@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (319) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +141 -2
  3. package/bin/codeflow.mjs +8 -0
  4. package/bin/launcher.mjs +127 -0
  5. package/dist/remote-host.json +1 -0
  6. package/licenses/inter.txt +92 -0
  7. package/licenses/preact.txt +21 -0
  8. package/licenses/signals-core.txt +21 -0
  9. package/licenses/signals.txt +21 -0
  10. package/licenses/typescript-notices.txt +193 -0
  11. package/licenses/typescript.txt +55 -0
  12. package/licenses/uqr.txt +22 -0
  13. package/licenses/xterm-fit.txt +19 -0
  14. package/licenses/xterm.txt +21 -0
  15. package/package.json +34 -4
  16. package/public/assets/changes-62ZIEQSN.js +1 -0
  17. package/public/assets/chunk-2PZVOKID.js +1 -0
  18. package/public/assets/chunk-4D5IENEB.js +1 -0
  19. package/public/assets/chunk-5SARP5MU.js +1 -0
  20. package/public/assets/chunk-63YLZ3PR.js +1 -0
  21. package/public/assets/chunk-7FUHKF2M.js +1 -0
  22. package/public/assets/chunk-APQEVJ2K.js +1 -0
  23. package/public/assets/chunk-CGOZQMEZ.js +2 -0
  24. package/public/assets/chunk-J4VYS3KV.js +2 -0
  25. package/public/assets/chunk-L7TUCIYF.js +1 -0
  26. package/public/assets/chunk-SIHDWM2Y.js +154 -0
  27. package/public/assets/chunk-TEJVYIKC.js +1 -0
  28. package/public/assets/code-browser-VB2HGZSG.js +4 -0
  29. package/public/assets/filtered-tasks-ES5CP4KV.js +1 -0
  30. package/public/assets/interactive-browser-7F5ZXRUV.js +7 -0
  31. package/public/assets/join-project-6RTFHNCA.js +1 -0
  32. package/public/assets/main-65EW73SB.js +1 -0
  33. package/public/assets/project-invitations-view-GMPWGWYM.js +1 -0
  34. package/public/assets/settings-UB5Q4AQM.js +9 -0
  35. package/public/assets/styles-18792BB4.css +32 -0
  36. package/public/assets/team-server-wizard-2GLDWS6D.js +8 -0
  37. package/public/assets/terminal-IWAIM4DE.js +62 -0
  38. package/public/assets.json +1 -0
  39. package/public/bundle-meta.json +1 -0
  40. package/public/docs/.nojekyll +0 -0
  41. package/public/docs/accessibility.html +19 -0
  42. package/public/docs/acp-agents.html +117 -0
  43. package/public/docs/agent-containers.html +79 -0
  44. package/public/docs/api.html +1130 -0
  45. package/public/docs/app.js +342 -0
  46. package/public/docs/application-improvements.html +275 -0
  47. package/public/docs/architecture-explorer.html +19 -0
  48. package/public/docs/architecture.html +149 -0
  49. package/public/docs/auto-team.html +148 -0
  50. package/public/docs/automations.html +109 -0
  51. package/public/docs/checkpoint-review.html +37 -0
  52. package/public/docs/code-hosts.html +35 -0
  53. package/public/docs/code-intelligence.html +35 -0
  54. package/public/docs/configuration.html +346 -0
  55. package/public/docs/context-inspection.html +23 -0
  56. package/public/docs/coordinated-changes.html +28 -0
  57. package/public/docs/deferred-runs.html +25 -0
  58. package/public/docs/dependency-discovery.html +19 -0
  59. package/public/docs/documentation.html +84 -0
  60. package/public/docs/dynamic-teams-evaluation.html +174 -0
  61. package/public/docs/dynamic-teams-implementation-plan.html +882 -0
  62. package/public/docs/dynamic-teams-implementation-review-1.html +141 -0
  63. package/public/docs/dynamic-teams-plan-review-0.html +204 -0
  64. package/public/docs/extensions.html +42 -0
  65. package/public/docs/external-sources.html +96 -0
  66. package/public/docs/filesystem-policy.html +26 -0
  67. package/public/docs/filtered-tasks.html +44 -0
  68. package/public/docs/font-license.txt +92 -0
  69. package/public/docs/getting-started.html +143 -0
  70. package/public/docs/github-review-threads.html +26 -0
  71. package/public/docs/github.html +157 -0
  72. package/public/docs/help.html +69 -0
  73. package/public/docs/index.html +88 -0
  74. package/public/docs/installation.html +80 -0
  75. package/public/docs/launch-profiles.html +48 -0
  76. package/public/docs/maintenance.html +60 -0
  77. package/public/docs/memory-claims.html +31 -0
  78. package/public/docs/memory-storage.html +58 -0
  79. package/public/docs/notifications.html +39 -0
  80. package/public/docs/patterns.html +195 -0
  81. package/public/docs/performance-results.html +210 -0
  82. package/public/docs/performance.html +166 -0
  83. package/public/docs/project-conventions.html +22 -0
  84. package/public/docs/project-first-navigation-plan.html +587 -0
  85. package/public/docs/project-teams-implementation-plan.html +772 -0
  86. package/public/docs/project-teams.html +129 -0
  87. package/public/docs/provider-compatibility.html +20 -0
  88. package/public/docs/releasing.html +65 -0
  89. package/public/docs/remote-workers.html +64 -0
  90. package/public/docs/review-inbox.html +26 -0
  91. package/public/docs/run-storage.html +23 -0
  92. package/public/docs/runs.html +141 -0
  93. package/public/docs/search.json +1 -0
  94. package/public/docs/security.html +133 -0
  95. package/public/docs/shared-projects.html +31 -0
  96. package/public/docs/ssh-projects.html +60 -0
  97. package/public/docs/style.css +768 -0
  98. package/public/docs/task-reruns.html +30 -0
  99. package/public/docs/team-collaboration.html +412 -0
  100. package/public/docs/verification.html +22 -0
  101. package/public/docs/vscode.html +53 -0
  102. package/public/docs/worker-permission-verification.html +131 -0
  103. package/public/index.html +17 -0
  104. package/scripts/check-node.mjs +7 -0
  105. package/scripts/codeflow.mjs +55 -0
  106. package/scripts/computer-use.swift +64 -0
  107. package/scripts/pty.py +273 -0
  108. package/src/acp-connections.js +110 -0
  109. package/src/adapters/acp-presets.js +37 -0
  110. package/src/adapters/acp-types.js +0 -0
  111. package/src/adapters/acp.js +328 -0
  112. package/src/adapters/agent-tools.js +28 -0
  113. package/src/adapters/agy-auth.js +67 -0
  114. package/src/adapters/agy-isolation.js +242 -0
  115. package/src/adapters/agy-tools.js +45 -0
  116. package/src/adapters/agy.js +326 -0
  117. package/src/adapters/claude-stream.js +58 -0
  118. package/src/adapters/claude.js +282 -0
  119. package/src/adapters/codex-app-server.js +555 -0
  120. package/src/adapters/codex.js +311 -0
  121. package/src/adapters/errors.js +57 -0
  122. package/src/adapters/index.js +91 -0
  123. package/src/adapters/managed-permissions.js +37 -0
  124. package/src/adapters/model-discovery.js +100 -0
  125. package/src/adapters/process.js +433 -0
  126. package/src/adapters/team-tools.js +103 -0
  127. package/src/adapters/types.js +0 -0
  128. package/src/agent-browser.js +688 -0
  129. package/src/agent-computer.js +88 -0
  130. package/src/agent-container.js +155 -0
  131. package/src/agent-team-definitions.js +131 -0
  132. package/src/agent-tool-client.mjs +79 -0
  133. package/src/agent-tools.js +296 -0
  134. package/src/approvals.js +134 -0
  135. package/src/architecture.js +456 -0
  136. package/src/assets.js +44 -0
  137. package/src/automation.js +901 -0
  138. package/src/browser-files.js +293 -0
  139. package/src/browser-ownership.js +150 -0
  140. package/src/certificate-renewal.js +75 -0
  141. package/src/chat-family.js +25 -0
  142. package/src/chat-handoff.js +87 -0
  143. package/src/checkpoint-review.js +72 -0
