@minhspark/codex-mcp-bridge 1.18.1 → 1.19.0

package/CHANGELOG.md

@@ -4,6 +4,27 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.19.0] - 2026-09-29
+
+### Added
+
+- Give each independent Codex Desktop task its own creation identity with an optional `requestId` UUID on `delegate_to_codex` and `start_codex_thread` (#82). Creation receipts were keyed by directory and title, or by the exact prompt when no title was given, so a second independent task with the same title returned the earlier task and its brief was never sent. A fresh `requestId` creates a separate task even with the same directory, title and prompt, and retrying with the same ID recovers the original receipt after a bridge restart without resending the prompt. Calls without `requestId` keep the previous deduplication. Legacy app-server mode rejects `requestId` before creating anything, because it cannot deduplicate creations durably.
+
+### Changed
+
+- Guide agents to open a new Codex conversation for each independent task when the user asks for one or has given standing instructions to, and to continue unfinished work, fixes and results in the task's original thread (#82). The server instructions, tool descriptions and README previously told agents to prefer an existing task and to create one only on an explicit request.
+
+### Fixed
+
+- Verify Codex → Claude Desktop senders that run inside a Codex-managed sandbox (#83). Codex Desktop 26.924 starts ordinary tasks with a `managed` permission profile, a `workspace-write` sandbox, and a `granular` approval policy, and its permission selector may offer only **Ask for approval** and **Approve for me**; the bridge accepted only the disabled full-access profile, so every send from such a task stopped with `CODEX_SENDER_CONTEXT_UNVERIFIED`. A managed profile whose file system is restricted now attests `prompting` with a `user` or `auto_review` reviewer and any approval policy, matching Claude, which counts `dontAsk` and `auto` as prompting; it can never attest `bypass`, which still requires Full access with `approval_policy: never`. The bridge still fails closed when the managed file system is unrestricted, grants write access to the file-system root, a literal root path, a glob, or an unrecognised special path, or has any unrecognised shape. A granular policy is reported as a stable `granular(<allowed categories>)` label, and `claude_bridge_status` shows the sender's permission profile and approval reviewer, which a queued send now also pins. A class mismatch against a Claude task in `bypassPermissions` names the Full access requirement.
+- Retry removing an integration test's temporary home on Windows while the bridge and the PowerShell probes it started are still exiting (#86). They keep that directory as their working directory after the SDK's close() sends SIGKILL, so the removal failed a Windows CI run with `EPERM`.
+
+## [1.18.2] - 2026-09-26
+
+### Fixed
+
+- Restore native relay compatibility with Codex Desktop 26.924 by including the required caller source in native tool requests, allowing pipe discovery and Desktop operations to recover automatically.
+
 ## [1.18.1] - 2026-09-25
 
 ### Fixed

package/README.md

@@ -220,17 +220,24 @@ The registered supervisor should report auto-reload enabled. Next, list the inte
 
 | Direction | Tools |
 |---|---|
-| Claude → Codex | `list_codex_threads`, then `send_to_codex_thread` |
+| Continue unfinished Codex work | Verify the original `threadId`, then `send_to_codex_thread` |
 | Codex → Claude | `list_claude_sessions`, then `send_to_claude_session` |
-| Create a Codex task | `delegate_to_codex` with `cwd` and `prompt` |
+| Start independent Codex work | `delegate_to_codex` or `start_codex_thread` with `cwd`, initial `prompt`, and a fresh UUID `requestId` in Desktop mode |
 
 Example requests:
 
+- **In Claude:** “For each independent new task or feature, create a new Codex conversation and send the initial brief there. Continue unfinished work in its original conversation.”
 - **In Claude:** “Send this review request to my existing Codex task in this project and wait for its reply.”
 - **In Codex:** “Send this result to my Claude Desktop Code session in this project and confirm its reply.”
 
 Use the exact project directory and destination task. If several Claude sessions match, specify the task ID. A `reply_received` receipt confirms a reply; a timeout does not mean the task stopped, so inspect it before retrying.
 
+An explicit request for a new conversation, or standing user instructions such as the example above, authorizes creation for independent work. Keep fixes, clarifications and results for unfinished work in its original conversation. A completed assistant turn does not by itself mean the whole task is finished; matching a project or finding a recent task does not make it the right destination for new work.
+
+In Desktop mode, generate a fresh UUID `requestId` for each independent task and retain it on every retry of that creation. Different request IDs create separate tasks even with the same directory, title and prompt. The same ID recovers the original receipt after a bridge restart; an edited title or prompt is not resent. Continue that task with its returned `threadId`. Pending or uncertain creation remains blocked: inspect the original receipt/task instead of changing the ID to retry.
