@minhspark/codex-mcp-bridge 1.12.2 → 1.12.4

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](https://semver.org/).
 
+## [1.12.4] - 2026-09-05
+
+### Fixed
+
+- Authenticate Windows peer connections with the destination peer key, publish keys under the canonical socket hash, use Claude-compatible reply pipe names, and encode reply addresses. Incoming unauthenticated Windows frames are refused.
+- Keep receiver policy receipts separate from replies and correlate them to the original message and destination. Socket writes no longer report confirmed delivery; timeout and held/refused outcomes fail the roundtrip diagnostic without automatic retries.
+- Read ordinary Claude Desktop responses from the local transcript using the injected UUID and assistant ancestry, preserving Desktop's disabled native reply tool. Late correlated responses remain available while the bridge runs.
+- Declare sender permission mode only when explicitly configured, and preserve receiver approval decisions. Status reports unknown sender mode instead of inventing one.
+
+### Tests
+
+- Added authenticated transport, missing/bad auth, canonical key and address, receiver status, MCP outcome, and transcript-correlation regressions. Live Windows testing confirmed authentication and returned an actual `held` receipt; the Desktop assistant roundtrip remains subject to recipient approval.
+
+## [1.12.3] - 2026-09-05
+
+### Fixed
+
+- Discover the native tools pipe from the launching Desktop app-server's `mcp_servers.codex_app.env` override when Desktop does not pass it to custom MCP servers. Explicit pipe settings keep precedence; discovery rejects unrelated processes, ambiguous settings, and remote Windows pipes without scanning other sessions or persisting a restart-specific address.
+- Cancel pending pipe discovery when the client closes, and share discovery between concurrent connection requests so a closed client cannot send a delayed message.
+- Report a reachable shared companion in native relay status when another MCP instance owns the listening endpoint.
+
+### Tests
+
+- Added Windows/POSIX command-line parsing, parent discovery, environment precedence, real mock-pipe delivery, cancellation, concurrent connection, and shared-companion regressions.
+
 ## [1.12.2] - 2026-09-05
 
 ### Fixed

package/README.md

@@ -330,7 +330,7 @@ Under `owned`, a thread a human opened is **unreachable rather than merely restr
 | Tool | What it does | Hints |
 |---|---|---|
 | `list_claude_sessions` | Lists Claude Code sessions running on this machine (name, pid, sessionId, cwd, entrypoint). | read-only |
-| `send_to_claude_session` | Delivers a message into a Claude session — it lands **in that session's chat**, exactly like a teammate's message — and waits for the reply. `waitSec: 0` fires and forgets. `target` takes a name, pid or sessionId; **Claude session names drift over time**, so target by `sessionId` when it matters. | destructive |
+| `send_to_claude_session` | Sends to a Claude inbox and waits for a correlated reply. Receipt statuses distinguish `reply_received`, `sent_unconfirmed`, `reply_timeout`, and receiver policy outcomes such as `held` or `refused`. `waitSec: 0` sends without waiting for confirmation. Prefer an exact `sessionId` because session names can change. | destructive |
 | `read_claude_inbox` | Reads **and clears** messages Claude pushed over on its own, including replies that arrived late. | destructive |
 | `read_claude_transcript` | Reads a Claude session's recent conversation without sending anything. | read-only |
 | `bind_codex_thread` | Binds a Codex thread so every message from Claude is relayed into it, **visible in the Codex desktop app**. Pass an empty string to stop. | writes |
@@ -340,25 +340,37 @@ Every tool declares MCP annotation hints (`readOnlyHint`, `destructiveHint`, `id
 
 Waited sends to the same Claude session run in order. If an earlier send timed out or used `waitSec: 0` and its reply has not arrived, a new waited send returns `PEER_REPLY_PENDING` before delivering another message. Wait for the earlier reply and inspect `read_claude_inbox`, or use `waitSec: 0` if another asynchronous message is intended. Different destination sessions remain independent.
 
+Claude Desktop disables the CLI-native `SendMessage` tool. For Desktop targets, the bridge requests an ordinary answer in the destination conversation and reads only a completed assistant turn descended from the injected message UUID. Unrelated human prompts and sidechains are excluded. Late answers remain available through the inbox while the bridge process is running. This does not change Desktop tool permissions or the receiver's inbound policy.
+
+`CLAUDE_BRIDGE_PERMISSION_MODE` optionally declares the **actual sender** permission class (`prompting` or `bypass`). The installer preserves this setting when supplied. Leave it unset when the sender's effective mode is unknown. Never choose a value just to match a recipient: Claude applies its own permission-mode and inbound-policy checks and may hold a message for user approval. The bridge reports that decision and does not retry it automatically.
+
+`npm run check:claude` without `CLAUDE_TARGET` checks discovery only. With a target it requires `reply_received`; a socket write, a held message, or a timeout fails the roundtrip check.
+
 ### How each side sees the other
 
-- **Claude sees Codex:** `claude-bridge` registers itself as a *peer session* under `~/.claude/sessions/`. Claude lists it with `ListAgents` and messages it with `SendMessage` — not hidden, not an invisible background process. The default name is `codex-<pid>`; after `bind_codex_thread` it renames itself to `codex-<first 8 chars of threadId>`, which is what makes several bridges distinguishable (Codex starts **one bridge per session**, so a few peers usually advertise at once).
+- **Claude sees Codex:** `claude-bridge` registers a peer under `~/.claude/sessions/`. CLI sessions can use their permitted peer messaging tools to reply; Desktop replies use the correlated transcript path described above. The default name is `codex-<pid>`; `bind_codex_thread` renames it to `codex-<first 8 chars of threadId>`.
 - **Codex sees Claude:** `list_claude_sessions` reads that same registry, and `read_claude_transcript` shows what a Claude session is working on.
-- **Visible in chat:** a message from Codex appears in the Claude Desktop chat of the target session; a message from Claude is relayed into the bound Codex thread, so it appears in the Codex desktop app.
+- **Visible in chat:** messages accepted by Claude appear in the target conversation. Received replies can be relayed into the bound Codex task. A `held` receipt means the receiver has not released the message to Claude yet.
+
+### Peer protocol
 