  144. package/src/checks.js +303 -0
  145. package/src/code-host-git.js +102 -0
  146. package/src/code-hosts-api.js +99 -0
  147. package/src/code-hosts.js +482 -0
  148. package/src/code-intelligence-worker.mjs +452 -0
  149. package/src/code-intelligence.js +141 -0
  150. package/src/collab/api.js +365 -0
  151. package/src/collab/checkpoints.js +198 -0
  152. package/src/collab/connections.js +139 -0
  153. package/src/collab/host-execution.js +347 -0
  154. package/src/collab/hub-client.js +210 -0
  155. package/src/collab/link-api.js +229 -0
  156. package/src/collab/link.js +595 -0
  157. package/src/collab/model.js +496 -0
  158. package/src/collab/runner.js +1014 -0
  159. package/src/collab/store.js +1452 -0
  160. package/src/collab/terminals.js +361 -0
  161. package/src/collaboration-reviews.js +116 -0
  162. package/src/config.js +48 -0
  163. package/src/context-budget.js +14 -0
  164. package/src/context-inspection.js +204 -0
  165. package/src/context.js +154 -0
  166. package/src/conventions.js +283 -0
  167. package/src/coordinated-api.js +247 -0
  168. package/src/deferred-launch.js +82 -0
  169. package/src/deferred-runs.js +515 -0
  170. package/src/dependency-health.js +35 -0
  171. package/src/diff.js +43 -0
  172. package/src/docs-help.js +316 -0
  173. package/src/doctor.js +232 -0
  174. package/src/documentation-changes.js +20 -0
  175. package/src/engine.js +5258 -0
  176. package/src/env.js +44 -0
  177. package/src/execution-budget.js +8 -0
  178. package/src/experience.js +50 -0
  179. package/src/extensions.js +144 -0
  180. package/src/filesystem-access.js +107 -0
  181. package/src/filesystem-policy.js +238 -0
  182. package/src/filtered-task-limits.js +93 -0
  183. package/src/filtered-tasks-api.js +53 -0
  184. package/src/filtered-tasks.js +576 -0
  185. package/src/frame-policy.js +66 -0
  186. package/src/fs.js +57 -0
  187. package/src/git.js +626 -0
  188. package/src/github-review-threads.js +181 -0
  189. package/src/github.js +538 -0
  190. package/src/http.js +69 -0
  191. package/src/improve-settings.js +38 -0
  192. package/src/improve.js +187 -0
  193. package/src/integrations.js +373 -0
  194. package/src/integrity.js +259 -0
  195. package/src/journey-api.js +77 -0
  196. package/src/journey-replay.js +65 -0
  197. package/src/journey-store.js +97 -0
  198. package/src/journeys.js +60 -0
  199. package/src/json.js +81 -0
  200. package/src/launch-profiles.js +292 -0
  201. package/src/learnings.js +80 -0
  202. package/src/local-app-url.js +19 -0
  203. package/src/log.js +39 -0
  204. package/src/maintenance.js +335 -0
  205. package/src/memory-analysis.js +182 -0
  206. package/src/memory-claims.js +153 -0
  207. package/src/memory-sqlite.js +236 -0
  208. package/src/memory.js +552 -0
  209. package/src/merge-validation.js +58 -0
  210. package/src/model-catalog.js +239 -0
  211. package/src/model-research.js +91 -0
  212. package/src/notes.js +176 -0
  213. package/src/notifications.js +413 -0
  214. package/src/patterns/auto-team-model.js +230 -0
  215. package/src/patterns/auto-team.js +816 -0
  216. package/src/patterns/council.js +199 -0
  217. package/src/patterns/debate.js +188 -0
  218. package/src/patterns/findings.js +141 -0
  219. package/src/patterns/index.js +21 -0
  220. package/src/patterns/loop.js +158 -0
  221. package/src/patterns/pipeline.js +125 -0
  222. package/src/patterns/prompts.js +181 -0
  223. package/src/patterns/race.js +147 -0
  224. package/src/patterns/schemas.js +40 -0
  225. package/src/patterns/solo.js +46 -0
  226. package/src/patterns/supervisor.js +235 -0
  227. package/src/patterns/task-draft.js +29 -0
  228. package/src/patterns/task-review.js +45 -0
  229. package/src/patterns/tdd.js +231 -0
  230. package/src/patterns/team-strategies.js +67 -0
  231. package/src/performance.js +43 -0
  232. package/src/persistence-status.js +35 -0
  233. package/src/phone-sessions.js +96 -0
  234. package/src/preview-overlay.js +392 -0
  235. package/src/preview.js +230 -0
  236. package/src/privacy.js +23 -0
  237. package/src/project-report.js +22 -0
  238. package/src/project-team-budget.js +22 -0
  239. package/src/project-team-model.js +225 -0
  240. package/src/project-team-policy.js +42 -0
  241. package/src/project-team-store.js +234 -0
  242. package/src/project-team-usage.js +24 -0
  243. package/src/project-teams-api.js +43 -0
  244. package/src/project-teams.js +644 -0
  245. package/src/projects.js +290 -0
  246. package/src/provider-eligibility.js +9 -0
  247. package/src/readiness.js +98 -0
  248. package/src/remote-tls.js +66 -0
  249. package/src/remote-workers/bundles.js +198 -0
  250. package/src/remote-workers/client.js +332 -0
  251. package/src/remote-workers/durability.js +37 -0
  252. package/src/remote-workers/protocol.js +68 -0
  253. package/src/remote-workers/stdio.js +138 -0
  254. package/src/remote-workers/worker.js +304 -0
  255. package/src/remote.js +204 -0
  256. package/src/repo-config.js +201 -0
  257. package/src/repo-coordination.js +725 -0
  258. package/src/repo-tree.js +106 -0
  259. package/src/repository-identity.js +13 -0
  260. package/src/retention-policy.js +466 -0
  261. package/src/review-inbox.js +38 -0
  262. package/src/routing.js +49 -0
  263. package/src/run-analysis.js +111 -0
  264. package/src/run-cold-store.js +231 -0
  265. package/src/run-environment.js +15 -0
  266. package/src/run-history.js +91 -0
  267. package/src/run-log.js +160 -0
  268. package/src/run-permissions.js +111 -0
  269. package/src/run-projection.js +77 -0
  270. package/src/run-recovery.js +53 -0
  271. package/src/run-status.js +56 -0
  272. package/src/serve.js +138 -0
  273. package/src/server.js +2871 -0
  274. package/src/shared-access.js +103 -0
  275. package/src/shared-accounts.js +381 -0
  276. package/src/shared-api.js +239 -0
  277. package/src/shell.js +346 -0
  278. package/src/ship.js +344 -0
  279. package/src/slots.js +74 -0
  280. package/src/snapshot.js +388 -0
  281. package/src/source-context.js +17 -0
  282. package/src/sse-writer.js +70 -0
  283. package/src/ssh-projects/bootstrap.mjs +95 -0
  284. package/src/ssh-projects/config.js +45 -0
  285. package/src/ssh-projects/gateway.js +143 -0
  286. package/src/ssh-projects/manager.js +320 -0
  287. package/src/ssh-projects/team-autostart.mjs +93 -0
  288. package/src/ssh-projects/team-remove.mjs +69 -0
  289. package/src/ssh-projects/team-status.mjs +39 -0
  290. package/src/ssh-projects/transport.js +133 -0
  291. package/src/stats.js +139 -0
  292. package/src/store.js +544 -0
  293. package/src/stream.js +91 -0
  294. package/src/sweeps.js +241 -0
  295. package/src/tailscale.js +101 -0
  296. package/src/task-draft.js +23 -0
  297. package/src/task-team.js +164 -0
  298. package/src/team-evaluation.js +243 -0
  299. package/src/team-mailbox.js +160 -0
  300. package/src/team-memory.js +84 -0
  301. package/src/team-rerun-graph.js +15 -0
  302. package/src/team-reruns.js +130 -0
  303. package/src/team-scheduler.js +121 -0
  304. package/src/team-steering.js +21 -0
  305. package/src/team-template-store.js +98 -0
  306. package/src/team-templates.js +117 -0
  307. package/src/team-tool-client.mjs +79 -0
  308. package/src/team-tools.js +235 -0
