@minhspark/codex-mcp-bridge 1.26.9 → 1.26.10

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-mcp-bridge",
-  "version": "1.26.9",
+  "version": "1.26.10",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh"

package/CHANGELOG.md

@@ -4,6 +4,31 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.26.10] - 2026-11-03
+
+### Fixed
+
+- Recover Claude replies whose native ancestry passes through a verified Monitor notification. Preserve outstanding background work and reject unrelated or malformed notifications. Pending-delivery diagnostics now retain the original message ID and direct callers to its receipt without suggesting a duplicate send.
+- Observe Antigravity Desktop replies through a bounded, read-only native transcript adapter. New deliveries retain a pre-send boundary and prompt hash; completion requires the exact original message, execution, public final response and idle conversation. Unsupported schemas, interleaved messages and ambiguous matches remain unconfirmed. Reply reads retain sender, account and project isolation.
+- Migrate pending Claude transcript observations during future worker updates only after a unique native message proves acceptance. Held and unobserved deliveries keep their locks and defer reload, preserving their original reply channel.
+- Resolve Codex CLI candidates from the worker's actual environment, skip incomplete version directories and retry read-only inspection once if an unpinned executable disappears during an app update. Explicit executable selections, authentication failures and real jobs are never retried or silently redirected.
+- Report background relay readiness separately from unverified Desktop connections after updating. A ready background worker does not establish a live native Desktop relay.
+- Reject malformed transcript session identifiers before composing filesystem paths, and validate executable candidates before inspecting their file type. Configured external executable locations remain supported.
+
+### Verification and limits
+
+- Regression coverage includes Monitor ancestry, pending receipt ownership, reload safety, exact native reply correlation, account changes and CLI replacement races. Historical native transcripts confirmed both reply-observation failures without resending their prompts.
+- An already-running older worker can still defer its own upgrade while a receipt is pending. Preserve that receipt and any verified historical result before reconnecting its MCP client; a missing receipt after reconnecting is not evidence of non-delivery. Legacy Antigravity receipts without the original account binding cannot disclose recovered reply text.
+- A Desktop relay exiting on another machine still requires that machine's MCP host log and shutdown reason. This release does not infer an idle-chat cause or replace Desktop delivery with a CLI worker.
+
+### Upgrade
+
+```powershell
+npx.cmd -y @minhspark/codex-mcp-bridge@latest
+```
+
+For noninteractive Windows updates, use `codex-bridge-update --user`. Reconnect affected existing MCP clients after active work finishes, then check their status tools. The global installation path remains available with `npm install -g @minhspark/codex-mcp-bridge@latest --allow-scripts=@minhspark/codex-mcp-bridge --foreground-scripts`.
+
 ## [1.26.9] - 2026-11-03
 
 ### Fixed

package/docs/daily-handoffs.md

@@ -82,6 +82,12 @@ new task, account, process, prompt and directory to match.
    turn. The exact dispatch must occur after the saved watermark, and commentary
    alone is never a final reply. Receipt observation resolves that exact dispatch
    even after newer turns start; it does not substitute the latest turn's answer.
+   For Antigravity Desktop, retain `requestId` and use
+   `read_antigravity_delivery`. `accepted` confirms only native acceptance;
+   `reply_received` requires an exact native message and execution with a public
+   final reply. Unsupported transcript formats or ambiguous interleaving keep
+   the delivery unconfirmed. Receipts without their original account binding
+   cannot disclose recovered reply text. None of these states authorizes a resend.
 5. An `interrupted` receipt ends observation only: task outcome is unknown and
    background work may continue. Inspect the existing task before a scoped
    follow-up; do not repeat card creation or file operations.
@@ -113,6 +119,18 @@ defer hot reload. Save the original receipt and any verified historical reply
 before reconnecting. An unknown ID after reconnecting is not evidence of
 non-delivery. Verify recovery with one harmless message, not by resending work.
 
+Updated workers can transfer a pending Claude transcript observation only when
+the exact native message has already been observed. Held or unobserved deliveries
+retain their original callback channel and continue to defer reload. Installing
+new code cannot change the migration behavior of an already-running old worker.
+
+Updater success verifies managed settings and the background relay separately
+from Desktop connectivity. Check `codex_bridge_status`, `claude_bridge_status`
+and `antigravity_bridge_status` in the existing clients. If a native companion
+starts and then exits, retain its MCP host stderr and shutdown reason. A missing
+relay pipe alone does not identify the cause; do not infer that an empty chat or
+a dummy prompt is required to keep it alive.
+
 Card revocation and communication revocation are independent. Archiving a
 conversation does not guarantee worktree/branch removal. Check running work,
 uncommitted files and unique commits before cleanup; preserve configuration,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.26.9",
+  "version": "1.26.10",
   "description": "Connect Claude, Codex, and Antigravity through MCP, with native Desktop handoffs and bridge-owned Antigravity CLI sessions.",
   "keywords": [
     "mcp",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "codex-mcp-bridge",
-  "version": "1.26.9",
+  "version": "1.26.10",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh",

package/scripts/install-native-relay.mjs

@@ -25,7 +25,7 @@ import { removeRelayFile } from "../src/native-relay-files.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.9";
+const VERSION = "1.26.10";
 const root = stableInstallPath(path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."));
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/scripts/update.mjs

@@ -220,7 +220,7 @@ export async function runUpdate({ args = [], env = process.env, platform = proce
   if (setup?.configured !== true) throw failure("UPDATE_SETUP_INCOMPLETE", `The global bridge settings are incomplete. ${setupFailureSummary(setup) ?? SETUP_INSPECTION} ${RETRY}`, "verification");
   onProgress("Verifying the owned relay runtime.");
   const service = await awaitService(globalRoot, false, "verification");
-  return { updated: true, configured: true, version, previousVersion, migrated, service, opensApps: false, opensChats: false };
+  return { updated: true, configured: true, version, previousVersion, migrated, service, desktopConnectionsVerified: false, opensApps: false, opensChats: false };
 }
 
 export async function runUpdateCli(args = process.argv.slice(2)) {
@@ -228,7 +228,7 @@ export async function runUpdateCli(args = process.argv.slice(2)) {
     process.chdir(neutralDirectory([ROOT], process.env));
     const result = await runUpdate({ args, onProgress: message => process.stderr.write(`${message}\n`) });
     process.stdout.write(result.help ? `${result.help}\n` : args.includes("--json") ? `${JSON.stringify(result, null, 2)}\n`
-      : `Bridge ${result.version} updated; managed settings verified. Background relay ${result.service.ready ? "ready" : "remains intentionally disabled"}.\n`);
+      : `Bridge ${result.version} updated; managed settings verified. Background relay ${result.service.ready ? "ready" : "remains intentionally disabled"}.\nDesktop connections have not been verified. Check codex_bridge_status, claude_bridge_status and antigravity_bridge_status in the existing apps.\n`);
   } catch (error) {
     const options = { component: "bridge-update", operation: "update", deliveryState: "not_applicable" };
     if (args.includes("--json")) process.stdout.write(JSON.stringify({ updated: false, pending: error.pending === true, diagnostic: bridgeDiagnostic(error, options) }, null, 2) + "\n");

package/src/antigravity-bridge.mjs

@@ -7,9 +7,11 @@ import { z } from "zod";
 import { resolveCodexSenderContext } from "./codex-sender-context.mjs";
 import { readClaudeSenderContext, requireClaudeSenderContext, stopProcessInspectors } from "./claude-sender-context.mjs";
 import { readClaudeAccountContext } from "./desktop-account-context.mjs";
+import { readCodexAccountContext } from "./codex-account-context.mjs";
 import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
 import { antigravityBridgeDirectory, callAntigravityDesktop } from "./antigravity-ipc.mjs";
 import { AntigravityDeliveries, antigravityDeliveryError } from "./antigravity-deliveries.mjs";
+import { observeAntigravityDelivery } from "./antigravity-desktop.mjs";
 import { AntigravityCliSession } from "./antigravity-cli.mjs";
 import { exitForVersionRequest } from "./cli-version.mjs";
 import { NativeDesktopRelay, desktopTaskSocketPath, accountRelaySocketPath } from "./native-relay.mjs";
@@ -45,6 +47,7 @@ const reload = createReloadControl({
 
