@minhspark/codex-mcp-bridge 1.15.2 → 1.16.1

package/src/claude-bridge.mjs

@@ -2,15 +2,17 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { createHash } from "node:crypto";
 
 import { CodexAppServerClient } from "./app-server-client.mjs";
-import { PLATFORM_LABEL } from "./platform.mjs";
-import { PeerEndpoint, assertClaudeSessionCwd, assertClaudeSessionProcess, findClaudeSession, listClaudeSessions, readTranscript } from "./peer-protocol.mjs";
+import { PLATFORM_LABEL, openClaudeCodeComposer } from "./platform.mjs";
+import { PeerEndpoint, assertClaudeSessionCwd, assertClaudeSessionProcess, findClaudeSession, listClaudeSessions, readTranscript, readInitialTranscriptMessage } from "./peer-protocol.mjs";
 import { createThreadDelivery } from "./thread-delivery.mjs";
 import { exitForVersionRequest } from "./cli-version.mjs";
 import { desktopTasksConfigured } from "./native-relay.mjs";
 import { createRuntimeState } from "./runtime-state.mjs";
-import { readClaudeDesktopContext } from "./claude-desktop-context.mjs";
+import { readClaudeDesktopContext, readClaudeDesktopTasks } from "./claude-desktop-context.mjs";
+import { ClaudeSessionCreation } from "./claude-session-creation.mjs";
 import { readClaudeInboundPolicy } from "./claude-inbound-policy.mjs";
 import { assertRecipientClass, preflightFailure } from "./recipient-preflight.mjs";
 import { readCodexSenderContext } from "./codex-sender-context.mjs";
@@ -18,11 +20,13 @@ import { ReplyForwarder } from "./reply-forwarder.mjs";
 import { assertRoutingReload, clientReloadReason, createReloadControl } from "./reload-control.mjs";
 import { readClaudeAccountContext } from "./desktop-account-context.mjs";
 import { assertAccountIdentity, bindUnsolicitedClaudeMessageAccount, publicAccountState, readBridgeAccounts, requireBridgeAccounts, sameAccountIdentity } from "./bridge-account-context.mjs";
-import { resolveClaudeDesktopSession } from "./claude-session-router.mjs";
+import { resolveClaudeDesktopSession, sameClaudeDesktopRecipient } from "./claude-session-router.mjs";
+import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.15.2";
+const VERSION = "1.16.1";
+void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;
 
@@ -30,6 +34,7 @@ const log = (msg) => process.stderr.write(`[claude-bridge] ${msg}\n`);
 
 const defaultPeerName = process.env.CLAUDE_BRIDGE_PEER_NAME ?? `codex-${process.pid}`;
 const desktopOnly = desktopTasksConfigured();
+const rootPolicy = createHardenedRootPolicy();
 const runtime = createRuntimeState({ configuration: desktopTasksConfigured });
 
 const peer = new PeerEndpoint({
@@ -55,6 +60,35 @@ const forwarding = {
   threadId: process.env.CODEX_THREAD_ID ?? null,
 };
 