+
+For backward compatibility, calls without `requestId` retain the previous deduplication by directory and explicit title (or exact prompt when no title is supplied). They can return an older task with the same title. Use a fresh request ID for independent new work; keep the old call shape when recovering an earlier legacy creation. Legacy app-server mode rejects `requestId` before creating anything because durable creation deduplication is only supported through Desktop native delivery.
+
 The sending tools ask agents to write each prompt in English with these sections, dropping any that do not apply: `Goal`, `Context`, `Task`, `Scope`, `Constraints`, `Done when`, `Reply format`. The first line names the sender, the project and the purpose. Text the user supplied is sent unchanged.
 
 ```text
@@ -384,4 +391,4 @@ npm test
 
 On Windows, use `node --test --test-concurrency=2` (also avoids npm versions that reject forwarded flags). CI tests Node 22 and 24 on Linux, macOS, and Windows. Tests use isolated fixtures and do not spend model quota. For the optional telemetry endpoint, also run `deno test --allow-env supabase/functions/bridge-usage/contract-check.ts`.
 
-[Contributing](CONTRIBUTING.md) · [Changelog](CHANGELOG.md) · [MIT license](LICENSE)
+[Contributing](CONTRIBUTING.md) · [Changelog](CHANGELOG.md) · [MIT license](LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.18.1",
+  "version": "1.19.0",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/scripts/install-native-relay.mjs

@@ -22,7 +22,7 @@ import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.1";
+const VERSION = "1.19.0";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/src/claude-bridge.mjs

@@ -26,7 +26,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.1";
+const VERSION = "1.19.0";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;
@@ -482,7 +482,8 @@ registerTool(
               rootPolicy.recheck(scopeBindings.sender, "Codex sender working directory");
               rootPolicy.recheck(scopeBindings.recipient, "Claude recipient working directory");
             }
-            if (active.threadId !== sender.threadId || active.turnId !== sender.turnId || active.cwd !== sender.cwd || active.mode !== sender.mode || active.approvalPolicy !== sender.approvalPolicy || JSON.stringify(active.review) !== JSON.stringify(sender.review)) {
+            if (active.threadId !== sender.threadId || active.turnId !== sender.turnId || active.cwd !== sender.cwd || active.mode !== sender.mode || active.approvalPolicy !== sender.approvalPolicy
+                || active.permissionProfile !== sender.permissionProfile || active.approvalsReviewer !== sender.approvalsReviewer || JSON.stringify(active.review) !== JSON.stringify(sender.review)) {
               throw preflightFailure("CODEX_SENDER_CONTEXT_CHANGED", "The sender's active turn or permissions changed while this message was queued.");
             }
             assertRecipientClass(refreshed, active);
@@ -690,6 +691,7 @@ registerTool(
         `sender mode:   ${sender?.mode ?? (desktopOnly ? "unverified - Desktop sends blocked" : peer.permissionMode ?? "unknown")}`,
         ...(sender ? [`sender context: ${sender.status} (${sender.source ?? "unavailable"})`, `sender task: ${sender.threadId ?? "unknown"}`, `sender turn: ${sender.turnId ?? "unknown"}`, ...(sender.reason ? [`sender detail: ${sender.reason}`] : [])] : []),
         ...(sender?.approvalPolicy ? [`sender approval policy: ${sender.approvalPolicy}`] : []),
+        ...(sender?.permissionProfile ? [`sender permission profile: ${sender.permissionProfile}`, `sender approval reviewer: ${sender.approvalsReviewer}`] : []),
         ...(sender?.review ? [`sender auto review: ${sender.review.autoReview}`, `sender Node REPL review: ${sender.review.nodeReplReview}`] : []),
         `session policy: ${desktopOnly ? "desktop-only" : "all Claude Code entrypoints"}`,
         `Claude account: ${accounts.claude.status}${accounts.claude.fingerprint ? ` (${accounts.claude.fingerprint.slice(0, 12)})` : ` - ${accounts.claude.reason}`}`,

package/src/codex-sender-context.mjs

@@ -9,6 +9,12 @@ const STARTED = new Set(["task_started", "turn_started"]);
 const MAX_ROLLOUT_BYTES = 64 * 1024 * 1024;
 const MAX_ENTRIES = 100000;
 const MAX_DIRECTORIES = 4096;
+const PROMPTING_POLICIES = new Set(["on-request", "on-failure", "untrusted"]);
+const GRANULAR_CATEGORIES = ["sandbox_approval", "rules", "mcp_elicitations"];
+const MANAGED_REVIEWERS = new Set(["user", "auto_review"]);
+const MANAGED_SANDBOXES = new Set(["read-only", "workspace-write"]);
+const ENTRY_ACCESS = new Set(["read", "write", "deny", "none"]);
+const WRITABLE_SPECIAL_PATHS = new Set(["project_roots", "current_working_directory", "tmpdir", "slash_tmp"]);
 
 function object(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -97,14 +103,79 @@ export function readState(file, maxBytes) {
 }
 
 /**
- * Claude's inbound parity gate groups sessions by one question: does a human
- * still prompt the sender? Codex answers it with approval_policy. Its two host
- * review flags describe automated review instead - node_repl_auto_review_required
- * is a per-model catalog attribute (Codex Desktop derives it from
- * autoReview.requiredOnModels; the live gpt-6-astra task carried it with a
- * user reviewer and auto review disabled) and auto_review_enabled names a
- * Guardian reviewer - so they are required as evidence and reported, but
- * never move a sender between classes.
