@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.1

package/src/adapters/acp.js

@@ -0,0 +1,328 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { startJsonlProcess, commandExists, describeFailure, processErrorKind, stringify, truncate } from "./process.js";
+const object = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+const string = (value) => typeof value === "string" && value.length > 0 && value.length <= 4e3;
+class AcpError extends Error {
+  constructor(message, kind = "cli_incompatible", code) {
+    super(message);
+    this.kind = kind;
+    this.code = code;
+  }
+}
+class AcpClient {
+  constructor(connection, opts, onUpdate) {
+    this.connection = connection;
+    this.opts = opts;
+    this.onUpdate = onUpdate;
+    this.proc = startJsonlProcess({
+      command: connection.command,
+      args: connection.args,
+      cwd: opts.cwd,
+      interactive: true,
+      timeoutMs: opts.timeoutMs,
+      idleTimeoutMs: opts.idleTimeoutMs,
+      resultGraceMs: 1e3,
+      onJson: (message) => {
+        try {
+          this.receive(message);
+        } catch (error) {
+          this.fail(error);
+          this.proc.kill();
+        }
+      },
+      onText: () => {
+        this.fail(new AcpError("The CLI wrote invalid ACP data to stdout. Configure its ACP subcommand; logs must go to stderr."));
+        this.proc.kill();
+      }
+    });
+    void this.proc.outcome.then((outcome) => {
+      this.fail(new AcpError(describeFailure(connection.name, outcome), processErrorKind(outcome) ?? "other"));
+    });
+    opts.signal?.addEventListener("abort", this.cancel, { once: true });
+    if (opts.signal?.aborted) this.cancel();
+  }
+  nextId = 0;
+  pending = /* @__PURE__ */ new Map();
+  stopped;
+  lifetime = new AbortController();
+  cancelTimer;
+  approvalCount = 0;
+  permissionIds = /* @__PURE__ */ new Set();
+  permissionTasks = /* @__PURE__ */ new Set();
+  toolDetails = /* @__PURE__ */ new Map();
+  sessionId;
+  prompting = false;
+  proc;
+  fail(error) {
+    this.stopped ??= error;
+    this.lifetime.abort();
+    for (const waiter of this.pending.values()) {
+      clearTimeout(waiter.timer);
+      waiter.reject(this.stopped);
+    }
+    this.pending.clear();
+  }
+  cancel = () => {
+    if (this.sessionId) this.proc.send({ jsonrpc: "2.0", method: "session/cancel", params: { sessionId: this.sessionId } });
+    this.fail(new AcpError("ACP turn was cancelled", "cancelled"));
+    this.cancelTimer = setTimeout(() => this.proc.kill(), 1e3);
+    this.cancelTimer.unref();
+  };
+  request(method, params, timeoutMs = 2e4) {
+    if (this.stopped) return Promise.reject(this.stopped);
+    return new Promise((resolve, reject) => {
+      const id = ++this.nextId;
+      const timer = timeoutMs ? setTimeout(() => {
+        this.pending.delete(id);
+        reject(new AcpError(`ACP ${method} did not respond in time`, "timeout"));
+      }, timeoutMs) : void 0;
+      timer?.unref();
+      this.pending.set(id, { resolve, reject, timer });
+      if (!this.proc.send({ jsonrpc: "2.0", id, method, params })) {
+        clearTimeout(timer);
+        this.pending.delete(id);
+        reject(new AcpError("ACP process closed its input", "other"));
+      }
+    });
+  }
+  receive(message) {
+    if (!object(message) || message.jsonrpc !== "2.0") throw new AcpError("The CLI did not return ACP JSON-RPC 2.0 messages");
+    if (message.method === void 0) {
+      const waiter = this.pending.get(message.id);
+      if (!waiter) return;
+      this.pending.delete(message.id);
+      clearTimeout(waiter.timer);
+      if (object(message.error)) waiter.reject(new AcpError(truncate(String(message.error.message ?? "ACP request failed")), message.error.code === -32e3 ? "auth" : message.error.code === -32002 ? "session_not_found" : [-32601, -32602].includes(message.error.code) ? "cli_incompatible" : "other", message.error.code));
+      else if (object(message.result)) waiter.resolve(message.result);
+      else waiter.reject(new AcpError("ACP response is missing its result"));
+      return;
+    }
+    if (message.id !== void 0) {
