@minhspark/codex-mcp-bridge 1.19.2 → 1.19.3

package/CHANGELOG.md

@@ -4,6 +4,16 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.19.3] - 2026-09-30
+
+### Changed
+
+- Write the `analytics` branch with the `Repository analytics` workflow's own token. Its hourly commits were pushed with `ANALYTICS_TOKEN`, a personal token, so they were attributed to the repository owner and GitHub showed the owner an "analytics had recent pushes" banner with a "Compare & pull request" button after every run. The commits now come from `github-actions[bot]`. `ANALYTICS_TOKEN` only reads GitHub traffic and no longer needs write access (fine-grained: Administration read).
+
+### Fixed
+
+- Refuse Claude-to-Codex Desktop delivery into another project even when `send_to_codex_thread` omits `cwd` or supplies the recipient's directory. The bridge now compares the independently verified Claude caller with the destination before creation, rename, navigation and prompt delivery, and checks both directory/repository identities and the current native destination again at the socket write. Broad allowed roots and thread overrides cannot authorize a different project. Subfolders and registered worktrees of the same repository remain usable; drive/home repositories do not absorb unrelated projects. Blocked preflight calls report that no Desktop mutation was dispatched.
+
 ## [1.19.2] - 2026-09-29
 
 ### Fixed

package/README.md

@@ -331,7 +331,7 @@ For unresolved failures, [open an issue](https://github.com/buidangminh23/codex-
 
 ## Repository analytics
 
-The live dashboard polls the aggregate API every 30 seconds. Installation counts reflect reports received by the server; this is not a count of currently online processes. Public GitHub/npm sources are refreshed with a short cache, but their own statistics may be delayed. GitHub Actions refreshes and archives statistics hourly through the `Repository analytics` workflow, including private GitHub traffic; scheduled runs may be delayed by GitHub. That workflow needs the `ANALYTICS_TOKEN` repository secret set to a token with push access to this repository (fine-grained: Contents read/write plus Administration read); the default workflow token cannot read GitHub traffic, so without it the views/clones sources are retained from the last successful run and the run is reported as incomplete while the Pages deployment still succeeds. The README image is a snapshot and may be cached by GitHub; open the live dashboard for automatic updates. Source timestamps show freshness; missing data is unavailable, not zero. Only aggregate figures are published. Installation IDs stay in the private database.
+The live dashboard polls the aggregate API every 30 seconds. Installation counts reflect reports received by the server; this is not a count of currently online processes. Public GitHub/npm sources are refreshed with a short cache, but their own statistics may be delayed. GitHub Actions refreshes and archives statistics hourly through the `Repository analytics` workflow, including private GitHub traffic; scheduled runs may be delayed by GitHub. That workflow reads GitHub traffic with the `ANALYTICS_TOKEN` repository secret, a token with push access to this repository (fine-grained: Administration read); the default workflow token cannot read GitHub traffic, so without it the views/clones sources are retained from the last successful run and the run is reported as incomplete while the Pages deployment still succeeds. The `analytics` branch is written with the workflow's own token, so its commits come from `github-actions[bot]` and `ANALYTICS_TOKEN` needs no write access. The README image is a snapshot and may be cached by GitHub; open the live dashboard for automatic updates. Source timestamps show freshness; missing data is unavailable, not zero. Only aggregate figures are published. Installation IDs stay in the private database.
 
 Repository owners can view [GitHub traffic](https://github.com/buidangminh23/codex-mcp-bridge/graphs/traffic) for recent views and clones. Downloads and clones include updates, reinstalls, and automation; they do not measure active users. GitHub traffic only covers the recent 14-day window, so collect it regularly to keep a longer history.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.19.2",
+  "version": "1.19.3",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/scripts/install-native-relay.mjs

@@ -22,7 +22,7 @@ import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.2";
+const VERSION = "1.19.3";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/scripts/publish-repo-analytics.mjs

