@minhspark/codex-mcp-bridge 1.18.2 → 1.19.1

package/CHANGELOG.md

@@ -4,6 +4,32 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.19.1] - 2026-09-29
+
+### Fixed
+
+- Recognize `codex_work_desktop` as a local Desktop sender while retaining exact host task/turn, workspace, and lifecycle checks (#84). Its permission profile is classified like that of any other Codex Desktop task, including the managed sandboxes supported since 1.19.0 (#83). Claude's inbound policy and permission parity checks are unchanged.
+- Read completed native replies from `codex_work_desktop` tasks and correlate both raw and XML-escaped Desktop dispatch envelopes to the exact sent prompt (#84). Task, workspace, turn, executor, and pre-send watermark checks remain required for automatic reply observation.
+- Preserve confirmed native send acceptance when the overall response deadline expires (#84). The timeout does not release the underlying operation's thread lock, retry a prompt, or turn an unconfirmed send into a successful delivery.
+- Avoid a Windows Node 24.13.0 native crash when preparing supervisor and MCP contract test fixtures from a Unicode checkout path by awaiting asynchronous directory copies (#84).
+- Stop refusing Claude → Codex callers on Windows because Windows PowerShell started slowly (#42). The caller check reads the process ancestry in a fresh Windows PowerShell that first compiles its Toolhelp helper, and the five-second fail-closed deadline covered that startup as well as the read. On a cold or contended machine the startup alone has taken 5 to 15 seconds: CI refused callers with `INSPECTION_TIMEOUT` before the script had begun (5,036 ms) and while the helper was still compiling (5,017 ms), although the read itself takes about 60 ms. The helper now reports when it is ready, and the five-second deadline starts there. Getting ready has its own 25-second ceiling, so a whole read still ends within the 30 seconds the bridge gives its other PowerShell identity reads. Either expiry still refuses the caller, and a slow start is reported as `INSPECTOR_START_TIMEOUT`. The helper also writes its JSON itself, so the timed read no longer loads PowerShell's JSON serializer.
+- Lock `ip-address` at 10.7.2 for development installs (#87). 10.5.0 misclassified IPv6 link-local and NAT64 local-use addresses. The bridge's stdio servers never load the rate-limiting code that uses it, and the published package ships no lockfile, so installs from npm resolve their own versions.
+
+## [1.19.0] - 2026-09-29
+
+### Added
+
+- Give each independent Codex Desktop task its own creation identity with an optional `requestId` UUID on `delegate_to_codex` and `start_codex_thread` (#82). Creation receipts were keyed by directory and title, or by the exact prompt when no title was given, so a second independent task with the same title returned the earlier task and its brief was never sent. A fresh `requestId` creates a separate task even with the same directory, title and prompt, and retrying with the same ID recovers the original receipt after a bridge restart without resending the prompt. Calls without `requestId` keep the previous deduplication. Legacy app-server mode rejects `requestId` before creating anything, because it cannot deduplicate creations durably.
+
+### Changed
+
+- Guide agents to open a new Codex conversation for each independent task when the user asks for one or has given standing instructions to, and to continue unfinished work, fixes and results in the task's original thread (#82). The server instructions, tool descriptions and README previously told agents to prefer an existing task and to create one only on an explicit request.
+
+### Fixed
+
+- Verify Codex → Claude Desktop senders that run inside a Codex-managed sandbox (#83). Codex Desktop 26.924 starts ordinary tasks with a `managed` permission profile, a `workspace-write` sandbox, and a `granular` approval policy, and its permission selector may offer only **Ask for approval** and **Approve for me**; the bridge accepted only the disabled full-access profile, so every send from such a task stopped with `CODEX_SENDER_CONTEXT_UNVERIFIED`. A managed profile whose file system is restricted now attests `prompting` with a `user` or `auto_review` reviewer and any approval policy, matching Claude, which counts `dontAsk` and `auto` as prompting; it can never attest `bypass`, which still requires Full access with `approval_policy: never`. The bridge still fails closed when the managed file system is unrestricted, grants write access to the file-system root, a literal root path, a glob, or an unrecognised special path, or has any unrecognised shape. A granular policy is reported as a stable `granular(<allowed categories>)` label, and `claude_bridge_status` shows the sender's permission profile and approval reviewer, which a queued send now also pins. A class mismatch against a Claude task in `bypassPermissions` names the Full access requirement.
+- Retry removing an integration test's temporary home on Windows while the bridge and the PowerShell probes it started are still exiting (#86). They keep that directory as their working directory after the SDK's close() sends SIGKILL, so the removal failed a Windows CI run with `EPERM`.
+
 ## [1.18.2] - 2026-09-26
 
 ### Fixed

package/README.md

@@ -220,17 +220,24 @@ The registered supervisor should report auto-reload enabled. Next, list the inte
 
 | Direction | Tools |
 |---|---|
-| Claude → Codex | `list_codex_threads`, then `send_to_codex_thread` |
+| Continue unfinished Codex work | Verify the original `threadId`, then `send_to_codex_thread` |
 | Codex → Claude | `list_claude_sessions`, then `send_to_claude_session` |
-| Create a Codex task | `delegate_to_codex` with `cwd` and `prompt` |
+| Start independent Codex work | `delegate_to_codex` or `start_codex_thread` with `cwd`, initial `prompt`, and a fresh UUID `requestId` in Desktop mode |
 
 Example requests:
 
+- **In Claude:** “For each independent new task or feature, create a new Codex conversation and send the initial brief there. Continue unfinished work in its original conversation.”
 - **In Claude:** “Send this review request to my existing Codex task in this project and wait for its reply.”
 - **In Codex:** “Send this result to my Claude Desktop Code session in this project and confirm its reply.”
 
 Use the exact project directory and destination task. If several Claude sessions match, specify the task ID. A `reply_received` receipt confirms a reply; a timeout does not mean the task stopped, so inspect it before retrying.
 
+An explicit request for a new conversation, or standing user instructions such as the example above, authorizes creation for independent work. Keep fixes, clarifications and results for unfinished work in its original conversation. A completed assistant turn does not by itself mean the whole task is finished; matching a project or finding a recent task does not make it the right destination for new work.
+
+In Desktop mode, generate a fresh UUID `requestId` for each independent task and retain it on every retry of that creation. Different request IDs create separate tasks even with the same directory, title and prompt. The same ID recovers the original receipt after a bridge restart; an edited title or prompt is not resent. Continue that task with its returned `threadId`. Pending or uncertain creation remains blocked: inspect the original receipt/task instead of changing the ID to retry.
+
+For backward compatibility, calls without `requestId` retain the previous deduplication by directory and explicit title (or exact prompt when no title is supplied). They can return an older task with the same title. Use a fresh request ID for independent new work; keep the old call shape when recovering an earlier legacy creation. Legacy app-server mode rejects `requestId` before creating anything because durable creation deduplication is only supported through Desktop native delivery.
