@minhspark/codex-mcp-bridge 1.20.1 → 1.21.1

package/src/project-policy.mjs

@@ -0,0 +1,256 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+
+const MAX_BYTES = 256 * 1024;
+const inside = (root, candidate) => {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (!path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`));
+};
+const equal = (a, b) => path.relative(a, b) === "";
+
+export function readRegularConfigFile(file, { maxBytes = MAX_BYTES, missing = false, encoding = "utf8", label = "Configuration" } = {}) {
+  let entry;
+  try { entry = fs.lstatSync(file, { bigint: true }); }
+  catch (error) { if (missing && error.code === "ENOENT") return null; throw error; }
+  const valid = stat => stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1n && stat.size <= BigInt(maxBytes);
+  const matches = (left, right) => ["dev", "ino", "size", "mtimeNs", "ctimeNs", "nlink"].every(field => left[field] === right[field]);
+  if (!valid(entry)) throw new Error(`${label}: refusing linked or nonregular file, or exceeded size limit`);
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
+  try {
+    const before = fs.fstatSync(fd, { bigint: true });
+    if (!valid(before) || !matches(entry, before)) throw new Error(`${label} changed during access`);
+    const data = Buffer.alloc(Number(before.size) + 1);
+    let offset = 0;
+    while (offset < data.length) {
+      const count = fs.readSync(fd, data, offset, data.length - offset, offset);
+      if (!count) break;
+      offset += count;
+    }
+    const after = fs.fstatSync(fd, { bigint: true });
+    const current = fs.lstatSync(file, { bigint: true });
+    if (offset !== Number(before.size) || !valid(after) || !valid(current) || !matches(before, after) || !matches(after, current)) throw new Error(`${label} changed during access`);
+    const bytes = data.subarray(0, offset);
+    return encoding === null ? bytes : bytes.toString(encoding);
+  } finally { fs.closeSync(fd); }
+}
+
+export function backupRegularConfigFile(file, backup, expected, maxBytes = MAX_BYTES) {
+  const bytes = readRegularConfigFile(file, { maxBytes, encoding: null });
+  if (bytes.toString("utf8") !== expected) throw new Error("Configuration changed concurrently before backup");
+  fs.writeFileSync(backup, bytes, { flag: "wx", mode: 0o600 });
+}
+
+export function directoryBinding(input) {
+  if (typeof input !== "string" || !path.isAbsolute(input)) throw new Error("Project paths must be absolute directories");
+  const resolved = fs.realpathSync.native(input);
+  const stat = fs.statSync(resolved, { bigint: true });
+  if (!stat.isDirectory()) throw new Error("Project path is not a directory");
+  return { path: resolved, identity: `${stat.dev}:${stat.ino}:${stat.birthtimeNs ?? stat.birthtimeMs}` };
+}
+
+// Git reports membership; comparing a .git pointer alone would accept a forged checkout.
+export function repositoryBinding(cwd, { git = "git", env = process.env, strict = false } = {}) {
+  let marker = false;
+  for (let root = cwd; ; root = path.dirname(root)) {
+    try { fs.lstatSync(path.join(root, ".git")); marker = true; break; }
+    catch (error) { if (error.code !== "ENOENT") throw error; }
+    if (path.dirname(root) === root) break;
+  }
+  if (!marker) return null;
+  const gitEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !/^GIT_/i.test(key)));
+  const run = (args) => execFileSync(git, ["--no-optional-locks", "-C", cwd, ...args], {
+    env: gitEnv, encoding: "utf8", windowsHide: true, timeout: 5000, maxBuffer: 1024 * 1024, stdio: ["ignore", "pipe", "pipe"],
+  });
+  try {
+    const top = directoryBinding(run(["rev-parse", "--show-toplevel"]).trim());
+    const common = directoryBinding(run(["rev-parse", "--path-format=absolute", "--git-common-dir"]).trim());
+    const worktrees = run(["worktree", "list", "--porcelain", "-z"]).split("\0")
+      .filter((field) => field.startsWith("worktree ")).map((field) => field.slice(9));
+    if (!worktrees.some((root) => { try { return equal(directoryBinding(root).path, top.path); } catch { return false; } })) throw new Error("Git worktree is not registered");
+    const primary = directoryBinding(worktrees[0]);
+    return { common, primary, top, worktrees: worktrees.flatMap((root) => { try { return [directoryBinding(root)]; } catch { return []; } }) };
+  } catch (cause) {
+    if (strict) throw new Error("Git repository identity could not be verified", { cause });
+    return null;
+  }
+}
+
+export function scopeEntry(input, kind, options) {
+  if (!["project", "parent"].includes(kind)) throw new Error("Scope kind must be project or parent");
+  const directory = directoryBinding(input);
+  if (path.parse(directory.path).root === directory.path) throw new Error("Authorize a project or parent folder, not an entire drive");
+  const repo = kind === "project" ? repositoryBinding(directory.path, { ...options, strict: true }) : null;
+  return { kind, ...directory, ...(repo ? { repository: repo.common, worktrees: repo.worktrees } : {}) };
+}
+
