@minhspark/codex-mcp-bridge 1.20.0 → 1.21.0

package/src/claude-sender-context.mjs

@@ -285,7 +285,7 @@ export async function readClaudeSenderContext({ account, parentPid = process.ppi
     }
     const sessions = registered.filter((session) => session.entrypoint === "claude-desktop" && session.alive && seen.has(session.pid));
     if (sessions.length > 1) return senderResult("ambiguous", "Multiple registered Claude Desktop sessions appear in this MCP process's ancestry.");
-    if (!sessions.length) return senderResult("unavailable", "This MCP process has no registered Claude Desktop Code session in its parent ancestry. Reconnect the bridge inside the intended existing Code task.");
+    if (!sessions.length) return senderResult("unavailable", "This MCP process has no registered Claude Desktop Code session in its parent ancestry. Check the user-level Claude Code registration: a shared Desktop MCP entry cannot identify the sending Code task. Reload the existing task after correcting registration; View > Reload may refresh only the page. Do not substitute another session or disable sender verification.");
     const session = sessions[0];
     const process = ancestry.find((entry) => entry.pid === session.pid);
     if (session.processStart && session.processStart !== process.processStart) return senderResult("unavailable", "The calling Claude session's registered process identity changed.");

package/src/claude-session-creation.mjs

@@ -48,7 +48,15 @@ function matchesInitialMessage(text, expected) {
 }
 
 function receipt(request) {
-  return structuredClone({ requestId: request.requestId, status: request.status, cwd: request.cwd, promptSubmitted: request.status === "created" || request.submissionObserved === true, reason: request.reason, ...(request.observedCwd ? { observedCwd: request.observedCwd } : {}), ...(request.sessionId ? { sessionId: request.sessionId, taskId: request.taskId, title: request.title } : {}) });
+  const submitted = request.status === "created" || request.submissionObserved === true;
+  return structuredClone({ requestId: request.requestId, status: request.status, cwd: request.cwd,
+    // false means no verified observation, not proof that Desktop did not submit.
+    promptSubmitted: submitted, submissionStatus: submitted ? "observed" : "not_observed",
+    reason: request.reason, ...(request.observedCwd ? { observedCwd: request.observedCwd } : {}), ...(request.sessionId ? { sessionId: request.sessionId, taskId: request.taskId, title: request.title } : {}),
+    ...(PENDING.has(request.status) ? { directoryVerification: {
+      required: true, expectedCwd: request.cwd, verified: false,
+      detail: "The prefilled folder chip is not evidence of the actual session directory. Claude Desktop may create a No folder scratch session. An unobserved submission may be outside the authorized discovery scope; do not expand scope or resend to find it. Inspect Desktop before taking further action. For a fresh setup, prefer the intended project's sidebar New session button, verify the actual cwd with a read-only bootstrap, then dispatch work to the verified task. Do not replace a pending request without explicit cancellation.",
+    } } : {}) });
 }
 
 export class ClaudeSessionCreation {
@@ -137,7 +145,7 @@ export class ClaudeSessionCreation {
       await this.open(url);
       if (autoSubmit) await this.settle();
       request.status = "awaiting_user";
-      request.reason = "Claude Desktop was asked to prefill a new session. Confirm the folder if prompted and press Send; no prompt has been submitted by the bridge.";
+      request.reason = "Claude Desktop was asked to prefill a new session; the bridge did not press Send. The folder chip alone does not confirm the actual directory. Verify the created task's cwd before dispatching work; absence of a discovered task does not prove that the prompt was not submitted.";
     } catch {
       request.reason = "The Desktop launcher failed or returned an uncertain outcome. This request will not be launched again; inspect it to check whether the session was created.";
     }

package/src/codex-mcp-registration.mjs

@@ -17,7 +17,7 @@ export function stdioMcpRegistration({ name, existing, node, entry, entryArgs =
 
 export function codexMcpRegistration({ name, existing, node, entry, entryArgs = [], env, desktopOnly }) {
   const values = { ...existing?.transport?.env };
-  for (const key of ["CLAUDE_BRIDGE_PEER_NAME", "CLAUDE_BRIDGE_PERMISSION_MODE", "CODEX_BRIDGE_DESKTOP_TASKS", "CLAUDE_DESKTOP_USER_DATA"]) {
+  for (const key of ["CLAUDE_BRIDGE_PEER_NAME", "CLAUDE_BRIDGE_PERMISSION_MODE", "CODEX_BRIDGE_DESKTOP_TASKS", "CLAUDE_DESKTOP_USER_DATA", "CODEX_BRIDGE_PROJECT_POLICY"]) {
     if (env[key] !== undefined) values[key] = env[key];
   }
   values.CODEX_BRIDGE_DESKTOP_TASKS ??= desktopOnly ? "1" : "0";

