@minhspark/codex-mcp-bridge 1.13.6 → 1.13.7

package/CHANGELOG.md

@@ -4,6 +4,25 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.13.7] - 2026-09-07
+
+### Fixed
+
+- Correlate a Desktop reply to a message that arrived while the recipient was mid-turn. Claude Code absorbs such a message into the running turn and records it as a `queued_command` attachment whose `source_uuid` is the message id, under a fresh uuid; only the idle shape (a user entry whose uuid is the message id) was recognised, so the reply appeared in the app while the bridge reported `reply_timeout` and kept the message pending. Both shapes now resolve to the turn's closing text. A reply taken from an absorbed turn is marked `replyAbsorbed: true` in receipts, the tool result says so, and the text forwarded to Codex carries the same note, because that closing text may not address the message.
+- Detect a Claude Desktop task record rewritten during inspection by comparing its bytes, not only its stat fields. A same-size rewrite inside one filesystem timestamp tick (about 16 ms on Windows) left size, times and inode unchanged, so the replace-detection test failed intermittently on Windows CI and the guard could miss such a replacement.
+
+### Added
+
+- Read the recipient session's effective `crossSessionInbound` (managed, user, project, and local settings with Claude's tightening precedence) and refuse a send at preflight with `CLAUDE_RECIPIENT_INBOUND_POLICY` when it is `refuse` or `hold`; an explicit `accept` sends without a class check. Otherwise read the recipient task's permission mode from Claude Desktop metadata, report it with its Claude parity class in `list_claude_sessions`, and refuse with `CLAUDE_RECIPIENT_CLASS_MISMATCH` when that class differs from the verified sender class, naming both classes and the user-only remedies on either side, since Claude Desktop cannot show the approval dialog such a hold would need. Both checks repeat before writing; an unknown mode leaves the decision to Claude. Only a plain alphabetic mode value is exposed. Receipts carry `senderApprovalPolicy`, `recipientPermissionMode`, `recipientPermissionClass`, and `recipientInboundPolicy`, and a held receipt names both classes.
+
+### Changed
+
+- Document Claude's symmetric inbound parity: a prompting-class Desktop recipient holds a `bypass` sender just as a bypassing recipient holds a `prompting` one, so a `held` receipt means the two tasks run in different permission classes and only the user can align them, by running the recipient in the matching class or setting `crossSessionInbound` to `accept` there. The bridge never adjusts the attested class. Describe `node_repl_auto_review_required` as the per-model catalog attribute observed live alongside a user reviewer, note that `auto_review_enabled: true` with a user reviewer is unobserved, and pin the held-receipt wording in the tool contract test.
+
+### Upgrade notes
+
+- Reconnect the MCP connections in both Desktop clients after upgrading; a bridge process started before this version reports stale source and refuses new sends once the files change.
+
 ## [1.13.6] - 2026-09-06
 
 ### Fixed

package/README.md

@@ -392,7 +392,7 @@ Desktop task mode (`CODEX_BRIDGE_DESKTOP_TASKS=1` or the shared setting written
 
 `claude_bridge_status` reports the destination policy, eligible session count, and excluded non-Desktop count. Send receipts include the destination's `entrypoint`, `cwd`, and `sessionId`. A correlated reply confirms receipt in that session; it does not independently prove that its conversation is visible in the Desktop UI. Desktop sends require `expectedCwd`, an absolute independently verified project directory. The bridge resolves both paths and refuses a missing, nonexistent, parent, or different directory before sending; it rechecks the destination after queueing. Reconnect the bridge's MCP connection after upgrading to load the enforcement code.
 
-Desktop session discovery includes the native task title and task ID, matched through Claude Desktop's local session metadata. Use `list_claude_sessions({expectedCwd})` for the intended project; an empty result is not permission to substitute a different project. Sending additionally requires `expectedTaskId` from the intended task, alongside `target` and `expectedCwd`. The bridge verifies the exact CLI session ID, unique native task ID, canonical cwd, archive state, optional bridge ID, and live process start identity. It repeats these checks at dispatch. Missing, stale, ambiguous, or unreadable metadata blocks the send rather than guessing from a generated name such as `pcc4sh-19`.
+Desktop session discovery includes the native task title and task ID, matched through Claude Desktop's local session metadata. Use `list_claude_sessions({expectedCwd})` for the intended project; an empty result is not permission to substitute a different project. Sending additionally requires `expectedTaskId` from the intended task, alongside `target` and `expectedCwd`. The bridge verifies the exact CLI session ID, unique native task ID, canonical cwd, archive state, optional bridge ID, and live process start identity. It repeats these checks at dispatch. Missing, stale, ambiguous, or unreadable metadata blocks the send rather than guessing from a generated name such as `pcc4sh-19`. Each matched Desktop row also reports the task's permission mode from that metadata and its Claude parity class (`bypass` for `bypassPermissions`; `prompting` for `default`, `acceptEdits`, `auto`, and `dontAsk`; no class for `plan` or an unknown value).
 
