@minhspark/codex-mcp-bridge 1.19.3 → 1.19.5

package/CHANGELOG.md

@@ -4,6 +4,18 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.19.5] - 2026-10-02
+
+### Added
+
+- Add an explicit `--full-access` installer option that sets Codex Full access + Never globally, repairs the managed policy on Windows, macOS, and Linux with OS administrator authentication when needed, and restores the chosen settings on later bridge connections.
+
+## [1.19.4] - 2026-10-02
+
+### Fixed
+
+- Detect a managed Codex `requirements.toml` whose `allowed_sandbox_modes` omits `read-only` before auto-starting an external app-server. The bridge and `npm run check` now report the policy error directly instead of waiting for a generic connection failure; they do not edit the administrator-managed file.
+
 ## [1.19.3] - 2026-09-30
 
 ### Changed

package/README.md

@@ -51,6 +51,10 @@ Choose the mode for the conversations you want to connect:
 
 The bridge requires **Node.js 22+**; Node 24 LTS is a suitable starting point. If Node is already managed by a version manager, use that installation. Install the bridge under the same OS user as the clients. A global npm install does not require cloning this repository.
 
+To opt a machine you administer into **Full access + Never**, run `codex-mcp-bridge-install --full-access` when registering the bridge (`codex-mcp-bridge-install.cmd --full-access` in PowerShell). The installer sets global Codex defaults for old and new projects, repairs or creates the managed policy with both `read-only` and `danger-full-access`, and records the choice so the bridge can restore it if the files drift later. Windows UAC, macOS administrator authentication, or Linux polkit/sudo may be required for the system policy. Normal installation does not change Codex permissions. Run `codex doctor --summary --ascii` after setup; existing Desktop tasks may need to be reopened to load the new permissions.
+
+If the bridge is already registered, `codex-full-access` (`codex-full-access.cmd` in PowerShell) enables the same settings without replacing that registration. The bridge reads the saved choice when it starts.
+
 For Desktop mode, install [Codex Desktop](https://developers.openai.com/codex/app) and [Claude Desktop](https://claude.com/download), sign in, and save the intended local project in Codex Desktop. Open that same directory in Claude Desktop's Code tab. A normal Claude chat is not a Code session.
 
 ### Windows (PowerShell)
@@ -310,6 +314,7 @@ Start with `codex doctor` for Codex installation problems and `claude doctor` fo
 
 | Error / symptom | Fix |
 |---|---|
+| Codex says `Organization settings could not be loaded`, or the bridge reports `INVALID_MANAGED_CONFIG` | On a machine you administer, rerun `codex-mcp-bridge-install --full-access` to repair the managed policy and global defaults. The policy must include `"read-only"` alongside `"danger-full-access"`; the former is required for Codex to load it, while the effective mode remains Full access. Complete any OS administrator prompt, then run `codex doctor --summary --ascii`. |
 | `codex binary not found`, `ENOENT`, or Windows `EINVAL` during registration | Locate the actual executable. Set `CODEX_EXE` before rerunning the installer: PowerShell `$env:CODEX_EXE = (Get-Command codex.exe).Source`; macOS/Linux `export CODEX_EXE="$(command -v codex)"`. On Windows, do not point it at `codex.ps1` or `codex.cmd`. |
 | Tools appear in Claude Desktop but not in its Code task | Complete the separate [Claude Code registration](#register-claude-code), then reconnect `/mcp` in that Code session. |
 | Installer refuses an entry with custom access/timeout settings | Keep those settings. Update only the existing entry's `command` and `args` to the values printed by the installer, then reconnect. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.19.3",
+  "version": "1.19.5",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",
@@ -28,7 +28,8 @@
     "claude-mcp-bridge-install": "scripts/install-codex-mcp.mjs",
     "codex-native-relay": "src/native-relay-launcher.mjs",
     "codex-native-relay-install": "scripts/install-native-relay.mjs",
-    "codex-npm-footer-install": "scripts/install-npm-footer.mjs"
+    "codex-npm-footer-install": "scripts/install-npm-footer.mjs",
+    "codex-full-access": "scripts/repair-codex-access.mjs"
   },
   "files": [
     "src",