  309. package/src/teams.js +0 -0
  310. package/src/templates.js +62 -0
  311. package/src/transcript.js +134 -0
  312. package/src/verification-integrity.js +27 -0
  313. package/src/verification.js +183 -0
  314. package/src/watch.js +195 -0
  315. package/src/work-queue.js +47 -0
  316. package/src/workflow-control.js +83 -0
  317. package/src/workspace-api.js +207 -0
  318. package/src/workspace-changes.js +61 -0
  319. package/src/workspace.js +146 -0
package/public/docs/verification.html ADDED
@@ -0,0 +1,22 @@
1
+ <!doctype html>
2
+ <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Verification and review — code-flow guides and reference"><title>Verification and review · code-flow</title><link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
3
+ <body data-page="verification"><a class="skip-link" href="#content">Skip to content</a>
4
+ <header class="topbar"><a class="brand" href="index.html"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
5
+ <div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" aria-current="page">Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
6
+ <main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Work with agents</div><article><h1 id="verification-and-review">Verification and review</h1>
7
+ <p>Open Project → Repository tools → Verification to inspect the repository’s checks. Select the profile in the composer, then review each required gate and criterion mapping on the final result.</p>
8
+ <h2 id="verify-a-result">Verify a result</h2>
9
+ <p>In the composer, select a verification profile instead of the single legacy check. Lightweight, standard and thorough presets detect existing repository commands. In <strong>Project → Repository tools → Verification</strong>, review/edit the detected commands, add bounded custom gates, map acceptance criteria to checks, and run them at a pinned commit. A baseline comparison runs the same profile on both commits; repeated attempts distinguish consistent failures from flaky results. Export the report or profile for reuse through the API.</p>
10
+ <p>Every required gate must pass. Skipped gates, mixed results, missing criterion mappings and failing mapped checks cannot produce <code>verified</code>. A criterion mapping is your assertion that the chosen checks exercise its behavior; passing a command is not a semantic proof of an arbitrary requirement. Finished work without independent verification is labeled accordingly.</p>
11
+ <p>Thorough detection recognizes <code>test:mutation</code>/<code>mutation</code>, <code>test:visual</code>, and <code>test:a11y</code>/<code>test:accessibility</code> scripts when present. These are explicit mutation, visual and accessibility gates. The repository supplies its testing tools, mutation thresholds, image baselines, target URLs and accessibility rules. code-flow executes the commands and retains their exit/output evidence; it does not install those tools or invent screenshot baselines. Set optional gates to required when their failure must block verification.</p>
12
+ <p>Profiles support at most 12 checks, 48 criteria, 30 minutes per check, three repeats and a one-hour suite deadline. Setup has a separate two-minute bound. Profile checks must preserve tracked files, the index and HEAD; changing tested code or hiding files with Git index flags blocks the result before another gate can run. Ignored or untracked build output is allowed. Temporary worktrees are removed on failure and cancellation.</p>
13
+ <p>The <strong>Changes</strong> side tab records human review of individual files at an exact commit, exposes heuristic change-risk reasons, and records time spent correcting a result. Review coverage becomes stale when the branch moves. Agent activity is not counted as human rework, and a clean test run does not mark files reviewed.</p>
14
+ <p>The result&#39;s merge panel can <strong>Validate merge result</strong> against the current local target branch. This constructs the combined tree in a disposable checkout and runs the configured setup/profile. Requiring validation pins source, target and merged tree; moving refs, rewriting checks or a different merge result invalidates it. Commit-hook changes are detected, with rollback of the application&#39;s own clean merge when possible. GitHub PR merges still use the repository&#39;s remote checks and policies; this local validation does not replace a remote merge queue.</p>
15
+ <p>Checks execute repository code. Use a check container or explicitly trust host execution, especially with imported source text. Agent isolation and check isolation are separate settings. See <a href="security.html">security</a>, <a href="agent-containers.html">agent containers</a>, and the <a href="api.html">API contract</a>.</p>
16
+ <hr>
17
+ <p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
18
+ </article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/verification.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.3 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="review-inbox.html"><small>← Previous</small>Review inbox</a><a href="github.html"><small>Next →</small>GitHub, review and shipping</a></nav></main>
19
+ <aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#verify-a-result">Verify a result</a></aside>
20
+ <aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
21
+ <dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
22
+ </body></html>
package/public/docs/vscode.html ADDED
@@ -0,0 +1,53 @@
1
+ <!doctype html>
2
+ <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Code Flow for VS Code — code-flow guides and reference"><title>Code Flow for VS Code · code-flow</title><link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
3
+ <body data-page="vscode"><a class="skip-link" href="#content">Skip to content</a>
4
+ <header class="topbar"><a class="brand" href="index.html"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
5
+ <div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" aria-current="page">Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
6
+ <main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Build and extend</div><article><h1 id="code-flow-for-vs-code">Code Flow for VS Code</h1>
7
+ <p>Use the local VS Code integration to create tasks and inspect Code Flow results without leaving your editor. The Code Flow server must be running and authenticated before the extension can connect.</p>
8
+ <p>Connect a local VS Code window to a running Code Flow server. Start a Safe solo task
9
+ from the current saved file and selected text, inspect recent run states, open the
10
+ full review in Code Flow, stop a running task, or open a result worktree in a new window.</p>
11
+ <ol>
12
+ <li>Start Code Flow and read its local URL and token from the server startup output.</li>
13
+ <li>Install the locally built VSIX through <strong>Extensions → Install from VSIX</strong>.</li>
14
+ <li>Run <strong>Code Flow: Connect to Local Server</strong>, enter the loopback URL and token.</li>
15
+ <li>Open a trusted local Git folder, then run <strong>Code Flow: Start Task from Editor</strong>.</li>
16
+ </ol>
17
+ <p>Tokens use <a href="https://code.visualstudio.com/api/references/vscode-api#SecretStorage">VS Code SecretStorage</a>.
