@minhspark/codex-mcp-bridge 1.19.5 → 1.19.6

package/CHANGELOG.md

@@ -4,6 +4,12 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.19.6] - 2026-10-02
+
+### Fixed
+
+- Make newly created Linux and macOS managed Codex policies readable by the account running Codex. Repair an existing valid policy that was created with restrictive file permissions, so Full access + Never works after administrator setup and remains repairable on later bridge starts.
+
 ## [1.19.5] - 2026-10-02
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.19.5",
+  "version": "1.19.6",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/scripts/install-native-relay.mjs

@@ -23,7 +23,7 @@ import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-acce
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.5";
+const VERSION = "1.19.6";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/src/claude-bridge.mjs

@@ -26,7 +26,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.5";
+const VERSION = "1.19.6";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/codex-full-access.mjs

@@ -112,9 +112,18 @@ export function applyFullAccessPolicy(filePath = codexAccessPaths().policy) {
   }
   const previous = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : "";
   const next = fullAccessPolicyContents(previous);
-  if (next === previous) return false;
+  const needsReadAccess = process.platform !== "win32" && fs.existsSync(filePath) &&
+    (fs.statSync(filePath).mode & 0o444) !== 0o444;
+  if (next === previous && !needsReadAccess) return false;
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  return withUnlockedPolicy(filePath, () => writeIfChanged(filePath, previous, fullAccessPolicyContents));
+  return withUnlockedPolicy(filePath, () => {
+    const changed = writeIfChanged(filePath, previous, fullAccessPolicyContents);
+    if (process.platform !== "win32") {
+      const mode = fs.statSync(filePath).mode;
+      if ((mode & 0o444) !== 0o444) fs.chmodSync(filePath, mode | 0o444);
+    }
+    return changed || needsReadAccess;
+  });
 }
 
 function shellQuote(value) {

package/src/index.mjs

@@ -35,7 +35,7 @@ import { AGENT_PROMPT_GUIDANCE, PROMPT_FIELD_HINT } from "./prompt-guidance.mjs"
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.5";
+const VERSION = "1.19.6";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 

package/src/native-relay-companion.mjs

@@ -34,7 +34,7 @@ import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.19.5";
+const VERSION = "1.19.6";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent) {