+const creationRootBindings = new Map();
+
+const creations = new ClaudeSessionCreation({
+  open: openClaudeCodeComposer,
+  listTasks: (account) => readClaudeDesktopTasks({ account }).filter((task) => rootPolicy.allows(task.cwd)),
+  listSessions: () => listClaudeSessions().filter((session) => rootPolicy.allows(session.cwd)),
+  readContext: (session, account) => readClaudeDesktopContext(session, { account }),
+  readTranscript: (...args) => {
+    const binding = rootPolicy.capture(args[1], "Claude creation transcript working directory");
+    const transcript = readInitialTranscriptMessage(...args);
+    rootPolicy.recheck(binding, "Claude creation transcript working directory");
+    return transcript;
+  },
+  readAccount: readClaudeAccountContext,
+  assertProcess: assertClaudeSessionProcess,
+});
+function recheckScopeBindings(bindings) {
+  if (!rootPolicy.enabled) return;
+  if (!bindings?.sender || !bindings?.recipient) throw Object.assign(new Error("Hardened bridge record has no original sender and recipient root binding"), { code: "ROOT_BINDING_MISSING" });
+  rootPolicy.recheck(bindings.sender, "Original Codex sender working directory");
+  rootPolicy.recheck(bindings.recipient, "Original Claude recipient working directory");
+}
+
+function recordVisible(record, accounts = readBridgeAccounts()) {
+  if (desktopOnly && !sameAccountIdentity(record?.accountContext, accounts)) return false;
+  if (!rootPolicy.enabled) return true;
+  try { recheckScopeBindings(record?.scopeBindings); return true; } catch { return false; }
+}
+
 const replyForwarder = new ReplyForwarder({
   minIntervalMs: FORWARD_MIN_INTERVAL_MS,
   maxPerSession: FORWARD_MAX_PER_SESSION,
@@ -63,16 +97,17 @@ const replyForwarder = new ReplyForwarder({
       throw Object.assign(new Error("Bridge routing changed; the reply was not forwarded. Inspect the original receipt before reconnecting."), { code: "REPLY_ROUTING_CHANGED" });
     }
     if (desktopOnly) assertAccountIdentity(record.accountContext);
+    recheckScopeBindings(record.scopeBindings);
   },
   deliver: (threadId, record) => delivery.deliver(threadId, `[message from Claude session ${record.fromSocket ?? "?"}]\n${record.absorbed ? "[This reply is the closing text of a turn that absorbed the message while it was running; it may not address the message.]\n" : ""}\n${record.text}`,
-    desktopOnly ? { beforeSend: () => assertAccountIdentity(record.accountContext), accountContext: record.accountContext } : {}),
+    desktopOnly ? { beforeSend: () => { assertAccountIdentity(record.accountContext); recheckScopeBindings(record.scopeBindings); }, accountContext: record.accountContext } : {}),
 });
 
 const reload = createReloadControl({
   entry: "claude-bridge.mjs",
   inspect: () => peer.reloadReason() ?? replyForwarder.reloadReason() ?? clientReloadReason(codex),
   quiesce: async () => { await peer.quiesce(); codex.close(); },
-  exportState: () => ({ desktopOnly, peer: peer.exportReloadState(), forwarding: replyForwarder.exportReloadState(), threadId: forwarding.threadId }),
+  exportState: () => ({ desktopOnly, peer: peer.exportReloadState(), forwarding: replyForwarder.exportReloadState(), threadId: forwarding.threadId, creations: creations.exportState(), creationRootBindings: [...creationRootBindings] }),
   restore: (state) => {
     assertRoutingReload(state.desktopOnly, desktopOnly);
     if (state.threadId !== null && (typeof state.threadId !== "string" || !state.threadId.trim())) {
@@ -81,6 +116,14 @@ const reload = createReloadControl({
     peer.restoreReloadState(state.peer);
     replyForwarder.restoreReloadState(state.forwarding);
     forwarding.threadId = state.threadId;
+    if (state.creations !== undefined) creations.restoreState(state.creations);
+    if (state.creationRootBindings !== undefined) {
+      if (!Array.isArray(state.creationRootBindings) || state.creationRootBindings.length > 32) throw new Error("Invalid Claude creation root bindings");
+      for (const entry of state.creationRootBindings) {
+        if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string" || creationRootBindings.has(entry[0]) || !creations.requests.has(entry[0])) throw new Error("Invalid Claude creation root binding");
+        creationRootBindings.set(entry[0], entry[1]);
+      }
+    }
   },
   activate: () => peer.start(),
   resume: () => peer.resume(),
@@ -89,6 +132,9 @@ const reload = createReloadControl({
 function readReceipt(msgId) {
   const receipt = peer.readDelivery(msgId);
   if (desktopOnly && receipt && !sameAccountIdentity(receipt.accountContext, readBridgeAccounts())) return null;
+  if (rootPolicy.enabled) {
+    try { recheckScopeBindings(receipt?.scopeBindings); } catch { return null; }
+  }
   return receipt ? { ...receipt, forwarding: replyForwarder.read(msgId) ?? receipt.forwardingError ?? null } : null;
 }
 
