@minhspark/codex-mcp-bridge 1.21.0 → 1.21.2

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-mcp-bridge",
-  "version": "1.21.0",
+  "version": "1.21.2",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh"

package/CHANGELOG.md

@@ -4,6 +4,36 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.21.2] - 2026-10-10
+
+### Added
+
+- Show an npm download trend in the repository README, with links to the interactive npmcharts view and GitHub dependents.
+- Publish a source-dated trend SVG from the existing hourly analytics history. Distinguish unavailable data from a reported zero and label stale sources at generation time.
+
+### Fixed
+
+- Preserve a telemetry lock replaced by another writer on Windows even when rapid file creation gives both locks the same reported file identity and birth time.
+
+### Upgrade notes
+
+- MCP behavior is unchanged. The repository analytics workflow publishes the new SVG after this release reaches `main`.
+
+## [1.21.1] - 2026-10-07
+
+### Fixed
+
+- Read project policies, onboarding settings, manager descriptors and automation configuration through bounded, verified file descriptors. Reject files replaced, linked, enlarged or modified during reads, and preserve verified bytes in backups.
+- Pin reply receipt directory identity and recheck receipt and signing-key metadata before and after descriptor reads. Reject nonregular rollout descriptors and open without blocking on POSIX pipes.
+- Encode Windows ACL target paths as data so Unicode quotation marks in directory names cannot alter the PowerShell command.
+- Reject linked and oversized installer configuration, restore configuration through exclusive temporary files, and validate whole-home project aliases before acquiring onboarding locks.
+- Update the MCP SDK to 1.32.1 for GHSA-6qxp-vccf-f47h.
+
+### Upgrade notes
+
+- Update to `@minhspark/codex-mcp-bridge@1.21.1` and reconnect existing MCP connections to load the fixes in running processes.
+- The 91 open findings reported for 1.21.0 have been resolved: nine closed after code changes and 82 were reviewed as false positives with individual evidence. Additional findings from the new scans were reviewed against their data-flow sources and file validation controls. The final main-branch scan reported zero open CodeQL alerts without disabling queries or excluding paths.
+
 ## [1.21.0] - 2026-10-06
 
 ### Added

package/README.md

@@ -16,6 +16,12 @@ Send prompts and replies between **Claude and Codex**, keeping each conversation
 
 https://github.com/user-attachments/assets/98b23989-826f-4d7d-9dcb-ad7dd2739095
 
+## Package activity
+
+[![npm download trend](https://raw.githubusercontent.com/buidangminh23/codex-mcp-bridge/analytics/stats-npm-downloads.svg)](https://www.npmcharts.com/compare/%40minhspark%2Fcodex-mcp-bridge?minimal=true)
+
+[Explore the interactive npmcharts trend](https://www.npmcharts.com/compare/%40minhspark%2Fcodex-mcp-bridge?minimal=true) · [View public GitHub dependents](https://github.com/buidangminh23/codex-mcp-bridge/network/dependents). The chart uses the repository's hourly npm analytics snapshots; npm downloads include updates and automation.
+
 ## Release notifications
 
 To receive new release notifications, open [this repository](https://github.com/buidangminh23/codex-mcp-bridge), select **Watch → Custom → Releases**, then click **Apply**. Choose GitHub or email delivery in your [notification settings](https://github.com/settings/notifications).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.21.0",
+  "version": "1.21.2",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",
@@ -79,7 +79,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "zod": "^3.25.76"
   }
 }

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "codex-mcp-bridge",
-  "version": "1.21.0",
+  "version": "1.21.2",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh",

package/scripts/bridge-projects.mjs

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import path from "node:path";
-import fs from "node:fs";
 import os from "node:os";
-import { createProjectScope, editProjectGrant, readProjectPolicy, updateProjectPolicy } from "../src/project-policy.mjs";
+import { createProjectScope, editProjectGrant, readProjectPolicy, updateProjectPolicy, readRegularConfigFile } from "../src/project-policy.mjs";
 import { exitForVersionRequest } from "../src/cli-version.mjs";
 import { inspectBridgeProject, prepareBridgeProject } from "../src/project-onboarding.mjs";
 import { registerProjectManager } from "../src/project-manager-registration.mjs";
@@ -19,9 +18,7 @@ try {
   if (action === "register-manager" || action === "register-card-settings") console.log(JSON.stringify(registerProjectManager({ policyFile: file }), null, 2));
   else if (action === "sync-card-settings") {
     if (!input || !path.isAbsolute(input)) throw new Error('An absolute settings snapshot file is required');
-    const stat = fs.lstatSync(input);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024) throw new Error('Invalid settings snapshot');
-    const snapshot = JSON.parse(fs.readFileSync(input, 'utf8'));
+    const snapshot = JSON.parse(readRegularConfigFile(input, { label: "Invalid settings snapshot" }));
     console.log(JSON.stringify(syncCardSettings(file, snapshot, { acknowledgeRender: snapshot.acknowledgeRender === true }), null, 2));
   }
   else if (["prepare", "inspect"].includes(action)) {