+ * Codex writes AskForApproval as a string, or as {granular: {...}} whose
+ * boolean categories choose which approval requests reach the reviewer. The
+ * label is a plain string so receipts and the queued-send comparison can
+ * compare it directly.
+ */
+function approvalPolicyLabel(policy) {
+  if (policy === "never" || PROMPTING_POLICIES.has(policy)) return policy;
+  if (!exactObject(policy, ["granular"]) || !object(policy.granular)) return null;
+  const categories = Object.entries(policy.granular);
+  if (!GRANULAR_CATEGORIES.every((category) => Object.hasOwn(policy.granular, category)) || categories.some(([, allowed]) => typeof allowed !== "boolean")) return null;
+  return `granular(${categories.filter(([, allowed]) => allowed).map(([category]) => category).sort().join(",")})`;
+}
+
+function rootPath(value) {
+  let local = value.replace(/^file:/i, "");
+  if (local.startsWith("///")) local = local.slice(2);
+  local = local.replace(/^\/(?=[a-z]:)/i, "").replace(/^\\\\\?\\UNC\\/i, "\\\\");
+  const { base } = path.win32.parse(path.win32.normalize(local || "/"));
+  return !base || base === ".";
+}
+
+/**
+ * A write grant on the file-system root, on a literal root path, or on a
+ * target whose breadth cannot be judged (a glob or an unrecognised special
+ * path) would leave the sandbox as open as full access, so such a profile
+ * gets no class. Read and deny entries only narrow what the sandbox exposes,
+ * so an unrecognised special path among them is ignored, as Codex ignores it.
+ */
+function assertSandboxEntry(entry) {
+  const target = object(entry) ? entry.path : undefined;
+  const known = object(target) && (
+    (target.type === "path" && exactObject(target, ["type", "path"]) && typeof target.path === "string")
+    || (target.type === "glob_pattern" && exactObject(target, ["type", "pattern"]) && typeof target.pattern === "string")
+    || (target.type === "special" && exactObject(target, ["type", "value"]) && object(target.value) && typeof target.value.kind === "string"));
+  if (!known || !ENTRY_ACCESS.has(entry.access) || Object.keys(entry).some((key) => !["path", "access", "missing_path_behavior"].includes(key))
+      || (Object.hasOwn(entry, "missing_path_behavior") && entry.missing_path_behavior !== "skip")) throw new Error("The caller's managed sandbox has an unsupported file-system entry; no permission class was inferred");
+  if (entry.access === "write" && (target.type === "glob_pattern" || (target.type === "path" ? rootPath(target.path) : !WRITABLE_SPECIAL_PATHS.has(target.value.kind)))) {
+    throw new Error("The caller's managed sandbox grants write access beyond specific directories; no permission class was inferred");
+  }
+}
+
+function assertManagedSandbox(context) {
+  const { permission_profile: profile, sandbox_policy: sandbox } = context;
+  if (!exactObject(profile, ["type", "file_system", "network"]) || !["restricted", "enabled"].includes(profile.network)) throw new Error("The caller's managed permission profile is unsupported; no permission class was inferred");
+  const fileSystem = profile.file_system;
+  if (object(fileSystem) && fileSystem.type === "unrestricted") throw new Error("The caller's managed sandbox leaves the file system unrestricted; no permission class was inferred");
+  if (!object(fileSystem) || fileSystem.type !== "restricted" || !Array.isArray(fileSystem.entries)
+      || Object.keys(fileSystem).some((key) => !["type", "entries", "glob_scan_max_depth"].includes(key))
+      || (Object.hasOwn(fileSystem, "glob_scan_max_depth") && !(Number.isSafeInteger(fileSystem.glob_scan_max_depth) && fileSystem.glob_scan_max_depth > 0))) throw new Error("The caller's managed file-system sandbox is unsupported; no permission class was inferred");
+  for (const entry of fileSystem.entries) assertSandboxEntry(entry);
+  if (!object(sandbox) || !MANAGED_SANDBOXES.has(sandbox.type)) throw new Error("The caller's effective sandbox policy does not match its managed permission profile");
+}
+
+/**
+ * Claude's inbound parity gate asks one question: does the sender bypass
+ * permission checks? Claude puts only bypassPermissions in that class and
+ * counts dontAsk (deny without asking) and auto (a classifier approves) as
+ * prompting.
