@minhspark/codex-mcp-bridge 1.26.8 → 1.26.10

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-mcp-bridge",
-  "version": "1.26.8",
+  "version": "1.26.10",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh"

package/CHANGELOG.md

@@ -4,6 +4,51 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.26.10] - 2026-11-03
+
+### Fixed
+
+- Recover Claude replies whose native ancestry passes through a verified Monitor notification. Preserve outstanding background work and reject unrelated or malformed notifications. Pending-delivery diagnostics now retain the original message ID and direct callers to its receipt without suggesting a duplicate send.
+- Observe Antigravity Desktop replies through a bounded, read-only native transcript adapter. New deliveries retain a pre-send boundary and prompt hash; completion requires the exact original message, execution, public final response and idle conversation. Unsupported schemas, interleaved messages and ambiguous matches remain unconfirmed. Reply reads retain sender, account and project isolation.
+- Migrate pending Claude transcript observations during future worker updates only after a unique native message proves acceptance. Held and unobserved deliveries keep their locks and defer reload, preserving their original reply channel.
+- Resolve Codex CLI candidates from the worker's actual environment, skip incomplete version directories and retry read-only inspection once if an unpinned executable disappears during an app update. Explicit executable selections, authentication failures and real jobs are never retried or silently redirected.
+- Report background relay readiness separately from unverified Desktop connections after updating. A ready background worker does not establish a live native Desktop relay.
+- Reject malformed transcript session identifiers before composing filesystem paths, and validate executable candidates before inspecting their file type. Configured external executable locations remain supported.
+
+### Verification and limits
+
+- Regression coverage includes Monitor ancestry, pending receipt ownership, reload safety, exact native reply correlation, account changes and CLI replacement races. Historical native transcripts confirmed both reply-observation failures without resending their prompts.
+- An already-running older worker can still defer its own upgrade while a receipt is pending. Preserve that receipt and any verified historical result before reconnecting its MCP client; a missing receipt after reconnecting is not evidence of non-delivery. Legacy Antigravity receipts without the original account binding cannot disclose recovered reply text.
+- A Desktop relay exiting on another machine still requires that machine's MCP host log and shutdown reason. This release does not infer an idle-chat cause or replace Desktop delivery with a CLI worker.
+
+### Upgrade
+
+```powershell
+npx.cmd -y @minhspark/codex-mcp-bridge@latest
+```
+
+For noninteractive Windows updates, use `codex-bridge-update --user`. Reconnect affected existing MCP clients after active work finishes, then check their status tools. The global installation path remains available with `npm install -g @minhspark/codex-mcp-bridge@latest --allow-scripts=@minhspark/codex-mcp-bridge --foreground-scripts`.
+
+## [1.26.9] - 2026-11-03
+
+### Fixed
+
+- Shorten the "Applying managed settings" step of `npx @minhspark/codex-mcp-bridge@latest`. Each Codex `mcp` command takes several seconds to start on a machine with many MCP servers and plugins, and one update ran about sixteen of them. The Codex installers now read their own entry with one `codex mcp get` instead of listing every server first, the verification reads all three registrations from a single `codex mcp list`, and the updater no longer runs a second, separate verification process after setup has already verified the saved settings.
+- Show which component the updater is configuring while managed settings are applied, instead of a single line that looked frozen for a minute or more.
+- Stop reporting `MCP registration is missing` for `claude-bridge`, `codex-native-relay` and `antigravity-bridge` when Codex CLI was merely too slow to answer. A slow inventory now says so, and the three registrations are reported as not checked. Codex `mcp` commands used by setup may take up to 120 seconds instead of 30, so a busy computer no longer fails an otherwise complete update.
+
+### Verification
+
+- Regression coverage checks that verification makes exactly one Codex inventory call, that only Codex's own "No MCP server named" error counts as an absent entry, that a timed-out inventory is reported as unchecked, and that the updater runs setup once and relays only its progress lines.
+
+### Upgrade
+
+```powershell
+npx.cmd -y @minhspark/codex-mcp-bridge@latest
+```
+
+This command runs the 1.26.9 updater itself, so the shorter sequence applies to this update.
+
 ## [1.26.8] - 2026-11-03
 