package/scripts/install-claude-code.mjs

@@ -5,7 +5,7 @@ import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { claudeDesktopConfigPath } from "../src/platform.mjs";
 import { checkCodeRegistration, planCodeRegistration } from "../src/claude-code-registration.mjs";
-import { readProjectPolicy } from "../src/project-policy.mjs";
+import { readProjectPolicy, readRegularConfigFile, backupRegularConfigFile } from "../src/project-policy.mjs";
 import { exitForVersionRequest } from "../src/cli-version.mjs";
 
 exitForVersionRequest(import.meta.url);
@@ -15,9 +15,11 @@ const option = (key, fallback) => { const index = args.indexOf(key); return inde
 const codeFile = option("--code-config", path.join(os.homedir(), ".claude.json"));
 const desktopFile = option("--desktop-config", claudeDesktopConfigPath());
 const policyFile = option("--policy", process.env.CODEX_BRIDGE_PROJECT_POLICY);
+const maxConfigBytes = 8 * 1024 * 1024;
+const read = (file) => readRegularConfigFile(file, { maxBytes: maxConfigBytes, missing: true });
 try {
   const files = [codeFile, desktopFile];
-  const originals = files.map((file) => fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null);
+  const originals = files.map(read);
   const [code, desktop] = originals.map((raw) => raw === null ? {} : JSON.parse(raw.replace(/^\uFEFF/, "")));
   if (args.includes("--check")) {
     const result = checkCodeRegistration({ code, desktop });
@@ -37,25 +39,36 @@ try {
       try {
         for (let index = 0; index < files.length; index++) {
           const file = files[index];
-          const now = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null;
+          const now = read(file);
           if (now !== originals[index]) throw new Error(`Configuration changed concurrently: ${file}`);
           if (now === null && index === 1 && !Object.keys(plan.desktop.mcpServers ?? {}).length) continue;
-          if (now !== null) fs.copyFileSync(file, `${file}.backup-${suffix}`, fs.constants.COPYFILE_EXCL);
+          if (now !== null) backupRegularConfigFile(file, `${file}.backup-${suffix}`, now, maxConfigBytes);
           fs.mkdirSync(path.dirname(file), { recursive: true });
           const temporary = `${file}.pending-${suffix}`;
           try {
             fs.writeFileSync(temporary, contents[index], { flag: "wx", mode: 0o600 });
+            if (read(file) !== now) throw new Error(`Configuration changed concurrently: ${file}`);
             fs.renameSync(temporary, file);
           } finally { fs.rmSync(temporary, { force: true }); }
           written.push(index);
         }
       } catch (error) {
-        for (const index of written) {
-          if (fs.readFileSync(files[index], "utf8") === contents[index]) {
-            if (originals[index] === null) fs.rmSync(files[index]);
-            else fs.writeFileSync(files[index], originals[index]);
-          }
+        const remaining = [];
+        for (const index of written.reverse()) {
+          const file = files[index];
+          const temporary = `${file}.rollback-${suffix}`;
+          try {
+            if (read(file) !== contents[index]) { remaining.push(file); continue; }
+            if (originals[index] === null) fs.unlinkSync(file);
+            else {
+              fs.writeFileSync(temporary, originals[index], { flag: "wx", mode: 0o600 });
+              if (read(file) !== contents[index]) { remaining.push(file); continue; }
+              fs.renameSync(temporary, file);
+            }
+          } catch { remaining.push(file); }
+          finally { fs.rmSync(temporary, { force: true }); }
         }
+        if (remaining.length) error.message += `; rollback requires review: ${remaining.join(", ")}`;
         throw error;
       }
       console.log("Reopen the original Code task and call codex_bridge_status with the intended project cwd. Update the configuration manager's matching entry to the same policy file. No new per-project MCP entry is needed.");

package/scripts/install-native-relay.mjs

@@ -23,7 +23,7 @@ import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-acce
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.21.0";
+const VERSION = "1.21.2";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/scripts/publish-repo-analytics.mjs

@@ -128,6 +128,23 @@ export function renderGithubViewsBadge(data, { now = Date.now() } = {}) {
   return `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="24" viewBox="0 0 ${width} 24" role="img" aria-label="${escapeXml(accessible)}"><title>${escapeXml(`${accessible}. ${detail}`)}</title><rect width="${width}" height="24" rx="4" fill="#555"/><path d="M${labelWidth} 0H${width - 4}Q${width} 0 ${width} 4V20Q${width} 24 ${width - 4} 24H${labelWidth}Z" fill="${color}"/><g fill="#fff" font-family="DejaVu Sans Mono,monospace" font-size="12" text-anchor="middle"><text x="${labelWidth / 2}" y="16">${escapeXml(label)}</text><text x="${labelWidth + messageWidth / 2}" y="16">${escapeXml(message)}</text></g></svg>\n`;
 }
 