+      if (!(typeof message.id === "number" || typeof message.id === "string")) throw new AcpError("Invalid ACP request ID");
+      if (message.method === "session/request_permission") {
+        if (this.permissionIds.has(message.id) || this.permissionIds.size >= 16) throw new AcpError("Too many or duplicate ACP permission requests");
+        this.permissionIds.add(message.id);
+        const task = this.permission(message).finally(() => {
+          this.permissionIds.delete(message.id);
+          this.permissionTasks.delete(task);
+        });
+        this.permissionTasks.add(task);
+      } else this.proc.send({ jsonrpc: "2.0", id: message.id, error: { code: -32601, message: "Client capability is not supported" } });
+    } else if (message.method === "session/update" && this.prompting && message.params?.sessionId === this.sessionId && object(message.params.update)) {
+      const update = message.params.update;
+      if (["tool_call", "tool_call_update"].includes(update.sessionUpdate) && string(update.toolCallId)) {
+        if (!this.toolDetails.has(update.toolCallId) && this.toolDetails.size >= 2e3) throw new AcpError("ACP turn exceeds the tool call limit");
+        const previous = this.toolDetails.get(update.toolCallId) ?? {};
+        this.toolDetails.set(update.toolCallId, {
+          ...previous,
+          toolCallId: update.toolCallId,
+          ...typeof update.kind === "string" ? { kind: update.kind } : {},
+          ...typeof update.title === "string" ? { title: truncate(update.title, 1e3) } : {},
+          ...Array.isArray(update.locations) ? { locations: update.locations.slice(0, 50).filter((item) => string(item?.path)).map((item) => ({ path: item.path })) } : {},
+          ...update.rawInput !== void 0 ? { rawInput: { description: truncate(stringify(update.rawInput)), ...typeof update.rawInput?.command === "string" ? { command: truncate(update.rawInput.command) } : {}, ...string(update.rawInput?.path) ? { path: update.rawInput.path } : {} } } : {}
+        });
+      }
+      this.onUpdate(update);
+    }
+  }
+  async permission(message) {
+    const params = message.params;
+    const tool = object(params?.toolCall) ? { ...this.toolDetails.get(params.toolCall.toolCallId), ...params.toolCall } : void 0;
+    let optionId;
+    const options = Array.isArray(params?.options) ? params.options : [];
+    const once = (kind) => options.find((option) => option?.kind === kind && string(option.optionId))?.optionId;
+    const eligible = this.prompting && params?.sessionId === this.sessionId && object(tool) && string(tool.toolCallId);
+    const canAsk = eligible && (this.opts.mode === "write" || ["read", "search", "think"].includes(tool.kind));
+    const controller = new AbortController();
+    let waiting = false;
+    const abort = () => controller.abort();
+    this.lifetime.signal.addEventListener("abort", abort, { once: true });
+    if (this.lifetime.signal.aborted) controller.abort();
+    const timer = setTimeout(abort, 12e4);
+    timer.unref();
+    try {
+      if (canAsk && once("allow_once") && this.opts.interactiveApprovals && this.opts.onApproval && !controller.signal.aborted) {
+        waiting = true;
+        this.approvalCount++;
+        this.proc.pauseIdle(true);
+        const paths = Array.isArray(tool.locations) ? tool.locations.slice(0, 50).map((location) => location?.path).filter(string) : [];
+        if (!paths.length && tool.kind === "edit" && string(tool.rawInput?.path)) paths.push(tool.rawInput.path);
+        const request = {
+          id: `acp:${String(message.id)}`,
+          kind: ["edit", "delete", "move"].includes(tool.kind) ? "file-change" : "command",
+          paths,
+          cwd: this.opts.cwd,
+          command: typeof tool.rawInput?.command === "string" ? truncate(tool.rawInput.command) : truncate(stringify(tool.rawInput ?? tool.title ?? tool.kind)),
+          reason: truncate(String(tool.title ?? "ACP tool request"))
+        };
+        const decision = await Promise.race([
+          this.opts.onApproval(request, controller.signal),
+          new Promise((resolve) => {