 async function identifySender(extra) {
   if (caller === "codex") {
+    const account = readCodexAccountContext();
     const context = await resolveCodexSenderContext(extra?._meta, { inspectDesktopTask: async (threadId) => {
       const accounts = requireBridgeAccounts(readBridgeAccounts());
       const { result } = await senderRelay.requestDesktop("read_thread", { threadId, hostId: "local", turnLimit: 1, includeOutputs: false, maxOutputCharsPerItem: 1 }, { accountContext: accounts, beforeSend: () => assertAccountIdentity(accounts) });
@@ -52,11 +55,16 @@ async function identifySender(extra) {
       return { thread: result?.thread, latestTurnId: result?.turns?.[0]?.id ?? null };
     } });
     if (context.status !== "verified") throw new Error(context.reason ?? "Unverified Codex sender");
-    return { provider: "codex", id: context.threadId, cwd: context.cwd };
+    const current = readCodexAccountContext();
+    if (account.status !== "verified" || current.status !== "verified" || !/^[a-f0-9]{64}$/.test(account.fingerprint ?? "")) throw new Error("The calling Codex account is not verified");
+    if (current.fingerprint !== account.fingerprint) throw new Error("The calling Codex account changed during sender verification");
+    return { provider: "codex", id: context.threadId, cwd: context.cwd, accountFingerprint: account.fingerprint };
   }
   if (caller === "claude") {
     const context = requireClaudeSenderContext(await readClaudeSenderContext({ account: readClaudeAccountContext() }));
-    return { provider: "claude", id: context.sessionId, cwd: context.cwd };
+    const current = readClaudeAccountContext();
+    if (current.status !== "verified" || !/^[a-f0-9]{64}$/.test(context.accountFingerprint ?? "") || current.fingerprint !== context.accountFingerprint) throw new Error("The calling Claude account changed during sender verification");
+    return { provider: "claude", id: context.sessionId, cwd: context.cwd, accountFingerprint: context.accountFingerprint };
   }
   throw new Error("Install this bridge for Codex or Claude; unknown callers cannot read conversations or send work");
 }
@@ -89,10 +97,25 @@ function sameCwd(expected, actual) {
 
 function owns(record, identity) {
   if (!record || record.sender?.provider !== identity.provider || record.sender?.id !== identity.id) throw preflightFailure("ANTIGRAVITY_RECEIPT_OWNER_MISMATCH", "Delivery does not belong to this sending conversation");
+  if (Object.hasOwn(record.sender, "accountFingerprint") && record.sender.accountFingerprint !== identity.accountFingerprint) throw preflightFailure("ANTIGRAVITY_RECEIPT_ACCOUNT_MISMATCH", "Delivery does not belong to the currently signed-in sending account");
   sameCwd(identity.cwd, record.cwd);
   return record;
 }
 
+function sameSender(left, right) {
+  return left?.provider === right?.provider && left?.id === right?.id && left?.accountFingerprint === right?.accountFingerprint;
+}
+
+function accountUnboundReceipt(record) {
+  const recovered = record.status === "reply_received" || record.result?.status === "reply_received" || record.replyObservation?.status === "reply_received";
+  const status = recovered ? "unknown" : record.status;
+  const { response, reply, ...originalResult } = record.result ?? {};
+  return { ...record, status,
+    result: recovered ? { conversationId: record.conversationId, surface: "desktop", status, completed: false } : originalResult,
+    replyObservation: { status: "unavailable", code: "ANTIGRAVITY_RECEIPT_ACCOUNT_UNBOUND", source: "native-transcript", retrySafe: false,
+      reason: "The original delivery did not record its sending account. Recovered reply text is withheld; retain the original receipt and do not resend." } };
+}
+
 function handoff(prompt, identity) {
   return `[Agent handoff from ${identity.provider} conversation ${identity.id}. Native Antigravity permissions remain in effect.]\n\n${prompt}`;
 }
@@ -146,7 +169,7 @@ register("list_antigravity_conversations", "List native Desktop conversations an
   const identity = await sender(extra);
   const records = surface === "desktop" ? await callAntigravityDesktop({ operation: "list" }) : [...sessions.values()].map((entry) => ({ ...entry.session.read(), sender: entry.sender }));
   return records.filter((record) => {
-    try { sameCwd(identity.cwd, record.cwd); return surface !== "cli" || record.sender.id === identity.id && record.sender.provider === identity.provider; }
+    try { sameCwd(identity.cwd, record.cwd); return surface !== "cli" || sameSender(record.sender, identity); }
     catch { return false; }
   });
 });
@@ -156,14 +179,26 @@ register("send_to_antigravity_conversation", "Send one authorized prompt to an e
   const cwd = sameCwd(identity.cwd, args.cwd);
   const prompt = handoff(args.prompt, identity);
   if (args.surface === "desktop" && (prompt.length > 30000 || prompt.includes("\0"))) throw preflightFailure("ANTIGRAVITY_PROMPT_INVALID", "Desktop handoff must fit within 30000 characters and contain no NUL");
-  if (args.surface === "desktop") return callAntigravityDesktop({ operation: "send", ...args, cwd, prompt, sender: identity });
+  if (args.surface === "desktop") {
+    const receipt = await callAntigravityDesktop({ operation: "send", ...args, cwd, prompt, sender: identity });
+    try {
+      const current = await sender(extra);
+      if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed while inspecting the native delivery receipt");
+      owns(receipt, current);
+      return Object.hasOwn(receipt.sender, "accountFingerprint") ? receipt : accountUnboundReceipt(receipt);
+    } catch (error) {
+      error.phase = "receipt";
+      error.deliveryState = "unknown";
+      throw error;
+    }
+  }
   const entry = sessions.get(args.conversationId);
-  if (!entry || entry.sender.id !== identity.id || entry.sender.provider !== identity.provider) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender and bridge process");
+  if (!entry || !sameSender(entry.sender, identity)) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender and bridge process");
   sameCwd(cwd, entry.session.read().cwd);
   return deliveries.dispatch({ ...args, cwd, sender: identity, prompt }, async () => {
     const current = await sender(extra);
     sameCwd(cwd, current.cwd);
-    if (current.id !== identity.id) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
+    if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
     return entry.session.send(prompt);
   }, { component: "antigravity-bridge", operation: "send_to_antigravity_conversation" });
 });
@@ -188,7 +223,7 @@ register("start_antigravity_cli_session", "Create a new bridge-owned Antigravity
       reserved = false;
       const current = await sender(extra);
       sameCwd(cwd, current.cwd);
-      if (current.id !== identity.id) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
+      if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed before delivery");
       sending = true;
       return await session.send(handoff(args.prompt, identity));
     } catch (error) {
@@ -208,16 +243,21 @@ register("start_antigravity_cli_session", "Create a new bridge-owned Antigravity
   }, { component: "antigravity-bridge", operation: "start_antigravity_cli_session" });
 });
 
-register("read_antigravity_delivery", "Read the original receipt without resending. Desktop accepted means the native API accepted it, not that the agent completed a turn.", { surface: z.enum(["desktop", "cli"]), requestId: z.string().uuid() }, true, async (args, extra) => {
+register("read_antigravity_delivery", "Read the original receipt without resending. Desktop accepted means native acceptance; reply_received requires a final reply correlated to the original message and execution.", { surface: z.enum(["desktop", "cli"]), requestId: z.string().uuid() }, true, async (args, extra) => {
   const identity = await sender(extra);
   const record = args.surface === "desktop" ? await callAntigravityDesktop({ operation: "receipt", requestId: args.requestId }) : deliveries.read(args.requestId);
-  return owns(record, identity);
+  owns(record, identity);
+  if (args.surface !== "desktop") return record;
+  const observed = Object.hasOwn(record.sender, "accountFingerprint") ? await observeAntigravityDelivery(record) : accountUnboundReceipt(record);
+  const current = await sender(extra);
+  if (!sameSender(current, identity)) throw preflightFailure("ANTIGRAVITY_SENDER_CHANGED", "Sender changed while inspecting the original delivery");
+  return owns(observed, current);
 });
 
 register("close_antigravity_cli_session", "Close an idle bridge-owned CLI session belonging to the caller.", { conversationId: z.string().uuid() }, false, async ({ conversationId }, extra) => {
   const identity = await sender(extra);
   const entry = sessions.get(conversationId);
-  if (!entry || entry.sender.id !== identity.id || entry.sender.provider !== identity.provider) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender");
+  if (!entry || !sameSender(entry.sender, identity)) throw preflightFailure("ANTIGRAVITY_SESSION_OWNER_MISMATCH", "CLI session is not owned by this sender");
   sameCwd(identity.cwd, entry.session.read().cwd);
   if (["running", "starting"].includes(entry.session.read().status)) throw preflightFailure("ANTIGRAVITY_SESSION_BUSY", "Wait for the active CLI delivery before closing");
   const closed = await entry.session.close();

package/src/antigravity-deliveries.mjs

@@ -64,6 +64,29 @@ export class AntigravityDeliveries {
     this.write(record);
   }
 