 A `held` receipt confirms only that the recipient has withheld a message. It does not prove an approval button is available in Claude Desktop. Inspect that exact task before directing the user to approve; when the UI offers no approval route, preserve the receipt and report the boundary. A preflight failure is distinct: it returns `sent: false` and no message ID, so nothing was submitted to the recipient.
 
@@ -400,13 +400,13 @@ Sends to the same Claude session run in order. An outstanding message blocks all
 
 Both bridge status tools report the loaded source fingerprint and process identity. Source or Desktop-routing configuration changes make the running process stale and block new sends until reconnect, while Claude inbox/receipt reads remain available. This guard applies only after the version containing it has loaded; upgrading files cannot retrofit the guard into an older process already running.
 
-Claude's [inbound permission controls](https://code.claude.com/docs/en/cross-session-messaging#control-inbound-messages) remain authoritative. A missing or mismatched sender permission class makes a bypassing recipient hold the message. Claude Desktop does not declare the `peer_inbound_approval` dialog kind to Claude Code, so a message held by a Desktop-hosted session has no approval button there; Claude Code keeps it until `dialogExpiry` (five minutes by default) and then reports it as expired. A hold in Desktop mode is therefore a sender-classification problem to fix at the sender, never a prompt to wait for. Do not change `CLAUDE_BRIDGE_PERMISSION_MODE` or recipient settings merely to bypass a hold/refusal. Legacy CLI configuration must truthfully represent every session using that MCP entry; Desktop sends derive their class from the verified calling turn. If the Desktop UI does not expose the pending approval, report that boundary and keep the original receipt rather than creating a CLI session.
+Claude's [inbound permission controls](https://code.claude.com/docs/en/cross-session-messaging#control-inbound-messages) remain authoritative, and their default rule is symmetric: when no `crossSessionInbound` value applies, a message is delivered only when the sender's attested class matches the recipient's. A recipient that bypasses permission prompts holds every sender that does not attest `bypass`; a recipient that prompts (default, `acceptEdits`, `auto`, `dontAsk`) holds every sender that attests `bypass`. The bridge attests the sender's true class from the verified Codex turn and never adjusts it to suit a recipient. Claude Desktop does not declare the `peer_inbound_approval` dialog kind to Claude Code, so a message held by a Desktop-hosted session has no approval button there; Claude Code keeps it until `dialogExpiry` (five minutes by default) and then reports it as expired. A `held` receipt in Desktop mode therefore means the two tasks run in different permission classes, not that the sender was misread. Report that to the user: only they can run the recipient task in the matching class or set `crossSessionInbound` to `accept` in that session's own settings. Because that outcome is predictable, `send_to_claude_session` first reads the recipient session's effective `crossSessionInbound` from the same files Claude Desktop loads (managed settings, then the user's `~/.claude/settings.json`, with the recipient project's `.claude/settings.json` and `settings.local.json` able only to tighten it) and refuses at preflight with `CLAUDE_RECIPIENT_INBOUND_POLICY` when that value is `refuse` or `hold`, since nothing could reach Claude or be approved. An explicit `accept` sends without a class check, because Claude delivers regardless of class. Otherwise the parity default applies: the recipient task's permission mode from Claude Desktop metadata is compared with the verified sender class and a mismatch is refused with `CLAUDE_RECIPIENT_CLASS_MISMATCH`, naming both classes and the user-only remedies on either side; both checks repeat immediately before writing. A task whose mode is unknown is sent as before and Claude decides. Flags passed at launch such as `--settings` are invisible to the bridge, so put the value in a settings file. `list_claude_sessions` shows an explicit inbound value with its source, and receipts carry `senderApprovalPolicy`, `recipientPermissionMode`, `recipientPermissionClass`, and `recipientInboundPolicy`; a held receipt repeats both classes. Do not change `CLAUDE_BRIDGE_PERMISSION_MODE`, fabricate a sender class, or edit recipient settings on the user's behalf. Legacy CLI configuration must truthfully represent every session using that MCP entry; Desktop sends derive their class from the verified calling turn. If the Desktop UI does not expose the pending approval, keep the original receipt rather than creating a CLI session.
 
-Claude Desktop disables the CLI-native `SendMessage` tool. For Desktop targets, the bridge requests an ordinary answer in the destination conversation and reads only a completed assistant turn descended from the injected message UUID. Unrelated human prompts and sidechains are excluded. Late answers remain available through the inbox while the bridge process is running. This does not change Desktop tool permissions or the receiver's inbound policy.
+Claude Desktop disables the CLI-native `SendMessage` tool. For Desktop targets, the bridge requests an ordinary answer in the destination conversation and reads only a completed assistant turn descended from the transcript entry that records the injected message. Unrelated human prompts and sidechains are excluded. Late answers remain available through the inbox while the bridge process is running. This does not change Desktop tool permissions or the receiver's inbound policy. Claude Code records the injected message in one of two shapes: an idle recipient starts a new turn with a user entry whose uuid is the message id, while a busy recipient absorbs the message into its running turn as a `queued_command` attachment whose `source_uuid` is the message id, and that turn's closing text is the reply. Both shapes are recognised; before 1.13.7 only the idle one was, so a reply to an absorbed message was visible in the app yet reported as `reply_timeout` with the message still pending. A reply taken from an absorbed turn is that turn's closing text, which may not address the message, so the receipt marks it `replyAbsorbed: true`, the tool result says so, and the text forwarded to Codex carries the same note.
 
