@minhspark/codex-mcp-bridge 1.22.4 → 1.22.6

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-mcp-bridge",
-  "version": "1.22.4",
+  "version": "1.22.6",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh"

package/CHANGELOG.md

@@ -4,6 +4,50 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.22.6] - 2026-10-20
+
+### Fixed
+
+- Keep a confirmed Desktop creation identifiable when post-creation verification fails. `delegate_to_codex` and `start_codex_thread` now return the task's threadId, its deliveryId and "Task was accepted; do not resend" instead of a bare allowed-roots error that read as if nothing had been created. The confirmed threadId is kept even when a later account, receipt or scope check fails after the bridge waited for the task's workspace.
+- Treat a filesystem root that Codex Desktop briefly reports as a newly created task's workspace, observed as `/` right after creation following an account switch, as "workspace not yet assigned" when it is not the expected project. Creation keeps observing until its deadline and then returns a pending receipt that keeps the accepted threadId; reply observation keeps polling. The tolerance lasts at most 120 seconds from creation, or from the first such report during reply observation, and the bridge acts on nothing at that path and grants no task access from it during that time.
+- Report a pending creation whose task Desktop already confirmed as `deliveryStatus: accepted` instead of `unconfirmed`.
+
+### Security
+
+- A root report that outlasts the grace period, any other workspace outside the allowed roots, a different project, an account change or a sender mismatch still fails closed. Sends and plain thread inspection keep the normal allowed-roots refusal for a root workspace; nothing is sent.
+
+### Verification
+
+- 10 regression tests reproduce the defect on v1.22.5 and pass with the fix: creation confirmation with a brief `/` report, a pending result at the deadline, grace expiry, an outside-root workspace, a later account change, reply observation in both the wait and snapshot paths, and two MCP-level `delegate_to_codex` tests through the relay companion.
+- The full CI matrix passed on Windows, macOS and Linux with Node 22 and 24. A local run outside the sandbox passed 1406 tests with 0 failures.
+- An independent adversarial review found no security regression; its four confirmed correctness findings were fixed before merge.
+
+### Upgrade notes
+
+- Reconnect the MCP server after updating and confirm the loaded version from the actual runtime before relying on the fix.
+- A creation that is pending because Desktop has not reported its workspace continues with `wait_codex_reply` and the returned deliveryId. Do not resend the prompt or create the task again.
+- Not yet exercised against a live Desktop account switch. A placeholder workspace other than a filesystem root still fails closed as before.
+
+## [1.22.5] - 2026-10-19
+
+### Fixed
+
+- Persist confirmed Desktop send acceptance in the original owner-bound receipt so a later wait or MCP restart does not revert it to unconfirmed.
+- Resolve exact peer dispatches from their original rollout watermark, including messages injected into an active Codex turn and completed replies followed by newer turns. Preserve sender, account, project and response-integrity checks, mark same-turn finals and retain exact empty memory-citation formatting.
+- Include the advertised peer name in Claude's supported message envelope so the native recipient can identify the sender instead of showing an unnamed session. Codex Desktop's fixed sender badge remains controlled by the host; author headers identify the actual collaborator without impersonating user input.
+- Follow verified native Claude compaction continuations when correlating an outstanding peer reply, while retaining interruption and identity checks.
+- Return an unavailable reply at the observation deadline without losing accepted delivery state; continue rejecting identity and permission failures even when they occur after that deadline.
+
+### Verification
+
+- The receipt fixes passed the full CI matrix on Windows, macOS and Linux with Node 22 and 24, including restart, compaction and deadline-boundary regressions.
+- Live Desktop peer exchanges confirmed both directions, durable acceptance and recovery of a historical final response. Project authorization remained unchanged.
+
+### Upgrade notes
+
+- A worker with an unresolved peer receipt can defer automatic reload. Verify the loaded version from the actual MCP after reconnecting; retain the original receipt and inspect the existing conversation before any follow-up.
+- Native sender labels remain host-controlled. Claude can display the advertised peer name; Codex retains its native cross-chat label alongside the actual author header. This release does not add Cowork or Dispatch connectivity.
+
 ## [1.22.4] - 2026-10-19
 
 ### Fixed

package/docs/daily-handoffs.md

@@ -45,6 +45,14 @@ message and does not establish a native sender label. If a handoff requires the
 recipient's peer sender attribution, use `send_to_claude_session` with a verified
 live task. Do not substitute composer submission or a text header for that route.
 
+Peer messages include the bridge's advertised name through Claude's supported
+`from-name` envelope field. Claude determines the native wording and verifies
+the peer; the bridge does not set trusted-origin flags. Codex Desktop currently
+uses its own fixed `Sent by ... from another chat` label and exposes no sender-name
+override. Keep the actual `[From Claude ...]` or `[From Codex ...]` author header
+in the message. A body header does not rename a native badge, and applications'
+private data must not be patched to make that claim.
+
 If a link was already opened, retain its requestId and inspect its receipt.
 `promptSubmitted=false` with `submissionStatus=not_observed` means submission
 was not verified, not that nothing was delivered. A wrong-directory task can
@@ -68,6 +76,12 @@ new task, account, process, prompt and directory to match.
    deliveryId. For Codex-to-Claude, retain the original msgId and inspect its
    receipt. An unconfirmed acknowledgement is not proof of delivery; observe
    the original receipt instead of resending an uncertain task.
+   Confirmed native acceptance is retained across reconnects. A message injected
+   into an active Codex turn can return that turn's final answer with
+   `responseScope: same_turn_final`; it may cover other peer messages in that
+   turn. The exact dispatch must occur after the saved watermark, and commentary
+   alone is never a final reply. Receipt observation resolves that exact dispatch
+   even after newer turns start; it does not substitute the latest turn's answer.
 5. An `interrupted` receipt ends observation only: task outcome is unknown and
    background work may continue. Inspect the existing task before a scoped
    follow-up; do not repeat card creation or file operations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.22.4",
+  "version": "1.22.6",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "codex-mcp-bridge",
-  "version": "1.22.4",
+  "version": "1.22.6",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh",

package/scripts/install-native-relay.mjs

@@ -23,7 +23,7 @@ import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-acce
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.4";
+const VERSION = "1.22.6";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/src/claude-bridge.mjs

@@ -30,7 +30,7 @@ import { discoverClaudeProject } from "./claude-project-discovery.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.4";
+const VERSION = "1.22.6";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/codex-native-response.mjs

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import { scanRollout } from "./rollout-reader.mjs";
 import { findRolloutSegments, confirmsDesktopTask, isLegacyCliSession, assertRolloutSetStable } from "./rollout-segments.mjs";
 
@@ -81,20 +82,22 @@ function samePathBoundary(expected, current) {
       entry.path === current.ancestors[index].path && entry.dev === current.ancestors[index].dev && entry.ino === current.ancestors[index].ino);
 }
 
-function readStable(found, maxBytes, { threadId, turnId, afterOffset = 0, prefixSize } = {}) {
+function readStable(found, maxBytes, { threadId, turnId, afterOffset = 0, prefixSize, dispatchOutputs, dispatchAfterOffset = afterOffset } = {}) {
   for (let attempt = 0; ; attempt++) {
-    try { return readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefixSize }); }
+    try { return readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefixSize, dispatchOutputs, dispatchAfterOffset }); }
     catch (error) {
       if (attempt >= 2 || !/changed while (reading|opening)|incomplete final record/.test(error.message)) throw error;
     }
   }
 }
 