+function validateBinding(binding) {
+  if (!binding || typeof binding.path !== "string" || !path.isAbsolute(binding.path) || typeof binding.identity !== "string" || !binding.identity) throw new Error("Invalid stored directory identity");
+}
+
+export function readProjectPolicy(file) {
+  if (!path.isAbsolute(file)) throw new Error("CODEX_BRIDGE_PROJECT_POLICY must be an absolute file path");
+  const raw = readRegularConfigFile(file, { label: "Project policy" });
+  return parseProjectPolicy(raw);
+}
+
+export function parseProjectPolicy(raw) {
+  const policy = JSON.parse(raw);
+  if (policy.version !== 1 || !Array.isArray(policy.grants) || !Array.isArray(policy.denies) || policy.grants.length + policy.denies.length > 512) throw new Error("Invalid project policy schema");
+  for (const entry of [...policy.grants, ...policy.denies]) {
+    if (!["project", "parent"].includes(entry.kind)) throw new Error("Invalid project policy entry kind");
+    validateBinding(entry);
+    if (entry.repository) validateBinding(entry.repository);
+    if (entry.worktrees !== undefined) {
+      if (!entry.repository || !Array.isArray(entry.worktrees) || entry.worktrees.length > 512) throw new Error("Invalid stored worktree identities");
+      entry.worktrees.forEach(validateBinding);
+    }
+  }
+  return { policy, revision: createHash("sha256").update(raw).digest("hex") };
+}
+
+function current(binding) {
+  try { const now = directoryBinding(binding.path); return equal(now.path, binding.path) && now.identity === binding.identity; } catch { return false; }
+}
+const sameRepository = (a, b) => a && b && equal(a.path, b.path) && a.identity === b.identity;
+
+export function createProjectScope(file, options = {}) {
+  const inspect = (candidate) => {
+    const { policy, revision } = readProjectPolicy(file);
+    const directory = directoryBinding(candidate);
+    let repo;
+    const repository = () => repo === undefined ? (repo = repositoryBinding(directory.path, { ...options, strict: true })) : repo;
+    const matches = (entry, deny = false) => {
+      // Denials keep blocking their path even if that directory has been replaced.
+      if (deny && (inside(entry.path, directory.path) || entry.worktrees?.some((root) => inside(root.path, directory.path)))) return true;
+      if (!deny && current(entry) && inside(entry.path, directory.path) &&
+          (!entry.repository || sameRepository(entry.repository, repository()?.common))) return true;
+      const actual = repository();
+      if (!actual) return false;
+      if (entry.repository && (deny ? equal(entry.repository.path, actual.common.path) : current(entry.repository) && sameRepository(entry.repository, actual.common))) return true;
+      return entry.kind === "parent" && (deny || current(entry)) && inside(entry.path, actual.primary.path);
+    };
+    if (policy.denies.some((entry) => matches(entry, true))) throw new Error(`Project access was revoked: ${directory.path}. Explicitly reauthorize this project before sending.`);
+    const grant = policy.grants.find((entry) => matches(entry));
+    if (!grant) throw new Error(`Project is not authorized: ${directory.path}. Authorize this project once with bridge-projects allow-project, or authorize its parent folder.`);
+    // Bind repository identity as well as cwd, including when a direct path grant matched.
+    const actual = repository();
+    return { ...directory, repository: actual?.common ?? null, revision, authorizedBy: { kind: grant.kind, path: grant.path } };
+  };
+  const capture = (candidate, label = "Working directory") => {
+    try { return Object.freeze(inspect(candidate)); }
+    catch (error) { throw new Error(`${label}: ${error.message}`, { cause: error }); }
+  };
+  return Object.freeze({
+    enabled: true,
+    mode: "project-policy",
+    file,
+    get roots() { return readProjectPolicy(file).policy.grants.map((entry) => entry.path); },
+    assert: (candidate, label) => capture(candidate, label).path,
+    allows(candidate) { try { capture(candidate); return true; } catch { return false; } },
+    capture,
+    recheck(binding, label = "Working directory") {
+      if (!binding?.identity) throw new Error(`${label} has no original directory identity`);
+      const now = capture(binding.path, label);
+      if (now.identity !== binding.identity || !equal(now.path, binding.path) ||
+          Boolean(now.repository) !== Boolean(binding.repository) ||
+          (now.repository && !sameRepository(now.repository, binding.repository))) throw new Error(`${label} directory or repository was replaced`);
+      return now.path;
+    },
+    same(a, b) { try { return equal(capture(a).path, capture(b).path); } catch { return false; } },
+    status(candidate) {
+      try {
+        const { policy, revision } = readProjectPolicy(file);
+        const stale = policy.grants.filter((entry) => !current(entry) || (entry.repository && !current(entry.repository)));
+        return { mode: "project-policy", file, revision, grants: policy.grants.length, denies: policy.denies.length,
