fix: 2026-07-02 audit remediation — date-safe redaction, DR incomplete flags, symlink-safe installs

CHANGELOG.md

@@ -40,6 +40,29 @@ versioning: [SemVer](https://semver.org/).
   clarification request — that auto-proceed round overwrote the real report
   and burned DR quota. Clarification detection now applies only to short
   (≤ 1200 char) done-texts.
+- PII redaction no longer corrupts calendar dates: "2026-05-26" (and
+  `DD-MM-YYYY` / datetime / date-range forms) satisfied the phone-number
+  pattern and came back as `<PHONE>` in memories, tasks, and conversation
+  titles. Phone masking still applies to actual phone shapes — including a
+  phone that follows a date inside the same greedy match
+  ("2026-05-26 617-555-0123" keeps the date, masks the phone).
+- `deep_research` / `deep_research_heavy` now append an explicit "⚠ Report
+  may be incomplete" note when the SSE stream ended without the server
+  marking the response finished (`terminated_abnormally`) or when completion
+  polling timed out — previously a truncated report was indistinguishable
+  from a complete one.
+- `gpt2agent install`: writing a symlinked agent config (dotfile-repo
+  setups) now writes through to the symlink target instead of replacing the
+  link with a plain file and stranding the real config.
+- `gpt2agent setup`: `~/.gpt2agent/config.toml` is backed up
+  (`.bak-gpt2agent`) before being overwritten and is written atomically;
+  a rewrite with identical content is a no-op.
+- Removed the `browser-use` session-cookie fallback that saved a NextAuth
+  session cookie as `access_token` — the saved "token" 401'd on every API
+  call. Extraction now fails visibly so the user can paste a real token.
+  The manual paste prompt likewise no longer suggests the
+  `__Secure-next-auth.session-token` cookie and refuses to save values that
+  are not 3-segment JWTs (a pasted session cookie only produced 401s).
 
 ## [0.0.8] - 2026-06-27
 

gpt2agent/auth.py

@@ -71,17 +71,23 @@ def _from_browser() -> dict | None:
     print(
         '    copy(JSON.parse(localStorage["@@auth0spajs@@::..."] || "{}").body?.access_token'
     )
-    print("  OR go to:")
-    print("    Application → Cookies → __Secure-next-auth.session-token")
     print()
-    print("  Then paste the token below.")
+    print("  Then paste the access_token below. Browser cookies such as")
+    print("  __Secure-next-auth.session-token are NOT access tokens — the API")
+    print("  rejects them with 401, so they are not accepted here.")
     print("  (Tip: running `codex login` once lets gpt2agent reuse that token automatically.)")
     print()
     webbrowser.open("https://chat.openai.com")
-    token = input("  Paste access_token (or session token): ").strip()
-    if token:
-        return {"access_token": token, "source": "browser"}
-    return None
+    token = input("  Paste access_token: ").strip()
+    if not token:
+        return None
+    if not token.startswith("eyJ") or token.count(".") != 2:
+        # ChatGPT access tokens are 3-segment JWTs; session cookies (5-segment
+        # JWE) or random strings only produce 401s downstream — fail here.
+        print("  That does not look like a JWT access_token (expected eyJ...x.y.z);")
+        print("  not saving it. Use `codex login` for the reliable path.")
+        return None
+    return {"access_token": token, "source": "browser"}
 
 
 def _from_browser_use() -> dict | None:
@@ -122,17 +128,11 @@ def _from_browser_use() -> dict | None:
                 except Exception:
                     pass
 
-        # Try cookies fallback
-        result = subprocess.run(
-            ["browser-use", "cookies", "get", "--url", "https://chat.openai.com"],
-            capture_output=True,
-            text=True,
-            timeout=15,
-        )
-        cookies = json.loads(result.stdout or "[]")
-        for c in cookies:
-            if "session-token" in c.get("name", ""):
-                return {"access_token": c["value"], "source": "browser-use-cookie"}
+        # No cookie fallback: the __Secure-next-auth.session-token cookie is a
+        # NextAuth session cookie, not the chatgpt.com-scoped access-token JWT
+        # the backend sends as `Authorization: Bearer` — saving it "succeeds"
+        # here and then every API call 401s. Better to fail visibly.
+        print("  browser-use found no access_token in localStorage.")
 
     except Exception as e:
         print(f"  browser-use extraction failed: {e}")

gpt2agent/install.py

@@ -88,6 +88,11 @@ def _atomic_write(path: Path, content: str) -> None:
     contain MCP server commands that the agent will exec, so they should not
     be world-readable on shared systems.
     """
+    if path.is_symlink():
+        # Users symlink agent configs into dotfile repos; rename() over the
+        # symlink would replace the link with a plain file and strand the real
+        # target. Write through to the target instead.
+        path = path.resolve()
     path.parent.mkdir(parents=True, exist_ok=True)
     tmp = path.with_name(path.name + f".tmp-{os.getpid()}")
     # Open the temp file at 0o600 up front so a secret-bearing config is never

gpt2agent/server.py

@@ -76,6 +76,21 @@ def load_config(path: Path | None = None) -> dict[str, Any]:
 # ── server ───────────────────────────────────────────────────────────────────
 