18
+ They are not put in workspace settings, URLs or logs. Use <strong>Forget Server Token</strong>
19
+ to remove a connection. Server URL configuration is application-wide so a repository
20
+ cannot silently redirect the extension to another service. The client refuses
21
+ redirects, non-loopback endpoints, unsupported API versions and oversized responses.
22
+ An SSH tunnel can expose another Code Flow instance as a local endpoint when its
23
+ forwarded port matches the server&#39;s Host validation.</p>
24
+ <p>Task creation requires workspace trust and local <code>file:</code> folders. Remote VS Code
25
+ workspaces and virtual files are unsupported in this first integration. The task
26
+ uses detected verification, Auto provider selection, bounded execution, no copied
27
+ ignored files and interactive tool approval requests. Current-file context excludes
28
+ credential filenames and paths outside the selected folder. Unsaved files require
29
+ an explicit save before dispatch. Review code and verification in Code Flow before
30
+ shipping a result.</p>
31
+ <p>The Explorer view shows the recent 100 server runs, filtered to local workspace
32
+ folders, and refreshes every ten seconds while visible. It displays verification
33
+ and approval state but does not approve permissions from the editor. Open the full
34
+ run for those decisions. Stopping a task asks for confirmation. Creating a task can
35
+ consume the configured provider&#39;s quota; the extension never starts one on activation.</p>
36
+ <p>From the Code Flow repository:</p>
37
+ <pre><code class="language-sh">python3 scripts/package-vscode.py
38
+ node scripts/test-vscode.mjs
39
+ </code></pre>
40
+ <p>The package is written to <code>output/vscode/</code>. Packaging uses Python 3&#39;s standard
41
+ library. Host acceptance uses an installed <code>code</code> executable (or
42
+ <code>CODEFLOW_VSCODE_BIN</code>), an isolated temporary profile and extension directory, and a
43
+ real Code Flow server with fake agents. It packages and installs the VSIX first,
44
+ then exercises that installed artifact&#39;s activation, command registration, token
45
+ storage, task execution, refresh, token deletion and delayed connection responses.
46
+ See <a href="https://code.visualstudio.com/api/working-with-extensions/testing-extension">VS Code extension testing</a>.
47
+ No marketplace publishing or changes to the user&#39;s installed extensions are performed.</p>
48
+ <p><a href="index.html">Documentation library</a> · <a href="api.html">API and CLI</a> · <a href="getting-started.html">Getting started</a></p>
49
+ </article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/integrations/vscode/README.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.3 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="performance-results.html"><small>← Previous</small>Measured performance: 19 October 2026</a><span></span></nav></main>
50
+ <aside class="on-page" aria-label="On this page"><strong>On this page</strong></aside>
51
+ <aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
52
+ <dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
53
+ </body></html>
package/public/docs/worker-permission-verification.html ADDED
@@ -0,0 +1,131 @@
1
+ <!doctype html>
2
+ <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Live worker permission verification — code-flow guides and reference"><title>Live worker permission verification · code-flow</title><link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
3
+ <body data-page="worker-permission-verification"><a class="skip-link" href="#content">Skip to content</a>
4
+ <header class="topbar"><a class="brand" href="index.html"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
5
+ <div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" aria-current="page">Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
6
+ <main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Engineering records</div><article><h1 id="live-worker-permission-verification">Live worker permission verification</h1>
7
+ <p>Tested locally on macOS, 2026-10-21, using temporary Git fixtures and the user&#39;s existing CLI authentication. No credentials were read/exported and no global provider settings were changed. These are bounded observations of these versions/models, not certification of every model, OS, container or remote worker.</p>
8
+ <div class="table-scroll" tabindex="0"><table>
9
+ <thead>
10
+ <tr>
11
+ <th>Provider</th>
12
+ <th>Version/model</th>
13
+ <th>Observed result</th>
14
+ </tr>
15
+ </thead>
16
+ <tbody><tr>
17
+ <td>Codex</td>
18
+ <td>CLI 0.162.1, <code>gpt-6.1-sol</code>, low effort</td>
19
+ <td>In-workspace edit and terminal write succeeded. A sibling fixture write and localhost HTTP request from the terminal returned <code>EPERM</code>; the outside sentinel stayed unchanged and server received zero requests.</td>
20
+ </tr>
21
+ <tr>
22
+ <td>Codex</td>
23
+ <td>Same CLI/model, app-server</td>
24
+ <td>Scoped <code>codeflow_team.read_inbox</code> reached only the issued local fixture capability and returned <code>LOCAL_MCP_FIXTURE</code>.</td>
25
+ </tr>
26
+ <tr>
27
+ <td>Codex</td>
28
+ <td>Same CLI/model, browser</td>
29
+ <td>A new browser tab read <code>LOCAL_BROWSER_FIXTURE</code> from the local HTTP server and was closed. This worked with terminal network denied, demonstrating the separate browser permission surface. Existing tabs were not inspected.</td>
30
+ </tr>
31
+ <tr>
32
+ <td>Codex</td>
33
+ <td>Fresh low-effort and resumed Ultra session</td>
34
+ <td>Before the fix, native spawn succeeded despite both feature flags being false. After adding <code>agents.enabled=false</code> and explicit v2/thread controls, native spawn was unavailable. The resumed test reused one of the earlier fixture sessions; no cross-provider session was transferred.</td>
35
+ </tr>
36
+ <tr>
37
+ <td>Claude</td>
38
+ <td>CLI 2.1.306, <code>claude-sonnet-5-5</code>, low effort</td>
39
+ <td>Safe profile allowed a fixture file edit and denied the one requested Node terminal command with “requires approval.” No outside write or network request occurred. This is tool-rule enforcement, not an OS sandbox.</td>
40
+ </tr>
41
+ <tr>
42
+ <td>Claude</td>
43
+ <td>Same CLI/model, external tools disabled</td>
44
+ <td>Native web/browser and external MCP were absent in the observed tool surface. After repairing truncated CLI help detection, the explicitly granted local <code>codeflow_team</code> MCP fixture remained callable and returned its marker. No external website or third-party MCP was called.</td>
45
+ </tr>
46
+ <tr>
47
+ <td>Antigravity</td>
48
+ <td>CLI 1.4.4</td>
49
+ <td><code>agy models</code> returned six candidates. Help exposes sandbox and persistent MCP management, but no verified scoped MCP/native-delegation controls. A managed adapter call was rejected before inference. Legacy sandbox execution and external integrations were not certified.</td>
50
+ </tr>
51
+ </tbody></table>
52
+ </div><h2 id="fixes-and-boundaries">Fixes and boundaries</h2>
53
+ <p>Code Flow now passes Codex delegation, hook and sandbox overrides in both the CLI arguments and thread start/resume configuration. Feature-list output alone had incorrectly suggested that delegation was disabled: model-driven v2 required the additional <code>agents.enabled</code> control. Claude managed settings disable workflows, Ultracode and hooks and deny native delegation/scheduling tools. Regular-file help capture avoids truncated piped output and handles Antigravity&#39;s stderr help.</p>