@@ -150,11 +150,19 @@ export function publicFiles(history, usage) {
   return { 'dashboard.svg': renderPublicDashboard(data), 'README.md': readme.replace('![Repository dashboard]', `[Live dashboard · refreshes every 30 seconds](${pagesUrl})\n\n![Repository dashboard]`), 'data.json': `${JSON.stringify(data, null, 2)}\n`, 'index.html': renderLiveDashboard(data) };
 }
 
-export function githubApi(endpoint, { method = 'GET', body } = {}) {
+export function githubEnvironment(token, env = process.env) {
+  return token ? { ...env, GH_TOKEN: token } : env;
+}
+
+export function githubClient(token, api = githubApi) {
+  return token ? (endpoint, options = {}) => api(endpoint, { ...options, token }) : api;
+}
+
+export function githubApi(endpoint, { method = 'GET', body, token } = {}) {
   return new Promise((resolve, reject) => {
     const args = ['api', '--hostname', 'github.com', '--method', method, endpoint];
     if (body) args.push('--input', '-');
-    const child = spawn('gh', args, { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+    const child = spawn('gh', args, { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], env: githubEnvironment(token) });
     let stdout = '';
     let stderr = '';
     const timer = setTimeout(() => child.kill(), 60000);

package/scripts/refresh-hosted-analytics.mjs

@@ -1,37 +1,46 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { collectSources, mergeHistory } from './collect-repo-analytics.mjs';
-import { githubApi, publicFiles, publishAnalytics, sanitizeAnalytics } from './publish-repo-analytics.mjs';
+import { githubApi, githubClient, publicFiles, publishAnalytics, sanitizeAnalytics } from './publish-repo-analytics.mjs';
 import { TELEMETRY_PUBLIC_KEY } from '../src/telemetry-config.mjs';
 