-### Protocol (measured, not documented)
+Claude Code advertises local inboxes in `~/.claude/sessions/<pid>.json`. The bridge uses a Unix socket on macOS/Linux and `\\.\pipe\LOCAL\cc-msg-<32 hex characters>` on Windows. Frames are **NDJSON**, one message per line. A Windows connection starts with an authentication line using the destination's peer key; it never uses the separate child-process token:
+
+```json
+{"type":"auth","token":"<destination peer token>"}
+```
 
-Every Claude Code session writes `~/.claude/sessions/<pid>.json` and listens on `/tmp/cc-socks/<pid>.sock`. Frames are **NDJSON**, one message per line:
+The message carries an explicit UUID for transcript correlation:
 
 ```json
-{"msgV":1,"msg_id":"<uuid>","type":"user","message":{"role":"user",
- "content":"<cross-session-message from=\"uds:/tmp/cc-socks/<pid>.sock\" from-mode=\"bypass\">\n...\n</cross-session-message>"},
+{"msgV":1,"msg_id":"<uuid>","uuid":"<uuid>","type":"user","message":{"role":"user",
+ "content":"<cross-session-message from=\"uds:/tmp/cc-socks/<pid>.sock\">\n...\n</cross-session-message>"},
  "priority":"next","from":"uds:/tmp/cc-socks/<pid>.sock"}
 ```
 
-There is no token in the frame — **the socket is mode `0600`, so owning the user account is the entire security boundary**. To receive replies you must register a peer session of your own (registry entry + socket), because Claude answers to the address in `from`.
+Peer key names are `<pid>.<sha256(canonical socket)>.key`. Windows pipe names are normalized for hashing, and reply addresses are percent-encoded on the wire. Authentication and control frames are not user replies. `peer_message_status` receipts are matched to the original message ID and destination. A successful socket write alone is not a delivery acknowledgement.
 
-> ⚠️ This is a **Claude Code internal with no public documentation** (measured on 2.1.229). If the format changes, the Codex → Claude direction breaks; fix it in `src/peer-protocol.mjs`. The Claude → Codex direction goes through the official app-server and is unaffected.
+See [Claude Code cross-session messaging](https://code.claude.com/docs/en/cross-session-messaging) for authentication and inbound-policy behavior. Wire compatibility was checked against installed Claude Code 2.1.260; peer internals can change between releases.
 
 ### Ping-pong guard
 
@@ -424,7 +436,7 @@ Resolution order is `CODEX_RELAY_ID` → that file → an error naming both. Nev
 
 A companion that cannot be reached before sending falls back to the app-server path. Once a request has been written, a refusal, timeout, or lost acknowledgement does not trigger another delivery: the first attempt may already have succeeded. Invalid or oversized messages are also refused rather than passed to another backend.
 
-Codex Desktop supplies `CODEX_APP_TOOLS_PIPE_PATH` to its companion. The companion keeps that native connection separate from MCP stdio. Without the inherited native pipe it does not advertise a working relay endpoint; if a configured pipe is late during startup, it retries in the background.
+The companion uses `CODEX_APP_TOOLS_PIPE_PATH` when inherited. Desktop builds that supply it only to their bundled `codex_app` MCP are also supported: the companion reads the exact `mcp_servers.codex_app.env` override from its launching app-server. It never picks a pipe from another session or saves a restart-specific address. The native connection remains separate from MCP stdio. If neither source provides a valid pipe, the relay stays unavailable; if a configured pipe is late during startup, it retries in the background. When several MCP instances start, status identifies a reachable shared companion instead of reporting that the relay is down.
 
 > ⚠️ `codex_app.send_message_to_thread` and the native tools pipe are **Codex Desktop internals with no public documentation**, on the same footing as the Claude peer protocol above. That is why the relay is Windows/macOS, feature-detected, optional and fallback-safe. If Codex changes it, the two places to fix are `NATIVE_DISPATCH_METHOD` and `nativeDispatchParams()` in `src/native-relay.mjs`; `CODEX_NATIVE_RELAY_METHOD` overrides the method name without a release. The request the companion sends is:
 >

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.12.2",
+  "version": "1.12.4",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/scripts/check-claude-bridge.mjs

@@ -34,7 +34,13 @@ try {
       arguments: { target, message, waitSec },
     });
     console.log("\n--- send_to_claude_session ---\n" + sent.content[0].text);
-    if (sent.isError) throw new Error("Claude message delivery failed");
+    if (sent.isError) throw new Error("Claude message roundtrip failed; receipt or outcome is unconfirmed");
+    if (sent.structuredContent?.receipt?.status !== "reply_received") {
+      throw new Error("Claude message roundtrip unconfirmed: an actual reply is required; use CLAUDE_WAIT greater than 0");
+    }
+    console.log("\nClaude message roundtrip passed: reply received.");
+  } else {
+    console.log("\nDiscovery checks passed. Message roundtrip was not tested; set CLAUDE_TARGET to verify a reply.");
   }
 } finally {
   await client.close();

package/scripts/install-codex-mcp.mjs

@@ -11,6 +11,8 @@ const codexBin = resolveCodexBin(process.env.CODEX_EXE);
 const serverName = process.env.CLAUDE_BRIDGE_NAME ?? "claude-bridge";
 const entry = path.join(root, "src", "claude-bridge.mjs");
 const remove = process.argv.includes("--remove");
+const permissionMode = process.env.CLAUDE_BRIDGE_PERMISSION_MODE;
+if (!remove && permissionMode && !["bypass", "prompting"].includes(permissionMode)) throw new Error("CLAUDE_BRIDGE_PERMISSION_MODE must be bypass or prompting");
 
 if (!fs.existsSync(entry)) throw new Error(`bridge entry point missing: ${entry}`);
 if (!path.isAbsolute(codexBin) || !fs.existsSync(codexBin)) {
@@ -33,6 +35,7 @@ try {
 const args = ["mcp", "add", serverName];
 const peerName = process.env.CLAUDE_BRIDGE_PEER_NAME;
 if (peerName) args.push("--env", `CLAUDE_BRIDGE_PEER_NAME=${peerName}`);
+if (permissionMode) args.push("--env", `CLAUDE_BRIDGE_PERMISSION_MODE=${permissionMode}`);
 args.push("--", process.execPath, entry);
 
 run(args);

package/scripts/install-native-relay.mjs

@@ -8,7 +8,7 @@ import { CodexAppServerClient } from "../src/app-server-client.mjs";
 import { bootstrapRelayThread, readRelayConfig, relayConfigPath, relaySocketPath } from "../src/native-relay.mjs";
 import { IS_MACOS, IS_WINDOWS, PLATFORM_LABEL, homeDir, resolveCodexBin, spawnEnv } from "../src/platform.mjs";
 