+            if (controller.signal.aborted) resolve("decline");
+            else controller.signal.addEventListener("abort", () => resolve("decline"), { once: true });
+          })
+        ]);
+        if (decision === "approve" && !controller.signal.aborted) optionId = once("allow_once");
+      }
+    } catch {
+    } finally {
+      clearTimeout(timer);
+      this.lifetime.signal.removeEventListener("abort", abort);
+      controller.abort();
+      if (waiting) {
+        this.approvalCount--;
+        if (!this.approvalCount) this.proc.pauseIdle(false);
+      }
+      optionId ??= once("reject_once");
+      this.proc.send({ jsonrpc: "2.0", id: message.id, result: { outcome: this.lifetime.signal.aborted || !optionId ? { outcome: "cancelled" } : { outcome: "selected", optionId } } });
+    }
+  }
+  async initialize() {
+    const init = await this.request("initialize", { protocolVersion: 1, clientCapabilities: {}, clientInfo: { name: "code-flow", version: "0.1.0" } });
+    if (init.protocolVersion !== 1) throw new AcpError(`Unsupported ACP protocol version: ${String(init.protocolVersion)}; code-flow supports v1`);
+    return init;
+  }
+  async session(init) {
+    const params = { cwd: this.opts.cwd, mcpServers: [] };
+    let session;
+    if (this.opts.resumeSessionId) {
+      if (init.agentCapabilities?.loadSession !== true) throw new AcpError("This ACP agent cannot load previous sessions", "session_not_found");
+      session = await this.request("session/load", { ...params, sessionId: this.opts.resumeSessionId });
+      this.sessionId = this.opts.resumeSessionId;
+    } else {
+      session = await this.request("session/new", params);
+      if (!string(session.sessionId)) throw new AcpError("ACP session/new returned no valid session ID");
+      this.sessionId = session.sessionId;
+    }
+    return session;
+  }
+  async close() {
+    this.opts.signal?.removeEventListener("abort", this.cancel);
+    clearTimeout(this.cancelTimer);
+    this.lifetime.abort();
+    await Promise.allSettled([...this.permissionTasks]);
+    this.proc.resultSeen();
+    this.proc.endInput();
+    await this.proc.outcome;
+  }
+}
+function configOption(session, category) {
+  const options = Array.isArray(session?.configOptions) ? session.configOptions.filter((option) => option?.type === "select" && option.category === category && string(option.id)) : [];
+  return options.find((option) => option.id === category) ?? options.find((option) => category !== "model" || option.id !== "provider");
+}
+function choices(option) {
+  const flat = Array.isArray(option?.options) ? option.options.flatMap((item) => Array.isArray(item?.options) ? item.options : [item]) : [];
+  return flat.filter((item) => string(item?.value) && string(item?.name)).slice(0, 1e3).map((item) => ({ id: item.value, label: item.name }));
+}
+function acpCatalog(session) {
+  const model = configOption(session, "model"), effort = configOption(session, "thought_level");
+  const models = model ? choices(model) : Array.isArray(session?.models?.availableModels) ? session.models.availableModels.filter((item) => string(item?.modelId) && string(item?.name)).slice(0, 1e3).map((item) => ({ id: item.modelId, label: item.name })) : [];
+  const defaultModel = model?.currentValue ?? session?.models?.currentModelId;
+  return {
+    models,
+    efforts: choices(effort).map((item) => item.id),
+    allowCustom: false,
+    defaultModel: string(defaultModel) ? defaultModel : void 0,
+    defaultEffort: string(effort?.currentValue) ? effort.currentValue : void 0
+  };
+}
+async function probeAcp(connection) {
+  const cwd = await mkdtemp(join(tmpdir(), "codeflow-acp-probe-"));
+  let client;
+  try {
+    client = new AcpClient(connection, { cwd, prompt: "", mode: "read", timeoutMs: 3e4 }, () => {
+    });
+    const init = await client.initialize(), session = await client.session(init);
+    return {
+      protocolVersion: 1,
+      agent: string(init.agentInfo?.title) ? init.agentInfo.title : string(init.agentInfo?.name) ? init.agentInfo.name : connection.name,