package/scripts/check.mjs

@@ -2,6 +2,8 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { readManagedRequirementsIssue } from "../src/app-server-client.mjs";
+import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-access.mjs";
 import { desktopTasksConfigured } from "../src/native-relay.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -15,6 +17,7 @@ const bridgeEnvNames = [
   "CODEX_BRIDGE_APPROVAL",
   "CODEX_BRIDGE_AUTO_APPROVE_ACK",
   "CODEX_BRIDGE_APPROVAL_POLICY",
+  "CODEX_BRIDGE_ENFORCE_FULL_ACCESS",
   "CODEX_BRIDGE_AUTOSTART",
   "CODEX_BRIDGE_DESKTOP_TASKS",
   "CODEX_NATIVE_RELAY_SOCKET",
@@ -40,6 +43,9 @@ const transport = new StdioClientTransport({
 const client = new Client({ name: "bridge-check", version: "1.0.0" });
 
 try {
+  if (fullAccessEnabled()) enableCodexFullAccess();
+  const managedIssue = readManagedRequirementsIssue();
+  if (managedIssue) throw new Error(managedIssue);
   await client.connect(transport);
   const tools = await client.listTools();
   console.log("tools:", tools.tools.map((t) => t.name).join(", "));

package/scripts/install-claude-desktop.mjs

@@ -7,6 +7,7 @@ import { IS_WINDOWS, PLATFORM_LABEL, claudeDesktopConfigPath, resolveCodexBin }
 import { desktopTasksConfigured } from "../src/native-relay.mjs";
 import { exitForVersionRequest } from "../src/cli-version.mjs";
 import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs";
+import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-access.mjs";
 
 exitForVersionRequest(import.meta.url);
 
@@ -14,6 +15,8 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const cfgPath = process.env.CLAUDE_DESKTOP_CONFIG ?? claudeDesktopConfigPath();
 const reset = process.argv.includes("--reset");
 const forceDesktopTasks = process.argv.includes("--desktop-tasks");
+const fullAccess = process.argv.includes("--full-access") || fullAccessEnabled();
+if (fullAccess) enableCodexFullAccess();
 
 /**
  * This bridge is intentionally the local hand-off point between Claude and
@@ -85,7 +88,8 @@ cfg.mcpServers["codex-bridge"] = {
     CODEX_BRIDGE_ALLOWED_ROOTS: settled("CODEX_BRIDGE_ALLOWED_ROOTS", defaultRoots),
     CODEX_BRIDGE_APPROVAL: settled("CODEX_BRIDGE_APPROVAL", "deny"),
     CODEX_BRIDGE_AUTO_APPROVE_ACK: settled("CODEX_BRIDGE_AUTO_APPROVE_ACK", "0"),
-    CODEX_BRIDGE_APPROVAL_POLICY: settled("CODEX_BRIDGE_APPROVAL_POLICY", "on-request"),
+    CODEX_BRIDGE_APPROVAL_POLICY: fullAccess ? "never" : settled("CODEX_BRIDGE_APPROVAL_POLICY", "on-request"),
+    CODEX_BRIDGE_ENFORCE_FULL_ACCESS: fullAccess ? "1" : settled("CODEX_BRIDGE_ENFORCE_FULL_ACCESS", "0"),
     /**
      * Written out even at its default so it is visible in the file. Left
      * implicit, the one setting that decides whether the bridge can reach a
@@ -94,7 +98,7 @@ cfg.mcpServers["codex-bridge"] = {
      * points nowhere near it.
      */
     CODEX_BRIDGE_THREAD_POLICY: settled("CODEX_BRIDGE_THREAD_POLICY", "roots"),
-    CODEX_BRIDGE_SANDBOX: settled("CODEX_BRIDGE_SANDBOX", "workspace-write"),
+    CODEX_BRIDGE_SANDBOX: fullAccess ? "danger-full-access" : settled("CODEX_BRIDGE_SANDBOX", "workspace-write"),
     CODEX_BRIDGE_OPEN_IN_APP: settled("CODEX_BRIDGE_OPEN_IN_APP", IS_WINDOWS ? "1" : "0"),
     CODEX_BRIDGE_RELEASE_AFTER_TURN: settled("CODEX_BRIDGE_RELEASE_AFTER_TURN", IS_WINDOWS ? "1" : "0"),
     ...(desktopMode !== undefined ? { CODEX_BRIDGE_DESKTOP_TASKS: desktopMode } : {}),