-const VERSION = "1.12.2";
+const VERSION = "1.12.4";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "native-relay-companion.mjs");
 const serverName = process.env.CODEX_NATIVE_RELAY_NAME ?? "codex-native-relay";

package/src/claude-bridge.mjs

@@ -8,7 +8,7 @@ import { PLATFORM_LABEL } from "./platform.mjs";
 import { PeerEndpoint, findClaudeSession, listClaudeSessions, readTranscript } from "./peer-protocol.mjs";
 import { createThreadDelivery } from "./thread-delivery.mjs";
 
-const VERSION = "1.12.2";
+const VERSION = "1.12.4";
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;
 
@@ -91,7 +91,7 @@ const server = new McpServer(
   {
     instructions:
       "Talk to a live Claude Code session from Codex. list_claude_sessions finds the session, " +
-      "send_to_claude_session delivers a message into its chat and waits for the answer. " +
+      "send_to_claude_session sends to its peer transport and waits for a reply to confirm receipt. " +
       "This bridge registers itself as a peer, so Claude sees it in its own agent list and can " +
       "message back; bind_codex_thread relays those messages into a Codex thread.",
   },
@@ -130,8 +130,8 @@ server.registerTool(
   {
     title: "Send a message to a Claude session",
     description:
-      "Deliver a message into a running Claude Code session. It appears in that session's chat exactly like " +
-      "a message from a teammate, and Claude can reply. Set waitSec to 0 to fire and forget. " +
+      "Send a message to a running Claude Code session's peer transport and wait for its reply. " +
+      "A socket write alone does not confirm that Claude received the message. Set waitSec to 0 to send without confirmation. " +
       "A waited send is refused while earlier messages to that session still await replies; " +
       "wait for those replies and read_claude_inbox before trying again.",
     inputSchema: {
@@ -159,17 +159,33 @@ server.registerTool(
       if (!session) return textResult(`No live Claude session matches "${target}".`, true);
 
       const wait = waitSec ?? 180;
-      const { reply } = await peer.sendAndWait(session.socket, message, { timeoutMs: wait * 1000 });
-      const header = `delivered to ${session.name ?? session.pid} (pid ${session.pid}, session ${session.sessionId ?? "?"})`;
+      const desktop = session.entrypoint === "claude-desktop";
+      const text = desktop ? `${message}\n\n[Bridge response routing: reply with ordinary text in this conversation. The bridge reads the response associated with this message from the local transcript; no cross-session reply tool is needed.]` : message;
+      const { msgId, reply, delivery } = await peer.sendAndWait(session.socket, text, {
+        timeoutMs: wait * 1000,
+        ...(desktop ? { transcriptSession: session } : {}),
+      });
+      const status = reply ? "reply_received" : delivery?.status ?? (wait === 0 ? "sent_unconfirmed" : "reply_timeout");
+      const receipt = { status, msgId, target: session.name ?? String(session.pid), sessionId: session.sessionId, waitSec: wait, ...(reply ? { source: reply.source ?? "peer" } : {}) };
+      const result = (text, isError = false) => ({ ...textResult(text, isError), structuredContent: { receipt } });
+      const targetLabel = `${session.name ?? session.pid} (pid ${session.pid}, session ${session.sessionId ?? "?"})`;
 
-      if (wait === 0) return textResult(`${header}\nnot waiting for a reply.`);
+      if (!reply && delivery && delivery.status !== "delivered") {
+        return result(`Claude inbox reported ${delivery.status} for ${targetLabel}.\n${delivery.reason}\nMessage id: ${msgId}`, true);
+      }
+
+      if (wait === 0) {
+        return result(`Sent to peer transport for ${targetLabel}.\nClaude receipt unconfirmed; not waiting for a reply.\nMessage id: ${msgId}`);
+      }
 
       if (!reply) {
-        return textResult(
-          `${header}\n\nNo reply within ${wait}s. Claude may still be working - check again with read_claude_inbox.`,
+        return result(
+          `Sent to peer transport for ${targetLabel}.\n\nNo reply within ${wait}s; Claude receipt and outcome remain unconfirmed. ` +
+          `Do not automatically retry: the message may still be processed. Check read_claude_inbox for a late reply.\nMessage id: ${msgId}`,
+          true,
         );
       }
-      return textResult(`${header}\n\n--- Claude reply ---\n${reply.text}`);
+      return result(`Reply received from ${targetLabel}.\nMessage id: ${msgId}\n\n--- Claude reply ---\n${reply.text}`);
     } catch (err) {
       return failure(err);
     }
@@ -296,6 +312,7 @@ server.registerTool(
         `bridge:        claude-bridge ${VERSION}`,
         `peer name:     ${peer.name}   (Claude sees this in its agent list)`,
         `peer socket:   ${peer.socketPath}`,
+        `sender mode:   ${peer.permissionMode ?? "unknown (recipient may hold messages for approval)"}`,
         `live sessions: ${sessions.length}`,
         `relay thread:  ${forwarding.threadId ?? "(none - use bind_codex_thread)"}`,
         `delivery:      ${delivery.describe()}`,

package/src/index.mjs

@@ -23,7 +23,7 @@ import {
 import { runTurn } from "./turn.mjs";
 import { BridgeSecurityPolicy } from "./security-policy.mjs";
 
-const VERSION = "1.12.2";
+const VERSION = "1.12.4";
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
 /**

package/src/native-relay-companion.mjs

@@ -17,7 +17,7 @@ import {
 } from "./native-relay.mjs";
 import { IS_WINDOWS, PLATFORM_LABEL } from "./platform.mjs";
 
-const VERSION = "1.12.2";
+const VERSION = "1.12.4";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message) {
@@ -201,6 +201,10 @@ export class RelaySocketServer {
     });
   }
 