+          warnings: [...stale.map((entry) => `Authorization path is missing or replaced: ${entry.path}`), ...policy.denies.filter(entry => entry.revocationWarning).map(entry => `${entry.path}: ${entry.revocationWarning}`)],
+          ...(candidate ? { workspace: inspect(candidate) } : {}) };
+      } catch (error) { return { mode: "project-policy", file, error: error.message }; }
+    },
+  });
+}
+
+export function updateProjectPolicy(file, edit) {
+  if (!path.isAbsolute(file)) throw new Error("Policy file path must be absolute");
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const lock = `${file}.lock`;
+  const handle = fs.openSync(lock, "wx", 0o600);
+  const temporary = `${file}.pending-${randomUUID()}`;
+  try {
+    const original = readRegularConfigFile(file, { missing: true, label: "Project policy" });
+    const exists = original !== null;
+    const policy = exists ? parseProjectPolicy(original).policy : { version: 1, grants: [], denies: [] };
+    const before = JSON.stringify(policy);
+    edit(policy);
+    if (exists && JSON.stringify(policy) === before) return policy;
+    fs.writeFileSync(temporary, `${JSON.stringify(policy, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+    readProjectPolicy(temporary);
+    if (readRegularConfigFile(file, { missing: true }) !== original) throw new Error("Project policy changed concurrently");
+    if (exists) backupRegularConfigFile(file, `${file}.backup-${randomUUID()}`, original);
+    fs.renameSync(temporary, file);
+    return policy;
+  } finally {
+    fs.closeSync(handle);
+    fs.rmSync(temporary, { force: true });
+    fs.rmSync(lock);
+  }
+}
+
+function canonicalPolicyPath(input) {
+  if (typeof input !== "string" || !path.isAbsolute(input)) throw new Error("Project paths must be absolute directories");
+  let root = path.resolve(input);
+  const suffix = [];
+  for (;;) {
+    try { return path.join(fs.realpathSync.native(root), ...suffix); }
+    catch (error) {
+      if (!["ENOENT", "ENOTDIR"].includes(error.code) || path.dirname(root) === root) throw error;
+      suffix.unshift(path.basename(root));
+      root = path.dirname(root);
+    }
+  }
+}
+
+export function projectRevocationEntry(entry, options) {
+  let actual;
+  try { actual = repositoryBinding(entry.path, options); }
+  catch (error) {
+    if (!["ENOENT", "ENOTDIR"].includes(error.code)) throw error;
+  }
+  let registered = [];
+  let revocationWarning;
+  try {
+  if (entry.repository && current(entry.repository)) {
+    const { git = "git", env = process.env } = options ?? {};
+    const gitEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !/^GIT_/i.test(key)));
+    const output = execFileSync(git, ["--no-optional-locks", `--git-dir=${entry.repository.path}`, "worktree", "list", "--porcelain", "-z"], {
+      env: gitEnv, encoding: "utf8", windowsHide: true, timeout: 5000, maxBuffer: 1024 * 1024, stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (!current(entry.repository)) throw new Error("Repository changed while revoking project access");
+    registered = output.split("\0").filter(field => field.startsWith("worktree ")).flatMap(field => {
+      try { return [directoryBinding(field.slice(9))]; }
+      catch (error) { if (["ENOENT", "ENOTDIR"].includes(error.code)) return []; throw error; }
+    });
+  }
+  } catch { revocationWarning = "Git worktree discovery failed during revocation; saved repository and path denials were retained"; }
+  const worktrees = [...(entry.worktrees ?? []), ...registered, ...(sameRepository(entry.repository, actual?.common) ? actual.worktrees : [])];
+  return { ...entry, ...(revocationWarning ? { revocationWarning } : {}), ...(entry.repository ? { worktrees: [...new Map(worktrees.map(root => [root.path, root])).values()] } : {}) };
+}
+
+export function editProjectGrant(policy, action, input, options) {
+  const saved = action === "revoke" ? [...policy.grants, ...policy.denies].find(other => equal(other.path, canonicalPolicyPath(input))) : null;
+  const entry = action === "revoke"
+    ? projectRevocationEntry(saved ?? scopeEntry(input, "project", options), options)
+    : scopeEntry(input, action === "allow-parent" ? "parent" : "project", options);
+  const same = (other) => equal(other.path, entry.path) ||
+    other.repository && entry.repository && equal(other.repository.path, entry.repository.path) ||
+    action === "allow-project" && other.worktrees?.some(root => equal(root.path, entry.path));
+  if (action === "revoke") {
+    policy.grants = policy.grants.filter((other) => !same(other));
+    policy.denies = [...policy.denies.filter((other) => !same(other)), entry];
+  } else if (["allow-project", "allow-parent"].includes(action)) {
+    // Authorizing a parent never clears its children's explicit revocations.
+    policy.denies = policy.denies.filter((other) => !same(other));
+    policy.grants = [...policy.grants.filter((other) => !same(other)), entry];
+  } else throw new Error(`Unknown authorization action: ${action}`);
+}

