livedesk 0.1.206 → 0.1.208

package/hub/src/agents/agent-device-scope.js

@@ -16,3 +16,14 @@ export function selectAgentDeviceIds({ allowedDeviceIds, requestedDeviceIds, con
   const candidates = requested.length > 0 ? requested : [...allowed];
   return candidates.filter(deviceId => allowed.has(deviceId) && connected.has(deviceId));
 }
+
+export function resolveAgentTargetIds({ allowedDeviceIds, requestedDeviceIds, connectedDeviceIds }) {
+  const requested = normalizeIds(requestedDeviceIds);
+  const allowed = allowedDeviceIds instanceof Set ? allowedDeviceIds : new Set(normalizeIds(allowedDeviceIds));
+  const deviceIds = selectAgentDeviceIds({ allowedDeviceIds: allowed, requestedDeviceIds: requested, connectedDeviceIds });
+  if (deviceIds.length > 0) return { deviceIds, error: '' };
+  if (requested.length > 0 && requested.every(deviceId => !allowed.has(deviceId))) {
+    return { deviceIds: [], error: 'agent-target-outside-selection' };
+  }
+  return { deviceIds: [], error: 'agent-no-target-devices' };
+}

package/hub/src/agents/agent-manager.js

@@ -37,13 +37,19 @@ export function createAgentManager({
   async function getCodexStatus() {
     if (!runtime) return { installed: false, authenticated: 'unknown', status: 'unavailable', codexPath: '' };
     if (statusCache.value && statusCache.expiresAt > Date.now()) return statusCache.value;
-    const value = publicCodexStatus(await runtime.getStatus());
+    let value;
+    try {
+      value = publicCodexStatus(await runtime.getStatus());
+    } catch (error) {
+      value = publicCodexStatus({ installed: true, authenticated: 'unknown', status: error?.code || 'security-unavailable', detail: error?.message || 'Codex security isolation is unavailable.' });
+    }
     statusCache = { value, expiresAt: Date.now() + 10000 };
     return value;
   }
 
   async function publicSettings() {
     const current = await settings.get();
+    const { codexMaxTurns: _codexMaxTurns, ...exposedSettings } = current;
     let hasApiKey = false;
     let apiKeyPreview = '';
     let secretStoreAvailable = true;
@@ -57,8 +63,17 @@ export function createAgentManager({
       }
     }
     const codex = await getCodexStatus();
+    const securityStatus = runtime?.getSecurityStatus?.() || {
+      isolatedCodexHome: false,
+      restrictedEnvironment: false,
+      livedeskMcpOnly: false,
+      selectedDeviceScopeEnforced: false,
+      failClosed: true,
+      verified: false,
+      state: 'unavailable'
+    };
     return {
-      ...current,
+      ...exposedSettings,
       hasApiKey,
       apiKeyPreview,
       secretStoreAvailable,
@@ -66,7 +81,8 @@ export function createAgentManager({
       codexAuth: codex.authenticated,
       codexStatus: codex.status,
       codexPath: codex.codexPath,
-      agentWorkspacePath: current.codexWorkingDirectory
+      agentWorkspacePath: current.codexWorkingDirectory,
+      securityStatus
     };
   }
 

package/hub/src/agents/codex-agent-runtime.js

@@ -19,10 +19,6 @@ const SAFE_ENV_KEYS = [
   'ComSpec',
   'TEMP',
   'TMP',
-  'USERPROFILE',
-  'HOME',
-  'APPDATA',
-  'LOCALAPPDATA',
   'WINDIR',
   'LANG',
   'LC_ALL',
@@ -103,6 +99,7 @@ function baseCodexConfig() {
       web_search: false,
       skill_mcp_dependency_install: false,
       memories: false,
+      plugins: false,
       remote_plugin: false
     },
     tools: {
@@ -139,21 +136,40 @@ function codexConfig({ mcpServerPath, mcpUrl, token, workspace }) {
 }
 
