@minhspark/codex-mcp-bridge 1.16.0 → 1.17.0

package/src/turn.mjs

@@ -1,9 +1,11 @@
+import crypto from "node:crypto";
+
 const TERMINAL_STATUSES = new Set(["completed", "interrupted", "failed"]);
 
 function summarizeItem(item) {
   switch (item?.type) {
     case "agentMessage":
-      return { kind: "agentMessage", text: item.text ?? "" };
+      return { kind: "agentMessage", id: item.id ?? null, text: item.text ?? "" };
     case "commandExecution":
       return {
         kind: "command",
@@ -32,9 +34,11 @@ function summarizeItem(item) {
  */
 export async function runTurn(client, { threadId, input, timeoutMs = 240000, turnOverrides = {} }) {
   const messages = [];
+  const assistantItems = [];
   const activity = [];
   const errors = [];
   const buffered = [];
+  const completedItems = new Map();
   let turnId = null;
   let settled = false;
   let resolveDone;
@@ -56,6 +60,7 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
   const process = (msg) => {
     if (settled) return;
     const params = msg.params ?? {};
+    if (params.threadId !== undefined && params.threadId !== threadId) return;
     if (turnId && params.turnId && params.turnId !== turnId) return;
 
     switch (msg.method) {
@@ -65,10 +70,25 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
         return;
       }
       case "item/completed": {
+        if (!turnId || params.turnId !== turnId) return;
         const summary = summarizeItem(params.item);
         if (!summary) return;
+        const itemId = params.item?.id;
+        if (typeof itemId !== "string" || !itemId.trim()) return;
+        const fingerprint = JSON.stringify(summary);
+        if (completedItems.has(itemId)) {
+          if (completedItems.get(itemId) !== fingerprint && !settled) {
+            settled = true;
+            resolveDone({ status: "failed", error: { message: `Conflicting duplicate item ${itemId}` } });
+          }
+          return;
+        }
+        completedItems.set(itemId, fingerprint);
         if (summary.kind === "agentMessage") {
-          if (summary.text.trim()) messages.push(summary.text);
+          if (summary.text.trim()) {
+            messages.push(summary.text);
+            assistantItems.push({ id: itemId, text: summary.text });
+          }
         } else {
           activity.push(summary);
         }
@@ -86,6 +106,9 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
         const turn = params.turn ?? {};
         if (turnId && turn.id && turn.id !== turnId) return;
         if (!TERMINAL_STATUSES.has(turn.status)) return;
+        if (Array.isArray(turn.items)) {
+          for (const item of turn.items) process({ method: "item/completed", params: { threadId, turnId, item } });
+        }
         if (settled) return;
         settled = true;
         resolveDone({ status: turn.status, error: turn.error ?? null, durationMs: turn.durationMs ?? null });
@@ -135,18 +158,27 @@ export async function runTurn(client, { threadId, input, timeoutMs = 240000, tur
         throw new Error("Codex app-server did not return a turn id for turn/start");
       }
       for (const msg of buffered.splice(0)) process(msg);
+      if (Array.isArray(start.started?.turn?.items)) {
+        for (const item of start.started.turn.items) process({ method: "item/completed", params: { threadId, turnId, item } });
+      }
       if (TERMINAL_STATUSES.has(start.started?.turn?.status)) {
         process({ method: "turn/completed", params: { turn: start.started.turn } });
       }
       outcome = await done;
     }
+    const completedReply = outcome.status === "completed";
+    const text = completedReply ? messages.join("\n\n") : "";
+    const returnedItems = completedReply ? assistantItems : [];
     return {
       threadId,
       turnId,
       status: outcome.status,
       error: outcome.error,
       durationMs: outcome.durationMs ?? null,
-      text: messages.join("\n\n").trim(),
+      text,
+      responseStatus: completedReply ? (returnedItems.length ? "completed" : "completed_no_reply") : "unavailable",
+      assistantItems: returnedItems,
+      replySha256: completedReply ? crypto.createHash("sha256").update(text.replace(/\r\n?/g, "\n").normalize("NFC"), "utf8").digest("hex") : null,
       activity,
       errors,
     };