54
+ <p>Mandatory workspace/terminal-network boundaries currently require a compatible local Codex environment. Claude without a container provides tool permissions, not filesystem isolation. Worktrees do not prevent reads outside their directory. With external tools left provider-configured, browser and MCP access continue to follow provider configuration. The adapter rejects mandatory external-tool isolation for Codex instead of claiming its terminal sandbox covers browser/MCP. Antigravity now has a local macOS file-only managed executor; see the latest follow-up below. Other environments remain unsupported.</p>
55
+ <p>CLI discovery does not verify every listed model&#39;s account entitlement. Real inference observations above apply only to the named models. Remote/container controls and all other model/effort combinations remain unverified. The later Antigravity section records its separately tested local executor. Mock tests cover launch flags, policy intersection, recovery and fail-closed behavior separately.</p>
56
+ <p>Official references: <a href="https://learn.chatgpt.com/docs/config-file/config-reference">Codex configuration</a>, <a href="https://learn.chatgpt.com/docs/app-server">Codex app-server</a>, <a href="https://code.claude.com/docs/en/workflows">Claude workflows</a>, <a href="https://www.antigravity.google/docs/cli/reference/">Antigravity CLI reference</a>.</p>
57
+ <p>Repeatable opt-in probes are in <code>scripts/live-permission-probes/</code>; their README explains fixture creation, provider usage and the bounded checks. Runtime bookkeeping is isolated from the application server. The validated catalog service was also exercised against the installed CLIs: 12 Claude models (11 reporting effort controls), seven Codex models, and six Antigravity models (per-model effort support unknown).</p>
58
+ <h2 id="antigravity-auto-feasibility-follow-up">Antigravity Auto feasibility follow-up</h2>
59
+ <p>On 2026-10-21, two additional real <code>agy</code> 1.4.4 turns used <code>gemini-3.8-flash-low</code>, <code>--sandbox</code>, <code>--disable-slash-commands</code> and a workspace custom agent allowing only <code>view_file</code>, with <code>subagent: false</code> and <code>commandExecutionPolicy: off</code>. Neither turn used <code>--dangerously-skip-permissions</code>.</p>
60
+ <p>Both turns read the fixture successfully. In the second, the model was asked to attempt a fixture write and a harmless terminal command <strong>only if those tools were offered</strong>. It reported them unavailable; only <code>view_file</code> calls were observed and no write marker appeared. This is evidence that a custom-agent allowlist narrowed the observed model surface. It is not a forced-call rejection test. The <code>init.tools</code> event still listed terminal, write, browser, MCP, workflow and native delegation tools; that event is therefore not an attestation of the effective allowlist. A fixture SessionStart hook did not produce its marker; this does not establish that all hooks are disabled.</p>
61
+ <p>The current supported CLI interface does not provide verified per-run settings isolation, hook suppression, or scoped MCP configuration. Documented permissions live in shared settings; allowed paths, domains and <code>unsandboxed</code> rules can change the terminal sandbox&#39;s effective boundary. Hooks may come from workspace, global settings and plugins. A custom-agent file cannot establish that these independent surfaces obey the run policy. See <a href="https://www.antigravity.google/docs/permissions">CLI permissions</a>, <a href="https://www.antigravity.google/docs/sandbox">terminal sandbox</a>, <a href="https://www.antigravity.google/docs/subagents/">custom agents</a> and <a href="https://www.antigravity.google/docs/hooks/">hooks</a>.</p>
62
+ <p><strong>Decision: keep managed Antigravity unavailable.</strong> The adapter and routing now share an actionable diagnostic, and capability reporting labels its sandbox enforcement unknown rather than tested merely because help exists. Regression tests reject every trust level, read/write turns, Solo, resumed assignments and container/remote choices. The legacy skip-permissions environment setting cannot override that rejection.</p>
63
+ <p>Enabling Auto requires either a supported invocation-scoped policy interface or a separately implemented isolated executor. That executor must keep policy/configuration outside worker write access, exclude ambient hooks/plugins/MCP, mediate every exposed tool (including browser and delegation), separate inference connectivity from command networking, and reapply/recheck policy on resume. A container alone does not establish these properties. Temporarily editing global settings would race other sessions; a prompt instruction or post-turn revert is not enforcement. No global settings were modified and no credentials were copied for this investigation.</p>
64
+ <p><code>scripts/live-permission-probes/antigravity.ts</code> repeats the bounded custom-agent check. It remains an opt-in research probe, not a supported managed execution path.</p>
65
+ <h2 id="isolated-execution-investigation">Isolated execution investigation</h2>
66
+ <p>The next investigation on 2026-10-21 implemented an <strong>offline macOS containment prototype</strong>, separate from the adapter. <code>agy-isolation-fixture.ts</code> creates a fresh home, restrictive settings, empty MCP/hook configuration and a file-reading custom agent. Its OS policy allows workspace and scratch writes, protects the entire home from changes, excludes workspace customizations from reads, and denies network access for the whole process tree. The child environment is constructed from a small allowlist; it does not inherit provider keys, SSH sockets or Code Flow credentials. Standard system file reads and filesystem metadata remain allowed. This is not a complete cross-platform executor.</p>
67
+ <p>Real kernel checks passed for a local workspace write and scratch write, and rejected:</p>
68
+ <ul>
69
+ <li>Reading a fixture outside the workspace through a symlink.</li>
70
+ <li>Reading workspace <code>.agents/hooks.json</code>.</li>
71
+ <li>Changing settings permissions, overwriting settings, or replacing their parent directory.</li>
72
+ <li>Writing an outside sentinel or connecting to a local TCP server (zero accepted connections).</li>
73
+ </ul>
74
+ <p>The actual Antigravity 1.4.4 executable returned its version inside this boundary. <code>agy models</code> exited unsuccessfully there; no inference was attempted. A separate discovery-only check with a fresh home and normal network access returned “Please sign in.” Existing host authentication was not copied. This establishes that starting the binary and enforcing fixture containment are possible, but it does not establish authenticated model access, native tool enforcement, hook suppression by the vendor runtime, or session recovery.</p>
75
