@makerbi/remodex 2.3.2 → 2.5.6

package/src/desktop-ipc-live-owner.js

@@ -9,6 +9,7 @@ const net = require("net");
 const {
   CLIENT_STATUS_CHANGED,
   DESKTOP_IPC_METHOD_VERSIONS: METHOD_VERSION_BY_NAME,
+  buildCompleteThreadReadParams,
   cloneJSON,
   conversationSnapshotShowsActiveTurn,
   isPlainJSONObject,
@@ -16,6 +17,7 @@ const {
   readString,
   requestIdKey,
   resolveDefaultIpcSocketPath,
+  resolveIpcSocketPathCandidates,
   safeParseJSON,
   visibleUserPromptFromInputEntries,
 } = require("./desktop-ipc-shared");
@@ -51,6 +53,8 @@ const DEFAULT_LIVE_OWNERSHIP_FRESHNESS_MS = 20_000;
 // can actually see the thread.
 const DEFAULT_SIDEBAR_REFRESH_DELAY_MS = 1_200;
 const THREAD_STREAM_STATE_CHANGED = "thread-stream-state-changed";
+const THREAD_STREAM_FOLLOWING_CHANGED = "thread-stream-following-changed";
+const THREAD_STREAM_FOLLOWING_STATUS_REQUESTED = "thread-stream-following-status-requested";
 // Cached thread/read responses are only a hydration convenience; owned threads
 // are never evicted, so a small cap keeps long browsing sessions bounded.
 const MAX_CACHED_THREADS = 30;
@@ -114,7 +118,9 @@ function createDesktopIpcLiveOwner({
   sendRawCodexMessage,
   normalizeTurnStartParams = (params) => params,
   runtimeSettingsStore = null,
-  socketPath = resolveDefaultIpcSocketPath(),
+  // Resolved per connect: Codex Desktop can start, stop, or move its bus while
+  // the bridge stays up.
+  socketPath = resolveIpcSocketPathCandidates,
   sidebarRefreshDelayMs = DEFAULT_SIDEBAR_REFRESH_DELAY_MS,
   snapshotDebounceMs = DEFAULT_SNAPSHOT_DEBOUNCE_MS,
   maxPatchCount = DEFAULT_MAX_PATCH_COUNT,
@@ -124,6 +130,7 @@ function createDesktopIpcLiveOwner({
   initialHistoryRetryMs = DEFAULT_INITIAL_HISTORY_RETRY_MS,
   initialHistoryMaxAttempts = DEFAULT_INITIAL_HISTORY_MAX_ATTEMPTS,
   liveOwnershipFreshnessMs = DEFAULT_LIVE_OWNERSHIP_FRESHNESS_MS,
+  onFollowerStateChanged = null,
   netModule = net,
   now = () => Date.now(),
   logPrefix = "[remodex]",
@@ -155,8 +162,14 @@ function createDesktopIpcLiveOwner({
   // baseRevision matches their last-seen revision, and load-complete-history
   // waits for the snapshot carrying the returned revision.
   const streamRevisionsByThreadId = new Map();
+  const followerClientIdsByThreadId = new Map();
   const announcedSidebarThreadIds = new Set();
   const sidebarRefreshTimersByThreadId = new Map();
+  // A new rollout can exist as a thread id before Desktop's separate app-server
+  // can return it from thread/list. Keep a bounded materialization replay alive
+  // until the first user item and turn completion prove the rollout was written.
+  const pendingSidebarMaterializationThreadIds = new Set();
+  const replayedSidebarMaterializationThreadIds = new Set();
   const pendingTurnStartParamsByThreadId = new Map();
   const pendingTurnStartEntriesByRequestId = new Map();
   const followerRuntimeOverridesByThreadId = new Map();
@@ -179,6 +192,7 @@ function createDesktopIpcLiveOwner({
     logPrefix,
     onConnected() {
       flushPendingThreadArchiveMetadataBroadcasts();
+      requestFollowerStatusForAllOwnedThreads();
       broadcastAllOwnedSnapshots();
     },
     onBroadcast(envelope) {
@@ -322,6 +336,7 @@ function createDesktopIpcLiveOwner({
       }
       refreshOptimisticFallbackForThread(update.threadId);
       scheduleSnapshot(update.threadId);
+      replaySidebarAnnouncementAfterMaterialization(message, update.threadId);
     }
 