package/src/project-scope.mjs

@@ -15,9 +15,28 @@ function samePath(left, right) {
 }
 
 function metadata(file) {
-  const stat = fs.statSync(file);
-  if (!stat.isFile() || stat.size > 4096) throw new Error("Invalid project repository metadata");
-  return fs.readFileSync(file, "utf8").trim();
+  const entry = fs.lstatSync(file);
+  if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 4096) throw new Error("Invalid project repository metadata");
+  const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  try {
+    const before = fs.fstatSync(descriptor);
+    const fields = ["dev", "ino", "size", "mtimeMs", "ctimeMs"];
+    const matches = (left, right) => fields.every((field) => left[field] === right[field]);
+    if (!before.isFile() || !matches(entry, before)) throw new Error("Project repository metadata changed during access");
+    const data = Buffer.alloc(before.size);
+    let offset = 0;
+    while (offset < data.length) {
+      const count = fs.readSync(descriptor, data, offset, data.length - offset, offset);
+      if (!count) throw new Error("Project repository metadata changed during access");
+      offset += count;
+    }
+    const after = fs.fstatSync(descriptor);
+    const current = fs.lstatSync(file);
+    if (!current.isFile() || current.isSymbolicLink() || !matches(before, after) || !matches(after, current)) throw new Error("Project repository metadata changed during access");
+    return data.toString("utf8").trim();
+  } finally {
+    fs.closeSync(descriptor);
+  }
 }
 