+export function renderNpmDownloadsChart(data, { now = Date.now() } = {}) {
+  const snapshot = [...data.snapshots].sort((a, b) => String(b.collectedAt).localeCompare(String(a.collectedAt))).find(row => row.npm);
+  const collectedAt = snapshot?.sourceCollectedAt?.npm;
+  const rows = Object.entries(data.daily.npm || {}).filter(([day, row]) => date(day) && number(row?.downloads) != null).sort(([left], [right]) => left.localeCompare(right)).slice(-30);
+  const values = rows.map(([, row]) => row.downloads);
+  const maximum = Math.max(1, ...values);
+  const total = values.reduce((sum, value) => sum + value, 0);
+  const status = !date(collectedAt) ? 'Source unavailable' : now - Date.parse(collectedAt) > staleAfter ? 'Source stale at generation' : 'Source collected';
+  const summary = rows.length ? `${format(total)} downloads across ${rows.length} reported ${rows.length === 1 ? 'day' : 'days'} · ${rows[0][0]} to ${rows.at(-1)[0]} UTC` : 'No download history available';
+  const points = rows.map(([day, row], index) => ({ day, value: row.downloads, x: 76 + index * 680 / Math.max(1, rows.length - 1), y: 226 - row.downloads * 132 / maximum }));
+  const path = points.map((point, index) => `${index ? 'L' : 'M'}${point.x.toFixed(1)} ${point.y.toFixed(1)}`).join(' ');
+  const grid = [94, 160, 226].map(y => `<path d="M76 ${y}H756" stroke="#d8dee4" stroke-width="1"/>`).join('');
+  const axis = points.length ? `${grid}<text x="66" y="98" text-anchor="end" font-size="12" fill="#57606a">${escapeXml(format(maximum))}</text><text x="66" y="230" text-anchor="end" font-size="12" fill="#57606a">0</text><text x="76" y="250" font-size="12" fill="#57606a">${escapeXml(rows[0][0])}</text><text x="756" y="250" text-anchor="end" font-size="12" fill="#57606a">${escapeXml(rows.at(-1)[0])}</text>` : '';
+  const line = points.length ? `<path d="${path}" fill="none" stroke="#2f81f7" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/>${points.map(point => `<circle cx="${point.x.toFixed(1)}" cy="${point.y.toFixed(1)}" r="3" fill="#2f81f7"><title>${escapeXml(`${point.day}: ${format(point.value)} downloads`)}</title></circle>`).join('')}` : '<text x="416" y="167" text-anchor="middle" font-size="17" fill="#57606a">Download data unavailable</text>';
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="820" height="300" viewBox="0 0 820 300" role="img" aria-label="npm download trend"><title>npm download trend</title><desc>${escapeXml(`${summary}. ${status}: ${displayTime(collectedAt)}.`)}</desc><rect width="820" height="300" rx="12" fill="#ffffff"/><rect x="0.5" y="0.5" width="819" height="299" rx="11.5" fill="none" stroke="#d8dee4"/><g font-family="Arial, sans-serif"><text x="32" y="38" font-size="21" font-weight="bold" fill="#24292f">npm download trend</text><text x="32" y="65" font-size="14" fill="#57606a">${escapeXml(summary)}</text>${axis}${line}<text x="32" y="280" font-size="12" fill="${status === 'Source collected' ? '#57606a' : '#9a6700'}">${escapeXml(`npm API · ${status} · ${displayTime(collectedAt)}`)}</text></g></svg>\n`;
+}
+
 export function renderLiveDashboard(data) {
   const latest = source => [...data.snapshots].sort((a, b) => String(b.collectedAt).localeCompare(String(a.collectedAt))).find(row => row[source]);
   const npm = latest('npm');
@@ -216,9 +233,9 @@ export function publicFiles(history, usage) {
   const usageDays = Object.fromEntries((data.usage?.daily || []).map(row => [row.day, row.installations]));
   const days = [...new Set([...Object.keys(data.daily.views), ...Object.keys(data.daily.clones), ...Object.keys(data.daily.npm), ...Object.keys(usageDays)])].sort().reverse();
   const table = ['| Date (UTC) | Views | Unique visitors | Clones | Unique cloners | npm downloads | Active installations |', '|---|---:|---:|---:|---:|---:|---:|', ...days.map(day => `| ${day} | ${[data.daily.views[day]?.count, data.daily.views[day]?.uniques, data.daily.clones[day]?.count, data.daily.clones[day]?.uniques, data.daily.npm[day]?.downloads, usageDays[day]].map(format).join(' | ')} |`)].join('\n');
-  const readme = `# Public repository analytics\n\n![Repository dashboard](dashboard.svg)\n\n[Aggregate JSON history](data.json) · [Repository](https://github.com/${data.repo})\n\nAll dates and source windows use UTC. Source timestamps on the dashboard show when each metric was last available. Downloads and clones include automation and do not measure people. Unique visitors/cloners apply only to the source window; never sum daily unique counts across dates. Active installations cover consenting installations only, with distinct counts for each whole period. Operating system and version breakdowns cover 30 days; an installation may appear in multiple version groups after upgrading.\n\nThis branch contains only aggregate statistics. No installation identifiers, prompts, account details, credentials, private error messages, or local paths are published. Missing metrics mean unavailable, not zero.\n\n## Daily history\n\nEvery archived source day is listed below, newest first. Active installations count consenting installations that reported that UTC day.\n\n${table}\n`;
+  const readme = `# Public repository analytics\n\n![Repository dashboard](dashboard.svg)\n\n![npm download trend](stats-npm-downloads.svg)\n\n[Aggregate JSON history](data.json) · [Repository](https://github.com/${data.repo})\n\nAll dates and source windows use UTC. Source timestamps on the dashboard show when each metric was last available. Downloads and clones include automation and do not measure people. Unique visitors/cloners apply only to the source window; never sum daily unique counts across dates. Active installations cover consenting installations only, with distinct counts for each whole period. Operating system and version breakdowns cover 30 days; an installation may appear in multiple version groups after upgrading.\n\nThis branch contains only aggregate statistics. No installation identifiers, prompts, account details, credentials, private error messages, or local paths are published. Missing metrics mean unavailable, not zero.\n\n## Daily history\n\nEvery archived source day is listed below, newest first. Active installations count consenting installations that reported that UTC day.\n\n${table}\n`;
   const pagesUrl = `https://${data.repo.split('/')[0]}.github.io/${data.repo.split('/')[1]}/`;
-  return { 'stats-github-views.svg': renderGithubViewsBadge(data), 'dashboard.svg': renderPublicDashboard(data), 'README.md': readme.replace('![Repository dashboard]', `[Live dashboard · refreshes every 30 seconds](${pagesUrl})\n\n![Repository dashboard]`), 'data.json': `${JSON.stringify(data, null, 2)}\n`, 'index.html': renderLiveDashboard(data) };
+  return { 'stats-github-views.svg': renderGithubViewsBadge(data), 'stats-npm-downloads.svg': renderNpmDownloadsChart(data), 'dashboard.svg': renderPublicDashboard(data), 'README.md': readme.replace('![Repository dashboard]', `[Live dashboard · refreshes every 30 seconds](${pagesUrl})\n\n![Repository dashboard]`), 'data.json': `${JSON.stringify(data, null, 2)}\n`, 'index.html': renderLiveDashboard(data) };
 }
 