+ *
+ * For a Codex task with no sandbox, approval_policy decides: never is bypass,
+ * and a policy that routes requests for approval is prompting. A task inside
+ * a Codex-managed sandbox that restricts the file system never bypasses the
+ * checks, whatever its approval policy or reviewer: a sandbox that never asks
+ * is dontAsk, and escalations decided by the auto_review subagent are auto.
+ * Such a sender is always prompting, never bypass. Codex Desktop's "Ask for
+ * approval" and "Approve for me" run this way; only "Full access" is bypass.
+ *
+ * The two host review flags describe automated review instead -
+ * node_repl_auto_review_required is a per-model catalog attribute (Codex
+ * Desktop derives it from autoReview.requiredOnModels; the live gpt-6-astra
+ * task carried it with a user reviewer and auto review disabled) and
+ * auto_review_enabled names a Guardian reviewer - so they are required as
+ * evidence and reported, but never move a sender between classes.
  * Downgrading them held every send from such a model behind an approval
  * dialog that Claude Desktop does not render.
  */
@@ -112,11 +183,18 @@ function permissionClass(context, metadata) {
   for (const field of ["auto_review_enabled", "node_repl_auto_review_required"]) {
     if (!Object.hasOwn(metadata, field) || typeof metadata[field] !== "boolean") throw new Error(`The caller's ${field} review evidence is ${reviewFlag(metadata, field)}; the host must supply an explicit boolean`);
   }
+  const approvalPolicy = approvalPolicyLabel(context.approval_policy);
+  if (object(context.permission_profile) && context.permission_profile.type === "managed") {
+    if (!MANAGED_REVIEWERS.has(context.approvals_reviewer)) throw new Error("The caller's effective approval reviewer is unverified");
+    assertManagedSandbox(context);
+    if (!approvalPolicy) throw new Error("The caller's effective approval policy is unsupported");
+    return { mode: "prompting", approvalPolicy, permissionProfile: "managed" };
+  }
   if (context.approvals_reviewer !== "user") throw new Error("The caller's effective approval reviewer is unverified");
-  if (!exactObject(context.permission_profile, ["type"]) || context.permission_profile.type !== "disabled") throw new Error("The caller's permission profile is restricted or unsupported; no permission class was inferred");
+  if (!exactObject(context.permission_profile, ["type"]) || context.permission_profile.type !== "disabled") throw new Error("The caller's permission profile is unsupported; no permission class was inferred");
   if (!exactObject(context.sandbox_policy, ["type"]) || context.sandbox_policy.type !== "danger-full-access") throw new Error("The caller's effective sandbox policy does not match its disabled permission profile");
-  if (context.approval_policy === "never") return "bypass";
-  if (["on-request", "on-failure", "untrusted"].includes(context.approval_policy)) return "prompting";
+  if (approvalPolicy === "never") return { mode: "bypass", approvalPolicy, permissionProfile: "disabled" };
+  if (PROMPTING_POLICIES.has(approvalPolicy)) return { mode: "prompting", approvalPolicy, permissionProfile: "disabled" };
   throw new Error("The caller's effective approval policy is unsupported");
 }
 
@@ -140,8 +218,8 @@ export function readCodexSenderContext(meta, { env = process.env, maxRolloutByte
     if (typeof context.cwd !== "string" || !path.isAbsolute(context.cwd) || typeof session.cwd !== "string" || !path.isAbsolute(session.cwd)) throw new Error("The caller's workspace is missing or invalid");
     const cwd = fs.realpathSync.native(context.cwd);
     if (!fs.statSync(cwd).isDirectory() || path.relative(fs.realpathSync.native(session.cwd), cwd)) throw new Error("The caller's workspace changed from its Desktop session identity");
-    const mode = permissionClass(context, metadata);
-    return { status: "verified", ...identity, mode, cwd, source: file, approvalPolicy: context.approval_policy, reason: "Host-supplied calling task and active turn match the Desktop rollout's effective permission settings" };
+    const { mode, approvalPolicy, permissionProfile } = permissionClass(context, metadata);
+    return { status: "verified", ...identity, mode, cwd, source: file, approvalPolicy, permissionProfile, approvalsReviewer: context.approvals_reviewer, reason: "Host-supplied calling task and active turn match the Desktop rollout's effective permission settings" };
   } catch (error) {