 function safeCodexEnv(codexHome) {
-  const env = { CODEX_HOME: codexHome };
+  const env = {
+    CODEX_HOME: codexHome,
+    HOME: codexHome,
+    USERPROFILE: codexHome,
+    APPDATA: path.join(codexHome, 'AppData', 'Roaming'),
+    LOCALAPPDATA: path.join(codexHome, 'AppData', 'Local')
+  };
   for (const key of SAFE_ENV_KEYS) {
     const value = process.env[key];
     if (value !== undefined && value !== '') env[key] = value;
   }
-  if (!env.HOME) env.HOME = os.homedir();
-  if (!env.USERPROFILE && process.platform === 'win32') env.USERPROFILE = os.homedir();
   if (!env.Path && env.PATH) env.Path = env.PATH;
   if (!env.PATH && env.Path) env.PATH = env.Path;
   return env;
 }
 
 async function ensureCodexHome(codexHome) {
-  await mkdir(codexHome, { recursive: true, mode: 0o700 });
-  const targetAuthPath = path.join(codexHome, 'auth.json');
+  const resolvedHome = path.resolve(codexHome);
+  const globalHome = path.resolve(os.homedir(), '.codex');
+  if (!resolvedHome || resolvedHome === globalHome) {
+    throw new AgentProviderError('codex-isolation-unavailable', 'Codex requires a dedicated LiveDesk home.', { status: 503 });
+  }
+  try {
+    await mkdir(resolvedHome, { recursive: true, mode: 0o700 });
+    if (await access(path.join(resolvedHome, 'config.toml')).then(() => true, () => false)) {
+      throw new AgentProviderError('codex-environment-isolation-failed', 'The dedicated Codex home contains an unmanaged config.toml.', { status: 503 });
+    }
+  } catch (error) {
+    if (error instanceof AgentProviderError) throw error;
+    const wrapped = new AgentProviderError('codex-environment-isolation-failed', 'The dedicated Codex home could not be prepared.', { status: 503 });
+    wrapped.cause = error;
+    throw wrapped;
+  }
+  const targetAuthPath = path.join(resolvedHome, 'auth.json');
   try {
     await access(targetAuthPath);
     return;
@@ -162,11 +178,14 @@ async function ensureCodexHome(codexHome) {
     // CLI-owned auth file when the user is already signed in. The runtime
     // never reads or copies the credential contents.
   }
+  const sourceAuthPath = path.join(os.homedir(), '.codex', 'auth.json');
+  if (!(await access(sourceAuthPath).then(() => true, () => false))) return;
   try {
-    await link(path.join(os.homedir(), '.codex', 'auth.json'), targetAuthPath);
-  } catch {
-    // A fresh installation may not have a CLI auth file yet. Codex will then
-    // report the normal auth-required state through getStatus().
+    await link(sourceAuthPath, targetAuthPath);
+  } catch (error) {
+    const wrapped = new AgentProviderError('codex-environment-isolation-failed', 'The Codex authentication bridge could not be prepared.', { status: 503 });
+    wrapped.cause = error;
+    throw wrapped;
   }
 }
 
@@ -207,7 +226,7 @@ function runAgeMs(run) {
 }
 
 function codexAbortError(code, message) {
-  return new AgentProviderError(code, message, { status: code === 'codex-task-timeout' ? 504 : 409, retryable: code === 'codex-task-timeout' });
+  return new AgentProviderError(code, message, { status: code === 'codex-run-timeout' ? 504 : 409, retryable: code === 'codex-run-timeout' });
 }
 
 function safeAgentDeviceIds(value) {
@@ -221,14 +240,55 @@ export function createCodexAgentRuntime({
   dataDir = path.join(os.homedir(), '.livedesk'),
   mcpServerPath,
   createMcpSession,
-  destroyMcpSession
+  destroyMcpSession,
+  createCodexClient: injectedCodexClient,
+  getCodexStatus: injectedCodexStatus
 } = {}) {
   const runs = new Map();
   let activeCount = 0;
   let codexModulePromise;
+  let securityVerificationState = 'configured';
   const workspace = path.resolve(dataDir, 'agent-workspace');
   const codexHome = path.resolve(dataDir, 'codex-home');
 