+  async isListening() {
+    return this.started || this.#socketIsLive();
+  }
+
   #handleConnection(socket) {
     let buffer = Buffer.alloc(0);
     let handled = false;
@@ -350,6 +354,7 @@ if (invokedDirectly) {
       },
     },
     async () => {
+      const listening = await relay.isListening();
       let executor = "(unconfigured)";
       try {
         const resolved = resolveRelayThreadId();
@@ -364,7 +369,7 @@ if (invokedDirectly) {
             text: [
               `platform:       ${PLATFORM_LABEL} (${process.platform}/${process.arch})`,
               `companion:      codex-native-relay ${VERSION}`,
-              `relay socket:   ${relay.started ? relay.socketPath : `${relay.socketPath} (not listening)`}`,
+              `relay socket:   ${relay.started ? relay.socketPath : `${relay.socketPath} (${listening ? "shared companion listening" : "not listening"})`}`,
               `executor:       ${executor}`,
               `dispatch:       ${process.env.CODEX_NATIVE_RELAY_METHOD ?? NATIVE_DISPATCH_METHOD}`,
               `native pipe:    ${nativeTools.socketPath ?? "unavailable (requires Codex Desktop)"}`,

package/src/native-relay.mjs

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import net from "node:net";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 
 import { IS_MACOS, IS_WINDOWS, PLATFORM_LABEL, homeDir } from "./platform.mjs";
 
@@ -139,14 +141,168 @@ export function nativeDispatchParams({ executorThreadId, targetThreadId, message
   };
 }
 
+const execFileAsync = promisify(execFile);
+
+function splitDesktopCommandLine(commandLine, platform) {
+  const args = [];
+  let value = "";
+  let quote = null;
+  let depth = 0;
+  for (let index = 0; index < commandLine.length; index++) {
+    const char = commandLine[index];
+    if (platform === "win32" && char === "\\") {
+      let end = index;
+      while (commandLine[end] === "\\") end++;
+      const count = end - index;
+      if (commandLine[end] === '"') {
+        value += "\\".repeat(Math.floor(count / 2));
+        if (count % 2) value += '"';
+        else quote = quote ? null : '"';
+        index = end;
+      } else {
+        value += "\\".repeat(count);
+        index = end - 1;
+      }
+      continue;
+    }
+    if (platform !== "win32" && depth > 0) {
+      value += char;
+      if (quote) {
+        if (char === "\\" && quote === '"') value += commandLine[++index] ?? "";
+        else if (char === quote) quote = null;
+      } else if (char === '"' || char === "'") quote = char;
+      else if (char === "{" || char === "[") depth++;
+      else if (char === "}" || char === "]") depth--;
+      continue;
+    }
+    if (char === '"' || (platform !== "win32" && char === "'")) {
+      if (!quote) quote = char;
+      else if (quote === char) quote = null;
+      else value += char;
+    } else if (!quote && /\s/.test(char)) {
+      if (value) args.push(value);
+      value = "";
+    } else {
+      value += char;
+      if (platform !== "win32" && !quote && char === "{") depth++;
+    }
+  }
+  if (quote || depth) return [];
+  if (value) args.push(value);
+  return args;
+}
+
+function inlineTableValues(table) {
+  const text = table.trim();
+  if (!text.startsWith("{") || !text.endsWith("}")) return null;
+  const entries = [];
+  let start = 1;
+  let quote = null;
+  let depth = 0;
+  for (let index = 1; index < text.length - 1; index++) {
+    const char = text[index];
+    if (quote) {
+      if (char === "\\" && quote === '"') index++;
+      else if (char === quote) quote = null;
+    } else if (char === '"' || char === "'") quote = char;
+    else if (char === "{" || char === "[") depth++;
+    else if (char === "}" || char === "]") {
+      if (--depth < 0) return null;
+    } else if (char === "," && depth === 0) {
+      entries.push(text.slice(start, index));
+      start = index + 1;
+    }
+  }
+  if (quote || depth) return null;
+  entries.push(text.slice(start, -1));
+  const values = new Map();
+  for (const entry of entries) {
+    if (!entry.trim()) continue;
+    const match = entry.match(/^\s*(?:"([A-Za-z_][A-Za-z0-9_-]*)"|'([A-Za-z_][A-Za-z0-9_-]*)'|([A-Za-z_][A-Za-z0-9_-]*))\s*=\s*([\s\S]+)$/);
+    if (!match) return null;
+    const key = match[1] ?? match[2] ?? match[3];
+    if (values.has(key)) return null;
+    values.set(key, match[4].trim());
+  }
+  return values;
+}
+
+export function nativeToolsPipeFromCommandLine(commandLine, { platform = process.platform } = {}) {
+  if (typeof commandLine !== "string" || /[\r\n\0]/.test(commandLine)) return null;
+  const args = splitDesktopCommandLine(commandLine, platform);
+  const paths = platform === "win32" ? path.win32 : path.posix;
+  if (!/^codex(?:\.exe)?$/i.test(paths.basename(args[0] ?? ""))) return null;
+  const overrides = [];
+  let appServer = false;
+  for (let index = 1; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "-c" || arg === "--config") {
+      overrides.push(args[++index] ?? "");
+    } else if (arg.startsWith("--config=")) overrides.push(arg.slice(9));
+    else if (arg === "app-server") appServer = true;
+    else if (!arg.startsWith("-") && !appServer) return null;
+  }
+  if (!appServer) return null;
+  const candidates = [];
+  for (const override of overrides) {
+    const match = override.match(/^mcp_servers\.codex_app\s*=\s*([\s\S]+)$/);
+    if (!match) continue;
+    const config = inlineTableValues(match[1]);
+    if (!config) return null;
+    const env = inlineTableValues(config.get("env") ?? "{}");
+    if (!env) return null;
+    const raw = env.get("CODEX_APP_TOOLS_PIPE_PATH");
+    if (raw === undefined) continue;
+    let candidate;
+    try {
+      candidate = raw.startsWith('"') ? JSON.parse(raw) : /^'[^']*'$/.test(raw) ? raw.slice(1, -1) : null;
+    } catch {
+      return null;
+    }
+    if (typeof candidate !== "string" || /[\r\n\0]/.test(candidate)) return null;
+    if (platform === "win32" ? !/^\\\\\.\\pipe\\[^\\]/i.test(candidate) : !path.posix.isAbsolute(candidate)) return null;
+    candidates.push(candidate);
+  }
+  return candidates.length && new Set(candidates).size === 1 ? candidates[0] : null;
+}
+
+async function readParentCommandLine(parentPid, platform) {
+  if (!Number.isSafeInteger(parentPid) || parentPid <= 0) return null;
+  const options = { timeout: 5000, maxBuffer: 128 * 1024, windowsHide: true };
+  if (platform === "win32") {
+    const powershell = path.win32.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    const script = `$p=Get-CimInstance Win32_Process -Filter 'ProcessId=${parentPid}'; if ($p.Name -eq 'codex.exe') { $p.CommandLine | ConvertTo-Json -Compress }`;
+    const { stdout } = await execFileAsync(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], options);
+    return stdout.trim() ? JSON.parse(stdout.trim()) : null;
+  }
+  const { stdout } = await execFileAsync("/bin/ps", ["-ww", "-p", String(parentPid), "-o", "args="], options);
+  return stdout.trim();
+}
+
+export async function resolveNativeToolsPipePath({
+  env = process.env,
+  parentPid = process.ppid,
+  platform = process.platform,
+  readParentCommandLine: readParent = readParentCommandLine,
+} = {}) {
+  if (env.CODEX_APP_TOOLS_PIPE_PATH) return env.CODEX_APP_TOOLS_PIPE_PATH;
+  try {
+    return nativeToolsPipeFromCommandLine(await readParent(parentPid, platform), { platform });
+  } catch {
+    return null;
+  }
+}
+
 export class NativeToolsClient {
-  constructor({ env = process.env, socketPath = env.CODEX_APP_TOOLS_PIPE_PATH, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  constructor({ env = process.env, socketPath = env.CODEX_APP_TOOLS_PIPE_PATH, timeoutMs = DEFAULT_TIMEOUT_MS, resolveSocketPath = () => resolveNativeToolsPipePath({ env }) } = {}) {
     this.env = env;
     this.socketPath = socketPath;
     this.timeoutMs = timeoutMs;
+    this.resolveSocketPath = resolveSocketPath;
     this.socket = null;
     this.connectingSocket = null;
     this.connecting = null;
+    this.connectionGeneration = 0;
     this.pending = new Map();
     this.nextId = 1;
   }
@@ -154,10 +310,17 @@ export class NativeToolsClient {
   async connect() {
     if (this.connecting) return this.connecting;
     if (this.socket && !this.socket.destroyed) return;
-    if (!this.socketPath) {
-      throw new NativeRelayError("CODEX_APP_TOOLS_PIPE_PATH is missing; launch the companion from Codex Desktop", "NATIVE_PIPE_UNAVAILABLE");
-    }
-    this.connecting = new Promise((resolve, reject) => {
+    const generation = this.connectionGeneration;
+    this.connecting = (async () => {
+      const socketPath = this.socketPath || await this.resolveSocketPath();
+      if (generation !== this.connectionGeneration) {
+        throw new NativeRelayError("Native tools client closed while discovering the Desktop pipe", "NATIVE_PIPE_UNAVAILABLE");
+      }
+      this.socketPath = socketPath;
+      if (!this.socketPath) {
+        throw new NativeRelayError("CODEX_APP_TOOLS_PIPE_PATH is missing from the environment and parent Desktop app-server configuration; launch the companion from Codex Desktop", "NATIVE_PIPE_UNAVAILABLE");
+      }
+      return new Promise((resolve, reject) => {
       const socket = net.connect({ path: this.socketPath });
       this.connectingSocket = socket;
       let buffer = Buffer.alloc(0);
@@ -215,7 +378,8 @@ export class NativeToolsClient {
       });
       socket.on("error", (err) => fail(new NativeRelayError(`Codex Desktop native pipe failed: ${err.message}`, connected ? "NATIVE_DELIVERY_UNCONFIRMED" : "NATIVE_PIPE_UNAVAILABLE")));
       socket.on("close", () => fail(new NativeRelayError("Codex Desktop native tools pipe closed before confirming delivery", connected ? "NATIVE_DELIVERY_UNCONFIRMED" : "NATIVE_PIPE_UNAVAILABLE")));
-    });
+      });
+    })();
     try {
       await this.connecting;
     } finally {
@@ -264,6 +428,7 @@ export class NativeToolsClient {
   }
 