+
 The sending tools ask agents to write each prompt in English with these sections, dropping any that do not apply: `Goal`, `Context`, `Task`, `Scope`, `Constraints`, `Done when`, `Reply format`. The first line names the sender, the project and the purpose. Text the user supplied is sent unchanged.
 
 ```text
@@ -384,4 +391,4 @@ npm test
 
 On Windows, use `node --test --test-concurrency=2` (also avoids npm versions that reject forwarded flags). CI tests Node 22 and 24 on Linux, macOS, and Windows. Tests use isolated fixtures and do not spend model quota. For the optional telemetry endpoint, also run `deno test --allow-env supabase/functions/bridge-usage/contract-check.ts`.
 
-[Contributing](CONTRIBUTING.md) · [Changelog](CHANGELOG.md) · [MIT license](LICENSE)
+[Contributing](CONTRIBUTING.md) · [Changelog](CHANGELOG.md) · [MIT license](LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.18.2",
+  "version": "1.19.1",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/scripts/install-native-relay.mjs

@@ -22,7 +22,7 @@ import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.2";
+const VERSION = "1.19.1";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/src/claude-bridge.mjs

@@ -26,7 +26,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.2";
+const VERSION = "1.19.1";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;
@@ -482,7 +482,8 @@ registerTool(
               rootPolicy.recheck(scopeBindings.sender, "Codex sender working directory");
               rootPolicy.recheck(scopeBindings.recipient, "Claude recipient working directory");
             }
-            if (active.threadId !== sender.threadId || active.turnId !== sender.turnId || active.cwd !== sender.cwd || active.mode !== sender.mode || active.approvalPolicy !== sender.approvalPolicy || JSON.stringify(active.review) !== JSON.stringify(sender.review)) {
+            if (active.threadId !== sender.threadId || active.turnId !== sender.turnId || active.cwd !== sender.cwd || active.mode !== sender.mode || active.approvalPolicy !== sender.approvalPolicy
+                || active.permissionProfile !== sender.permissionProfile || active.approvalsReviewer !== sender.approvalsReviewer || JSON.stringify(active.review) !== JSON.stringify(sender.review)) {
               throw preflightFailure("CODEX_SENDER_CONTEXT_CHANGED", "The sender's active turn or permissions changed while this message was queued.");
             }
             assertRecipientClass(refreshed, active);
@@ -690,6 +691,7 @@ registerTool(
         `sender mode:   ${sender?.mode ?? (desktopOnly ? "unverified - Desktop sends blocked" : peer.permissionMode ?? "unknown")}`,
         ...(sender ? [`sender context: ${sender.status} (${sender.source ?? "unavailable"})`, `sender task: ${sender.threadId ?? "unknown"}`, `sender turn: ${sender.turnId ?? "unknown"}`, ...(sender.reason ? [`sender detail: ${sender.reason}`] : [])] : []),
         ...(sender?.approvalPolicy ? [`sender approval policy: ${sender.approvalPolicy}`] : []),
+        ...(sender?.permissionProfile ? [`sender permission profile: ${sender.permissionProfile}`, `sender approval reviewer: ${sender.approvalsReviewer}`] : []),
         ...(sender?.review ? [`sender auto review: ${sender.review.autoReview}`, `sender Node REPL review: ${sender.review.nodeReplReview}`] : []),
         `session policy: ${desktopOnly ? "desktop-only" : "all Claude Code entrypoints"}`,
         `Claude account: ${accounts.claude.status}${accounts.claude.fingerprint ? ` (${accounts.claude.fingerprint.slice(0, 12)})` : ` - ${accounts.claude.reason}`}`,

package/src/claude-sender-context.mjs

@@ -1,4 +1,4 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import path from "node:path";
 import { promisify } from "node:util";
 import { listClaudeSessions } from "./peer-protocol.mjs";
@@ -6,12 +6,35 @@ import { readClaudeDesktopContext } from "./claude-desktop-context.mjs";
 
 const execute = promisify(execFile);
 const MAX_ANCESTORS = 8;
+const INSPECTION_OUTPUT_LIMIT = 16384;
+
+/**
+ * The five-second deadline is what keeps the caller check fail-closed: a read
+ * that cannot answer in time leaves the caller unverified. On Windows the read
+ * runs in a fresh Windows PowerShell that must first compile its Toolhelp
+ * helper, and the deadline used to cover that startup too. Starting is the
+ * machine's cost, not the read's: CI refused callers with INSPECTION_TIMEOUT
+ * both before the script had begun (5,036ms) and while the helper was still
+ * compiling (5,017ms), a cold start here has been measured between 5s and 15s,
+ * and the read itself takes milliseconds once the helper exists.
+ *
+ * The helper therefore reports on stderr when it is ready, and the five-second
+ * deadline starts there. Getting ready has its own ceiling, so a whole read
+ * still ends within the 30s the bridge gives its other PowerShell identity
+ * reads (peer-protocol.mjs). Either expiry kills the process and refuses the
+ * caller; nothing is read before the helper is ready, so the wait adds no
+ * staleness.
+ */
+const INSPECTION_TIMEOUT_MS = 5000;
+const INSPECTOR_START_TIMEOUT_MS = 25000;
+const INSPECTOR_READY_MARKER = "BRIDGE_ANCESTRY_READY";
 const WINDOWS_ANCESTRY_SOURCE = `
 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
 using System.Globalization;
 using System.Runtime.InteropServices;
+using System.Text;
 
 public static class ClaudeProcessAncestry {
   [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
@@ -83,6 +106,17 @@ public static class ClaudeProcessAncestry {
     }
     return rows.ToArray();
   }
+
+  public static string ReadJson(uint firstPid, int limit) {
+    var json = new StringBuilder("[");
+    foreach (var row in Read(firstPid, limit)) {
+      if (json.Length > 1) json.Append(',');
+      json.Append(@"{""pid"":").Append(row.pid.ToString(CultureInfo.InvariantCulture))
+        .Append(@",""parentPid"":").Append(row.parentPid.ToString(CultureInfo.InvariantCulture))
+        .Append(@",""processStart"":""").Append(row.processStart).Append(@"""}");
+    }
+    return json.Append(']').ToString();
+  }
 }`;
 
 function parseWindowsAncestry(stdout, parentPid, limit) {
@@ -105,26 +139,77 @@ function parseWindowsAncestry(stdout, parentPid, limit) {
   return rows;
 }
 
-export async function readProcessAncestry({ parentPid = process.ppid, platform = process.platform, maxDepth = MAX_ANCESTORS, run = execute } = {}) {
+/**
+ * Runs a process the way execFile does - the same stdout and stderr strings,
+ * maxBuffer limit, and exit-code and spawn errors - except that `timeout`
+ * starts once `readyMarker` appears on stderr, and `startupTimeout` bounds the
+ * time before it. An expiry kills the process and rejects with ETIMEDOUT and
+ * the phase that ran out. The result also carries the pid, readyAfterMs and
+ * elapsedMs so tests can report where the time went.