package/src/codex-native-response.mjs

@@ -2,11 +2,11 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { scanRollout } from "./rollout-reader.mjs";
+import { findRolloutSegments, confirmsDesktopTask, isLegacyCliSession, assertRolloutSetStable } from "./rollout-segments.mjs";
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 const MAX_ROLLOUT_BYTES = 16 * 1024 * 1024;
-const MAX_ENTRIES = 100000;
-const MAX_DIRECTORIES = 4096;
 const MAX_REPLY_BYTES = 1024 * 1024;
 const DESKTOP_ORIGINATORS = new Set(["Codex Desktop", "codex_work_desktop"]);
 const COMPLETED = new Set(["task_complete", "task_completed", "turn_complete", "turn_completed"]);
@@ -36,37 +36,9 @@ function configuredSessions(env) {
   return canonicalSessions;
 }
 
-function findRollout(threadId, env) {
-  if (!UUID.test(threadId)) throw new Error("The Codex task identity is invalid");
+function findRollouts(threadId, env) {
   const sessions = configuredSessions(env);
-  const queue = [{ directory: sessions, depth: 0 }];
-  const matches = [];
-  let entries = 0;
-  let directories = 0;
-  while (queue.length) {
-    const { directory, depth } = queue.pop();
-    if (++directories > MAX_DIRECTORIES) throw new Error("The bounded Codex sessions scan exceeded its directory limit");
-    const children = fs.readdirSync(directory, { withFileTypes: true });
-    entries += children.length;
-    if (entries > MAX_ENTRIES) throw new Error("The bounded Codex sessions scan exceeded its entry limit");
-    for (const child of children) {
-      const candidate = path.join(directory, child.name);
-      if (depth < 3 && (depth === 0 ? /^\d{4}$/ : /^\d{2}$/).test(child.name)) {
-        if (child.isSymbolicLink()) throw new Error("The Codex sessions scan encountered a linked date directory");
-        if (child.isDirectory()) {
-          const resolved = fs.realpathSync.native(candidate);
-          const relative = path.relative(sessions, resolved);
-          if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("A Codex date directory escapes the sessions path");
-          queue.push({ directory: resolved, depth: depth + 1 });
-        }
-      }
-      if (depth === 3 && child.name.startsWith("rollout-") && child.name.endsWith(`-${threadId}.jsonl`)) matches.push(candidate);
-    }
-  }
-  if (matches.length !== 1) throw new Error(matches.length ? "Multiple rollouts match the Codex task" : "No rollout matches the Codex task");
-  const status = fs.lstatSync(matches[0]);
-  if (!status.isFile() || status.isSymbolicLink()) throw new Error("The Codex rollout is not a regular file");
-  return { file: matches[0], sessions };
+  return findRolloutSegments(sessions, threadId).map((file) => ({ file, sessions }));
 }
 
 function pathIdentity(candidate, kind) {
@@ -100,49 +72,49 @@ function samePathBoundary(expected, current) {
       entry.path === current.ancestors[index].path && entry.dev === current.ancestors[index].dev && entry.ino === current.ancestors[index].ino);
 }
 
-function readStable(found, maxBytes) {
-  const { file, sessions } = found;
-  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_ROLLOUT_BYTES) throw new Error("The Codex rollout read limit is invalid");
-  const beforeBoundary = capturePathBoundary(file, sessions);
-  const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
-  try {
-    const before = fs.fstatSync(descriptor);
-    if (before.dev !== beforeBoundary.file.dev || before.ino !== beforeBoundary.file.ino) throw new Error("The Codex rollout changed while opening");
-    if (!before.isFile() || before.size === 0 || before.size > maxBytes) throw new Error("The Codex rollout is empty or exceeds the bounded read limit");
-    const data = Buffer.alloc(before.size);
-    let offset = 0;
-    while (offset < data.length) {
-      const count = fs.readSync(descriptor, data, offset, data.length - offset, offset);
-      if (!count) throw new Error("The Codex rollout changed while reading");
-      offset += count;
+function readStable(found, maxBytes, { threadId, turnId, afterOffset = 0, prefixSize } = {}) {
+  for (let attempt = 0; ; attempt++) {
+    try { return readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefixSize }); }
+    catch (error) {
+      if (attempt >= 2 || !/changed while (reading|opening)|incomplete final record/.test(error.message)) throw error;
     }
-    const after = fs.fstatSync(descriptor);
-    const afterBoundary = capturePathBoundary(file, sessions);
-    if (!samePathBoundary(beforeBoundary, afterBoundary) || before.size !== after.size || before.mtimeMs !== after.mtimeMs ||
-        before.ctimeMs !== after.ctimeMs || before.ino !== after.ino || before.dev !== after.dev ||
-        before.ino !== afterBoundary.file.ino || before.dev !== afterBoundary.file.dev) throw new Error("The Codex rollout changed while reading");
-    if (data.at(-1) !== 0x0a) throw new Error("The Codex rollout has an incomplete final record");
-    return { data, identity: { dev: before.dev, ino: before.ino } };
-  } finally {
-    fs.closeSync(descriptor);
   }
 }
 