   close() {
+    this.connectionGeneration++;
     const socket = this.socket;
     this.socket = null;
     for (const pending of this.pending.values()) {

package/src/peer-protocol.mjs

@@ -21,7 +21,7 @@ const SOCKET_DIR = "/tmp/cc-socks";
  * directory to create, no mode to chmod and no file to unlink beforehand.
  */
 function peerSocketPath(pid) {
-  return IS_WINDOWS ? `\\\\.\\pipe\\LOCAL\\cc-peer-${pid}` : path.join(SOCKET_DIR, `${pid}.sock`);
+  return IS_WINDOWS ? `\\\\.\\pipe\\LOCAL\\cc-msg-${crypto.randomBytes(16).toString("hex")}` : path.join(SOCKET_DIR, `${pid}.sock`);
 }
 const PEER_PROTOCOL_VERSION = 1;
 const CLAUDE_VERSION_HINT = "2.1.229";
@@ -35,32 +35,78 @@ const projectsDir = () => path.join(homeDir(), ".claude", "projects");
  * listens for peer messages on a local socket or Windows named pipe. Messages are newline-delimited
  * JSON; the wrapper element is what Claude renders in its chat surface.
  */
-export function buildFrame({ text, fromSocket, priority = "next" }) {
+export function buildFrame({ text, fromSocket, priority = "next", permissionMode }) {
+  const msgId = crypto.randomUUID();
+  const from = `uds:${fromSocket.replace(/[^A-Za-z0-9:_/.\-]/gu, (character) => Array.from(Buffer.from(character), (byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""))}`;
+  const mode = ["bypass", "prompting"].includes(permissionMode) ? ` from-mode="${permissionMode}"` : "";
   return {
     msgV: PEER_PROTOCOL_VERSION,
-    msg_id: crypto.randomUUID(),
+    msg_id: msgId,
+    uuid: msgId,
     type: "user",
     message: {
       role: "user",
-      content: `<cross-session-message from="uds:${fromSocket}" from-mode="bypass">\n${text}\n</cross-session-message>`,
+      content: `<cross-session-message from="${from}"${mode}>\n${text}\n</cross-session-message>`,
     },
     priority,
-    from: `uds:${fromSocket}`,
+    from,
   };
 }
 