+ */
+export function runProcessInspector(command, args, { timeout, startupTimeout, readyMarker, maxBuffer = Infinity, windowsHide = true } = {}) {
+  return new Promise((resolve, reject) => {
+    const started = performance.now();
+    const child = spawn(command, args, { windowsHide, stdio: ["ignore", "pipe", "pipe"] });
+    const output = { stdout: [], stderr: [] };
+    const size = { stdout: 0, stderr: 0 };
+    let readyAfterMs = null;
+    let settled = false;
+    let timer;
+    const text = (stream) => Buffer.concat(output[stream]).toString("utf8");
+    const settle = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (error && child.pid !== undefined && child.exitCode === null && child.signalCode === null) child.kill();
+      const result = { stdout: text("stdout"), stderr: text("stderr"), pid: child.pid, readyAfterMs, elapsedMs: Math.round(performance.now() - started) };
+      if (error) reject(Object.assign(error, result));
+      else resolve(result);
+    };
+    const arm = (phase, ms) => {
+      clearTimeout(timer);
+      timer = setTimeout(() => settle(Object.assign(new Error(`Process inspection ${phase} deadline elapsed`), { code: "ETIMEDOUT", phase, killed: true, signal: "SIGTERM" })), ms);
+    };
+    if (readyMarker) arm("startup", startupTimeout);
+    else arm("inspection", timeout);
+    for (const stream of ["stdout", "stderr"]) {
+      child[stream].on("data", (chunk) => {
+        if (settled) return;
+        output[stream].push(chunk);
+        size[stream] += chunk.length;
+        if (size[stream] > maxBuffer) return settle(Object.assign(new RangeError(`${stream} maxBuffer length exceeded`), { code: "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" }));
+        if (stream === "stderr" && readyMarker && readyAfterMs === null && text("stderr").includes(readyMarker)) {
+          readyAfterMs = Math.round(performance.now() - started);
+          arm("inspection", timeout);
+        }
+      });
+    }
+    child.on("error", settle);
+    child.on("close", (code, signal) => settle(code === 0 ? null : Object.assign(new Error(`Process inspection exited with ${signal ?? code}`), { code, signal })));
+  });
+}
+
+export async function readProcessAncestry({ parentPid = process.ppid, platform = process.platform, maxDepth = MAX_ANCESTORS, run } = {}) {
   if (!Number.isSafeInteger(parentPid) || parentPid <= 0 || parentPid > 0xffffffff) return [];
   const limit = Number.isInteger(maxDepth) && maxDepth > 0 ? Math.min(maxDepth, MAX_ANCESTORS) : MAX_ANCESTORS;
-  const options = { timeout: 5000, maxBuffer: 16384, windowsHide: true };
   if (platform === "win32") {
     const shell = path.win32.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-    const script = `$ErrorActionPreference='Stop'; $PSModuleAutoLoadingPreference='None'; Import-Module -Name ([IO.Path]::Combine($PSHOME,'Modules','Microsoft.PowerShell.Utility','Microsoft.PowerShell.Utility.psd1')) -ErrorAction Stop; Add-Type -TypeDefinition @'\n${WINDOWS_ANCESTRY_SOURCE}\n'@\nConvertTo-Json -InputObject @([ClaudeProcessAncestry]::Read(${parentPid},${limit})) -Compress`;
-    const { stdout } = await run(shell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], options);
+    const script = `$ErrorActionPreference='Stop'; $PSModuleAutoLoadingPreference='None'; Import-Module -Name ([IO.Path]::Combine($PSHOME,'Modules','Microsoft.PowerShell.Utility','Microsoft.PowerShell.Utility.psd1')) -ErrorAction Stop; Add-Type -TypeDefinition @'\n${WINDOWS_ANCESTRY_SOURCE}\n'@\n[Console]::Error.WriteLine('${INSPECTOR_READY_MARKER}')\n[Console]::Out.Write([ClaudeProcessAncestry]::ReadJson(${parentPid},${limit}))`;
+    const { stdout } = await (run ?? runProcessInspector)(shell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+      timeout: INSPECTION_TIMEOUT_MS, startupTimeout: INSPECTOR_START_TIMEOUT_MS, readyMarker: INSPECTOR_READY_MARKER, maxBuffer: INSPECTION_OUTPUT_LIMIT, windowsHide: true,
+    });
     return parseWindowsAncestry(stdout, parentPid, limit);
   }
   const rows = [];
   const seen = new Set();
   let next = parentPid;
-  const deadline = Date.now() + 5000;
+  const deadline = Date.now() + INSPECTION_TIMEOUT_MS;
   while (next > 0 && !seen.has(next) && rows.length < limit) {
     seen.add(next);
     const remaining = deadline - Date.now();
     if (remaining <= 0) throw new Error("process inspection deadline elapsed");
-    const { stdout } = await run("/bin/ps", ["-p", String(next), "-o", "pid=,ppid=,lstart="], {
-      ...options, timeout: remaining, env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
+    const { stdout } = await (run ?? execute)("/bin/ps", ["-p", String(next), "-o", "pid=,ppid=,lstart="], {
+      timeout: remaining, maxBuffer: INSPECTION_OUTPUT_LIMIT, windowsHide: true, env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
     });
     const match = stdout.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
     if (!match) break;
@@ -140,6 +225,7 @@ function senderResult(status, reason, values = {}) {
 }
 
 function senderFailureCode(error) {
+  if (error?.code === "ETIMEDOUT" && error.phase === "startup") return "INSPECTOR_START_TIMEOUT";
   if (error?.code === "ETIMEDOUT" || (error?.killed && ["SIGTERM", "SIGKILL"].includes(error.signal))) return "INSPECTION_TIMEOUT";
   if (error?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") return "OUTPUT_LIMIT";
   if (["ENOENT", "EACCES", "EPERM"].includes(error?.code)) return error.code;

package/src/codex-native-response.mjs

@@ -8,6 +8,7 @@ const MAX_ROLLOUT_BYTES = 16 * 1024 * 1024;
 const MAX_ENTRIES = 100000;
 const MAX_DIRECTORIES = 4096;
 const MAX_REPLY_BYTES = 1024 * 1024;
+const DESKTOP_ORIGINATORS = new Set(["Codex Desktop", "codex_work_desktop"]);
 const COMPLETED = new Set(["task_complete", "task_completed", "turn_complete", "turn_completed"]);
 const STARTED = new Set(["task_started", "turn_started"]);
 const FAILED = new Set(["task_aborted", "turn_aborted", "task_failed", "turn_failed"]);
@@ -155,12 +156,14 @@ function validateSession(records, threadId, expectedCwd) {
   const sessions = records.filter(({ record }) => record.type === "session_meta").map(({ record }) => record.payload);
   if (sessions.length !== 1) throw new Error("The Codex rollout has ambiguous session identity");
   const session = sessions[0];
-  if (session.id !== threadId || session.originator !== "Codex Desktop" || session.source !== "vscode") throw new Error("The rollout does not confirm the exact native Codex Desktop task");
+  if (session.id !== threadId || !DESKTOP_ORIGINATORS.has(session.originator) || session.source !== "vscode") throw new Error("The rollout does not confirm the exact native Codex Desktop task");
   if (canonicalDirectory(session.cwd, "The rollout workspace") !== expectedCwd) throw new Error("The rollout workspace does not match the selected native task");
 }
 
-function delegationOutput(executorThreadId, prompt) {
-  return `<codex_delegation>\n  <source_thread_id>${executorThreadId}</source_thread_id>\n  <input>${prompt}</input>\n</codex_delegation>`;
+function delegationOutputs(executorThreadId, prompt) {
+  const escaped = prompt.replace(/[&<>]/g, (character) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" })[character]);
+  // Older Desktop rollouts stored raw text; current builds escape XML text content.