-function readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefixSize }) {
+function readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefixSize, dispatchOutputs, dispatchAfterOffset }) {
   const { file, sessions } = found;
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_ROLLOUT_BYTES) throw new Error("The Codex rollout read limit is invalid");
   const beforeBoundary = capturePathBoundary(file, sessions);
   const records = [];
+  const dispatches = [];
+  const otherTurnStarts = [];
   const digest = crypto.createHash("sha256");
   let session, latestContext, retainedBytes = 0, turnBeforeWatermark = false;
   const snapshot = scanRollout(file, {
@@ -111,6 +114,19 @@ function readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefix
       }
       if (record.type === "turn_context") latestContext = record.payload;
       const entry = { record, start };
+      if (start >= dispatchAfterOffset && dispatchOutputs && record.type === "response_item" && record.payload.type === "function_call_output" &&
+          record.payload.namespace === "codex_app" && record.payload.name === "send_message_to_thread" && dispatchOutputs.includes(record.payload.output)) {
+        const metadata = record.payload.internal_chat_message_metadata_passthrough;
+        const selectedTurnId = record.payload.turn_id ?? record.payload.root_turn_id ?? metadata?.turn_id ?? metadata?.root_turn_id;
+        if (!UUID.test(selectedTurnId) || !recordBelongsToTurn(entry, threadId, selectedTurnId)) throw new Error("The native dispatch has no consistent turn identity");
+        dispatches.push({ turnId: selectedTurnId, start });
+        if (dispatches.length > 1) throw new Error("Multiple post-send native dispatches match the reply receipt");
+      }
+      if (turnId && start >= afterOffset && (record.type === "turn_context" || record.type === "event_msg" && STARTED.has(record.payload.type)) &&
+          !recordBelongsToTurn(entry, threadId, turnId)) {
+        otherTurnStarts.push(start);
+        if (otherTurnStarts.length > 65536) throw new Error("The native turn boundary count exceeds its read limit");
+      }
       if (turnId && recordBelongsToTurn(entry, threadId, turnId)) {
         if (start < afterOffset) { turnBeforeWatermark = true; return; }
         retainedBytes += bytes;
@@ -123,7 +139,7 @@ function readStableOnce(found, maxBytes, { threadId, turnId, afterOffset, prefix
   if (!samePathBoundary(beforeBoundary, afterBoundary) || snapshot.identity.dev !== beforeBoundary.file.dev || snapshot.identity.ino !== beforeBoundary.file.ino) {
     throw new Error("The Codex rollout changed while reading");
   }
-  return { ...snapshot, file, sessions, records, retainedBytes, session, latestContext, turnBeforeWatermark, prefixSha256: digest.digest("hex") };
+  return { ...snapshot, file, sessions, records, dispatches, otherTurnStarts, retainedBytes, session, latestContext, turnBeforeWatermark, prefixSha256: digest.digest("hex") };
 }
 
 function canonicalDirectory(value, label) {
@@ -209,10 +225,11 @@ function completedMemoryCitation(item) {
       !Number.isSafeInteger(entry.lineStart) || entry.lineStart < 1 || !Number.isSafeInteger(entry.lineEnd) || entry.lineEnd < entry.lineStart) ||
       citation.rolloutIds.some((id) => typeof id !== "string" || !UUID.test(id))) return null;
   const entries = citation.entries.map((entry) => `${entry.path}:${entry.lineStart}-${entry.lineEnd}|note=[${entry.note}]`).join("\n");
-  return `<oai-mem-citation>\n<citation_entries>\n${entries}\n</citation_entries>\n<rollout_ids>\n${citation.rolloutIds.join("\n")}\n</rollout_ids>\n</oai-mem-citation>`;
+  const rolloutIds = citation.rolloutIds.join("\n");
+  return `<oai-mem-citation>\n<citation_entries>\n${entries ? `${entries}\n` : ""}</citation_entries>\n<rollout_ids>\n${rolloutIds ? `${rolloutIds}\n` : ""}</rollout_ids>\n</oai-mem-citation>`;
 }
 
-function inspectTurnRecords(records, threadId, turnId, cwd, { requireDispatch } = {}) {
+function inspectTurnRecords(records, threadId, turnId, cwd, { requireDispatch, otherTurnStarts = [] } = {}) {
   const turns = records.filter((entry) => recordBelongsToTurn(entry, threadId, turnId));
   const starts = turns.filter(({ record }) => record.type === "event_msg" && STARTED.has(record.payload.type));
   const contexts = turns.filter(({ record }) => record.type === "turn_context");
@@ -222,26 +239,39 @@ function inspectTurnRecords(records, threadId, turnId, cwd, { requireDispatch }
   const lifecycleError = (check, fields) => validationError("The native turn lifecycle is missing, ambiguous, failed, or out of order", check, fields);
   if (failures.length) throw lifecycleError("lifecycle_failure", { count: failures.length, eventBytes: recordOffsets(failures) });
   for (const [kind, entries] of [["start", starts], ["context", contexts], ["completion", completions]]) {
-    if (entries.length !== 1) throw lifecycleError(`lifecycle_${kind}_count`, { count: entries.length, recordBytes: recordOffsets(entries) });
+    if (entries.length !== 1 && (kind !== "context" || !entries.length)) throw lifecycleError(`lifecycle_${kind}_count`, { count: entries.length, recordBytes: recordOffsets(entries) });
+  }
+  if (contexts.some((entry) => !isDeepStrictEqual(entry.record.payload, contexts[0].record.payload))) {
+    throw lifecycleError("lifecycle_context_changed", { count: contexts.length, recordBytes: recordOffsets(contexts) });
   }
   if (canonicalDirectory(contexts[0].record.payload.cwd, "The observed turn workspace") !== cwd) {
     throw lifecycleError("lifecycle_workspace", { contextByte: contexts[0].start });
   }
-  if (starts[0].start >= contexts[0].start || contexts[0].start >= completions[0].start) {
+  if (contexts.some((entry) => starts[0].start >= entry.start || entry.start >= completions[0].start)) {
     throw lifecycleError("lifecycle_order", { startByte: starts[0].start, contextByte: contexts[0].start, completionByte: completions[0].start });
   }
 
   let dispatch = null;
   if (requireDispatch) {
     const dispatches = turns.filter(({ record }) => record.type === "response_item" && record.payload.type === "function_call_output" &&
-      record.payload.namespace === "codex_app" && record.payload.name === (requireDispatch.operation ?? "send_message_to_thread"));
-    if (dispatches.length !== 1 || !requireDispatch.outputs.includes(dispatches[0].record.payload.output) ||
+      record.payload.namespace === "codex_app" && record.payload.name === (requireDispatch.operation ?? "send_message_to_thread") &&
+      (!requireDispatch.existingTurn || requireDispatch.outputs.includes(record.payload.output)));
+    if (dispatches.length !== 1 || !requireDispatch.outputs.includes(dispatches[0].record.payload.output) || dispatches[0].start < (requireDispatch.afterOffset ?? 0) ||
+        (requireDispatch.existingTurn && contexts[0].start >= requireDispatch.afterOffset) ||
         contexts[0].start >= dispatches[0].start || dispatches[0].start >= completions[0].start) {
       throw validationError("The newly observed turn is not correlated to the exact native dispatch", "dispatch_correlation", {
         count: dispatches.length, dispatchBytes: recordOffsets(dispatches), contextByte: contexts[0].start, completionByte: completions[0].start,
       });
     }
     dispatch = dispatches[0];
+    if (otherTurnStarts.some((start) => start > dispatch.start && start < completions[0].start)) {
+      throw validationError("Another native turn superseded the dispatch before completion", "dispatch_superseded");
+    }
+    if (requireDispatch.existingTurn && turns.some(({ record, start }) => start > dispatch.start &&
+        (record.type === "response_item" && record.payload.type === "message" && record.payload.role === "user" ||
+         record.type === "event_msg" && record.payload.type === "user_message"))) {
+      throw validationError("New user input superseded the native dispatch in the active turn", "dispatch_superseded");
+    }
   }
 
   const allAssistantEntries = turns.filter(({ record }) => record.type === "response_item" && record.payload.type === "message" && record.payload.role === "assistant");
@@ -378,10 +408,52 @@ export function inspectCodexNativeTurn({ threadId, turnId, expectedCwd, desktopE
   }
 }
 