 ### Fixed

package/docs/daily-handoffs.md

@@ -82,6 +82,12 @@ new task, account, process, prompt and directory to match.
    turn. The exact dispatch must occur after the saved watermark, and commentary
    alone is never a final reply. Receipt observation resolves that exact dispatch
    even after newer turns start; it does not substitute the latest turn's answer.
+   For Antigravity Desktop, retain `requestId` and use
+   `read_antigravity_delivery`. `accepted` confirms only native acceptance;
+   `reply_received` requires an exact native message and execution with a public
+   final reply. Unsupported transcript formats or ambiguous interleaving keep
+   the delivery unconfirmed. Receipts without their original account binding
+   cannot disclose recovered reply text. None of these states authorizes a resend.
 5. An `interrupted` receipt ends observation only: task outcome is unknown and
    background work may continue. Inspect the existing task before a scoped
    follow-up; do not repeat card creation or file operations.
@@ -113,6 +119,18 @@ defer hot reload. Save the original receipt and any verified historical reply
 before reconnecting. An unknown ID after reconnecting is not evidence of
 non-delivery. Verify recovery with one harmless message, not by resending work.
 
+Updated workers can transfer a pending Claude transcript observation only when
+the exact native message has already been observed. Held or unobserved deliveries
+retain their original callback channel and continue to defer reload. Installing
+new code cannot change the migration behavior of an already-running old worker.
+
+Updater success verifies managed settings and the background relay separately
+from Desktop connectivity. Check `codex_bridge_status`, `claude_bridge_status`
+and `antigravity_bridge_status` in the existing clients. If a native companion
+starts and then exits, retain its MCP host stderr and shutdown reason. A missing
+relay pipe alone does not identify the cause; do not infer that an empty chat or
+a dummy prompt is required to keep it alive.
+
 Card revocation and communication revocation are independent. Archiving a
 conversation does not guarantee worktree/branch removal. Check running work,
 uncommitted files and unique commits before cleanup; preserve configuration,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.26.8",
+  "version": "1.26.10",
   "description": "Connect Claude, Codex, and Antigravity through MCP, with native Desktop handoffs and bridge-owned Antigravity CLI sessions.",
   "keywords": [
     "mcp",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "codex-mcp-bridge",
-  "version": "1.26.8",
+  "version": "1.26.10",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh",

package/scripts/install-antigravity-bridge.mjs

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
-import { applyStdioMcpRegistration, stdioMcpRegistration } from "../src/codex-mcp-registration.mjs";
+import { applyStdioMcpRegistration, CODEX_MCP_TIMEOUT_MS, readCodexMcpServer, stdioMcpRegistration } from "../src/codex-mcp-registration.mjs";
 import { bridgeEntrypointConflict, isBridgeSource, isMainModule, isNodeLauncher, stableInstallPath, stableNodeBin } from "../src/install-paths.mjs";
 import { backupRegularConfigFile } from "../src/project-policy.mjs";
 import { homeDir, resolveCodexBin, spawnEnv } from "../src/platform.mjs";
@@ -256,10 +256,8 @@ export function runAntigravityInstaller(args = process.argv.slice(2), { prepareR
   let codexExisting = null;
   if (options.targets.includes("codex")) {
     const codexBin = validateCodexExecutable(resolveCodexBin(process.env.CODEX_EXE));
-    run = (command) => execFileSync(codexBin, command, { encoding: "utf8", env: spawnEnv(), windowsHide: true, shell: false, timeout: 30000, stdio: "pipe" });
-    const inventory = JSON.parse(run(["mcp", "list", "--json"]));
-    if (!Array.isArray(inventory)) throw new Error("Codex returned an invalid MCP inventory");
-    if (inventory.some((item) => item.name === NAME)) codexExisting = JSON.parse(run(["mcp", "get", NAME, "--json"]));
+    run = (command) => execFileSync(codexBin, command, { encoding: "utf8", env: spawnEnv(), windowsHide: true, shell: false, timeout: CODEX_MCP_TIMEOUT_MS, stdio: "pipe" });
+    codexExisting = readCodexMcpServer(run, NAME);
   }
   const plan = planAntigravityInstallation({ ...options, home, root, node, codexExisting });
   if (!options.remove) {