package/src/vscode-bridge.mjs

@@ -0,0 +1,162 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { VSCodeIpc } from "./vscode-ipc.mjs";
+import { classifyClaudeDelivery, classifyCodexCompletion } from "./vscode-delivery.mjs";
+import { findRollout, readState, readCodexSenderContext } from "./codex-sender-context.mjs";
+import { readProcessAncestry } from "./claude-sender-context.mjs";
+import { listClaudeSessions, assertClaudeSessionCwd, assertClaudeSessionProcess, PeerEndpoint } from "./peer-protocol.mjs";
+import { readClaudeInboundPolicy } from "./claude-inbound-policy.mjs";
+
+const host = process.argv[2];
+if (!["claude", "codex"].includes(host)) throw new Error("Specify the calling extension: claude or codex");
+if (process.platform !== "win32") throw new Error("VS Code bridge preview currently supports Windows only");
+const roots = (process.env.VSCODE_BRIDGE_ALLOWED_ROOTS ?? "").split(path.delimiter).filter(Boolean).map((root) => fs.realpathSync.native(root));
+if (!roots.length || roots.some((root) => path.parse(root).root === root)) throw new Error("Configure explicit project roots in VSCODE_BRIDGE_ALLOWED_ROOTS");
+const sessions = path.join(process.env.CODEX_HOME || path.join(os.homedir(), ".codex"), "sessions");
+const peer = new PeerEndpoint({ name: "codex-vscode-bridge" });
+const unresolved = new Map();
+const deliveryOwners = new Map();
+const result = (value, isError = false) => ({ content: [{ type: "text", text: JSON.stringify(value) }], isError });
+const samePath = (left, right) => path.relative(fs.realpathSync.native(left), fs.realpathSync.native(right)) === "";
+
+function assertRoot(cwd) {
+  const resolved = fs.realpathSync.native(cwd);
+  if (!roots.some((root) => {
+    const relative = path.relative(root, resolved);
+    return !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`);
+  })) throw new Error("The session is outside the configured project roots");
+  return resolved;
+}
+
+async function caller(meta) {
+  if (host === "codex") {
+    const sender = readCodexSenderContext(meta, { originator: "codex_vscode" });
+    if (sender.status !== "verified") throw new Error(sender.reason);
+    assertRoot(sender.cwd);
+    return sender;
+  }
+  const ancestry = await readProcessAncestry();
+  const matches = listClaudeSessions().filter((session) => session.entrypoint === "claude-vscode" && ancestry.some((row) => row.pid === session.pid && row.processStart === session.processStart));
+  if (matches.length !== 1) throw new Error("This MCP server must be launched by one live Claude Code VS Code session");
+  assertClaudeSessionProcess(matches[0]);
+  assertRoot(matches[0].cwd);
+  return matches[0];
+}
+
+function codexTask(threadId, cwd) {
+  if (!/^[0-9a-f-]{36}$/.test(threadId)) throw new Error("Invalid task ID");
+  const file = findRollout(sessions, threadId);
+  const state = readState(file, 64 * 1024 * 1024);
+  if (state.session?.id !== threadId || state.session.originator !== "codex_vscode" || state.session.source !== "vscode") throw new Error("The target is not a Codex VS Code task");
+  assertRoot(state.session.cwd);
+  if (!samePath(state.session.cwd, cwd) || !samePath(state.context.cwd, cwd)) throw new Error("Target and caller must use the same project directory");
+  return { ...state, file };
+}
+
+function taskCandidates(cwd) {
+  const queue = [{ directory: sessions, depth: 0 }];
+  const rows = [];
+  let count = 0;
+  while (queue.length) {
+    const { directory, depth } = queue.pop();
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (++count > 100000) throw new Error("Session scan limit exceeded");
+      if (entry.isSymbolicLink()) continue;
+      const file = path.join(directory, entry.name);
+      if (depth < 3 && entry.isDirectory() && /^\d{2,4}$/.test(entry.name)) queue.push({ directory: file, depth: depth + 1 });
+      if (depth !== 3 || !entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
+      const fd = fs.openSync(file, "r");
+      let first;
+      try { const data = Buffer.alloc(65536); const size = fs.readSync(fd, data); first = JSON.parse(data.subarray(0, size).toString("utf8").split("\n")[0]); }
+      catch { continue; }
+      finally { fs.closeSync(fd); }
+      const session = first.payload;
+      if (first.type === "session_meta" && session?.originator === "codex_vscode" && session.source === "vscode" && samePath(session.cwd, cwd)) rows.push({ threadId: session.id, cwd: session.cwd });
+    }
+  }
+  return rows.slice(-50);
+}
+
+const server = new McpServer({ name: `vscode-${host}-bridge`, version: "0.1.0" });
+function tool(name, description, inputSchema, action) {
+  server.registerTool(name, { description, inputSchema }, async (args, extra) => {
+    try { return result(await action(args, await caller(extra?._meta), extra?._meta)); }
+    catch (error) { return result({ error: error.message, ...(error.msgId ? { msgId: error.msgId } : {}), ...(error.delivery ? { delivery: error.delivery } : {}) }, true); }
+  });
+}
+