 In Desktop-only mode, the sender is resolved separately for every MCP call. Codex supplies `x-codex-turn-metadata` with the calling task and turn IDs; the bridge matches them to one active, local Codex Desktop rollout and reads its effective permission profile and approval settings. The diagnostic `sandbox_mode` label is never used to authorize a send. Missing or invalid host review flags, a completed or superseded turn, or an unsupported permission profile blocks sending before any message bytes are written. Status distinguishes enabled, disabled, missing, and invalid review flags. Do not supply fabricated MCP metadata or use another process to make a blocked send succeed.
 
-Only an explicitly disabled permission profile with a matching full-access sandbox and user approval reviewer is supported. With `approval_policy: never` it maps to `bypass`; with `on-request`, `on-failure`, or `untrusted` it maps to `prompting`. The class answers the question Claude's parity gate asks, whether a human still prompts the sender, so Codex's two host review flags never change it: `node_repl_auto_review_required` is a model catalog requirement (Codex refuses such a model without auto review) and `auto_review_enabled` names an automated Guardian reviewer; neither adds a human prompt. Both flags must still be present as booleans and are reported in status and preserved in receipts as evidence. Other profiles remain unsupported and fail closed. The receiver may still require approval for a prompting sender. The context, approval policy, and review flags are checked again before each connection attempt and immediately before writing, so queued messages cannot inherit another turn's permissions.
+Only an explicitly disabled permission profile with a matching full-access sandbox and user approval reviewer is supported. With `approval_policy: never` it maps to `bypass`; with `on-request`, `on-failure`, or `untrusted` it maps to `prompting`. The class answers the question Claude's parity gate asks, whether a human still prompts the sender, so Codex's two host review flags never change it: `node_repl_auto_review_required` is a per-model catalog attribute that Codex Desktop derives from `autoReview.requiredOnModels`, describing automated review of Node REPL code, and `auto_review_enabled` names an automated Guardian reviewer; neither adds a human prompt. The live `gpt-6-astra` task carried `node_repl_auto_review_required: true` together with `approvals_reviewer: user` and `auto_review_enabled: false`, and its messages are delivered to a bypassing Claude Desktop task. `auto_review_enabled: true` alongside a user reviewer has not been observed; the class still follows `approval_policy` there. Both flags must still be present as booleans and are reported in status and preserved in receipts as evidence. Other profiles remain unsupported and fail closed. The receiver may still require approval for a prompting sender. The context, approval policy, and review flags are checked again before each connection attempt and immediately before writing, so queued messages cannot inherit another turn's permissions.
 
 `CLAUDE_BRIDGE_PERMISSION_MODE` remains a legacy CLI setting and is ignored for Desktop sends. A manually bound relay task is not proof of the sender's identity. Correlated Desktop replies retain the original sending task ID even if the relay binding later changes.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.13.6",
+  "version": "1.13.7",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/scripts/install-native-relay.mjs

@@ -20,7 +20,7 @@ import { exitForVersionRequest } from "../src/cli-version.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.13.6";
+const VERSION = "1.13.7";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "native-relay-companion.mjs");
 const serverName = process.env.CODEX_NATIVE_RELAY_NAME ?? "codex-native-relay";

package/src/claude-bridge.mjs

@@ -11,12 +11,14 @@ import { exitForVersionRequest } from "./cli-version.mjs";
 import { desktopTasksConfigured } from "./native-relay.mjs";
 import { createRuntimeState } from "./runtime-state.mjs";
 import { readClaudeDesktopContext } from "./claude-desktop-context.mjs";
+import { readClaudeInboundPolicy } from "./claude-inbound-policy.mjs";
+import { assertRecipientClass, preflightFailure } from "./recipient-preflight.mjs";
 import { readCodexSenderContext } from "./codex-sender-context.mjs";
 import { ReplyForwarder } from "./reply-forwarder.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.13.6";
+const VERSION = "1.13.7";
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;
 
@@ -57,7 +59,7 @@ const replyForwarder = new ReplyForwarder({
       throw Object.assign(new Error("Bridge routing changed; the reply was not forwarded. Inspect the original receipt before reconnecting."), { code: "REPLY_ROUTING_CHANGED" });
     }
   },
-  deliver: (threadId, record) => delivery.deliver(threadId, `[message from Claude session ${record.fromSocket ?? "?"}]\n\n${record.text}`),
+  deliver: (threadId, record) => delivery.deliver(threadId, `[message from Claude session ${record.fromSocket ?? "?"}]\n${record.absorbed ? "[This reply is the closing text of a turn that absorbed the message while it was running; it may not address the message.]\n" : ""}\n${record.text}`),
 });
 
 function readReceipt(msgId) {
@@ -80,19 +82,14 @@ const missingDesktopSession = "No live Claude Desktop session with an exact matc
 