package/scripts/install-codex-mcp.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { PLATFORM_LABEL, resolveCodexBin, spawnEnv } from "../src/platform.mjs";
 import { exitForVersionRequest } from "../src/cli-version.mjs";
 import { desktopTasksConfigured } from "../src/native-relay.mjs";
-import { applyStdioMcpRegistration, codexMcpRegistration } from "../src/codex-mcp-registration.mjs";
+import { applyStdioMcpRegistration, codexMcpRegistration, readCodexMcpServer } from "../src/codex-mcp-registration.mjs";
 import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs";
 import { codexAccessPaths, enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-access.mjs";
 import { stableInstallPath, stableNodeBin } from "../src/install-paths.mjs";
@@ -37,10 +37,7 @@ if (remove) {
   process.exit(0);
 }
 
-const servers = JSON.parse(run(["mcp", "list", "--json"]));
-if (!Array.isArray(servers)) throw new Error("Codex returned an invalid MCP inventory; existing configuration was not changed");
-const existing = servers.some((server) => server.name === serverName)
-  ? JSON.parse(run(["mcp", "get", serverName, "--json"])) : null;
+const existing = readCodexMcpServer(run, serverName);
 const registration = codexMcpRegistration({ name: serverName, existing, node: nodeBin, entry, entryArgs, env: process.env, desktopOnly: desktopTasksConfigured() });
 createReleaseSnapshot(root, { cache: snapshotRoot({ ...process.env, ...registration.environment }) });
 const applied = applyStdioMcpRegistration({ name: serverName, registration, existing, run, configPath: codexAccessPaths().config });

package/scripts/install-native-relay.mjs

@@ -17,7 +17,7 @@ import {
   spawnEnv,
 } from "../src/platform.mjs";
 import { exitForVersionRequest } from "../src/cli-version.mjs";
-import { applyStdioMcpRegistration, stdioMcpRegistration } from "../src/codex-mcp-registration.mjs";
+import { applyStdioMcpRegistration, readCodexMcpServer, stdioMcpRegistration } from "../src/codex-mcp-registration.mjs";
 import { createReleaseSnapshot, snapshotRoot } from "../src/release-snapshot.mjs";
 import { codexAccessPaths, enableCodexFullAccess, fullAccessEnabled } from "../src/codex-full-access.mjs";
 import { stableInstallPath } from "../src/install-paths.mjs";
@@ -25,7 +25,7 @@ import { removeRelayFile } from "../src/native-relay-files.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.8";
+const VERSION = "1.26.10";
 const root = stableInstallPath(path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."));
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];
@@ -69,10 +69,7 @@ if (!IS_MACOS && !IS_WINDOWS) {
   console.log("claude-bridge will keep using the app-server path here.");
 }
 
-const servers = JSON.parse(run(["mcp", "list", "--json"]));
-if (!Array.isArray(servers)) throw new Error("Codex returned an invalid MCP inventory; existing configuration was not changed");
-const existingServer = servers.some((server) => server.name === serverName)
-  ? JSON.parse(run(["mcp", "get", serverName, "--json"])) : null;
+const existingServer = readCodexMcpServer(run, serverName);
 /**
  * Registering under whichever Node happens to run this installer is what made
  * the companion unreachable on macOS: Codex Desktop rejects a peer whose
@@ -105,7 +102,7 @@ if (runtime.source === "process.execPath" && hasCodexDesktopApp()) {
   console.log("runtime shipped inside Codex Desktop if that happens.");
 }
 console.log(`registered MCP server "${serverName}" with Codex (${applied.mode === "retarget" ? "existing entry retargeted in place; its other settings were kept" : "codex mcp add"}):`);
-console.log(run(["mcp", "get", serverName]));
+if (!process.argv.includes("--setup")) console.log(run(["mcp", "get", serverName]));
 if (applied.notice) console.log(`NOTE: ${applied.notice}`);
 else if (ensureEnvVars.length) console.log(`env_vars includes ${ensureEnvVars.join(", ")}; the temporary pipe path itself is never saved.`);
 