+  function securityStatus() {
+    const configured = codexHome !== path.resolve(os.homedir(), '.codex')
+      && typeof createMcpSession === 'function'
+      && Boolean(mcpServerPath);
+    return {
+      isolatedCodexHome: codexHome !== path.resolve(os.homedir(), '.codex'),
+      restrictedEnvironment: true,
+      livedeskMcpOnly: typeof createMcpSession === 'function' && Boolean(mcpServerPath),
+      selectedDeviceScopeEnforced: typeof createMcpSession === 'function',
+      failClosed: true,
+      verified: configured && securityVerificationState === 'verified',
+      state: configured ? securityVerificationState : 'unavailable'
+    };
+  }
+
+  async function prepareCodexHome() {
+    try {
+      await ensureCodexHome(codexHome);
+      securityVerificationState = 'verified';
+    } catch (error) {
+      securityVerificationState = 'unavailable';
+      throw error;
+    }
+  }
+
+  function assertSecurityConfiguration() {
+    const status = securityStatus();
+    if (!status.isolatedCodexHome || !status.restrictedEnvironment || !status.livedeskMcpOnly || !status.selectedDeviceScopeEnforced) {
+      throw new AgentProviderError('codex-unsupported-security-config', 'Codex security isolation is not available.', { status: 503 });
+    }
+  }
+
+  async function createCodexClient(options) {
+    if (typeof injectedCodexClient === 'function') return injectedCodexClient(options);
+    const { Codex } = await loadCodex();
+    return new Codex(options);
+  }
+
   function scheduleRunCleanup(run) {
     const timer = setTimeout(() => {
       if (runs.get(run.runId) === run && isTerminalStatus(run.status) && runAgeMs(run) >= RUN_TTL_MS) {
@@ -268,6 +328,7 @@ export function createCodexAgentRuntime({
   }
 
   async function getStatus() {
+    if (typeof injectedCodexStatus === 'function') return injectedCodexStatus();
     const pathToCli = cliPath();
     if (!pathToCli) {
       return { installed: false, authenticated: 'unknown', status: 'not-installed', codexPath: '' };
@@ -275,28 +336,29 @@ export function createCodexAgentRuntime({
     let authenticated = 'unknown';
     let detail = '';
     try {
-      await ensureCodexHome(codexHome);
+      await prepareCodexHome();
       const result = await runCli(pathToCli, ['login', 'status'], 5000, safeCodexEnv(codexHome));
       detail = safeText(result.stdout || result.stderr, 300);
       authenticated = /logged in|authenticated|chatgpt/i.test(`${result.stdout}\n${result.stderr}`)
         ? 'signed-in'
         : 'not-signed-in';
     } catch (error) {
+      if (error instanceof AgentProviderError) throw error;
       detail = safeText(error?.message, 300);
     }
     return { installed: true, authenticated, status: authenticated === 'signed-in' ? 'ready' : 'auth-required', codexPath: pathToCli, detail };
   }
 