@@ -117,6 +163,10 @@ function withDesktopContext(session, account = readClaudeAccountContext()) {
     ? { ...session, desktop: readClaudeDesktopContext(session, { account }), inbound: readClaudeInboundPolicy(session.cwd) } : session;
 }
 
+function assertSessionRoot(session, label = "Claude session") {
+  return rootPolicy.assert(session?.cwd, `${label} working directory`);
+}
+
 function assertDesktopTask(session, expectedTaskId) {
   if (session.desktop?.status !== "matched") {
     throw preflightFailure("CLAUDE_DESKTOP_TASK_UNVERIFIED", session.desktop?.reason ?? "The live session could not be matched to a Claude Desktop task.");
@@ -134,6 +184,47 @@ function assertSender(meta) {
   return sender;
 }
 
+function assertCreationRoots(requestId, sender) {
+  if (!rootPolicy.enabled) return;
+  rootPolicy.assert(sender.cwd, "Codex sender working directory");
+  recheckScopeBindings(creationRootBindings.get(requestId));
+}
+
+async function startClaudeCreation({ requestId, cwd, prompt }, meta) {
+  runtime.assertCurrent();
+  if (!desktopOnly) throw new Error("New Claude sessions require Desktop-only mode");
+  const sender = assertSender(meta);
+  const accounts = readBridgeAccounts();
+  const selectedAccounts = requireBridgeAccounts(accounts);
+  if (rootPolicy.enabled && creations.requests.has(requestId)) assertCreationRoots(requestId, sender);
+  const scopeBindings = rootPolicy.enabled ? creationRootBindings.get(requestId) ?? {
+    sender: rootPolicy.capture(sender.cwd, "Codex sender working directory"),
+    recipient: rootPolicy.capture(cwd, "Claude creation working directory"),
+  } : null;
+  const receipt = await creations.start({ requestId, cwd, prompt, account: accounts.claude, senderThreadId: sender.threadId,
+    beforeOpen: () => {
+      runtime.assertCurrent();
+      assertAccountIdentity(selectedAccounts);
+      recheckScopeBindings(scopeBindings);
+      if (rootPolicy.enabled && !rootPolicy.same(cwd, scopeBindings.recipient.path)) throw new Error("The Claude creation working directory changed before opening Desktop");
+      const current = assertSender(meta);
+      if (JSON.stringify(current) !== JSON.stringify(sender)) throw new Error("The calling Codex turn changed before opening Claude Desktop");
+    },
+  });
+  if (rootPolicy.enabled) creationRootBindings.set(requestId, scopeBindings);
+  return { ...textResult(JSON.stringify(receipt, null, 2)), structuredContent: { creation: receipt } };
+}
+
+async function inspectClaudeCreation(requestId, meta) {
+  const sender = assertSender(meta);
+  assertCreationRoots(requestId, sender);
+  const accounts = readBridgeAccounts();
+  requireBridgeAccounts(accounts);
+  const receipt = await creations.inspect(requestId, { account: accounts.claude, senderThreadId: sender.threadId });
+  assertCreationRoots(requestId, sender);
+  return { ...textResult(JSON.stringify(receipt, null, 2)), structuredContent: { creation: receipt } };
+}
+
 function forwardToCodexThread(record) {
   const threadId = record.replyThreadId ?? (desktopOnly ? null : forwarding.threadId);
   if (!threadId) return;
@@ -146,6 +237,9 @@ function forwardToCodexThread(record) {
 }
 
 peer.onMessage((record) => {
+  if (rootPolicy.enabled && !record.cwd) { record.forwardingError = { status: "blocked", reasonCode: "ROOT_UNAUTHORIZED", reason: "Unsolicited inbound messages are disabled in hardened mode without a verified root binding" }; return; }
+  try { if (rootPolicy.enabled) rootPolicy.assert(record.cwd, "Inbound Claude message working directory"); }
+  catch (err) { record.forwardingError = { status: "blocked", reasonCode: "ROOT_UNAUTHORIZED", reason: err.message }; return; }
   if (desktopOnly) bindUnsolicitedClaudeMessageAccount(record, {
     hasPendingSource: (socket) => [...peer.pendingMessages.values()].some((pending) => pending.targetSocket === socket),
   });
@@ -178,6 +272,50 @@ function registerTool(name, definition, handler) {
   });
 }
 