     if (readString(message.method) === "turn/completed") {
@@ -360,11 +375,14 @@ function createDesktopIpcLiveOwner({
     lastBroadcastStatesByThreadId.clear();
     fallbackTurnIdsByThreadId.clear();
     streamRevisionsByThreadId.clear();
+    followerClientIdsByThreadId.clear();
     for (const timer of sidebarRefreshTimersByThreadId.values()) {
       clearTimeout(timer);
     }
     sidebarRefreshTimersByThreadId.clear();
     announcedSidebarThreadIds.clear();
+    pendingSidebarMaterializationThreadIds.clear();
+    replayedSidebarMaterializationThreadIds.clear();
     pendingTurnStartParamsByThreadId.clear();
     pendingTurnStartEntriesByRequestId.clear();
     followerRuntimeOverridesByThreadId.clear();
@@ -616,8 +634,12 @@ function createDesktopIpcLiveOwner({
     if (!normalizedThreadId) {
       return;
     }
+    const isNewOwner = !ownedThreadIds.has(normalizedThreadId);
     ownedThreadIds.add(normalizedThreadId);
     ipc.ensureConnected();
+    if (isNewOwner) {
+      requestFollowerStatus(normalizedThreadId);
+    }
   }
 
   // Notification-only thread/start paths do not echo a request id, so consume the
@@ -662,6 +684,9 @@ function createDesktopIpcLiveOwner({
     lastBroadcastStatesByThreadId.delete(normalizedThreadId);
     fallbackTurnIdsByThreadId.delete(normalizedThreadId);
     streamRevisionsByThreadId.delete(normalizedThreadId);
+    if (followerClientIdsByThreadId.delete(normalizedThreadId)) {
+      onFollowerStateChanged?.(normalizedThreadId, false);
+    }
     // An active-peer takeover can still drop a non-empty queue (hasActiveLocalTurn
     // only shields idle yields); announce the emptied queue instead of letting
     // clients keep rendering drafts the bridge will never run.
@@ -674,6 +699,8 @@ function createDesktopIpcLiveOwner({
     announcedReadStateThreadIds.delete(normalizedThreadId);
     cancelSidebarAnnouncement(normalizedThreadId);
     announcedSidebarThreadIds.delete(normalizedThreadId);
+    pendingSidebarMaterializationThreadIds.delete(normalizedThreadId);
+    replayedSidebarMaterializationThreadIds.delete(normalizedThreadId);
     pendingTurnStartParamsByThreadId.delete(normalizedThreadId);
     followerRuntimeOverridesByThreadId.delete(normalizedThreadId);
     for (const [requestId, pending] of Array.from(pendingTurnStartEntriesByRequestId.entries())) {
@@ -726,9 +753,9 @@ function createDesktopIpcLiveOwner({
   }
 
   // Desktop has no watcher on the shared session store, but its webview reacts
-  // to thread-unarchived broadcasts by re-running thread/list. Announcing each
-  // phone-driven thread once (after the rollout has had time to persist) makes
-  // it appear in Desktop's sidebar without the disruptive deep-link bounce.
+  // to thread-unarchived broadcasts by re-running thread/list. The first timed
+  // announcement keeps the common path responsive; materialization events below
+  // replay it because a new rollout id can precede Desktop's thread/list entry.
   function scheduleSidebarAnnouncement(threadId) {
     const normalizedThreadId = readString(threadId);
     if (!normalizedThreadId
@@ -736,6 +763,7 @@ function createDesktopIpcLiveOwner({
       || sidebarRefreshTimersByThreadId.has(normalizedThreadId)) {
       return;
     }
+    pendingSidebarMaterializationThreadIds.add(normalizedThreadId);
     const timer = setTimeout(() => {
       sidebarRefreshTimersByThreadId.delete(normalizedThreadId);
       if (!ownedThreadIds.has(normalizedThreadId)) {
@@ -748,6 +776,42 @@ function createDesktopIpcLiveOwner({
     sidebarRefreshTimersByThreadId.set(normalizedThreadId, timer);
   }
 