 export function githubEnvironment(token, env = process.env) {

package/src/claude-bridge.mjs

@@ -29,7 +29,7 @@ import { registerProjectOnboardingTools } from "./project-onboarding-tools.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.21.0";
+const VERSION = "1.21.2";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/desktop-reply-receipts.mjs

@@ -6,6 +6,7 @@ import { homeDir } from "./platform.mjs";
 
 const ID = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
 const LIMIT = 256 * 1024;
+const sameFile = (left, right) => ["dev", "ino", "size", "mode", "uid", "nlink", "mtimeMs", "ctimeMs"].every(field => left[field] === right[field]);
 
 function owner(context) {
   const { sessionId, taskId } = context?.caller ?? {};
@@ -19,16 +20,20 @@ function owner(context) {
 // These are observation bindings, never permission grants. Every continuation
 // still passes the normal live sender, account, workspace and rollout checks.
 export class DesktopReplyReceipts {
+  #boundary;
   constructor({ directory = path.join(process.env.CODEX_HOME ?? path.join(homeDir(), ".codex"), "bridge-reply-receipts") } = {}) {
     this.directory = path.resolve(directory);
   }
 
   file(id, create = false) {
-    if (!ID.test(id)) throw new Error("Invalid reply deliveryId");
+    if (typeof id !== "string" || !ID.test(id)) throw new Error("Invalid reply deliveryId");
     if (create) fs.mkdirSync(this.directory, { recursive: true, mode: 0o700 });
     const info = fs.lstatSync(this.directory);
     if (!info.isDirectory() || info.isSymbolicLink()) throw new Error("Unsafe reply receipt directory");
-    return path.join(this.directory, `${id}.json`);
+    const canonical = fs.realpathSync.native(this.directory);
+    if (this.#boundary && (this.#boundary.path !== canonical || this.#boundary.dev !== info.dev || this.#boundary.ino !== info.ino)) throw new Error("Reply receipt directory changed");
+    this.#boundary ??= { path: canonical, dev: info.dev, ino: info.ino };
+    return path.join(canonical, `${id}.json`);
   }
 
   create(delivered, context) {
@@ -51,10 +56,10 @@ export class DesktopReplyReceipts {
     const file = this.file(id);
     const before = fs.lstatSync(file);
     if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size > LIMIT) throw new Error("Unsafe reply receipt");
-    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
     try {
       const opened = fs.fstatSync(fd);
-      if (!opened.isFile() || opened.nlink !== 1 || opened.size > LIMIT || opened.ino !== before.ino || opened.dev !== before.dev) throw new Error("Reply receipt changed while opening");
+      if (!opened.isFile() || !sameFile(before, opened)) throw new Error("Reply receipt changed while opening");
       const buffer = Buffer.alloc(LIMIT + 1);
       let length = 0;
       for (;;) {
@@ -64,7 +69,8 @@ export class DesktopReplyReceipts {
         if (length > LIMIT) throw new Error("Reply receipt exceeds its read limit");
       }
       const after = fs.fstatSync(fd);
-      if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs || length !== opened.size) throw new Error("Reply receipt changed while reading");
+      const current = fs.lstatSync(this.file(id));
+      if (current.isSymbolicLink() || !sameFile(opened, after) || !sameFile(after, current) || length !== opened.size) throw new Error("Reply receipt changed while reading");
       const receipt = JSON.parse(buffer.subarray(0, length).toString("utf8"));
       const expected = owner(context);
       if (receipt.version !== 1 || receipt.deliveryId !== id || !receipt.owner ||