 function exists(file) {
@@ -40,12 +59,21 @@ function repository(cwd) {
     if (samePath(root, path.parse(root).root) || samePath(root, home)) return null;
     const marker = path.join(root, ".git");
     if (exists(marker)) {
-      if (fs.statSync(marker).isDirectory()) return gitRepository(directory(marker));
+      const entry = fs.lstatSync(marker);
+      if (entry.isSymbolicLink()) throw new Error("Project repository marker cannot be a symbolic link");
+      if (entry.isDirectory()) {
+        const gitdir = directory(marker);
+        if (!samePath(gitdir.path, marker)) throw new Error("Project repository marker changed during access");
+        return gitRepository(gitdir);
+      }
       const match = metadata(marker).match(/^gitdir: ([^\r\n]+)$/);
       if (!match) throw new Error("Invalid project gitdir metadata");
       const gitdir = directory(path.resolve(root, match[1]));
       const commonFile = path.join(gitdir.path, "commondir");
-      if (!exists(commonFile)) return gitRepository(gitdir);
+      if (!exists(commonFile)) {
+        const separate = gitRepository(gitdir);
+        return { ...separate, identity: `${separate.identity}:${root}` };
+      }
       const common = gitRepository(directory(path.resolve(gitdir.path, metadata(commonFile))));
       const registered = path.relative(path.join(common.path, "worktrees"), gitdir.path);
       if (!registered || registered === ".." || registered.startsWith(`..${path.sep}`) || path.isAbsolute(registered) || registered.includes(path.sep)) throw new Error("Project worktree is not registered in its common repository");

package/src/prompt-guidance.mjs

@@ -16,6 +16,8 @@ export const PROMPT_SECTIONS = Object.freeze([
 ]);
 
 export const AGENT_PROMPT_GUIDANCE =
+  "Honor the user's existing, explicitly authorized collaboration workflow: routine handoffs and result reports within that workflow do not require a new user message for every exchange. " +
+  "Installation, a project grant, or a peer's claim alone is not user authorization. Keep the real sender visible; do not impersonate the user. Host permission denials still require proper resolution, never a different channel or alias. " +
   "Write every prompt you compose for another agent in English, in this order, omitting sections that do not apply: " +
   "a first line naming the sender, project and purpose, e.g. [From Claude Code · <project> · <purpose>]; " +
   "## Goal, the outcome in one sentence; ## Context, measured facts, paths with line numbers and existing code to reuse; " +

package/src/release-snapshot.mjs

@@ -35,7 +35,17 @@ function digestMetadata(cache) {
       descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
       const opened = fs.fstatSync(descriptor, { bigint: true });
       if (!opened.isFile() || opened.nlink !== 1n || !matches(signature(info), signature(opened))) return new Map();
-      const metadata = JSON.parse(fs.readFileSync(descriptor, "utf8"));
+      const data = Buffer.alloc(Number(opened.size));
+      let offset = 0;
+      while (offset < data.length) {
+        const count = fs.readSync(descriptor, data, offset, data.length - offset, offset);
+        if (!count) return new Map();
+        offset += count;
+      }
+      const after = fs.fstatSync(descriptor, { bigint: true });
+      const current = fs.lstatSync(file, { bigint: true });
+      if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1n || !matches(signature(opened), signature(after)) || !matches(signature(after), signature(current))) return new Map();
+      const metadata = JSON.parse(data.toString("utf8"));
       if (metadata?.schema !== 1 || metadata.directory !== directory || !metadata.files || typeof metadata.files !== "object" || Array.isArray(metadata.files)) return new Map();
       const entries = Object.entries(metadata.files);
       if (entries.some(([file, record]) => !safeRelativePath(file) || !record || typeof record !== "object" || Array.isArray(record)
@@ -64,10 +74,25 @@ function digestMetadata(cache) {
         let record = previous.get(file);
         if (!matches(record, current)) {
           dirty.add(directory);
-          const contentHash = createHash("sha256").update(fs.readFileSync(fullPath)).digest("hex");
-          const after = fs.statSync(fullPath, { bigint: true });
-          if (!after.isFile() || !matches(current, signature(after))) throw new Error("A release file changed during integrity verification");
-          record = { ...current, hash: contentHash };
+          const canonical = fs.realpathSync.native(fullPath);
+          const descriptor = fs.openSync(canonical, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+          try {
+            const opened = fs.fstatSync(descriptor, { bigint: true });
+            if (!opened.isFile() || !matches(current, signature(opened))) throw new Error("A release file changed during integrity verification");
+            const content = createHash("sha256");
+            const buffer = Buffer.alloc(64 * 1024);
+            let remaining = opened.size;
+            while (remaining > 0n) {
+              const count = fs.readSync(descriptor, buffer, 0, Number(remaining > BigInt(buffer.length) ? BigInt(buffer.length) : remaining), null);
+              if (!count) throw new Error("A release file changed during integrity verification");
+              content.update(buffer.subarray(0, count));
+              remaining -= BigInt(count);
+            }
+            const after = fs.fstatSync(descriptor, { bigint: true });
+            const resolved = fs.statSync(fullPath, { bigint: true });
+            if (!resolved.isFile() || fs.realpathSync.native(fullPath) !== canonical || !matches(current, signature(after)) || !matches(current, signature(resolved))) throw new Error("A release file changed during integrity verification");
+            record = { ...current, hash: content.digest("hex") };
+          } finally { fs.closeSync(descriptor); }
         }
         records.set(file, record);
         hash.update(file).update("\0").update(record.hash).update("\0");