package/scripts/setup.mjs

@@ -4,7 +4,8 @@ import { printSetup, runSetup, setupFailureResult } from "../src/setup.mjs";
 
 exitForVersionRequest(import.meta.url);
 try {
-  const result = runSetup({ args: process.argv.slice(2) });
+  const onProgress = process.argv.includes("--progress") ? (step) => process.stderr.write(`setup-progress: ${step}\n`) : undefined;
+  const result = runSetup({ args: process.argv.slice(2), onProgress });
   printSetup(result, { json: process.argv.includes("--json") });
   if (result.configured === false && !result.dryRun) process.exitCode = 1;
 } catch (error) {

package/scripts/update.mjs

@@ -65,9 +65,18 @@ export function resolveUpdateNpm(env = process.env) {
   throw failure("UPDATE_NPM_NOT_FOUND", "A supported npm CLI could not be located. Run this updater through npm exec.", "preflight");
 }
 
-function execute(command, args, options) {
+const SETUP_PROGRESS = /^setup-progress: ([^\u0000-\u001f\u007f]{1,120})$/;
+
+function execute(command, args, { onStderrLine, ...options }) {
   return new Promise(resolve => {
-    execFile(command, args, options, (error, stdout, stderr) => resolve({ status: error ? 1 : 0, error, stdout, stderr }));
+    const child = execFile(command, args, options, (error, stdout, stderr) => resolve({ status: error ? 1 : 0, error, stdout, stderr }));
+    if (!onStderrLine || !child.stderr) return;
+    let pending = "";
+    child.stderr.on("data", chunk => {
+      const lines = (pending + chunk).split(/\r?\n/);
+      pending = lines.pop();
+      for (const line of lines) onStderrLine(line);
+    });
   });
 }
 
@@ -141,11 +150,11 @@ export async function runUpdate({ args = [], env = process.env, platform = proce
   const prefixArgs = userPrefix ? ["--prefix", userPrefix] : [];
   let cwd = neutralDirectory([root], env);
   let childEnv = Object.fromEntries(Object.entries(env).filter(([name]) => !/^AGENT_RELAY_(?!DIRECTORY$)/i.test(name)));
-  const command = async (arguments_, phase, timeout = 600000, environment = childEnv, setupCommand = false) => {
+  const command = async (arguments_, phase, timeout = 600000, environment = childEnv, setupCommand = false, onStderrLine) => {
     let result;
     try {
       result = await run(process.execPath, arguments_, { env: environment, cwd, encoding: "utf8", windowsHide: true,
-        shell: false, timeout, maxBuffer: 8 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] });
+        shell: false, timeout, maxBuffer: 8 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"], ...(onStderrLine ? { onStderrLine } : {}) });
     } catch (error) { throw childFailure({ error, stdout: error.stdout, stderr: error.stderr }, phase, setupCommand); }
     if (result?.error || (result?.status ?? result?.exitCode ?? 0) !== 0) throw childFailure(result, phase, setupCommand);
     return String(result?.stdout ?? "");
@@ -203,15 +212,15 @@ export async function runUpdate({ args = [], env = process.env, platform = proce
   await command([npm, "install", "--global", "--prefix", prefix, `${PACKAGE}@${version}`, "--ignore-scripts"],
     "installation", 600000, { ...childEnv, CODEX_BRIDGE_SKIP_SETUP: "1" });
   if (packageVersion(globalRoot) !== version) throw failure("UPDATE_VERSION_MISMATCH", "The global package version does not match the updater version. Rerun the same update command.", "verification");
-  for (const check of [false, true]) {
-    onProgress(check ? "Verifying the global bridge settings and owned relay runtime." : "Applying managed settings from the installed bridge.");
-    let setup;
-    try { setup = JSON.parse(await command([path.join(globalRoot, "scripts", "setup.mjs"), ...(check ? ["--check"] : []), "--json"], "verification", 600000, childEnv, true)); }
-    catch (error) { if (error?.code) throw error; throw failure("UPDATE_SETUP_INCOMPLETE", `Global setup did not return a verifiable result. ${SETUP_INSPECTION} ${RETRY}`, "verification"); }
-    if (setup?.configured !== true) throw failure("UPDATE_SETUP_INCOMPLETE", `The global bridge settings are incomplete. ${setupFailureSummary(setup) ?? SETUP_INSPECTION} ${RETRY}`, "verification");
-  }
+  onProgress("Applying and verifying managed settings from the installed bridge. Each step can take up to a minute while Codex CLI reads its configuration.");
+  const setupProgress = line => { const step = SETUP_PROGRESS.exec(line)?.[1]; if (step) onProgress(`  ${step}`); };
+  let setup;
+  try { setup = JSON.parse(await command([path.join(globalRoot, "scripts", "setup.mjs"), "--json", "--progress"], "verification", 600000, childEnv, true, setupProgress)); }
+  catch (error) { if (error?.code) throw error; throw failure("UPDATE_SETUP_INCOMPLETE", `Global setup did not return a verifiable result. ${SETUP_INSPECTION} ${RETRY}`, "verification"); }
+  if (setup?.configured !== true) throw failure("UPDATE_SETUP_INCOMPLETE", `The global bridge settings are incomplete. ${setupFailureSummary(setup) ?? SETUP_INSPECTION} ${RETRY}`, "verification");
+  onProgress("Verifying the owned relay runtime.");
   const service = await awaitService(globalRoot, false, "verification");
-  return { updated: true, configured: true, version, previousVersion, migrated, service, opensApps: false, opensChats: false };
+  return { updated: true, configured: true, version, previousVersion, migrated, service, desktopConnectionsVerified: false, opensApps: false, opensChats: false };
 }
 