+export function resolveCodexNativeDispatchResponse(binding, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
+  const { threadId, expectedCwd, executorThreadId, prompt, watermark, desktopEvidence } = binding;
+  let turnId = null;
+  try {
+    if (!UUID.test(threadId) || !UUID.test(executorThreadId) || typeof prompt !== "string" || !prompt.length) throw new Error("The native dispatch identity is invalid");
+    if (!object(watermark) || watermark.status !== "available" || watermark.threadId !== threadId) throw new Error("No trusted pre-send rollout watermark is available");
+    const cwd = canonicalDirectory(expectedCwd, "The selected native task workspace");
+    if (watermark.cwd !== cwd) throw new Error("The selected native task workspace changed after dispatch");
+    const marks = watermark.segments ?? [watermark];
+    if (!Array.isArray(marks) || !marks.length || marks.length > 64 || new Set(marks.map((mark) => mark.file)).size !== marks.length ||
+        !marks.some((mark) => mark.file === watermark.file && mark.size === watermark.size && mark.prefixSha256 === watermark.prefixSha256) ||
+        marks.some((mark) => !Number.isSafeInteger(mark.size) || mark.size < 1)) throw new Error("The pre-send segment watermarks are invalid");
+    const found = findRollouts(threadId, env);
+    if (marks.some((mark) => !found.some(({ file }) => file === mark.file))) throw new Error("A pre-send rollout segment disappeared after dispatch");
+    const outputs = delegationOutputs(executorThreadId, prompt);
+    const snapshots = found.map((entry) => {
+      const mark = marks.find(({ file }) => file === entry.file);
+      const snapshot = readStable(entry, maxRolloutBytes, { threadId, afterOffset: mark?.size ?? 0, prefixSize: mark?.size, dispatchOutputs: outputs });
+      if (mark) {
+        if (snapshot.identity.dev !== mark.identity?.dev || snapshot.identity.ino !== mark.identity?.ino || snapshot.size < mark.size) throw new Error("The selected native task rollout identity changed after dispatch");
+        if (snapshot.prefixSha256 !== mark.prefixSha256) throw new Error("The pre-send Codex rollout history changed after dispatch");
+      }
+      validateIdentity(snapshot, threadId, cwd, desktopEvidence);
+      return snapshot;
+    });
+    assertRolloutSetStable(snapshots[0].sessions, threadId, snapshots);
+    const matches = snapshots.flatMap((snapshot) => snapshot.dispatches.map((dispatch) => ({ snapshot, dispatch })));
+    if (!matches.length) return { status: "pending", threadId, turnId: null, text: "", assistantItems: [], replySha256: null };
+    if (matches.length !== 1) throw new Error("Multiple post-send native dispatches match the reply receipt");
+    validateSession(matches[0].snapshot, threadId, cwd, desktopEvidence);
+    turnId = matches[0].dispatch.turnId;
+    const result = readCodexNativeTurnResponse({ ...binding, turnId }, { env, maxRolloutBytes });
+    if (result.status === "unavailable" && result.dispatchObserved && /check=lifecycle_completion_count; count=0;/.test(result.reason)) {
+      return { status: "pending", threadId, turnId, dispatchObserved: true, text: "", assistantItems: [], replySha256: null };
+    }
+    return result;
+  } catch (error) {
+    return { ...unavailable(error), threadId, turnId, source: "codex_desktop_rollout", assistantItems: [], text: "", replySha256: null };
+  }
+}
+
 export function readCodexNativeTurnResponse({ threadId, turnId, previousTurnId, expectedCwd, executorThreadId, prompt, watermark, desktopEvidence }, { env = process.env, maxRolloutBytes = MAX_ROLLOUT_BYTES } = {}) {
+  let dispatchObserved = false;
   try {
     if (!UUID.test(threadId) || !UUID.test(turnId) || !UUID.test(executorThreadId)) throw new Error("The native response identity is invalid");
-    if (turnId === previousTurnId) throw new Error("The observed turn was already present before dispatch");
+    const existingTurn = turnId === previousTurnId;
     if (typeof prompt !== "string" || !prompt.length) throw new Error("The exact dispatched prompt is unavailable");
     if (!object(watermark) || watermark.status !== "available" || watermark.threadId !== threadId) throw new Error("No trusted pre-send rollout watermark is available");
     const cwd = canonicalDirectory(expectedCwd, "The selected native task workspace");
@@ -393,10 +465,11 @@ export function readCodexNativeTurnResponse({ threadId, turnId, previousTurnId,
     for (const mark of marks) if (!Number.isSafeInteger(mark.size) || mark.size < 1) throw new Error("The pre-send rollout watermark size is invalid");
     const found = findRollouts(threadId, env);
     if (marks.some((mark) => !found.some(({ file }) => file === mark.file))) throw new Error("A pre-send rollout segment disappeared after dispatch");
+    const outputs = delegationOutputs(executorThreadId, prompt);
     let retainedBytes = 0;
     const snapshots = found.map((entry) => {
       const mark = marks.find(({ file }) => file === entry.file);
-      const snapshot = readStable(entry, maxRolloutBytes, { threadId, turnId, afterOffset: mark?.size ?? 0, prefixSize: mark?.size });
+      const snapshot = readStable(entry, maxRolloutBytes, { threadId, turnId, afterOffset: existingTurn ? 0 : mark?.size ?? 0, prefixSize: mark?.size, dispatchOutputs: outputs, dispatchAfterOffset: mark?.size ?? 0 });
       retainedBytes += snapshot.retainedBytes;
       if (retainedBytes > maxRolloutBytes) throw new Error("The native turn exceeds the retained-record limit across segments");
       if (mark) {
@@ -409,12 +482,20 @@ export function readCodexNativeTurnResponse({ threadId, turnId, previousTurnId,
     });
     assertRolloutSetStable(snapshots[0].sessions, threadId, snapshots);
     const selected = uniqueTurn(snapshots);
+    const matchedDispatches = snapshots.flatMap((snapshot) => snapshot.dispatches);
+    if (matchedDispatches.length !== 1 || matchedDispatches[0].turnId !== turnId) throw new Error("The observed turn is not uniquely correlated to the exact native dispatch");
     validateSession(selected, threadId, cwd, desktopEvidence);
+    const selectedMark = marks.find(({ file }) => file === selected.file);
+    if (existingTurn && !selectedMark) throw new Error("The active native turn has no pre-send rollout watermark");
+    dispatchObserved = selected.records.some(({ record, start }) => start >= (selectedMark?.size ?? 0) &&
+      record.type === "response_item" && record.payload.type === "function_call_output" &&
+      record.payload.namespace === "codex_app" && record.payload.name === "send_message_to_thread" && outputs.includes(record.payload.output));
     const inspected = inspectTurnRecords(selected.records, threadId, turnId, cwd, {
-      requireDispatch: { outputs: delegationOutputs(executorThreadId, prompt) },
+      requireDispatch: { outputs, afterOffset: selectedMark?.size ?? 0, existingTurn },
+      otherTurnStarts: selected.otherTurnStarts,
     });
-    return { ...inspected, observationStatus: inspected.status };
+    return { ...inspected, observationStatus: inspected.status, ...(existingTurn ? { responseScope: "same_turn_final" } : {}) };
   } catch (error) {
-    return { ...unavailable(error), threadId, turnId, source: "codex_desktop_rollout", assistantItems: [], text: "", replySha256: null };
+    return { ...unavailable(error), ...(dispatchObserved ? { dispatchObserved: true } : {}), threadId, turnId, source: "codex_desktop_rollout", assistantItems: [], text: "", replySha256: null };
   }
 }

package/src/desktop-reply-receipts.mjs

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { creationRequestHash, creationIdValid } from "./native-creation-receipts.mjs";
 import { homeDir } from "./platform.mjs";
 