 const repo = 'buidangminh23/codex-mcp-bridge';
-const file = await githubApi(`repos/${repo}/contents/data.json?ref=analytics`);
-const previous = JSON.parse(Buffer.from(file.content, 'base64').toString('utf8'));
-const options = { repo, package: '@minhspark/codex-mcp-bridge' };
-const snapshot = await collectSources(options);
-const history = mergeHistory(previous, options, snapshot);
-let usage = previous.usage;
-let usageFailed = false;
-try {
-  const response = await fetch('https://vdbwkowdggtcihixowxi.supabase.co/functions/v1/bridge-stats', {
-    headers: { apikey: TELEMETRY_PUBLIC_KEY }, signal: AbortSignal.timeout(15000),
-  });
-  if (!response.ok) throw new Error('Stats unavailable');
-  const data = await response.json();
-  if (!data.usage || data.errors?.some(row => row.source === 'usage')) throw new Error('Usage unavailable');
-  usage = sanitizeAnalytics(history, data.usage).usage;
-} catch { usageFailed = true; }
-const sha = await publishAnalytics(repo, publicFiles(history, usage));
-const ref = await githubApi(`repos/${repo}/git/ref/heads/analytics`);
-if (ref.object.sha !== sha) throw new Error('Analytics publication changed during verification');
-const directory = path.resolve('public-analytics');
-await mkdir(directory, { recursive: true });
-for (const [name, content] of Object.entries(publicFiles(history, usage))) await writeFile(path.join(directory, name), content);
-console.log(`Published aggregate analytics: ${sha}`);
-for (const error of snapshot.errors) {
-  const status = error.status ? ` (HTTP ${error.status})` : '';
-  const hint = error.status === 403 && ['views', 'clones'].includes(error.source) ? ' GitHub traffic requires the ANALYTICS_TOKEN secret to be a token with push access (fine-grained: Administration read); the default workflow token cannot read traffic.' : '';
-  console.error(`::warning::${error.source} was not refreshed${status}; previous data retained.${hint}`);
+
+export async function refreshHostedAnalytics({ env = process.env, api = githubApi, collect = collectSources, fetcher = fetch, directory = path.resolve('public-analytics') } = {}) {
+  const branch = githubClient(env.ANALYTICS_BRANCH_TOKEN, api);
+  const file = await branch(`repos/${repo}/contents/data.json?ref=analytics`);
+  const previous = JSON.parse(Buffer.from(file.content, 'base64').toString('utf8'));
+  const options = { repo, package: '@minhspark/codex-mcp-bridge' };
+  const snapshot = await collect(options);
+  const history = mergeHistory(previous, options, snapshot);
+  let usage = previous.usage;
+  let usageFailed = false;
+  try {
+    const response = await fetcher('https://vdbwkowdggtcihixowxi.supabase.co/functions/v1/bridge-stats', {
+      headers: { apikey: TELEMETRY_PUBLIC_KEY }, signal: AbortSignal.timeout(15000),
+    });
+    if (!response.ok) throw new Error('Stats unavailable');
+    const data = await response.json();
+    if (!data.usage || data.errors?.some(row => row.source === 'usage')) throw new Error('Usage unavailable');
+    usage = sanitizeAnalytics(history, data.usage).usage;
+  } catch { usageFailed = true; }
+  const sha = await publishAnalytics(repo, publicFiles(history, usage), branch);
+  const ref = await branch(`repos/${repo}/git/ref/heads/analytics`);
+  if (ref.object.sha !== sha) throw new Error('Analytics publication changed during verification');
+  await mkdir(directory, { recursive: true });
+  for (const [name, content] of Object.entries(publicFiles(history, usage))) await writeFile(path.join(directory, name), content);
+  return { sha, errors: snapshot.errors, usageFailed };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  const { sha, errors, usageFailed } = await refreshHostedAnalytics();
+  console.log(`Published aggregate analytics: ${sha}`);
+  for (const error of errors) {
+    const status = error.status ? ` (HTTP ${error.status})` : '';
+    const hint = error.status === 403 && ['views', 'clones'].includes(error.source) ? ' GitHub traffic requires the ANALYTICS_TOKEN secret to be a token with push access (fine-grained: Administration read); the default workflow token cannot read traffic.' : '';
+    console.error(`::warning::${error.source} was not refreshed${status}; previous data retained.${hint}`);
+  }
+  if (usageFailed) console.error('::warning::Usage was not refreshed; previous data retained.');
+  if (errors.length || usageFailed) process.exitCode = 1;
 }
-if (usageFailed) console.error('::warning::Usage was not refreshed; previous data retained.');
-if (snapshot.errors.length || usageFailed) process.exitCode = 1;

package/src/claude-bridge.mjs

@@ -26,7 +26,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.2";
+const VERSION = "1.19.3";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/index.mjs

@@ -34,7 +34,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.2";
+const VERSION = "1.19.3";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
@@ -57,7 +57,7 @@ const security = new BridgeSecurityPolicy();
 const desktopTasksEnabled = desktopTasksConfigured();
 const runtime = createRuntimeState({ configuration: desktopTasksConfigured });
 const desktopOperation = new AsyncLocalStorage();
-const desktopTasks = new DesktopTaskDelivery({ security, beforeRequest: beforeDesktopRequest, accountContext: () => desktopOperation.getStore()?.accounts });
+const desktopTasks = new DesktopTaskDelivery({ security, beforeRequest: beforeDesktopRequest, accountContext: () => desktopOperation.getStore()?.accounts, senderContext: () => desktopOperation.getStore()?.caller });
 