package/src/rollout-reader.mjs

@@ -0,0 +1,59 @@
+import fs from "node:fs";
+
+const CHUNK_BYTES = 256 * 1024;
+const VERSION_FIELDS = ["size", "mtimeMs", "ctimeMs", "ino", "dev"];
+const sameVersion = (a, b) => VERSION_FIELDS.every((key) => a[key] === b[key]);
+
+// Scan the complete history, but retain at most one bounded JSONL record.
+// Skipping the middle of a rollout would miss duplicate identities or corruption.
+export function scanRollout(file, { maxRecordBytes, onRecord, onChunk = () => {} }) {
+  if (!Number.isSafeInteger(maxRecordBytes) || maxRecordBytes < 1) throw new Error("The rollout record read limit is invalid");
+  const named = fs.lstatSync(file);
+  if (!named.isFile() || named.isSymbolicLink()) throw new Error("The rollout is not a regular file");
+  const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
+  try {
+    const before = fs.fstatSync(descriptor);
+    if (!before.isFile()) throw new Error("The opened rollout is not a regular file");
+    if (!sameVersion(named, before)) throw new Error("The rollout changed while opening");
+    if (before.size === 0) throw new Error("The rollout is empty (0 bytes)");
+    let parts = [], length = 0, start = 0, position = 0;
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    while (position < before.size) {
+      const buffer = Buffer.allocUnsafe(Math.min(CHUNK_BYTES, before.size - position));
+      const count = fs.readSync(descriptor, buffer, 0, buffer.length, position);
+      if (!count) throw new Error("The rollout changed while reading");
+      const chunk = buffer.subarray(0, count);
+      onChunk(chunk, position);
+      let offset = 0;
+      while (offset < count) {
+        const newline = chunk.indexOf(0x0a, offset);
+        const end = newline < 0 ? count : newline;
+        length += end - offset;
+        if (length > maxRecordBytes) throw new Error(`The rollout record at byte ${start} exceeds the ${maxRecordBytes}-byte per-record read limit (file: ${before.size} bytes)`);
+        parts.push(chunk.subarray(offset, end));
+        if (newline < 0) break;
+        if (length) {
+          const record = JSON.parse(decoder.decode(parts.length === 1 ? parts[0] : Buffer.concat(parts, length)));
+          if (!record || typeof record !== "object" || Array.isArray(record) || !record.payload || typeof record.payload !== "object" || Array.isArray(record.payload)) {
+            throw new Error("The rollout contains an invalid record");
+          }
+          onRecord(record, start, position + newline + 1 - start);
+        }
+        parts = []; length = 0;
+        offset = newline + 1;
+        start = position + offset;
+      }
+      position += count;
+    }
+    if (start !== before.size) throw new Error("The rollout has an incomplete final record");
+    const after = fs.fstatSync(descriptor);
+    const current = fs.lstatSync(file);
+    if (!current.isFile() || current.isSymbolicLink() || !sameVersion(before, after) || !sameVersion(after, current)) {
+      throw new Error("The rollout changed while reading");
+    }
+    return { size: before.size, identity: { dev: before.dev, ino: before.ino },
+      version: Object.fromEntries(VERSION_FIELDS.map((key) => [key, before[key]])) };
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}