 
+def _dr_incomplete_note(timed_out: bool) -> str:
+    """Marker appended when a DR stream never reached finished_successfully.
+
+    Without it, a truncated or timed-out report is indistinguishable from a
+    complete one — the caller would archive partial research as final.
+    """
+    note = (
+        "\n\n---\n**⚠ Report may be incomplete** — the stream ended before the "
+        "server marked the response finished"
+    )
+    if timed_out:
+        note += " (completion polling timed out)"
+    return note + ". Retry, or use get_conversation to check for a fuller report."
+
+
 def build_server(cfg: dict[str, Any]) -> FastMCP:
     srv = cfg["server"]
     models = cfg["models"]
@@ -149,13 +164,17 @@ async def deep_research(query: str, auto_confirm: bool = True) -> str:
         final_text = ""
         tool_calls: list[str] = []
         refs: list = []
+        truncated = False
+        timed_out = False
 
         async for event in conv.deep_research(q):
             if event["type"] == "tool":
                 tool_calls.append(event["call"])
             elif event["type"] == "done":
                 final_text = event["text"]
                 refs = event.get("content_references", [])
+                truncated = bool(event.get("terminated_abnormally"))
+                timed_out = bool(event.get("timeout"))
 
         # Append a brief sources section if citations were returned
         if refs:
@@ -170,6 +189,9 @@ async def deep_research(query: str, auto_confirm: bool = True) -> str:
                         lines.append(f"- [{title}]({url})")
             final_text += "\n".join(lines)
 
+        if truncated:
+            final_text += _dr_incomplete_note(timed_out)
+
         return final_text or "(no response)"
 
     @mcp.tool()
@@ -189,6 +211,8 @@ async def deep_research_heavy(query: str, auto_confirm: bool = True) -> str:
         refs: list = []
         connector_failed = False
         tool_error_msg = ""
+        truncated = False
+        timed_out = False
 
         async for event in conv.deep_research_heavy(q, model=heavy_dr_model):
             etype = event.get("type")
@@ -197,6 +221,8 @@ async def deep_research_heavy(query: str, auto_confirm: bool = True) -> str:
                 refs = event.get("content_references", [])
                 if event.get("connector_failed"):
                     connector_failed = True
+                truncated = bool(event.get("terminated_abnormally"))
+                timed_out = bool(event.get("timeout"))
             elif etype == "tool_error":
                 tool_error_msg = event.get("message", "")
 
@@ -226,6 +252,9 @@ async def deep_research_heavy(query: str, auto_confirm: bool = True) -> str:
                 warning += f"\n\n*Server message:* `{first_line}`"
             final_text += warning
 
+        if truncated:
+            final_text += _dr_incomplete_note(timed_out)
+
         return final_text or "(no response)"
 
     @mcp.tool()

gpt2agent/setup.py

@@ -147,6 +147,8 @@ def detect_plan() -> str:
 
 
 def write_mcp_config(plan: str) -> None:
+    from gpt2agent.install import _atomic_write, _backup
+
     chat_model = "gpt-5-5-pro" if plan == "pro" else "gpt-5-3"
     cfg = f"""[server]
 # Loopback only — the HTTP transport is unauthenticated and proxies your full
@@ -157,7 +159,13 @@ def write_mcp_config(plan: str) -> None:
 [models]
 chat = "{chat_model}"
 """
-    MCP_CONFIG_PATH.write_text(cfg)
+    # Users hand-edit this file (models, host opt-ins); don't clobber their
+    # copy silently — keep a .bak and write atomically.
+    if MCP_CONFIG_PATH.exists():
+        if MCP_CONFIG_PATH.read_text() == cfg:
+            return
+        _backup(MCP_CONFIG_PATH)
+    _atomic_write(MCP_CONFIG_PATH, cfg)
 
 
 # ── final summary ────────────────────────────────────────────────────────────

gpt2agent/tools/_redact.py

@@ -3,6 +3,21 @@
 # PII patterns.
 _EMAIL_RE = re.compile(r"[\w.+-]+@[\w-]+\.[\w.-]+")
 _PHONE_RE = re.compile(r"\+?\d[\d ()\-]{8,}\d")
+# Calendar dates satisfy _PHONE_RE ("2026-05-26" is 10 digit/dash chars), so a
+# phone match that *starts* with a date shape keeps the date — dates in
+# memories/tasks/conversations vastly outnumber phone numbers written with a
+# leading date. Only the date itself is preserved; the rest of the match is
+# re-scanned so "2026-05-26 617-555-0123" still masks the phone.
+_DATE_PREFIX_RE = re.compile(r"^(\d{4}-\d{2}-\d{2}|\d{1,2}-\d{1,2}-\d{4})(?=$|[^\d])")
+
+
+def _phone_repl(m: re.Match) -> str:
+    text = m.group(0)
+    dm = _DATE_PREFIX_RE.match(text)
+    if not dm:
+        return "<PHONE>"
+    prefix = dm.group(1)
+    return prefix + _PHONE_RE.sub(_phone_repl, text[len(prefix):])
 
 # Secret patterns. Users routinely paste API keys / tokens into ChatGPT, so they
 # end up in memories, tasks, and custom instructions — which these tools return
@@ -25,5 +40,5 @@ def redact(s: object) -> object:
     s = _APIKEY_RE.sub("<APIKEY>", s)
     s = _GH_TOKEN_RE.sub("<TOKEN>", s)
     s = _EMAIL_RE.sub("<EMAIL>", s)
-    s = _PHONE_RE.sub("<PHONE>", s)
+    s = _PHONE_RE.sub(_phone_repl, s)
     return s