@@ -52,6 +53,33 @@ export class DesktopReplyReceipts {
     return id;
   }
 
+  acknowledge(id, delivered, context) {
+    const previous = this.read(id, context);
+    const acknowledgement = JSON.parse(JSON.stringify(delivered));
+    if (acknowledgement.deliveryStatus !== "accepted" || previous.creationObservation ||
+        !["unconfirmed", "accepted"].includes(previous.deliveryStatus) ||
+        !isDeepStrictEqual({ ...acknowledgement, deliveryStatus: previous.deliveryStatus }, previous)) {
+      throw new Error("Delivery acknowledgement does not match the original reply binding");
+    }
+    if (previous.deliveryStatus === "accepted") return;
+    const file = this.file(id);
+    const bytes = Buffer.from(JSON.stringify({ version: 1, deliveryId: id, owner: owner(context), delivered: acknowledgement }));
+    if (bytes.length > LIMIT) throw new Error("Reply observation binding exceeds the receipt limit");
+    const temporary = `${file}.${randomUUID()}.pending`;
+    const fd = fs.openSync(temporary, "wx", 0o600);
+    try {
+      try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); }
+      finally { fs.closeSync(fd); }
+      if (!isDeepStrictEqual(this.read(id, context), previous) || this.file(id) !== file) {
+        throw new Error("Reply receipt changed before acknowledgement");
+      }
+      fs.renameSync(temporary, file);
+    } finally {
+      try { fs.unlinkSync(temporary); }
+      catch (error) { if (error.code !== "ENOENT") throw error; }
+    }
+  }
+
   read(id, context) {
     const file = this.file(id);
     const before = fs.lstatSync(file);

package/src/index.mjs

@@ -40,7 +40,7 @@ import { PROJECT_SETUP_TOOLS, registerProjectOnboardingTools } from "./project-o
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.4";
+const VERSION = "1.22.6";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
@@ -151,11 +151,12 @@ const failure = (err) => {
 
 function replyResult(delivered, deliveryId, result, notes = []) {
   result = { activity: [], errors: [], ...result };
+  const deliveryStatus = ["completed", "completed_no_reply"].includes(result.responseStatus) ? "accepted" : delivered.deliveryStatus ?? "accepted";
   const pending = result.status === "timeout";
   const continuation = deliveryId ? `deliveryId: ${deliveryId}\n${pending ? "Continue automatically with wait_codex_reply and this deliveryId; it only observes the original send. Do not resend the prompt." : "Keep this deliveryId to inspect the same send after reconnecting."}` : "";
   return {
-    ...textResult([...notes, formatTurn(result, { desktop: true }), continuation].filter(Boolean).join("\n"), result.status === "failed" || result.status === "systemError"),
-    structuredContent: { ...result, threadId: delivered.threadId, deliveryStatus: result.responseStatus === "completed" || result.responseStatus === "completed_no_reply" ? "accepted" : delivered.deliveryStatus ?? "accepted", ...(deliveryId ? { deliveryId } : {}), nextAction: pending && deliveryId ? "wait_codex_reply" : "none" },
+    ...textResult([...notes, `deliveryStatus: ${deliveryStatus}`, formatTurn(result, { desktop: true }), continuation].filter(Boolean).join("\n"), result.status === "failed" || result.status === "systemError"),
+    structuredContent: { ...result, threadId: delivered.threadId, deliveryStatus, ...(deliveryId ? { deliveryId } : {}), nextAction: pending && deliveryId ? "wait_codex_reply" : "none" },
   };
 }
 
@@ -210,6 +211,25 @@ function threadNameFor({ cwd, prompt, name }) {
   );
 }
 
+/**
+ * Once a Desktop creation was dispatched, a later verification failure must
+ * never read like a refusal: the caller keeps the task and receipt identity
+ * and is told not to resend. Verification still fails closed; only the report
+ * changes.
+ */
+function creationVerificationFailure({ created, deliveryId, requestId, err }) {
+  const threadId = created.threadId ?? err?.threadId ?? null;
+  const lines = threadId
+    ? ["Codex Desktop accepted the task, but post-creation verification failed.", `threadId: ${threadId}`]
+    : ["Codex Desktop creation was dispatched, but its outcome is not yet confirmed."];
+  lines.push(...(requestId ? [`requestId: ${requestId}`] : []), `cwd: ${created.cwd}`, ...(deliveryId ? [`deliveryId: ${deliveryId}`] : []), `error: ${err?.message ?? String(err)}`,
+    threadId ? "Task was accepted; do not resend. Resolve the verification error, then continue observing with wait_codex_reply and this deliveryId." : "Do not resend or create again. Continue observing with wait_codex_reply and this deliveryId.");
+  return {
+    ...textResult(lines.join("\n"), true),
+    structuredContent: { ...failure(err).structuredContent, threadId, deliveryStatus: threadId ? "accepted" : "unconfirmed", ...(deliveryId ? { deliveryId } : {}), nextAction: deliveryId ? "wait_codex_reply" : "none" },
+  };
+}
+
 async function delegateDesktopTask({ cwd, prompt, name, requestId, model, effort, timeoutSec, openInApp, waitForReply = true }) {
   const deadline = desktopOperation.getStore()?.deadline ?? Date.now() + Math.min((timeoutSec ?? 40) * 1000, DESKTOP_TOOL_BUDGET_MS);
   const workspace = resolveWorkspacePath(cwd);
@@ -221,8 +241,17 @@ async function delegateDesktopTask({ cwd, prompt, name, requestId, model, effort
   const deliveryId = created.deliveryId;
   let delivered = deliveryId ? replyReceipts.read(deliveryId, desktopOperation.getStore()) : null;
   if (delivered?.creationObservation) {
-    const resolved = await desktopTasks.resolveCreation(delivered, { deadline });
-    if (!resolved) return replyResult(delivered, deliveryId, { threadId: null, status: "timeout", responseStatus: "unavailable", text: "" }, ["Creation acknowledgement pending; do not create again."]);
+    let resolved;
+    try {
+      resolved = await desktopTasks.resolveCreation(delivered, { deadline });
+    } catch (err) {
+      return creationVerificationFailure({ created, deliveryId, requestId, err });
+    }
+    if (!resolved) {
+      const threadId = created.threadId ?? null;
+      return replyResult({ ...delivered, threadId, ...(threadId ? { deliveryStatus: "accepted" } : {}) }, deliveryId, { threadId, status: "timeout", responseStatus: "unavailable", text: "" },
+        [...(threadId ? [`threadId: ${threadId}`, "Task was accepted; Codex Desktop has not yet confirmed its workspace or creation receipt."] : []), "Creation acknowledgement pending; do not create again."]);
+    }
     delivered = resolved;
     created.threadId = resolved.threadId;
   }
@@ -625,6 +654,7 @@ registerTool(
             acceptedDelivery = prepared;
           } });
           acceptedDelivery = delivered;
+          if (delivered.deliveryStatus === "accepted") replyReceipts.acknowledge(deliveryId, delivered, desktopOperation.getStore());
           notes.push(delivered.deliveryStatus === "unconfirmed" ? "Desktop delivery acknowledgement timed out; delivery is unconfirmed. Continue observing this receipt; do not resend." : "sent through Codex Desktop; no external app-server writer", `cwd: ${delivered.cwd}`);
           if (delivered.deliveryStatus === "unconfirmed") return replyResult(delivered, deliveryId, { threadId, status: "timeout", responseStatus: "unavailable", text: "" }, notes);
           if (shouldOpen) {
@@ -694,7 +724,7 @@ registerTool(
         const held = shouldOpen && !shouldRelease && client.holdsThread(threadId) ? writerLockWarning(threadId) : "";
         return textResult(`${notes.length ? `${notes.join("\n")}\n` : ""}${body}${held}`, failed);
       } catch (err) {
-        if (acceptedDelivery?.deliveryStatus === "accepted") return textResult(`threadId: ${threadId}\nTask was accepted, but its reply receipt could not be prepared: ${err.message}. Inspect the existing task; do not resend.`, true);
+        if (acceptedDelivery?.deliveryStatus === "accepted") return textResult(`threadId: ${threadId}\ndeliveryId: ${deliveryId}\nTask was accepted, but its reply receipt could not be updated: ${err.message}. Inspect the existing task; do not resend.`, true);
         return failure(err);
       }
     }, {