+  captureObservation(requestId, observation) {
+    if (!this.active.has(requestId)) throw new Error("Cannot prepare inactive delivery observation");
+    if (observation?.version !== 1 || !["ready", "unavailable"].includes(observation.status)
+        || !/^[a-f0-9]{64}$/.test(observation.promptSha256 ?? "") || typeof observation.projectId !== "string"
+        || observation.status === "ready" && (!UUID.test(observation.trajectoryId ?? "") || !Number.isSafeInteger(observation.beforeStepIndex) || observation.beforeStepIndex < -1)) throw new Error("Invalid native observation boundary");
+    const record = this.read(requestId);
+    record.nativeObservation = { version: 1, status: observation.status, promptSha256: observation.promptSha256, projectId: observation.projectId,
+      ...(observation.status === "ready" ? { trajectoryId: observation.trajectoryId, beforeStepIndex: observation.beforeStepIndex } : { code: "ANTIGRAVITY_TRANSCRIPT_UNAVAILABLE" }) };
+    this.write(record);
+  }
+
+  async refresh(requestId, observe) {
+    const record = this.read(requestId);
+    if (!record || this.active.has(requestId)) return record;
+    const refreshed = await observe(record);
+    if (!refreshed || refreshed.requestId !== record.requestId || refreshed.digest !== record.digest || refreshed.cwd !== record.cwd
+        || refreshed.conversationId !== record.conversationId || refreshed.surface !== record.surface || JSON.stringify(refreshed.sender) !== JSON.stringify(record.sender)) throw new Error("Observation changed the delivery identity");
+    const current = this.read(requestId);
+    if (this.active.has(requestId) || JSON.stringify(current) !== JSON.stringify(record)) return current;
+    if (refreshed.status === "reply_received") this.write(refreshed);
+    return refreshed;
+  }
+
   write(record) {
     const temporary = `${this.file(record.requestId)}.${process.pid}.tmp`;
     fs.writeFileSync(temporary, JSON.stringify(record), { flag: "wx", mode: 0o600 });
@@ -91,7 +114,7 @@ export class AntigravityDeliveries {
     }
     this.active.add(requestId);
     void Promise.resolve().then(operation).then((result) => {
-      record.status = ["accepted", "sent_unconfirmed", "held", "refused"].includes(result?.status) ? result.status : result?.status && result.status !== "SUCCESS" ? "failed" : "completed";
+      record.status = ["accepted", "sent_unconfirmed", "held", "refused", "reply_received"].includes(result?.status) ? result.status : result?.status && result.status !== "SUCCESS" ? "failed" : "completed";
       record.result = result;
       record.conversationId = result?.conversationId ?? result?.conversation_id ?? record.conversationId;
       if (record.status === "failed") {
@@ -107,7 +130,9 @@ export class AntigravityDeliveries {
     }).finally(() => {
       record.finishedAt = new Date().toISOString();
       try {
-        record.conversationId ??= this.read(requestId)?.conversationId;
+        const previous = this.read(requestId);
+        record.conversationId ??= previous?.conversationId;
+        record.nativeObservation ??= previous?.nativeObservation;
         this.write(record);
       } catch (error) { process.stderr.write(`Could not persist Antigravity delivery outcome: ${error.code ?? "WRITE_FAILED"}\n`); }
       this.active.delete(requestId);