 async function assertDesktopOperation(context, { verifyProcess = false } = {}) {
   if (!context || context.diagnostic) return;
@@ -77,7 +77,7 @@ async function beforeDesktopRequest({ operation, args, phase }) {
   if (!context) throw new Error("Desktop operations require a verified calling Code session.");
   const mutating = ["create_thread", "send_message_to_thread", "set_thread_title", "navigate_to_codex_page"].includes(operation);
   await assertDesktopOperation(context, { verifyProcess: mutating && phase === "write" });
-  if (mutating) {
+  if (mutating && phase === "dispatch") {
     context.dispatched = true;
     if (args.threadId) context.threadId = args.threadId;
   }
@@ -349,7 +349,8 @@ const server = new McpServer(
       "A completed turn alone does not mean the task is finished. Do not choose an old task merely because its project matches or it was recently active. " +
       "Without authorization to create a new conversation, ask before creating it. With Desktop tasks enabled it assigns the exact saved project and starts visibly in " +
       "Codex Desktop using Desktop permissions. Otherwise it releases the bridge writer lock and opens the exact thread in " +
-      "Codex Desktop. Use send_to_codex_thread only when an existing threadId is intentional; use " +
+      "Codex Desktop. Desktop creation and sends always require the verified calling Claude task and the Codex destination to belong to the same project, even when cwd is omitted. " +
+      "Use send_to_codex_thread only when an existing threadId is intentional; use " +
       "list_codex_threads or read_codex_thread to inspect sessions and codex_bridge_status to inspect wiring. " +
       AGENT_PROMPT_GUIDANCE,
   },
@@ -368,6 +369,7 @@ function registerTool(name, definition, handler) {
         result.content.push({ type: "text", text: `runtime pid: ${state.pid}\nloaded source: ${state.revision}\nruntime state: current` });
         result.structuredContent = { ...result.structuredContent, runtime: state };
         if (desktopTasksEnabled) {
+          result.structuredContent.projectScope = { enabled: true, policy: "verified-sender-same-project", match: "canonical-directory-or-git-repository", checkedBeforeMutation: true };
           result.structuredContent.accounts = { claude: publicAccountState(accounts.claude), codex: publicAccountState(accounts.codex) };
         }
         return result;
@@ -383,6 +385,9 @@ function registerTool(name, definition, handler) {
             await assertDesktopOperation(context);
             const result = await handler(...args);
             await assertDesktopOperation(context);
+            if (result.isError && !context.dispatched) {
+              result.structuredContent = { ...result.structuredContent, accountContext: context.accounts, operation: { state: "blocked", threadId: context.threadId ?? null } };
+            }
             return result;
           } catch (error) {
             return withheldDesktopResult(error, context);
@@ -513,7 +518,7 @@ registerTool(
         .max(3600)
         .optional()
         .describe("How long to observe the task (Desktop caps the entire call at 40s; the task continues and its threadId is returned)"),
-      cwd: z.string().optional().describe("Override the working directory for this turn"),
+      cwd: z.string().optional().describe("Expected destination directory; Desktop always checks the verified sender's project and cannot change the task's workspace"),
       model: z.string().optional().describe("Override the model for this turn"),
       effort: z
         .enum(["minimal", "low", "medium", "high", "xhigh", "ultra"])
@@ -950,6 +955,7 @@ registerTool(
         `bridge version: ${VERSION}`,
         `node:           ${process.version} at ${process.execPath}`,
         "desktop tasks:  enabled; Desktop permissions, exact saved project, immediate visibility",
+        "project scope:  verified Claude sender; same directory or Git repository, checked before each mutation",
         `native relay:   ${native.available ? "available; verified through Codex Desktop" : "unavailable"}`,
         `native endpoint: ${native.socketPath}`,
         ...(native.available ? [`local projects: ${native.localProjects}`] : [`reason: ${native.reason}`]),

package/src/native-relay-companion.mjs

@@ -34,7 +34,7 @@ import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.2";
+const VERSION = "1.19.3";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent) {

