:proof:chatgpt-presets && npm run smoke:platform:all/, "release check should combine local verification, ChatGPT preset proof, and full platform smoke");
   const runnerSource = readFileSync(new URL("./crabbox-runner.mjs", import.meta.url), "utf8");
   assert.match(runnerSource, /PLATFORM_SMOKE_CRABBOX/, "runner should honor reusable Crabbox binary override");
   assert.match(runnerSource, /PLATFORM_SMOKE_MAC_WORK_ROOT/, "runner should honor reusable macOS work-root override");