   async function testConnection() {
+    assertSecurityConfiguration();
     const startedAt = Date.now();
     const status = await getStatus();
     if (!status.installed) throw new AgentProviderError('codex-sdk-not-installed', 'Codex SDK is not installed.', { status: 503 });
     if (status.authenticated !== 'signed-in') throw new AgentProviderError('codex-auth-required', 'Sign in with the Codex CLI first.', { status: 401 });
     const settings = await settingsStore.get();
     await mkdir(workspace, { recursive: true });
-    await ensureCodexHome(codexHome);
-    const { Codex } = await loadCodex();
-    const codex = new Codex({ env: safeCodexEnv(codexHome), config: baseCodexConfig() });
+    await prepareCodexHome();
+    const codex = await createCodexClient({ env: safeCodexEnv(codexHome), config: baseCodexConfig() });
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), Math.min(30000, settings.codexTaskTimeoutMs));
     try {
@@ -359,6 +421,7 @@ export function createCodexAgentRuntime({
     let session;
     let timeoutTimer;
     try {
+      assertSecurityConfiguration();
       const settings = await settingsStore.get();
       const timeoutMs = Math.max(1000, Number(settings.codexTaskTimeoutMs) || 600000);
       timeoutTimer = setTimeout(() => {
@@ -372,22 +435,21 @@ export function createCodexAgentRuntime({
         throw new AgentProviderError('agent-concurrency-limit', 'The LiveDesk Agent concurrency limit is reached.', { status: 429, retryable: true });
       }
       if (run.abortController.signal.aborted) {
-        if (run.abortReason === 'timeout') throw codexAbortError('codex-task-timeout', 'The Codex task exceeded its timeout.');
+        if (run.abortReason === 'timeout') throw codexAbortError('codex-run-timeout', 'The Codex task exceeded its timeout.');
         throw Object.assign(new Error('The Codex task was cancelled.'), { name: 'AbortError' });
       }
       const status = await getStatus();
       if (!status.installed) throw new AgentProviderError('codex-sdk-not-installed', 'Codex SDK is not installed.', { status: 503 });
       if (status.authenticated !== 'signed-in') throw new AgentProviderError('codex-auth-required', 'Sign in with the Codex CLI first.', { status: 401 });
-      session = createMcpSession({ runId: run.runId, signal: run.abortController.signal, allowedDeviceIds: input.deviceIds });
+      session = createMcpSession({ runId: run.runId, signal: run.abortController.signal, allowedDeviceIds: input.deviceIds, maxToolCalls: settings.codexMaxToolCalls });
       run.mcpToken = session.token;
       if (run.abortController.signal.aborted) {
         session.cancel();
-        if (run.abortReason === 'timeout') throw codexAbortError('codex-task-timeout', 'The Codex task exceeded its timeout.');
+        if (run.abortReason === 'timeout') throw codexAbortError('codex-run-timeout', 'The Codex task exceeded its timeout.');
         throw Object.assign(new Error('The Codex task was cancelled.'), { name: 'AbortError' });
       }
-      await ensureCodexHome(codexHome);
-      const { Codex } = await loadCodex();
-      const codex = new Codex({ env: safeCodexEnv(codexHome), config: codexConfig({ mcpServerPath, mcpUrl: session.url, token: session.token, workspace }) });
+      await prepareCodexHome();
+      const codex = await createCodexClient({ env: safeCodexEnv(codexHome), config: codexConfig({ mcpServerPath, mcpUrl: session.url, token: session.token, workspace }) });
       const threadOptions = codexThreadOptions(settings, workspace);
       const thread = input.resumeThreadId && settings.codexResumeSessions
         ? codex.resumeThread(String(input.resumeThreadId), threadOptions)
@@ -397,6 +459,15 @@ export function createCodexAgentRuntime({
       const streamed = await thread.runStreamed(promptFor({ instruction: run.instruction, deviceIds: input.deviceIds }), { signal: run.abortController.signal });
       for await (const event of streamed.events) {
         emit(run, event);
+        if (event.type === 'turn.started') {
+          run.turnCount += 1;
+          if (run.turnCount > settings.codexMaxTurns) {
+            run.abortReason = 'turn-limit';
+            run.abortController.abort();
+            session.cancel();
+            throw new AgentProviderError('codex-turn-limit-reached', 'Codex exceeded the LiveDesk turn limit.', { status: 409 });
+          }
+        }
         if (run.toolCallCount > settings.codexMaxToolCalls) {
           run.abortReason = 'tool-limit';
           run.abortController.abort();
@@ -412,10 +483,13 @@ export function createCodexAgentRuntime({
     } catch (error) {
       if (run.abortReason === 'timeout') {
         run.status = 'failed';
-        run.error = 'codex-task-timeout';
+        run.error = 'codex-run-timeout';
       } else if (run.abortReason === 'tool-limit') {
         run.status = 'failed';
         run.error = 'codex-tool-limit-reached';
+      } else if (run.abortReason === 'turn-limit') {
+        run.status = 'failed';
+        run.error = 'codex-turn-limit-reached';
       } else if (isAbortError(error) || run.abortController.signal.aborted) {
         run.status = 'cancelled';
         run.error = 'cancelled-by-user';
@@ -439,8 +513,11 @@ export function createCodexAgentRuntime({
   async function start(input = {}) {
     const instruction = safeText(input.instruction, 4000);
     if (!instruction) throw new AgentProviderError('agent-invalid-instruction', 'Instruction is required.', { status: 400 });
+    const deviceIds = safeAgentDeviceIds(input.deviceIds);
+    if (deviceIds.length === 0) throw new AgentProviderError('agent-no-target-devices', 'Select at least one connected device.', { status: 400 });
     const settings = await settingsStore.get();
     if (!settings.enabled) throw new AgentProviderError('agent-ai-disabled', 'Agent AI is disabled in Settings.', { status: 409 });
+    assertSecurityConfiguration();
     pruneRuns();
     if (runs.size >= MAX_RUNS) throw new AgentProviderError('agent-run-limit', 'The LiveDesk Agent run history is full.', { status: 429, retryable: true });
     const run = {
@@ -454,6 +531,7 @@ export function createCodexAgentRuntime({
       createdAt: new Date().toISOString(),
       updatedAt: new Date().toISOString(),
       toolCallCount: 0,
+      turnCount: 0,
       batchIds: new Set(),
       events: [],
       abortController: new AbortController(),
@@ -461,7 +539,7 @@ export function createCodexAgentRuntime({
       mcpToken: ''
     };
     runs.set(run.runId, run);
-    void execute(run, { deviceIds: safeAgentDeviceIds(input.deviceIds), resumeThreadId: input.resumeThreadId });
+    void execute(run, { deviceIds, resumeThreadId: input.resumeThreadId });
     return publicRun(run);
   }
 