 export function parseFrame(line) {
   const frame = JSON.parse(line);
+  if (frame?.type !== "user" || typeof frame.message?.content !== "string") return null;
   const raw = frame?.message?.content ?? "";
   const inner = raw.match(/<cross-session-message[^>]*>\n?([\s\S]*?)\n?<\/cross-session-message>/);
   return {
     msgId: frame.msg_id ?? null,
     from: frame.from ?? null,
-    fromSocket: (frame.from ?? "").replace(/^uds:/, "") || null,
+    fromSocket: decodePeerAddress(frame.from),
     text: (inner ? inner[1] : raw).trim(),
   };
 }
 
+function decodePeerAddress(from) {
+  if (typeof from !== "string" || !from.startsWith("uds:")) return null;
+  try { return decodeURIComponent(from.slice(4)) || null; }
+  catch { return null; }
+}
+
+export function peerKeyPath(pid, socket) {
+  const pipe = /^[\\/]{2}[.?][\\/]pipe[\\/](?:(LOCAL)[\\/])?([^\\/]+)$/i.exec(socket);
+  let canonical;
+  if (pipe && !/[. ]$/.test(pipe[2]) && ![".", ".."].includes(pipe[2])) {
+    canonical = `\\\\.\\pipe\\${pipe[1] ? "local\\" : ""}${pipe[2].replace(/[A-Z]/g, (letter) => letter.toLowerCase())}`;
+  } else if (!IS_WINDOWS && path.isAbsolute(socket)) {
+    canonical = path.resolve(socket);
+  } else {
+    throw new Error("Refusing a non-local or non-canonical peer socket");
+  }
+  return path.join(sessionsDir(), `${pid}.${crypto.createHash("sha256").update(canonical).digest("hex")}.key`);
+}
+
+function readPeerToken(socket) {
+  peerKeyPath(process.pid, socket);
+  const candidates = listClaudeSessions({ includeBridges: true }).filter((entry) => {
+    try { return peerKeyPath(entry.pid, entry.socket) === peerKeyPath(entry.pid, socket); }
+    catch { return false; }
+  });
+  if (candidates.length !== 1) {
+    if (IS_WINDOWS) throw new Error("No unique live session owns the destination inbox; message was not sent");
+    return null;
+  }
+  try {
+    const key = JSON.parse(fs.readFileSync(peerKeyPath(candidates[0].pid, socket), "utf8"));
+    if (typeof key.peerToken !== "string" || !/^[0-9a-f]{32}$/i.test(key.peerToken)) throw new Error("Invalid peer key");
+    const identity = IS_WINDOWS ? key.procStartFt : key.procStart;
+    if (identity && identity !== readProcessStart(candidates[0].pid)) throw new Error("Peer process identity changed");
+    return key.peerToken;
+  } catch {
+    if (IS_WINDOWS) throw new Error("The destination inbox authentication key is missing or invalid; message was not sent");
+    return null;
+  }
+}
+
 /**
  * MCP servers are spawned with an empty PATH, so `ps` must be addressed by its
  * absolute path - a bare lookup throws ENOENT and takes the whole server down
@@ -69,7 +115,11 @@ export function parseFrame(line) {
  */
 function readProcessStart(pid) {
   try {
-    return execFileSync(PS_BIN, ["-o", "lstart=", "-p", String(pid)]).toString().trim();
+    if (IS_WINDOWS) {
+      const shell = path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+      return execFileSync(shell, ["-NoProfile", "-Command", `(Get-Process -Id ${Number(pid)}).StartTime.ToUniversalTime().ToFileTimeUtc().ToString()`], { timeout: 3000, windowsHide: true }).toString().trim();
+    }
+    return execFileSync(PS_BIN, ["-o", "lstart=", "-p", String(pid)], { env: { ...process.env, LC_ALL: "C", TZ: "UTC" }, timeout: 3000 }).toString().trim();
   } catch {
     return "";
   }
@@ -195,6 +245,29 @@ export function readTranscript(sessionId, cwd, limit = 10) {
   return { file, messages: messages.slice(-limit) };
 }
 
+export function readTranscriptReply(sessionId, cwd, msgId) {
+  const file = findTranscriptFile(sessionId, cwd);
+  let lines;
+  try { lines = fs.readFileSync(file, "utf8").split("\n"); }
+  catch { return null; }
+  const descendants = new Set();
+  for (const line of lines) {
+    let entry;
+    try { entry = JSON.parse(line); } catch { continue; }
+    if (entry.isSidechain) continue;
+    if (entry.uuid === msgId && entry.message?.role === "user") { descendants.add(msgId); continue; }
+    if (!descendants.has(entry.parentUuid)) continue;
+    const role = entry.message?.role;
+    const content = entry.message?.content;
+    if (role === "user" && !(Array.isArray(content) && content.every((part) => part.type === "tool_result"))) continue;
+    if (typeof entry.uuid === "string") descendants.add(entry.uuid);
+    if (role !== "assistant" || !["end_turn", "stop_sequence"].includes(entry.message.stop_reason)) continue;
+    const text = Array.isArray(content) ? content.filter((part) => part.type === "text").map((part) => part.text ?? "").join("\n") : String(content ?? "");
+    if (text.trim()) return { text: text.trim(), msgId: entry.uuid, source: "transcript", inReplyTo: msgId };
+  }
+  return null;
+}
+
 /**
  * Registers this process as a peer that Claude sessions can see in their agent
  * list and reply to. Without a registered socket, Claude has no address to
@@ -216,6 +289,11 @@ export class PeerEndpoint {
     this.requestQueues = new Map();
     this.unconfirmedReplies = new Map();
     this.started = false;
+    this.peerToken = null;
+    this.permissionMode = process.env.CLAUDE_BRIDGE_PERMISSION_MODE;
+    this.deliveryReceipts = new Map();
+    this.pendingMessages = new Map();
+    this.responsePoll = null;
   }
 
