Motivation

• Fix a security issue where Claude permission replies (yes/no <id>) could be spoofed from any session because pending requests were keyed only by a short request_id.
• Ensure permission replies are only accepted from the same session that originated the permission request to prevent cross-session or untrusted-channel approvals.
• Preserve existing behavior for legitimate requests while closing the approval spoofing vector.

Description

• Require session_key in the notifications/claude/channel/permission_request schema and propagate it through the MCP server; changed src/mcp/channel-shared.ts and src/mcp/channel-server.ts.
• Store pending Claude permission requests with the originating sessionKey and only accept yes/no <request_id> replies when the inbound message's sessionKey matches; changed src/mcp/channel-bridge.ts.
• Add and update tests to cover session-bound permission handling and regression scenarios, including rejecting attacker-session replies and accepting trusted-session replies; changed src/mcp/channel-server.test.ts.

Testing

• Ran the targeted unit tests with pnpm test -- src/mcp/channel-server.test.ts, which passed (1 passed, 6 tests).
• Ran the repository verification gate with pnpm check, which completed successfully (lint/type checks passed).

Codex Task