@@ -482,5 +560,5 @@ export function createCodexAgentRuntime({
     return publicRun(run);
   }
 
-  return { getStatus, testConnection, start, get, cancel, workspace, codexHome };
+  return { getStatus, testConnection, start, get, cancel, workspace, codexHome, getSecurityStatus: securityStatus };
 }

package/hub/src/remote-hub.js

@@ -1832,6 +1832,11 @@ export function createRemoteHub(options = {}) {
         if (!batch) {
             return { ok: false, error: 'task-not-found' };
         }
+        if (!['running', 'queued'].includes(batch.status)) {
+            return { ok: true, ...serializeTaskBatch(batch) };
+        }
+
+        batch.cancelRequested = true;
 
         for (const item of batch.results) {
             if (!['targeted', 'queued', 'running'].includes(item.status)) {
@@ -2821,6 +2826,7 @@ export function createRemoteHub(options = {}) {
             completed: 0,
             failed: targets.length > 0 ? 0 : 1,
             timedOut: 0,
+            cancelRequested: false,
             results: targets.map(deviceId => ({
                 deviceId,
                 deviceName: safeString(devices.get(deviceId)?.deviceName || devices.get(deviceId)?.hostname || deviceId, 160),
@@ -2890,7 +2896,9 @@ export function createRemoteHub(options = {}) {
         batch.pending = results.filter(item => ['targeted', 'queued', 'running'].includes(item.status)).length;
         batch.updatedAt = new Date().toISOString();
 
-        if (batch.total === 0) {
+        if (batch.cancelRequested && batch.pending === 0) {
+            batch.status = 'cancelled';
+        } else if (batch.total === 0) {
             batch.status = 'failed';
         } else if (batch.completed + batch.failed + batch.cancelled >= batch.total) {
             batch.status = batch.failed > 0 ? 'completed-with-failures' : 'completed';
@@ -2919,6 +2927,10 @@ export function createRemoteHub(options = {}) {
             return null;
         }
 
+        if (batch.cancelRequested && item.status === 'cancelled') {
+            return batch;
+        }
+
         item.ok = true;
         item.status = safeString(task.status, 40) || 'queued';
         item.stage = safeString(task.stage, 160) || (item.status === 'running' ? 'Working' : '');

package/hub/src/server.js

@@ -16,7 +16,8 @@ import { toFilesystemHttpError } from './filesystem/directory-reader.js';
 import { createAgentManager } from './agents/agent-manager.js';
 import { AgentSettingsStore } from './agents/agent-settings.js';
 import { createCodexAgentRuntime } from './agents/codex-agent-runtime.js';
-import { createAgentDeviceScope, selectAgentDeviceIds } from './agents/agent-device-scope.js';
+import { createAgentDeviceScope, resolveAgentTargetIds } from './agents/agent-device-scope.js';
+import { AgentProviderError } from './agents/provider-errors.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const webDistCandidates = [
@@ -214,6 +215,8 @@ const agentMcpRunBatches = new Map();
 const agentMcpRunCleanupTimers = new Map();
 const AGENT_MCP_RUN_TTL_MS = 60 * 60 * 1000;
 const MAX_AGENT_MCP_RUN_RECORDS = 500;
+const DEFAULT_AGENT_MCP_TOOL_CALL_LIMIT = 20;
+const MAX_AGENT_MCP_TOOL_CALL_LIMIT = 100;
 
 function connectedAgentDeviceIds() {
   const devices = remoteHub.listDevices({ includeDataUrl: false });
@@ -246,15 +249,28 @@ function scheduleAgentMcpRunCleanup(runId) {
   agentMcpRunCleanupTimers.set(runId, timer);
 }
 