 function formatSessionRow(s) {
   const started = s.startedAt ? new Date(s.startedAt).toISOString().replace("T", " ").slice(0, 16) : "?";
-  const task = s.desktop ? `\n    Desktop task: ${s.desktop.title ?? "unverified"}\n    task ID: ${s.desktop.taskId ?? "unverified"}\n    mapping: ${s.desktop.status}${s.desktop.reason ? ` - ${s.desktop.reason}` : ""}` : "";
+  const permission = s.desktop?.status === "matched" ? `\n    permission: ${s.desktop.permissionMode ?? "unknown"}${s.desktop.permissionClass ? ` (${s.desktop.permissionClass} class)` : ""}${s.inbound?.value ? `\n    inbound: crossSessionInbound ${s.inbound.value} (${s.inbound.source} settings)` : ""}` : "";
+  const task = s.desktop ? `\n    Desktop task: ${s.desktop.title ?? "unverified"}\n    task ID: ${s.desktop.taskId ?? "unverified"}${permission}\n    mapping: ${s.desktop.status}${s.desktop.reason ? ` - ${s.desktop.reason}` : ""}` : "";
   return `- ${s.name ?? "(unnamed)"}  [pid ${s.pid}]\n    session: ${s.sessionId ?? "?"}\n    cwd: ${s.cwd ?? "?"}\n    started: ${started}  kind: ${s.kind ?? "?"}  via: ${s.entrypoint ?? "?"}${task}`;
 }
 
-function preflightFailure(code, reason) {
-  const error = new Error(`${reason} No message was sent.`);
-  error.preflight = { status: "blocked", code, reason, sent: false };
-  return error;
-}
-
 function withDesktopContext(session) {
   return session.entrypoint === "claude-desktop"
-    ? { ...session, desktop: readClaudeDesktopContext(session) } : session;
+    ? { ...session, desktop: readClaudeDesktopContext(session), inbound: readClaudeInboundPolicy(session.cwd) } : session;
 }
 
 function assertDesktopTask(session, expectedTaskId) {
@@ -139,6 +136,7 @@ const server = new McpServer(
       "Read the Desktop task title and task ID as well as the exact project directory and sessionId before sending. " +
       "The host's current MCP turn metadata identifies the sender; unknown or stale permission context blocks sending. " +
       "The sender class follows the verified approval policy; automated review flags are reported but never change it. " +
+      "A Desktop recipient whose settings refuse or hold inbound messages, or whose task metadata shows a different permission class without an explicit accept, is refused before sending, because Claude Desktop cannot show the approval dialog. " +
       "Never launch a CLI session or an external app-server as a substitute. A receipt confirms a reply, not visual verification in the app. " +
       "A held receipt does not prove that Desktop exposes an approval button; verify the UI before asking the user to approve.",
   },
@@ -222,6 +220,7 @@ server.registerTool(
         assertClaudeSessionProcess(session);
       }
       const sender = desktopOnly ? assertSender(extra?._meta) : null;
+      if (desktopOnly) assertRecipientClass(session, sender);
       await peer.start();
 