+      version: string(init.agentInfo?.version) ? init.agentInfo.version : void 0,
+      sessionResume: init.agentCapabilities?.loadSession === true,
+      catalog: acpCatalog(session)
+    };
+  } finally {
+    await client?.close();
+    await rm(cwd, { recursive: true, force: true });
+  }
+}
+function createAcpAdapter(connection) {
+  const saved = structuredClone(connection);
+  return {
+    id: saved.id,
+    displayName: saved.name,
+    binary: saved.command,
+    available: () => commandExists(saved.command),
+    catalog: async () => (await probeAcp(saved)).catalog,
+    run: (opts, event) => runAcp(saved, opts, event)
+  };
+}
+async function runAcp(connection, opts, event) {
+  if (opts.signal?.aborted) return { ok: false, finalText: "", error: "ACP turn was cancelled", errorKind: "cancelled" };
+  if (opts.agentContainer || opts.trust !== "full") return { ok: false, finalText: "", error: "ACP connections require Full access on the current host; sandbox and container profiles are not supported", errorKind: "cli_incompatible" };
+  let finalText = "", client;
+  const calls = /* @__PURE__ */ new Map(), finished = /* @__PURE__ */ new Set();
+  try {
+    client = new AcpClient(connection, opts, (update) => {
+      if (update.sessionUpdate === "agent_message_chunk" || update.sessionUpdate === "agent_thought_chunk") {
+        if (update.content?.type !== "text" || typeof update.content.text !== "string") return;
+        if (update.sessionUpdate === "agent_message_chunk") {
+          if (finalText.length + update.content.text.length > 4 * 1024 * 1024) throw new AcpError("ACP answer exceeds the 4 MiB limit");
+          finalText += update.content.text;
+          event({ kind: "text", text: update.content.text });
+        } else event({ kind: "thinking", text: update.content.text });
+      } else if (["tool_call", "tool_call_update"].includes(update.sessionUpdate) && string(update.toolCallId)) {
+        const previous = calls.get(update.toolCallId);
+        if (!previous && calls.size >= 2e3) throw new AcpError("ACP turn exceeds the tool call limit");
+        const name = String(update.title ?? previous?.name ?? update.kind ?? "Tool");
+        const input = update.rawInput !== void 0 ? truncate(stringify(update.rawInput), 16e3) : previous?.input ?? "{}";
+        if (!previous || previous.name !== name || previous.input !== input) {
+          event({ kind: "tool_call", callId: update.toolCallId, name, input });
+        }
+        const text = Array.isArray(update.content) ? update.content.map((item) => item.type === "content" && item.content?.type === "text" ? item.content.text : item.type === "diff" ? `${item.path}
+${item.newText ?? ""}` : "").join("\n") : void 0;
+        const output = truncate(text ?? (update.rawOutput !== void 0 ? stringify(update.rawOutput) : previous?.output ?? ""), 32e3);
+        calls.set(update.toolCallId, { name, input, output });
+        if (["completed", "failed"].includes(update.status) && !finished.has(update.toolCallId)) {
+          finished.add(update.toolCallId);
+          event({ kind: "tool_result", callId: update.toolCallId, output, isError: update.status === "failed" });
+        }
+      }
+    });
+    const init = await client.initialize();
+    let session = await client.session(init);
+    event({ kind: "session", sessionId: client.sessionId });
+    for (const [category, value] of [["model", opts.model], ["thought_level", opts.effort]]) {
+      if (!value) continue;
+      const option = configOption(session, category);
+      if (option) {
+        if (!choices(option).some((item) => item.id === value)) throw new AcpError(`ACP agent does not advertise ${category} ${value}`);
+        session = { ...session, ...await client.request("session/set_config_option", { sessionId: client.sessionId, configId: option.id, value }) };
+      } else if (category === "model" && acpCatalog(session).models.some((model) => model.id === value)) {
+        await client.request("session/set_model", { sessionId: client.sessionId, modelId: value });
+      } else throw new AcpError(`This ACP agent does not support selecting ${category}`);