-function createAgentMcpSession({ runId, signal, allowedDeviceIds: allowedDeviceIdsInput = [] }) {
+function normalizeAgentMcpToolCallLimit(value) {
+  const limit = Number(value);
+  if (!Number.isFinite(limit)) return DEFAULT_AGENT_MCP_TOOL_CALL_LIMIT;
+  return Math.min(MAX_AGENT_MCP_TOOL_CALL_LIMIT, Math.max(1, Math.floor(limit)));
+}
+
+function createAgentMcpSession({ runId, signal, allowedDeviceIds: allowedDeviceIdsInput = [], maxToolCalls }) {
   const token = crypto.randomBytes(32).toString('hex');
-  const allowedDeviceIds = createAgentDeviceScope(allowedDeviceIdsInput, connectedAgentDeviceIds());
+  const allowedDeviceIds = createAgentDeviceScope(allowedDeviceIdsInput);
+  const initialResolution = resolveAgentTargetIds({ allowedDeviceIds, connectedDeviceIds: connectedAgentDeviceIds() });
+  if (initialResolution.deviceIds.length === 0) {
+    throw new AgentProviderError(initialResolution.error || 'agent-no-target-devices', 'No selected connected device is available.', { status: 400 });
+  }
   pruneAgentMcpRunBatches();
   const session = {
     token,
     runId: String(runId || ''),
     signal,
     allowedDeviceIds,
+    toolCallCount: 0,
+    maxToolCalls: normalizeAgentMcpToolCallLimit(maxToolCalls),
+    toolLimitReached: false,
     cancelled: false,
     cancel() {
       if (this.cancelled) return;
@@ -278,16 +294,41 @@ function delayAgentMcp(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
+function validateAgentMcpArguments(name, args) {
+  const value = args && typeof args === 'object' && !Array.isArray(args) ? args : null;
+  if (!value) return 'agent-tool-arguments-invalid';
+  if (value.deviceIds !== undefined) {
+    if (!Array.isArray(value.deviceIds) || value.deviceIds.length > 500 || value.deviceIds.some(item => typeof item !== 'string' || !item.trim())) {
+      return 'agent-tool-arguments-invalid';
+    }
+  }
+  if (name === 'livedesk.list_processes' && value.processName !== undefined
+    && (typeof value.processName !== 'string' || value.processName.length > 120)) return 'agent-tool-arguments-invalid';
+  if (name === 'livedesk.get_service_status' && value.serviceName !== undefined
+    && (typeof value.serviceName !== 'string' || value.serviceName.length > 120)) return 'agent-tool-arguments-invalid';
+  return '';
+}
+
 async function dispatchAgentMcpTool(session, name, args = {}) {
   if (session.cancelled || session.signal?.aborted) return { ok: false, error: 'cancelled-by-user' };
+  // This check runs synchronously before the first await, so concurrent Node
+  // requests cannot pass the same remaining budget and queue extra Client work.
+  if (session.toolCallCount >= session.maxToolCalls) {
+    session.toolLimitReached = true;
+    return { ok: false, error: 'codex-tool-limit-reached' };
+  }
+  session.toolCallCount += 1;
+  const validationError = validateAgentMcpArguments(name, args);
+  if (validationError) return { ok: false, error: validationError };
   if (name === 'livedesk.list_devices') {
-    const requested = selectAgentDeviceIds({
+    const resolution = resolveAgentTargetIds({
       allowedDeviceIds: session.allowedDeviceIds,
       requestedDeviceIds: args.deviceIds,
       connectedDeviceIds: connectedAgentDeviceIds()
     });
+    if (resolution.deviceIds.length === 0) return { ok: false, error: resolution.error };
     const devices = remoteHub.listDevices({ includeDataUrl: false })
-      .filter(device => requested.includes(device.deviceId))
+      .filter(device => resolution.deviceIds.includes(device.deviceId))
       .slice(0, 500)
       .map(device => ({ deviceId: device.deviceId, deviceName: device.deviceName, hostname: device.hostname, connected: device.connected === true, platform: device.platform, capabilities: device.capabilities }));
     return { ok: true, devices };
@@ -301,13 +342,14 @@ async function dispatchAgentMcpTool(session, name, args = {}) {
     'livedesk.collect_diagnostics': 'diagnostics.collect'
   };
   const operation = operationByTool[name];
-  if (!operation) return { ok: false, error: 'unsupported-livedesk-tool' };
-  const targetIds = selectAgentDeviceIds({
+  if (!operation) return { ok: false, error: 'codex-tool-not-allowed' };
+  const resolution = resolveAgentTargetIds({
     allowedDeviceIds: session.allowedDeviceIds,
     requestedDeviceIds: args.deviceIds,
     connectedDeviceIds: connectedAgentDeviceIds()
   });
-  if (targetIds.length === 0) return { ok: false, error: 'no-target-devices' };
+  const targetIds = resolution.deviceIds;
+  if (targetIds.length === 0) return { ok: false, error: resolution.error };
   const targetQuery = operation === 'process.list'
     ? String(args.processName || '').replace(/[\0\r\n]/g, ' ').trim().slice(0, 120)
     : operation === 'service.status'
@@ -475,7 +517,12 @@ function sendAgentError(res, error) {
   const code = String(error?.code || 'agent-request-failed').replace(/[^a-z0-9-]/gi, '-').toLowerCase().slice(0, 80);
   const status = Number.isInteger(error?.status) && error.status >= 400 && error.status <= 599
     ? error.status
-    : code === 'agent-api-key-missing' || code === 'agent-api-key-invalid' || code === 'codex-auth-required' ? 401 : 502;
+    : code === 'agent-api-key-missing' || code === 'agent-api-key-invalid' || code === 'codex-auth-required' ? 401
+      : code === 'agent-no-target-devices' || code === 'agent-target-outside-selection' || code === 'codex-tool-not-allowed' ? 400
+        : code === 'agent-mcp-loopback-only' ? 403
+          : code === 'codex-isolation-unavailable' || code === 'codex-environment-isolation-failed' || code === 'codex-unsupported-security-config' ? 503
+            : code === 'codex-run-timeout' ? 504
+              : 502;
   res.status(status).json({ ok: false, error: code });
 }
 