package/src/index.mjs

@@ -39,7 +39,7 @@ import { PROJECT_SETUP_TOOLS, registerProjectOnboardingTools } from "./project-o
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.21.0";
+const VERSION = "1.21.2";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 

package/src/message-automation.mjs

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-import { readProjectPolicy } from "./project-policy.mjs";
+import { readProjectPolicy, readRegularConfigFile, backupRegularConfigFile } from "./project-policy.mjs";
 
 export const MESSAGE_TOOLS = Object.freeze([
   "mcp__codex-bridge__send_to_codex_thread",
@@ -25,10 +25,7 @@ The user enabled automatic messaging with the installed bridge. This is standing
 }
 
 function read(file) {
-  if (!fs.existsSync(file)) return null;
-  const stat = fs.lstatSync(file);
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 2 * 1024 * 1024) throw new Error(`Refusing nonregular, linked or oversized configuration: ${file}`);
-  return fs.readFileSync(file, "utf8");
+  return readRegularConfigFile(file, { maxBytes: 2 * 1024 * 1024, missing: true });
 }
 const json = (raw) => raw === null ? {} : JSON.parse(raw.replace(/^\uFEFF/, ""));
 function matches(rule, tool) {
@@ -68,7 +65,7 @@ export function applyMessageAutomation(plan) {
       if (read(item.file) !== item.before) throw new Error(`Configuration changed concurrently: ${item.file}`);
       if (item.before === item.after) continue;
       fs.mkdirSync(path.dirname(item.file), { recursive: true });
-      if (item.before !== null) fs.copyFileSync(item.file, `${item.file}.backup-${suffix}`, fs.constants.COPYFILE_EXCL);
+      if (item.before !== null) backupRegularConfigFile(item.file, `${item.file}.backup-${suffix}`, item.before, 2 * 1024 * 1024);
       const temporary = `${item.file}.pending-${suffix}`;
       try {
         fs.writeFileSync(temporary, item.after, { flag: "wx", mode: 0o600 });
@@ -81,7 +78,13 @@ export function applyMessageAutomation(plan) {
     for (const item of changed.reverse()) {
       if (read(item.file) !== item.after) continue;
       if (item.before === null) fs.rmSync(item.file);
-      else fs.writeFileSync(item.file, item.before);
+      else {
+        const rollback = `${item.file}.rollback-${suffix}`;
+        try {
+          fs.writeFileSync(rollback, item.before, { flag: "wx", mode: 0o600 });
+          if (read(item.file) === item.after) fs.renameSync(rollback, item.file);
+        } finally { fs.rmSync(rollback, { force: true }); }
+      }
     }
     throw error;
   }

package/src/native-creation-receipts.mjs

@@ -4,6 +4,8 @@ import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from
 import { execFileSync } from "node:child_process";
 import { homeDir } from "./platform.mjs";
 