+    }
+    const prompt = `${opts.mode === "read" ? "This is a read-only task. Do not edit files or run commands that change the repository.\n\n" : ""}${opts.prompt}${opts.jsonSchema ? `
+
+Return your final answer as JSON matching this schema:
+${JSON.stringify(opts.jsonSchema)}` : ""}`;
+    client.prompting = true;
+    const result = await client.request("session/prompt", { sessionId: client.sessionId, prompt: [{ type: "text", text: prompt }] }, 0);
+    client.prompting = false;
+    if (opts.signal?.aborted || result.stopReason === "cancelled") throw new AcpError("ACP turn was cancelled", "cancelled");
+    if (result.stopReason !== "end_turn") throw new AcpError(`ACP turn stopped: ${String(result.stopReason ?? "missing stop reason")}`, "other");
+    return { ok: true, finalText, sessionId: client.sessionId };
+  } catch (error) {
+    const failure = error;
+    return { ok: false, finalText, sessionId: client?.sessionId, error: failure.message, errorKind: opts.signal?.aborted ? "cancelled" : error instanceof AcpError ? error.kind : "other" };
+  } finally {
+    await client?.close();
+  }
+}
+export {
+  acpCatalog,
+  createAcpAdapter,
+  probeAcp,
+  runAcp
+};

package/src/adapters/agy-auth.js

@@ -0,0 +1,67 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+function agyCredentialFailure(text) {
+  return /(?:token refresh failed|failed to refresh loaded token|failed to (?:save|persist|marshal) (?:refreshed (?:OAuth )?token|credentials)|failed to (?:save|persist) token to keyring|failed to load (?:stored )?token from keyring, falling back to file|stored credentials are invalid or expired)/i.test(text);
+}
+const AGY_AUTH_LOG_LIMIT = 4 * 1024 * 1024;
+function observeAgyAuthLine(observation, line) {
+  const message = line.match(/\b(?:auth|auth_provider|server_oauth|credentials|keyring)\.go:\d+\]\s+(.*)$/)?.[1];
+  if (!message) return;
+  if (/token refreshed, new expiry=|Auto-saving refreshed token from token source callback/.test(message)) observation.refreshObserved = true;
+  if (agyCredentialFailure(message)) observation.credentialFailure = true;
+  if (/OAuth: starting OAuth flow/.test(message)) observation.interactiveAuthObserved = true;
+  const expired = message.match(/keyringAuth: loaded token, [^\r\n]*\bexpired=(true|false)\b/)?.[1];
+  if (expired) observation.loadedTokenExpired = observation.loadedTokenExpired === true || expired === "true";
+}
+async function inspectAgyAuthLog(path) {
+  const result = { log: "unreadable", refreshObserved: false, credentialFailure: false, interactiveAuthObserved: false, loadedTokenExpired: null };
+  let file;
+  try {
+    file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const stat = await file.stat();
+    if (!stat.isFile() || stat.nlink !== 1) return result;
+    if (stat.size > AGY_AUTH_LOG_LIMIT) {
+      result.log = "too-large";
+      return result;
+    }
+    const buffer = Buffer.alloc(16 * 1024);
+    let consumed = 0, pending = "", dropped = false;
+    while (consumed <= AGY_AUTH_LOG_LIMIT) {
+      const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, AGY_AUTH_LOG_LIMIT + 1 - consumed), consumed);
+      if (!bytesRead) break;
+      consumed += bytesRead;
+      if (consumed > AGY_AUTH_LOG_LIMIT) {
+        result.log = "too-large";
+        return result;
+      }
+      for (const part of buffer.subarray(0, bytesRead).toString("latin1").split(/(?<=\n)/)) {
+        if (!dropped) {
+          pending += part;
+          if (pending.length > 8192) {
+            pending = "";
+            dropped = true;
+          }
+        }
+        if (part.endsWith("\n")) {
+          if (!dropped) observeAgyAuthLine(result, pending.trimEnd());
+          pending = "";
+          dropped = false;
+        }
+      }
+    }
+    if (pending && !dropped) observeAgyAuthLine(result, pending);
+    result.log = "read";
+    return result;
+  } catch (error) {
+    result.log = error.code === "ENOENT" ? "missing" : "unreadable";
+    return result;
+  } finally {
+    await file?.close();
+  }
+}
+export {
+  AGY_AUTH_LOG_LIMIT,
+  agyCredentialFailure,