-function parseRecords(data) {
+function readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefixSize }) {
+  const { file, sessions } = found;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_ROLLOUT_BYTES) throw new Error("The Codex rollout read limit is invalid");
+  const beforeBoundary = capturePathBoundary(file, sessions);
   const records = [];
-  let offset = 0;
-  while (offset < data.length) {
-    const newline = data.indexOf(0x0a, offset);
-    if (newline < 0) throw new Error("The Codex rollout has an incomplete final record");
-    const raw = data.subarray(offset, newline).toString("utf8");
-    const start = offset;
-    offset = newline + 1;
-    if (!raw) continue;
-    const record = JSON.parse(raw);
-    if (!object(record) || !object(record.payload)) throw new Error("The Codex rollout contains an invalid record");
-    records.push({ record, start });
+  const digest = crypto.createHash("sha256");
+  let session, latestContext, retainedBytes = 0, turnBeforeWatermark = false;
+  const snapshot = scanRollout(file, {
+    maxRecordBytes: maxBytes,
+    onChunk(chunk, offset) {
+      // Verify every byte of the pre-send prefix without keeping it in memory.
+      const length = prefixSize === undefined ? chunk.length : Math.max(0, Math.min(chunk.length, prefixSize - offset));
+      if (length) digest.update(chunk.subarray(0, length));
+    },
+    onRecord(record, start, bytes) {
+      if (record.type === "session_meta") {
+        if (session) throw new Error("The Codex rollout has ambiguous session identity");
+        session = record.payload;
+      }
+      if (record.type === "turn_context") latestContext = record.payload;
+      const entry = { record, start };
+      if (turnId && recordBelongsToTurn(entry, threadId, turnId)) {
+        if (start < afterOffset) { turnBeforeWatermark = true; return; }
+        retainedBytes += bytes;
+        if (retainedBytes > maxBytes) throw new Error(`The selected native turn exceeds the ${maxBytes}-byte retained-record limit`);
+        records.push(entry);
+      }
+    },
+  });
+  const afterBoundary = capturePathBoundary(file, sessions);
+  if (!samePathBoundary(beforeBoundary, afterBoundary) || snapshot.identity.dev !== beforeBoundary.file.dev || snapshot.identity.ino !== beforeBoundary.file.ino) {
+    throw new Error("The Codex rollout changed while reading");
   }
-  return records;
+  return { ...snapshot, file, sessions, records, retainedBytes, session, latestContext, turnBeforeWatermark, prefixSha256: digest.digest("hex") };
 }
 
 function canonicalDirectory(value, label) {
@@ -152,12 +124,26 @@ function canonicalDirectory(value, label) {
   return fs.realpathSync.native(value);
 }
 
-function validateSession(records, threadId, expectedCwd) {
-  const sessions = records.filter(({ record }) => record.type === "session_meta").map(({ record }) => record.payload);
-  if (sessions.length !== 1) throw new Error("The Codex rollout has ambiguous session identity");
-  const session = sessions[0];
-  if (session.id !== threadId || !DESKTOP_ORIGINATORS.has(session.originator) || session.source !== "vscode") throw new Error("The rollout does not confirm the exact native Codex Desktop task");
-  if (canonicalDirectory(session.cwd, "The rollout workspace") !== expectedCwd) throw new Error("The rollout workspace does not match the selected native task");
+function validateIdentity({ session }, threadId, expectedCwd, desktopEvidence) {
+  if (!session) throw new Error("The Codex rollout is missing its session identity");
+  const desktop = DESKTOP_ORIGINATORS.has(session.originator) && session.source === "vscode";
+  const adopted = isLegacyCliSession(session) && confirmsDesktopTask(desktopEvidence, threadId, expectedCwd);
+  if (session.id !== threadId || (!desktop && !adopted)) throw new Error("The rollout does not confirm the exact native Codex Desktop task");
+  if (typeof session.cwd !== "string" || !path.isAbsolute(session.cwd)) throw new Error("The original rollout workspace is missing or invalid");
+}
+
+function validateSession(snapshot, threadId, expectedCwd, desktopEvidence) {
+  validateIdentity(snapshot, threadId, expectedCwd, desktopEvidence);
+  // Current cwd comes from independently inspected native Desktop metadata.
+  if (canonicalDirectory(snapshot.latestContext ? snapshot.latestContext.cwd : snapshot.session.cwd, "The rollout workspace") !== expectedCwd) throw new Error("The rollout workspace does not match the selected native task");
+}
+
+function uniqueTurn(snapshots) {
+  const selected = snapshots.filter((snapshot) => snapshot.records.length);
+  if (selected.length !== 1) throw new Error(selected.length
+    ? "The native turn spans multiple rollout segments or has ambiguous copies; response withheld"
+    : "No rollout segment contains the selected native turn");
+  return selected[0];
 }
 