package/src/rollout-segments.mjs

@@ -0,0 +1,65 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+
+// Continuations retain session_meta.id but append a second UUID to the filename.
+// Filename/mtime ordering is not evidence of which turn is currently active.
+export function findRolloutSegments(sessions, threadId) {
+  if (!new RegExp(`^${UUID}$`).test(threadId)) throw new Error("The Codex task identity is invalid");
+  const root = fs.lstatSync(sessions);
+  if (!root.isDirectory() || root.isSymbolicLink()) throw new Error("The Codex sessions path is not a regular directory");
+  const canonical = fs.realpathSync.native(sessions);
+  const pattern = new RegExp(`^rollout-.+-${threadId}(?:_${UUID})?\\.jsonl$`);
+  const queue = [{ directory: canonical, depth: 0 }], matches = [];
+  let entries = 0, directories = 0;
+  while (queue.length) {
+    const { directory, depth } = queue.pop();
+    if (++directories > 4096) throw new Error("The bounded Codex sessions scan exceeded its directory limit");
+    const children = fs.readdirSync(directory, { withFileTypes: true });
+    entries += children.length;
+    if (entries > 100000) throw new Error("The bounded Codex sessions scan exceeded its entry limit");
+    for (const child of children) {
+      const candidate = path.join(directory, child.name);
+      if (depth < 3 && (depth === 0 ? /^\d{4}$/ : /^\d{2}$/).test(child.name)) {
+        if (child.isSymbolicLink()) throw new Error("The Codex sessions scan encountered a linked date directory");
+        if (child.isDirectory()) {
+          const resolved = fs.realpathSync.native(candidate);
+          const relative = path.relative(canonical, resolved);
+          if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("A Codex date directory escapes the sessions path");
+          queue.push({ directory: resolved, depth: depth + 1 });
+        }
+      }
+      if (depth === 3 && pattern.test(child.name)) {
+        if (!child.isFile() || child.isSymbolicLink()) throw new Error("The Codex rollout is not a regular file");
+        matches.push(candidate);
+        if (matches.length > 64) throw new Error("The Codex task exceeds the 64-segment discovery limit");
+      }
+    }
+  }
+  if (!matches.length) throw new Error("No rollout matches the calling Codex task");
+  return matches.sort();
+}
+
+// Only independently retrieved native metadata may be supplied here. Tool
+// arguments, process globals, and manual relay bindings are not ownership proof.
+export function confirmsDesktopTask(evidence, threadId, cwd, turnId) {
+  const thread = evidence?.thread;
+  if (thread?.id !== threadId || thread.kind !== "codex" || thread.hostId !== "local"
+      || typeof thread.cwd !== "string" || !path.isAbsolute(thread.cwd)
+      || (turnId !== undefined && evidence.latestTurnId !== turnId)) return false;
+  return !path.relative(fs.realpathSync.native(thread.cwd), fs.realpathSync.native(cwd));
+}
+
+export function isLegacyCliSession(session) {
+  return session?.originator === "codex-tui" && session.source === "cli";
+}
+
+export function assertRolloutSetStable(sessions, threadId, snapshots) {
+  const files = findRolloutSegments(sessions, threadId);
+  if (files.length !== snapshots.length || files.some((file, i) => file !== snapshots[i].file)) throw new Error("The rollout segment set changed while reading");
+  for (const { file, version } of snapshots) {
+    const current = fs.lstatSync(file);
+    if (!current.isFile() || current.isSymbolicLink() || Object.entries(version).some(([key, value]) => current[key] !== value)) throw new Error("A rollout segment changed while reading");
+  }
+}