+  return [prompt, escaped].map((text) => `<codex_delegation>\n  <source_thread_id>${executorThreadId}</source_thread_id>\n  <input>${text}</input>\n</codex_delegation>`);
 }
 
 function normalizedText(value) {
@@ -214,7 +217,7 @@ function inspectTurnRecords(records, threadId, turnId, cwd, { requireDispatch }
   if (requireDispatch) {
     const dispatches = turns.filter(({ record }) => record.type === "response_item" && record.payload.type === "function_call_output" &&
       record.payload.namespace === "codex_app" && record.payload.name === "send_message_to_thread");
-    if (dispatches.length !== 1 || dispatches[0].record.payload.output !== requireDispatch.output ||
+    if (dispatches.length !== 1 || !requireDispatch.outputs.includes(dispatches[0].record.payload.output) ||
         contexts[0].start >= dispatches[0].start || dispatches[0].start >= completions[0].start) {
       throw new Error("The newly observed turn is not correlated to the exact native dispatch");
     }
@@ -324,7 +327,7 @@ export function readCodexNativeTurnResponse({ threadId, turnId, previousTurnId,
     validateSession(records, threadId, cwd);
     const tail = records.filter(({ start }) => start >= watermark.size);
     const inspected = inspectTurnRecords(tail, threadId, turnId, cwd, {
-      requireDispatch: { output: delegationOutput(executorThreadId, prompt) },
+      requireDispatch: { outputs: delegationOutputs(executorThreadId, prompt) },
     });
     return { ...inspected, observationStatus: inspected.status };
   } catch (error) {

package/src/codex-sender-context.mjs

@@ -9,6 +9,13 @@ const STARTED = new Set(["task_started", "turn_started"]);
 const MAX_ROLLOUT_BYTES = 64 * 1024 * 1024;
 const MAX_ENTRIES = 100000;
 const MAX_DIRECTORIES = 4096;
+const DESKTOP_ORIGINATORS = new Set(["Codex Desktop", "codex_work_desktop"]);
+const PROMPTING_POLICIES = new Set(["on-request", "on-failure", "untrusted"]);
+const GRANULAR_CATEGORIES = ["sandbox_approval", "rules", "mcp_elicitations"];
+const MANAGED_REVIEWERS = new Set(["user", "auto_review"]);
+const MANAGED_SANDBOXES = new Set(["read-only", "workspace-write"]);
+const ENTRY_ACCESS = new Set(["read", "write", "deny", "none"]);
+const WRITABLE_SPECIAL_PATHS = new Set(["project_roots", "current_working_directory", "tmpdir", "slash_tmp"]);
 
 function object(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -97,14 +104,79 @@ export function readState(file, maxBytes) {
 }
 
 /**
- * Claude's inbound parity gate groups sessions by one question: does a human
- * still prompt the sender? Codex answers it with approval_policy. Its two host
- * review flags describe automated review instead - node_repl_auto_review_required
- * is a per-model catalog attribute (Codex Desktop derives it from
- * autoReview.requiredOnModels; the live gpt-6-astra task carried it with a
- * user reviewer and auto review disabled) and auto_review_enabled names a
- * Guardian reviewer - so they are required as evidence and reported, but
- * never move a sender between classes.
+ * Codex writes AskForApproval as a string, or as {granular: {...}} whose
+ * boolean categories choose which approval requests reach the reviewer. The
+ * label is a plain string so receipts and the queued-send comparison can
+ * compare it directly.
+ */
+function approvalPolicyLabel(policy) {
+  if (policy === "never" || PROMPTING_POLICIES.has(policy)) return policy;
+  if (!exactObject(policy, ["granular"]) || !object(policy.granular)) return null;
+  const categories = Object.entries(policy.granular);
+  if (!GRANULAR_CATEGORIES.every((category) => Object.hasOwn(policy.granular, category)) || categories.some(([, allowed]) => typeof allowed !== "boolean")) return null;
+  return `granular(${categories.filter(([, allowed]) => allowed).map(([category]) => category).sort().join(",")})`;
+}
+
+function rootPath(value) {
+  let local = value.replace(/^file:/i, "");
+  if (local.startsWith("///")) local = local.slice(2);
+  local = local.replace(/^\/(?=[a-z]:)/i, "").replace(/^\\\\\?\\UNC\\/i, "\\\\");
+  const { base } = path.win32.parse(path.win32.normalize(local || "/"));
+  return !base || base === ".";
+}
+
+/**
+ * A write grant on the file-system root, on a literal root path, or on a
+ * target whose breadth cannot be judged (a glob or an unrecognised special
+ * path) would leave the sandbox as open as full access, so such a profile
+ * gets no class. Read and deny entries only narrow what the sandbox exposes,
+ * so an unrecognised special path among them is ignored, as Codex ignores it.