 function delegationOutputs(executorThreadId, prompt) {
@@ -216,7 +202,7 @@ function inspectTurnRecords(records, threadId, turnId, cwd, { requireDispatch }
   let dispatch = null;
   if (requireDispatch) {
     const dispatches = turns.filter(({ record }) => record.type === "response_item" && record.payload.type === "function_call_output" &&
-      record.payload.namespace === "codex_app" && record.payload.name === "send_message_to_thread");
+      record.payload.namespace === "codex_app" && record.payload.name === (requireDispatch.operation ?? "send_message_to_thread"));
     if (dispatches.length !== 1 || !requireDispatch.outputs.includes(dispatches[0].record.payload.output) ||
         contexts[0].start >= dispatches[0].start || dispatches[0].start >= completions[0].start) {
       throw new Error("The newly observed turn is not correlated to the exact native dispatch");
@@ -274,42 +260,73 @@ function inspectTurnRecords(records, threadId, turnId, cwd, { requireDispatch }
   };
 }
 
-export function captureCodexRolloutWatermark({ threadId, expectedCwd }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
+export function captureCodexRolloutWatermark({ threadId, expectedCwd, desktopEvidence }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
   try {
     const cwd = canonicalDirectory(expectedCwd, "The selected native task workspace");
-    const found = findRollout(threadId, env);
-    const snapshot = readStable(found, maxRolloutBytes);
-    const records = parseRecords(snapshot.data);
-    validateSession(records, threadId, cwd);
-    return {
-      status: "available",
-      threadId,
-      cwd,
-      file: found.file,
-      size: snapshot.data.length,
-      prefixSha256: crypto.createHash("sha256").update(snapshot.data).digest("hex"),
-      identity: snapshot.identity,
-    };
+    const snapshots = findRollouts(threadId, env).map((found) => ({ ...found, ...readStable(found, maxRolloutBytes) }));
+    assertRolloutSetStable(snapshots[0].sessions, threadId, snapshots);
+    for (const snapshot of snapshots) validateIdentity(snapshot, threadId, cwd, desktopEvidence);
+    const matches = snapshots.length === 1 ? snapshots : snapshots.filter((snapshot) =>
+      desktopEvidence?.latestTurnId && snapshot.latestContext?.turn_id === desktopEvidence.latestTurnId);
+    if (matches.length !== 1) throw new Error("Multiple rollouts require an unambiguous current native Desktop turn");
+    const selected = matches[0];
+    validateSession(selected, threadId, cwd, desktopEvidence);
+    const mark = ({ file, size, prefixSha256, identity }) => ({ file, size, prefixSha256, identity });
+    return { status: "available", threadId, cwd, ...mark(selected), segments: snapshots.map(mark) };
   } catch (error) {
     return unavailable(error);
   }
 }
 