     return unavailable(error?.code ? `Caller evidence could not be read (${error.code}); no sender permission class was inferred` : error.message, identity);
   }

package/src/desktop-task-receipts.mjs

@@ -5,11 +5,15 @@ import path from "node:path";
 import { homeDir } from "./platform.mjs";
 
 const HASH = /^[a-f0-9]{64}$/;
-const FIELDS = new Set(["version", "key", "cwd", "promptHash", "state", "startedAt", "threadId", "projectId", "projectName", "name", "accountContext"]);
+const REQUEST_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+const FIELDS = new Set(["version", "key", "cwd", "promptHash", "state", "startedAt", "threadId", "projectId", "projectName", "name", "accountContext", "requestId"]);
 const digest = (value) => createHash("sha256").update(value).digest("hex");
 const normalizedName = (name) => name?.normalize("NFC").trim().replace(/\s+/g, " ");
 const canonicalCwd = (cwd) => process.platform === "win32" ? path.normalize(cwd).toLowerCase() : path.normalize(cwd);
 const nonemptyString = (value) => typeof value === "string" && value.trim().length > 0 && value.length <= 8192 && !/[\u0000-\u001f]/.test(value);
+const receiptKey = ({ cwd, name, promptHash, requestId }) => digest(JSON.stringify(requestId
+  ? [canonicalCwd(cwd), "request", requestId.toLowerCase()]
+  : [canonicalCwd(cwd), normalizedName(name) || promptHash]));
 
 function assertKey(key) {
   if (typeof key !== "string" || !HASH.test(key)) throw new Error("Invalid Desktop task receipt key; refusing unsafe filesystem access.");
@@ -23,6 +27,7 @@ function validateReceipt(key, receipt) {
   const valid = receipt && typeof receipt === "object" && !Array.isArray(receipt)
     && Object.keys(receipt).every((field) => FIELDS.has(field))
     && receipt.version === 1 && receipt.key === key && HASH.test(receipt.promptHash)
+    && (receipt.requestId === undefined || typeof receipt.requestId === "string" && REQUEST_ID.test(receipt.requestId))
     && nonemptyString(receipt.cwd) && path.isAbsolute(receipt.cwd)
     && ["pending", "unknown", "known"].includes(receipt.state)
     && Number.isSafeInteger(receipt.startedAt) && receipt.startedAt >= 0
@@ -31,7 +36,7 @@ function validateReceipt(key, receipt) {
     && ["threadId", "projectId", "projectName", "name"].every((field) => receipt[field] === undefined || nonemptyString(receipt[field]))
     && (receipt.state !== "known" || nonemptyString(receipt.threadId));
   if (!valid) throw unsafeReceipt(key);
-  const expected = digest(JSON.stringify([canonicalCwd(receipt.cwd), normalizedName(receipt.name) || receipt.promptHash]));
+  const expected = receiptKey(receipt);
   if (expected !== key) throw unsafeReceipt(key);
   return receipt;
 }
@@ -41,12 +46,15 @@ export class DesktopTaskReceipts {
     this.directory = path.resolve(directory);
   }
 
-  key({ cwd, prompt, name }) {
+  key({ cwd, prompt, name, requestId }) {
     if (!nonemptyString(cwd) || !path.isAbsolute(cwd) || typeof prompt !== "string" || (name !== undefined && typeof name !== "string")) {
       throw new Error("Desktop task receipts require an absolute validated cwd, a prompt string, and an optional name string.");
     }
+    if (requestId !== undefined && (typeof requestId !== "string" || !REQUEST_ID.test(requestId))) {
+      throw new Error("Desktop task creation requestId must be a stable UUID; use a fresh UUID only for independent new work.");
+    }
     const promptHash = digest(prompt);
-    return { key: digest(JSON.stringify([canonicalCwd(cwd), normalizedName(name) || promptHash])), promptHash };
+    return { key: receiptKey({ cwd, name, promptHash, requestId }), promptHash, ...(requestId ? { requestId: requestId.toLowerCase() } : {}) };
   }
 
   async ensureDirectory(create = false) {

package/src/index.mjs

@@ -34,7 +34,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.1";
+const VERSION = "1.19.0";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
@@ -169,12 +169,12 @@ function threadNameFor({ cwd, prompt, name }) {
   );
 }
 
-async function delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSec, openInApp, waitForReply = true }) {
+async function delegateDesktopTask({ cwd, prompt, name, requestId, model, effort, timeoutSec, openInApp, waitForReply = true }) {
   const deadline = desktopOperation.getStore()?.deadline ?? Date.now() + Math.min((timeoutSec ?? 40) * 1000, DESKTOP_TOOL_BUDGET_MS);
   const workspace = resolveWorkspacePath(cwd);
   const created = await desktopTasks.create({