package/src/project-scope.mjs

@@ -0,0 +1,103 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+function directory(value) {
+  if (typeof value !== "string" || !value.trim() || !path.isAbsolute(value)) throw new Error("Project directory must be an absolute existing directory");
+  const resolved = fs.realpathSync.native(value);
+  const stat = fs.statSync(resolved, { bigint: true });
+  if (!stat.isDirectory()) throw new Error("Project path is not a directory");
+  return { input: value, path: resolved, identity: `${stat.dev}:${stat.ino}:${stat.birthtimeNs ?? stat.birthtimeMs}` };
+}
+
+function samePath(left, right) {
+  return path.relative(left, right) === "";
+}
+
+function metadata(file) {
+  const stat = fs.statSync(file);
+  if (!stat.isFile() || stat.size > 4096) throw new Error("Invalid project repository metadata");
+  return fs.readFileSync(file, "utf8").trim();
+}
+
+function exists(file) {
+  try { fs.lstatSync(file); return true; } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+function gitRepository(gitdir, common = gitdir) {
+  const head = metadata(path.join(gitdir.path, "HEAD"));
+  if (!/^(?:ref: refs\/[^\s]+|[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/.test(head)) throw new Error("Invalid project repository HEAD metadata");
+  directory(path.join(common.path, "objects"));
+  return common;
+}
+
+function repository(cwd) {
+  const home = fs.realpathSync.native(os.homedir());
+  for (let root = cwd; ; root = path.dirname(root)) {
+    if (samePath(root, path.parse(root).root) || samePath(root, home)) return null;
+    const marker = path.join(root, ".git");
+    if (exists(marker)) {
+      if (fs.statSync(marker).isDirectory()) return gitRepository(directory(marker));
+      const match = metadata(marker).match(/^gitdir: ([^\r\n]+)$/);
+      if (!match) throw new Error("Invalid project gitdir metadata");
+      const gitdir = directory(path.resolve(root, match[1]));
+      const commonFile = path.join(gitdir.path, "commondir");
+      if (!exists(commonFile)) return gitRepository(gitdir);
+      const common = gitRepository(directory(path.resolve(gitdir.path, metadata(commonFile))));
+      const registered = path.relative(path.join(common.path, "worktrees"), gitdir.path);
+      if (!registered || registered === ".." || registered.startsWith(`..${path.sep}`) || path.isAbsolute(registered) || registered.includes(path.sep)) throw new Error("Project worktree is not registered in its common repository");
+      const backlink = path.resolve(gitdir.path, metadata(path.join(gitdir.path, "gitdir")));
+      if (!samePath(fs.realpathSync.native(backlink), fs.realpathSync.native(marker))) throw new Error("Project worktree backlink does not match its directory");
+      return gitRepository(gitdir, common);
+    }
+    if (path.dirname(root) === root) return null;
+  }
+}
+
+function project(value) {
+  const current = directory(value);
+  return { ...current, repository: repository(current.path) };
+}
+
+function sameBinding(left, right) {
+  return Boolean(left && right && samePath(left.path, right.path) && left.identity === right.identity);
+}
+
+function sameProject(left, right) {
+  return sameBinding(left, right) || sameBinding(left.repository, right.repository);
+}
+
+export function captureProjectScope(senderCwd, recipientCwd) {
+  let sender;
+  let recipient;
+  try {
+    sender = project(senderCwd);
+    recipient = project(recipientCwd);
+  } catch (cause) {
+    const error = new Error(`Project scope could not be verified: ${cause.message}. No message was sent.`, { cause });
+    error.code = "PROJECT_SCOPE_UNVERIFIED";
+    throw error;
+  }
+  if (!sameProject(sender, recipient)) {
+    const error = new Error(`Project mismatch: the calling Claude task works in "${sender.path}", but the Codex destination works in "${recipient.path}". Select a task in the sender's project. No message was sent.`);
+    error.code = "PROJECT_SCOPE_MISMATCH";
+    throw error;
+  }
+  return { sender, recipient };
+}
+
+export function recheckProjectScope(expected, current = captureProjectScope(expected.sender.input, expected.recipient.input)) {
+  for (const side of ["sender", "recipient"]) {
+    if (!sameBinding(expected[side], current[side]) ||
+        Boolean(expected[side].repository) !== Boolean(current[side].repository) ||
+        (expected[side].repository && !sameBinding(expected[side].repository, current[side].repository))) {
+      const error = new Error(`The ${side} project directory or repository changed before delivery. No message was sent.`);
+      error.code = "PROJECT_SCOPE_CHANGED";
+      throw error;
+    }
+  }
+  return current;
+}

package/src/thread-delivery.mjs

@@ -4,6 +4,8 @@ import { realpathSync } from "node:fs";
 import path from "node:path";
 import { DesktopTaskReceipts } from "./desktop-task-receipts.mjs";
 import { captureCodexRolloutWatermark, inspectCodexNativeTurn, readCodexNativeTurnResponse } from "./codex-native-response.mjs";
+import { captureProjectScope, recheckProjectScope } from "./project-scope.mjs";
+import { requireClaudeSenderContext } from "./claude-sender-context.mjs";
 