-export function inspectCodexNativeTurn({ threadId, turnId, expectedCwd }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
+// Creation has no pre-send rollout: the confirmed fresh thread ID is its boundary.
+// Require the exact create_thread dispatch, executor and prompt rather than
+// treating any later turn in that thread as the delegated reply.
+export function readCodexNativeCreationResponse({ threadId, turnId, expectedCwd, executorThreadId, prompt, desktopEvidence }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
+  try {
+    if (!UUID.test(threadId) || !UUID.test(turnId) || !UUID.test(executorThreadId)) throw new Error("The native creation response identity is invalid");
+    if (typeof prompt !== "string" || !prompt.length) throw new Error("The exact creation prompt is unavailable");
+    const cwd = canonicalDirectory(expectedCwd, "The created native task workspace");
+    let retainedBytes = 0;
+    const snapshots = findRollouts(threadId, env).map((found) => {
+      const snapshot = readStable(found, maxRolloutBytes, { threadId, turnId });
+      retainedBytes += snapshot.retainedBytes;
+      if (retainedBytes > maxRolloutBytes) throw new Error("The native turn exceeds the retained-record limit across segments");
+      validateIdentity(snapshot, threadId, cwd, desktopEvidence);
+      return snapshot;
+    });
+    assertRolloutSetStable(snapshots[0].sessions, threadId, snapshots);
+    const selected = uniqueTurn(snapshots);
+    validateSession(selected, threadId, cwd, desktopEvidence);
+    return inspectTurnRecords(selected.records, threadId, turnId, cwd, {
+      requireDispatch: { operation: "create_thread", outputs: delegationOutputs(executorThreadId, prompt) },
+    });
+  } catch (error) {
+    return { ...unavailable(error), threadId, turnId, source: "codex_desktop_rollout", assistantItems: [], text: "", replySha256: null };
+  }
+}
+
+export function inspectCodexNativeTurn({ threadId, turnId, expectedCwd, desktopEvidence }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
   try {
     if (!UUID.test(threadId) || !UUID.test(turnId)) throw new Error("The native turn identity is invalid");
     const cwd = canonicalDirectory(expectedCwd, "The selected native task workspace");
-    const found = findRollout(threadId, env);
-    const snapshot = readStable(found, maxRolloutBytes);
-    const records = parseRecords(snapshot.data);
-    validateSession(records, threadId, cwd);
-    return inspectTurnRecords(records, threadId, turnId, cwd);
+    let retainedBytes = 0;
+    const snapshots = findRollouts(threadId, env).map((found) => {
+      const snapshot = readStable(found, maxRolloutBytes, { threadId, turnId });
+      retainedBytes += snapshot.retainedBytes;
+      if (retainedBytes > maxRolloutBytes) throw new Error("The native turn exceeds the retained-record limit across segments");
+      return snapshot;
+    });
+    assertRolloutSetStable(snapshots[0].sessions, threadId, snapshots);
+    for (const snapshot of snapshots) validateIdentity(snapshot, threadId, cwd, desktopEvidence);
+    const selected = uniqueTurn(snapshots);
+    validateSession(selected, threadId, cwd, desktopEvidence);
+    return inspectTurnRecords(selected.records, threadId, turnId, cwd);
   } catch (error) {
     return { ...unavailable(error), threadId, turnId, source: "codex_desktop_rollout", assistantItems: [], text: "", replySha256: null };
   }
 }
 
-export function readCodexNativeTurnResponse({ threadId, turnId, previousTurnId, expectedCwd, executorThreadId, prompt, watermark }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
+export function readCodexNativeTurnResponse({ threadId, turnId, previousTurnId, expectedCwd, executorThreadId, prompt, watermark, desktopEvidence }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
   try {
     if (!UUID.test(threadId) || !UUID.test(turnId) || !UUID.test(executorThreadId)) throw new Error("The native response identity is invalid");
     if (turnId === previousTurnId) throw new Error("The observed turn was already present before dispatch");
@@ -317,16 +334,31 @@ export function readCodexNativeTurnResponse({ threadId, turnId, previousTurnId,
     if (!object(watermark) || watermark.status !== "available" || watermark.threadId !== threadId) throw new Error("No trusted pre-send rollout watermark is available");
     const cwd = canonicalDirectory(expectedCwd, "The selected native task workspace");
     if (watermark.cwd !== cwd) throw new Error("The selected native task workspace changed after dispatch");
-    const found = findRollout(threadId, env);
-    if (found.file !== watermark.file) throw new Error("The selected native task rollout changed after dispatch");
-    const snapshot = readStable(found, maxRolloutBytes);
-    if (snapshot.identity.dev !== watermark.identity?.dev || snapshot.identity.ino !== watermark.identity?.ino || snapshot.data.length < watermark.size) throw new Error("The selected native task rollout identity changed after dispatch");
-    const prefix = snapshot.data.subarray(0, watermark.size);
-    if (crypto.createHash("sha256").update(prefix).digest("hex") !== watermark.prefixSha256) throw new Error("The pre-send Codex rollout history changed after dispatch");
-    const records = parseRecords(snapshot.data);
-    validateSession(records, threadId, cwd);
-    const tail = records.filter(({ start }) => start >= watermark.size);
-    const inspected = inspectTurnRecords(tail, threadId, turnId, cwd, {
+    const marks = watermark.segments ?? [watermark];
+    if (!Array.isArray(marks) || !marks.length || marks.length > 64
+        || new Set(marks.map((mark) => mark.file)).size !== marks.length
+        || !marks.some((mark) => mark.file === watermark.file && mark.size === watermark.size && mark.prefixSha256 === watermark.prefixSha256)) throw new Error("The pre-send segment watermarks are invalid");
+    for (const mark of marks) if (!Number.isSafeInteger(mark.size) || mark.size < 1) throw new Error("The pre-send rollout watermark size is invalid");
+    const found = findRollouts(threadId, env);
+    if (marks.some((mark) => !found.some(({ file }) => file === mark.file))) throw new Error("A pre-send rollout segment disappeared after dispatch");
+    let retainedBytes = 0;
+    const snapshots = found.map((entry) => {
+      const mark = marks.find(({ file }) => file === entry.file);
+      const snapshot = readStable(entry, maxRolloutBytes, { threadId, turnId, afterOffset: mark?.size ?? 0, prefixSize: mark?.size });
+      retainedBytes += snapshot.retainedBytes;
+      if (retainedBytes > maxRolloutBytes) throw new Error("The native turn exceeds the retained-record limit across segments");
+      if (mark) {
+        if (snapshot.identity.dev !== mark.identity?.dev || snapshot.identity.ino !== mark.identity?.ino || snapshot.size < mark.size) throw new Error("The selected native task rollout identity changed after dispatch");
+        if (snapshot.prefixSha256 !== mark.prefixSha256) throw new Error("The pre-send Codex rollout history changed after dispatch");
+      }
+      if (snapshot.turnBeforeWatermark) throw new Error("The observed turn was already present before dispatch");
+      validateIdentity(snapshot, threadId, cwd, desktopEvidence);
+      return snapshot;
+    });
+    assertRolloutSetStable(snapshots[0].sessions, threadId, snapshots);
+    const selected = uniqueTurn(snapshots);
+    validateSession(selected, threadId, cwd, desktopEvidence);
+    const inspected = inspectTurnRecords(selected.records, threadId, turnId, cwd, {
       requireDispatch: { outputs: delegationOutputs(executorThreadId, prompt) },
     });
     return { ...inspected, observationStatus: inspected.status };