     cwd: workspace.path, prompt, name: threadNameFor({ cwd: workspace.path, prompt, name }),
-    dedupeName: name ?? "", model: model ?? DEFAULT_MODEL, effort: effort ?? DEFAULT_EFFORT, deadline,
+    dedupeName: name ?? "", requestId, model: model ?? DEFAULT_MODEL, effort: effort ?? DEFAULT_EFFORT, deadline,
   });
   const notes = [];
   if (workspace.note) notes.push(workspace.note);
@@ -188,6 +188,7 @@ async function delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSe
   }
   const lines = [
     created.reused ? "Reused the existing Codex Desktop task; the prompt was not resent" : "Delegated through Codex Desktop", `threadId: ${created.threadId}`, `name: ${created.name}`,
+    ...(requestId ? [`requestId: ${requestId}`] : []),
     `cwd: ${created.cwd}`,
     ...(created.projectAssignmentStatus === "unverified"
       ? [`expected projectId: ${created.expectedProjectId}`, `expected project: ${created.expectedProjectName ?? "(unnamed)"}`, "project assignment: unverified", created.projectAssignmentNote]
@@ -195,7 +196,7 @@ async function delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSe
     "permissions: Codex Desktop settings; no external app-server writer",
     ...(created.promptChanged ? [created.projectAssignmentStatus === "unverified"
       ? "The edited brief was not sent. Inspect this task's project assignment before continuing it."
-      : "The edited brief was not sent. Use send_to_codex_thread with this threadId for a continuation, or a distinct title for separate work."] : []), ...notes,
+      : "The edited brief was not sent. Continue the same unfinished work with send_to_codex_thread and this threadId. For independent new work, create a task with a fresh requestId; never change requestId merely to retry uncertain delivery."] : []), ...notes,
   ];
   if (created.projectAssignmentStatus === "unverified") return textResult([...lines, "status: existing task retained; project assignment needs inspection"].join("\n"));
   if (!waitForReply) return textResult([...lines, created.reused ? "status: existing task; read it to check its current progress" : "status: accepted; the task is running in Desktop"].join("\n"));
@@ -341,9 +342,12 @@ const server = new McpServer(
   { name: "codex-bridge", version: VERSION },
   {
     instructions:
-      "Bridge Claude work into Codex. Prefer an existing task: inspect its exact threadId and project, then use send_to_codex_thread. " +
-      "Only use delegate_to_codex or start_codex_thread when the user explicitly requests a new task at the " +
-      "requested cwd. With Desktop tasks enabled it assigns the exact saved project and starts visibly in " +
+      "Bridge Claude work into Codex. When the user requests a new conversation or has given standing authorization to create one for each independent task, " +
+      "use delegate_to_codex or start_codex_thread with the initial prompt and a fresh requestId for each independent task or feature in Desktop mode, even in the same project. " +
+      "In legacy app-server mode, use delegate_to_codex with the initial prompt and omit requestId; durable creation deduplication is unavailable there. " +
+      "Reuse that requestId only for retries of that creation. Continue unfinished work, fixes, clarifications, and results in its verified original threadId with send_to_codex_thread. " +
+      "A completed turn alone does not mean the task is finished. Do not choose an old task merely because its project matches or it was recently active. " +
+      "Without authorization to create a new conversation, ask before creating it. With Desktop tasks enabled it assigns the exact saved project and starts visibly in " +
       "Codex Desktop using Desktop permissions. Otherwise it releases the bridge writer lock and opens the exact thread in " +
       "Codex Desktop. Use send_to_codex_thread only when an existing threadId is intentional; use " +
       "list_codex_threads or read_codex_thread to inspect sessions and codex_bridge_status to inspect wiring. " +
@@ -399,9 +403,12 @@ registerTool(
     title: "Delegate work to a new Codex session",
     description:
       "Create a named Codex session at the requested project directory, send Claude's prompt into it, " +
-      "return Codex's reply, and hand the session to Codex Desktop without leaving the bridge writer lock behind.",
+      "return Codex's reply, and hand the session to Codex Desktop without leaving the bridge writer lock behind. " +
+      "Use for independent new work when the user explicitly or through standing instructions authorizes new conversations. " +