 /**
  * Which backend puts a message into a Codex thread.
@@ -48,7 +50,7 @@ export function matchDesktopProject(projects, cwd, { canonicalize = realpathSync
 }
 
 export class DesktopTaskDelivery {
-  constructor({ relay = new NativeDesktopRelay({ socketPath: desktopTaskSocketPath(), accountSocketPath: accountRelaySocketPath() }), security, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now = Date.now, receipts = new DesktopTaskReceipts(), beforeRequest, accountContext, captureResponse = captureCodexRolloutWatermark, readResponse = readCodexNativeTurnResponse, inspectResponse = inspectCodexNativeTurn } = {}) {
+  constructor({ relay = new NativeDesktopRelay({ socketPath: desktopTaskSocketPath(), accountSocketPath: accountRelaySocketPath() }), security, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now = Date.now, receipts = new DesktopTaskReceipts(), beforeRequest, accountContext, senderContext, captureResponse = captureCodexRolloutWatermark, readResponse = readCodexNativeTurnResponse, inspectResponse = inspectCodexNativeTurn } = {}) {
     this.relay = relay;
     this.security = security;
     this.sleep = sleep;
@@ -56,25 +58,56 @@ export class DesktopTaskDelivery {
     this.receipts = receipts;
     this.beforeRequest = beforeRequest;
     this.accountContext = accountContext;
+    this.senderContext = senderContext;
     this.captureResponse = captureResponse;
     this.readResponse = readResponse;
     this.inspectResponse = inspectResponse;
     this.threadOperations = new Map();
   }
 
-  async request(operation, args, { deadline, includeRelayContext = false } = {}) {
+  senderProjectScope(cwd) {
+    if (!this.senderContext) return null;
+    const sender = requireClaudeSenderContext(this.senderContext());
+    return captureProjectScope(sender.cwd, cwd);
+  }
+
+  async mutationProjectScope(operation, args, { deadline } = {}) {
+    if (!this.senderContext) return null;
+    if (operation === "create_thread") {
+      const listed = await this.request("list_projects", {}, { deadline });
+      const projects = listed?.projects?.filter((project) => project.projectId === args.target?.projectId && project.projectKind === "local" && project.hostId === "local");
+      if (projects?.length !== 1) throw new Error("Desktop did not confirm the destination project before creation");
+      this.security.assertCwd(projects[0].path);
+      return this.senderProjectScope(projects[0].path);
+    }
+    if (!["send_message_to_thread", "set_thread_title", "navigate_to_codex_page"].includes(operation)) return null;
+    const inspected = await this.inspect(args.threadId, undefined, { deadline });
+    return inspected.projectScope;
+  }
+
+  async request(operation, args, { deadline, includeRelayContext = false, projectScope: expectedScope } = {}) {
     try {
       await this.beforeRequest?.({ operation, args });
+      const projectScope = expectedScope ?? await this.mutationProjectScope(operation, args, { deadline });
+      if (expectedScope) recheckProjectScope(expectedScope, this.senderProjectScope(expectedScope.recipient.input));
       const remaining = deadline === undefined ? undefined : deadline - this.now();
       if (remaining !== undefined && remaining <= 0) throw new Error("The bridge's response deadline has elapsed; this operation was not sent");
       const accountContext = this.accountContext?.();
       const response = await this.relay.requestDesktop(operation, args, {
         ...(remaining === undefined ? {} : { timeoutMs: remaining }),
-        ...(this.beforeRequest ? { beforeSend: () => this.beforeRequest({ operation, args, phase: "write" }) } : {}),
+        ...(this.beforeRequest || projectScope ? { beforeSend: async () => {
+          await this.beforeRequest?.({ operation, args, phase: "write" });
+          if (projectScope) {
+            recheckProjectScope(projectScope);
+            recheckProjectScope(projectScope, await this.mutationProjectScope(operation, args, { deadline }));
+          }
+          await this.beforeRequest?.({ operation, args, phase: "dispatch" });
+        } } : {}),
         ...(accountContext ? { accountContext } : {}),
       });
       return includeRelayContext ? { result: response.result, executorThreadId: response.executorThreadId } : response.result;
     } catch (err) {
+      if (err.code?.startsWith("PROJECT_SCOPE_") || err.code === "CLAUDE_SENDER_CONTEXT_UNVERIFIED") throw err;
       throw new Error(`Codex Desktop operation ${operation} failed: ${err.message}. Desktop-only mode will not start or use an external app-server. Open Codex Desktop and reconnect its native relay, then inspect the existing task before retrying a send.`, { cause: err });
     }
   }
@@ -203,6 +236,7 @@ export class DesktopTaskDelivery {
 
