@minhspark/codex-mcp-bridge 1.22.5 → 1.22.6

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-mcp-bridge",
-  "version": "1.22.5",
+  "version": "1.22.6",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh"

package/CHANGELOG.md

@@ -4,6 +4,30 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.22.6] - 2026-10-20
+
+### Fixed
+
+- Keep a confirmed Desktop creation identifiable when post-creation verification fails. `delegate_to_codex` and `start_codex_thread` now return the task's threadId, its deliveryId and "Task was accepted; do not resend" instead of a bare allowed-roots error that read as if nothing had been created. The confirmed threadId is kept even when a later account, receipt or scope check fails after the bridge waited for the task's workspace.
+- Treat a filesystem root that Codex Desktop briefly reports as a newly created task's workspace, observed as `/` right after creation following an account switch, as "workspace not yet assigned" when it is not the expected project. Creation keeps observing until its deadline and then returns a pending receipt that keeps the accepted threadId; reply observation keeps polling. The tolerance lasts at most 120 seconds from creation, or from the first such report during reply observation, and the bridge acts on nothing at that path and grants no task access from it during that time.
+- Report a pending creation whose task Desktop already confirmed as `deliveryStatus: accepted` instead of `unconfirmed`.
+
+### Security
+
+- A root report that outlasts the grace period, any other workspace outside the allowed roots, a different project, an account change or a sender mismatch still fails closed. Sends and plain thread inspection keep the normal allowed-roots refusal for a root workspace; nothing is sent.
+
+### Verification
+
+- 10 regression tests reproduce the defect on v1.22.5 and pass with the fix: creation confirmation with a brief `/` report, a pending result at the deadline, grace expiry, an outside-root workspace, a later account change, reply observation in both the wait and snapshot paths, and two MCP-level `delegate_to_codex` tests through the relay companion.
+- The full CI matrix passed on Windows, macOS and Linux with Node 22 and 24. A local run outside the sandbox passed 1406 tests with 0 failures.
+- An independent adversarial review found no security regression; its four confirmed correctness findings were fixed before merge.
+
+### Upgrade notes
+
+- Reconnect the MCP server after updating and confirm the loaded version from the actual runtime before relying on the fix.
+- A creation that is pending because Desktop has not reported its workspace continues with `wait_codex_reply` and the returned deliveryId. Do not resend the prompt or create the task again.
+- Not yet exercised against a live Desktop account switch. A placeholder workspace other than a filesystem root still fails closed as before.
+
 ## [1.22.5] - 2026-10-19
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.22.5",
+  "version": "1.22.6",
   "description": "Two-way MCP bridge between Claude and Codex: prompts into a live Codex thread, messages into a running Claude Code session.",
   "keywords": [
     "mcp",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "codex-mcp-bridge",
-  "version": "1.22.5",
+  "version": "1.22.6",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh",

package/scripts/install-native-relay.mjs

@@ -23,7 +23,7 @@ import { enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-acce
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.5";
+const VERSION = "1.22.6";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/src/claude-bridge.mjs

@@ -30,7 +30,7 @@ import { discoverClaudeProject } from "./claude-project-discovery.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.5";
+const VERSION = "1.22.6";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/index.mjs

@@ -40,7 +40,7 @@ import { PROJECT_SETUP_TOOLS, registerProjectOnboardingTools } from "./project-o
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.5";
+const VERSION = "1.22.6";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 
@@ -211,6 +211,25 @@ function threadNameFor({ cwd, prompt, name }) {
   );
 }
 