package/src/antigravity-desktop.mjs

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import crypto from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -8,6 +9,207 @@ import { promisify } from "node:util";
 const execute = promisify(execFile);
 const SURFACES = { desktop: "antigravity", cli: "antigravity-cli" };
 const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+const TRANSCRIPT_ROW_LIMIT = 4096;
+const TRANSCRIPT_BYTE_LIMIT = 32 * 1024 * 1024;
+const utf8 = new TextDecoder("utf-8", { fatal: true });
+const RESTART_NOTICE = "[Notice] All your subagents and background tasks have been stopped due to server restart. If you want a subagent to continue working, it needs to be revived by sending it a new message. If resuming work, please check on status and restart as needed.";
+
+function transcriptFailure(code = "ANTIGRAVITY_TRANSCRIPT_UNSUPPORTED") {
+  return Object.assign(new Error("Native Antigravity reply observation is unavailable; retain the original receipt and do not resend."), { code });
+}
+
+function protobufFields(value) {
+  if (!(value instanceof Uint8Array) || value.length > 2 * 1024 * 1024) throw transcriptFailure();
+  const buffer = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+  const fields = [];
+  let offset = 0;
+  const integer = () => {
+    let result = 0n;
+    for (let shift = 0n; shift < 70n; shift += 7n) {
+      if (offset >= buffer.length) throw transcriptFailure();
+      const byte = buffer[offset++];
+      result |= BigInt(byte & 127) << shift;
+      if (!(byte & 128)) {
+        if (result > BigInt(Number.MAX_SAFE_INTEGER)) throw transcriptFailure();
+        return Number(result);
+      }
+    }
+    throw transcriptFailure();
+  };
+  while (offset < buffer.length) {
+    if (fields.length >= 4096) throw transcriptFailure();
+    const tag = integer();
+    const field = Math.floor(tag / 8);
+    const wire = tag % 8;
+    if (!field || field > 536870911) throw transcriptFailure();
+    if (wire === 0) fields.push({ field, wire, value: integer() });
+    else {
+      const length = wire === 2 ? integer() : wire === 1 ? 8 : wire === 5 ? 4 : -1;
+      if (length < 0 || length > buffer.length - offset) throw transcriptFailure();
+      fields.push({ field, wire, value: buffer.subarray(offset, offset + length) });
+      offset += length;
+    }
+  }
+  return fields;
+}
+
+function protobufField(fields, number, wire) {
+  const matches = fields.filter((field) => field.field === number);
+  if (matches.length > 1 || matches.length && matches[0].wire !== wire) throw transcriptFailure();
+  return matches[0]?.value;
+}
+
+function protobufText(fields, number) {
+  const value = protobufField(fields, number, 2);
+  return value === undefined ? "" : utf8.decode(value);
+}
+
+function protobufTime(fields, number) {
+  const value = protobufField(fields, number, 2);
+  if (!value) return null;
+  const timestamp = protobufFields(value);
+  const seconds = protobufField(timestamp, 1, 0) ?? 0;
+  const nanos = protobufField(timestamp, 2, 0) ?? 0;
+  if (nanos >= 1e9 || seconds > 253402300799) throw transcriptFailure();
+  return seconds * 1000 + nanos / 1e6;
+}
+
+function decodeNativeStep(row) {
+  if (!Number.isSafeInteger(row.idx) || row.idx < 0 || row.step_format !== 0) throw transcriptFailure();
+  const fields = protobufFields(row.step_payload);
+  if (protobufField(fields, 1, 0) !== row.step_type || protobufField(fields, 4, 0) !== row.status) throw transcriptFailure();
+  const rawMetadata = protobufField(fields, 5, 2);
+  if (!rawMetadata || !Buffer.from(row.metadata ?? []).equals(rawMetadata)) throw transcriptFailure();
+  const metadata = protobufFields(rawMetadata);
+  const step = { index: row.idx, type: row.step_type, status: row.status, executionId: protobufText(metadata, 12), createdAt: protobufTime(metadata, 1), completedAt: protobufTime(metadata, 8) };
+  if (step.type === 101) {
+    const system = protobufFields(protobufField(fields, 114, 2));
+    const rawAgent = protobufField(system, 4, 2);
+    if (rawAgent) {
+      const agent = protobufFields(rawAgent);
+      step.message = { id: protobufText(agent, 1), recipient: protobufText(agent, 2), sender: protobufText(agent, 3), content: protobufText(agent, 4), hidden: protobufField(agent, 11, 0) === 1 };
+    }
+  }
+  if (step.type === 15) {
+    const response = protobufFields(protobufField(fields, 20, 2));
+    step.response = protobufText(response, 8) || protobufText(response, 1);
+    step.hasTools = response.some((field) => field.field === 7);
+    step.stopReason = protobufField(response, 12, 0);
+    step.finishedAt = protobufTime(metadata, 7);
+  }
+  return step;
+}
+
+async function readNativeSteps({ home, conversationId, boundaryOnly = false, afterStepIndex = -1, findRoot }) {
+  if (!UUID.test(conversationId ?? "")) throw transcriptFailure();
+  let directory = fs.realpathSync.native(home);
+  for (const segment of [".gemini", "antigravity", "conversations"]) {
+    directory = path.join(directory, segment);
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw transcriptFailure();
+  }
+  const filename = path.join(directory, `${conversationId}.db`);
+  const before = fs.lstatSync(filename, { bigint: true });
+  if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n || before.size > 512n * 1024n * 1024n) throw transcriptFailure();
+  for (const suffix of ["-wal", "-shm"]) {
+    try {
+      const stat = fs.lstatSync(`${filename}${suffix}`);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw transcriptFailure();
+    } catch (error) { if (error.code !== "ENOENT") throw error; }
+  }
+  const { DatabaseSync } = await import("node:sqlite");
+  const db = new DatabaseSync(filename, { readOnly: true });
+  try {
+    db.exec("PRAGMA query_only=ON; BEGIN");
+    const trajectory = db.prepare("SELECT trajectory_id, cascade_id FROM trajectory_meta LIMIT 2").all();
+    if (trajectory.length !== 1 || trajectory[0].cascade_id !== conversationId || !UUID.test(trajectory[0].trajectory_id ?? "")) throw transcriptFailure();
+    const maximum = db.prepare("SELECT MAX(idx) AS lastStepIndex FROM steps").get().lastStepIndex ?? -1;
+    if (!Number.isSafeInteger(maximum) || maximum < -1) throw transcriptFailure();
+    const readSteps = (lowerBound, rootsOnly = false) => {
+      const selector = rootsOnly ? "step_type = 101" : "idx > ?";
+      const parameters = rootsOnly ? [] : [lowerBound];
+      const rows = db.prepare(`SELECT idx, step_type, status, step_format, length(metadata) AS metadata_bytes, length(step_payload) AS payload_bytes FROM steps WHERE ${selector} ORDER BY idx LIMIT ?`).all(...parameters, TRANSCRIPT_ROW_LIMIT + 1);
+      if (rows.length > TRANSCRIPT_ROW_LIMIT || rows.some((row) => row.metadata_bytes > 2 * 1024 * 1024 || row.payload_bytes > 2 * 1024 * 1024)
+          || rows.reduce((sum, row) => sum + row.metadata_bytes + row.payload_bytes, 0) > TRANSCRIPT_BYTE_LIMIT) throw transcriptFailure("ANTIGRAVITY_TRANSCRIPT_LIMIT");
+      return rows.length ? db.prepare(`SELECT idx, step_type, status, step_format, metadata, step_payload FROM steps WHERE idx >= ? AND idx <= ?${rootsOnly ? " AND step_type = 101" : ""} ORDER BY idx`).all(rows[0].idx, rows.at(-1).idx).map(decodeNativeStep) : [];
+    };
+    let steps = [];
+    let roots;
+    if (!boundaryOnly) {
+      if (findRoot) {
+        roots = readSteps(-1, true).filter(findRoot);
+        if (roots.length === 1) steps = readSteps(roots[0].index - 1);
+      } else steps = readSteps(afterStepIndex);
+    }
+    const after = fs.lstatSync(filename, { bigint: true });
+    if (!after.isFile() || after.isSymbolicLink() || after.nlink !== 1n || before.dev !== after.dev || before.ino !== after.ino || before.birthtimeNs !== after.birthtimeNs) throw transcriptFailure();
+    return { trajectoryId: trajectory[0].trajectory_id, lastStepIndex: maximum, steps, ...(roots ? { roots } : {}) };
+  } finally { db.close(); }
+}
+
+export async function captureAntigravityObservation({ home = os.homedir(), conversationId, prompt, projectId }) {
+  const promptSha256 = crypto.createHash("sha256").update(prompt).digest("hex");
+  try {
+    const snapshot = await readNativeSteps({ home, conversationId, boundaryOnly: true });
+    return { version: 1, status: "ready", trajectoryId: snapshot.trajectoryId, beforeStepIndex: snapshot.lastStepIndex, promptSha256, projectId };
+  } catch {
+    return { version: 1, status: "unavailable", code: "ANTIGRAVITY_TRANSCRIPT_UNAVAILABLE", promptSha256, projectId };
+  }
+}
+
+export async function observeAntigravityDelivery(record, { home = os.homedir(), list = listAntigravityConversations } = {}) {
+  if (record?.surface !== "desktop" || !["accepted", "unknown", "sent_unconfirmed"].includes(record.status)) return record;
+  const observation = (status, code) => ({ ...record, replyObservation: { status, code, source: "native-transcript", retrySafe: false } });
+  try {
+    if (!UUID.test(record.conversationId ?? "") || !/^[a-f0-9]{64}$/.test(record.digest ?? "") || !["codex", "claude"].includes(record.sender?.provider)
+        || typeof record.sender.id !== "string" || !record.sender.id) throw transcriptFailure();
+    const matches = (await list({ home, surface: "desktop", limit: 1000 })).filter((row) => row.conversationId === record.conversationId);
+    if (matches.length !== 1 || matches[0].surface !== "desktop" || canonicalCwd(matches[0].cwd) !== canonicalCwd(record.cwd)) throw transcriptFailure("ANTIGRAVITY_REPLY_SCOPE_CHANGED");
+    const boundary = record.nativeObservation;
+    if (boundary && (boundary.version !== 1 || !["ready", "unavailable"].includes(boundary.status) || !/^[a-f0-9]{64}$/.test(boundary.promptSha256 ?? "") || boundary.projectId !== matches[0].projectId)) throw transcriptFailure();
+    if (boundary?.status === "ready" && (!Number.isSafeInteger(boundary.beforeStepIndex) || boundary.beforeStepIndex < -1 || !UUID.test(boundary.trajectoryId ?? ""))) throw transcriptFailure();
+    const createdAt = Date.parse(record.createdAt);
+    const finishedAt = Date.parse(record.finishedAt);
+    if (!Number.isFinite(createdAt) || boundary?.status !== "ready" && !Number.isFinite(finishedAt)) throw transcriptFailure();
+    const matchesRoot = (step) => {
+      if (step.type !== 101 || !step.message || step.status !== 3 || !UUID.test(step.message.id) || step.message.recipient !== record.conversationId
+          || step.createdAt === null || step.createdAt < createdAt - (boundary?.status === "ready" ? 2000 : 0) || !step.executionId) return false;
+      if (boundary?.status !== "ready" && step.createdAt > Math.min(createdAt + 120000, finishedAt + 30000)) return false;
+      const prompt = step.message.content;
+      if (boundary?.promptSha256 && crypto.createHash("sha256").update(prompt).digest("hex") !== boundary.promptSha256) return false;
+      const digest = crypto.createHash("sha256").update(JSON.stringify({ surface: "desktop", conversationId: record.conversationId, cwd: record.cwd, sender: record.sender, prompt })).digest("hex");
+      return digest === record.digest;
+    };
+    const snapshot = await readNativeSteps({ home, conversationId: record.conversationId, ...(boundary?.status === "ready" ? { afterStepIndex: boundary.beforeStepIndex } : { findRoot: matchesRoot }) });
+    if (boundary?.status === "ready" && (boundary.trajectoryId !== snapshot.trajectoryId || snapshot.lastStepIndex < boundary.beforeStepIndex)) throw transcriptFailure("ANTIGRAVITY_TRANSCRIPT_REPLACED");
+    const roots = snapshot.roots ?? snapshot.steps.filter(matchesRoot);
+    if (!roots.length) return observation("pending", "ANTIGRAVITY_MESSAGE_NOT_OBSERVED");
+    if (roots.length !== 1) return observation("ambiguous", "ANTIGRAVITY_REPLY_AMBIGUOUS");
+    const root = roots[0];
+    let reply;
+    for (const step of snapshot.steps.filter((step) => step.index > root.index)) {
+      if (step.type === 14 || step.executionId !== root.executionId) break;
+      if (step.type === 101) {
+        if (step.message?.hidden && step.message.sender === "system" && step.message.content === RESTART_NOTICE) continue;
+        if (!reply) return observation("ambiguous", "ANTIGRAVITY_REPLY_INTERLEAVED");
+        break;
+      }
+      reply = step.type === 15 && step.status === 3 && step.response && !step.hasTools && step.stopReason === 2
+        && step.finishedAt !== null && step.completedAt !== null && step.finishedAt >= root.createdAt && step.completedAt >= step.finishedAt ? step : null;
+    }
+    if (!reply) return observation("pending", "ANTIGRAVITY_REPLY_NOT_OBSERVED");
+    const current = (await list({ home, surface: "desktop", limit: 1000 })).filter((row) => row.conversationId === record.conversationId);
+    if (current.length !== 1 || current[0].surface !== "desktop" || current[0].projectId !== matches[0].projectId || canonicalCwd(current[0].cwd) !== canonicalCwd(record.cwd)) throw transcriptFailure("ANTIGRAVITY_REPLY_SCOPE_CHANGED");
+    if (current[0].status !== "CASCADE_RUN_STATUS_IDLE") return observation("pending", "ANTIGRAVITY_REPLY_STILL_RUNNING");
+    if (Buffer.byteLength(reply.response) > 256 * 1024) throw transcriptFailure("ANTIGRAVITY_REPLY_LIMIT");
+    const evidence = { source: "native-transcript", nativeMessageId: root.message.id, rootStepIndex: root.index, replyStepIndex: reply.index,
+      executionId: root.executionId, trajectoryId: snapshot.trajectoryId, replySha256: crypto.createHash("sha256").update(reply.response).digest("hex") };
+    return { ...record, status: "reply_received", replyObservation: { status: "reply_received", retrySafe: false, ...evidence },
+      result: { ...record.result, status: "reply_received", completed: true, response: reply.response, reply: reply.response, ...evidence } };
+  } catch (error) {
+    return observation("unavailable", /^ANTIGRAVITY_(?:TRANSCRIPT|REPLY)_[A-Z_]+$/.test(error.code ?? "") ? error.code : "ANTIGRAVITY_TRANSCRIPT_UNAVAILABLE");
+  }
+}
 
 function failure(code, message) {
   return Object.assign(new Error(message), { code, deliveryState: "not_sent" });
@@ -105,7 +307,7 @@ export async function runAgentApi(options) {
   }
 }
 