package/src/native-relay-companion.mjs

@@ -38,7 +38,7 @@ import { NativeCreationReceipts, creationIdValid } from "./native-creation-recei
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.4";
+const VERSION = "1.22.6";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent, details) {

package/src/peer-protocol.mjs

@@ -38,9 +38,11 @@ const projectsDir = () => path.join(homeDir(), ".claude", "projects");
  * listens for peer messages on a local socket or Windows named pipe. Messages are newline-delimited
  * JSON; the wrapper element is what Claude renders in its chat surface.
  */
-export function buildFrame({ text, fromSocket, priority = "next", permissionMode }) {
+export function buildFrame({ text, fromSocket, fromName, priority = "next", permissionMode }) {
   const msgId = crypto.randomUUID();
   const from = `uds:${fromSocket.replace(/[^A-Za-z0-9:_/.\-]/gu, (character) => Array.from(Buffer.from(character), (byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""))}`;
+  const displayName = typeof fromName === "string" ? fromName.replace(/["<>\p{Cf}\p{Cc}\p{Cs}\p{Zl}\p{Zp}]/gu, "").trim() : "";
+  const name = displayName ? ` from-name="${displayName}"` : "";
   const mode = ["bypass", "prompting"].includes(permissionMode) ? ` from-mode="${permissionMode}"` : "";
   return {
     msgV: PEER_PROTOCOL_VERSION,
@@ -49,7 +51,7 @@ export function buildFrame({ text, fromSocket, priority = "next", permissionMode
     type: "user",
     message: {
       role: "user",
-      content: `<cross-session-message from="${from}"${mode}>\n${text}\n</cross-session-message>`,
+      content: `<cross-session-message from="${from}"${name}${mode}>\n${text}\n</cross-session-message>`,
     },
     priority,
     from,
@@ -413,6 +415,38 @@ function isImageToolCompanion(entry, entriesById) {
         && typeof tool.id === "string" && tool.id === part.tool_use_id));
 }
 
+function compactContinuation(entry, root, entriesById, sessionId, cwd) {
+  if (entry.type !== "system" || entry.subtype !== "compact_boundary" || entry.parentUuid !== null
+      || typeof entry.logicalParentUuid !== "string") return null;
+  const sameIdentity = (record) => record?.entrypoint === "claude-desktop"
+    && record.sessionId === sessionId && record.cwd === root.cwd;
+  if (!sameIdentity(root) || !sameIdentity(entry) || typeof root.cwd !== "string"
+      || path.resolve(root.cwd) !== path.resolve(cwd)) return null;
+  const segment = entry.compactMetadata?.preservedSegment;
+  const preserved = entry.compactMetadata?.preservedMessages;
+  const ids = preserved?.uuids;
+  if (!Array.isArray(ids) || !ids.length || ids.length > 65536
+      || ids.some((id) => typeof id !== "string" || !id) || new Set(ids).size !== ids.length
+      || !Array.isArray(preserved.allUuids) || preserved.allUuids.length !== ids.length
+      || ids.some((id, index) => preserved.allUuids[index] !== id)
+      || !ids.includes(root.uuid) || segment?.headUuid !== ids[0]
+      || segment.tailUuid !== ids.at(-1) || segment.tailUuid !== entry.logicalParentUuid
+      || typeof segment.anchorUuid !== "string" || preserved.anchorUuid !== segment.anchorUuid) return null;
+  if (ids.some((id, index) => !sameIdentity(entriesById.get(id))
+      || index > 0 && entriesById.get(id).parentUuid !== ids[index - 1])
+      || ids.includes(entriesById.get(ids[0]).parentUuid)) return null;
+  const summary = entriesById.get(segment.anchorUuid);
+  if (!sameIdentity(summary) || summary.type !== "user" || summary.message?.role !== "user"
+      || summary.isCompactSummary !== true || summary.isVisibleInTranscriptOnly !== true
+      || summary.turnOrigin !== "peer" || summary.origin != null || summary.promptSource != null) return null;
+  let ancestor = entriesById.get(summary.parentUuid);
+  for (let depth = 0; depth < 64 && ancestor?.type === "attachment"; depth++) {
+    if (!sameIdentity(ancestor)) return null;
+    ancestor = entriesById.get(ancestor.parentUuid);
+  }
+  return ancestor === entry ? summary.uuid : null;
+}
+
 // Interruption closes reply observation, not execution. Never attach a later
 // user turn's answer to the original request or claim its side effects stopped.
 export function readTranscriptOutcome(sessionId, cwd, msgId) {
@@ -445,6 +479,7 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
   const openLeaves = new Set();
   const passiveLeaves = new Set();
   const interruptions = [];
+  const compactSummaries = new Set();
   const interrupt = (entry, outstanding) => {
     if (typeof entry.uuid !== "string" || !entry.uuid.trim()) return;
     openLeaves.delete(entry.parentUuid);
@@ -452,7 +487,16 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
   };
   for (const entry of entries) {
     if (entry === root) { descendants.set(entry.uuid, new Map()); openLeaves.add(entry.uuid); continue; }
-    if (!descendants.has(entry.parentUuid)) continue;
+    let parentUuid = entry.parentUuid;
+    if (!ambiguous && !interruptions.length && descendants.has(entry.logicalParentUuid)
+        && openLeaves.has(entry.logicalParentUuid)) {
+      const summaryId = compactContinuation(entry, root, entriesById, sessionId, cwd);
+      if (summaryId) {
+        parentUuid = entry.logicalParentUuid;
+        compactSummaries.add(summaryId);
+      }
+    }
+    if (!descendants.has(parentUuid)) continue;
     if (entry.type === "attachment" && entry.attachment?.type === "queued_command") {
       // Only a native command record is a boundary. Its text is never used as
       // proof of authorization, cancellation, or successful task completion.
@@ -469,10 +513,10 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
     }
     const role = entry.message?.role;
     const content = entry.message?.content;
-    const outstanding = new Map(descendants.get(entry.parentUuid));
+    const outstanding = new Map(descendants.get(parentUuid));
     const toolResults = Array.isArray(content) && content.length > 0 && content.every((part) => part?.type === "tool_result");
     const imageCompanion = isImageToolCompanion(entry, entriesById);
-    if (role === "user" && !toolResults && !imageCompanion) {
+    if (role === "user" && !toolResults && !imageCompanion && !compactSummaries.has(entry.uuid)) {
       const notificationText = typeof content === "string" ? content
         : Array.isArray(content) ? content.filter((part) => typeof part?.text === "string").map((part) => part.text).join("\n") : "";
       const nativeHuman = entry.origin?.kind === "human" && entry.promptSource === "sdk" && entry.turnOrigin === "human";
@@ -524,7 +568,7 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
       && ["hook_success", "total_tokens_reminder", "deferred_tools_record"].includes(entry.attachment?.type)) {
       passiveLeaves.add(entry.uuid);
     }
-    openLeaves.delete(entry.parentUuid);
+    openLeaves.delete(parentUuid);
     openLeaves.add(entry.uuid);
     if (role !== "assistant" || !["end_turn", "stop_sequence"].includes(entry.message.stop_reason)) continue;
     if (outstanding.size > 0) continue;
@@ -858,7 +902,7 @@ export class PeerEndpoint {
 