+/**
+ * Once a Desktop creation was dispatched, a later verification failure must
+ * never read like a refusal: the caller keeps the task and receipt identity
+ * and is told not to resend. Verification still fails closed; only the report
+ * changes.
+ */
+function creationVerificationFailure({ created, deliveryId, requestId, err }) {
+  const threadId = created.threadId ?? err?.threadId ?? null;
+  const lines = threadId
+    ? ["Codex Desktop accepted the task, but post-creation verification failed.", `threadId: ${threadId}`]
+    : ["Codex Desktop creation was dispatched, but its outcome is not yet confirmed."];
+  lines.push(...(requestId ? [`requestId: ${requestId}`] : []), `cwd: ${created.cwd}`, ...(deliveryId ? [`deliveryId: ${deliveryId}`] : []), `error: ${err?.message ?? String(err)}`,
+    threadId ? "Task was accepted; do not resend. Resolve the verification error, then continue observing with wait_codex_reply and this deliveryId." : "Do not resend or create again. Continue observing with wait_codex_reply and this deliveryId.");
+  return {
+    ...textResult(lines.join("\n"), true),
+    structuredContent: { ...failure(err).structuredContent, threadId, deliveryStatus: threadId ? "accepted" : "unconfirmed", ...(deliveryId ? { deliveryId } : {}), nextAction: deliveryId ? "wait_codex_reply" : "none" },
+  };
+}
+
 async function delegateDesktopTask({ cwd, prompt, name, requestId, model, effort, timeoutSec, openInApp, waitForReply = true }) {
   const deadline = desktopOperation.getStore()?.deadline ?? Date.now() + Math.min((timeoutSec ?? 40) * 1000, DESKTOP_TOOL_BUDGET_MS);
   const workspace = resolveWorkspacePath(cwd);
@@ -222,8 +241,17 @@ async function delegateDesktopTask({ cwd, prompt, name, requestId, model, effort
   const deliveryId = created.deliveryId;
   let delivered = deliveryId ? replyReceipts.read(deliveryId, desktopOperation.getStore()) : null;
   if (delivered?.creationObservation) {
-    const resolved = await desktopTasks.resolveCreation(delivered, { deadline });
-    if (!resolved) return replyResult(delivered, deliveryId, { threadId: null, status: "timeout", responseStatus: "unavailable", text: "" }, ["Creation acknowledgement pending; do not create again."]);
+    let resolved;
+    try {
+      resolved = await desktopTasks.resolveCreation(delivered, { deadline });
+    } catch (err) {
+      return creationVerificationFailure({ created, deliveryId, requestId, err });
+    }
+    if (!resolved) {
+      const threadId = created.threadId ?? null;
+      return replyResult({ ...delivered, threadId, ...(threadId ? { deliveryStatus: "accepted" } : {}) }, deliveryId, { threadId, status: "timeout", responseStatus: "unavailable", text: "" },
+        [...(threadId ? [`threadId: ${threadId}`, "Task was accepted; Codex Desktop has not yet confirmed its workspace or creation receipt."] : []), "Creation acknowledgement pending; do not create again."]);
+    }
     delivered = resolved;
     created.threadId = resolved.threadId;
   }

package/src/native-relay-companion.mjs

@@ -38,7 +38,7 @@ import { NativeCreationReceipts, creationIdValid } from "./native-creation-recei
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.22.5";
+const VERSION = "1.22.6";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent, details) {

package/src/thread-delivery.mjs

@@ -26,6 +26,8 @@ import { requireClaudeSenderContext } from "./claude-sender-context.mjs";
 export const NATIVE_BACKEND = "codex-desktop-native";
 export const APP_SERVER_BACKEND = "app-server";
 export const DESKTOP_TOOL_BUDGET_MS = 40000;
+export const WORKSPACE_UNASSIGNED = "DESKTOP_WORKSPACE_UNASSIGNED";
+export const UNASSIGNED_WORKSPACE_GRACE_MS = 120000;
 const RELEASE_STATUSES = new Set(["completed", "interrupted", "failed"]);
 const METADATA_READ_OPTIONS = { includeOutputs: false, maxOutputCharsPerItem: 1 };
 
@@ -35,6 +37,17 @@ function unavailableWaitRenderer(error) {
     /^(Codex app tool request failed\.?|The app tool call ended before producing a result\.?)$/.test(cause.message);
 }
 
+function isFilesystemRoot(value) {
+  if (typeof value !== "string" || !path.isAbsolute(value)) return false;
+  const resolved = path.resolve(value);
+  return path.parse(resolved).root === resolved;
+}
+
+function acceptedCreationError(threadId, error) {
+  if (error.acceptedCreation) return error;
+  return Object.assign(new Error(`Codex Desktop created task ${threadId}, but its post-creation verification failed: ${error.message}. threadId: ${threadId}. Task was accepted; do not resend. Its reply was withheld until the verification error is resolved.`, { cause: error }), { code: "DESKTOP_CREATION_VERIFICATION_FAILED", threadId, acceptedCreation: true });
+}
+
 function sameAccountContext(expected, current) {
   return Boolean(expected && current && ["claude", "codex"].every((provider) =>
     typeof expected[provider] === "string" && expected[provider] === current[provider]));
@@ -75,6 +88,8 @@ export class DesktopTaskDelivery {
     this.threadOperations = new Map();
   }
 