   /**
@@ -250,8 +328,8 @@ export class PeerEndpoint {
     this.#sweepDeadBridges();
     const procStart = readProcessStart(this.pid);
     const peerToken = crypto.randomBytes(16).toString("hex");
-    const keyHash = crypto.createHash("sha256").update(`${peerToken}${procStart}`).digest("hex");
-    this.keyPath = path.join(sessionsDir(), `${this.pid}.${keyHash}.key`);
+    this.peerToken = peerToken;
+    this.keyPath = peerKeyPath(this.pid, this.socketPath);
 
     if (!IS_WINDOWS) fs.mkdirSync(SOCKET_DIR, { recursive: true });
     fs.mkdirSync(sessionsDir(), { recursive: true });
@@ -264,12 +342,13 @@ export class PeerEndpoint {
     });
     if (!IS_WINDOWS) fs.chmodSync(this.socketPath, 0o600);
 
+    const processIdentity = procStart ? (IS_WINDOWS ? { procStartFt: procStart } : { procStart }) : {};
     this.registry = {
       pid: this.pid,
       sessionId: crypto.randomUUID(),
       cwd: this.cwd,
       startedAt: Date.now(),
-      procStart,
+      ...processIdentity,
       version: CLAUDE_VERSION_HINT,
       peerProtocol: PEER_PROTOCOL_VERSION,
       kind: "interactive",
@@ -279,7 +358,7 @@ export class PeerEndpoint {
       nameSource: "derived",
     };
     fs.writeFileSync(this.registryPath, JSON.stringify(this.registry), { mode: 0o600 });
-    fs.writeFileSync(this.keyPath, JSON.stringify({ peerToken, procStart }), { mode: 0o600 });
+    fs.writeFileSync(this.keyPath, JSON.stringify({ peerToken, ...processIdentity }), { mode: 0o600 });
 
     for (const signal of ["SIGINT", "SIGTERM"]) {
       process.on(signal, () => {
@@ -295,37 +374,91 @@ export class PeerEndpoint {
 
   #handleConnection(socket) {
     let buffer = "";
+    let authenticated = false;
+    let firstLine = true;
     socket.setEncoding("utf8");
     socket.on("data", (chunk) => {
       buffer += chunk;
+      if (buffer.length > 1048576) { socket.destroy(); return; }
       let index;
       while ((index = buffer.indexOf("\n")) >= 0) {
         const line = buffer.slice(0, index).trim();
         buffer = buffer.slice(index + 1);
-        if (!line) continue;
+        if (!line) {
+          if (IS_WINDOWS && !authenticated) { socket.destroy(); return; }
+          continue;
+        }
         let message;
         try {
+          const frame = JSON.parse(line);
+          if (firstLine && frame?.type === "auth") {
+            firstLine = false;
+            const supplied = typeof frame.token === "string" ? Buffer.from(frame.token) : Buffer.alloc(0);
+            const expected = Buffer.from(this.peerToken ?? "");
+            authenticated = expected.length > 0 && supplied.length === expected.length && crypto.timingSafeEqual(supplied, expected);
+            if (!authenticated) { socket.destroy(); return; }
+            continue;
+          }
+          firstLine = false;
+          if (IS_WINDOWS && !authenticated) { socket.destroy(); return; }
+          if (frame?.type === "control" && frame.action === "peer_message_status") {
+            if (typeof frame.orig_msg_id === "string" && typeof frame.from === "string") {
+              const receipt = {
+                status: frame.status_detail === "refused" ? "refused" : frame.status,
+                reason: typeof frame.reason === "string" ? frame.reason : "",
+                fromSocket: decodePeerAddress(frame.from),
+              };
+              const pending = this.pendingMessages.get(frame.orig_msg_id);
+              if (pending?.targetSocket === receipt.fromSocket) {
+                this.deliveryReceipts.set(frame.orig_msg_id, receipt);
+                if (["refused", "denied", "expired", "dropped"].includes(receipt.status)) this.#removePendingReply(receipt.fromSocket, frame.orig_msg_id);
+              }
+            }
+            continue;
+          }
           message = parseFrame(line);
         } catch {
-          this.log(`ignored malformed peer frame (${line.slice(0, 80)})`);
+          if (IS_WINDOWS && !authenticated) { socket.destroy(); return; }
+          this.log("ignored malformed peer frame");
           continue;
         }
-        const record = { ...message, receivedAt: Date.now(), sequence: ++this.messageSequence };
-        this.inbox.push(record);
-        this.#removePendingReply(record.fromSocket);
-        this.log(`inbox <- ${record.fromSocket ?? "?"}: ${record.text.slice(0, 120)}`);
-        for (const listener of [...this.listeners]) {
-          try {
-            listener(record);
-          } catch (err) {
-            this.log(`peer listener error: ${err.message}`);
-          }
-        }
+        if (!message) continue;
+        this.#receiveMessage(message);
       }
     });
     socket.on("error", (err) => this.log(`peer socket error: ${err.message}`));
   }
 
+  #receiveMessage(message) {
+    const record = { ...message, receivedAt: Date.now(), sequence: ++this.messageSequence };
+    this.inbox.push(record);
+    this.#removePendingReply(record.fromSocket, record.inReplyTo);
+    this.log(`inbox <- ${record.fromSocket ?? "?"}: ${record.text.slice(0, 120)}`);
+    for (const listener of [...this.listeners]) {
+      try { listener(record); }
+      catch (err) { this.log(`peer listener error: ${err.message}`); }
+    }
+  }
+
+  #refreshTranscriptReplies() {
+    for (const [msgId, pending] of this.pendingMessages) {
+      if (!pending.transcriptSession) continue;
+      const { sessionId, cwd } = pending.transcriptSession;
+      const file = findTranscriptFile(sessionId, cwd);
+      let stamp;
+      try { const stat = fs.statSync(file); stamp = `${stat.mtimeMs}:${stat.size}`; }
+      catch { continue; }
+      if (stamp === pending.transcriptStamp) continue;
+      pending.transcriptStamp = stamp;
+      const reply = readTranscriptReply(sessionId, cwd, msgId);
+      if (reply) this.#receiveMessage({ ...reply, fromSocket: pending.targetSocket });
+    }
+    if (![...this.pendingMessages.values()].some((entry) => entry.transcriptSession)) {
+      globalThis.clearInterval(this.responsePoll);
+      this.responsePoll = null;
+    }
+  }
+
   /**
    * Codex starts one bridge per session, so several peers advertise at once.
    * Renaming to the bound thread is what lets a human tell them apart in
@@ -347,9 +480,11 @@ export class PeerEndpoint {
     return () => this.listeners.delete(listener);
   }
 