 export async function runUpdateCli(args = process.argv.slice(2)) {
@@ -219,7 +228,7 @@ export async function runUpdateCli(args = process.argv.slice(2)) {
     process.chdir(neutralDirectory([ROOT], process.env));
     const result = await runUpdate({ args, onProgress: message => process.stderr.write(`${message}\n`) });
     process.stdout.write(result.help ? `${result.help}\n` : args.includes("--json") ? `${JSON.stringify(result, null, 2)}\n`
-      : `Bridge ${result.version} updated; managed settings verified. Background relay ${result.service.ready ? "ready" : "remains intentionally disabled"}.\n`);
+      : `Bridge ${result.version} updated; managed settings verified. Background relay ${result.service.ready ? "ready" : "remains intentionally disabled"}.\nDesktop connections have not been verified. Check codex_bridge_status, claude_bridge_status and antigravity_bridge_status in the existing apps.\n`);
   } catch (error) {
     const options = { component: "bridge-update", operation: "update", deliveryState: "not_applicable" };
     if (args.includes("--json")) process.stdout.write(JSON.stringify({ updated: false, pending: error.pending === true, diagnostic: bridgeDiagnostic(error, options) }, null, 2) + "\n");

package/src/antigravity-bridge.mjs

@@ -7,9 +7,11 @@ import { z } from "zod";
 import { resolveCodexSenderContext } from "./codex-sender-context.mjs";
 import { readClaudeSenderContext, requireClaudeSenderContext, stopProcessInspectors } from "./claude-sender-context.mjs";
 import { readClaudeAccountContext } from "./desktop-account-context.mjs";
+import { readCodexAccountContext } from "./codex-account-context.mjs";
 import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 import { antigravityBridgeDirectory, callAntigravityDesktop } from "./antigravity-ipc.mjs";
 import { AntigravityDeliveries, antigravityDeliveryError } from "./antigravity-deliveries.mjs";
+import { observeAntigravityDelivery } from "./antigravity-desktop.mjs";
 import { AntigravityCliSession } from "./antigravity-cli.mjs";
 import { exitForVersionRequest } from "./cli-version.mjs";
 import { NativeDesktopRelay, desktopTaskSocketPath, accountRelaySocketPath } from "./native-relay.mjs";
@@ -45,6 +47,7 @@ const reload = createReloadControl({
 