+  #unassignedSince = new Map();
+
   senderProjectScope(cwd) {
     if (!this.senderContext) return null;
     const sender = requireClaudeSenderContext(this.senderContext());
@@ -329,6 +344,15 @@ export class DesktopTaskDelivery {
   async resolveCreation(delivered, { deadline = this.now() + DESKTOP_TOOL_BUDGET_MS } = {}) {
     const binding = delivered.creationObservation;
     if (!binding) return delivered;
+    let confirmedThreadId = null;
+    try {
+      return await this.#resolveCreationLoop(delivered, binding, deadline, (threadId) => { confirmedThreadId = threadId; });
+    } catch (error) {
+      throw confirmedThreadId ? acceptedCreationError(confirmedThreadId, error) : error;
+    }
+  }
+
+  async #resolveCreationLoop(delivered, binding, deadline, onConfirmed) {
     for (;;) {
       if (this.now() >= deadline) return null;
       this.security.assertCwd(delivered.cwd);
@@ -345,17 +369,29 @@ export class DesktopTaskDelivery {
         const response = row.result, threadId = response?.threadId;
         if (typeof threadId !== "string" || !threadId.trim() || response.hostId !== "local" || response.status === "outcome-unknown" ||
             response.firstTurn && response.firstTurn.status !== "accepted" || receipt.threadId && receipt.threadId !== threadId) throw new Error("Native creation is not confirmed; do not resend");
+        onConfirmed(threadId);
         let inspected;
-        try { inspected = await this.#inspectMetadata(threadId, delivered.cwd, { deadline }); }
-        catch (error) { if (this.now() >= deadline && /deadline|within \d+ms/.test(error.message)) return null; throw error; }
-        if (inspected.executorThreadId !== envelope.executorThreadId) throw new Error("Native creation executor changed");
-        if (!sameAccountContext(binding.accountContext, this.accountContext?.())) throw new Error("Creation receipt account changed");
-        this.security.assertCwd(delivered.cwd);
-        this.senderProjectScope(delivered.cwd);
-        if (this.security.hardenedRoots?.mode === "project-policy") this.security.hardenedRoots.recheck(inspected.scopeBinding);
-        if (inspected.projectScope) recheckProjectScope(inspected.projectScope);
-        this.security.registerThread(threadId);
-        this.security.assertThread(threadId, inspected.thread.cwd);
+        try { inspected = await this.#inspectMetadata(threadId, delivered.cwd, { deadline, tolerance: { since: receipt.startedAt } }); }
+        catch (error) {
+          if (error.code === WORKSPACE_UNASSIGNED) {
+            await this.sleep(Math.min(1000, Math.max(0, deadline - this.now())));
+            continue;
+          }
+          if (this.now() >= deadline && /deadline|within \d+ms/.test(error.message)) return null;
+          throw acceptedCreationError(threadId, error);
+        }
+        try {
+          if (inspected.executorThreadId !== envelope.executorThreadId) throw new Error("Native creation executor changed");
+          if (!sameAccountContext(binding.accountContext, this.accountContext?.())) throw new Error("Creation receipt account changed");
+          this.security.assertCwd(delivered.cwd);
+          this.senderProjectScope(delivered.cwd);
+          if (this.security.hardenedRoots?.mode === "project-policy") this.security.hardenedRoots.recheck(inspected.scopeBinding);
+          if (inspected.projectScope) recheckProjectScope(inspected.projectScope);
+          this.security.registerThread(threadId);
+          this.security.assertThread(threadId, inspected.thread.cwd);
+        } catch (error) {
+          throw acceptedCreationError(threadId, error);
+        }
         return { threadId, cwd: delivered.cwd, previousTurnId: null, deliveryStatus: "accepted",
           responseObservation: { operation: "create_thread", threadId, previousTurnId: null, expectedCwd: delivered.cwd,
             executorThreadId: envelope.executorThreadId, prompt: binding.args.prompt, accountContext: binding.accountContext } };
@@ -366,18 +402,18 @@ export class DesktopTaskDelivery {
     }
   }
 