+      "In Desktop mode, supply a fresh requestId per independent task and keep it on retries; omit requestId in legacy app-server mode. Use send_to_codex_thread for unfinished work.",
     inputSchema: {
       cwd: z.string().describe("Absolute project directory where Codex must work"),
+      requestId: z.string().uuid().optional().describe("Desktop creation identity: fresh UUID for each independent new task; retain exactly on retries. Omitting it preserves legacy title/prompt deduplication and can return an older task. Not supported in legacy app-server mode."),
       prompt: z.string().describe(`The complete task Claude is delegating to Codex. ${PROMPT_FIELD_HINT}`),
       name: z.string().min(1).max(200).optional().describe("Optional Codex session title; otherwise one is derived from the prompt"),
       timeoutSec: z
@@ -432,12 +439,13 @@ registerTool(
       openWorldHint: true,
     },
   },
-  async ({ cwd, prompt, name, timeoutSec, model, effort, openInApp, releaseAfterTurn }) => {
+  async ({ cwd, prompt, name, requestId, timeoutSec, model, effort, openInApp, releaseAfterTurn }) => {
     const shouldOpen = openInApp ?? DEFAULT_OPEN_IN_APP;
     const shouldRelease = releaseAfterTurn ?? DEFAULT_RELEASE_AFTER_TURN;
     const notes = [];
     try {
-      if (desktopTasksEnabled) return await delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSec, openInApp });
+      if (desktopTasksEnabled) return await delegateDesktopTask({ cwd, prompt, name, requestId, model, effort, timeoutSec, openInApp });
+      if (requestId !== undefined) throw new Error("Creation requestId requires Desktop native delivery; legacy app-server mode cannot safely deduplicate this request. No task was created.");
       const created = await createCodexThread({ cwd, prompt, name, model });
       if (created.workspace.note) notes.push(created.workspace.note);
       if (shouldOpen && !shouldRelease) {
@@ -490,6 +498,7 @@ registerTool(
     title: "Send a prompt to a Codex thread",
     description:
       "Send a prompt as a new user turn inside an existing Codex thread and wait for Codex to answer. " +
+      "Use only for the same unfinished task, including follow-up fixes, clarifications, or results; independent new work belongs in a new conversation when authorized. " +
       "The thread keeps its full history, cwd and model. Use list_codex_threads first if you do not know the threadId. " +
       "Desktop-owned tasks must use Desktop native delivery; an open task is a valid destination. " +
       "If legacy delivery reports an active writer, inspect codex_bridge_status and repair the native relay/configuration. " +
@@ -702,9 +711,10 @@ registerTool(
   "start_codex_thread",
   {
     title: "Start a new Codex thread",
-    description: "Start a Codex task. In Desktop mode include the initial prompt to create and assign a visible task atomically; use delegate_to_codex to also wait for its reply.",
+    description: "Start a new Codex task when the user explicitly or through standing instructions authorizes a new conversation for independent work. In Desktop mode include the initial prompt and a fresh requestId to create and assign a visible task atomically; keep requestId unchanged on retries. Continue unfinished work with send_to_codex_thread and its original threadId. Use delegate_to_codex to also wait for its reply.",
     inputSchema: {
       cwd: z.string().describe("Absolute working directory for the new Codex session"),
+      requestId: z.string().uuid().optional().describe("Desktop creation identity: fresh UUID per independent task, same UUID on retries. Omit only for legacy title/prompt deduplication. Not supported in legacy app-server mode."),
       prompt: z.string().min(1).optional().describe(`Initial task; required with CODEX_BRIDGE_DESKTOP_TASKS=1, starts immediately. ${PROMPT_FIELD_HINT}`),
       model: z.string().optional().describe("Model override, e.g. gpt-5.6-luna"),
       name: z.string().min(1).max(200).optional().describe("Optional title to show for the new Codex session"),
@@ -716,12 +726,13 @@ registerTool(
       openWorldHint: true,
     },
   },
-  async ({ cwd, model, name, prompt }) => {
+  async ({ cwd, model, name, prompt, requestId }) => {
     try {
       if (desktopTasksEnabled) {
         if (!prompt?.trim()) throw new Error("Desktop task creation requires the initial prompt. Use delegate_to_codex, or pass prompt to start_codex_thread. No task was created.");