 async function identifySender(extra) {
   if (caller === "codex") {
+    const account = readCodexAccountContext();
     const context = await resolveCodexSenderContext(extra?._meta, { inspectDesktopTask: async (threadId) => {
       const accounts = requireBridgeAccounts(readBridgeAccounts());
       const { result } = await senderRelay.requestDesktop("read_thread", { threadId, hostId: "local", turnLimit: 1, includeOutputs: false, maxOutputCharsPerItem: 1 }, { accountContext: accounts, beforeSend: () => assertAccountIdentity(accounts) });
@@ -52,11 +55,16 @@ async function identifySender(extra) {
       return { thread: result?.thread, latestTurnId: result?.turns?.[0]?.id ?? null };
     } });
     if (context.status !== "verified") throw new Error(context.reason ?? "Unverified Codex sender");
-    return { provider: "codex", id: context.threadId, cwd: context.cwd };
+    const current = readCodexAccountContext();
+    if (account.status !== "verified" || current.status !== "verified" || !/^[a-f0-9]{64}$/.test(account.fingerprint ?? "")) throw new Error("The calling Codex account is not verified");
+    if (current.fingerprint !== account.fingerprint) throw new Error("The calling Codex account changed during sender verification");
+    return { provider: "codex", id: context.threadId, cwd: context.cwd, accountFingerprint: account.fingerprint };
   }
   if (caller === "claude") {
     const context = requireClaudeSenderContext(await readClaudeSenderContext({ account: readClaudeAccountContext() }));
-    return { provider: "claude", id: context.sessionId, cwd: context.cwd };
+    const current = readClaudeAccountContext();
+    if (current.status !== "verified" || !/^[a-f0-9]{64}$/.test(context.accountFingerprint ?? "") || current.fingerprint !== context.accountFingerprint) throw new Error("The calling Claude account changed during sender verification");
+    return { provider: "claude", id: context.sessionId, cwd: context.cwd, accountFingerprint: context.accountFingerprint };
   }
   throw new Error("Install this bridge for Codex or Claude; unknown callers cannot read conversations or send work");
 }
@@ -89,10 +97,25 @@ function sameCwd(expected, actual) {
 
 function owns(record, identity) {
   if (!record || record.sender?.provider !== identity.provider || record.sender?.id !== identity.id) throw preflightFailure("ANTIGRAVITY_RECEIPT_OWNER_MISMATCH", "Delivery does not belong to this sending conversation");
+  if (Object.hasOwn(record.sender, "accountFingerprint") && record.sender.accountFingerprint !== identity.accountFingerprint) throw preflightFailure("ANTIGRAVITY_RECEIPT_ACCOUNT_MISMATCH", "Delivery does not belong to the currently signed-in sending account");
   sameCwd(identity.cwd, record.cwd);
   return record;
 }
 