       const wait = waitSec ?? 180;
@@ -229,7 +228,8 @@ server.registerTool(
       const text = desktop ? `${message}\n\n[Bridge response routing: reply with ordinary text in this conversation. The bridge reads the response associated with this message from the local transcript; no cross-session reply tool is needed.]` : message;
       const { msgId, reply, delivery } = await peer.sendAndWait(session.socket, text, {
         timeoutMs: wait * 1000,
-        ...(sender ? { permissionMode: sender.mode, replyThreadId: sender.threadId, senderReview: sender.review } : {}),
+        ...(sender ? { permissionMode: sender.mode, replyThreadId: sender.threadId, senderReview: sender.review, senderApprovalPolicy: sender.approvalPolicy } : {}),
+        ...(desktop ? { recipient: { permissionMode: session.desktop.permissionMode ?? null, permissionClass: session.desktop.permissionClass ?? null, inboundPolicy: session.inbound?.value ?? null } } : {}),
         beforeSend: () => {
           runtime.assertCurrent();
           const current = findClaudeSession(session.sessionId ?? String(session.pid), { desktopOnly });
@@ -239,25 +239,28 @@ server.registerTool(
           if (desktopOnly || expectedCwd !== undefined) assertClaudeSessionCwd(current, expectedCwd);
           if (desktopOnly) {
             assertClaudeSessionProcess(current);
-            assertDesktopTask(withDesktopContext(current), expectedTaskId);
+            const refreshed = withDesktopContext(current);
+            assertDesktopTask(refreshed, expectedTaskId);
             const active = assertSender(extra?._meta);
             if (active.threadId !== sender.threadId || active.turnId !== sender.turnId || active.cwd !== sender.cwd || active.mode !== sender.mode || active.approvalPolicy !== sender.approvalPolicy || JSON.stringify(active.review) !== JSON.stringify(sender.review)) {
               throw preflightFailure("CODEX_SENDER_CONTEXT_CHANGED", "The sender's active turn or permissions changed while this message was queued.");
             }
+            assertRecipientClass(refreshed, active);
           }
         },
         ...(desktop ? { transcriptSession: session } : {}),
       });
       const status = reply ? "reply_received" : delivery?.status ?? (wait === 0 ? "sent_unconfirmed" : "reply_timeout");
       const receipt = { status, msgId, target: session.name ?? String(session.pid), sessionId: session.sessionId, cwd: session.cwd, entrypoint: session.entrypoint, waitSec: wait,
-        ...(desktop ? { taskId: session.desktop.taskId, title: session.desktop.title, approvalUi: "unverified" } : {}),
-        ...(sender ? { senderMode: sender.mode, senderThreadId: sender.threadId, senderTurnId: sender.turnId, senderReview: sender.review } : {}),
-        ...(reply ? { source: reply.source ?? "peer", forwarding: replyForwarder.read(msgId) ?? reply.forwardingError ?? null } : {}) };
+        ...(desktop ? { taskId: session.desktop.taskId, title: session.desktop.title, approvalUi: "unverified", recipientPermissionMode: session.desktop.permissionMode ?? null, recipientPermissionClass: session.desktop.permissionClass ?? null, recipientInboundPolicy: session.inbound?.value ?? null } : {}),
+        ...(sender ? { senderMode: sender.mode, senderApprovalPolicy: sender.approvalPolicy, senderThreadId: sender.threadId, senderTurnId: sender.turnId, senderReview: sender.review } : {}),
+        ...(reply ? { source: reply.source ?? "peer", ...(reply.absorbed ? { replyAbsorbed: true } : {}), forwarding: replyForwarder.read(msgId) ?? reply.forwardingError ?? null } : {}) };
       const result = (text, isError = false) => ({ ...textResult(text, isError), structuredContent: { receipt } });
       const targetLabel = `${session.desktop?.title ?? session.name ?? session.pid} (pid ${session.pid}, session ${session.sessionId ?? "?"}, via ${session.entrypoint ?? "unknown"}, cwd ${session.cwd ?? "?"})`;
 
       if (!reply && delivery && delivery.status !== "delivered") {
-        return result(`Claude inbox reported ${delivery.status} for ${targetLabel}.\n${delivery.reason}\nMessage id: ${msgId}\nInspect read_claude_delivery with this message ID. Do not resend, change the sender permission class, or alter recipient permissions to bypass this receipt. The approval UI has not been verified; Claude Desktop declares no peer approval dialog, so do not tell the user an approval button exists without inspecting this exact Desktop task.`, true);
+        const classes = desktop && sender ? `Recipient task mode: ${session.desktop.permissionMode ?? "unknown"}${session.desktop.permissionClass ? ` (${session.desktop.permissionClass} class)` : ""}; this sender attested ${sender.mode}.\n` : "";
+        return result(`Claude inbox reported ${delivery.status} for ${targetLabel}.\n${delivery.reason}\n${classes}Message id: ${msgId}\nInspect read_claude_delivery with this message ID. Do not resend, change the sender permission class, or alter recipient permissions to bypass this receipt. The approval UI has not been verified; Claude Desktop declares no peer approval dialog, so do not tell the user an approval button exists without inspecting this exact Desktop task.`, true);
       }
 
       if (wait === 0) {
@@ -271,7 +274,8 @@ server.registerTool(
           true,
         );
       }
-      return result(`Reply received from ${targetLabel}.\nMessage id: ${msgId}\n\n--- Claude reply ---\n${reply.text}`);
+      const absorbedNote = reply.absorbed ? "\nThe recipient was mid-turn when this message arrived; the reply is the closing text of a turn that absorbed the message and may not address it." : "";
+      return result(`Reply received from ${targetLabel}.\nMessage id: ${msgId}${absorbedNote}\n\n--- Claude reply ---\n${reply.text}`);
     } catch (err) {
       return failure(err);
     }

package/src/claude-desktop-context.mjs

@@ -12,8 +12,22 @@ const VERSION_FIELDS = ["size", "mtimeMs", "ctimeMs", "ino", "dev"];
 
 const sameVersion = (left, right) => VERSION_FIELDS.every((field) => left[field] === right[field]);
 
+/**
+ * Claude's inbound parity gate groups bypassPermissions as one class and
+ * default, acceptEdits, auto and dontAsk as the prompting class. Plan counts
+ * as bypass only when bypass is available to that session, which the record
+ * does not say, so it and any unknown value yield no class rather than a guess.
+ */
+const PERMISSION_CLASSES = { bypassPermissions: "bypass", default: "prompting", acceptEdits: "prompting", auto: "prompting", dontAsk: "prompting" };
+
+const PERMISSION_MODE = /^[A-Za-z]{1,64}$/;
+
+const permissionModeOf = (mode) => typeof mode === "string" && PERMISSION_MODE.test(mode) ? mode : null;
+
+const permissionClassOf = (mode) => typeof mode === "string" && Object.hasOwn(PERMISSION_CLASSES, mode) ? PERMISSION_CLASSES[mode] : null;
+
 function result(status, reason, task = {}) {
-  return { status, taskId: task.taskId ?? null, title: task.title ?? null, cwd: task.cwd ?? null, reason };
+  return { status, taskId: task.taskId ?? null, title: task.title ?? null, cwd: task.cwd ?? null, permissionMode: task.permissionMode ?? null, permissionClass: task.permissionClass ?? null, reason };
 }
 