+tool("vscode_bridge_status", "Verify this extension caller and list same-project counterparts in VS Code. Desktop sessions are excluded.", {}, async (_, sender) => {
+  if (host === "codex") return { host, cwd: sender.cwd, sessions: listClaudeSessions().filter((session) => session.entrypoint === "claude-vscode" && samePath(session.cwd, sender.cwd)).map(({ sessionId, cwd }) => ({ sessionId, cwd })) };
+  const ipc = await new VSCodeIpc().connect();
+  try {
+    const tasks = [];
+    for (const candidate of taskCandidates(sender.cwd)) {
+      try { await ipc.owner(candidate.threadId); tasks.push(candidate); } catch {}
+    }
+    return { host, cwd: sender.cwd, tasks };
+  } finally { ipc.close(); }
+});
+
+if (host === "claude") {
+  tool("send_to_codex_vscode", "Send to an existing Codex extension task in this project, preserving its selected permissions. Never retries or opens another app. Use read_codex_vscode_reply after submission.", { threadId: z.string(), message: z.string().min(1).max(50000) }, async ({ threadId, message }, sender, meta) => {
+    if (unresolved.has(threadId)) throw new Error("An earlier send is unresolved. Read its reply before sending again.");
+    const inspect = () => {
+      const state = codexTask(threadId, sender.cwd);
+      if (!["task_complete", "task_completed", "turn_complete", "turn_completed", "turn_aborted", "task_aborted"].includes(state.lifecycle?.type)) throw new Error("The target is busy or its lifecycle is unknown; wait for it to finish");
+    };
+    inspect();
+    const ipc = await new VSCodeIpc().connect();
+    try {
+      return await ipc.send(threadId, message, { beforeSend: async () => {
+        const current = await caller(meta);
+        if (current.sessionId !== sender.sessionId || current.processStart !== sender.processStart) throw new Error("Caller session changed");
+        inspect();
+        if (unresolved.has(threadId)) throw new Error("Another send is already pending for this task");
+        unresolved.set(threadId, "submission outcome unknown");
+      } }).then((receipt) => { unresolved.set(threadId, receipt.turnId); return receipt; });
+    } finally { ipc.close(); }
+  });
+  tool("read_codex_vscode_reply", "Read completion of the exact returned turn ID. A submission receipt alone does not prove completion.", { threadId: z.string(), turnId: z.string() }, async ({ threadId, turnId }, sender) => {
+    const state = codexTask(threadId, sender.cwd);
+    const completion = classifyCodexCompletion(state.lifecycle, turnId);
+    if (["completed", "failed", "interrupted"].includes(completion.status) && unresolved.get(threadId) === turnId) unresolved.delete(threadId);
+    return { threadId, ...completion };
+  });
+} else {
+  tool("send_to_claude_vscode", "Send to the exact Claude Code VS Code session in this project. Never changes recipient permissions. Do not ask the recipient to call back while this synchronous request waits.", { sessionId: z.string(), message: z.string().min(1).max(50000), waitSec: z.number().int().min(0).max(45).default(30) }, async ({ sessionId, message, waitSec }, sender, meta) => {
+    const inspect = () => {
+      const matches = listClaudeSessions().filter((session) => session.entrypoint === "claude-vscode" && session.sessionId === sessionId);
+      if (matches.length !== 1) throw new Error("No unique live Claude Code VS Code session matches");
+      const session = matches[0];
+      assertClaudeSessionCwd(session, sender.cwd);
+      assertClaudeSessionProcess(session);
+      const policy = readClaudeInboundPolicy(session.cwd);
+      if (["hold", "refuse"].includes(policy.value)) throw new Error(`Recipient crossSessionInbound is ${policy.value}; no message sent`);
+      return session;
+    };
+    const recipient = inspect();
+    await peer.start();
+    const receipt = await peer.sendAndWait(recipient.socket, message, { timeoutMs: waitSec * 1000, permissionMode: sender.mode, transcriptSession: { sessionId, cwd: recipient.cwd }, beforeSend: async () => {
+      const current = await caller(meta);
+      if (current.turnId !== sender.turnId || current.mode !== sender.mode) throw new Error("Caller turn or permissions changed");
+      const target = inspect();
+      if (target.pid !== recipient.pid || target.socket !== recipient.socket || target.processStart !== recipient.processStart) throw new Error("Recipient session changed");
+    } }).catch((error) => {
+      if (error.msgId) deliveryOwners.set(error.msgId, sender.threadId);
+      throw error;
+    });
+    deliveryOwners.set(receipt.msgId, sender.threadId);
+    return classifyClaudeDelivery(receipt, sender.mode);
+  });
+  tool("read_claude_vscode_delivery", "Inspect an earlier send without resending it.", { msgId: z.string() }, async ({ msgId }, sender) => {
+    if (deliveryOwners.get(msgId) !== sender.threadId) throw new Error("This receipt does not belong to the calling task");
+    return peer.readDelivery(msgId) ?? { status: "unknown" };
+  });
+}
+
+process.on("exit", () => peer.stop());
+await server.connect(new StdioServerTransport());