-async function executeAgentApi({ command, conversationId, prompt, expectedCwd, home = os.homedir(), env = process.env, executable = env.ANTIGRAVITY_AGENTAPI_EXE, run = execute, list = listAntigravityConversations }) {
+async function executeAgentApi({ command, conversationId, prompt, expectedCwd, home = os.homedir(), env = process.env, executable = env.ANTIGRAVITY_AGENTAPI_EXE, run = execute, list = listAntigravityConversations, beforeDispatch }) {
   if (!UUID.test(conversationId)) throw failure("ANTIGRAVITY_ID_INVALID", "An exact conversation UUID is required");
   if (!["metadata", "send"].includes(command)) throw new Error("Unsupported Antigravity agentapi command");
   if (!env.ANTIGRAVITY_LS_ADDRESS || !env.ANTIGRAVITY_CSRF_TOKEN) throw failure("ANTIGRAVITY_SIDECAR_REQUIRED", "Antigravity must launch the bridge sidecar before native requests are available");
@@ -141,6 +343,8 @@ async function executeAgentApi({ command, conversationId, prompt, expectedCwd, h
   if (metadata.cwd !== cwd || metadata.projectId !== before.projectId) throw failure("ANTIGRAVITY_METADATA_MISMATCH", "Native metadata does not match the selected conversation workspace and project");
   const current = await select();
   if (current.projectId !== before.projectId) throw failure("ANTIGRAVITY_METADATA_MISMATCH", "Conversation project changed during delivery preflight");
+  const nativeObservation = await captureAntigravityObservation({ home, conversationId, prompt, projectId: current.projectId });
+  await beforeDispatch?.(nativeObservation);
   await invoke(["send-message", conversationId, prompt]);
-  return { conversationId, status: "accepted", completed: false, surface: "desktop" };
+  return { conversationId, status: "accepted", completed: false, surface: "desktop", nativeObservation };
 }

package/src/antigravity-outbound-targets.mjs

@@ -236,7 +236,7 @@ export function createAntigravityOutboundTargets(options = {}) {
       await context.check();
       return { target, sessionId: recipient.sessionId, taskId, cwd: context.cwd, msgId, status: outcome.delivery?.status ?? "sent_unconfirmed", completed: false, accountContext: context.accountContext };
     } catch (error) {
-      if (error.msgId) receipts.set(error.msgId, { sender: context.identity, accountContext: context.accountContext, cwd: context.cwd });
+      if (error.msgId && error.code !== "PEER_REPLY_PENDING") receipts.set(error.msgId, { sender: context.identity, accountContext: context.accountContext, cwd: context.cwd });
       if (msgId) error.msgId = msgId;
       if (msgId || error.deliveryUncertain) error.deliveryState = "unknown";
       else if (!error.deliveryState) error.deliveryState = "not_sent";

package/src/antigravity-sidecar.mjs

@@ -3,7 +3,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { antigravityBridgeDirectory, serveAntigravityDesktop } from "./antigravity-ipc.mjs";
 import { AntigravityDeliveries } from "./antigravity-deliveries.mjs";
-import { listAntigravityConversations, runAgentApi, sanitizeAntigravityMetadata } from "./antigravity-desktop.mjs";
+import { listAntigravityConversations, observeAntigravityDelivery, runAgentApi, sanitizeAntigravityMetadata } from "./antigravity-desktop.mjs";
 import { exitForVersionRequest } from "./cli-version.mjs";
 import { readProcessAncestry } from "./claude-sender-context.mjs";
 
@@ -34,7 +34,7 @@ export async function createAntigravityParentGuard({ parentPid = process.ppid, i
   };
 }
 
-export async function startAntigravitySidecar({ directory = antigravityBridgeDirectory(), env = process.env, createParentGuard = createAntigravityParentGuard, serve = serveAntigravityDesktop, parentCheckIntervalMs = 5000, onParentLost = () => {} } = {}) {
+export async function startAntigravitySidecar({ directory = antigravityBridgeDirectory(), env = process.env, createParentGuard = createAntigravityParentGuard, serve = serveAntigravityDesktop, parentCheckIntervalMs = 5000, onParentLost = () => {}, runNative = runAgentApi, observeDelivery = observeAntigravityDelivery } = {}) {
   if (!env.ANTIGRAVITY_AGENTAPI_EXE || !env.ANTIGRAVITY_LS_ADDRESS) throw new Error("Antigravity must launch this sidecar. Do not run it as a replacement app server.");
   const assertParent = await createParentGuard();
   const deliveries = new AntigravityDeliveries(path.join(directory, "desktop-deliveries"));
@@ -68,7 +68,7 @@ export async function startAntigravitySidecar({ directory = antigravityBridgeDir
       const native = sanitizeAntigravityMetadata(await runAgentApi({ command: "metadata", conversationId: request.conversationId, env }), request.conversationId);
       return { ...record, ...native };
     }
-    if (request.operation === "receipt") return deliveries.read(request.requestId);
+    if (request.operation === "receipt") return deliveries.refresh(request.requestId, observeDelivery);
     if (request.operation !== "send" || typeof request.prompt !== "string" || !request.prompt.trim() || request.prompt.length > 30000 || request.prompt.includes("\0")
       || typeof request.cwd !== "string" || !path.isAbsolute(request.cwd) || !request.sender || !["codex", "claude"].includes(request.sender.provider)
       || typeof request.sender.id !== "string" || !request.sender.id) throw new Error("Invalid Antigravity delivery request");
@@ -76,7 +76,8 @@ export async function startAntigravitySidecar({ directory = antigravityBridgeDir
       await checkParent();
       if (sending.has(request.conversationId)) throw Object.assign(new Error("Another delivery is pending for this conversation"), { deliveryState: "not_sent" });
       sending.add(request.conversationId);
-      try { return await runAgentApi({ command: "send", conversationId: request.conversationId, expectedCwd: request.cwd, prompt: request.prompt, env }); }
+      try { return await runNative({ command: "send", conversationId: request.conversationId, expectedCwd: request.cwd, prompt: request.prompt, env,
+        beforeDispatch: (observation) => deliveries.captureObservation(request.requestId, observation) }); }
       finally { sending.delete(request.conversationId); }
     });
   }, { directory });

package/src/background-codex-worker.mjs

@@ -61,22 +61,29 @@ function workerEnv(env, relayEnv = {}) {
 }
 
 function binary(executable, env, platform = process.platform) {
-  const selected = executable ?? resolveCodexBin(undefined, { env, platform });
+  const selected = executable ?? env.CODEX_BIN ?? env.CODEX_CLI_PATH ?? resolveCodexBin(undefined, { env, platform });
   try {
     if (typeof selected !== "string" || !path.isAbsolute(selected) || /[\u0000-\u001f\u007f]/.test(selected)) throw new Error();
     const resolved = fs.realpathSync.native(selected);
     if (!fs.statSync(resolved).isFile() || platform === "win32" && !/\.(?:exe|com)$/i.test(resolved)) throw new Error();
     fs.accessSync(resolved, platform === "win32" ? fs.constants.R_OK : fs.constants.X_OK);
     return resolved;
-  } catch { throw failure("CLI_UNAVAILABLE", "inspect"); }
+  } catch (cause) { throw Object.assign(failure("CLI_UNAVAILABLE", "inspect"), { cause }); }
 }
 