@@ -1351,9 +1398,13 @@ app.post('/api/settings/agent/test', async (_req, res) => {
 
 app.post('/api/internal/agent-mcp/tool', async (req, res) => {
   noStore(res);
+  if (!isLoopbackAddress(req.socket?.remoteAddress)) {
+    res.status(403).json({ ok: false, error: 'agent-mcp-loopback-only' });
+    return;
+  }
   const authorization = String(req.headers.authorization || '');
   const token = authorization.startsWith('Bearer ') ? authorization.slice(7).trim() : '';
-  const session = agentMcpSessions.get(token);
+  const session = /^[a-f0-9]{64}$/i.test(token) ? agentMcpSessions.get(token) : null;
   if (!session || session.cancelled || session.signal?.aborted) {
     res.status(401).json({ ok: false, error: 'agent-mcp-session-invalid' });
     return;
@@ -1365,7 +1416,7 @@ app.post('/api/internal/agent-mcp/tool', async (req, res) => {
   try {
     const name = String(req.body?.name || '').slice(0, 120);
     const result = await dispatchAgentMcpTool(session, name, req.body?.arguments || {});
-    res.json({ ok: result.ok !== false, result });
+    res.status(result.ok === false ? 400 : 200).json({ ok: result.ok !== false, error: result.ok === false ? result.error : undefined, result });
   } catch {
     res.status(502).json({ ok: false, error: 'agent-mcp-tool-failed' });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "livedesk",
-  "version": "0.1.206",
+  "version": "0.1.208",
   "description": "LiveDesk Hub and client launcher",
   "type": "module",
   "bin": {