package/src/vscode-delivery.mjs

@@ -0,0 +1,19 @@
+const BLOCKED = new Set(["held", "refused", "denied", "expired", "dropped"]);
+
+export function classifyClaudeDelivery(receipt, senderMode) {
+  if (receipt.reply) return { ...receipt, status: "reply_received" };
+  const status = receipt.delivery?.status ?? "sent_unconfirmed";
+  if (BLOCKED.has(status)) {
+    throw Object.assign(new Error(`Claude returned ${status}: ${receipt.delivery.reason ?? "the message was not delivered to the conversation"}. Sender permission class: ${senderMode}. This does not prove an approval control exists in the VS Code extension. Report the receipt to the user; do not resend, change permissions, or claim that the user can click an unverified approval button.`), { msgId: receipt.msgId, delivery: receipt.delivery });
+  }
+  return { ...receipt, status };
+}
+
+export function classifyCodexCompletion(lifecycle, turnId) {
+  if (lifecycle?.turn_id !== turnId) return { status: "pending_or_unavailable", turnId };
+  if (["turn_aborted", "task_aborted"].includes(lifecycle.type)) return { status: "interrupted", turnId };
+  if (!["task_complete", "task_completed", "turn_complete", "turn_completed"].includes(lifecycle.type)) return { status: "pending_or_unavailable", turnId };
+  if (lifecycle.error) return { status: "failed", turnId, error: lifecycle.error };
+  if (typeof lifecycle.last_agent_message !== "string") return { status: "response_unavailable", turnId };
+  return { status: "completed", turnId, text: lifecycle.last_agent_message };
+}