package/scripts/install-codex-mcp.mjs

@@ -9,6 +9,7 @@ import { exitForVersionRequest } from "../src/cli-version.mjs";
 import { desktopTasksConfigured } from "../src/native-relay.mjs";
 import { codexMcpRegistration } from "../src/codex-mcp-registration.mjs";
 import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs";
+import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-access.mjs";
 
 exitForVersionRequest(import.meta.url);
 
@@ -18,6 +19,7 @@ const serverName = process.env.CLAUDE_BRIDGE_NAME ?? "claude-bridge";
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["claude-bridge.mjs"];
 const remove = process.argv.includes("--remove");
+if (!remove && (process.argv.includes("--full-access") || fullAccessEnabled())) enableCodexFullAccess();
 const permissionMode = process.env.CLAUDE_BRIDGE_PERMISSION_MODE;
 if (!remove && permissionMode && !["bypass", "prompting"].includes(permissionMode)) throw new Error("CLAUDE_BRIDGE_PERMISSION_MODE must be bypass or prompting");
 

package/scripts/install-native-relay.mjs

@@ -19,15 +19,17 @@ import {
 import { exitForVersionRequest } from "../src/cli-version.mjs";
 import { stdioMcpRegistration } from "../src/codex-mcp-registration.mjs";
 import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs";
+import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-access.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.3";
+const VERSION = "1.19.5";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];
 const serverName = process.env.CODEX_NATIVE_RELAY_NAME ?? "codex-native-relay";
 const remove = process.argv.includes("--remove");
+if (!remove && (process.argv.includes("--full-access") || fullAccessEnabled())) enableCodexFullAccess();
 const skipBootstrap = process.argv.includes("--no-bootstrap");
 
 const codexBin = resolveCodexBin(process.env.CODEX_EXE);

package/scripts/repair-codex-access.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { applyFullAccessPolicy, enableCodexFullAccess } from "../src/codex-full-access.mjs";
+import { exitForVersionRequest } from "../src/cli-version.mjs";
+
+exitForVersionRequest(import.meta.url);
+
+try {
+  if (process.argv.includes("--elevated")) {
+    applyFullAccessPolicy();
+    console.log("Codex managed policy repaired");
+  } else {
+    const paths = enableCodexFullAccess();
+    console.log(`Codex Full access + Never enabled: ${paths.config}`);
+    console.log(`Managed policy: ${paths.policy}`);
+  }
+} catch (error) {
+  console.error(`Codex access repair failed: ${error.message}`);
+  process.exitCode = 1;
+}

package/src/app-server-client.mjs

@@ -1,13 +1,34 @@
 import { execFileSync, spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import path from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 
 import { PLATFORM_LABEL, resolveCodexBin, spawnEnv } from "./platform.mjs";
 import { assertAllowedAppServerUrl } from "./security-policy.mjs";
+import { enableCodexFullAccess, fullAccessEnabled } from "./codex-full-access.mjs";
 
 const DEFAULT_URL = "ws://127.0.0.1:8791";
 const CONNECT_ATTEMPTS = 2;
 const CONNECT_RETRY_DELAY_MS = 750;
 