+  function replaySidebarAnnouncementAfterMaterialization(message, threadId) {
+    const normalizedThreadId = readString(threadId);
+    if (!normalizedThreadId
+      || !ownedThreadIds.has(normalizedThreadId)
+      || !pendingSidebarMaterializationThreadIds.has(normalizedThreadId)) {
+      return;
+    }
+
+    const method = readString(message?.method);
+    const itemType = readString(message?.params?.item?.type);
+    const turnItems = Array.isArray(message?.params?.turn?.items)
+      ? message.params.turn.items
+      : [];
+    const includesPersistedUserMessage = (
+      (method === "item/started" || method === "item/completed")
+        && itemType === "userMessage"
+    ) || turnItems.some((item) => readString(item?.type) === "userMessage");
+    const turnCompleted = method === "turn/completed";
+    if (!includesPersistedUserMessage && !turnCompleted) {
+      return;
+    }
+
+    cancelSidebarAnnouncement(normalizedThreadId);
+    announcedSidebarThreadIds.add(normalizedThreadId);
+    if (!replayedSidebarMaterializationThreadIds.has(normalizedThreadId) || turnCompleted) {
+      broadcastThreadUnarchived(normalizedThreadId);
+    }
+
+    if (turnCompleted) {
+      pendingSidebarMaterializationThreadIds.delete(normalizedThreadId);
+      replayedSidebarMaterializationThreadIds.delete(normalizedThreadId);
+      return;
+    }
+    replayedSidebarMaterializationThreadIds.add(normalizedThreadId);
+  }
+
   function cancelSidebarAnnouncement(threadId) {
     const timer = sidebarRefreshTimersByThreadId.get(threadId);
     if (timer) {
@@ -993,7 +1057,10 @@ function createDesktopIpcLiveOwner({
       return;
     }
     const hydration = Promise.resolve()
-      .then(() => sendCodexRequest("thread/read", { threadId: normalizedThreadId }))
+      .then(() => sendCodexRequest(
+        "thread/read",
+        buildCompleteThreadReadParams(normalizedThreadId)
+      ))
       .then((result) => {
         const thread = readThreadFromPayload(result);
         if (!thread?.id) {
@@ -1097,7 +1164,19 @@ function createDesktopIpcLiveOwner({
 
   function handlePeerBroadcast(envelope) {
     if (envelope?.method === CLIENT_STATUS_CHANGED) {
+      // The fallback router can accept the owner's connection before any
+      // Desktop client exists. Metadata broadcasts remain queued in that state;
+      // retry them whenever peer membership changes so a newly connected
+      // Desktop immediately refreshes its sidebar.
+      flushPendingThreadArchiveMetadataBroadcasts();
       broadcastAllOwnedSnapshots();
+      if (normalizeToken(envelope.params?.status) === "disconnected") {
+        removeFollowerClient(envelope.params?.clientId || envelope.sourceClientId);
+      }
+      return;
+    }
+    if (envelope?.method === THREAD_STREAM_FOLLOWING_CHANGED) {
+      updateFollowerState(envelope);
       return;
     }
     if (maybeYieldOwnedThreadForPeerArchive(envelope)) {
@@ -1131,6 +1210,66 @@ function createDesktopIpcLiveOwner({
     removeOwnedThread(threadId);
   }
 