package/src/vscode-ipc.mjs

@@ -0,0 +1,80 @@
+import net from "node:net";
+import { randomUUID } from "node:crypto";
+
+export class VSCodeIpc {
+  constructor({ socketPath = "\\\\.\\pipe\\codex-ipc", timeoutMs = 10000 } = {}) {
+    this.socketPath = socketPath;
+    this.timeoutMs = timeoutMs;
+    this.pending = new Map();
+    this.buffer = Buffer.alloc(0);
+  }
+
+  async connect() {
+    this.socket = net.createConnection(this.socketPath);
+    this.socket.on("data", (data) => {
+      try {
+        this.buffer = Buffer.concat([this.buffer, data]);
+        while (this.buffer.length >= 4) {
+          const length = this.buffer.readUInt32LE(0);
+          if (!length || length > 16 * 1024 * 1024) throw new Error("Invalid IPC frame length");
+          if (this.buffer.length < length + 4) break;
+          const frame = JSON.parse(this.buffer.subarray(4, length + 4).toString("utf8"));
+          this.buffer = this.buffer.subarray(length + 4);
+          if (frame.type !== "response") continue;
+          const pending = this.pending.get(frame.requestId);
+          if (!pending) continue;
+          this.pending.delete(frame.requestId);
+          clearTimeout(pending.timer);
+          if (frame.resultType !== "success") pending.reject(new Error(`IPC ${pending.method}: ${frame.error ?? "request failed"}`));
+          else if (pending.target && frame.handledByClientId !== pending.target) pending.reject(new Error("IPC owner changed"));
+          else pending.resolve(frame);
+        }
+      } catch (error) { this.close(error); }
+    });
+    this.socket.on("error", (error) => this.close(error));
+    this.socket.on("close", () => this.close(new Error("IPC connection closed")));
+    const response = await this.request("initialize", { clientType: "codex-mcp-bridge" }, 0);
+    if (typeof response.result?.clientId !== "string") throw new Error("IPC initialization omitted client identity");
+    this.clientId = response.result.clientId;
+    return this;
+  }
+
+  request(method, params, version = 1, target) {
+    return new Promise((resolve, reject) => {
+      const requestId = randomUUID();
+      const timer = setTimeout(() => {
+        this.pending.delete(requestId);
+        reject(new Error(`IPC ${method} timed out; inspect the original task before retrying a send`));
+      }, this.timeoutMs);
+      this.pending.set(requestId, { resolve, reject, timer, method, target });
+      const body = Buffer.from(JSON.stringify({ type: "request", requestId, sourceClientId: this.clientId ?? "initializing-client", version, method, params, ...(target ? { targetClientId: target } : {}) }));
+      const header = Buffer.alloc(4);
+      header.writeUInt32LE(body.length);
+      this.socket.write(Buffer.concat([header, body]));
+    });
+  }
+
+  async owner(threadId) {
+    const response = await this.request("thread-owner-discovery", { hostId: "local", conversationId: threadId });
+    if (!response.handledByClientId) throw new Error("No live owner for this task");
+    return response.handledByClientId;
+  }
+
+  async send(threadId, message, { beforeSend } = {}) {
+    const owner = await this.owner(threadId);
+    await beforeSend?.();
+    const response = await this.request("thread-follower-start-turn", {
+      conversationId: threadId,
+      turnStart: { request: { threadId, input: [{ type: "text", text: message, text_elements: [] }] }, context: { inheritThreadSettings: true } },
+    }, 2, owner);
+    const turnId = response.result?.result?.turn?.id;
+    if (typeof turnId !== "string") throw new Error("Submission was acknowledged without a turn ID; inspect the original task before retrying");
+    return { threadId, turnId, owner, status: "submitted" };
+  }
+
+  close(error = new Error("IPC client closed")) {
+    this.socket?.destroy();
+    for (const entry of this.pending.values()) { clearTimeout(entry.timer); entry.reject(error); }
+    this.pending.clear();
+  }
+}