 function sessionsRoot(platform, env) {
@@ -62,6 +76,7 @@ function readMetadata(file, budget) {
     const current = fs.lstatSync(file);
     if (!sameVersion(before, after) || current.isSymbolicLink() || !sameVersion(current, after)) throw new Error("metadata changed");
     budget.versions.set(file, current);
+    budget.contents.set(file, bytes);
     const data = JSON.parse(bytes.toString("utf8"));
     if (!data || typeof data !== "object" || Array.isArray(data)) throw new Error("invalid metadata");
     return {
@@ -72,12 +87,33 @@ function readMetadata(file, budget) {
       cwd: data.cwd,
       title: data.title,
       isArchived: data.isArchived,
+      permissionMode: data.permissionMode,
     };
   } finally {
     fs.closeSync(descriptor);
   }
 }
 
+/**
+ * Stat fields cannot prove a record is unchanged: a same-size rewrite inside
+ * one filesystem timestamp tick (about 16 ms on Windows) keeps size, times
+ * and inode identical. The final consistency pass therefore compares the
+ * bytes themselves; the records are small JSON files, so the extra read is
+ * cheap and the check is deterministic on every platform.
+ */
+function rereadMetadata(file) {
+  const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile() || stat.size > MAX_FILE_BYTES) throw new Error("file limit");
+    const bytes = Buffer.alloc(stat.size);
+    if (fs.readSync(descriptor, bytes, 0, bytes.length, 0) !== bytes.length) throw new Error("short read");
+    return bytes;
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
 function canonicalDirectory(directory) {
   if (typeof directory !== "string" || !path.isAbsolute(directory)) throw new Error("invalid cwd");
   const canonical = fs.realpathSync.native(directory);
@@ -98,7 +134,7 @@ export function readClaudeDesktopContext(session, { platform = process.platform,
   try {
     if (!fs.existsSync(directory)) return result("missing", "Claude Desktop task metadata is not available on this host.");
     const files = metadataFiles(directory);
-    const budget = { bytes: 0, versions: new Map() };
+    const budget = { bytes: 0, versions: new Map(), contents: new Map() };
     records = files.map((file) => readMetadata(file, budget));
     const currentFiles = metadataFiles(directory);
     if (files.length !== currentFiles.length || files.some((file, index) => file !== currentFiles[index])) {
@@ -107,6 +143,7 @@ export function readClaudeDesktopContext(session, { platform = process.platform,
     for (const file of files) {
       const current = fs.lstatSync(file);
       if (!current.isFile() || !sameVersion(current, budget.versions.get(file))) throw new Error("metadata changed");
+      if (!rereadMetadata(file).equals(budget.contents.get(file))) throw new Error("metadata changed");
     }
   } catch {
     return result("mismatch", "Claude Desktop task metadata could not be read completely and consistently; no task identity is confirmed.");
@@ -156,5 +193,7 @@ export function readClaudeDesktopContext(session, { platform = process.platform,
     taskId: record.taskId,
     title: record.title,
     cwd: taskCwd,
+    permissionMode: permissionModeOf(record.permissionMode),
+    permissionClass: permissionClassOf(permissionModeOf(record.permissionMode)),
   });
 }

package/src/claude-inbound-policy.mjs

@@ -0,0 +1,50 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { homeDir } from "./platform.mjs";
+
+const VALUES = new Set(["accept", "hold", "refuse"]);
+
+/**
+ * Claude Code consults crossSessionInbound before comparing permission
+ * classes: an explicit value always wins, managed settings override every
+ * other source, and a project or local file may only tighten (refuse over
+ * hold over the user's accept). An unrecognised value holds messages while it
+ * is present. Flags such as --settings cannot be seen from outside the
+ * process; Claude Desktop launches its sessions with the user, project and
+ * local sources, which is what this reads.
+ */
+function managedSettingsFile(platform, env) {
+  if (platform === "darwin") return "/Library/Application Support/ClaudeCode/managed-settings.json";
+  if (platform === "win32") return path.join(env.ProgramData || "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
+  return "/etc/claude-code/managed-settings.json";
+}
+
+function readValue(file) {
+  let text;
+  try { text = fs.readFileSync(file, "utf8"); }
+  catch { return undefined; }
+  try {
+    const data = JSON.parse(text);
+    const value = data && typeof data === "object" && !Array.isArray(data) ? data.crossSessionInbound : undefined;
+    if (value === undefined) return undefined;
+    return VALUES.has(value) ? value : "invalid";
+  } catch {
+    return undefined;
+  }
+}
+
+export function readClaudeInboundPolicy(cwd, { platform = process.platform, env = process.env, home = homeDir(), managedFile = managedSettingsFile(platform, env) } = {}) {
+  const managed = readValue(managedFile);
+  if (managed !== undefined) return { value: managed === "invalid" ? "refuse" : managed, source: "managed" };
+  const sources = [
+    ["user", readValue(path.join(home, ".claude", "settings.json"))],
+    ...(typeof cwd === "string" && path.isAbsolute(cwd)
+      ? [["project", readValue(path.join(cwd, ".claude", "settings.json"))], ["local", readValue(path.join(cwd, ".claude", "settings.local.json"))]]
+      : []),
+  ];
+  for (const [source, value] of sources) if (value === "refuse") return { value: "refuse", source };
+  for (const [source, value] of sources) if (value === "hold" || value === "invalid") return { value: "hold", source };
+  if (sources[0][1] === "accept") return { value: "accept", source: "user" };
+  return { value: null, source: null };
+}