package/src/codex-sender-context.mjs

@@ -1,14 +1,14 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { scanRollout } from "./rollout-reader.mjs";
+import { findRolloutSegments, confirmsDesktopTask, isLegacyCliSession, assertRolloutSetStable } from "./rollout-segments.mjs";
 
 const METADATA_KEY = "x-codex-turn-metadata";
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 const LIFECYCLE = new Set(["task_started", "task_complete", "task_completed", "turn_started", "turn_complete", "turn_completed", "turn_aborted", "task_aborted"]);
 const STARTED = new Set(["task_started", "turn_started"]);
 const MAX_ROLLOUT_BYTES = 64 * 1024 * 1024;
-const MAX_ENTRIES = 100000;
-const MAX_DIRECTORIES = 4096;
 const DESKTOP_ORIGINATORS = new Set(["Codex Desktop", "codex_work_desktop"]);
 const PROMPTING_POLICIES = new Set(["on-request", "on-failure", "untrusted"]);
 const GRANULAR_CATEGORIES = ["sandbox_approval", "rules", "mcp_elicitations"];
@@ -37,57 +37,27 @@ function reviewFlag(metadata, field) {
 }
 
 export function findRollout(sessions, threadId) {
-  if (!fs.lstatSync(sessions).isDirectory()) throw new Error("The Codex sessions path is not a regular directory");
-  const queue = [{ directory: sessions, depth: 0 }];
-  const matches = [];
-  let entries = 0;
-  let directories = 0;
-  while (queue.length) {
-    const { directory, depth } = queue.pop();
-    if (++directories > MAX_DIRECTORIES) throw new Error("The bounded Codex sessions scan exceeded its directory limit");
-    const children = fs.readdirSync(directory, { withFileTypes: true });
-    entries += children.length;
-    if (entries > MAX_ENTRIES) throw new Error("The bounded Codex sessions scan exceeded its entry limit");
-    for (const child of children) {
-      const candidate = path.join(directory, child.name);
-      if (depth < 3 && (depth === 0 ? /^\d{4}$/ : /^\d{2}$/).test(child.name)) {
-        if (child.isSymbolicLink()) throw new Error("The Codex sessions scan encountered a linked date directory");
-        if (child.isDirectory()) queue.push({ directory: candidate, depth: depth + 1 });
-      }
-      if (depth === 3 && child.name.startsWith("rollout-") && child.name.endsWith(`-${threadId}.jsonl`)) {
-        if (!child.isFile() || child.isSymbolicLink()) throw new Error("The sender rollout is not a regular file");
-        matches.push(candidate);
-      }
-    }
-  }
-  if (matches.length !== 1) throw new Error(matches.length ? "Multiple rollouts match the calling Codex task" : "No rollout matches the calling Codex task");
-  return matches[0];
+  const files = findRolloutSegments(sessions, threadId);
+  if (files.length !== 1) throw new Error("Multiple rollouts match the calling Codex task");
+  return files[0];
 }
 