+  function updateFollowerState(envelope) {
+    const params = envelope?.params || {};
+    const threadId = readString(params.conversationId) || readString(params.conversation_id);
+    const clientId = readString(envelope?.sourceClientId);
+    if (!threadId || !clientId || !ownedThreadIds.has(threadId)) {
+      return;
+    }
+
+    const followers = followerClientIdsByThreadId.get(threadId) || new Set();
+    if (params.following === true) {
+      const wasUnfollowed = followers.size === 0;
+      followers.add(clientId);
+      followerClientIdsByThreadId.set(threadId, followers);
+      if (wasUnfollowed) {
+        onFollowerStateChanged?.(threadId, true);
+      }
+      // Match Codex's owner behavior: a newly mounted follower receives an
+      // immediate full baseline instead of waiting for the next model delta.
+      broadcastConversationState(threadId, { forceSnapshot: true });
+      return;
+    }
+
+    if (!followers.delete(clientId)) {
+      return;
+    }
+    if (followers.size === 0) {
+      followerClientIdsByThreadId.delete(threadId);
+      onFollowerStateChanged?.(threadId, false);
+    }
+  }
+
+  function removeFollowerClient(clientId) {
+    const normalizedClientId = readString(clientId);
+    if (!normalizedClientId) {
+      return;
+    }
+    for (const [threadId, followers] of followerClientIdsByThreadId) {
+      if (!followers.delete(normalizedClientId)) {
+        continue;
+      }
+      if (followers.size === 0) {
+        followerClientIdsByThreadId.delete(threadId);
+        onFollowerStateChanged?.(threadId, false);
+      }
+    }
+  }
+
+  function requestFollowerStatusForAllOwnedThreads() {
+    for (const threadId of ownedThreadIds) {
+      requestFollowerStatus(threadId);
+    }
+  }
+
+  function requestFollowerStatus(threadId) {
+    ipc.sendBroadcast(THREAD_STREAM_FOLLOWING_STATUS_REQUESTED, {
+      hostId,
+      conversationId: threadId,
+    });
+  }
+
   function isPeerOwnershipBroadcast(params) {
     if (readString(params?.remodexOwnerSource) === REMODEX_LIVE_OWNER_SOURCE) {
       return false;
@@ -1203,7 +1342,10 @@ function createDesktopIpcLiveOwner({
   // history is complete, then force-broadcast a fresh snapshot.
   async function handleFollowerLoadCompleteHistory(conversationId) {
     try {
-      const result = await sendCodexRequest("thread/read", { threadId: conversationId });
+      const result = await sendCodexRequest(
+        "thread/read",
+        buildCompleteThreadReadParams(conversationId)
+      );
       const thread = readThreadFromPayload(result);
       if (thread?.id) {
         rememberCachedThread(thread.id, thread);

package/src/desktop-ipc-owner-transport.js

@@ -11,16 +11,18 @@ const path = require("path");
 const {
   CLIENT_STATUS_CHANGED,
   DESKTOP_IPC_METHOD_VERSIONS: METHOD_VERSION_BY_NAME,
-  FRAME_HEADER_BYTES,
-  MAX_FRAME_BYTES,
+  buildIpcRequestEnvelope,
+  createFrameReader,
   normalizeToken,
   readString,
   requestIdKey,
-  safeParseJSON,
+  toSocketPathCandidatesResolver,
+  toSocketPathResolver,
   writeFrame,
 } = require("./desktop-ipc-shared");
 
 const DEFAULT_DISCOVERY_TIMEOUT_MS = 1_000;
+const SOCKET_PROBE_TIMEOUT_MS = 500;
 
 function createDesktopOwnerIpcClient({
   socketPath,
@@ -35,16 +37,22 @@ function createDesktopOwnerIpcClient({
   canHandleRequest,
   handleRequest,
 }) {
+  const resolveSocketPaths = toSocketPathCandidatesResolver(socketPath);
   let socket = null;
   let isConnecting = false;
   let isInitialized = false;
   let clientId = "";
-  let readBuffer = Buffer.alloc(0);
   let reconnectTimer = null;
   let shouldReconnect = false;
+  let remainingSocketPaths = [];
+  let preferredSocketFailure = null;
+  const frameReader = createFrameReader({
+    onFrame: (envelope) => dispatchEnvelope(envelope),
+    onOverflow: () => closeSocket(),
+  });
   const localRouter = startRouterWhenMissing
     ? createDesktopIpcRouterServer({
-      socketPath,
+      socketPath: () => resolveSocketPaths()[0],
       netModule,
       now,
       requestTimeoutMs,
@@ -60,8 +68,20 @@ function createDesktopOwnerIpcClient({
       return;
     }
     clearReconnectTimer();
+    remainingSocketPaths = resolveSocketPaths();
+    preferredSocketFailure = null;
+    connectNextSocket();
+  }
+
+  function connectNextSocket() {
+    const nextSocketPath = remainingSocketPaths.shift();
+    if (!nextSocketPath) {
+      isConnecting = false;
+      return;
+    }
+
     isConnecting = true;
-    const nextSocket = netModule.createConnection(socketPath);
+    const nextSocket = netModule.createConnection(nextSocketPath);
     socket = nextSocket;
 