+ */
+function assertSandboxEntry(entry) {
+  const target = object(entry) ? entry.path : undefined;
+  const known = object(target) && (
+    (target.type === "path" && exactObject(target, ["type", "path"]) && typeof target.path === "string")
+    || (target.type === "glob_pattern" && exactObject(target, ["type", "pattern"]) && typeof target.pattern === "string")
+    || (target.type === "special" && exactObject(target, ["type", "value"]) && object(target.value) && typeof target.value.kind === "string"));
+  if (!known || !ENTRY_ACCESS.has(entry.access) || Object.keys(entry).some((key) => !["path", "access", "missing_path_behavior"].includes(key))
+      || (Object.hasOwn(entry, "missing_path_behavior") && entry.missing_path_behavior !== "skip")) throw new Error("The caller's managed sandbox has an unsupported file-system entry; no permission class was inferred");
+  if (entry.access === "write" && (target.type === "glob_pattern" || (target.type === "path" ? rootPath(target.path) : !WRITABLE_SPECIAL_PATHS.has(target.value.kind)))) {
+    throw new Error("The caller's managed sandbox grants write access beyond specific directories; no permission class was inferred");
+  }
+}
+
+function assertManagedSandbox(context) {
+  const { permission_profile: profile, sandbox_policy: sandbox } = context;
+  if (!exactObject(profile, ["type", "file_system", "network"]) || !["restricted", "enabled"].includes(profile.network)) throw new Error("The caller's managed permission profile is unsupported; no permission class was inferred");
+  const fileSystem = profile.file_system;
+  if (object(fileSystem) && fileSystem.type === "unrestricted") throw new Error("The caller's managed sandbox leaves the file system unrestricted; no permission class was inferred");
+  if (!object(fileSystem) || fileSystem.type !== "restricted" || !Array.isArray(fileSystem.entries)
+      || Object.keys(fileSystem).some((key) => !["type", "entries", "glob_scan_max_depth"].includes(key))
+      || (Object.hasOwn(fileSystem, "glob_scan_max_depth") && !(Number.isSafeInteger(fileSystem.glob_scan_max_depth) && fileSystem.glob_scan_max_depth > 0))) throw new Error("The caller's managed file-system sandbox is unsupported; no permission class was inferred");
+  for (const entry of fileSystem.entries) assertSandboxEntry(entry);
+  if (!object(sandbox) || !MANAGED_SANDBOXES.has(sandbox.type)) throw new Error("The caller's effective sandbox policy does not match its managed permission profile");
+}
+
+/**
+ * Claude's inbound parity gate asks one question: does the sender bypass
+ * permission checks? Claude puts only bypassPermissions in that class and
+ * counts dontAsk (deny without asking) and auto (a classifier approves) as
+ * prompting.
+ *
+ * For a Codex task with no sandbox, approval_policy decides: never is bypass,
+ * and a policy that routes requests for approval is prompting. A task inside
+ * a Codex-managed sandbox that restricts the file system never bypasses the
+ * checks, whatever its approval policy or reviewer: a sandbox that never asks
+ * is dontAsk, and escalations decided by the auto_review subagent are auto.
+ * Such a sender is always prompting, never bypass. Codex Desktop's "Ask for
+ * approval" and "Approve for me" run this way; only "Full access" is bypass.
+ *
+ * The two host review flags describe automated review instead -
+ * node_repl_auto_review_required is a per-model catalog attribute (Codex
+ * Desktop derives it from autoReview.requiredOnModels; the live gpt-6-astra
+ * task carried it with a user reviewer and auto review disabled) and
+ * auto_review_enabled names a Guardian reviewer - so they are required as
+ * evidence and reported, but never move a sender between classes.
  * Downgrading them held every send from such a model behind an approval
  * dialog that Claude Desktop does not render.
  */
@@ -112,11 +184,18 @@ function permissionClass(context, metadata) {
   for (const field of ["auto_review_enabled", "node_repl_auto_review_required"]) {
     if (!Object.hasOwn(metadata, field) || typeof metadata[field] !== "boolean") throw new Error(`The caller's ${field} review evidence is ${reviewFlag(metadata, field)}; the host must supply an explicit boolean`);
   }
+  const approvalPolicy = approvalPolicyLabel(context.approval_policy);
+  if (object(context.permission_profile) && context.permission_profile.type === "managed") {
+    if (!MANAGED_REVIEWERS.has(context.approvals_reviewer)) throw new Error("The caller's effective approval reviewer is unverified");
+    assertManagedSandbox(context);
+    if (!approvalPolicy) throw new Error("The caller's effective approval policy is unsupported");
+    return { mode: "prompting", approvalPolicy, permissionProfile: "managed" };
+  }
   if (context.approvals_reviewer !== "user") throw new Error("The caller's effective approval reviewer is unverified");
-  if (!exactObject(context.permission_profile, ["type"]) || context.permission_profile.type !== "disabled") throw new Error("The caller's permission profile is restricted or unsupported; no permission class was inferred");
+  if (!exactObject(context.permission_profile, ["type"]) || context.permission_profile.type !== "disabled") throw new Error("The caller's permission profile is unsupported; no permission class was inferred");
   if (!exactObject(context.sandbox_policy, ["type"]) || context.sandbox_policy.type !== "danger-full-access") throw new Error("The caller's effective sandbox policy does not match its disabled permission profile");
-  if (context.approval_policy === "never") return "bypass";
-  if (["on-request", "on-failure", "untrusted"].includes(context.approval_policy)) return "prompting";
+  if (approvalPolicy === "never") return { mode: "bypass", approvalPolicy, permissionProfile: "disabled" };
+  if (PROMPTING_POLICIES.has(approvalPolicy)) return { mode: "prompting", approvalPolicy, permissionProfile: "disabled" };
   throw new Error("The caller's effective approval policy is unsupported");
 }
 
@@ -135,13 +214,15 @@ export function readCodexSenderContext(meta, { env = process.env, maxRolloutByte
     const state = readState(file, Math.min(MAX_ROLLOUT_BYTES, maxRolloutBytes));
     const { session, context, lifecycle } = state;
     if (!["Codex Desktop", "codex_vscode"].includes(originator)) throw new Error("Unsupported calling host");
-    if (session?.id !== identity.threadId || session.originator !== originator || session.source !== "vscode") throw new Error(`The caller rollout does not confirm a root ${originator} task`);
+    const desktop = originator === "Codex Desktop";
+    const matchesOriginator = desktop ? DESKTOP_ORIGINATORS.has(session?.originator) : session?.originator === originator;
+    if (session?.id !== identity.threadId || !matchesOriginator || session.source !== "vscode") throw new Error(`The caller rollout does not confirm a root ${originator} task`);
     if (context?.turn_id !== identity.turnId || lifecycle?.turn_id !== identity.turnId || !STARTED.has(lifecycle?.type)) throw new Error("The calling turn is no longer the latest active Codex turn");