package/src/security-policy.mjs

@@ -212,11 +212,13 @@ export class BridgeSecurityPolicy {
   }
 
   summary() {
+    const projectPolicy = this.hardenedRoots.mode === "project-policy" ? this.hardenedRoots.status() : null;
     return {
       authorizedThreads: this.allowedThreadIds.size + this.ownedThreadIds.size,
       allowAllThreads: this.allowAllThreads,
-      allowedRoots: this.allowAllRoots ? [ALLOW_ALL_ROOTS] : this.allowedRoots,
-      allowAllRoots: this.allowAllRoots,
+      allowedRoots: projectPolicy ? (projectPolicy.error ? [] : this.hardenedRoots.roots) : this.allowAllRoots ? [ALLOW_ALL_ROOTS] : this.allowedRoots,
+      allowAllRoots: projectPolicy ? false : this.allowAllRoots,
+      ...(projectPolicy ? { projectPolicy } : {}),
       threadPolicy: this.threadPolicy,
       approvalPolicy: this.approvalPolicy,
       sandbox: this.sandbox,

package/src/sites-connector.mjs

@@ -54,8 +54,23 @@ async function readPrivateJson(file, maxBytes = 2 * 1024 * 1024) {
   const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
   try {
     const current = await handle.stat();
-    if (!current.isFile() || current.nlink !== 1 || current.ino !== info.ino || current.dev !== info.dev || current.size > maxBytes) throw new Error("Private connector file changed during access");
-    return JSON.parse(await handle.readFile("utf8"));
+    const fields = ["dev", "ino", "size", "mtimeMs", "ctimeMs"];
+    const matches = (left, right) => fields.every((field) => left[field] === right[field]);
+    if (!current.isFile() || current.nlink !== 1 || current.size > maxBytes || !matches(info, current)) throw new Error("Private connector file changed during access");
+    const data = Buffer.alloc(current.size);
+    let offset = 0;
+    while (offset < data.length) {
+      const { bytesRead } = await handle.read(data, offset, data.length - offset, offset);
+      if (!bytesRead) throw new Error("Private connector file changed during access");
+      offset += bytesRead;
+    }
+    const after = await handle.stat();
+    const entry = await fs.lstat(file);
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1 || !matches(current, after) || !matches(after, entry)) throw new Error("Private connector file changed during access");
+    return JSON.parse(data.toString("utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") throw new Error("Private connector file changed during access", { cause: error });
+    throw error;
   } finally { await handle.close(); }
 }
 

package/src/telemetry.mjs

@@ -1,4 +1,4 @@
-import { mkdir, readFile, open, rename, unlink, stat } from 'node:fs/promises';
+import { mkdir, readFile, open, rename, unlink, lstat } from 'node:fs/promises';
 import path from 'node:path';
 import { homedir } from 'node:os';
 import { randomUUID } from 'node:crypto';
@@ -48,14 +48,16 @@ async function locked(directory, action) {
     lock = await open(filename, 'wx', 0o600);
   } catch (error) {
     if (error.code !== 'EEXIST') throw error;
-    const info = await stat(filename).catch(() => null);
-    if (info && Date.now() - info.mtimeMs > 60000) {
-      await unlink(filename).catch(() => {});
-      lock = await open(filename, 'wx', 0o600);
-    } else throw new Error('Telemetry settings are busy. Retry in a few seconds.');
+    throw new Error('Telemetry settings are busy. Locks never expire automatically; inspect active telemetry processes before repairing a leftover lock.');
+  }
+  let owned;
+  try { owned = await lock.stat(); return await action(); }
+  finally {
+    try {
+      const current = await lstat(filename).catch(error => { if (error.code !== 'ENOENT') throw error; return null; });
+      if (owned && current?.isFile() && !current.isSymbolicLink() && current.nlink === 1 && owned.dev === current.dev && owned.ino === current.ino && owned.birthtimeMs === current.birthtimeMs) await unlink(filename);
+    } finally { await lock.close(); }
   }
-  try { return await action(); }
-  finally { await lock.close(); await unlink(filename).catch(() => {}); }
 }
 
 function suppressed(env) {