     nextSocket.on("connect", () => {
@@ -77,11 +97,19 @@ function createDesktopOwnerIpcClient({
           closeSocket();
         });
     });
-    nextSocket.on("data", handleData);
+    nextSocket.on("data", (chunk) => frameReader.push(chunk));
     nextSocket.on("close", () => handleClose(nextSocket));
     nextSocket.on("error", (error) => {
       if (error?.code === "ENOENT" || error?.code === "ECONNREFUSED") {
-        startLocalRouterAfterMissingSocket(error.code);
+        preferredSocketFailure ||= { code: error.code, socketPath: nextSocketPath };
+        if (remainingSocketPaths.length > 0) {
+          retryNextSocket(nextSocket);
+          return;
+        }
+        startLocalRouterAfterMissingSocket(
+          preferredSocketFailure.code,
+          preferredSocketFailure.socketPath
+        );
         return;
       }
       if (error?.code !== "ENOENT" && error?.code !== "ECONNREFUSED") {
@@ -90,11 +118,46 @@ function createDesktopOwnerIpcClient({
     });
   }
 
-  function startLocalRouterAfterMissingSocket(reasonCode) {
+  function retryNextSocket(failedSocket) {
+    if (socket === failedSocket) {
+      socket = null;
+    }
+    isConnecting = false;
+    frameReader.reset();
+    failedSocket.destroy();
+    connectNextSocket();
+  }
+
+  function startLocalRouterAfterMissingSocket(reasonCode, failedSocketPath) {
     if (!localRouter || localRouter.isStarted) {
       return;
     }
-    localRouter.start({ removeStaleSocket: reasonCode === "ECONNREFUSED" })
+    // ECONNREFUSED means the socket file is there with nobody behind it, so the
+    // fallback router replaces it. Codex can bind its own bus in the gap between
+    // that refusal and the replacement, and unlinking a live socket would strand
+    // the desktop on a path no other client reaches: probe once more first, and
+    // let the ordinary reconnect take over when the bus is back.
+    const mayReplaceStaleSocket = reasonCode === "ECONNREFUSED";
+    const removeStaleSocket = mayReplaceStaleSocket
+      ? probeSocketIsListening(failedSocketPath, netModule).then((isListening) => !isListening)
+      : Promise.resolve(false);
+
+    removeStaleSocket
+      .then((shouldRemoveStaleSocket) => {
+        if (mayReplaceStaleSocket && !shouldRemoveStaleSocket) {
+          return null;
+        }
+        return startLocalRouter({ removeStaleSocket: shouldRemoveStaleSocket });
+      })
+      .catch((error) => {
+        if (error?.code !== "EADDRINUSE") {
+          console.warn(`${logPrefix} desktop IPC router fallback failed: ${error.message}`);
+        }
+      });
+  }
+
+  function startLocalRouter({ removeStaleSocket }) {
+    return localRouter.start({ removeStaleSocket })
       .then(() => {
         if (!shouldReconnect) {
           return;
@@ -103,11 +166,6 @@ function createDesktopOwnerIpcClient({
         isConnecting = false;
         clearReconnectTimer();
         ensureConnected();
-      })
-      .catch((error) => {
-        if (error?.code !== "EADDRINUSE") {
-          console.warn(`${logPrefix} desktop IPC router fallback failed: ${error.message}`);
-        }
       });
   }
 