+registerTool(
+  "start_claude_session",
+  {
+    title: "Prepare a new Claude Desktop Code session",
+    description: "Use only when the user explicitly requests a NEW Claude Desktop session. Open the official Code composer in an existing project with a prefilled prompt. Claude Desktop requires the user to confirm the folder and press Send; opening the link is not session creation. Retain requestId and inspect read_claude_creation. Never substitute an existing task or launch a CLI session.",
+    inputSchema: {
+      requestId: z.string().describe("Stable UUID for this creation; reuse exactly when inspecting or retrying"),
+      cwd: z.string().describe("Exact absolute directory of the existing Claude Desktop project"),
+      prompt: z.string().describe("Initial prompt for the NEW conversation; shown for user confirmation"),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+  },
+  async (args, extra) => startClaudeCreation(args, extra?._meta),
+);
+
+registerTool(
+  "read_claude_creation",
+  {
+    title: "Verify a new Claude Desktop session",
+    description: "Inspect an existing creation request without reopening or sending. A created receipt requires a new native task, matching account/project, live process identity, and the exact initial user prompt. awaiting_project_confirmation means the prompt arrived in a new task but its folder still differs; the user must adopt the requested project before creation can be confirmed. An old task resumed with a new process never counts as a new session.",
+    inputSchema: { requestId: z.string().describe("Original requestId returned by start_claude_session") },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+  },
+  async ({ requestId }, extra) => inspectClaudeCreation(requestId, extra?._meta),
+);
+
+registerTool(
+  "abandon_claude_creation",
+  {
+    title: "Release a cancelled Claude creation request",
+    description: "Use only when the user explicitly cancels a pending creation request. Release its composer reservation while retaining the receipt. This does not close Claude Desktop or prove that the prefilled prompt was never submitted; the old request remains inspectable.",
+    inputSchema: { requestId: z.string().describe("Exact creation requestId the user cancelled") },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+  },
+  async ({ requestId }, extra) => {
+    const sender = assertSender(extra?._meta);
+    assertCreationRoots(requestId, sender);
+    const accounts = readBridgeAccounts();
+    requireBridgeAccounts(accounts);
+    const receipt = await creations.abandon(requestId, { account: accounts.claude, senderThreadId: sender.threadId });
+    return { ...textResult(JSON.stringify(receipt, null, 2)), structuredContent: { creation: receipt } };
+  },
+);
+
 registerTool(
   "list_claude_sessions",
   {
@@ -196,11 +334,13 @@ registerTool(
   },
   async ({ includeDead, expectedCwd }) => {
     try {
+      if (rootPolicy.enabled && expectedCwd !== undefined) rootPolicy.assert(expectedCwd, "Requested working directory");
       if (expectedCwd !== undefined) assertClaudeSessionCwd({ cwd: expectedCwd }, expectedCwd);
       const account = readClaudeAccountContext();
       if (desktopOnly && account.status !== "verified") return { ...textResult(`Claude account ${account.status}: ${account.reason} Sign in and retry discovery.`, true), structuredContent: { account: publicAccountState(account), sessions: [] } };
       const sessions = listClaudeSessions({ includeDead: includeDead ?? false }).filter(
         (s) => s.pid !== process.pid && (!desktopOnly || s.entrypoint === "claude-desktop"),
+      ).filter((session) => !rootPolicy.enabled || rootPolicy.allows(session.cwd)
       ).filter((session) => {
         if (expectedCwd === undefined) return true;
         try { assertClaudeSessionCwd(session, expectedCwd); return true; }
@@ -221,13 +361,14 @@ registerTool(