-  async send(targetSocket, text, { priority = "next" } = {}) {
-    const frame = buildFrame({ text, fromSocket: this.socketPath, priority });
-    const line = JSON.stringify(frame) + "\n";
+  async send(targetSocket, text, { priority = "next", msgId } = {}) {
+    const frame = buildFrame({ text, fromSocket: this.socketPath, priority, permissionMode: this.permissionMode });
+    if (msgId) frame.uuid = frame.msg_id = msgId;
+    const token = readPeerToken(targetSocket);
+    const line = (token ? JSON.stringify({ type: "auth", token }) + "\n" : "") + JSON.stringify(frame) + "\n";
     for (let attempt = 1; attempt <= PEER_SEND_ATTEMPTS; attempt += 1) {
       try {
         await new Promise((resolve, reject) => {
@@ -399,7 +534,7 @@ export class PeerEndpoint {
     return frame.msg_id;
   }
 
-  async sendAndWait(targetSocket, text, { timeoutMs = 120000, priority = "next" } = {}) {
+  async sendAndWait(targetSocket, text, { timeoutMs = 120000, priority = "next", transcriptSession } = {}) {
     const previous = this.requestQueues.get(targetSocket) ?? Promise.resolve();
     const pending = previous.catch(() => {}).then(async () => {
       const unconfirmed = this.unconfirmedReplies.get(targetSocket) ?? 0;
@@ -414,16 +549,29 @@ export class PeerEndpoint {
       const since = Date.now();
       const afterSequence = this.messageSequence;
       this.unconfirmedReplies.set(targetSocket, unconfirmed + 1);
-      let msgId;
+      let msgId = crypto.randomUUID();
+      this.pendingMessages.set(msgId, { targetSocket, transcriptSession });
       try {
-        msgId = await this.send(targetSocket, text, { priority });
+        const sentId = await this.send(targetSocket, text, { priority, msgId });
+        if (sentId !== msgId) {
+          const pendingMessage = this.pendingMessages.get(msgId);
+          this.pendingMessages.delete(msgId);
+          msgId = sentId;
+          if (pendingMessage) this.pendingMessages.set(msgId, pendingMessage);
+        }
       } catch (err) {
-        this.#removePendingReply(targetSocket);
+        this.#removePendingReply(targetSocket, msgId);
         throw err;
       }
+      if (transcriptSession && !this.responsePoll && this.pendingMessages.has(msgId)) {
+        this.responsePoll = globalThis.setInterval(() => this.#refreshTranscriptReplies(), 250);
+        this.responsePoll.unref();
+      }
       const reply = timeoutMs > 0
-        ? await this.waitForReply(targetSocket, { timeoutMs, since, afterSequence })
+        ? await this.waitForReply(targetSocket, { timeoutMs, since, afterSequence, msgId })
         : null;
+      const delivery = this.deliveryReceipts.get(msgId);
+      if (delivery?.fromSocket === targetSocket) return { msgId, reply, delivery };
       return { msgId, reply };
     });
     this.requestQueues.set(targetSocket, pending);
@@ -434,7 +582,9 @@ export class PeerEndpoint {
     }
   }
 
-  #removePendingReply(fromSocket) {
+  #removePendingReply(fromSocket, msgId) {
+    const key = msgId ?? [...this.pendingMessages].find(([, entry]) => entry.targetSocket === fromSocket)?.[0];
+    if (key) this.pendingMessages.delete(key);
     const pending = this.unconfirmedReplies.get(fromSocket) ?? 0;
     if (pending > 1) this.unconfirmedReplies.set(fromSocket, pending - 1);
     else this.unconfirmedReplies.delete(fromSocket);
@@ -444,22 +594,27 @@ export class PeerEndpoint {
    * Claude answers with a fresh msg_id rather than an in-reply-to field, so a
    * reply is matched by origin socket and arrival time.
    */
-  waitForReply(fromSocket, { timeoutMs = 120000, since = Date.now(), afterSequence = null } = {}) {
+  waitForReply(fromSocket, { timeoutMs = 120000, since = Date.now(), afterSequence = null, msgId } = {}) {
     const matches = (record) => record.fromSocket === fromSocket
       && (afterSequence === null ? record.receivedAt >= since : record.sequence > afterSequence);
     const existing = this.inbox.find(matches);
     if (existing) return Promise.resolve(existing);
     return new Promise((resolve) => {
-      const timer = globalThis.setTimeout(() => {
+      const finish = (reply) => {
         unsubscribe();
-        resolve(null);
-      }, timeoutMs);
+        globalThis.clearTimeout(timer);
+        globalThis.clearInterval(poll);
+        resolve(reply);
+      };
+      const timer = globalThis.setTimeout(() => finish(null), timeoutMs);
       const unsubscribe = this.onMessage((record) => {
         if (!matches(record)) return;
-        globalThis.clearTimeout(timer);
-        unsubscribe();
-        resolve(record);
+        finish(record);
       });
+      const poll = msgId ? globalThis.setInterval(() => {
+        const receipt = this.deliveryReceipts.get(msgId);
+        if (receipt?.fromSocket === fromSocket && ["held", "refused", "denied", "expired", "dropped"].includes(receipt.status)) { finish(null); return; }
+      }, 250) : null;
     });
   }
 
@@ -470,6 +625,9 @@ export class PeerEndpoint {
   }
 
   stop() {
+    globalThis.clearInterval(this.responsePoll);
+    this.responsePoll = null;
+    this.pendingMessages.clear();
     try {
       this.server?.close();
     } catch {}