   async send(targetSocket, text, { priority = "next", msgId, permissionMode = this.permissionMode, beforeSend } = {}) {
     if (this.reloadPaused) throw new Error("The peer endpoint is quiesced; no message was sent");
-    const frame = buildFrame({ text, fromSocket: this.socketPath, priority, permissionMode });
+    const frame = buildFrame({ text, fromSocket: this.socketPath, fromName: this.name, priority, permissionMode });
     if (msgId) frame.uuid = frame.msg_id = msgId;
     const token = readPeerToken(targetSocket);
     const line = (token ? JSON.stringify({ type: "auth", token }) + "\n" : "") + JSON.stringify(frame) + "\n";

package/src/thread-delivery.mjs

@@ -5,7 +5,7 @@ import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { creationRequestHash } from "./native-creation-receipts.mjs";
 import { DesktopTaskReceipts } from "./desktop-task-receipts.mjs";
-import { captureCodexRolloutWatermark, inspectCodexNativeTurn, readCodexNativeTurnResponse, readCodexNativeCreationResponse } from "./codex-native-response.mjs";
+import { captureCodexRolloutWatermark, inspectCodexNativeTurn, readCodexNativeTurnResponse, readCodexNativeCreationResponse, resolveCodexNativeDispatchResponse } from "./codex-native-response.mjs";
 import { captureProjectScope, recheckProjectScope } from "./project-scope.mjs";
 import { requireClaudeSenderContext } from "./claude-sender-context.mjs";
 
@@ -26,6 +26,8 @@ import { requireClaudeSenderContext } from "./claude-sender-context.mjs";
 export const NATIVE_BACKEND = "codex-desktop-native";
 export const APP_SERVER_BACKEND = "app-server";
 export const DESKTOP_TOOL_BUDGET_MS = 40000;
+export const WORKSPACE_UNASSIGNED = "DESKTOP_WORKSPACE_UNASSIGNED";
+export const UNASSIGNED_WORKSPACE_GRACE_MS = 120000;
 const RELEASE_STATUSES = new Set(["completed", "interrupted", "failed"]);
 const METADATA_READ_OPTIONS = { includeOutputs: false, maxOutputCharsPerItem: 1 };
 
@@ -35,6 +37,17 @@ function unavailableWaitRenderer(error) {
     /^(Codex app tool request failed\.?|The app tool call ended before producing a result\.?)$/.test(cause.message);
 }
 
+function isFilesystemRoot(value) {
+  if (typeof value !== "string" || !path.isAbsolute(value)) return false;
+  const resolved = path.resolve(value);
+  return path.parse(resolved).root === resolved;
+}
+
+function acceptedCreationError(threadId, error) {
+  if (error.acceptedCreation) return error;
+  return Object.assign(new Error(`Codex Desktop created task ${threadId}, but its post-creation verification failed: ${error.message}. threadId: ${threadId}. Task was accepted; do not resend. Its reply was withheld until the verification error is resolved.`, { cause: error }), { code: "DESKTOP_CREATION_VERIFICATION_FAILED", threadId, acceptedCreation: true });
+}
+
 function sameAccountContext(expected, current) {
   return Boolean(expected && current && ["claude", "codex"].every((provider) =>
     typeof expected[provider] === "string" && expected[provider] === current[provider]));
@@ -59,7 +72,7 @@ export function matchDesktopProject(projects, cwd, { canonicalize = realpathSync
 }
 
 export class DesktopTaskDelivery {
-  constructor({ relay = new NativeDesktopRelay({ socketPath: desktopTaskSocketPath(), accountSocketPath: accountRelaySocketPath() }), security, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now = Date.now, receipts = new DesktopTaskReceipts(), beforeRequest, accountContext, senderContext, captureResponse = captureCodexRolloutWatermark, readResponse = readCodexNativeTurnResponse, inspectResponse = inspectCodexNativeTurn } = {}) {
+  constructor({ relay = new NativeDesktopRelay({ socketPath: desktopTaskSocketPath(), accountSocketPath: accountRelaySocketPath() }), security, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now = Date.now, receipts = new DesktopTaskReceipts(), beforeRequest, accountContext, senderContext, captureResponse = captureCodexRolloutWatermark, readResponse = readCodexNativeTurnResponse, inspectResponse = inspectCodexNativeTurn, resolveResponse = readResponse === readCodexNativeTurnResponse ? resolveCodexNativeDispatchResponse : null } = {}) {
     this.relay = relay;
     this.security = security;
     this.sleep = sleep;
@@ -71,9 +84,12 @@ export class DesktopTaskDelivery {
     this.captureResponse = captureResponse;
     this.readResponse = readResponse;
     this.inspectResponse = inspectResponse;
+    this.resolveResponse = resolveResponse;
     this.threadOperations = new Map();
   }
 