+  inspectAgyAuthLog,
+  observeAgyAuthLine
+};

package/src/adapters/agy-isolation.js

@@ -0,0 +1,223 @@
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { access, lstat, mkdir, mkdtemp, realpath, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir, userInfo } from "node:os";
+import { delimiter, isAbsolute, join, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+import { agyCredentialFailure, inspectAgyAuthLog } from "./agy-auth.js";
+import { startJsonlProcess } from "./process.js";
+const exec = promisify(execFile);
+const AGY_ISOLATION_VERSION = "macos-file-only-v1";
+const AGY_VERIFIED_CLI_VERSION = "1.4.4";
+const AGY_FILE_ONLY_LIMITATION = "Antigravity is limited to file tools in a fresh macOS sandbox. Terminal, browser, MCP, hooks and native delegation are disabled; Code Flow runs checks separately. Native sessions are not resumed.";
+const within = (path, parent) => path === parent || path.startsWith(parent + sep);
+function validPath(path) {
+  if (!isAbsolute(path) || path === "/" || resolve(path) !== path || /[\x00-\x1f\x7f]/.test(path)) throw new Error("Invalid Antigravity isolation path");
+}
+async function inspectAgyIsolationRuntime() {
+  if (process.platform !== "darwin") throw new Error("Isolated Antigravity requires macOS; remote and container execution are unsupported");
+  await access("/usr/bin/sandbox-exec", constants.X_OK);
+  let binary;
+  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+    if (!isAbsolute(dir)) continue;
+    const candidate = join(dir, "agy");
+    try {
+      await access(candidate, constants.X_OK);
+      binary = await realpath(candidate);
+      break;
+    } catch {
+    }
+  }
+  if (!binary) throw new Error("Antigravity CLI is not installed");
+  await verifyAgyVersion(binary);
+  const keychains = await realpath(join(userInfo().homedir, "Library", "Keychains"));
+  const cache = await exec("/usr/bin/getconf", ["DARWIN_USER_CACHE_DIR"], { timeout: 5e3, maxBuffer: 4096, env: { PATH: "/usr/bin:/bin" } });
+  const securityCache = await realpath(join(cache.stdout.trim(), "mds"));
+  const securityLock = join(securityCache, "mds.lock");
+  const lock = await lstat(securityLock);
+  if (!lock.isFile() || lock.isSymbolicLink() || lock.nlink !== 1) throw new Error("The macOS security cache lock is unavailable or unsafe");
+  for (const path of [binary, keychains, securityCache, securityLock]) validPath(path);
+  return { binary, keychains, securityCache, securityLock };
+}
+async function isolatedOutput(command, args, cwd, env, timeoutMs, maxBytes) {
+  let output = "", overflow = false;
+  const append = (line) => {
+    if (overflow) return;
+    if (Buffer.byteLength(output) + Buffer.byteLength(line) + 1 > maxBytes) {
+      overflow = true;
+      proc.kill();
+      return;
+    }
+    output += line + "\n";
+  };
+  const proc = startJsonlProcess({ command, args, cwd, env, timeoutMs, onText: append, onJson: (value) => append(JSON.stringify(value)) });
+  const outcome = await proc.outcome;
+  if (agyCredentialFailure(outcome.stderr + "\n" + output) || overflow || outcome.exitCode !== 0 || outcome.aborted || outcome.timedOut || outcome.stalled) throw new Error("Isolated Antigravity probe failed");
+  return output;
+}
+async function verifyAgyVersion(binary) {
+  validPath(binary);
+  const root = await realpath(await mkdtemp(join(tmpdir(), "codeflow-agy-version-")));
+  try {
+    const profile = join(root, "version.sb");
+    await writeFile(profile, `(version 1)
+(deny default)
+(allow sysctl-read file-read-metadata)
+(allow process-exec (literal ${JSON.stringify(binary)}))
+(allow file-read* file-map-executable (literal "/") (subpath "/System") (subpath "/usr") (subpath "/bin") (subpath "/Library/Apple") (subpath "/private/etc") (subpath "/dev") (literal ${JSON.stringify(binary)}))
+(allow file-write* (literal "/dev/null"))
+`, { mode: 256 });
+    const version = await isolatedOutput(
+      "/usr/bin/sandbox-exec",
+      ["-f", profile, binary, "--version"],
+      root,
+      { PATH: "/usr/bin:/bin", HOME: root, TMPDIR: root, AGY_CLI_DISABLE_AUTO_UPDATE: "true" },