-  async inspect(threadId, cwd, { deadline } = {}) {
-    const inspected = await this.#inspectMetadata(threadId, cwd, { deadline });
+  async inspect(threadId, cwd, { deadline, tolerateUnassigned = false } = {}) {
+    const inspected = await this.#inspectMetadata(threadId, cwd, { deadline, ...(tolerateUnassigned ? { tolerance: {} } : {}) });
     this.security.assertThread(threadId, inspected.thread.cwd);
     return inspected;
   }
 
-  async #inspectMetadata(threadId, cwd, { deadline } = {}) {
+  async #inspectMetadata(threadId, cwd, { deadline, tolerance } = {}) {
     const envelope = await this.request("read_thread", { threadId, hostId: "local", turnLimit: 1, ...METADATA_READ_OPTIONS }, { deadline, includeRelayContext: true });
     const response = envelope.result;
     const thread = response?.thread;
     if (thread?.id !== threadId || thread.hostId !== "local" || !thread.cwd) throw new Error("Desktop did not confirm the task's local workspace.");
-    this.security.assertCwd(thread.cwd);
+    this.#assertReportedWorkspace(threadId, thread.cwd, cwd, tolerance);
     const projectScope = this.senderProjectScope(thread.cwd);
     if (cwd && path.relative(realpathSync.native(cwd), realpathSync.native(thread.cwd))) {
       throw new Error("Native Desktop delivery cannot change an existing task's workspace; create a new task at the requested cwd.");
@@ -386,6 +422,39 @@ export class DesktopTaskDelivery {
     return { thread, latestTurnId: response.turns?.[0]?.id ?? null, projectScope, scopeBinding, executorThreadId: envelope.executorThreadId ?? null };
   }
 