   async create({ cwd, prompt, name, dedupeName = name, requestId, model, effort, deadline = this.now() + DESKTOP_TOOL_BUDGET_MS }) {
     this.security.assertCwd(cwd);
+    const projectScope = this.senderProjectScope(cwd);
     cwd = realpathSync.native(cwd);
     this.security.assertCwd(cwd);
     dedupeName = dedupeName?.normalize("NFC").trim().replace(/\s+/g, " ") || undefined;
@@ -228,7 +262,7 @@ export class DesktopTaskDelivery {
           prompt, title: name,
           target: { type: "project", projectId: project.projectId, environment: { type: "local" } },
           ...(model ? { model } : {}), ...(effort ? { thinking: effort } : {}),
-        }, { deadline });
+        }, { deadline, projectScope });
         const confirmedId = response?.threadId ?? response?.conversationId;
         threadId = confirmedId;
         if (!threadId && (response?.status === "outcome-unknown" || response?.firstTurn?.status === "outcome-unknown")) threadId = response?.clientThreadId;
@@ -251,15 +285,16 @@ export class DesktopTaskDelivery {
     if (thread?.id !== threadId || thread.hostId !== "local" || !thread.cwd) throw new Error("Desktop did not confirm the task's local workspace.");
     this.security.assertThread(threadId, thread.cwd);
     this.security.assertCwd(thread.cwd);
+    const projectScope = this.senderProjectScope(thread.cwd);
     if (cwd && path.relative(realpathSync.native(cwd), realpathSync.native(thread.cwd))) {
       throw new Error("Native Desktop delivery cannot change an existing task's workspace; create a new task at the requested cwd.");
     }
-    return { thread, latestTurnId: response.turns?.[0]?.id ?? null };
+    return { thread, latestTurnId: response.turns?.[0]?.id ?? null, projectScope };
   }
 
   async send({ threadId, prompt, cwd, model, effort, name, deadline }) {
     const inspected = await this.inspect(threadId, cwd, { deadline });
-    if (name) await this.request("set_thread_title", { threadId, title: name.trim().slice(0, 200) }, { deadline });
+    if (name) await this.request("set_thread_title", { threadId, title: name.trim().slice(0, 200) }, { deadline, projectScope: inspected.projectScope });
     const expectedCwd = realpathSync.native(inspected.thread.cwd);
     const accountContext = this.accountContext?.();
     const watermark = this.captureResponse({ threadId, expectedCwd });
@@ -267,7 +302,7 @@ export class DesktopTaskDelivery {
       threadId, prompt,
       ...(model ? { model } : {}),
       ...(effort ? { thinking: effort } : {}),
-    }, { deadline, includeRelayContext: true });
+    }, { deadline, includeRelayContext: true, projectScope: inspected.projectScope });
     const response = envelope.result;
     if (response?.threadId !== threadId || response?.success === false || response?.isError === true ||
         (response?.status !== undefined && !["accepted", "sent"].includes(response.status)) ||