+      5e3,
+      4096
+    );
+    if (version.trim() !== AGY_VERIFIED_CLI_VERSION) throw new Error(`Isolated Antigravity requires verified CLI ${AGY_VERIFIED_CLI_VERSION}`);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
+async function agyIsolationProblem() {
+  try {
+    await inspectAgyIsolationRuntime();
+  } catch {
+    return `Isolated Antigravity requires macOS, CLI ${AGY_VERIFIED_CLI_VERSION}, and an existing native Keychain login/security cache. No permissive fallback is available.`;
+  }
+}
+async function discoverIsolatedAgyModels() {
+  const workspace = await mkdtemp(join(tmpdir(), "codeflow-agy-catalog-"));
+  let isolated;
+  try {
+    isolated = await prepareAgyIsolation(workspace, "read", await inspectAgyIsolationRuntime());
+    const logPath = join(isolated.paths.scratch, "native-auth.log");
+    const stdout = await isolatedOutput(isolated.command, [...isolated.args, "--log-file", logPath, "models"], isolated.paths.workspace, isolated.env, 2e4, 128 * 1024);
+    const auth = await inspectAgyAuthLog(logPath);
+    if (auth.credentialFailure || auth.interactiveAuthObserved) throw new Error("Native authentication could not be maintained");
+    const models = stdout.split("\n").map((line) => line.split("	")).filter((cols) => cols.length >= 2 && cols[0].trim()).map(([id, label]) => ({ id: id.trim(), label: label.trim() }));
+    if (!models.length) throw new Error("No model candidates");
+    return { models, efforts: [], allowCustom: false, discovery: { source: `agy models (${AGY_ISOLATION_VERSION}/1.4.4)`, confidence: "reported", verifiedAt: Date.now() } };
+  } catch {
+    throw new Error("Isolated Antigravity model discovery failed; check native login and runtime compatibility");
+  } finally {
+    await isolated?.cleanup();
+    await rm(workspace, { recursive: true, force: true });
+  }
+}
+function agyIsolationProfile(paths, mode) {
+  for (const path of Object.values(paths)) validPath(path);
+  const roots = [paths.workspace, paths.home, paths.scratch, paths.keychains, paths.securityCache];
+  for (let i = 0; i < roots.length; i++) for (let j = i + 1; j < roots.length; j++) {
+    if (within(roots[i], roots[j]) || within(roots[j], roots[i])) throw new Error("Antigravity isolation roots must not overlap");
+  }
+  if (paths.securityLock !== join(paths.securityCache, "mds.lock") || within(paths.binary, paths.workspace)) throw new Error("Unsafe Antigravity executable or security lock path");
+  const q = JSON.stringify;
+  const cli = join(paths.home, ".gemini", "antigravity-cli");
+  const protectedFiles = [paths.home, join(paths.home, ".gemini"), cli, join(paths.home, "Library"), join(paths.home, "Library", "Keychains"), join(cli, "settings.json"), join(cli, "mcp_config.json")];
+  return `(version 1)
+(deny default)
+(allow process-fork signal sysctl-read mach-lookup file-read-metadata)
+(allow process-exec (literal ${q(paths.binary)}) (literal "/usr/bin/security"))
+(allow file-read* file-map-executable
+  (literal "/") (subpath "/System") (subpath "/usr") (subpath "/bin") (subpath "/sbin")
+  (subpath "/Library/Apple") (subpath "/private/etc") (subpath "/dev")
+  (literal ${q(paths.binary)}) (subpath ${q(paths.workspace)}) (subpath ${q(paths.home)}) (subpath ${q(paths.scratch)})
+  (subpath ${q(paths.keychains)}) (subpath ${q(paths.securityCache)}) (subpath "/private/var/db/mds"))
+(allow file-write* (subpath ${q(paths.home)}) (subpath ${q(paths.scratch)}) (literal "/dev/null")${mode === "write" ? ` (subpath ${q(paths.workspace)})` : ""})
+(allow file-write-data (literal ${q(paths.securityLock)}))
+(deny file-write* ${protectedFiles.map((p) => `(literal ${q(p)})`).join(" ")}
+  (subpath ${q(join(paths.home, ".gemini", "config"))}))
+(deny file-read* file-write* (require-all (subpath ${q(paths.workspace)}) (regex #"/[.](agents|gemini)(/|$)")))
+(deny file-write* (require-all (subpath ${q(paths.workspace)}) (regex #"/[.]git(/|$)")))
+; Inference and native authentication need networking. Model command/browser/MCP tools
+; are removed and denied in protected provider policy; this is not whole-process offline mode.