 export function readState(file, maxBytes) {
-  const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
-  try {
-    const before = fs.fstatSync(descriptor);
-    if (!before.isFile() || before.size === 0 || before.size > maxBytes) throw new Error("The sender rollout is empty or exceeds the bounded read limit");
-    const data = Buffer.alloc(before.size);
-    let offset = 0;
-    while (offset < data.length) {
-      const count = fs.readSync(descriptor, data, offset, data.length - offset, offset);
-      if (!count) throw new Error("The sender rollout changed while reading");
-      offset += count;
+  for (let attempt = 0; ; attempt++) {
+    try { return readStateOnce(file, maxBytes); }
+    catch (error) {
+      // A live Desktop task can append its tool event during verification.
+      // Retry the entire scan, never reuse partially observed permissions.
+      if (attempt >= 2 || !/changed while (reading|opening)|incomplete final record/.test(error.message)) throw error;
     }
-    const after = fs.fstatSync(descriptor);
-    const current = fs.lstatSync(file);
-    if (!current.isFile() || current.isSymbolicLink() || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ino !== current.ino || before.dev !== current.dev) throw new Error("The sender rollout changed while reading");
-    const text = data.toString("utf8");
-    if (!text.endsWith("\n")) throw new Error("The sender rollout has an incomplete final record");
-    let session;
-    let context;
-    let lifecycle;
-    for (const line of text.split("\n")) {
-      if (!line) continue;
-      const record = JSON.parse(line);
-      if (!object(record) || !object(record.payload)) throw new Error("The sender rollout contains an invalid record");
+  }
+}
+
+function readStateOnce(file, maxBytes) {
+  let session, context, lifecycle;
+  const snapshot = scanRollout(file, {
+    maxRecordBytes: maxBytes,
+    onRecord(record) {
       if (record.type === "session_meta") {
         if (session) throw new Error("The sender rollout repeats its session identity");
         session = record.payload;
@@ -96,11 +66,9 @@ export function readState(file, maxBytes) {
       } else if (record.type === "event_msg" && LIFECYCLE.has(record.payload.type)) {
         lifecycle = record.payload;
       }
-    }
-    return { session, context, lifecycle };
-  } finally {
-    fs.closeSync(descriptor);
-  }
+    },
+  });
+  return { session, context, lifecycle, version: snapshot.version };
 }
 
 /**
@@ -199,31 +167,64 @@ function permissionClass(context, metadata) {
   throw new Error("The caller's effective approval policy is unsupported");
 }
 