package/src/codex-sender-context.mjs

@@ -100,9 +100,11 @@ function readState(file, maxBytes) {
  * Claude's inbound parity gate groups sessions by one question: does a human
  * still prompt the sender? Codex answers it with approval_policy. Its two host
  * review flags describe automated review instead - node_repl_auto_review_required
- * is a model catalog requirement (Codex refuses such a model without auto
- * review) and auto_review_enabled names a Guardian reviewer - so they are
- * required as evidence and reported, but never move a sender between classes.
+ * is a per-model catalog attribute (Codex Desktop derives it from
+ * autoReview.requiredOnModels; the live gpt-6-astra task carried it with a
+ * user reviewer and auto review disabled) and auto_review_enabled names a
+ * Guardian reviewer - so they are required as evidence and reported, but
+ * never move a sender between classes.
  * Downgrading them held every send from such a model behind an approval
  * dialog that Claude Desktop does not render.
  */

package/src/index.mjs

@@ -29,7 +29,7 @@ import { createRuntimeState } from "./runtime-state.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.13.6";
+const VERSION = "1.13.7";
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
 /**

package/src/native-relay-companion.mjs

@@ -23,7 +23,7 @@ import { exitForVersionRequest } from "./cli-version.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.13.6";
+const VERSION = "1.13.7";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message) {

package/src/peer-protocol.mjs

@@ -284,17 +284,35 @@ export function readTranscript(sessionId, cwd, limit = 10) {
   return { file, messages: messages.slice(-limit) };
 }
 
+/**
+ * Claude Code records an injected peer message in one of two shapes. An idle
+ * recipient starts a new turn with a user entry whose uuid is the message id
+ * (origin.msg_id names it as well). A busy recipient absorbs the message into
+ * the running turn instead: the entry is a queued_command attachment under a
+ * fresh uuid whose source_uuid is the message id, and the reply is that
+ * turn's closing text. Both were measured on Claude Code 2.1.260-2.1.263.
+ */
+function injectedMessageRoot(entry, msgId) {
+  const role = entry?.message?.role;
+  if (role === "user" && (entry.uuid === msgId || entry.origin?.msg_id === msgId)) return "idle";
+  const attachment = entry?.type === "attachment" ? entry.attachment : null;
+  if (attachment?.type === "queued_command" && (attachment.source_uuid === msgId || attachment.origin?.msg_id === msgId)) return "absorbed";
+  return null;
+}
+
 export function readTranscriptReply(sessionId, cwd, msgId) {
   const file = findTranscriptFile(sessionId, cwd);
   let lines;
   try { lines = fs.readFileSync(file, "utf8").split("\n"); }
   catch { return null; }
   const descendants = new Set();
+  let absorbed = false;
   for (const line of lines) {
     let entry;
     try { entry = JSON.parse(line); } catch { continue; }
     if (entry.isSidechain) continue;
-    if (entry.uuid === msgId && entry.message?.role === "user") { descendants.add(msgId); continue; }
+    const root = injectedMessageRoot(entry, msgId);
+    if (root) { absorbed = root === "absorbed"; if (typeof entry.uuid === "string") descendants.add(entry.uuid); continue; }
     if (!descendants.has(entry.parentUuid)) continue;
     const role = entry.message?.role;
     const content = entry.message?.content;
@@ -302,7 +320,7 @@ export function readTranscriptReply(sessionId, cwd, msgId) {
     if (typeof entry.uuid === "string") descendants.add(entry.uuid);
     if (role !== "assistant" || !["end_turn", "stop_sequence"].includes(entry.message.stop_reason)) continue;
     const text = Array.isArray(content) ? content.filter((part) => part.type === "text").map((part) => part.text ?? "").join("\n") : String(content ?? "");
-    if (text.trim()) return { text: text.trim(), msgId: entry.uuid, source: "transcript", inReplyTo: msgId };
+    if (text.trim()) return { text: text.trim(), msgId: entry.uuid, source: "transcript", inReplyTo: msgId, absorbed };
   }
   return null;
 }
@@ -594,7 +612,7 @@ export class PeerEndpoint {
     return frame.msg_id;
   }
 