-        return await delegateDesktopTask({ cwd, model, name, prompt, waitForReply: false });
+        return await delegateDesktopTask({ cwd, model, name, prompt, requestId, waitForReply: false });
       }
+      if (requestId !== undefined) throw new Error("Creation requestId requires Desktop native delivery; legacy app-server mode cannot safely deduplicate this request. No task was created.");
       if (prompt) throw new Error("Use delegate_to_codex to send an initial prompt in app-server mode.");
       const created = await createCodexThread({ cwd, model, name });
       return textResult(

package/src/native-relay-companion.mjs

@@ -34,7 +34,7 @@ import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.1";
+const VERSION = "1.19.0";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent) {

package/src/native-relay.mjs

@@ -168,6 +168,7 @@ export function resolveRelayThreadId(env = process.env) {
 export function nativeDispatchParams({ executorThreadId, targetThreadId, message }) {
   return {
     arguments: { threadId: targetThreadId, prompt: message },
+    callerSource: "codex",
     callId: `codex-native-relay-${randomUUID()}`,
     namespace: "codex_app",
     threadId: executorThreadId,
@@ -246,6 +247,7 @@ export function nativeDesktopOperationParams({ executorThreadId, operation, argu
   validateDesktopOperation(operation, args);
   return {
     arguments: args,
+    callerSource: "codex",
     callId: `codex-native-relay-${randomUUID()}`,
     namespace: "codex_app",
     threadId: executorThreadId,

package/src/recipient-preflight.mjs

@@ -22,5 +22,5 @@ export function assertRecipientClass(session, sender) {
   if (inbound.value === "accept") return;
   const recipient = session.desktop?.permissionClass ?? null;
   if (!recipient || recipient === sender.mode) return;
-  throw preflightFailure("CLAUDE_RECIPIENT_CLASS_MISMATCH", `The Claude Desktop task "${session.desktop.title}" runs in ${session.desktop.permissionMode} (${recipient} class) while this sender attests ${sender.mode}. With no explicit crossSessionInbound setting, Claude holds a cross-session message whose sender class differs from the recipient's, and Claude Desktop declares no peer approval dialog, so the message would expire unapproved. Report this to the user: they can run that task in the ${sender.mode} class, change this Codex task's approval policy so its class matches, or set crossSessionInbound to accept in the recipient session's own settings. Do not change the attested sender class or recipient settings yourself.`);
+  throw preflightFailure("CLAUDE_RECIPIENT_CLASS_MISMATCH", `The Claude Desktop task "${session.desktop.title}" runs in ${session.desktop.permissionMode} (${recipient} class) while this sender attests ${sender.mode}. With no explicit crossSessionInbound setting, Claude holds a cross-session message whose sender class differs from the recipient's, and Claude Desktop declares no peer approval dialog, so the message would expire unapproved. Report this to the user: they can run that task in the ${sender.mode} class, change this Codex task's permissions so its class matches (a Codex task attests bypass only with Full access and approval policy never), or set crossSessionInbound to accept in the recipient session's own settings. Do not change the attested sender class or recipient settings yourself.`);
 }

package/src/thread-delivery.mjs

@@ -197,12 +197,12 @@ export class DesktopTaskDelivery {
     return { projectId: project.projectId, projectName: project.label, projectAssignmentStatus: "verified" };
   }
 
-  async create({ cwd, prompt, name, dedupeName = name, model, effort, deadline = this.now() + DESKTOP_TOOL_BUDGET_MS }) {
+  async create({ cwd, prompt, name, dedupeName = name, requestId, model, effort, deadline = this.now() + DESKTOP_TOOL_BUDGET_MS }) {
     this.security.assertCwd(cwd);
     cwd = realpathSync.native(cwd);
     this.security.assertCwd(cwd);
     dedupeName = dedupeName?.normalize("NFC").trim().replace(/\s+/g, " ") || undefined;
-    const identity = this.receipts.key({ cwd, prompt, name: dedupeName });
+    const identity = this.receipts.key({ cwd, prompt, name: dedupeName, requestId });
     const accountContext = this.accountContext?.();
     if (this.accountContext && !accountContext) throw new Error("Desktop creation requires the original verified account context.");
     const options = { cwd, promptHash: identity.promptHash, deadline, accountContext };