+function managedRequirementsPath() {
+  return process.platform === "win32"
+    ? path.join(process.env.ProgramData ?? process.env.PROGRAMDATA ?? "C:\\ProgramData", "OpenAI", "Codex", "requirements.toml")
+    : "/etc/codex/requirements.toml";
+}
+
+export function readManagedRequirementsIssue(filePath = managedRequirementsPath()) {
+  let contents;
+  try {
+    contents = readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const sandboxModes = /^\s*allowed_sandbox_modes\s*=\s*\[([\s\S]*?)\]/m.exec(contents);
+  if (!sandboxModes || /["']read-only["']/.test(sandboxModes[1])) return null;
+  return `Codex managed requirements at ${filePath} are invalid: allowed_sandbox_modes must include "read-only". Ask the machine administrator to repair the policy, then run codex doctor. The bridge does not edit managed policy files.`;
+}
+
 export function parseListeningPids(output, port) {
   const suffix = `:${port}`;
   return [
@@ -81,6 +102,7 @@ export class CodexAppServerClient {
     this.url = options.url ?? process.env.CODEX_APP_SERVER_URL ?? DEFAULT_URL;
     assertAllowedAppServerUrl(this.url);
     this.codexBin = resolveCodexBin(options.codexBin);
+    this.requirementsPath = options.requirementsPath ?? managedRequirementsPath();
     this.autoStart = options.autoStart ?? process.env.CODEX_BRIDGE_AUTOSTART !== "0";
     this.log = options.log ?? (() => {});
     const requestedApproval = options.approval ?? process.env.CODEX_BRIDGE_APPROVAL ?? "deny";
@@ -119,6 +141,8 @@ export class CodexAppServerClient {
   }
 
   async startServer() {
+    const managedIssue = readManagedRequirementsIssue(this.requirementsPath);
+    if (managedIssue) throw new AppServerError(managedIssue, "INVALID_MANAGED_CONFIG");
     this.log(`starting shared app-server on ${PLATFORM_LABEL}: ${this.codexBin} app-server --listen ${this.url}`);
     const needsShell = /\.(cmd|bat)$/i.test(this.codexBin);
     const child = spawn(this.codexBin, ["app-server", "--listen", this.url], {
@@ -188,12 +212,20 @@ export class CodexAppServerClient {
       for (let attempt = 1; attempt <= CONNECT_ATTEMPTS; attempt += 1) {
         try {
           this.#assertConnectionEpoch(epoch);
+          if (fullAccessEnabled()) {
+            try {
+              enableCodexFullAccess();
+            } catch (error) {
+              throw new AppServerError(`Codex Full access repair failed: ${error.message}`, "CODEX_ACCESS_REPAIR_FAILED");
+            }
+          }
           await this.#openConnection(epoch);
           return;
         } catch (err) {
           lastError = err;
           this.#assertConnectionEpoch(epoch);
           this.log(`connect attempt ${attempt}/${CONNECT_ATTEMPTS} failed: ${err.message}`);
+          if (["INVALID_MANAGED_CONFIG", "CODEX_ACCESS_REPAIR_FAILED"].includes(err.code)) throw err;
           if (attempt < CONNECT_ATTEMPTS) await delay(CONNECT_RETRY_DELAY_MS);
         }
       }

package/src/claude-bridge.mjs

@@ -26,7 +26,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.3";
+const VERSION = "1.19.5";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/codex-full-access.mjs