package/src/windows-pipe-acl.mjs

@@ -0,0 +1,27 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { IS_WINDOWS } from "./platform.mjs";
+
+const execFile = promisify(execFileCallback);
+const powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+
+export function bridgePipeName(socketPath) {
+  const prefix = "\\\\.\\pipe\\";
+  if (typeof socketPath !== "string" || !socketPath.startsWith(prefix)) throw new Error("A Windows ACL may only protect a named pipe");
+  return socketPath.slice(prefix.length);
+}
+
+export async function protectCurrentUserPipe(socketPath, { pid = process.pid, run = execFile } = {}) {
+  if (!IS_WINDOWS) return { skipped: true };
+  const name = bridgePipeName(socketPath);
+  const script = fileURLToPath(new URL("./windows-pipe-acl.ps1", import.meta.url));
+  const { stdout } = await run(powershell, ["-NoProfile", "-NonInteractive", "-File", script, "-PipeName", name, "-ServerPid", String(pid)], { windowsHide: true, timeout: 15000 });
+  let result;
+  try { result = JSON.parse(stdout.trim()); } catch { throw new Error("Windows pipe ACL helper returned invalid readback"); }
+  if (result?.serverMatches !== true || result?.serverUserMatches !== true || result?.ownerMatches !== true || result?.protected !== true || result?.aceCount !== 1
+      || result?.rights !== 2032031 || result?.anonymousDenied !== true || result?.readError !== 5 || result?.duplexError !== 5) {
+    throw new Error("Windows pipe ACL readback did not prove exact current-user FullControl and anonymous denial");
+  }
+  return result;
+}