     if (typeof context.cwd !== "string" || !path.isAbsolute(context.cwd) || typeof session.cwd !== "string" || !path.isAbsolute(session.cwd)) throw new Error("The caller's workspace is missing or invalid");
     const cwd = fs.realpathSync.native(context.cwd);
     if (!fs.statSync(cwd).isDirectory() || path.relative(fs.realpathSync.native(session.cwd), cwd)) throw new Error("The caller's workspace changed from its Desktop session identity");
-    const mode = permissionClass(context, metadata);
-    return { status: "verified", ...identity, mode, cwd, source: file, approvalPolicy: context.approval_policy, reason: "Host-supplied calling task and active turn match the Desktop rollout's effective permission settings" };
+    const { mode, approvalPolicy, permissionProfile } = permissionClass(context, metadata);
+    return { status: "verified", ...identity, mode, cwd, source: file, approvalPolicy, permissionProfile, approvalsReviewer: context.approvals_reviewer, reason: "Host-supplied calling task and active turn match the Desktop rollout's effective permission settings" };
   } catch (error) {
     return unavailable(error?.code ? `Caller evidence could not be read (${error.code}); no sender permission class was inferred` : error.message, identity);
   }

package/src/desktop-task-receipts.mjs

@@ -5,11 +5,15 @@ import path from "node:path";
 import { homeDir } from "./platform.mjs";
 
 const HASH = /^[a-f0-9]{64}$/;
-const FIELDS = new Set(["version", "key", "cwd", "promptHash", "state", "startedAt", "threadId", "projectId", "projectName", "name", "accountContext"]);
+const REQUEST_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+const FIELDS = new Set(["version", "key", "cwd", "promptHash", "state", "startedAt", "threadId", "projectId", "projectName", "name", "accountContext", "requestId"]);
 const digest = (value) => createHash("sha256").update(value).digest("hex");
 const normalizedName = (name) => name?.normalize("NFC").trim().replace(/\s+/g, " ");
 const canonicalCwd = (cwd) => process.platform === "win32" ? path.normalize(cwd).toLowerCase() : path.normalize(cwd);
 const nonemptyString = (value) => typeof value === "string" && value.trim().length > 0 && value.length <= 8192 && !/[\u0000-\u001f]/.test(value);
+const receiptKey = ({ cwd, name, promptHash, requestId }) => digest(JSON.stringify(requestId
+  ? [canonicalCwd(cwd), "request", requestId.toLowerCase()]
+  : [canonicalCwd(cwd), normalizedName(name) || promptHash]));
 
 function assertKey(key) {
   if (typeof key !== "string" || !HASH.test(key)) throw new Error("Invalid Desktop task receipt key; refusing unsafe filesystem access.");
@@ -23,6 +27,7 @@ function validateReceipt(key, receipt) {
   const valid = receipt && typeof receipt === "object" && !Array.isArray(receipt)
     && Object.keys(receipt).every((field) => FIELDS.has(field))
     && receipt.version === 1 && receipt.key === key && HASH.test(receipt.promptHash)
+    && (receipt.requestId === undefined || typeof receipt.requestId === "string" && REQUEST_ID.test(receipt.requestId))
     && nonemptyString(receipt.cwd) && path.isAbsolute(receipt.cwd)
     && ["pending", "unknown", "known"].includes(receipt.state)
     && Number.isSafeInteger(receipt.startedAt) && receipt.startedAt >= 0
@@ -31,7 +36,7 @@ function validateReceipt(key, receipt) {
     && ["threadId", "projectId", "projectName", "name"].every((field) => receipt[field] === undefined || nonemptyString(receipt[field]))
     && (receipt.state !== "known" || nonemptyString(receipt.threadId));
   if (!valid) throw unsafeReceipt(key);
-  const expected = digest(JSON.stringify([canonicalCwd(receipt.cwd), normalizedName(receipt.name) || receipt.promptHash]));
+  const expected = receiptKey(receipt);
   if (expected !== key) throw unsafeReceipt(key);
   return receipt;
 }
@@ -41,12 +46,15 @@ export class DesktopTaskReceipts {
     this.directory = path.resolve(directory);
   }
 
-  key({ cwd, prompt, name }) {
+  key({ cwd, prompt, name, requestId }) {
     if (!nonemptyString(cwd) || !path.isAbsolute(cwd) || typeof prompt !== "string" || (name !== undefined && typeof name !== "string")) {
       throw new Error("Desktop task receipts require an absolute validated cwd, a prompt string, and an optional name string.");
     }
+    if (requestId !== undefined && (typeof requestId !== "string" || !REQUEST_ID.test(requestId))) {
+      throw new Error("Desktop task creation requestId must be a stable UUID; use a fresh UUID only for independent new work.");
+    }
     const promptHash = digest(prompt);
-    return { key: digest(JSON.stringify([canonicalCwd(cwd), normalizedName(name) || promptHash])), promptHash };
+    return { key: receiptKey({ cwd, name, promptHash, requestId }), promptHash, ...(requestId ? { requestId: requestId.toLowerCase() } : {}) };
   }
 
   async ensureDirectory(create = false) {

package/src/index.mjs

@@ -34,7 +34,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.2";
+const VERSION = "1.19.1";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
@@ -169,12 +169,12 @@ function threadNameFor({ cwd, prompt, name }) {
   );
 }
 
-async function delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSec, openInApp, waitForReply = true }) {
+async function delegateDesktopTask({ cwd, prompt, name, requestId, model, effort, timeoutSec, openInApp, waitForReply = true }) {
   const deadline = desktopOperation.getStore()?.deadline ?? Date.now() + Math.min((timeoutSec ?? 40) * 1000, DESKTOP_TOOL_BUDGET_MS);
   const workspace = resolveWorkspacePath(cwd);
   const created = await desktopTasks.create({
     cwd: workspace.path, prompt, name: threadNameFor({ cwd: workspace.path, prompt, name }),
-    dedupeName: name ?? "", model: model ?? DEFAULT_MODEL, effort: effort ?? DEFAULT_EFFORT, deadline,
+    dedupeName: name ?? "", requestId, model: model ?? DEFAULT_MODEL, effort: effort ?? DEFAULT_EFFORT, deadline,
   });
   const notes = [];
   if (workspace.note) notes.push(workspace.note);
@@ -188,6 +188,7 @@ async function delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSe
   }
   const lines = [
     created.reused ? "Reused the existing Codex Desktop task; the prompt was not resent" : "Delegated through Codex Desktop", `threadId: ${created.threadId}`, `name: ${created.name}`,
+    ...(requestId ? [`requestId: ${requestId}`] : []),
     `cwd: ${created.cwd}`,
     ...(created.projectAssignmentStatus === "unverified"
       ? [`expected projectId: ${created.expectedProjectId}`, `expected project: ${created.expectedProjectName ?? "(unnamed)"}`, "project assignment: unverified", created.projectAssignmentNote]
@@ -195,7 +196,7 @@ async function delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSe
     "permissions: Codex Desktop settings; no external app-server writer",
     ...(created.promptChanged ? [created.projectAssignmentStatus === "unverified"
       ? "The edited brief was not sent. Inspect this task's project assignment before continuing it."