     title: "Send a message to a Claude session",
     description:
       "Send a message to a running Claude Code session's peer transport and wait for its reply. " +
+      "Only when the user requests a NEW conversation, target new prepares the native Desktop composer in expectedCwd; it requires user confirmation and returns a creation receipt, not a delivery receipt. " +
       "A socket write alone does not confirm that Claude received the message. Set waitSec to 0 to send without confirmation. " +
       "Every send is refused while earlier messages to that session still await replies, including waitSec 0; " +
       "wait for those replies and read_claude_inbox before trying again. Desktop-only mode refuses CLI or unknown " +
       "entrypoints, partial names, ambiguous targets, and a missing or mismatched expectedCwd or expectedTaskId before sending. Use target auto and expectedCwd for automatic current-account discovery; expectedTaskId is optional only when auto finds exactly one matching task. " +
       "The sender's current permissions are verified per call; environment overrides and manual binding cannot bypass an unknown sender. It never creates a replacement session.",
     inputSchema: {
-      target: z.string().describe("Use auto for current-account discovery in expectedCwd, or an exact session name, pid or sessionId"),
+      target: z.string().describe("Use auto for current-account discovery in expectedCwd, an exact session identity, or new to prepare a separate Desktop conversation requiring user confirmation"),
       message: z.string().describe("The message text to deliver"),
       expectedCwd: z.string().optional().describe("Exact absolute project directory independently verified by the caller; required in Desktop-only mode"),
       expectedTaskId: z.string().optional().describe("Exact native Claude Desktop task ID from list_claude_sessions; verify its title in the app before sending"),
@@ -249,6 +390,12 @@ registerTool(
   async ({ target, message, waitSec, expectedCwd, expectedTaskId }, extra) => {
     try {
       runtime.assertCurrent();
+      if (target === "new") {
+        if (expectedTaskId !== undefined) throw new Error("A new Claude conversation cannot target an existing task ID");
+        const sender = assertSender(extra?._meta);
+        const requestId = createHash("sha256").update(JSON.stringify([sender.threadId, sender.turnId, expectedCwd, message])).digest("hex");
+        return await startClaudeCreation({ requestId, cwd: expectedCwd, prompt: message }, extra?._meta);
+      }
       const accounts = desktopOnly ? readBridgeAccounts() : null;
       const selectedAccounts = desktopOnly ? requireBridgeAccounts(accounts) : null;
       const found = desktopOnly ? resolveClaudeDesktopSession({ target, expectedCwd, expectedTaskId,
@@ -257,6 +404,7 @@ registerTool(
       }) : findClaudeSession(target, { desktopOnly });
       if (!found) return textResult(desktopOnly ? missingDesktopSession : `No live Claude session matches "${target}".`, true);
       const session = desktopOnly ? { ...found, inbound: readClaudeInboundPolicy(found.cwd) } : withDesktopContext(found);
+      assertSessionRoot(session);
       const selectedTaskId = target === "auto" ? session.desktop?.taskId : expectedTaskId;
       if (desktopOnly || expectedCwd !== undefined) assertClaudeSessionCwd(session, expectedCwd);
       if (desktopOnly) {
@@ -264,6 +412,10 @@ registerTool(
         assertClaudeSessionProcess(session);
       }
       const sender = desktopOnly ? assertSender(extra?._meta) : null;
+      const scopeBindings = rootPolicy.enabled ? {
+        sender: rootPolicy.capture(sender?.cwd, "Codex sender working directory"),
+        recipient: rootPolicy.capture(session.cwd, "Claude recipient working directory"),
+      } : null;
       if (desktopOnly) assertRecipientClass(session, sender);
       await peer.start();
 