+  /**
+   * Codex Desktop can briefly report a filesystem root as a task's workspace
+   * before it finishes assigning the task's saved project (observed as "/"
+   * right after creation, following an account switch). Only observers that
+   * pass a tolerance - creation confirmation and reply observation, both of
+   * which already know the expected workspace - treat a root that differs from
+   * that workspace as "not yet assigned", and only for a bounded grace period
+   * measured from creation or from the first such report. During it the bridge
+   * acts on nothing at that path, grants no access and keeps observing. After
+   * it, and for every other caller or path, the normal fail-closed
+   * allowed-roots check applies.
+   */
+  #assertReportedWorkspace(threadId, reported, expected, tolerance) {
+    if (!isFilesystemRoot(reported)) this.#unassignedSince.delete(threadId);
+    else if (tolerance && expected && !this.#isExpectedWorkspace(reported, expected)) {
+      const now = this.now();
+      if (tolerance.since === undefined && !this.#unassignedSince.has(threadId)) this.#unassignedSince.set(threadId, now);
+      const since = tolerance.since ?? this.#unassignedSince.get(threadId);
+      if (now - since < UNASSIGNED_WORKSPACE_GRACE_MS) {
+        throw Object.assign(new Error(`Codex Desktop has not yet reported task ${threadId}'s project workspace (it currently reports ${reported}); the bridge did not act on that path.`), { code: WORKSPACE_UNASSIGNED, threadId });
+      }
+    }
+    this.security.assertCwd(reported);
+  }
+
+  #isExpectedWorkspace(reported, expected) {
+    try {
+      return path.relative(realpathSync.native(expected), realpathSync.native(reported)) === "";
+    } catch {
+      return false;
+    }
+  }
+
   async send({ threadId, prompt, cwd, model, effort, name, deadline, onPrepared }) {
     const inspected = await this.inspect(threadId, cwd, { deadline });
     const scopeBinding = this.security.hardenedRoots?.mode === "project-policy" ? this.security.hardenedRoots.capture(inspected.thread.cwd) : undefined;
@@ -445,12 +514,12 @@ export class DesktopTaskDelivery {
       if (realpathSync.native(expectedCwd) !== expectedCwd) throw new Error("The selected native task workspace changed while its response was being observed");
     };
     await recheck();
-    const initial = await this.inspect(threadId, expectedCwd, { deadline });
+    const initial = await this.inspect(threadId, expectedCwd, { deadline, tolerateUnassigned: true });
     if (!resolveDispatch && initial.latestTurnId !== turnId) throw new Error("The selected native task changed before its response could be read; reply content was withheld");
     const read = resolveDispatch ? this.resolveResponse : responseObservation.operation === "create_thread" ? readCodexNativeCreationResponse : this.readResponse;
     const observed = read({ ...responseObservation, threadId, turnId, desktopEvidence: initial });
     await recheck();
-    const inspected = await this.inspect(threadId, expectedCwd, { deadline });
+    const inspected = await this.inspect(threadId, expectedCwd, { deadline, tolerateUnassigned: true });
     if (inspected.latestTurnId !== (resolveDispatch ? initial.latestTurnId : turnId)) throw new Error("The selected native task changed before its response could be confirmed; reply content was withheld");
     await recheck();
     return observed;
@@ -485,7 +554,7 @@ export class DesktopTaskDelivery {
       const result = await this.request("read_thread", { threadId, hostId: "local", turnLimit: 1, ...METADATA_READ_OPTIONS }, { deadline: startedAt + timeoutMs });
       const thread = result?.thread;
       if (thread?.id !== threadId || thread.hostId !== "local" || !thread.cwd) throw new Error("Desktop did not confirm the observed task's local workspace.");
-      this.security.assertCwd(thread.cwd);
+      this.#assertReportedWorkspace(threadId, thread.cwd, responseObservation?.expectedCwd, {});
       this.security.assertThread(threadId, thread.cwd);
       this.senderProjectScope(thread.cwd);
       if (responseObservation?.expectedCwd && realpathSync.native(thread.cwd) !== responseObservation.expectedCwd) throw new Error("The selected native task workspace changed during observation");
@@ -497,14 +566,17 @@ export class DesktopTaskDelivery {
       return this.now() - startedAt >= timeoutMs && (["DESKTOP_RESPONSE_DEADLINE", "RELAY_TIMEOUT"].includes(cause.code) ||
         cause.code === "RELAY_UNREACHABLE" && cause.message === "The Codex Desktop relay send deadline elapsed before dispatch");
     };
+    const unassigned = Symbol("workspace-unassigned");
     const observe = async (selectedTurnId, resolveDispatch = false) => {
       try {
         return await this.observeNativeResponse(threadId, selectedTurnId, responseObservation, { deadline: startedAt + timeoutMs, resolveDispatch });
       } catch (error) {
         if (deadlineError(error)) return null;
+        if (error.code === WORKSPACE_UNASSIGNED) return unassigned;
         throw error;
       }
     };
+    const pause = () => this.sleep(Math.min(1500, timeoutMs - (this.now() - startedAt)));
     for (;;) {
       if (this.now() - startedAt >= timeoutMs) return expired();
       let response;
@@ -514,13 +586,19 @@ export class DesktopTaskDelivery {
         }, { deadline: startedAt + timeoutMs });
       } catch (err) {
         if (deadlineError(err)) return expired();
+        if (err.code === WORKSPACE_UNASSIGNED) {
+          await pause();
+          continue;
+        }
         if (readSnapshots || !unavailableWaitRenderer(err)) throw err;
         readSnapshots = true;
         try {
           response = await readSnapshot();
         } catch (readError) {
           if (deadlineError(readError)) return expired();
-          throw readError;
+          if (readError.code !== WORKSPACE_UNASSIGNED) throw readError;
+          await pause();
+          continue;
         }
       }
       const poll = response?.polls?.find((item) => item.thread?.id === threadId && item.thread?.hostId === "local");
@@ -533,6 +611,10 @@ export class DesktopTaskDelivery {
       if (this.resolveResponse && responseObservation?.watermark?.status === "available" && responseObservation.operation !== "create_thread") {
         const observed = await observe(null, true);
         if (!observed) return expired();
+        if (observed === unassigned) {
+          await pause();
+          continue;
+        }
         turnId = observed.turnId ?? null;
         if (observed.status !== "pending") {
           return {
@@ -559,6 +641,10 @@ export class DesktopTaskDelivery {
         if (RELEASE_STATUSES.has(status)) {
           const observed = await observe(turn.id);
           if (!observed) return expired();
+          if (observed === unassigned) {
+            await pause();
+            continue;
+          }
           const responseStatus = observed.status;
           if (existingTurn && !observed.dispatchObserved && !["completed", "completed_no_reply"].includes(responseStatus)) {
             turnId = null;