-  async sendAndWait(targetSocket, text, { timeoutMs = 120000, priority = "next", transcriptSession, beforeSend, permissionMode = this.permissionMode, replyThreadId, senderReview } = {}) {
+  async sendAndWait(targetSocket, text, { timeoutMs = 120000, priority = "next", transcriptSession, beforeSend, permissionMode = this.permissionMode, replyThreadId, senderReview, senderApprovalPolicy, recipient } = {}) {
     const previous = this.requestQueues.get(targetSocket) ?? Promise.resolve();
     const pending = previous.catch(() => {}).then(async () => {
       await beforeSend?.();
@@ -612,7 +630,7 @@ export class PeerEndpoint {
       this.unconfirmedReplies.set(targetSocket, unconfirmed + 1);
       let msgId = crypto.randomUUID();
       this.pendingMessages.set(msgId, { targetSocket, transcriptSession });
-      this.sentMessages.set(msgId, { targetSocket, transcriptSession, sentAt: since, replyThreadId, permissionMode, ...(senderReview ? { senderReview: { ...senderReview } } : {}) });
+      this.sentMessages.set(msgId, { targetSocket, transcriptSession, sentAt: since, replyThreadId, permissionMode, senderApprovalPolicy, ...(senderReview ? { senderReview: { ...senderReview } } : {}), ...(recipient ? { recipient: { ...recipient } } : {}) });
       if (transcriptSession && !this.responsePoll) {
         this.responsePoll = globalThis.setInterval(() => this.#refreshTranscriptReplies(), 250);
         this.responsePoll.unref();
@@ -715,10 +733,12 @@ export class PeerEndpoint {
       taskId: session?.desktop?.taskId ?? null,
       title: session?.desktop?.title ?? null,
       senderMode: sent.permissionMode ?? null,
+      ...(sent.senderApprovalPolicy !== undefined ? { senderApprovalPolicy: sent.senderApprovalPolicy ?? null } : {}),
       ...(sent.senderReview ? { senderReview: { ...sent.senderReview } } : {}),
+      ...(sent.recipient ? { recipientPermissionMode: sent.recipient.permissionMode ?? null, recipientPermissionClass: sent.recipient.permissionClass ?? null, recipientInboundPolicy: sent.recipient.inboundPolicy ?? null } : {}),
       replyThreadId: sent.replyThreadId ?? null,
       pending: this.pendingMessages.has(msgId),
-      ...(sent.reply ? { reply: sent.reply.text, source: sent.reply.source ?? "peer", ...(sent.reply.forwardingError ? { forwardingError: { ...sent.reply.forwardingError } } : {}) } : {}),
+      ...(sent.reply ? { reply: sent.reply.text, source: sent.reply.source ?? "peer", ...(sent.reply.absorbed ? { replyAbsorbed: true } : {}), ...(sent.reply.forwardingError ? { forwardingError: { ...sent.reply.forwardingError } } : {}) } : {}),
     };
   }
 

package/src/recipient-preflight.mjs

@@ -0,0 +1,26 @@
+export function preflightFailure(code, reason) {
+  const error = new Error(`${reason} No message was sent.`);
+  error.preflight = { status: "blocked", code, reason, sent: false };
+  return error;
+}
+
+/**
+ * Claude consults crossSessionInbound before comparing permission classes,
+ * then holds any message whose attested sender class differs from the
+ * recipient's. Claude Desktop cannot show the approval dialog, so a hold
+ * there expires unapproved. Both predictable outcomes are refused here with
+ * the setting or both classes named. The recipient's mode comes from Desktop
+ * task metadata; an unknown mode leaves the decision to Claude. This runs at
+ * request time and again immediately before the socket write.
+ */
+export function assertRecipientClass(session, sender) {
+  if (!sender) return;
+  const inbound = session.inbound ?? { value: null, source: null };
+  if (inbound.value === "refuse" || inbound.value === "hold") {
+    throw preflightFailure("CLAUDE_RECIPIENT_INBOUND_POLICY", `The recipient session's ${inbound.source} settings set crossSessionInbound to ${inbound.value}, so Claude would ${inbound.value === "refuse" ? "drop this message without delivering it" : "hold this message, and Claude Desktop declares no peer approval dialog, so it would expire unapproved"}. Report this to the user: only they can change that setting. Do not edit recipient settings.`);
+  }
+  if (inbound.value === "accept") return;
+  const recipient = session.desktop?.permissionClass ?? null;
+  if (!recipient || recipient === sender.mode) return;
+  throw preflightFailure("CLAUDE_RECIPIENT_CLASS_MISMATCH", `The Claude Desktop task "${session.desktop.title}" runs in ${session.desktop.permissionMode} (${recipient} class) while this sender attests ${sender.mode}. With no explicit crossSessionInbound setting, Claude holds a cross-session message whose sender class differs from the recipient's, and Claude Desktop declares no peer approval dialog, so the message would expire unapproved. Report this to the user: they can run that task in the ${sender.mode} class, change this Codex task's approval policy so its class matches, or set crossSessionInbound to accept in the recipient session's own settings. Do not change the attested sender class or recipient settings yourself.`);
+}