+function sameSender(left, right) {
+  return left?.provider === right?.provider && left?.id === right?.id && left?.accountFingerprint === right?.accountFingerprint;
+}
+
+function accountUnboundReceipt(record) {
+  const recovered = record.status === "reply_received" || record.result?.status === "reply_received" || record.replyObservation?.status === "reply_received";
+  const status = recovered ? "unknown" : record.status;
+  const { response, reply, ...originalResult } = record.result ?? {};
+  return { ...record, status,
+    result: recovered ? { conversationId: record.conversationId, surface: "desktop", status, completed: false } : originalResult,
+    replyObservation: { status: "unavailable", code: "ANTIGRAVITY_RECEIPT_ACCOUNT_UNBOUND", source: "native-transcript", retrySafe: false,
+      reason: "The original delivery did not record its sending account. Recovered reply text is withheld; retain the original receipt and do not resend." } };
+}
+
 function handoff(prompt, identity) {
   return `[Agent handoff from ${identity.provider} conversation ${identity.id}. Native Antigravity permissions remain in effect.]\n\n${prompt}`;
 }
@@ -146,7 +169,7 @@ register("list_antigravity_conversations", "List native Desktop conversations an
   const identity = await sender(extra);
   const records = surface === "desktop" ? await callAntigravityDesktop({ operation: "list" }) : [...sessions.values()].map((entry) => ({ ...entry.session.read(), sender: entry.sender }));
   return records.filter((record) => {
-    try { sameCwd(identity.cwd, record.cwd); return surface !== "cli" || record.sender.id === identity.id && record.sender.provider === identity.provider; }
+    try { sameCwd(identity.cwd, record.cwd); return surface !== "cli" || sameSender(record.sender, identity); }
     catch { return false; }
   });
 });
@@ -156,14 +179,26 @@ register("send_to_antigravity_conversation", "Send one authorized prompt to an e
   const cwd = sameCwd(identity.cwd, args.cwd);
   const prompt = handoff(args.prompt, identity);
   if (args.surface === "desktop" && (prompt.length > 30000 || prompt.includes("\0"))) throw preflightFailure("ANTIGRAVITY_PROMPT_INVALID", "Desktop handoff must fit within 30000 characters and contain no NUL");
-  if (args.surface === "desktop") return callAntigravityDesktop({ operation: "send", ...args, cwd, prompt, sender: identity });
+  if (args.surface === "desktop") {
+    const receipt = await callAntigravityDesktop({ operation: "send", ...args, cwd, prompt, sender: identity });
+    try {
+      const current = await sender(extra);
+      if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed while inspecting the native delivery receipt");
+      owns(receipt, current);
+      return Object.hasOwn(receipt.sender, "accountFingerprint") ? receipt : accountUnboundReceipt(receipt);
+    } catch (error) {
+      error.phase = "receipt";
+      error.deliveryState = "unknown";
+      throw error;
+    }
+  }
   const entry = sessions.get(args.conversationId);
-  if (!entry || entry.sender.id !== identity.id || entry.sender.provider !== identity.provider) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender and bridge process");
+  if (!entry || !sameSender(entry.sender, identity)) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender and bridge process");
   sameCwd(cwd, entry.session.read().cwd);
   return deliveries.dispatch({ ...args, cwd, sender: identity, prompt }, async () => {
     const current = await sender(extra);
     sameCwd(cwd, current.cwd);
-    if (current.id !== identity.id) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
+    if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
     return entry.session.send(prompt);
   }, { component: "antigravity-bridge", operation: "send_to_antigravity_conversation" });
 });
@@ -188,7 +223,7 @@ register("start_antigravity_cli_session", "Create a new bridge-owned Antigravity
       reserved = false;
       const current = await sender(extra);
       sameCwd(cwd, current.cwd);
-      if (current.id !== identity.id) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
+      if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
       sending = true;
       return await session.send(handoff(args.prompt, identity));
     } catch (error) {
@@ -208,16 +243,21 @@ register("start_antigravity_cli_session", "Create a new bridge-owned Antigravity
   }, { component: "antigravity-bridge", operation: "start_antigravity_cli_session" });
 });
 
-register("read_antigravity_delivery", "Read the original receipt without resending. Desktop accepted means the native API accepted it, not that the agent completed a turn.", { surface: z.enum(["desktop", "cli"]), requestId: z.string().uuid() }, true, async (args, extra) => {
+register("read_antigravity_delivery", "Read the original receipt without resending. Desktop accepted means native acceptance; reply_received requires a final reply correlated to the original message and execution.", { surface: z.enum(["desktop", "cli"]), requestId: z.string().uuid() }, true, async (args, extra) => {
   const identity = await sender(extra);
   const record = args.surface === "desktop" ? await callAntigravityDesktop({ operation: "receipt", requestId: args.requestId }) : deliveries.read(args.requestId);
-  return owns(record, identity);
+  owns(record, identity);
+  if (args.surface !== "desktop") return record;
+  const observed = Object.hasOwn(record.sender, "accountFingerprint") ? await observeAntigravityDelivery(record) : accountUnboundReceipt(record);
+  const current = await sender(extra);
+  if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed while inspecting the original delivery");
+  return owns(observed, current);
 });
 