@@ -275,19 +427,28 @@ registerTool(
         ...(selectedAccounts ? { accountContext: selectedAccounts } : {}),
         ...(sender ? { permissionMode: sender.mode, replyThreadId: sender.threadId, senderReview: sender.review, senderApprovalPolicy: sender.approvalPolicy } : {}),
         ...(desktop ? { recipient: { permissionMode: session.desktop.permissionMode ?? null, permissionClass: session.desktop.permissionClass ?? null, inboundPolicy: session.inbound?.value ?? null } } : {}),
+        ...(scopeBindings ? { scopeBindings } : {}),
         beforeSend: () => {
           runtime.assertCurrent();
           if (desktopOnly) assertAccountIdentity(selectedAccounts);
           const current = findClaudeSession(session.sessionId ?? String(session.pid), { desktopOnly });
-          if (!current || current.pid !== session.pid || current.socket !== session.socket) {
+          const destinationUnchanged = desktopOnly
+            ? sameClaudeDesktopRecipient(session, current)
+            : Boolean(current && current.pid === session.pid && current.socket === session.socket);
+          if (!destinationUnchanged) {
             throw new Error("The Claude destination changed while this message was queued. No message was sent; inspect the existing Desktop session.");
           }
           if (desktopOnly || expectedCwd !== undefined) assertClaudeSessionCwd(current, expectedCwd);
+          assertSessionRoot(current);
           if (desktopOnly) {
             assertClaudeSessionProcess(current);
             const refreshed = withDesktopContext(current, readClaudeAccountContext());
             assertDesktopTask(refreshed, selectedTaskId);
             const active = assertSender(extra?._meta);
+            if (rootPolicy.enabled) {
+              rootPolicy.recheck(scopeBindings.sender, "Codex sender working directory");
+              rootPolicy.recheck(scopeBindings.recipient, "Claude recipient working directory");
+            }
             if (active.threadId !== sender.threadId || active.turnId !== sender.turnId || active.cwd !== sender.cwd || active.mode !== sender.mode || active.approvalPolicy !== sender.approvalPolicy || JSON.stringify(active.review) !== JSON.stringify(sender.review)) {
               throw preflightFailure("CODEX_SENDER_CONTEXT_CHANGED", "The sender's active turn or permissions changed while this message was queued.");
             }
@@ -339,11 +500,12 @@ registerTool(
   "read_claude_delivery",
   {
     title: "Inspect a Claude message receipt without resending",
-    description: "Read the latest recipient control receipt or correlated reply for a message sent by this MCP process. Unknown IDs do not prove non-delivery; retain the original receipt after a reconnect and inspect the existing Claude session before any resend.",
+    description: "Read the latest recipient control receipt or correlated reply for a message sent by this MCP process. Also accepts the 64-character requestId returned by target new to inspect creation without reopening. Unknown IDs do not prove non-delivery; retain the original receipt after a reconnect and inspect the existing Claude session before any resend.",
     inputSchema: { msgId: z.string().describe("The original message ID returned by send_to_claude_session") },
     annotations: { readOnlyHint: true, openWorldHint: false },
   },
-  async ({ msgId }) => {
+  async ({ msgId }, extra) => {
+    if (/^[0-9a-f]{64}$/i.test(msgId)) return inspectClaudeCreation(msgId, extra?._meta);
     const receipt = readReceipt(msgId);
     if (!receipt) return textResult("This MCP process has no receipt for that message ID. It may belong to a previous process; do not infer failure or resend. Inspect the original Claude Desktop session.", true);
     return { ...textResult(JSON.stringify(receipt, null, 2)), structuredContent: { receipt } };
@@ -371,7 +533,7 @@ registerTool(
     try {
       await peer.start();
       const accounts = desktopOnly ? readBridgeAccounts() : null;
-      const messages = peer.drainInbox(limit ?? 20, (record) => !desktopOnly || sameAccountIdentity(record.accountContext, accounts));
+      const messages = peer.drainInbox(limit ?? 20, (record) => recordVisible(record, accounts));
       if (!messages.length) return textResult(desktopOnly ? "No messages for the current accounts." : "Inbox is empty.");
       const result = textResult(
         messages
@@ -382,7 +544,8 @@ registerTool(
           })
           .join("\n\n"),
       );
-      return { ...result, structuredContent: { messages: messages.map((record) => ({ ...record, forwarding: replyForwarder.read(record.inReplyTo ?? record.msgId) ?? record.forwardingError ?? null })), remaining: peer.inbox.length } };
+      const remaining = peer.inbox.filter((record) => recordVisible(record, accounts)).length;
+      return { ...result, structuredContent: { messages: messages.map((record) => ({ ...record, forwarding: replyForwarder.read(record.inReplyTo ?? record.msgId) ?? record.forwardingError ?? null })), remaining } };