@@ -116,6 +174,12 @@ function createDesktopOwnerIpcClient({
     if (!socket || socket.destroyed || !isInitialized) {
       return false;
     }
+    // A write to the bridge-owned fallback router is not a delivery when no
+    // Desktop/VSCode peer is attached. Report that state as pending so callers
+    // can replay metadata and snapshots when the router announces a real peer.
+    if (localRouter && !localRouter.hasBroadcastRecipientFor(clientId)) {
+      return false;
+    }
     const envelope = {
       type: "broadcast",
       method,
@@ -132,14 +196,7 @@ function createDesktopOwnerIpcClient({
       return Promise.reject(new Error("Desktop IPC is not connected."));
     }
     const requestId = `remodex-owner-${now().toString(36)}-${randomUUID()}`;
-    const envelope = {
-      type: "request",
-      requestId,
-      sourceClientId: initializing ? "initializing-client" : clientId || "remodex-bridge",
-      version: METHOD_VERSION_BY_NAME.get(method) || 1,
-      method,
-      params: params || {},
-    };
+    const envelope = buildIpcRequestEnvelope({ requestId, method, params, clientId, initializing });
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         pendingResponses.delete(requestId);
@@ -160,27 +217,6 @@ function createDesktopOwnerIpcClient({
     });
   }
 
-  function handleData(chunk) {
-    readBuffer = Buffer.concat([readBuffer, chunk]);
-    while (readBuffer.length >= FRAME_HEADER_BYTES) {
-      const frameLength = readBuffer.readUInt32LE(0);
-      if (frameLength > MAX_FRAME_BYTES) {
-        closeSocket();
-        return;
-      }
-      if (readBuffer.length < FRAME_HEADER_BYTES + frameLength) {
-        return;
-      }
-
-      const payload = readBuffer.slice(FRAME_HEADER_BYTES, FRAME_HEADER_BYTES + frameLength).toString("utf8");
-      readBuffer = readBuffer.slice(FRAME_HEADER_BYTES + frameLength);
-      const envelope = safeParseJSON(payload);
-      if (envelope) {
-        dispatchEnvelope(envelope);
-      }
-    }
-  }
-
   function dispatchEnvelope(envelope) {
     if (envelope.type === "response") {
       handleResponse(envelope);
@@ -252,7 +288,7 @@ function createDesktopOwnerIpcClient({
     isConnecting = false;
     isInitialized = false;
     clientId = "";
-    readBuffer = Buffer.alloc(0);
+    frameReader.reset();
     for (const waiter of pendingResponses.values()) {
       clearTimeout(waiter.timeout);
       waiter.reject(new Error("Desktop IPC connection closed."));
@@ -332,10 +368,14 @@ function createDesktopIpcRouterServer({
   discoveryTimeoutMs,
   logPrefix,
 }) {
+  const resolveSocketPath = toSocketPathResolver(socketPath);
   let server = null;
   let started = false;
   let starting = null;
   let closed = false;
+  // Closing must unlink exactly what this router listened on, not whatever the
+  // resolver would pick later.
+  let listeningSocketPath = "";
   let nextClientSeq = 1;
   const clientsById = new Map();
   const pendingDiscoveryResponses = new Map();
@@ -350,8 +390,9 @@ function createDesktopIpcRouterServer({
     }
     closed = false;
     starting = new Promise((resolve, reject) => {
+      const nextSocketPath = resolveSocketPath();
       try {
-        prepareSocketPathForListen(socketPath, { removeStaleSocket });
+        prepareSocketPathForListen(nextSocketPath, { removeStaleSocket });
       } catch (error) {
         starting = null;
         reject(error);
@@ -365,9 +406,10 @@ function createDesktopIpcRouterServer({
         server = null;
         reject(error);
       });
-      nextServer.listen(socketPath, () => {
+      nextServer.listen(nextSocketPath, () => {
         started = true;
         starting = null;
+        listeningSocketPath = nextSocketPath;
         nextServer.removeAllListeners("error");
         nextServer.on("error", (error) => {
           console.warn(`${logPrefix} desktop IPC router fallback error: ${error.message}`);
@@ -384,35 +426,17 @@ function createDesktopIpcRouterServer({
       id: "",
       type: "",
       socket,
-      buffer: Buffer.alloc(0),
       initialized: false,
     };
-    socket.on("data", (chunk) => handleClientData(client, chunk));
+    const frameReader = createFrameReader({
+      onFrame: (envelope) => dispatchClientEnvelope(client, envelope),
+      onOverflow: () => client.socket.destroy(),
+    });
+    socket.on("data", (chunk) => frameReader.push(chunk));
     socket.on("close", () => removeClient(client));
     socket.on("error", () => removeClient(client));
   }
 