+const sameFile = (left, right) => ["dev", "ino", "size", "mode", "uid", "nlink", "mtimeMs", "ctimeMs"].every(field => left[field] === right[field]);
+
 export const creationIdValid = value => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/.test(value);
 export function creationRequestHash(args) {
   const canonical = value => Array.isArray(value) ? value.map(canonical) : value && typeof value === "object"
@@ -65,17 +67,18 @@ export class NativeCreationReceipts {
     if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size !== 32 ||
         process.platform !== "win32" && ((before.mode & 0o077) || before.uid !== process.getuid())) throw Error("Unsafe native creation signing key");
     if (process.platform === "win32" && !this.#keyBoundary) this.#assertWindowsPrivate(file, false);
-    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
     let key;
     try {
       const opened = fs.fstatSync(fd);
-      if (opened.dev !== before.dev || opened.ino !== before.ino) throw Error("Native creation signing key changed");
+      if (!opened.isFile() || !sameFile(before, opened)) throw Error("Native creation signing key changed");
       const bytes = Buffer.alloc(33);
       let count = 0, read;
       while (count < bytes.length && (read = fs.readSync(fd, bytes, count, bytes.length - count, count))) count += read;
       key = bytes.subarray(0, count);
       const after = fs.fstatSync(fd);
-      if (key.length !== 32 || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs) throw Error("Native creation signing key changed");
+      const current = fs.lstatSync(file);
+      if (key.length !== 32 || current.isSymbolicLink() || !sameFile(opened, after) || !sameFile(after, current)) throw Error("Native creation signing key changed");
     } finally { fs.closeSync(fd); }
     if (this.#keyBoundary && (this.#keyBoundary.dev !== before.dev || this.#keyBoundary.ino !== before.ino || !timingSafeEqual(this.#key, key))) throw Error("Native creation signing key changed");
     this.#keyBoundary ??= { dev: before.dev, ino: before.ino };
@@ -83,15 +86,15 @@ export class NativeCreationReceipts {
     return this.#key;
   }
   #protectWindowsPrivate(file, directory) {
-    const quoted = file.replaceAll("'", "''");
+    const encodedPath = Buffer.from(file, "utf8").toString("base64");
     const securityType = directory ? "DirectorySecurity" : "FileSecurity";
     const inheritance = directory ? "ContainerInherit,ObjectInherit" : "None";
-    const script = `$ErrorActionPreference='Stop';$s=[Security.Principal.WindowsIdentity]::GetCurrent().User;$a=New-Object Security.AccessControl.${securityType};$a.SetOwner($s);$a.SetAccessRuleProtection($true,$false);$r=New-Object Security.AccessControl.FileSystemAccessRule($s,'FullControl','${inheritance}','None','Allow');$a.AddAccessRule($r);Set-Acl -LiteralPath '${quoted}' -AclObject $a`;
+    const script = `$ErrorActionPreference='Stop';$s=[Security.Principal.WindowsIdentity]::GetCurrent().User;$a=New-Object Security.AccessControl.${securityType};$a.SetOwner($s);$a.SetAccessRuleProtection($true,$false);$r=New-Object Security.AccessControl.FileSystemAccessRule($s,'FullControl','${inheritance}','None','Allow');$a.AddAccessRule($r);Set-Acl -LiteralPath ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}'))) -AclObject $a`;
     this.#runWindowsAclScript(script);
   }
   #assertWindowsPrivate(file, directory) {
-    const quoted = file.replaceAll("'", "''");
-    const script = `$ErrorActionPreference='Stop';$a=Get-Acl -LiteralPath '${quoted}';$s=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value;if(${directory ? "$true" : "$false"} -and !$a.AreAccessRulesProtected){throw 'Unprotected native authority'};if($a.GetOwner([Security.Principal.SecurityIdentifier]).Value -ne $s){throw 'Unexpected native authority owner'};foreach($r in $a.Access){if($r.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -ne $s -or $r.AccessControlType -ne 'Allow'){throw 'Unexpected native authority access'}};if($a.Access.Count -ne 1){throw 'Ambiguous native authority access'}`;
+    const encodedPath = Buffer.from(file, "utf8").toString("base64");
+    const script = `$ErrorActionPreference='Stop';$a=Get-Acl -LiteralPath ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}')));$s=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value;if(${directory ? "$true" : "$false"} -and !$a.AreAccessRulesProtected){throw 'Unprotected native authority'};if($a.GetOwner([Security.Principal.SecurityIdentifier]).Value -ne $s){throw 'Unexpected native authority owner'};foreach($r in $a.Access){if($r.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -ne $s -or $r.AccessControlType -ne 'Allow'){throw 'Unexpected native authority access'}};if($a.Access.Count -ne 1){throw 'Ambiguous native authority access'}`;
     this.#runWindowsAclScript(script);
   }
   #runWindowsAclScript(script) {
@@ -122,14 +125,15 @@ export class NativeCreationReceipts {
       const before = fs.lstatSync(file);
       receiptFound = true;
       if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size > 1024 * 1024) throw Error("Unsafe native creation receipt");
-      fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+      fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
       const opened = fs.fstatSync(fd);
-      if (opened.ino !== before.ino || opened.dev !== before.dev) throw Error("Native creation receipt changed");
+      if (!opened.isFile() || !sameFile(before, opened)) throw Error("Native creation receipt changed");
       const bytes = Buffer.alloc(1024 * 1024 + 1);
       let count = 0, n;
       while ((n = fs.readSync(fd, bytes, count, bytes.length - count, count))) { count += n; if (count > 1024 * 1024) throw Error("Oversized native creation receipt"); }
       const after = fs.fstatSync(fd);
-      if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs || count !== opened.size) throw Error("Native creation receipt changed");
+      const current = fs.lstatSync(this.file(id));
+      if (current.isSymbolicLink() || !sameFile(opened, after) || !sameFile(after, current) || count !== opened.size) throw Error("Native creation receipt changed");
       const row = JSON.parse(bytes.subarray(0, count).toString());
       if (row.version !== 1 || row.id !== id || row.hash !== hash || creationRequestHash(row.args) !== hash ||
           !accounts || ["claude", "codex"].some(k => !accounts[k] || row.accounts?.[k] !== accounts[k]) ||

package/src/native-relay-companion.mjs

@@ -36,7 +36,7 @@ import { NativeCreationReceipts, creationIdValid } from "./native-creation-recei
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.21.0";
+const VERSION = "1.21.2";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent) {

package/src/project-manager-registration.mjs

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
+import { readRegularConfigFile, backupRegularConfigFile } from "./project-policy.mjs";
 
 // Optional UI adapter discovery. Neither bridge startup nor policy evaluation reads
 // this file. Removing the card extension or this descriptor cannot stop messaging.
@@ -16,18 +17,14 @@ export function registerProjectManager({ policyFile, env = process.env, executab
   if (!Object.values(value).filter(v => typeof v === "string").every(v => path.isAbsolute(v))) throw new Error("Manager paths must be absolute");
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const next = JSON.stringify(value, null, 2) + "\n";
-  let before = null;
-  if (fs.existsSync(file)) {
-    const stat = fs.lstatSync(file);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 16384) throw new Error("Invalid manager descriptor");
-    before = fs.readFileSync(file, "utf8");
-  }
+  const read = () => readRegularConfigFile(file, { maxBytes: 16384, missing: true, label: "Invalid manager descriptor" });
+  const before = read();
   if (next === before) return { file, changed: false };
   const temp = file + ".pending-" + randomUUID();
   try {
     fs.writeFileSync(temp, next, { flag: "wx", mode: 0o600 });
-    if ((fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null) !== before) throw new Error("Manager descriptor changed concurrently");
-    if (before !== null) fs.copyFileSync(file, file + ".backup-" + randomUUID(), fs.constants.COPYFILE_EXCL);
+    if (read() !== before) throw new Error("Manager descriptor changed concurrently");
+    if (before !== null) backupRegularConfigFile(file, file + ".backup-" + randomUUID(), before, 16384);
     fs.renameSync(temp, file);
   } finally { fs.rmSync(temp, { force: true }); }
   return { file, changed: true };