+  #unassignedSince = new Map();
+
   senderProjectScope(cwd) {
     if (!this.senderContext) return null;
     const sender = requireClaudeSenderContext(this.senderContext());
@@ -101,7 +117,7 @@ export class DesktopTaskDelivery {
       const projectScope = expectedScope ?? await this.mutationProjectScope(operation, args, { deadline });
       if (expectedScope) recheckProjectScope(expectedScope, this.senderProjectScope(expectedScope.recipient.input));
       const remaining = deadline === undefined ? undefined : deadline - this.now();
-      if (remaining !== undefined && remaining <= 0) throw new Error("The bridge's response deadline has elapsed; this operation was not sent");
+      if (remaining !== undefined && remaining <= 0) throw Object.assign(new Error("The bridge's response deadline has elapsed; this operation was not sent"), { code: "DESKTOP_RESPONSE_DEADLINE" });
       const accountContext = this.accountContext?.();
       const response = await this.relay.requestDesktop(operation, args, {
         ...(remaining === undefined ? {} : { timeoutMs: remaining }),
@@ -328,6 +344,15 @@ export class DesktopTaskDelivery {
   async resolveCreation(delivered, { deadline = this.now() + DESKTOP_TOOL_BUDGET_MS } = {}) {
     const binding = delivered.creationObservation;
     if (!binding) return delivered;
+    let confirmedThreadId = null;
+    try {
+      return await this.#resolveCreationLoop(delivered, binding, deadline, (threadId) => { confirmedThreadId = threadId; });
+    } catch (error) {
+      throw confirmedThreadId ? acceptedCreationError(confirmedThreadId, error) : error;
+    }
+  }
+
+  async #resolveCreationLoop(delivered, binding, deadline, onConfirmed) {
     for (;;) {
       if (this.now() >= deadline) return null;
       this.security.assertCwd(delivered.cwd);
@@ -344,17 +369,29 @@ export class DesktopTaskDelivery {
         const response = row.result, threadId = response?.threadId;
         if (typeof threadId !== "string" || !threadId.trim() || response.hostId !== "local" || response.status === "outcome-unknown" ||
             response.firstTurn && response.firstTurn.status !== "accepted" || receipt.threadId && receipt.threadId !== threadId) throw new Error("Native creation is not confirmed; do not resend");
+        onConfirmed(threadId);
         let inspected;
-        try { inspected = await this.#inspectMetadata(threadId, delivered.cwd, { deadline }); }
-        catch (error) { if (this.now() >= deadline && /deadline|within \d+ms/.test(error.message)) return null; throw error; }
-        if (inspected.executorThreadId !== envelope.executorThreadId) throw new Error("Native creation executor changed");
-        if (!sameAccountContext(binding.accountContext, this.accountContext?.())) throw new Error("Creation receipt account changed");
-        this.security.assertCwd(delivered.cwd);
-        this.senderProjectScope(delivered.cwd);
-        if (this.security.hardenedRoots?.mode === "project-policy") this.security.hardenedRoots.recheck(inspected.scopeBinding);
-        if (inspected.projectScope) recheckProjectScope(inspected.projectScope);
-        this.security.registerThread(threadId);
-        this.security.assertThread(threadId, inspected.thread.cwd);
+        try { inspected = await this.#inspectMetadata(threadId, delivered.cwd, { deadline, tolerance: { since: receipt.startedAt } }); }
+        catch (error) {
+          if (error.code === WORKSPACE_UNASSIGNED) {
+            await this.sleep(Math.min(1000, Math.max(0, deadline - this.now())));
+            continue;
+          }
+          if (this.now() >= deadline && /deadline|within \d+ms/.test(error.message)) return null;
+          throw acceptedCreationError(threadId, error);
+        }
+        try {
+          if (inspected.executorThreadId !== envelope.executorThreadId) throw new Error("Native creation executor changed");
+          if (!sameAccountContext(binding.accountContext, this.accountContext?.())) throw new Error("Creation receipt account changed");
+          this.security.assertCwd(delivered.cwd);
+          this.senderProjectScope(delivered.cwd);
+          if (this.security.hardenedRoots?.mode === "project-policy") this.security.hardenedRoots.recheck(inspected.scopeBinding);
+          if (inspected.projectScope) recheckProjectScope(inspected.projectScope);
+          this.security.registerThread(threadId);
+          this.security.assertThread(threadId, inspected.thread.cwd);
+        } catch (error) {
+          throw acceptedCreationError(threadId, error);
+        }
         return { threadId, cwd: delivered.cwd, previousTurnId: null, deliveryStatus: "accepted",
           responseObservation: { operation: "create_thread", threadId, previousTurnId: null, expectedCwd: delivered.cwd,
             executorThreadId: envelope.executorThreadId, prompt: binding.args.prompt, accountContext: binding.accountContext } };
@@ -365,18 +402,18 @@ export class DesktopTaskDelivery {
     }
   }
 
-  async inspect(threadId, cwd, { deadline } = {}) {
-    const inspected = await this.#inspectMetadata(threadId, cwd, { deadline });
+  async inspect(threadId, cwd, { deadline, tolerateUnassigned = false } = {}) {
+    const inspected = await this.#inspectMetadata(threadId, cwd, { deadline, ...(tolerateUnassigned ? { tolerance: {} } : {}) });
     this.security.assertThread(threadId, inspected.thread.cwd);
     return inspected;
   }
 
-  async #inspectMetadata(threadId, cwd, { deadline } = {}) {
+  async #inspectMetadata(threadId, cwd, { deadline, tolerance } = {}) {
     const envelope = await this.request("read_thread", { threadId, hostId: "local", turnLimit: 1, ...METADATA_READ_OPTIONS }, { deadline, includeRelayContext: true });
     const response = envelope.result;
     const thread = response?.thread;
     if (thread?.id !== threadId || thread.hostId !== "local" || !thread.cwd) throw new Error("Desktop did not confirm the task's local workspace.");
-    this.security.assertCwd(thread.cwd);
+    this.#assertReportedWorkspace(threadId, thread.cwd, cwd, tolerance);
     const projectScope = this.senderProjectScope(thread.cwd);
     if (cwd && path.relative(realpathSync.native(cwd), realpathSync.native(thread.cwd))) {
       throw new Error("Native Desktop delivery cannot change an existing task's workspace; create a new task at the requested cwd.");
@@ -385,6 +422,39 @@ export class DesktopTaskDelivery {
     return { thread, latestTurnId: response.turns?.[0]?.id ?? null, projectScope, scopeBinding, executorThreadId: envelope.executorThreadId ?? null };
   }
 
+  /**
+   * Codex Desktop can briefly report a filesystem root as a task's workspace
+   * before it finishes assigning the task's saved project (observed as "/"
+   * right after creation, following an account switch). Only observers that
+   * pass a tolerance - creation confirmation and reply observation, both of
+   * which already know the expected workspace - treat a root that differs from
+   * that workspace as "not yet assigned", and only for a bounded grace period
+   * measured from creation or from the first such report. During it the bridge
+   * acts on nothing at that path, grants no access and keeps observing. After
+   * it, and for every other caller or path, the normal fail-closed
+   * allowed-roots check applies.
+   */
+  #assertReportedWorkspace(threadId, reported, expected, tolerance) {
+    if (!isFilesystemRoot(reported)) this.#unassignedSince.delete(threadId);
+    else if (tolerance && expected && !this.#isExpectedWorkspace(reported, expected)) {
+      const now = this.now();
+      if (tolerance.since === undefined && !this.#unassignedSince.has(threadId)) this.#unassignedSince.set(threadId, now);
+      const since = tolerance.since ?? this.#unassignedSince.get(threadId);
+      if (now - since < UNASSIGNED_WORKSPACE_GRACE_MS) {
+        throw Object.assign(new Error(`Codex Desktop has not yet reported task ${threadId}'s project workspace (it currently reports ${reported}); the bridge did not act on that path.`), { code: WORKSPACE_UNASSIGNED, threadId });
+      }
+    }
+    this.security.assertCwd(reported);
+  }
+
+  #isExpectedWorkspace(reported, expected) {
+    try {
+      return path.relative(realpathSync.native(expected), realpathSync.native(reported)) === "";
+    } catch {
+      return false;
+    }
+  }
+
   async send({ threadId, prompt, cwd, model, effort, name, deadline, onPrepared }) {
     const inspected = await this.inspect(threadId, cwd, { deadline });
     const scopeBinding = this.security.hardenedRoots?.mode === "project-policy" ? this.security.hardenedRoots.capture(inspected.thread.cwd) : undefined;
@@ -432,7 +502,7 @@ export class DesktopTaskDelivery {
     if (response?.navigated !== true) throw new Error(`Desktop did not confirm opening task ${threadId}`);
   }
 