-export async function inspectCodexWorker({ env = process.env, executable, platform = process.platform, run = execFileAsync } = {}) {
+function missingExecutable(error) {
+  return ["ENOENT", "ENOTDIR"].includes(error?.code) || ["ENOENT", "ENOTDIR"].includes(error?.cause?.code);
+}
+
+async function inspectCodexWorkerAttempt({ env, executable, platform, run, retryMissing = false }) {
   const result = { agent: "codex", available: false, authenticated: null, ready: false };
   if (!object(env) || typeof run !== "function") return { ...result, code: "INVALID_INPUT", reason: ERRORS.INVALID_INPUT };
   let selected;
   try { selected = binary(executable, env, platform); }
-  catch (error) { return { ...result, code: error.code, reason: error.message }; }
+  catch (error) {
+    if (retryMissing && missingExecutable(error)) throw error;
+    return { ...result, code: error.code, reason: error.message };
+  }
   const options = { env: workerEnv(env), windowsHide: true, shell: false, timeout: 10000, maxBuffer: MAX_CAPTURE, encoding: "utf8" };
   try {
     const version = await run(selected, ["--version"], options);
@@ -88,6 +95,8 @@ export async function inspectCodexWorker({ env = process.env, executable, platfo
       return { ...result, code: "CLI_UNSUPPORTED", reason: ERRORS.CLI_UNSUPPORTED };
     }
   } catch (error) {
+    if (retryMissing && missingExecutable(error)) throw error;
+    if (missingExecutable(error)) return { ...result, available: false, code: "CLI_UNAVAILABLE", reason: ERRORS.CLI_UNAVAILABLE };
     const code = diagnosticCode(error.stderr, result.available ? "CLI_UNSUPPORTED" : "CLI_UNAVAILABLE");
     return { ...result, code, reason: ERRORS[code] };
   }
@@ -100,11 +109,24 @@ export async function inspectCodexWorker({ env = process.env, executable, platfo
     const code = diagnosticCode(text, "AUTH_UNVERIFIED");
     return { ...result, authenticated: code === "AUTH_REQUIRED" ? false : null, code, reason: ERRORS[code] };
   } catch (error) {
+    if (retryMissing && missingExecutable(error)) throw error;
+    if (missingExecutable(error)) return { ...result, available: false, code: "CLI_UNAVAILABLE", reason: ERRORS.CLI_UNAVAILABLE };
     const code = diagnosticCode(`${error.stdout ?? ""}\n${error.stderr ?? ""}`, "AUTH_UNVERIFIED");
     return { ...result, authenticated: code === "AUTH_REQUIRED" ? false : null, code, reason: ERRORS[code] };
   }
 }
 
+export async function inspectCodexWorker({ env = process.env, executable, platform = process.platform, run = execFileAsync } = {}) {
+  const settings = { env, executable, platform, run };
+  const pinned = executable != null || env?.CODEX_BIN != null || env?.CODEX_CLI_PATH != null;
+  try { return await inspectCodexWorkerAttempt({ ...settings, retryMissing: !pinned }); }
+  catch (error) {
+    if (!missingExecutable(error)) throw error;
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    return inspectCodexWorkerAttempt(settings);
+  }
+}
+
 function capture(executable, args, { cwd, env, spawn, signal, timeoutMs }) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) return reject(failure("ABORTED", "configure"));

package/src/claude-bridge.mjs

@@ -31,7 +31,7 @@ import { BACKGROUND_WORKER_GUIDANCE, registerBackgroundTools } from "./backgroun
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.9";
+const VERSION = "1.26.10";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/index.mjs

@@ -44,7 +44,7 @@ import { BACKGROUND_WORKER_GUIDANCE, registerBackgroundTools } from "./backgroun
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.9";
+const VERSION = "1.26.10";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 

package/src/native-relay-companion.mjs

@@ -43,7 +43,7 @@ import { remoteCodexSocketPath, remoteNativeAdapter, remoteRequestResponse } fro
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.9";
+const VERSION = "1.26.10";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent, details) {

package/src/peer-protocol.mjs

@@ -284,6 +284,7 @@ export function assertClaudeSessionProcess(session) {
  * rather than by reconstructing the slug.
  */
 function findTranscriptFile(sessionId, cwd) {
+  if (typeof sessionId !== "string" || !sessionId || sessionId.length > 128 || /[^a-zA-Z0-9_-]/.test(sessionId)) return null;
   const dir = projectsDir();
   const guess = path.join(dir, String(cwd ?? "").replace(/[^a-zA-Z0-9]/g, "-"), `${sessionId}.jsonl`);
   if (fs.existsSync(guess)) return guess;
@@ -297,7 +298,7 @@ function findTranscriptFile(sessionId, cwd) {
 
 export function readTranscript(sessionId, cwd, limit = 10) {
   const file = findTranscriptFile(sessionId, cwd);
-  if (!fs.existsSync(file)) return { file, messages: [] };
+  if (!file || !fs.existsSync(file)) return { file, messages: [] };
   const lines = fs.readFileSync(file, "utf8").split("\n").filter(Boolean);
   const messages = [];
   for (const line of lines) {
@@ -325,7 +326,7 @@ export function readTranscript(sessionId, cwd, limit = 10) {
 
 export function readInitialTranscriptMessage(sessionId, cwd) {
   const file = findTranscriptFile(sessionId, cwd);
-  if (!fs.existsSync(file)) return { file, messages: [] };
+  if (!file || !fs.existsSync(file)) return { file, messages: [] };
   const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
   try {
     const stat = fs.fstatSync(descriptor);
@@ -388,6 +389,46 @@ function isTerminalDelivery(receipt) {
   return ["refused", "denied", "expired", "dropped"].includes(receipt?.status) || isInterruptedDelivery(receipt);
 }
 
+function resumableTranscriptDelivery(id, sent, receipt) {
+  const uuid = value => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+  const session = sent?.transcriptSession;
+  return Boolean(sent) && uuid(id) && !sent.reply && !sent.failed && !isTerminalDelivery(receipt)
+    && Number.isFinite(sent.sentAt) && (!receipt || receipt.status === "delivered" && receipt.fromSocket === sent.targetSocket)
+    && session?.entrypoint === "claude-desktop" && uuid(session.sessionId)
+    && typeof session.cwd === "string" && path.isAbsolute(session.cwd)
+    && typeof sent.targetSocket === "string" && sent.targetSocket && session.socket === sent.targetSocket
+    && session.desktop?.status === "matched" && typeof session.desktop.taskId === "string"
+    && session.desktop.taskId.startsWith("local_") && uuid(session.desktop.taskId.slice(6))
+    && session.desktop.cwd === session.cwd
+    && /^[a-f0-9]{64}$/i.test(sent.accountContext?.claude ?? "") && /^[a-f0-9]{64}$/i.test(sent.accountContext?.codex ?? "")
+    && session.desktop.accountFingerprint === sent.accountContext.claude
+    && hasTranscriptDeliveryRoot(session.sessionId, session.cwd, id);
+}
+
+function hasTranscriptDeliveryRoot(sessionId, cwd, msgId) {
+  const file = findTranscriptFile(sessionId, cwd);
+  if (!file) return false;
+  let lines;
+  try { lines = fs.readFileSync(file, "utf8").split("\n"); }
+  catch { return false; }
+  let roots = 0;
+  const ids = new Set();
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let entry;
+    try { entry = JSON.parse(line); } catch { return false; }
+    if (!entry || typeof entry !== "object" || entry.isSidechain) continue;
+    if (typeof entry.uuid === "string") {
+      if (ids.has(entry.uuid)) return false;
+      ids.add(entry.uuid);
+    }
+    if (!injectedMessageRoot(entry, msgId)) continue;
+    if (entry.entrypoint !== "claude-desktop" || entry.sessionId !== sessionId || entry.cwd !== cwd) return false;
+    roots++;
+  }
+  return roots === 1;
+}
+
 export function readTranscriptReply(sessionId, cwd, msgId) {
   return readTranscriptOutcome(sessionId, cwd, msgId)?.reply ?? null;
 }
@@ -460,6 +501,7 @@ function compactContinuation(entry, root, entriesById, transcriptIds, sessionId,
 // user turn's answer to the original request or claim its side effects stopped.
 export function readTranscriptOutcome(sessionId, cwd, msgId) {
   const file = findTranscriptFile(sessionId, cwd);
+  if (!file) return null;
   let lines;
   try { lines = fs.readFileSync(file, "utf8").split("\n"); }
   catch { return null; }
@@ -509,6 +551,7 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
     }
   }
   const descendants = new Map();
+  const monitorTasksByEntry = new Map();
   const backgroundCalls = new Map();
   const openLeaves = new Set();
   const passiveLeaves = new Set();
@@ -520,7 +563,7 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
     interruptions.push({ entryId: entry.uuid, backgroundTaskIds: [...outstanding.keys()] });
   };
   for (const entry of orderedEntries) {
-    if (entry === root) { descendants.set(entry.uuid, new Map()); openLeaves.add(entry.uuid); continue; }
+    if (entry === root) { descendants.set(entry.uuid, new Map()); monitorTasksByEntry.set(entry.uuid, new Set()); openLeaves.add(entry.uuid); continue; }
     let parentUuid = entry.parentUuid;
     if (!ambiguous && !interruptions.length && descendants.has(entry.logicalParentUuid)
         && openLeaves.has(entry.logicalParentUuid)) {
@@ -549,6 +592,7 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
     const role = entry.message?.role;
     const content = entry.message?.content;
     const outstanding = new Map(descendants.get(parentUuid));
+    const monitorTasks = new Set(monitorTasksByEntry.get(parentUuid));
     const toolResults = Array.isArray(content) && content.length > 0 && content.every((part) => part?.type === "tool_result");
     const imageCompanion = isImageToolCompanion(entry, entriesById);
     if (role === "user" && !toolResults && !imageCompanion && !compactSummaries.has(entry.uuid)) {
@@ -575,13 +619,20 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
     }
     if (typeof taskNotification === "string" && /^<task-notification>\s[\s\S]*<\/task-notification>$/.test(taskNotification.trim())) {
       const field = (name) => {
+        if (taskNotification.split(`<${name}>`).length !== 2 || taskNotification.split(`</${name}>`).length !== 2) return null;
         const matches = [...taskNotification.matchAll(new RegExp(`<${name}>([^<>]+)</${name}>`, "g"))];
         return matches.length === 1 ? matches[0][1] : null;
       };
       const taskId = field("task-id");
+      const hasField = name => taskNotification.split(`<${name}>`).length === 2
+        && taskNotification.split(`</${name}>`).length === 2
+        && new RegExp(`<${name}>[\\s\\S]+?</${name}>`).test(taskNotification);
+      const monitorProgress = monitorTasks.has(taskId) && !outstanding.has(taskId)
+        && hasField("summary") && hasField("event")
+        && !/<\/?(?:status|tool-use-id)(?:\s|>)/.test(taskNotification);
       if (!outstanding.has(taskId) || outstanding.get(taskId) !== field("tool-use-id")
         || !["completed", "failed", "killed"].includes(field("status"))) {
-        if (role === "user") continue;
+        if (role === "user" && !monitorProgress) continue;
       } else outstanding.delete(taskId);
     }
     if (typeof entry.uuid !== "string" || !entry.uuid.trim()) continue;
@@ -600,6 +651,18 @@ export function readTranscriptOutcome(sessionId, cwd, msgId) {
     // Parallel tool results and hook records can be leaf siblings of the real
     // continuation. They are completed observations, not separate reply turns.
     const parentEntry = entriesById.get(entry.parentUuid);
+    const monitorTaskId = entry.toolUseResult?.taskId;
+    if (role === "user" && toolResults && content.length === 1 && typeof monitorTaskId === "string" && /^[\w-]{1,128}$/.test(monitorTaskId)
+      && entry.sourceToolAssistantUUID === parentEntry?.uuid
+      && parentEntry?.message?.role === "assistant"
+      && Number.isSafeInteger(entry.toolUseResult.timeoutMs) && entry.toolUseResult.timeoutMs > 0
+      && typeof entry.toolUseResult.persistent === "boolean") {
+      const matches = content.filter(part => !part.is_error && typeof part.tool_use_id === "string" && part.tool_use_id
+        && Array.isArray(parentEntry.message.content)
+        && parentEntry.message.content.filter(call => call.type === "tool_use" && call.name === "Monitor" && call.id === part.tool_use_id).length === 1);
+      if (matches.length === 1) monitorTasks.add(monitorTaskId);
+    }
+    monitorTasksByEntry.set(entry.uuid, monitorTasks);
     const matchedResults = toolResults && !entry.toolUseResult?.backgroundTaskId
       && content.every((part) => Array.isArray(parentEntry?.message?.content)
         && parentEntry.message.content.some((call) => call.type === "tool_use" && call.id === part.tool_use_id));
@@ -654,6 +717,7 @@ export class PeerEndpoint {
     this.sentMessages = new Map();
     this.pendingMessages = new Map();
     this.responsePoll = null;
+    this.transcriptPollingPaused = false;
     this.connections = new Set();
     this.activityRevision = 0;
     this.reloadPaused = false;
@@ -779,6 +843,8 @@ export class PeerEndpoint {
     }
 