     } catch (err) {
       return failure(err);
     }
@@ -407,10 +570,18 @@ registerTool(
     try {
       const session = findClaudeSession(target, { desktopOnly });
       if (!session) return textResult(`No live Claude session matches "${target}".`, true);
+      const transcriptRoot = rootPolicy.enabled ? rootPolicy.capture(session.cwd, "Claude transcript working directory") : null;
+      assertSessionRoot(session);
       if (desktopOnly) {
         const verified = withDesktopContext(session);
         if (verified.desktop?.status !== "matched") throw preflightFailure("CLAUDE_DESKTOP_TASK_UNVERIFIED", verified.desktop?.reason ?? "This task is not in the signed-in Claude account.");
       }
+      if (transcriptRoot) {
+        const current = findClaudeSession(session.sessionId ?? String(session.pid), { desktopOnly });
+        if (!current || current.pid !== session.pid || current.socket !== session.socket) throw new Error("The Claude transcript target changed before it could be read");
+        rootPolicy.recheck(transcriptRoot, "Claude transcript working directory");
+        if (desktopOnly) assertClaudeSessionProcess(current);
+      }
       const { file, messages } = readTranscript(session.sessionId, session.cwd, limit ?? 10);
       if (!messages.length) return textResult(`No transcript entries found (looked at ${file}).`);
       const body = messages.map((m) => `[${m.role}] ${m.text}`).join("\n\n");
@@ -474,7 +645,11 @@ registerTool(
       const sessions = listClaudeSessions().filter((s) => s.pid !== process.pid);
       const accounts = readBridgeAccounts();
       const eligible = sessions.filter((session) => !desktopOnly || session.entrypoint === "claude-desktop")
+        .filter((session) => !rootPolicy.enabled || rootPolicy.allows(session.cwd))
         .filter((session) => !desktopOnly || withDesktopContext(session, accounts.claude).desktop?.status === "matched");
+      const visibleInbox = peer.inbox.filter((record) => recordVisible(record, accounts));
+      const visiblePending = [...peer.pendingMessages.keys()].filter((id) => readReceipt(id));
+      const visibleForwarding = replyForwarder.status((record) => recordVisible(record, accounts));
       const sender = desktopOnly ? readCodexSenderContext(extra?._meta) : null;
       const lines = [
         `platform:      ${PLATFORM_LABEL} (${process.platform}/${process.arch})`,
@@ -489,17 +664,17 @@ registerTool(
         `Claude account: ${accounts.claude.status}${accounts.claude.fingerprint ? ` (${accounts.claude.fingerprint.slice(0, 12)})` : ` - ${accounts.claude.reason}`}`,
         `Codex account: ${accounts.codex.status}${accounts.codex.fingerprint ? ` (${accounts.codex.fingerprint.slice(0, 12)})` : ` - ${accounts.codex.reason}`}`,
         `live sessions: ${eligible.length}`,
-        `excluded:      ${sessions.length - eligible.length} non-Desktop or inactive-account session(s)`,
+        ...(rootPolicy.enabled ? [] : [`excluded:      ${sessions.length - eligible.length} non-Desktop or inactive-account session(s)`]),
         `relay thread:  ${forwarding.threadId ?? "(none - use bind_codex_thread)"}`,
         `delivery:      ${delivery.describe()}`,
-        `inbox:         ${peer.inbox.length} pending message(s)`,
-        `outstanding:   ${peer.pendingMessages.size} message(s) awaiting receipt or reply`,
-        `reply forwarding: ${JSON.stringify(replyForwarder.status())}`,
-        ...[...peer.pendingMessages.keys()].map((id) => `pending message: ${id} (${peer.readDelivery(id)?.status ?? "sent_unconfirmed"})`),
+        `inbox:         ${visibleInbox.length} pending message(s)`,
+        `outstanding:   ${visiblePending.length} message(s) awaiting receipt or reply`,
+        `reply forwarding: ${JSON.stringify(visibleForwarding)}`,
+        ...visiblePending.map((id) => `pending message: ${id} (${peer.readDelivery(id)?.status ?? "sent_unconfirmed"})`),
       ];
       const state = runtime.status();
       lines.push(`runtime pid:   ${state.pid}`, `loaded source: ${state.revision}`, `disk source:   ${state.diskRevision ?? "unreadable"}`, `runtime state: ${state.current ? "current" : `STALE - ${state.reason}; reconnect this MCP server in the existing task`}`);
-      return { ...textResult(lines.join("\n"), !state.current), structuredContent: { runtime: state, accounts: { claude: publicAccountState(accounts.claude), codex: publicAccountState(accounts.codex) }, replyForwarding: replyForwarder.status(), ...(sender ? { sender } : {}) } };
+      return { ...textResult(lines.join("\n"), !state.current), structuredContent: { runtime: state, accounts: { claude: publicAccountState(accounts.claude), codex: publicAccountState(accounts.codex) }, replyForwarding: visibleForwarding, ...(sender ? { sender } : {}) } };
     } catch (err) {
       return failure(err);
     }

