@minhspark/codex-mcp-bridge 1.16.0 → 1.16.1

package/src/turn.mjs

@@ -1,9 +1,11 @@
+import crypto from "node:crypto";
+
 const TERMINAL_STATUSES = new Set(["completed", "interrupted", "failed"]);
 
 function summarizeItem(item) {
   switch (item?.type) {
     case "agentMessage":
-      return { kind: "agentMessage", text: item.text ?? "" };
+      return { kind: "agentMessage", id: item.id ?? null, text: item.text ?? "" };
     case "commandExecution":
       return {
         kind: "command",
@@ -32,9 +34,11 @@ function summarizeItem(item) {
  */
 export async function runTurn(client, { threadId, input, timeoutMs = 240000, turnOverrides = {} }) {
   const messages = [];
+  const assistantItems = [];
   const activity = [];
   const errors = [];
   const buffered = [];
+  const completedItems = new Map();
   let turnId = null;
   let settled = false;
   let resolveDone;
@@ -56,6 +60,7 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
   const process = (msg) => {
     if (settled) return;
     const params = msg.params ?? {};
+    if (params.threadId !== undefined && params.threadId !== threadId) return;
     if (turnId && params.turnId && params.turnId !== turnId) return;
 
     switch (msg.method) {
@@ -65,10 +70,25 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
         return;
       }
       case "item/completed": {
+        if (!turnId || params.turnId !== turnId) return;
         const summary = summarizeItem(params.item);
         if (!summary) return;
+        const itemId = params.item?.id;
+        if (typeof itemId !== "string" || !itemId.trim()) return;
+        const fingerprint = JSON.stringify(summary);
+        if (completedItems.has(itemId)) {
+          if (completedItems.get(itemId) !== fingerprint && !settled) {
+            settled = true;
+            resolveDone({ status: "failed", error: { message: `Conflicting duplicate item ${itemId}` } });
+          }
+          return;
+        }
+        completedItems.set(itemId, fingerprint);
         if (summary.kind === "agentMessage") {
-          if (summary.text.trim()) messages.push(summary.text);
+          if (summary.text.trim()) {
+            messages.push(summary.text);
+            assistantItems.push({ id: itemId, text: summary.text });
+          }
         } else {
           activity.push(summary);
         }
@@ -86,6 +106,9 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
         const turn = params.turn ?? {};
         if (turnId && turn.id && turn.id !== turnId) return;
         if (!TERMINAL_STATUSES.has(turn.status)) return;
+        if (Array.isArray(turn.items)) {
+          for (const item of turn.items) process({ method: "item/completed", params: { threadId, turnId, item } });
+        }
         if (settled) return;
         settled = true;
         resolveDone({ status: turn.status, error: turn.error ?? null, durationMs: turn.durationMs ?? null });
@@ -135,18 +158,27 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
         throw new Error("Codex app-server did not return a turn id for turn/start");
       }
       for (const msg of buffered.splice(0)) process(msg);
+      if (Array.isArray(start.started?.turn?.items)) {
+        for (const item of start.started.turn.items) process({ method: "item/completed", params: { threadId, turnId, item } });
+      }
       if (TERMINAL_STATUSES.has(start.started?.turn?.status)) {
         process({ method: "turn/completed", params: { turn: start.started.turn } });
       }
       outcome = await done;
     }
+    const completedReply = outcome.status === "completed";
+    const text = completedReply ? messages.join("\n\n") : "";
+    const returnedItems = completedReply ? assistantItems : [];
     return {
       threadId,
       turnId,
       status: outcome.status,
       error: outcome.error,
       durationMs: outcome.durationMs ?? null,
-      text: messages.join("\n\n").trim(),
+      text,
+      responseStatus: completedReply ? (returnedItems.length ? "completed" : "completed_no_reply") : "unavailable",
+      assistantItems: returnedItems,
+      replySha256: completedReply ? crypto.createHash("sha256").update(text.replace(/\r\n?/g, "\n").normalize("NFC"), "utf8").digest("hex") : null,
       activity,
       errors,
     };