package/src/windows-pipe-acl.ps1

@@ -0,0 +1,85 @@
+param([Parameter(Mandatory)][string]$PipeName,[Parameter(Mandatory)][uint32]$ServerPid)
+$ErrorActionPreference='Stop'
+if($PipeName -notmatch '^LOCAL\\(?:codex-native-relay|codex-bridge|cc-msg)-[A-Za-z0-9_.-]+$'){throw 'Refusing a pipe outside the bridge-owned namespace.'}
+Add-Type @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using Microsoft.Win32.SafeHandles;
+public sealed class BridgeServerIdentity : IDisposable {
+ [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, uint pid);
+ [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool OpenProcessToken(IntPtr process, uint access, out IntPtr token);
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool GetTokenInformation(IntPtr token, int kind, IntPtr buffer, uint length, out uint required);
+ IntPtr process;
+ public string User { get; private set; }
+ public string Owner { get; private set; }
+ static string ReadSid(IntPtr token, int kind) {
+  uint required;
+  if(GetTokenInformation(token, kind, IntPtr.Zero, 0, out required) || Marshal.GetLastWin32Error()!=122 || required<IntPtr.Size || required>65536) throw new Win32Exception(Marshal.GetLastWin32Error());
+  IntPtr buffer=Marshal.AllocHGlobal((int)required);
+  try {
+   if(!GetTokenInformation(token, kind, buffer, required, out required)) throw new Win32Exception(Marshal.GetLastWin32Error());
+   return new SecurityIdentifier(Marshal.ReadIntPtr(buffer)).Value;
+  } finally { Marshal.FreeHGlobal(buffer); }
+ }
+ public BridgeServerIdentity(uint pid) {
+  process=OpenProcess(0x1000, false, pid);
+  if(process==IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error());
+  IntPtr token=IntPtr.Zero;
+  try {
+   if(!OpenProcessToken(process, 8, out token)) throw new Win32Exception(Marshal.GetLastWin32Error());
+   User=ReadSid(token, 1);
+   Owner=ReadSid(token, 4);
+  } catch { Dispose(); throw; }
+  finally { if(token!=IntPtr.Zero) CloseHandle(token); }
+ }
+ public void Dispose() { if(process!=IntPtr.Zero) { CloseHandle(process); process=IntPtr.Zero; } }
+}
+public static class BridgePipeAcl {
+ [DllImport("kernel32.dll")] static extern IntPtr GetCurrentThread();
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool ImpersonateAnonymousToken(IntPtr thread);
+ [DllImport("advapi32.dll", SetLastError=true)] static extern bool RevertToSelf();
+ [DllImport("kernel32.dll", SetLastError=true)] public static extern bool GetNamedPipeServerProcessId(SafePipeHandle pipe, out uint pid);
+ [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern SafeFileHandle CreateFile(string name,uint access,uint share,IntPtr sa,uint creation,uint flags,IntPtr template);
+ public static int AttemptAnonymous(string name,uint access) {
+  if(!ImpersonateAnonymousToken(GetCurrentThread())) throw new Win32Exception(Marshal.GetLastWin32Error());
+  try {
+   using(var handle=CreateFile(name,access,0,IntPtr.Zero,3,0,IntPtr.Zero)) {
+    int error=Marshal.GetLastWin32Error();
+    return handle.IsInvalid ? error : 0;
+   }
+  } finally {
+   if(!RevertToSelf()) Environment.FailFast("Could not end anonymous pipe ACL verification.");
+  }
+ }
+}
+'@
+$pipe=New-Object System.IO.Pipes.NamedPipeClientStream('.', $PipeName, [System.IO.Pipes.PipeAccessRights]::FullControl, [System.IO.Pipes.PipeOptions]::None, [System.Security.Principal.TokenImpersonationLevel]::Identification, [System.IO.HandleInheritability]::None)
+$serverIdentity=$null
+try {
+ $pipe.Connect(3000)
+ [uint32]$actualPid=0
+ if(-not [BridgePipeAcl]::GetNamedPipeServerProcessId($pipe.SafePipeHandle,[ref]$actualPid) -or $actualPid -ne $ServerPid){throw 'Pipe server identity mismatch.'}
+ $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User
+ $serverIdentity=New-Object BridgeServerIdentity($actualPid)
+ if($serverIdentity.User -ne $sid.Value){throw 'Pipe server token user is not current user.'}
+ $before=$pipe.GetAccessControl()
+ $owner=$before.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+ if($owner -ne $sid.Value -and $owner -ne $serverIdentity.Owner){throw 'Pipe owner does not match the verified server token.'}
+ $acl=New-Object System.IO.Pipes.PipeSecurity
+ $acl.SetOwner($sid)
+ $acl.SetAccessRuleProtection($true,$false)
+ $acl.AddAccessRule((New-Object System.IO.Pipes.PipeAccessRule($sid,[System.IO.Pipes.PipeAccessRights]::FullControl,[System.Security.AccessControl.AccessControlType]::Allow)))
+ $pipe.SetAccessControl($acl)
+ if(-not [BridgePipeAcl]::GetNamedPipeServerProcessId($pipe.SafePipeHandle,[ref]$actualPid) -or $actualPid -ne $ServerPid){throw 'Pipe server identity changed.'}
+ $after=$pipe.GetAccessControl(); $rules=@($after.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))
+ if($after.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value){throw 'Restricted owner readback mismatch.'}
+ if(-not $after.AreAccessRulesProtected -or $rules.Count -ne 1 -or $rules[0].IsInherited -or $rules[0].IdentityReference.Value -ne $sid.Value -or $rules[0].AccessControlType -ne 'Allow' -or $rules[0].PipeAccessRights -ne [System.IO.Pipes.PipeAccessRights]::FullControl){throw 'Restricted DACL readback mismatch.'}
+ $nativeName='\\.\pipe\'+$PipeName
+ $readError=[BridgePipeAcl]::AttemptAnonymous($nativeName,[uint32]2147483648)
+ $duplexError=[BridgePipeAcl]::AttemptAnonymous($nativeName,[uint32]3221225472)
+ if($readError -ne 5 -or $duplexError -ne 5){throw "Anonymous pipe access was not denied: read=$readError duplex=$duplexError"}
+ [pscustomobject]@{serverMatches=$true;serverUserMatches=$true;ownerMatches=$true;protected=$true;aceCount=1;rights=[int]$rules[0].PipeAccessRights;anonymousDenied=$true;readError=$readError;duplexError=$duplexError}|ConvertTo-Json -Compress
+} finally {if($null -ne $serverIdentity){$serverIdentity.Dispose()};$pipe.Dispose()}