+ <p>Antigravity&#39;s <a href="https://www.antigravity.google/docs/cli/install/">official authentication documentation</a> describes interactive sign-in and alternative API-key/enterprise ADC paths. Those alternatives are not interchangeable with the user&#39;s current subscription and were not enabled as a workaround.</p>
76
+ <p>Docker is installed on this machine, but its daemon socket was unavailable before and after a Desktop startup attempt. The ordinary container wrapper is also insufficient by itself: its writable home/auth volume could retain ambient settings, and its network permits inference and shell traffic together. No container compatibility claim was made and no Docker security settings were relaxed.</p>
77
+ <p><strong>At this stage Auto remained blocked (superseded by the login-reuse follow-up below).</strong> To proceed, the isolated executor needs separately provisioned authentication, inference connectivity separated from command networking, and real tests of browser/MCP/delegation denial and fresh/resumed execution. A production container implementation would additionally need immutable policy mounts and a clean workspace customization namespace. The experimental profile deliberately grants no inference network access and cannot be promoted into production by a successful fixture test or a user-supplied readiness flag. The current adapter and recovery gates are unchanged.</p>
78
+ <h2 id="existing-login-reuse-and-managed-file-workers">Existing login reuse and managed file workers</h2>
79
+ <p>The 2026-10-21 follow-up found a working path for <strong>macOS / Antigravity CLI 1.4.4</strong>. A clean <code>HOME</code> can reuse the existing login through the native macOS Keychain. Code Flow creates a temporary <code>Library/Keychains</code> symlink, grants read-only access to its target, and lets the official CLI call <code>/usr/bin/security</code>. It never extracts a password, exports an OAuth token, copies a credential file, or substitutes API-key billing. The CLI also needs reads of macOS security-module metadata and write-data access to the existing <code>mds.lock</code> cache lock. Broad cache writes are not granted. Merely linking legacy OAuth files did not authenticate the CLI.</p>
80
+ <p><code>src/adapters/agy-isolation.ts</code> now implements the narrowly scoped executor. Each turn gets a fresh private home, an allowlisted environment, immutable provider settings/custom agent, empty MCP/hook configuration and a protected default project record. The macOS policy restricts writes to the workspace (write turns only), runtime state, scratch and the one native cache lock. Policy files and ancestors, workspace customizations, Git metadata and host login files are protected. Only the verified CLI binary and Apple&#39;s security helper can execute. File tools are separately denied access to authentication, security-cache and runtime paths, including canonicalized symlink targets. Terminal, browser, MCP, workflow and native agent tools are excluded. The vendor&#39;s local <code>manage_task</code> bookkeeping tool can still appear; it is not the native delegation tool.</p>
81
+ <p>Inference networking remains enabled. This is <strong>file-only execution</strong>, not a general-purpose network-denied shell sandbox. Code Flow&#39;s check/setup commands retain their separately configured execution environment. System runtime files/metadata remain readable. This is not a complete VM boundary or a claim that every provider has identical isolation.</p>
82
+ <p>Bounded observations from the real CLI and <code>gemini-3.8-flash-low</code>:</p>
83
+ <ul>
84
+ <li>Six model candidates were discovered inside this executor with the existing login.</li>
85
+ <li>A file-reading/editing turn completed, and its JSON response was parsed through Code Flow&#39;s normal structured-result fallback.</li>
86
+ <li>A later read-only turn read the saved result with fresh provider state. Neither turn retained a native session ID.</li>
87
+ <li>A synthetic outside-file symlink read failed. A direct write and reads/writes through a symlink into protected profile state matched the provider deny rule; sentinels remained unchanged.</li>
88
+ <li>The workspace hook marker remained absent. The local browser fixture received zero requests. Terminal/browser/native delegation tools were not used; this is observed behavior plus configured controls, not arbitrary forced-tool-call fuzzing.</li>
89
+ <li>Deterministic tests exercise both read/write OS profiles, protected files, outside paths, Git metadata, child execution, environment scrubbing, forged policy rejection, unknown CLI versions, native-session rejection, catalog separation and mocked Auto dispatch/recovery.</li>
90
+ <li>A real end-to-end Auto fixture completed with verdict <strong>passed</strong>: <code>gpt-6.1-sol</code>/low coordinated, <code>gemini-3.8-flash-low</code> made the requested README edit, and the configured Node check plus independent review completed. Five steps completed with no failed steps. The Antigravity step recorded <code>os-sandbox</code>, <code>macos-file-only-v1</code>, isolated catalog revision 1 and no native session ID. This verifies that the adapter is reached through actual Auto dispatch, beyond standalone CLI probes.</li>
91
+ </ul>
92
+ <p>Managed eligibility now permits this local executor and rejects remote/container execution, interactive approvals and unverified CLI versions. Every launch rechecks the environment; <code>CODEFLOW_AGY_SKIP_PERMISSIONS</code> cannot bypass managed controls. Inventory describes the file-only restriction to the coordinator. The effective executor version is recorded on steps, while model assignments retain the isolated catalog revision/environment/provenance. A native session supplied during recovery is rejected as unavailable so the engine rebuilds a fresh turn from portable context. No session is transferred across providers.</p>
93
+ <p>The exact CLI version is deliberately pinned. Updating Antigravity requires re-verifying controls before changing that pin. Windows/Linux, container authentication reuse, other models/efforts and arbitrary forbidden-call injection are unverified. Authentication tests used a valid existing login; expired-login refresh was not tested. Read-only Keychain file rules do not claim to constrain the macOS security service&#39;s own credential lifecycle. The old offline prototype and earlier blocked decisions above remain historical investigation evidence, not the current production path.</p>
94
+ <p>Repeat the adapter probe with <code>node --import tsx scripts/live-permission-probes/managed-antigravity.ts</code>; repeat a real mixed-provider Auto fixture with <code>node --import tsx scripts/live-permission-probes/managed-antigravity-auto.ts</code>. Both consume provider usage and touch only synthetic project files. Official control references: <a href="https://www.antigravity.google/docs/subagents/">custom agents</a> and <a href="https://www.antigravity.google/docs/permissions">permission rules</a>.</p>
95
+ <h2 id="antigravity-permission-and-recovery-review-2026-10-21">Antigravity permission and recovery review (2026-10-21)</h2>
96
+ <p>The review found and fixed these gaps in the managed executor:</p>
97
+ <ul>
98
+ <li>Version inspection previously executed the candidate binary outside isolation. It now runs in a separate default-deny profile without host HOME, credentials or networking. Version and model probes use tracked process groups, so timeout and server recovery cover their children too.</li>