-  function handleClientData(client, chunk) {
-    client.buffer = Buffer.concat([client.buffer, chunk]);
-    while (client.buffer.length >= FRAME_HEADER_BYTES) {
-      const frameLength = client.buffer.readUInt32LE(0);
-      if (frameLength > MAX_FRAME_BYTES) {
-        client.socket.destroy();
-        return;
-      }
-      if (client.buffer.length < FRAME_HEADER_BYTES + frameLength) {
-        return;
-      }
-
-      const payload = client.buffer.slice(FRAME_HEADER_BYTES, FRAME_HEADER_BYTES + frameLength).toString("utf8");
-      client.buffer = client.buffer.slice(FRAME_HEADER_BYTES + frameLength);
-      const envelope = safeParseJSON(payload);
-      if (envelope) {
-        dispatchClientEnvelope(client, envelope);
-      }
-    }
-  }
-
   function dispatchClientEnvelope(client, envelope) {
     if (envelope.type === "request" && envelope.method === "initialize") {
       initializeClient(client, envelope);
@@ -685,9 +709,10 @@ function createDesktopIpcRouterServer({
       server.close();
       server = null;
     }
-    if (shouldRemoveSocketPath) {
-      removeSocketPathAfterClose(socketPath);
+    if (shouldRemoveSocketPath && listeningSocketPath) {
+      removeSocketPathAfterClose(listeningSocketPath);
     }
+    listeningSocketPath = "";
   }
 
   function writeEnvelopeToClient(client, envelope) {
@@ -703,9 +728,25 @@ function createDesktopIpcRouterServer({
     }
   }
 
+  function hasBroadcastRecipientFor(senderClientId) {
+    const sender = clientsById.get(senderClientId);
+    if (!sender) {
+      // The owner is connected to an external Codex bus rather than this
+      // fallback router; that bus itself is the broadcast recipient.
+      return true;
+    }
+    return Array.from(clientsById.values()).some((client) => (
+      client !== sender
+      && client.initialized
+      && !client.socket.destroyed
+      && normalizeToken(client.type) !== "remodexbridge"
+    ));
+  }
+
   return {
     start,
     close,
+    hasBroadcastRecipientFor,
     get isStarted() {
       return started && !closed;
     },
@@ -716,11 +757,40 @@ function routedResponseKey(clientId, requestId) {
   return `${clientId}:${requestId}`;
 }
 
+// Answers "is anyone actually serving this path right now", which is the only
+// safe basis for replacing a socket file the bridge does not own.
+function probeSocketIsListening(socketPath, netModule) {
+  return new Promise((resolve) => {
+    let probe = null;
+    const finish = (isListening) => {
+      clearTimeout(timeout);
+      if (probe) {
+        probe.removeAllListeners();
+        probe.destroy();
+        probe = null;
+      }
+      resolve(isListening);
+    };
+    const timeout = setTimeout(() => finish(false), SOCKET_PROBE_TIMEOUT_MS);
+    timeout.unref?.();
+
+    try {
+      probe = netModule.createConnection(socketPath);
+    } catch {
+      finish(false);
+      return;
+    }
+    probe.once("connect", () => finish(true));
+    probe.once("error", () => finish(false));
+  });
+}
+
 function prepareSocketPathForListen(socketPath, { removeStaleSocket = false } = {}) {
   if (process.platform === "win32") {
     return;
   }
-  fs.mkdirSync(path.dirname(socketPath), { recursive: true });
+  // Matches how Codex creates its own IPC directory: local user only.
+  fs.mkdirSync(path.dirname(socketPath), { recursive: true, mode: 0o700 });
   if (removeStaleSocket && fs.existsSync(socketPath)) {
     const socketStat = fs.lstatSync(socketPath);
     if (!socketStat.isSocket()) {