-  async observeNativeResponse(threadId, turnId, responseObservation, { deadline } = {}) {
+  async observeNativeResponse(threadId, turnId, responseObservation, { deadline, resolveDispatch = false } = {}) {
     if (!responseObservation) return unavailableObservation("Codex Desktop completed the turn without exposing assistant response text or a pre-send observation binding.");
     const { expectedCwd } = responseObservation;
     const args = { threadId, hostId: "local", turnLimit: 1 };
@@ -444,13 +514,13 @@ export class DesktopTaskDelivery {
       if (realpathSync.native(expectedCwd) !== expectedCwd) throw new Error("The selected native task workspace changed while its response was being observed");
     };
     await recheck();
-    const initial = await this.inspect(threadId, expectedCwd, { deadline });
-    if (initial.latestTurnId !== turnId) throw new Error("The selected native task changed before its response could be read; reply content was withheld");
-    const read = responseObservation.operation === "create_thread" ? readCodexNativeCreationResponse : this.readResponse;
+    const initial = await this.inspect(threadId, expectedCwd, { deadline, tolerateUnassigned: true });
+    if (!resolveDispatch && initial.latestTurnId !== turnId) throw new Error("The selected native task changed before its response could be read; reply content was withheld");
+    const read = resolveDispatch ? this.resolveResponse : responseObservation.operation === "create_thread" ? readCodexNativeCreationResponse : this.readResponse;
     const observed = read({ ...responseObservation, threadId, turnId, desktopEvidence: initial });
     await recheck();
-    const inspected = await this.inspect(threadId, expectedCwd, { deadline });
-    if (inspected.latestTurnId !== turnId) throw new Error("The selected native task changed before its response could be confirmed; reply content was withheld");
+    const inspected = await this.inspect(threadId, expectedCwd, { deadline, tolerateUnassigned: true });
+    if (inspected.latestTurnId !== (resolveDispatch ? initial.latestTurnId : turnId)) throw new Error("The selected native task changed before its response could be confirmed; reply content was withheld");
     await recheck();
     return observed;
   }
@@ -484,13 +554,29 @@ export class DesktopTaskDelivery {
       const result = await this.request("read_thread", { threadId, hostId: "local", turnLimit: 1, ...METADATA_READ_OPTIONS }, { deadline: startedAt + timeoutMs });
       const thread = result?.thread;
       if (thread?.id !== threadId || thread.hostId !== "local" || !thread.cwd) throw new Error("Desktop did not confirm the observed task's local workspace.");
-      this.security.assertCwd(thread.cwd);
+      this.#assertReportedWorkspace(threadId, thread.cwd, responseObservation?.expectedCwd, {});
       this.security.assertThread(threadId, thread.cwd);
       this.senderProjectScope(thread.cwd);
       if (responseObservation?.expectedCwd && realpathSync.native(thread.cwd) !== responseObservation.expectedCwd) throw new Error("The selected native task workspace changed during observation");
       return { polls: [{ thread, latestTurn: result.turns?.[0] ?? null }] };
     };
     const expired = () => ({ threadId, turnId, status: "timeout", text: "", responseStatus: "unavailable", assistantItems: [], replySha256: null, activity: [], errors: [], durationMs: this.now() - startedAt });
+    const deadlineError = (error) => {
+      const cause = error.cause ?? error;
+      return this.now() - startedAt >= timeoutMs && (["DESKTOP_RESPONSE_DEADLINE", "RELAY_TIMEOUT"].includes(cause.code) ||
+        cause.code === "RELAY_UNREACHABLE" && cause.message === "The Codex Desktop relay send deadline elapsed before dispatch");
+    };
+    const unassigned = Symbol("workspace-unassigned");
+    const observe = async (selectedTurnId, resolveDispatch = false) => {
+      try {
+        return await this.observeNativeResponse(threadId, selectedTurnId, responseObservation, { deadline: startedAt + timeoutMs, resolveDispatch });
+      } catch (error) {
+        if (deadlineError(error)) return null;
+        if (error.code === WORKSPACE_UNASSIGNED) return unassigned;
+        throw error;
+      }
+    };
+    const pause = () => this.sleep(Math.min(1500, timeoutMs - (this.now() - startedAt)));
     for (;;) {
       if (this.now() - startedAt >= timeoutMs) return expired();
       let response;
@@ -499,14 +585,20 @@ export class DesktopTaskDelivery {
           targets: [{ threadId, hostId: "local", ...(cursor ? { afterCursor: cursor } : {}) }], timeoutMs: 0,
         }, { deadline: startedAt + timeoutMs });
       } catch (err) {
-        if (this.now() - startedAt >= timeoutMs) return expired();
+        if (deadlineError(err)) return expired();
+        if (err.code === WORKSPACE_UNASSIGNED) {
+          await pause();
+          continue;
+        }
         if (readSnapshots || !unavailableWaitRenderer(err)) throw err;
         readSnapshots = true;
         try {
           response = await readSnapshot();
         } catch (readError) {
-          if (this.now() - startedAt >= timeoutMs) return expired();
-          throw readError;
+          if (deadlineError(readError)) return expired();
+          if (readError.code !== WORKSPACE_UNASSIGNED) throw readError;
+          await pause();
+          continue;
         }
       }
       const poll = response?.polls?.find((item) => item.thread?.id === threadId && item.thread?.hostId === "local");
@@ -514,15 +606,53 @@ export class DesktopTaskDelivery {
       cursor = poll.cursor;
       const turn = poll.latestTurn;
       const threadStatus = typeof poll.thread.status === "string" ? poll.thread.status : poll.thread.status?.type;
-      if (["systemError", "waitingOnApproval", "waitingOnUserInput"].includes(threadStatus)) {
-        return { threadId, turnId: turn?.id !== previousTurnId ? turn?.id ?? null : null, status: threadStatus, text: "", activity: [], errors: [], durationMs: this.now() - startedAt };
+      const needsAttention = ["systemError", "waitingOnApproval", "waitingOnUserInput"].includes(threadStatus);
+      const attention = () => ({ threadId, turnId: turn?.id !== previousTurnId ? turn?.id ?? null : null, status: threadStatus, text: "", activity: [], errors: [], durationMs: this.now() - startedAt });
+      if (this.resolveResponse && responseObservation?.watermark?.status === "available" && responseObservation.operation !== "create_thread") {
+        const observed = await observe(null, true);
+        if (!observed) return expired();
+        if (observed === unassigned) {
+          await pause();
+          continue;
+        }
+        turnId = observed.turnId ?? null;
+        if (observed.status !== "pending") {
+          return {
+            threadId, turnId, status: observed.status === "unavailable" ? "failed" : "completed",
+            responseStatus: observed.status, observationStatus: observed.status,
+            text: observed.status === "completed" ? observed.text : "",
+            ...(observed.reason ? { observationReason: observed.reason } : {}),
+            assistantItems: observed.assistantItems ?? [], replySha256: observed.replySha256 ?? null,
+            responseSource: observed.source ?? null,
+            ...(observed.responseScope ? { responseScope: observed.responseScope } : {}),
+            activity: [], errors: [], durationMs: this.now() - startedAt,
+          };
+        }
+        if (needsAttention) return attention();
+        if (this.now() - startedAt >= timeoutMs) return expired();
+        await this.sleep(Math.min(1500, timeoutMs - (this.now() - startedAt)));
+        continue;
       }
-      if (turn?.id && turn.id !== previousTurnId) {
-        turnId = turn.id;
+      if (needsAttention) return attention();
+      const existingTurn = turn?.id === previousTurnId;
+      if (turn?.id && (!existingTurn || responseObservation?.previousTurnId === previousTurnId)) {
+        if (!existingTurn) turnId = turn.id;
         const status = turn.status;
         if (RELEASE_STATUSES.has(status)) {
-          const observed = await this.observeNativeResponse(threadId, turnId, responseObservation, { deadline: startedAt + timeoutMs });
+          const observed = await observe(turn.id);
+          if (!observed) return expired();
+          if (observed === unassigned) {
+            await pause();
+            continue;
+          }
           const responseStatus = observed.status;
+          if (existingTurn && !observed.dispatchObserved && !["completed", "completed_no_reply"].includes(responseStatus)) {
+            turnId = null;
+            if (this.now() - startedAt >= timeoutMs) return expired();
+            await this.sleep(Math.min(1500, timeoutMs - (this.now() - startedAt)));
+            continue;
+          }
+          turnId = turn.id;
           return {
             threadId, turnId, status,
             text: responseStatus === "completed" ? observed.text : "",
@@ -532,6 +662,7 @@ export class DesktopTaskDelivery {
             assistantItems: observed.assistantItems ?? [],
             replySha256: observed.replySha256 ?? null,
             responseSource: observed.source ?? null,
+            ...(observed.responseScope ? { responseScope: observed.responseScope } : {}),
             activity: [], errors: turn.error ? [turn.error] : [], durationMs: turn.durationMs ?? this.now() - startedAt,
           };
         }