-export function readCodexSenderContext(meta, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES, originator = "Codex Desktop" } = {}) {
+export function readCodexSenderContext(meta, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES, originator = "Codex Desktop", desktopEvidence } = {}) {
   const metadata = object(meta) ? meta[METADATA_KEY] : undefined;
   if (!object(metadata) || typeof metadata.thread_id !== "string" || typeof metadata.turn_id !== "string" || !UUID.test(metadata.thread_id) || !UUID.test(metadata.turn_id)) return unavailable("This MCP call has no valid host-supplied Codex task and turn identity");
   const identity = { threadId: metadata.thread_id, turnId: metadata.turn_id,
     review: { autoReview: reviewFlag(metadata, "auto_review_enabled"), nodeReplReview: reviewFlag(metadata, "node_repl_auto_review_required") } };
   try {
     if (!Number.isSafeInteger(maxRolloutBytes) || maxRolloutBytes < 1) throw new Error("The sender rollout read limit is invalid");
-    if (metadata.thread_source !== "user") throw new Error("This MCP call is not from a user-owned Codex task");
+    // Native create_thread produces a user-visible Desktop task with a distinct
+    // host source. It is not a transient subagent. Require live native proof in
+    // addition to the root rollout and the caller's own permission context.
+    const agentCreated = metadata.thread_source === "agent_created_thread" && originator === "Codex Desktop";
+    if (metadata.thread_source !== "user" && !agentCreated) throw new Error(`Unsupported calling task source (host thread_source: ${JSON.stringify(metadata.thread_source) ?? "missing"})`);
     const configuredHome = env.CODEX_HOME || path.join(env.HOME || env.USERPROFILE || os.homedir(), ".codex");
     if (!path.isAbsolute(configuredHome)) throw new Error("The configured Codex home must be absolute");
     const sessions = path.join(configuredHome, "sessions");
-    const file = findRollout(sessions, identity.threadId);
-    const state = readState(file, Math.min(MAX_ROLLOUT_BYTES, maxRolloutBytes));
-    const { session, context, lifecycle } = state;
+    const matches = [], snapshots = [];
+    for (const file of findRolloutSegments(sessions, identity.threadId)) {
+      const state = readState(file, Math.min(MAX_ROLLOUT_BYTES, maxRolloutBytes));
+      if (state.session?.id !== identity.threadId) throw new Error("A rollout segment contradicts the calling task identity");
+      snapshots.push({ file, version: state.version });
+      if (state.context?.turn_id === identity.turnId || state.lifecycle?.turn_id === identity.turnId) matches.push({ file, ...state });
+      if (matches.length > 1) throw new Error("Multiple rollout segments match the calling turn");
+    }
+    assertRolloutSetStable(sessions, identity.threadId, snapshots);
+    if (matches.length !== 1) throw new Error(matches.length ? "Multiple rollout segments match the calling turn" : "The calling turn is no longer the latest active Codex turn");
+    const { file, session, context, lifecycle } = matches[0];
     if (!["Codex Desktop", "codex_vscode"].includes(originator)) throw new Error("Unsupported calling host");
     const desktop = originator === "Codex Desktop";
     const matchesOriginator = desktop ? DESKTOP_ORIGINATORS.has(session?.originator) : session?.originator === originator;
-    if (session?.id !== identity.threadId || !matchesOriginator || session.source !== "vscode") throw new Error(`The caller rollout does not confirm a root ${originator} task`);
+    const legacy = desktop && isLegacyCliSession(session);
+    if ((!matchesOriginator || session.source !== "vscode") && !legacy) throw new Error(`The caller rollout does not confirm a root ${originator} task`);
     if (context?.turn_id !== identity.turnId || lifecycle?.turn_id !== identity.turnId || !STARTED.has(lifecycle?.type)) throw new Error("The calling turn is no longer the latest active Codex turn");
     if (typeof context.cwd !== "string" || !path.isAbsolute(context.cwd) || typeof session.cwd !== "string" || !path.isAbsolute(session.cwd)) throw new Error("The caller's workspace is missing or invalid");
     const cwd = fs.realpathSync.native(context.cwd);
-    if (!fs.statSync(cwd).isDirectory() || path.relative(fs.realpathSync.native(session.cwd), cwd)) throw new Error("The caller's workspace changed from its Desktop session identity");
+    if (!fs.statSync(cwd).isDirectory()) throw new Error("The caller's current workspace is not a directory");
+    // Desktop can move a task after creation. Its exact active turn supplies both
+    // the effective workspace and permissions; session_meta.cwd is historical.
+    // VS Code's same-project policy is deliberately unchanged.
+    if (!desktop && path.relative(fs.realpathSync.native(session.cwd), cwd)) throw new Error("The caller's workspace changed from its VS Code session identity");
     const { mode, approvalPolicy, permissionProfile } = permissionClass(context, metadata);
+    if ((legacy || agentCreated) && !confirmsDesktopTask(desktopEvidence, identity.threadId, cwd, identity.turnId)) {
+      return { ...unavailable(`This ${agentCreated ? "agent-created" : "CLI-origin"} task requires current native Desktop ownership and exact active-turn confirmation`, identity), requiresDesktopEvidence: true };
+    }
     return { status: "verified", ...identity, mode, cwd, source: file, approvalPolicy, permissionProfile, approvalsReviewer: context.approvals_reviewer, reason: "Host-supplied calling task and active turn match the Desktop rollout's effective permission settings" };
   } catch (error) {
     return unavailable(error?.code ? `Caller evidence could not be read (${error.code}); no sender permission class was inferred` : error.message, identity);
   }
 }
+
+// Confirm adopted CLI and agent-created tasks through the account-bound native relay,
+// then re-read the rollout so a completed/replaced turn cannot reuse the proof.
+export async function resolveCodexSenderContext(meta, { inspectDesktopTask, ...options } = {}) {
+  const initial = readCodexSenderContext(meta, options);
+  if (!initial.requiresDesktopEvidence || typeof inspectDesktopTask !== "function") return initial;
+  try {
+    const desktopEvidence = await inspectDesktopTask(initial.threadId);
+    return readCodexSenderContext(meta, { ...options, desktopEvidence });
+  } catch (error) {
+    return { ...initial, reason: `Native Desktop ownership could not be verified: ${error.message}` };
+  }
+}