     this.started = true;
+    this.transcriptPollingPaused = false;
+    this.#startTranscriptPolling();
     this.log(`peer "${this.name}" listening on ${this.socketPath}`);
   }
 
@@ -903,11 +969,20 @@ export class PeerEndpoint {
     }
   }
 
+  #startTranscriptPolling() {
+    if (this.reloadPaused || this.transcriptPollingPaused || this.responsePoll
+      || ![...this.pendingMessages.values()].some(entry => entry.transcriptSession)) return;
+    this.responsePoll = globalThis.setInterval(() => this.#refreshTranscriptReplies(), 250);
+    this.responsePoll.unref();
+  }
+
   #refreshTranscriptReplies() {
+    if (this.reloadPaused || this.transcriptPollingPaused) return;
     for (const [msgId, pending] of this.pendingMessages) {
       if (!pending.transcriptSession) continue;
       const { sessionId, cwd } = pending.transcriptSession;
       const file = findTranscriptFile(sessionId, cwd);
+      if (!file) continue;
       let stamp;
       try { const stat = fs.statSync(file, { bigint: true }); stamp = `${stat.dev}:${stat.ino}:${stat.mtimeNs}:${stat.ctimeNs}:${stat.size}`; }
       catch { continue; }
@@ -1051,6 +1126,7 @@ export class PeerEndpoint {
         );
         error.code = "PEER_REPLY_PENDING";
         error.sent = false;
+        error.msgId = [...this.pendingMessages].find(([, entry]) => entry.targetSocket === targetSocket)?.[0];
         throw error;
       }
       const since = Date.now();
@@ -1059,10 +1135,7 @@ export class PeerEndpoint {
       let msgId = crypto.randomUUID();
       this.pendingMessages.set(msgId, { targetSocket, transcriptSession });
       this.sentMessages.set(msgId, { targetSocket, transcriptSession, sentAt: since, replyThreadId, permissionMode, senderApprovalPolicy, ...(senderReview ? { senderReview: { ...senderReview } } : {}), ...(recipient ? { recipient: { ...recipient } } : {}), ...(accountContext ? { accountContext: Object.freeze({ ...accountContext }) } : {}), ...(scopeBindings ? { scopeBindings: Object.freeze(structuredClone(scopeBindings)) } : {}) });
-      if (transcriptSession && !this.responsePoll) {
-        this.responsePoll = globalThis.setInterval(() => this.#refreshTranscriptReplies(), 250);
-        this.responsePoll.unref();
-      }
+      this.#startTranscriptPolling();
       try {
         const sentId = await this.send(targetSocket, text, { priority, msgId, permissionMode, beforeSend });
         if (sentId !== msgId) {
@@ -1191,9 +1264,21 @@ export class PeerEndpoint {
   reloadReason() {
     this.#refreshTranscriptReplies();
     if (this.connections.size) return "Peer socket connections are still open";
-    if (this.requestQueues.size || this.pendingMessages.size || this.unconfirmedReplies.size) return "Claude messages still have pending or unconfirmed delivery";
+    if (this.requestQueues.size) return "Claude messages are still being sent";
+    const counts = new Map();
+    for (const [id, pending] of this.pendingMessages) {
+      const sent = this.sentMessages.get(id);
+      if (!resumableTranscriptDelivery(id, sent, this.deliveryReceipts.get(id))
+        || pending.targetSocket !== sent.targetSocket || JSON.stringify(pending.transcriptSession) !== JSON.stringify(sent.transcriptSession)) {
+        return "Claude messages still have pending or unconfirmed delivery";
+      }
+      counts.set(sent.targetSocket, (counts.get(sent.targetSocket) ?? 0) + 1);
+    }
+    if (counts.size !== this.unconfirmedReplies.size || [...counts].some(([socket, count]) => this.unconfirmedReplies.get(socket) !== count)) {
+      return "Claude messages still have pending or unconfirmed delivery";
+    }
     for (const [id, sent] of this.sentMessages) {
-      if (!sent.reply && !sent.failed && !isTerminalDelivery(this.deliveryReceipts.get(id))) {
+      if (!sent.reply && !sent.failed && !isTerminalDelivery(this.deliveryReceipts.get(id)) && !this.pendingMessages.has(id)) {
         return "A Claude delivery outcome remains unconfirmed";
       }
     }
@@ -1243,14 +1328,17 @@ export class PeerEndpoint {
     const reason = this.reloadReason();
     if (reason || this.started && !this.reloadPaused) throw new Error(reason ?? "Quiesce the peer endpoint before exporting state");
     return cloneReloadState({ name: this.name, messageSequence: this.messageSequence, inbox: this.inbox,
-      sentMessages: [...this.sentMessages], deliveryReceipts: [...this.deliveryReceipts] });
+      sentMessages: [...this.sentMessages], deliveryReceipts: [...this.deliveryReceipts],
+      pendingMessages: [...this.pendingMessages].map(([id, pending]) => [id, { targetSocket: pending.targetSocket, transcriptSession: pending.transcriptSession }]) });
   }
 
