Greptile Summary

This PR closes a permission-spoofing vulnerability in the MCP channel by binding each pending Claude permission request to the sessionKey of the session that originated it, and requiring that any yes/no <id> reply arrive from that same session before the permission notification is forwarded.

• ClaudePermissionRequest type and ClaudePermissionRequestSchema gain a required session_key / sessionKey field, propagated through channel-server.ts → handleClaudePermissionRequest.
• handleSessionMessageEvent now reads the stored sessionKey and only accepts the reply when it matches the inbound message's sessionKey; mismatches fall through as ordinary messages without consuming the pending entry.
• Tests cover attacker-session rejection, trusted-session acceptance, and an integration-level regression check confirming the notification count stays at 1 after a cross-session reply attempt.
• Minor: session_key in the Zod schema uses z.string() which permits empty strings; a .min(1) guard would prevent a malformed notification from creating a permanently stuck entry in pendingClaudePermissions.

Confidence Score: 5/5

Safe to merge — the security fix is correctly implemented and well-tested; the only finding is a P2 schema robustness suggestion.

All changed logic is sound: the session-binding check is properly placed, failed matches do not consume the pending entry, and tests cover both the rejection and acceptance paths. The single comment is a minor defensive-coding suggestion (.min(1) on the Zod field) that does not affect production correctness under normal operation.

src/mcp/channel-shared.ts — minor schema hardening opportunity on line 122.

This is a comment left during a code review.
Path: src/mcp/channel-shared.ts
Line: 122

Comment:
**Non-empty validation missing for `session_key`**

`z.string()` accepts an empty string as a valid `session_key`. If a client sends `session_key: ""`, the pending permission is stored with an empty `sessionKey`, but `handleSessionMessageEvent` returns early because `toText(payload.sessionKey)` returns `undefined` for empty/whitespace strings — making that permission permanently un-approvable. Consider adding a `.min(1)` constraint to reject malformed notifications at the schema boundary rather than silently creating a stuck entry in `pendingClaudePermissions`.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "Merge pull request #1 from lifelikezzh/c..." | Re-trigger Greptile}

This fixes MCP Claude permission replies (approve/deny) not being routed back to the originating session when the permission request was initiated by a sub-agent. The replies were being broadcast to all sessions instead of targeted to the specific originating session. S-sized fix for a critical MCP security flow. LGTM.