package/src/project-onboarding.mjs

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { randomUUID } from "node:crypto";
-import { directoryBinding, repositoryBinding, editProjectGrant, readProjectPolicy, createProjectScope } from "./project-policy.mjs";
+import { directoryBinding, repositoryBinding, editProjectGrant, readProjectPolicy, parseProjectPolicy, createProjectScope, readRegularConfigFile, backupRegularConfigFile } from "./project-policy.mjs";
 
 const MAX_CONFIG_BYTES = 8 * 1024 * 1024;
 const object = value => value && typeof value === "object" && !Array.isArray(value);
@@ -20,12 +20,7 @@ export function onboardingPaths(env = process.env) {
 }
 
 function read(file, maxBytes = MAX_CONFIG_BYTES) {
-  let stat;
-  try { stat = fs.lstatSync(file); } catch (e) { if (e.code === "ENOENT") return null; throw e; }
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > maxBytes) throw new Error(`Refusing linked, nonregular or oversized configuration: ${file}`);
-  const raw = fs.readFileSync(file, "utf8");
-  if (Buffer.byteLength(raw) > maxBytes) throw new Error(`Configuration exceeds size limit: ${file}`);
-  return raw;
+  return readRegularConfigFile(file, { maxBytes, missing: true });
 }
 function parse(raw) {
   const value = raw === null ? {} : JSON.parse(raw.replace(/^\uFEFF/, ""));
@@ -70,7 +65,7 @@ function load(cwd, options) {
   const config = parse(configRaw);
   const trust = trustEntry(config, project);
   const policyRaw = read(files.policyFile, 256 * 1024);
-  const policy = policyRaw === null ? { version: 1, grants: [], denies: [] } : readProjectPolicy(files.policyFile).policy;
+  const policy = policyRaw === null ? { version: 1, grants: [], denies: [] } : parseProjectPolicy(policyRaw).policy;
   const denials = denied(policy, project);
   const authorized = policyRaw !== null && createProjectScope(files.policyFile, options).allows(project.directory.path);
   return { files, project, configRaw, config, trust, policyRaw, policy, denials, authorized };
@@ -102,6 +97,7 @@ export function inspectBridgeProject({ cwd, taskCards = false }, options = {}) {
 // compare before replacement, and roll back only bytes this transaction still owns.
 export function prepareBridgeProject({ cwd, reauthorize = false, taskCards = false }, options = {}) {
   const files = onboardingPaths(options.env);
+  target(cwd, { ...options, home: files.home });
   const locks = [], changed = [], backups = [];
   const suffix = randomUUID();
   const pending = [];
@@ -131,7 +127,7 @@ export function prepareBridgeProject({ cwd, reauthorize = false, taskCards = fal
       if (read(item.file) !== item.before) throw new Error("Configuration changed concurrently; retry inspection before applying");
       if (item.before !== null) {
         const backup = `${item.file}.backup-${suffix}`;
-        fs.copyFileSync(item.file, backup, fs.constants.COPYFILE_EXCL);
+        backupRegularConfigFile(item.file, backup, item.before, MAX_CONFIG_BYTES);
         backups.push(backup);
       }
       item.temp = `${item.file}.pending-${suffix}`;

package/src/project-policy.mjs

@@ -10,6 +10,38 @@ const inside = (root, candidate) => {
 };
 const equal = (a, b) => path.relative(a, b) === "";
 
+export function readRegularConfigFile(file, { maxBytes = MAX_BYTES, missing = false, encoding = "utf8", label = "Configuration" } = {}) {
+  let entry;
+  try { entry = fs.lstatSync(file, { bigint: true }); }
+  catch (error) { if (missing && error.code === "ENOENT") return null; throw error; }
+  const valid = stat => stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1n && stat.size <= BigInt(maxBytes);
+  const matches = (left, right) => ["dev", "ino", "size", "mtimeNs", "ctimeNs", "nlink"].every(field => left[field] === right[field]);
+  if (!valid(entry)) throw new Error(`${label}: refusing linked or nonregular file, or exceeded size limit`);
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
+  try {
+    const before = fs.fstatSync(fd, { bigint: true });
+    if (!valid(before) || !matches(entry, before)) throw new Error(`${label} changed during access`);
+    const data = Buffer.alloc(Number(before.size) + 1);
+    let offset = 0;
+    while (offset < data.length) {
+      const count = fs.readSync(fd, data, offset, data.length - offset, offset);
+      if (!count) break;
+      offset += count;
+    }
+    const after = fs.fstatSync(fd, { bigint: true });
+    const current = fs.lstatSync(file, { bigint: true });
+    if (offset !== Number(before.size) || !valid(after) || !valid(current) || !matches(before, after) || !matches(after, current)) throw new Error(`${label} changed during access`);
+    const bytes = data.subarray(0, offset);
+    return encoding === null ? bytes : bytes.toString(encoding);
+  } finally { fs.closeSync(fd); }
+}
+
+export function backupRegularConfigFile(file, backup, expected, maxBytes = MAX_BYTES) {
+  const bytes = readRegularConfigFile(file, { maxBytes, encoding: null });
+  if (bytes.toString("utf8") !== expected) throw new Error("Configuration changed concurrently before backup");
+  fs.writeFileSync(backup, bytes, { flag: "wx", mode: 0o600 });
+}
+
 export function directoryBinding(input) {
   if (typeof input !== "string" || !path.isAbsolute(input)) throw new Error("Project paths must be absolute directories");
   const resolved = fs.realpathSync.native(input);
@@ -59,10 +91,11 @@ function validateBinding(binding) {
 