package/src/windows-pipe-acl.mjs

@@ -0,0 +1,27 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { IS_WINDOWS } from "./platform.mjs";
+
+const execFile = promisify(execFileCallback);
+const powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+
+export function bridgePipeName(socketPath) {
+  const prefix = "\\\\.\\pipe\\";
+  if (typeof socketPath !== "string" || !socketPath.startsWith(prefix)) throw new Error("A Windows ACL may only protect a named pipe");
+  return socketPath.slice(prefix.length);
+}
+
+export async function protectCurrentUserPipe(socketPath, { pid = process.pid, run = execFile } = {}) {
+  if (!IS_WINDOWS) return { skipped: true };
+  const name = bridgePipeName(socketPath);
+  const script = fileURLToPath(new URL("./windows-pipe-acl.ps1", import.meta.url));
+  const { stdout } = await run(powershell, ["-NoProfile", "-NonInteractive", "-File", script, "-PipeName", name, "-ServerPid", String(pid)], { windowsHide: true, timeout: 15000 });
+  let result;
+  try { result = JSON.parse(stdout.trim()); } catch { throw new Error("Windows pipe ACL helper returned invalid readback"); }
+  if (result?.serverMatches !== true || result?.serverUserMatches !== true || result?.ownerMatches !== true || result?.protected !== true || result?.aceCount !== 1
+      || result?.rights !== 2032031 || result?.anonymousDenied !== true || result?.readError !== 5 || result?.duplexError !== 5) {
+    throw new Error("Windows pipe ACL readback did not prove exact current-user FullControl and anonymous denial");
+  }
+  return result;
+}