@@ -0,0 +1,175 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const POLICY_HEADER = [
+  'default_permissions = ":danger-full-access"',
+  'allowed_approval_policies = ["never"]',
+  'allowed_approvals_reviewers = ["user"]',
+  'allowed_sandbox_modes = ["read-only", "danger-full-access"]',
+];
+const CONFIG_HEADER = [
+  'approval_policy = "never"',
+  'sandbox_mode = "danger-full-access"',
+];
+
+export function codexAccessPaths(env = process.env) {
+  const home = env.CODEX_HOME || path.join(os.homedir(), ".codex");
+  return {
+    config: path.join(home, "config.toml"),
+    marker: path.join(home, "bridge-full-access.enabled"),
+    policy: process.platform === "win32"
+      ? path.join(env.ProgramData || env.PROGRAMDATA || "C:\\ProgramData", "OpenAI", "Codex", "requirements.toml")
+      : "/etc/codex/requirements.toml",
+  };
+}
+
+function newlineFor(contents) {
+  return contents.includes("\r\n") ? "\r\n" : "\n";
+}
+
+function replaceTopLevel(contents, keys, header) {
+  const newline = newlineFor(contents);
+  const firstTable = /^[ \t]*\[[^\]\r\n]+\]/m.exec(contents);
+  const splitAt = firstTable?.index ?? contents.length;
+  const top = contents.slice(0, splitAt).replace(
+    new RegExp(`^[ \\t]*(?:${keys.join("|")})[ \\t]*=[^\\r\\n]*(?:\\r?\\n|$)`, "gm"),
+    "",
+  );
+  const rest = contents.slice(splitAt);
+  return `${header.join(newline)}${newline}${top.trim() ? `${top.trimStart()}${top.endsWith(newline) ? "" : newline}` : newline}${rest}`;
+}
+
+export function fullAccessConfigContents(contents = "") {
+  const bom = contents.startsWith("\uFEFF") ? "\uFEFF" : "";
+  const source = contents.slice(bom.length);
+  const firstTable = /^[ \t]*\[[^\]\r\n]+\]/m.exec(source);
+  const top = source.slice(0, firstTable?.index ?? source.length);
+  if (["approval_policy", "sandbox_mode"].every((key, index) =>
+    top.split(/\r?\n/).filter((entry) => new RegExp(`^[ \\t]*${key}[ \\t]*=`).test(entry)).length === 1 &&
+      top.split(/\r?\n/).some((entry) => entry.trim() === CONFIG_HEADER[index]))) return contents;
+  return bom + replaceTopLevel(source, ["approval_policy", "sandbox_mode"], CONFIG_HEADER);
+}
+
+export function fullAccessPolicyContents(contents = "") {
+  const bom = contents.startsWith("\uFEFF") ? "\uFEFF" : "";
+  const newline = newlineFor(contents);
+  let updated = replaceTopLevel(
+    contents.slice(bom.length),
+    ["default_permissions", "allowed_approval_policies", "allowed_approvals_reviewers", "allowed_sandbox_modes"],
+    POLICY_HEADER,
+  );
+  const table = /^[ \t]*\[allowed_permission_profiles\][ \t]*(?:#.*)?$/m.exec(updated);
+  if (!table) {
+    updated = `${updated.trimEnd()}${newline}${newline}[allowed_permission_profiles]${newline}":danger-full-access" = true${newline}`;
+  } else {
+    const bodyStart = table.index + table[0].length;
+    const nextTable = /^[ \t]*\[[^\]\r\n]+\]/m.exec(updated.slice(bodyStart));
+    const bodyEnd = nextTable ? bodyStart + nextTable.index : updated.length;
+    const body = updated.slice(bodyStart, bodyEnd)
+      .replace(/^[ \t]*["']?:danger-full-access["']?[ \t]*=[^\r\n]*(?:\r?\n|$)/gm, "")
+      .replace(/^(?:\r?\n)+/, "");
+    updated = `${updated.slice(0, bodyStart)}${newline}":danger-full-access" = true${newline}${body}${updated.slice(bodyEnd)}`;
+  }
+  return bom + updated;
+}
+
+function writeIfChanged(filePath, contents, transform) {
+  const next = transform(contents);
+  if (next === contents) return false;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, next, { encoding: "utf8", mode: 0o600 });
+  return true;
+}
+
+function withUnlockedPolicy(filePath, action) {
+  if (!fs.existsSync(filePath)) return action();
+  if (process.platform === "darwin") {
+    const flags = execFileSync("/usr/bin/stat", ["-f", "%Sf", filePath], { encoding: "utf8" }).trim();