99
+ <li>Nested workspace <code>.agents</code>, <code>.gemini</code> and <code>.git</code> paths were not protected. Kernel rules now cover nested paths and canonical symlink targets, including workspace names containing regex metacharacters.</li>
100
+ <li>Native authentication/refresh errors could be classified as ordinary failures, and raw diagnostics could reach run history. Managed output now withholds native diagnostics and buffers response text until success; expired/revoked tokens and locked Keychains produce a safe auth failure. No automatic interactive login, global settings edits, credential export or permissive retry was added.</li>
101
+ <li>Recovery could retain the signed-out cooldown after the user repaired the login. Explicit Resume now requires fresh isolated discovery before clearing that cooldown. Failed/offline discovery and stale cached models leave it blocked. The original assignments/provenance and partial work remain recorded, and new execution rechecks model eligibility and effective permissions with a fresh provider home.</li>
102
+ <li>Workflow revisions previously rejected even an unchanged idle member whose login became unavailable. They can now retain that member and stop cleanly; adding, reassigning or retrying work still requires an eligible provider and preserves user pins.</li>
103
+ <li>Unexpected runtime tool events stop the worker and override a subsequent success result. This is drift detection, <strong>not pre-execution mediation</strong>; protected native policy and the OS sandbox remain the enforcement boundary. Preparation cleanup also runs if the initial event listener throws.</li>
104
+ </ul>
105
+ <p>Deterministic tests cover auth-result and diagnostic-only failures, secret-marker non-persistence, fresh-turn recovery, unchanged permission receipts, forbidden tool drift, cleanup, and a full Auto stop/reload/login-repair/resume with preserved partial files and model pins. Actual macOS kernel probes cover nested configuration, policy and authentication writes, outside symlinks and unauthorized executable launch.</p>
106
+ <p>The real CLI 1.4.4 passed the updated adapter read/write probes with <code>gemini-3.8-flash-low</code>: the edit and structured result succeeded, the outside read was denied, the outside file stayed unchanged, no hook marker appeared, no browser requests reached the fixture, and no native session was retained. These are bounded existing-login observations. Expired-login refresh is still <strong>not real-provider verified</strong>: tests simulate failures and repair without revoking, replacing or exporting the user&#39;s login. The native CLI owns refresh inside the existing boundary; if refresh needs additional access, the turn fails instead of expanding permissions. macOS security-service credential lifecycle access remains a documented trust boundary. See the provider&#39;s <a href="https://www.antigravity.google/docs/cli/troubleshooting/">locked-Keychain troubleshooting</a>.</p>
107
+ <p>The updated real mixed-provider Auto probe also completed successfully: Codex coordinated, one isolated Antigravity turn edited the fixture, and independent review plus the check passed (five completed steps, zero failed steps). The worker recorded its catalog revision and <code>macos-file-only-v1</code> permissions without retaining a native session.</p>
108
+ <h2 id="non-destructive-native-refresh-investigation-2026-10-21">Non-destructive native refresh investigation (2026-10-21)</h2>
109
+ <p>The <a href="https://www.antigravity.google/docs/cli/reference/">official CLI command reference</a> and installed 1.4.4 help expose no documented force-refresh command. The <a href="https://www.antigravity.google/docs/install?tab=cli">authentication guide</a> describes silent native-Keychain reuse and a destructive <code>/logout</code>; logout was not used. Inspection of the installed executable&#39;s static messages identified native refresh and credential-persistence diagnostics. This inspected the executable, not stored credential values, and does not establish a supported refresh API.</p>
110
+ <p>The new opt-in <code>scripts/live-permission-probes/antigravity-refresh.ts</code> runs only a normal <code>agy models</code> request in the production read-only sandbox with a fresh provider home. It observes a private native log using bounded, symlink-rejecting reads, emits only a closed set of boolean/status fields, and removes the temporary profile/log afterward. It does not export tokens, read Keychain values directly, change the clock or expiry, revoke credentials, change account settings, intercept TLS, or redirect OAuth endpoints. Normal token renewal is owned by the official CLI and may update its stored tokens; the probe does not promise byte-for-byte unchanged native credential storage.</p>
111
+ <p>Actual isolated requests returned six model candidates. Native logging explicitly reported a <strong>non-expired loaded token</strong>, with no refresh event, interactive authentication attempt or credential-persistence failure observed. This verifies ordinary login reuse. <strong>Actual expired-token renewal and successful persistence remain unverified.</strong> Repeating valid-token requests is not proof of refresh. The script returns exit code 2 when refresh was not observed, 1 when the native request/authentication failed, and 0 only when a native refresh event and successful discovery were observed. <code>credentialPersistence: not-attested</code> remains explicit even then; <code>expiredTokenRefreshVerified</code> additionally requires a native expired-at-load observation. Evidence cannot grant runtime permissions or clear a known failure on its own.</p>
112
+ <p>This investigation also found native messages for refresh persistence failure and fallback to credential files that were missing from Code Flow&#39;s error handling. Managed inference and isolated discovery now inspect their private native auth logs before accepting success. Known persistence/fallback or interactive-auth diagnostics reject the operation safely, even if inference returned success; raw diagnostics and structured failure payloads are not copied into run history. These are detection checks after native execution, not interception of the macOS security service or a guarantee that the CLI never attempted a fallback write. The existing sandbox and model-tool restrictions remain unchanged. Unreadable/missing/oversized logs are explicitly inconclusive to the refresh probe, never evidence that renewal succeeded.</p>
113
+ <p>Deterministic tests cover valid-token reuse versus refresh, persistence/fallback errors, successful-result override, secret-marker non-persistence, bounded/symlink-safe log reads and interactive authentication observation. No live credentials were deliberately expired, replaced, exported or revoked to exercise these cases. Safe completion of expired-token verification requires observing a naturally due refresh or a provider-supported test interface; Code Flow does not bypass that constraint.</p>
114
+ <h2 id="explicit-unrestricted-native-mode-2026-10-21">Explicit unrestricted native mode (2026-10-21)</h2>
115