package/src/claude-desktop-context.mjs

@@ -133,22 +133,11 @@ export function readClaudeDesktopContext(session, { platform = process.platform,
       (typeof session.bridgeSessionId !== "string" || !session.bridgeSessionId.trim())) {
     return result("mismatch", "The live Claude bridge session identity is invalid.");
   }
-  const directory = root ?? (account ? path.join(account.root, "claude-code-sessions") : sessionsRoot(platform, env));
   let records;
   try {
+    const directory = root ?? (account ? path.join(account.root, "claude-code-sessions") : sessionsRoot(platform, env));
     if (!fs.existsSync(directory)) return result("missing", "Claude Desktop task metadata is not available on this host.");
-    const files = metadataFiles(directory, account?.accountId);
-    const budget = { bytes: 0, versions: new Map(), contents: new Map() };
-    records = files.map((file) => readMetadata(file, budget));
-    const currentFiles = metadataFiles(directory, account?.accountId);
-    if (files.length !== currentFiles.length || files.some((file, index) => file !== currentFiles[index])) {
-      return result("mismatch", "Claude Desktop task metadata changed during inspection; inspect the existing task again.");
-    }
-    for (const file of files) {
-      const current = fs.lstatSync(file);
-      if (!current.isFile() || !sameVersion(current, budget.versions.get(file))) throw new Error("metadata changed");
-      if (!rereadMetadata(file).equals(budget.contents.get(file))) throw new Error("metadata changed");
-    }
+    records = readClaudeDesktopTasks({ platform, env, root, account });
   } catch {
     return result("mismatch", "Claude Desktop task metadata could not be read completely and consistently; no task identity is confirmed.");
   }
@@ -202,3 +191,20 @@ export function readClaudeDesktopContext(session, { platform = process.platform,
     accountFingerprint: account?.fingerprint,
   });
 }
+
+export function readClaudeDesktopTasks({ platform = process.platform, env = process.env, root, account } = {}) {
+  if (account !== undefined && (account.status !== "verified" || !ACCOUNT_ID.test(account.accountId ?? "") || !account.root)) {
+    throw new Error("Claude Desktop account is not verified");
+  }
+  const directory = root ?? (account ? path.join(account.root, "claude-code-sessions") : sessionsRoot(platform, env));
+  const files = metadataFiles(directory, account?.accountId);
+  const budget = { bytes: 0, versions: new Map(), contents: new Map() };
+  const records = files.map((file) => readMetadata(file, budget));
+  const currentFiles = metadataFiles(directory, account?.accountId);
+  if (files.length !== currentFiles.length || files.some((file, index) => file !== currentFiles[index])) throw new Error("metadata changed");
+  for (const file of files) {
+    const current = fs.lstatSync(file);
+    if (!current.isFile() || !sameVersion(current, budget.versions.get(file)) || !rereadMetadata(file).equals(budget.contents.get(file))) throw new Error("metadata changed");
+  }
+  return records;
+}