+    if (flags.split(",").includes("uchg")) {
+      execFileSync("/usr/bin/chflags", ["nouchg", filePath]);
+      try { return action(); } finally { execFileSync("/usr/bin/chflags", ["uchg", filePath]); }
+    }
+  }
+  if (process.platform === "linux") {
+    let attributes = "";
+    try {
+      attributes = execFileSync("lsattr", ["-d", filePath], { encoding: "utf8" }).split(/\s+/)[0];
+    } catch {}
+    if (attributes.includes("i")) {
+      execFileSync("chattr", ["-i", filePath]);
+      try { return action(); } finally { execFileSync("chattr", ["+i", filePath]); }
+    }
+  }
+  return action();
+}
+
+export function applyFullAccessPolicy(filePath = codexAccessPaths().policy) {
+  if (fs.existsSync(filePath) && fs.lstatSync(filePath).isSymbolicLink()) {
+    throw new Error(`Refusing to rewrite a symbolic-link managed policy: ${filePath}`);
+  }
+  const previous = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : "";
+  const next = fullAccessPolicyContents(previous);
+  if (next === previous) return false;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  return withUnlockedPolicy(filePath, () => writeIfChanged(filePath, previous, fullAccessPolicyContents));
+}
+
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function powershellQuote(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+
+function elevatedRepair() {
+  const helper = fileURLToPath(new URL("../scripts/repair-codex-access.mjs", import.meta.url));
+  if (process.platform === "win32") {
+    const command = `& ${powershellQuote(process.execPath)} ${powershellQuote(helper)} --elevated; exit $LASTEXITCODE`;
+    const encoded = Buffer.from(command, "utf16le").toString("base64");
+    const wrapper = `$p = Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-EncodedCommand','${encoded}') -Verb RunAs -Wait -PassThru -WindowStyle Hidden; exit $p.ExitCode`;
+    execFileSync("powershell.exe", ["-NoProfile", "-EncodedCommand", Buffer.from(wrapper, "utf16le").toString("base64")], { windowsHide: true, timeout: 120_000 });
+    return;
+  }
+  if (process.platform === "darwin") {
+    try {
+      execFileSync("sudo", ["-n", process.execPath, helper, "--elevated"], { timeout: 120_000 });
+      return;
+    } catch {}
+    const command = `${shellQuote(process.execPath)} ${shellQuote(helper)} --elevated`;
+    const appleScript = `do shell script "${command.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}" with administrator privileges`;
+    execFileSync("osascript", ["-e", appleScript], { timeout: 120_000 });
+    return;
+  }
+  try {
+    execFileSync("sudo", ["-n", process.execPath, helper, "--elevated"], { timeout: 120_000 });
+  } catch {
+    if (process.stdin.isTTY) {
+      execFileSync("sudo", [process.execPath, helper, "--elevated"], { stdio: "inherit", timeout: 120_000 });
+    } else {
+      execFileSync("pkexec", [process.execPath, helper, "--elevated"], { timeout: 120_000 });
+    }
+  }
+}
+
+export function fullAccessEnabled(paths = codexAccessPaths()) {
+  return fs.existsSync(paths.marker);
+}
+
+export function enableCodexFullAccess({ paths = codexAccessPaths(), allowElevation = true } = {}) {
+  const config = fs.existsSync(paths.config) ? fs.readFileSync(paths.config, "utf8") : "";
+  writeIfChanged(paths.config, config, fullAccessConfigContents);
+  try {
+    applyFullAccessPolicy(paths.policy);
+  } catch (error) {
+    if (!allowElevation || paths.policy !== codexAccessPaths().policy) throw error;
+    elevatedRepair();
+    const current = fs.readFileSync(paths.policy, "utf8");
+    if (fullAccessPolicyContents(current) !== current) throw new Error("Codex managed policy remains incomplete after administrator repair");
+  }
+  if (!fs.existsSync(paths.marker)) fs.writeFileSync(paths.marker, "enabled\n", { mode: 0o600 });
+  return paths;
+}