-      : "The edited brief was not sent. Use send_to_codex_thread with this threadId for a continuation, or a distinct title for separate work."] : []), ...notes,
+      : "The edited brief was not sent. Continue the same unfinished work with send_to_codex_thread and this threadId. For independent new work, create a task with a fresh requestId; never change requestId merely to retry uncertain delivery."] : []), ...notes,
   ];
   if (created.projectAssignmentStatus === "unverified") return textResult([...lines, "status: existing task retained; project assignment needs inspection"].join("\n"));
   if (!waitForReply) return textResult([...lines, created.reused ? "status: existing task; read it to check its current progress" : "status: accepted; the task is running in Desktop"].join("\n"));
@@ -341,9 +342,12 @@ const server = new McpServer(
   { name: "codex-bridge", version: VERSION },
   {
     instructions:
-      "Bridge Claude work into Codex. Prefer an existing task: inspect its exact threadId and project, then use send_to_codex_thread. " +
-      "Only use delegate_to_codex or start_codex_thread when the user explicitly requests a new task at the " +
-      "requested cwd. With Desktop tasks enabled it assigns the exact saved project and starts visibly in " +
+      "Bridge Claude work into Codex. When the user requests a new conversation or has given standing authorization to create one for each independent task, " +
+      "use delegate_to_codex or start_codex_thread with the initial prompt and a fresh requestId for each independent task or feature in Desktop mode, even in the same project. " +
+      "In legacy app-server mode, use delegate_to_codex with the initial prompt and omit requestId; durable creation deduplication is unavailable there. " +
+      "Reuse that requestId only for retries of that creation. Continue unfinished work, fixes, clarifications, and results in its verified original threadId with send_to_codex_thread. " +
+      "A completed turn alone does not mean the task is finished. Do not choose an old task merely because its project matches or it was recently active. " +
+      "Without authorization to create a new conversation, ask before creating it. With Desktop tasks enabled it assigns the exact saved project and starts visibly in " +
       "Codex Desktop using Desktop permissions. Otherwise it releases the bridge writer lock and opens the exact thread in " +
       "Codex Desktop. Use send_to_codex_thread only when an existing threadId is intentional; use " +
       "list_codex_threads or read_codex_thread to inspect sessions and codex_bridge_status to inspect wiring. " +
@@ -399,9 +403,12 @@ registerTool(
     title: "Delegate work to a new Codex session",
     description:
       "Create a named Codex session at the requested project directory, send Claude's prompt into it, " +
-      "return Codex's reply, and hand the session to Codex Desktop without leaving the bridge writer lock behind.",
+      "return Codex's reply, and hand the session to Codex Desktop without leaving the bridge writer lock behind. " +
+      "Use for independent new work when the user explicitly or through standing instructions authorizes new conversations. " +
+      "In Desktop mode, supply a fresh requestId per independent task and keep it on retries; omit requestId in legacy app-server mode. Use send_to_codex_thread for unfinished work.",
     inputSchema: {
       cwd: z.string().describe("Absolute project directory where Codex must work"),
+      requestId: z.string().uuid().optional().describe("Desktop creation identity: fresh UUID for each independent new task; retain exactly on retries. Omitting it preserves legacy title/prompt deduplication and can return an older task. Not supported in legacy app-server mode."),
       prompt: z.string().describe(`The complete task Claude is delegating to Codex. ${PROMPT_FIELD_HINT}`),
       name: z.string().min(1).max(200).optional().describe("Optional Codex session title; otherwise one is derived from the prompt"),
       timeoutSec: z
@@ -432,12 +439,13 @@ registerTool(
       openWorldHint: true,
     },
   },
-  async ({ cwd, prompt, name, timeoutSec, model, effort, openInApp, releaseAfterTurn }) => {
+  async ({ cwd, prompt, name, requestId, timeoutSec, model, effort, openInApp, releaseAfterTurn }) => {
     const shouldOpen = openInApp ?? DEFAULT_OPEN_IN_APP;
     const shouldRelease = releaseAfterTurn ?? DEFAULT_RELEASE_AFTER_TURN;
     const notes = [];
     try {
-      if (desktopTasksEnabled) return await delegateDesktopTask({ cwd, prompt, name, model, effort, timeoutSec, openInApp });
+      if (desktopTasksEnabled) return await delegateDesktopTask({ cwd, prompt, name, requestId, model, effort, timeoutSec, openInApp });
+      if (requestId !== undefined) throw new Error("Creation requestId requires Desktop native delivery; legacy app-server mode cannot safely deduplicate this request. No task was created.");
       const created = await createCodexThread({ cwd, prompt, name, model });
       if (created.workspace.note) notes.push(created.workspace.note);
       if (shouldOpen && !shouldRelease) {
@@ -490,6 +498,7 @@ registerTool(
     title: "Send a prompt to a Codex thread",
     description:
       "Send a prompt as a new user turn inside an existing Codex thread and wait for Codex to answer. " +
+      "Use only for the same unfinished task, including follow-up fixes, clarifications, or results; independent new work belongs in a new conversation when authorized. " +
       "The thread keeps its full history, cwd and model. Use list_codex_threads first if you do not know the threadId. " +
       "Desktop-owned tasks must use Desktop native delivery; an open task is a valid destination. " +
       "If legacy delivery reports an active writer, inspect codex_bridge_status and repair the native relay/configuration. " +
@@ -529,6 +538,7 @@ registerTool(
   },
   async ({ threadId, prompt, timeoutSec, cwd, model, effort, name, openInApp, releaseAfterTurn }) => {
     const deadline = desktopTasksEnabled ? desktopOperation.getStore()?.deadline ?? Date.now() + Math.min((timeoutSec ?? 40) * 1000, DESKTOP_TOOL_BUDGET_MS) : undefined;
+    let acceptedDelivery;
     return (desktopTasksEnabled ? desktopTasks : client).withThread(threadId, async () => {
       const notes = [];
       const shouldOpen = openInApp ?? DEFAULT_OPEN_IN_APP;
@@ -538,6 +548,7 @@ registerTool(
           const workspace = cwd ? resolveWorkspacePath(cwd) : null;
           if (workspace) security.assertCwd(workspace.path);
           const delivered = await desktopTasks.send({ threadId, prompt, cwd: workspace?.path, model: model ?? DEFAULT_MODEL, effort: effort ?? DEFAULT_EFFORT, name, deadline });
+          acceptedDelivery = delivered;
           notes.push("sent through Codex Desktop; no external app-server writer", `cwd: ${delivered.cwd}`);
           if (shouldOpen) {
             try {
@@ -608,7 +619,16 @@ registerTool(
       } catch (err) {
         return failure(err);
       }