   restoreReloadState(input) {
-    if (this.started || this.connections.size || this.sentMessages.size || this.inbox.length) throw new Error("Peer reload state requires an empty dormant endpoint");
+    if (this.started || this.connections.size || this.sentMessages.size || this.inbox.length || this.pendingMessages.size
+      || this.unconfirmedReplies.size || this.requestQueues.size || this.responsePoll) throw new Error("Peer reload state requires an empty dormant endpoint");
     const state = cloneReloadState(input);
     if (!state || typeof state.name !== "string" || !state.name || !Number.isSafeInteger(state.messageSequence) || state.messageSequence < 0
-      || !Array.isArray(state.inbox) || !Array.isArray(state.sentMessages) || !Array.isArray(state.deliveryReceipts)) throw new Error("Invalid peer reload state");
+      || !Array.isArray(state.inbox) || !Array.isArray(state.sentMessages) || !Array.isArray(state.deliveryReceipts)
+      || state.pendingMessages !== undefined && !Array.isArray(state.pendingMessages)) throw new Error("Invalid peer reload state");
     const restoreMap = (entries) => {
       const restored = new Map();
       for (const pair of entries) {
@@ -1262,6 +1350,17 @@ export class PeerEndpoint {
     };
     const sentMessages = restoreMap(state.sentMessages);
     const deliveryReceipts = restoreMap(state.deliveryReceipts);
+    const pendingMessages = restoreMap(state.pendingMessages ?? []);
+    const unconfirmedReplies = new Map();
+    for (const [id, pending] of pendingMessages) {
+      const sent = sentMessages.get(id);
+      if (!resumableTranscriptDelivery(id, sent, deliveryReceipts.get(id))
+        || pending.targetSocket !== sent.targetSocket || JSON.stringify(pending.transcriptSession) !== JSON.stringify(sent.transcriptSession)) {
+        throw new Error("Invalid pending Claude transcript reload record");
+      }
+      delete pending.transcriptStamp;
+      unconfirmedReplies.set(sent.targetSocket, (unconfirmedReplies.get(sent.targetSocket) ?? 0) + 1);
+    }
     for (const record of state.inbox) {
       if (!record || typeof record.text !== "string" || !Number.isSafeInteger(record.sequence) || record.sequence < 1
         || record.sequence > state.messageSequence || !Number.isFinite(record.receivedAt)) throw new Error("Invalid inbox reload record");
@@ -1269,7 +1368,7 @@ export class PeerEndpoint {
     for (const [id, sent] of sentMessages) {
       if (typeof sent.targetSocket !== "string" || !sent.targetSocket || !Number.isFinite(sent.sentAt)
         || sent.reply && (typeof sent.reply.text !== "string" || sent.reply.inReplyTo !== id)
-        || !sent.reply && !sent.failed && !isTerminalDelivery(deliveryReceipts.get(id))
+        || !sent.reply && !sent.failed && !isTerminalDelivery(deliveryReceipts.get(id)) && !pendingMessages.has(id)
         || isInterruptedDelivery(deliveryReceipts.get(id)) && deliveryReceipts.get(id).inReplyTo !== id) {
         throw new Error("Invalid or unconfirmed Claude delivery reload record");
       }
@@ -1279,6 +1378,9 @@ export class PeerEndpoint {
     this.inbox = state.inbox;
     this.sentMessages = sentMessages;
     this.deliveryReceipts = deliveryReceipts;
+    this.pendingMessages = pendingMessages;
+    this.unconfirmedReplies = unconfirmedReplies;
+    this.transcriptPollingPaused = true;
   }
 
   #removeRegistration() {

package/src/platform.mjs

@@ -88,9 +88,10 @@ function workspaceRoots() {
 }
 
 function isRunnable(candidate) {
-  if (!candidate || !existsSync(candidate)) return false;
-  if (IS_WINDOWS) return true;
+  if (typeof candidate !== "string" || !candidate || candidate.includes("\0")) return false;
   try {
+    if (!existsSync(candidate) || !statSync(candidate).isFile()) return false;
+    if (IS_WINDOWS) return true;
     accessSync(candidate, constants.X_OK);
     return true;
   } catch {
@@ -98,9 +99,9 @@ function isRunnable(candidate) {
   }
 }
 
-function windowsCodexCandidates() {
-  const roaming = process.env.APPDATA;
-  const local = process.env.LOCALAPPDATA;
+function windowsCodexCandidates(env, runnable) {
+  const roaming = env.APPDATA;
+  const local = env.LOCALAPPDATA;
   const versionedRoot = local && path.join(local, "OpenAI", "Codex", "bin");
   let versioned = [];
   if (versionedRoot) {
@@ -108,7 +109,7 @@ function windowsCodexCandidates() {
       versioned = readdirSync(versionedRoot, { withFileTypes: true })
         .filter((entry) => entry.isDirectory())
         .map((entry) => path.join(versionedRoot, entry.name, "codex.exe"))
-        .filter((candidate) => isRunnable(candidate))
+        .filter((candidate) => runnable(candidate))
         .sort((left, right) => {
           try {
             return statSync(path.dirname(right)).mtimeMs - statSync(path.dirname(left)).mtimeMs;
@@ -119,16 +120,16 @@ function windowsCodexCandidates() {
     } catch {}
   }
   return [
-    process.env.CODEX_CLI_PATH,
+    env.CODEX_CLI_PATH,
     ...versioned,
     local && path.join(local, "Programs", "OpenAI", "Codex", "bin", "codex.exe"),
     roaming && path.join(roaming, "npm", "codex.cmd"),
-    process.env.ProgramFiles && path.join(process.env.ProgramFiles, "nodejs", "codex.cmd"),
+    env.ProgramFiles && path.join(env.ProgramFiles, "nodejs", "codex.cmd"),
   ];
 }
 
-function unixCodexCandidates() {
-  const home = homeDir();
+function unixCodexCandidates(env) {
+  const home = env.HOME ?? env.USERPROFILE ?? os.homedir();
   return [
     path.join(home, ".local", "bin", "codex"),
     path.join(home, ".npm-global", "bin", "codex"),
@@ -147,17 +148,17 @@ function unixCodexCandidates() {
  * two versions write that same state, so prefer the app's binary whenever the
  * app is installed and fall back to the standalone CLI installs otherwise.
  */
-function macosCodexCandidates() {
+function macosCodexCandidates(env) {
   return [
     hasCodexDesktopApp() ? CODEX_DESKTOP_BIN_MACOS : null,
-    ...unixCodexCandidates(),
+    ...unixCodexCandidates(env),
   ];
 }
 
-function pathCandidates() {
-  const separator = IS_WINDOWS ? ";" : ":";
-  const names = IS_WINDOWS ? ["codex.exe", "codex.cmd"] : ["codex"];
-  return (process.env.PATH ?? "")
+function pathCandidates(env, platform) {
+  const separator = platform === "win32" ? ";" : ":";
+  const names = platform === "win32" ? ["codex.exe", "codex.cmd"] : ["codex"];
+  return (env.PATH ?? "")
     .split(separator)
     .filter(Boolean)
     .flatMap((dir) => names.map((name) => path.join(dir, name)));
@@ -217,8 +218,8 @@ export function resolveCodexBin(explicit, {
     explicit,
     env.CODEX_BIN,
     ...(discovered ?? [
-      ...(IS_WINDOWS ? windowsCodexCandidates() : IS_MACOS ? macosCodexCandidates() : unixCodexCandidates()),
-      ...pathCandidates(),
+      ...(platform === "win32" ? windowsCodexCandidates(env, runnable) : platform === "darwin" ? macosCodexCandidates(env) : unixCodexCandidates(env)),
+      ...pathCandidates(env, platform),
     ]),
   ].filter(Boolean);
 

package/src/recipient-preflight.mjs

@@ -55,8 +55,9 @@ export function bridgeDiagnostic(error, options = {}) {
     phase: name(previous?.phase ?? options.phase ?? error?.phase ?? error?.diagnostic?.stage, deliveryState === "not_sent" ? "preflight" : options.readOnly ? "inspection" : "delivery"),
     deliveryState,
     sent: deliveryState === "not_sent" ? false : deliveryState === "sent" ? true : null,
-    retrySafe: deliveryState === "not_sent",
-    nextAction: deliveryState === "not_sent" ? "Inspect the reported cause and bridge status before retrying. Do not open or create chats to load a relay."
+    retrySafe: deliveryState === "not_sent" && code !== "PEER_REPLY_PENDING",
+    nextAction: code === "PEER_REPLY_PENDING" ? "Read read_claude_delivery with the original msgId. Wait for its correlated outcome; do not resend or start another bridge to bypass pending work."
+      : deliveryState === "not_sent" ? "Inspect the reported cause and bridge status before retrying. Do not open or create chats to load a relay."
       : deliveryState === "not_applicable" ? "Inspect bridge status and include this diagnostic in the report."
       : "Inspect the original delivery receipt. Do not resend automatically or create a replacement chat.",
     reason: diagnosticText(previous?.reason ?? error?.preflight?.reason ?? error?.message ?? error),