+(allow network*)
+`;
+}
+function agyIsolatedSettings(paths, mode) {
+  return {
+    enableTerminalSandbox: true,
+    toolPermission: "request-review",
+    allowNonWorkspaceAccess: false,
+    permissions: {
+      allow: [`read_file(${paths.workspace})`, ...mode === "write" ? [`write_file(${paths.workspace})`] : []],
+      ask: [],
+      deny: [
+        "unsandboxed(*)",
+        "command(*)",
+        "mcp(*)",
+        "read_url(*)",
+        "execute_url(*)",
+        ...[paths.home, paths.scratch, paths.keychains, paths.securityCache, "/private/var/db/mds"].map((p) => `read_file(${p})`),
+        ...mode === "read" ? ["write_file(*)"] : []
+      ]
+    }
+  };
+}
+async function prepareAgyIsolation(workspace, mode, runtime) {
+  const root = await realpath(await mkdtemp(join(tmpdir(), "codeflow-agy-managed-")));
+  const cleanup = () => rm(root, { recursive: true, force: true });
+  try {
+    const home = join(root, "home"), scratch = join(root, "scratch");
+    const paths = { ...runtime, workspace: await realpath(workspace), home, scratch };
+    const profile = agyIsolationProfile(paths, mode);
+    const cli = join(home, ".gemini", "antigravity-cli"), config = join(home, ".gemini", "config");
+    for (const path of [scratch, cli, join(config, "agents"), join(config, "projects"), join(home, "Library")]) await mkdir(path, { recursive: true, mode: 448 });
+    await writeFile(join(config, "projects", "default-cli-project.json"), JSON.stringify({ id: "default-cli-project", name: "CLI Project", projectResources: {} }), { mode: 256 });
+    await writeFile(join(cli, "settings.json"), JSON.stringify(agyIsolatedSettings(paths, mode)), { mode: 256 });
+    await writeFile(join(config, "hooks.json"), "{}", { mode: 256 });
+    for (const path of [join(config, "mcp_config.json"), join(cli, "mcp_config.json")]) await writeFile(path, '{"mcpServers":{}}', { mode: 256 });
+    await writeFile(join(config, "agents", "codeflow-isolated.md"), `---
+name: codeflow-isolated
+description: Code Flow isolated file worker
+tools:
+  - view_file
+  - list_dir
+${mode === "write" ? "  - write_to_file\n  - replace_file_content\n" : ""}mainAgent: true
+subagent: false
+commandExecutionPolicy: off
+mcpServers: []
+skills: []
+plugins: []
+---
+Use the available file tools for this task. Code Flow runs checks separately. Report limitations when a task needs unavailable tools. Never attempt to bypass a denied tool.
+`, { mode: 256 });
+    await symlink(runtime.keychains, join(home, "Library", "Keychains"));
+    const profilePath = join(root, "worker.sb");
+    await writeFile(profilePath, profile, { mode: 256 });
+    const env = {
+      HOME: home,
+      TMPDIR: scratch,
+      PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
+      LANG: "en_US.UTF-8",
+      AGY_CLI_DISABLE_AUTO_UPDATE: "true",
+      GIT_CONFIG_GLOBAL: "/dev/null",
+      GIT_CONFIG_SYSTEM: "/dev/null",
+      GIT_TERMINAL_PROMPT: "0"
+    };
+    return { root, paths, env, command: "/usr/bin/sandbox-exec", args: ["-f", profilePath, runtime.binary], cleanup };
+  } catch (error) {
+    await cleanup();
+    throw error;
+  }
+}
+function agyManagedOptionsProblem(opts) {
+  const p = opts.permissions;
+  if (!p || p.provider !== "agy" || p.mode !== opts.mode || p.trust !== (opts.trust ?? "standard") || p.nativeDelegation !== false || p.isolation !== "os-sandbox" || p.implementation !== AGY_ISOLATION_VERSION || p.commandNetwork !== "denied" || p.externalTools !== "disabled") return "Antigravity options do not match the isolated run permission policy";
+  if (opts.agentContainer || opts.interactiveApprovals || p.toolApprovals) return "Isolated Antigravity does not support containers or interactive approvals";
+}
+export {
+  AGY_FILE_ONLY_LIMITATION,
+  AGY_ISOLATION_VERSION,
+  AGY_VERIFIED_CLI_VERSION,
+  agyIsolatedSettings,
+  agyIsolationProblem,
+  agyIsolationProfile,
+  agyManagedOptionsProblem,
+  discoverIsolatedAgyModels,
+  inspectAgyIsolationRuntime,
+  prepareAgyIsolation,
+  verifyAgyVersion
+};