 register("close_antigravity_cli_session", "Close an idle bridge-owned CLI session belonging to the caller.", { conversationId: z.string().uuid() }, false, async ({ conversationId }, extra) => {
   const identity = await sender(extra);
   const entry = sessions.get(conversationId);
-  if (!entry || entry.sender.id !== identity.id || entry.sender.provider !== identity.provider) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender");
+  if (!entry || !sameSender(entry.sender, identity)) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender");
   sameCwd(identity.cwd, entry.session.read().cwd);
   if (["running", "starting"].includes(entry.session.read().status)) throw preflightFailure("ANTIGRAVITY_SESSION_BUSY", "Wait for the active CLI delivery before closing");
   const closed = await entry.session.close();

package/src/antigravity-deliveries.mjs

@@ -64,6 +64,29 @@ export class AntigravityDeliveries {
     this.write(record);
   }
 
+  captureObservation(requestId, observation) {
+    if (!this.active.has(requestId)) throw new Error("Cannot prepare inactive delivery observation");
+    if (observation?.version !== 1 || !["ready", "unavailable"].includes(observation.status)
+        || !/^[a-f0-9]{64}$/.test(observation.promptSha256 ?? "") || typeof observation.projectId !== "string"
+        || observation.status === "ready" && (!UUID.test(observation.trajectoryId ?? "") || !Number.isSafeInteger(observation.beforeStepIndex) || observation.beforeStepIndex < -1)) throw new Error("Invalid native observation boundary");
+    const record = this.read(requestId);
+    record.nativeObservation = { version: 1, status: observation.status, promptSha256: observation.promptSha256, projectId: observation.projectId,
+      ...(observation.status === "ready" ? { trajectoryId: observation.trajectoryId, beforeStepIndex: observation.beforeStepIndex } : { code: "ANTIGRAVITY_TRANSCRIPT_UNAVAILABLE" }) };
+    this.write(record);
+  }
+
+  async refresh(requestId, observe) {
+    const record = this.read(requestId);
+    if (!record || this.active.has(requestId)) return record;
+    const refreshed = await observe(record);
+    if (!refreshed || refreshed.requestId !== record.requestId || refreshed.digest !== record.digest || refreshed.cwd !== record.cwd
+        || refreshed.conversationId !== record.conversationId || refreshed.surface !== record.surface || JSON.stringify(refreshed.sender) !== JSON.stringify(record.sender)) throw new Error("Observation changed the delivery identity");
+    const current = this.read(requestId);
+    if (this.active.has(requestId) || JSON.stringify(current) !== JSON.stringify(record)) return current;
+    if (refreshed.status === "reply_received") this.write(refreshed);
+    return refreshed;
+  }
+
   write(record) {
     const temporary = `${this.file(record.requestId)}.${process.pid}.tmp`;
     fs.writeFileSync(temporary, JSON.stringify(record), { flag: "wx", mode: 0o600 });
@@ -91,7 +114,7 @@ export class AntigravityDeliveries {
     }
     this.active.add(requestId);
     void Promise.resolve().then(operation).then((result) => {
-      record.status = ["accepted", "sent_unconfirmed", "held", "refused"].includes(result?.status) ? result.status : result?.status && result.status !== "SUCCESS" ? "failed" : "completed";
+      record.status = ["accepted", "sent_unconfirmed", "held", "refused", "reply_received"].includes(result?.status) ? result.status : result?.status && result.status !== "SUCCESS" ? "failed" : "completed";
       record.result = result;
       record.conversationId = result?.conversationId ?? result?.conversation_id ?? record.conversationId;
       if (record.status === "failed") {
@@ -107,7 +130,9 @@ export class AntigravityDeliveries {
     }).finally(() => {
       record.finishedAt = new Date().toISOString();
       try {
-        record.conversationId ??= this.read(requestId)?.conversationId;
+        const previous = this.read(requestId);
+        record.conversationId ??= previous?.conversationId;
+        record.nativeObservation ??= previous?.nativeObservation;
         this.write(record);
       } catch (error) { process.stderr.write(`Could not persist Antigravity delivery outcome: ${error.code ?? "WRITE_FAILED"}\n`); }
       this.active.delete(requestId);