-    }, { deadline }).catch(failure);
+    }, {
+      deadline,
+      onDeadline(error) {
+        if (!acceptedDelivery) throw error;
+        return {
+          ...textResult(`sent through Codex Desktop; no external app-server writer\ncwd: ${acceptedDelivery.cwd}\nthreadId: ${threadId}\nstatus: timeout\nTask was accepted; the response deadline elapsed before a completed reply was observed. Inspect the existing task; do not resend.`),
+          structuredContent: { threadId, deliveryStatus: "accepted", status: "timeout", responseStatus: "unavailable" },
+        };
+      },
+    }).catch(failure);
   },
 );
 
@@ -702,9 +722,10 @@ registerTool(
   "start_codex_thread",
   {
     title: "Start a new Codex thread",
-    description: "Start a Codex task. In Desktop mode include the initial prompt to create and assign a visible task atomically; use delegate_to_codex to also wait for its reply.",
+    description: "Start a new Codex task when the user explicitly or through standing instructions authorizes a new conversation for independent work. In Desktop mode include the initial prompt and a fresh requestId to create and assign a visible task atomically; keep requestId unchanged on retries. Continue unfinished work with send_to_codex_thread and its original threadId. Use delegate_to_codex to also wait for its reply.",
     inputSchema: {
       cwd: z.string().describe("Absolute working directory for the new Codex session"),
+      requestId: z.string().uuid().optional().describe("Desktop creation identity: fresh UUID per independent task, same UUID on retries. Omit only for legacy title/prompt deduplication. Not supported in legacy app-server mode."),
       prompt: z.string().min(1).optional().describe(`Initial task; required with CODEX_BRIDGE_DESKTOP_TASKS=1, starts immediately. ${PROMPT_FIELD_HINT}`),
       model: z.string().optional().describe("Model override, e.g. gpt-5.6-luna"),
       name: z.string().min(1).max(200).optional().describe("Optional title to show for the new Codex session"),
@@ -716,12 +737,13 @@ registerTool(
       openWorldHint: true,
     },
   },
-  async ({ cwd, model, name, prompt }) => {
+  async ({ cwd, model, name, prompt, requestId }) => {
     try {
       if (desktopTasksEnabled) {
         if (!prompt?.trim()) throw new Error("Desktop task creation requires the initial prompt. Use delegate_to_codex, or pass prompt to start_codex_thread. No task was created.");
-        return await delegateDesktopTask({ cwd, model, name, prompt, waitForReply: false });
+        return await delegateDesktopTask({ cwd, model, name, prompt, requestId, waitForReply: false });
       }
+      if (requestId !== undefined) throw new Error("Creation requestId requires Desktop native delivery; legacy app-server mode cannot safely deduplicate this request. No task was created.");
       if (prompt) throw new Error("Use delegate_to_codex to send an initial prompt in app-server mode.");
       const created = await createCodexThread({ cwd, model, name });
       return textResult(

package/src/native-relay-companion.mjs

@@ -34,7 +34,7 @@ import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.18.2";
+const VERSION = "1.19.1";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent) {

package/src/recipient-preflight.mjs

@@ -22,5 +22,5 @@ export function assertRecipientClass(session, sender) {
   if (inbound.value === "accept") return;
   const recipient = session.desktop?.permissionClass ?? null;
   if (!recipient || recipient === sender.mode) return;
-  throw preflightFailure("CLAUDE_RECIPIENT_CLASS_MISMATCH", `The Claude Desktop task "${session.desktop.title}" runs in ${session.desktop.permissionMode} (${recipient} class) while this sender attests ${sender.mode}. With no explicit crossSessionInbound setting, Claude holds a cross-session message whose sender class differs from the recipient's, and Claude Desktop declares no peer approval dialog, so the message would expire unapproved. Report this to the user: they can run that task in the ${sender.mode} class, change this Codex task's approval policy so its class matches, or set crossSessionInbound to accept in the recipient session's own settings. Do not change the attested sender class or recipient settings yourself.`);
+  throw preflightFailure("CLAUDE_RECIPIENT_CLASS_MISMATCH", `The Claude Desktop task "${session.desktop.title}" runs in ${session.desktop.permissionMode} (${recipient} class) while this sender attests ${sender.mode}. With no explicit crossSessionInbound setting, Claude holds a cross-session message whose sender class differs from the recipient's, and Claude Desktop declares no peer approval dialog, so the message would expire unapproved. Report this to the user: they can run that task in the ${sender.mode} class, change this Codex task's permissions so its class matches (a Codex task attests bypass only with Full access and approval policy never), or set crossSessionInbound to accept in the recipient session's own settings. Do not change the attested sender class or recipient settings yourself.`);
 }

package/src/thread-delivery.mjs

@@ -79,7 +79,7 @@ export class DesktopTaskDelivery {
     }
   }
 
-  async withThread(threadId, operation, { deadline } = {}) {
+  async withThread(threadId, operation, { deadline, onDeadline } = {}) {
     const previous = this.threadOperations.get(threadId) ?? Promise.resolve();
     let expired = false;
     const current = previous.catch(() => {}).then(() => {
@@ -98,6 +98,10 @@ export class DesktopTaskDelivery {
           reject(new Error("The Desktop response deadline elapsed. A previous operation may still be running; inspect the existing task before sending anything again."));
         }, Math.max(1, deadline - this.now()));
       })]);
+    } catch (error) {
+      // Preserve confirmed dispatch state while the underlying operation retains its lock.
+      if (expired && onDeadline) return onDeadline(error);
+      throw error;
     } finally {
       clearTimeout(timer);
     }
@@ -197,12 +201,12 @@ export class DesktopTaskDelivery {
     return { projectId: project.projectId, projectName: project.label, projectAssignmentStatus: "verified" };
   }
 
-  async create({ cwd, prompt, name, dedupeName = name, model, effort, deadline = this.now() + DESKTOP_TOOL_BUDGET_MS }) {
+  async create({ cwd, prompt, name, dedupeName = name, requestId, model, effort, deadline = this.now() + DESKTOP_TOOL_BUDGET_MS }) {
     this.security.assertCwd(cwd);
     cwd = realpathSync.native(cwd);
     this.security.assertCwd(cwd);
     dedupeName = dedupeName?.normalize("NFC").trim().replace(/\s+/g, " ") || undefined;
-    const identity = this.receipts.key({ cwd, prompt, name: dedupeName });
+    const identity = this.receipts.key({ cwd, prompt, name: dedupeName, requestId });
     const accountContext = this.accountContext?.();
     if (this.accountContext && !accountContext) throw new Error("Desktop creation requires the original verified account context.");
     const options = { cwd, promptHash: identity.promptHash, deadline, accountContext };