package/src/index.mjs

@@ -23,6 +23,7 @@ import {
 } from "./platform.mjs";
 import { runTurn } from "./turn.mjs";
 import { BridgeSecurityPolicy } from "./security-policy.mjs";
+import { enableCodexFullAccess, fullAccessEnabled } from "./codex-full-access.mjs";
 import { DesktopTaskDelivery, DESKTOP_TOOL_BUDGET_MS } from "./thread-delivery.mjs";
 import { desktopTasksConfigured } from "./native-relay.mjs";
 import { exitForVersionRequest } from "./cli-version.mjs";
@@ -34,7 +35,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.3";
+const VERSION = "1.19.5";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
@@ -53,7 +54,18 @@ const DEFAULT_RELEASE_AFTER_TURN = process.env.CODEX_BRIDGE_RELEASE_AFTER_TURN
   : IS_WINDOWS;
 const TERMINAL_TURN_STATUSES = new Set(["completed", "interrupted", "failed"]);
 const RELEASE_TURN_STATUSES = TERMINAL_TURN_STATUSES;
-const security = new BridgeSecurityPolicy();
+const enforceFullAccess = fullAccessEnabled();
+if (enforceFullAccess) {
+  try {
+    enableCodexFullAccess();
+  } catch (error) {
+    log(`Codex Full access repair failed: ${error.message}`);
+  }
+}
+const security = new BridgeSecurityPolicy({
+  ...process.env,
+  ...(enforceFullAccess ? { CODEX_BRIDGE_ENFORCE_FULL_ACCESS: "1" } : {}),
+});
 const desktopTasksEnabled = desktopTasksConfigured();
 const runtime = createRuntimeState({ configuration: desktopTasksConfigured });
 const desktopOperation = new AsyncLocalStorage();

package/src/native-relay-companion.mjs

@@ -34,7 +34,7 @@ import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.3";
+const VERSION = "1.19.5";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent) {

package/src/security-policy.mjs

@@ -3,7 +3,7 @@ import path from "node:path";
 import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 
 const APPROVAL_POLICIES = new Set(["untrusted", "on-failure", "on-request", "never"]);
-const SANDBOXES = new Set(["read-only", "workspace-write"]);
+const SANDBOXES = new Set(["read-only", "workspace-write", "danger-full-access"]);
 const THREAD_POLICIES = new Set(["owned", "roots"]);
 const ALLOW_ALL_ROOTS = "*";
 const ALLOW_ALL_THREADS = "*";
@@ -118,14 +118,15 @@ export class BridgeSecurityPolicy {
       throw new Error(`CODEX_BRIDGE_THREAD_POLICY must be owned or roots: ${this.threadPolicy}`);
     }
 
-    this.approvalPolicy = env.CODEX_BRIDGE_APPROVAL_POLICY ?? "on-request";
+    const fullAccess = env.CODEX_BRIDGE_ENFORCE_FULL_ACCESS === "1";
+    this.approvalPolicy = fullAccess ? "never" : env.CODEX_BRIDGE_APPROVAL_POLICY ?? "on-request";
     if (!APPROVAL_POLICIES.has(this.approvalPolicy)) {
       throw new Error(`Invalid CODEX_BRIDGE_APPROVAL_POLICY: ${this.approvalPolicy}`);
     }
 
-    this.sandbox = env.CODEX_BRIDGE_SANDBOX ?? "workspace-write";
+    this.sandbox = fullAccess ? "danger-full-access" : env.CODEX_BRIDGE_SANDBOX ?? "workspace-write";
     if (!SANDBOXES.has(this.sandbox)) {
-      throw new Error(`CODEX_BRIDGE_SANDBOX must be read-only or workspace-write: ${this.sandbox}`);
+      throw new Error(`CODEX_BRIDGE_SANDBOX must be read-only, workspace-write, or danger-full-access: ${this.sandbox}`);
     }
   }