package/src/windows-pipe-acl.ps1

@@ -0,0 +1,85 @@
+param([Parameter(Mandatory)][string]$PipeName,[Parameter(Mandatory)][uint32]$ServerPid)
+$ErrorActionPreference='Stop'
+if($PipeName -notmatch '^LOCAL\\(?:codex-native-relay|codex-bridge|cc-msg)-[A-Za-z0-9_.-]+$'){throw 'Refusing a pipe outside the bridge-owned namespace.'}
+Add-Type @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using Microsoft.Win32.SafeHandles;
+public sealed class BridgeServerIdentity : IDisposable {
+ [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, uint pid);
+ [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool OpenProcessToken(IntPtr process, uint access, out IntPtr token);
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool GetTokenInformation(IntPtr token, int kind, IntPtr buffer, uint length, out uint required);
+ IntPtr process;
+ public string User { get; private set; }
+ public string Owner { get; private set; }
+ static string ReadSid(IntPtr token, int kind) {
+  uint required;
+  if(GetTokenInformation(token, kind, IntPtr.Zero, 0, out required) || Marshal.GetLastWin32Error()!=122 || required<IntPtr.Size || required>65536) throw new Win32Exception(Marshal.GetLastWin32Error());
+  IntPtr buffer=Marshal.AllocHGlobal((int)required);
+  try {
+   if(!GetTokenInformation(token, kind, buffer, required, out required)) throw new Win32Exception(Marshal.GetLastWin32Error());
+   return new SecurityIdentifier(Marshal.ReadIntPtr(buffer)).Value;
+  } finally { Marshal.FreeHGlobal(buffer); }
+ }
+ public BridgeServerIdentity(uint pid) {
+  process=OpenProcess(0x1000, false, pid);
+  if(process==IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error());
+  IntPtr token=IntPtr.Zero;
+  try {
+   if(!OpenProcessToken(process, 8, out token)) throw new Win32Exception(Marshal.GetLastWin32Error());
+   User=ReadSid(token, 1);
+   Owner=ReadSid(token, 4);
+  } catch { Dispose(); throw; }
+  finally { if(token!=IntPtr.Zero) CloseHandle(token); }
+ }
+ public void Dispose() { if(process!=IntPtr.Zero) { CloseHandle(process); process=IntPtr.Zero; } }
+}
+public static class BridgePipeAcl {
+ [DllImport("kernel32.dll")] static extern IntPtr GetCurrentThread();
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool ImpersonateAnonymousToken(IntPtr thread);
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool RevertToSelf();
+ [DllImport("kernel32.dll", SetLastError=true)] public static extern bool GetNamedPipeServerProcessId(SafePipeHandle pipe, out uint pid);
+ [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern SafeFileHandle CreateFile(string name,uint access,uint share,IntPtr sa,uint creation,uint flags,IntPtr template);
+ public static int AttemptAnonymous(string name,uint access) {
+  if(!ImpersonateAnonymousToken(GetCurrentThread())) throw new Win32Exception(Marshal.GetLastWin32Error());
+  try {
+   using(var handle=CreateFile(name,access,0,IntPtr.Zero,3,0,IntPtr.Zero)) {
+    int error=Marshal.GetLastWin32Error();
+    return handle.IsInvalid ? error : 0;
+   }
+  } finally {
+   if(!RevertToSelf()) Environment.FailFast("Could not end anonymous pipe ACL verification.");
+  }
+ }
+}
+'@
+$pipe=New-Object System.IO.Pipes.NamedPipeClientStream('.', $PipeName, [System.IO.Pipes.PipeAccessRights]::FullControl, [System.IO.Pipes.PipeOptions]::None, [System.Security.Principal.TokenImpersonationLevel]::Identification, [System.IO.HandleInheritability]::None)
+$serverIdentity=$null
+try {
+ $pipe.Connect(3000)
+ [uint32]$actualPid=0
+ if(-not [BridgePipeAcl]::GetNamedPipeServerProcessId($pipe.SafePipeHandle,[ref]$actualPid) -or $actualPid -ne $ServerPid){throw 'Pipe server identity mismatch.'}
+ $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User
+ $serverIdentity=New-Object BridgeServerIdentity($actualPid)
+ if($serverIdentity.User -ne $sid.Value){throw 'Pipe server token user is not current user.'}
+ $before=$pipe.GetAccessControl()
+ $owner=$before.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+ if($owner -ne $sid.Value -and $owner -ne $serverIdentity.Owner){throw 'Pipe owner does not match the verified server token.'}
+ $acl=New-Object System.IO.Pipes.PipeSecurity
+ $acl.SetOwner($sid)
+ $acl.SetAccessRuleProtection($true,$false)
+ $acl.AddAccessRule((New-Object System.IO.Pipes.PipeAccessRule($sid,[System.IO.Pipes.PipeAccessRights]::FullControl,[System.Security.AccessControl.AccessControlType]::Allow)))
+ $pipe.SetAccessControl($acl)
+ if(-not [BridgePipeAcl]::GetNamedPipeServerProcessId($pipe.SafePipeHandle,[ref]$actualPid) -or $actualPid -ne $ServerPid){throw 'Pipe server identity changed.'}
+ $after=$pipe.GetAccessControl(); $rules=@($after.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))
+ if($after.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value){throw 'Restricted owner readback mismatch.'}
+ if(-not $after.AreAccessRulesProtected -or $rules.Count -ne 1 -or $rules[0].IsInherited -or $rules[0].IdentityReference.Value -ne $sid.Value -or $rules[0].AccessControlType -ne 'Allow' -or $rules[0].PipeAccessRights -ne [System.IO.Pipes.PipeAccessRights]::FullControl){throw 'Restricted DACL readback mismatch.'}
+ $nativeName='\\.\pipe\'+$PipeName
+ $readError=[BridgePipeAcl]::AttemptAnonymous($nativeName,[uint32]2147483648)
+ $duplexError=[BridgePipeAcl]::AttemptAnonymous($nativeName,[uint32]3221225472)
+ if($readError -ne 5 -or $duplexError -ne 5){throw "Anonymous pipe access was not denied: read=$readError duplex=$duplexError"}
+ [pscustomobject]@{serverMatches=$true;serverUserMatches=$true;ownerMatches=$true;protected=$true;aceCount=1;rights=[int]$rules[0].PipeAccessRights;anonymousDenied=$true;readError=$readError;duplexError=$duplexError}|ConvertTo-Json -Compress
+} finally {if($null -ne $serverIdentity){$serverIdentity.Dispose()};$pipe.Dispose()}