 export function readProjectPolicy(file) {
   if (!path.isAbsolute(file)) throw new Error("CODEX_BRIDGE_PROJECT_POLICY must be an absolute file path");
-  const stat = fs.statSync(file);
-  if (!stat.isFile() || stat.size > MAX_BYTES) throw new Error("Project policy exceeds its file size limit");
-  const raw = fs.readFileSync(file, "utf8");
-  if (Buffer.byteLength(raw) > MAX_BYTES) throw new Error("Project policy exceeds its file size limit");
+  const raw = readRegularConfigFile(file, { label: "Project policy" });
+  return parseProjectPolicy(raw);
+}
+
+export function parseProjectPolicy(raw) {
   const policy = JSON.parse(raw);
   if (policy.version !== 1 || !Array.isArray(policy.grants) || !Array.isArray(policy.denies) || policy.grants.length + policy.denies.length > 512) throw new Error("Invalid project policy schema");
   for (const entry of [...policy.grants, ...policy.denies]) {
@@ -145,14 +178,16 @@ export function updateProjectPolicy(file, edit) {
   const handle = fs.openSync(lock, "wx", 0o600);
   const temporary = `${file}.pending-${randomUUID()}`;
   try {
-    const exists = fs.existsSync(file);
-    const policy = exists ? readProjectPolicy(file).policy : { version: 1, grants: [], denies: [] };
+    const original = readRegularConfigFile(file, { missing: true, label: "Project policy" });
+    const exists = original !== null;
+    const policy = exists ? parseProjectPolicy(original).policy : { version: 1, grants: [], denies: [] };
     const before = JSON.stringify(policy);
     edit(policy);
     if (exists && JSON.stringify(policy) === before) return policy;
     fs.writeFileSync(temporary, `${JSON.stringify(policy, null, 2)}\n`, { flag: "wx", mode: 0o600 });
     readProjectPolicy(temporary);
-    if (exists) fs.copyFileSync(file, `${file}.backup-${randomUUID()}`, fs.constants.COPYFILE_EXCL);
+    if (readRegularConfigFile(file, { missing: true }) !== original) throw new Error("Project policy changed concurrently");
+    if (exists) backupRegularConfigFile(file, `${file}.backup-${randomUUID()}`, original);
     fs.renameSync(temporary, file);
     return policy;
   } finally {

package/src/rollout-reader.mjs

@@ -10,9 +10,10 @@ export function scanRollout(file, { maxRecordBytes, onRecord, onChunk = () => {}
   if (!Number.isSafeInteger(maxRecordBytes) || maxRecordBytes < 1) throw new Error("The rollout record read limit is invalid");
   const named = fs.lstatSync(file);
   if (!named.isFile() || named.isSymbolicLink()) throw new Error("The rollout is not a regular file");
-  const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
   try {
     const before = fs.fstatSync(descriptor);
+    if (!before.isFile()) throw new Error("The opened rollout is not a regular file");
     if (!sameVersion(named, before)) throw new Error("The rollout changed while opening");
     if (before.size === 0) throw new Error("The rollout is empty (0 bytes)");
     let parts = [], length = 0, start = 0, position = 0;

package/src/telemetry.mjs

@@ -51,11 +51,12 @@ async function locked(directory, action) {
     throw new Error('Telemetry settings are busy. Locks never expire automatically; inspect active telemetry processes before repairing a leftover lock.');
   }
   let owned;
-  try { owned = await lock.stat(); return await action(); }
+  const token = randomUUID();
+  try { await lock.writeFile(token); owned = await lock.stat({ bigint: true }); return await action(); }
   finally {
     try {
-      const current = await lstat(filename).catch(error => { if (error.code !== 'ENOENT') throw error; return null; });
-      if (owned && current?.isFile() && !current.isSymbolicLink() && current.nlink === 1 && owned.dev === current.dev && owned.ino === current.ino && owned.birthtimeMs === current.birthtimeMs) await unlink(filename);
+      const current = await lstat(filename, { bigint: true }).catch(error => { if (error.code !== 'ENOENT') throw error; return null; });
+      if (owned && current?.isFile() && !current.isSymbolicLink() && current.nlink === 1n && owned.dev === current.dev && owned.ino === current.ino && owned.birthtimeNs === current.birthtimeNs && owned.ctimeNs === current.ctimeNs && owned.size === current.size) await unlink(filename);
     } finally { await lock.close(); }
   }
 }