+ <p>User-authorized <code>antigravityExecution: &quot;native&quot;</code> reuses the installed CLI&#39;s existing host login and normal configuration. It deliberately removes Code Flow&#39;s file-only isolation and vendor sandbox for Antigravity, and records <code>agy-native-v1</code>, <code>isolation: none</code>, full trust, allowed command networking, provider-configured external tools and native delegation. This is an explicit permission exception, not verified sandbox enforcement. Default and historical isolated runs retain their original behavior.</p>
116
+ <p>Real acceptance: <code>node --import tsx scripts/live-permission-probes/managed-antigravity-auto.ts --native</code> completed with five successful steps, one Antigravity write turn, final verdict <code>passed</code>, expected README marker and no native session reuse. The recorded tools included Antigravity <code>run_command</code>; the synthetic task requested its terminal test. Codex coordinated and independently reviewed. No login/logout command, credential export, forced expiry, revocation or user configuration edit was performed. Native catalog discovery also returned six models through the existing profile.</p>
117
+ <p>Browser, MCP, hooks and native child agents were not exercised in the live probe. They are not restricted by this mode; native child usage cannot be bounded by Code Flow&#39;s roster/invocation budget. Native expired-token refresh remains unverified. Deterministic tests simulate refresh-persistence failures, verify private diagnostic handling and cleanup, and exercise restart/recovery for both native and isolated modes without widening authority.</p>
118
+ <h2 id="antigravity-145-compatibility-2026-10-22">Antigravity 1.4.5 compatibility (2026-10-22)</h2>
119
+ <p>The installed CLI updated to 1.4.5. The explicit supported-version list now includes 1.4.4 and 1.4.5; unknown versions still stop before an isolated launch. Agent mode preserves the Antigravity executor&#39;s native-delegation setting instead of applying Claude/Codex conversation permissions to it.</p>
120
+ <p>The production adapter&#39;s live write/read probe passed on 1.4.5: a workspace edit and structured answer succeeded, the outside symlink read produced a tool denial, the outside sentinel stayed unchanged, no hook marker appeared, no request reached the browser fixture, and no native session was retained. Kernel fixture tests still cover policy/configuration/authentication-write denials. A real Claude → Codex → Antigravity UI fork also recovered the carried conversation token. These observations retain the existing file-only scope and authentication limitations; they do not certify arbitrary future runtime versions or unrestricted browser/MCP behavior.</p>
121
+ <h2 id="task-scoped-antigravity-tools-2026-10-22-later-update">Task-scoped Antigravity tools (2026-10-22, later update)</h2>
122
+ <p>Interactive Antigravity Agent and Team turns can now use the shared Codeflow browser and computer bridge. Their isolated receipt is <code>macos-task-tools-v2</code> with <code>externalTools: task-scoped</code>; required <code>no-external-tools</code> retains the existing <code>macos-file-only-v1</code> profile and exposes no bridge. This supersedes earlier statements that isolated Antigravity is always file-only. Native shell/browser, ambient customizations and provider delegation remain unavailable in the isolated profile.</p>
123
+ <p>A fresh private HOME contains sealed settings and a custom agent exposing only the known <code>codeflow_agent</code> tool names. HTTP MCP uses a loopback endpoint and an expiring invocation token. Its transport shares the same read/write, task ownership, approval, cancellation and revocation checks as the Claude/Codex stdio bridge. MCP resources are empty; discovery does not grant access to host resources. The native-mode path uses a private configuration overlay and leaves global settings unchanged. No ambient MCP server is imported into the isolated profile.</p>
124
+ <p>Computer tools operate outside the workspace and remain gated by Full access for Antigravity, plus macOS Screen Recording and Accessibility permissions. Every action requires a fresh screenshot token and the same foreground app; foreground identity is checked before and after capture. Pixel coordinates remain the default for existing callers. Antigravity explicitly selects the normalized 0–1000 coordinate format, which the host converts to display points. Invocation-private offloaded screenshot files are readable so the model can inspect its tool results; private settings, MCP configuration and authentication data remain protected.</p>
125
+ <p>Schema-constrained turns permit Antigravity&#39;s built-in <code>finish</code> control tool. Only its injected <code>toolAction</code> and <code>toolSummary</code> metadata are removed when not requested by the schema; other unexpected properties remain subject to validation. Successful browser/computer effects record tool names and timestamps, without arguments, as host evidence. These receipts establish that an action succeeded at the tool boundary, not that the user&#39;s task is correct; independent review and configured checks still apply.</p>
126
+ <p>Real Antigravity 1.4.5 validation passed the shared browser form, file/folder uploads and authenticated downloads after human/Claude/Codex use. Real Agent and Team computer turns filled and submitted a dedicated native fixture, with exact output verified by Codeflow. Earlier failed foreground/coordinate attempts were retained and corrected without removing the app guard. See <code>output/agent-mode/agy-browser-structured-final.log</code>, <code>agy-transfers-live.log</code> and <code>agy-computer-normalized-final.log</code>, and the detailed validation record in <code>docs/plans/agent-mode-validation.md</code>. These are bounded observations of the installed versions, not certification of arbitrary native tools, future versions or expired-token renewal.</p>
127
+ </article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/worker-permission-verification.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.3 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="dynamic-teams-implementation-review-1.html"><small>← Previous</small>Review 1: the dynamic teams implementation</a><a href="dynamic-teams-plan-review-0.html"><small>Next →</small>Review 0: Dynamic teams implementation plan</a></nav></main>
128
+ <aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#fixes-and-boundaries">Fixes and boundaries</a><a class="depth-2" href="#antigravity-auto-feasibility-follow-up">Antigravity Auto feasibility follow-up</a><a class="depth-2" href="#isolated-execution-investigation">Isolated execution investigation</a><a class="depth-2" href="#existing-login-reuse-and-managed-file-workers">Existing login reuse and managed file workers</a><a class="depth-2" href="#antigravity-permission-and-recovery-review-2026-10-21">Antigravity permission and recovery review (2026-10-21)</a><a class="depth-2" href="#non-destructive-native-refresh-investigation-2026-10-21">Non-destructive native refresh investigation (2026-10-21)</a><a class="depth-2" href="#explicit-unrestricted-native-mode-2026-10-21">Explicit unrestricted native mode (2026-10-21)</a><a class="depth-2" href="#antigravity-145-compatibility-2026-10-22">Antigravity 1.4.5 compatibility (2026-10-22)</a><a class="depth-2" href="#task-scoped-antigravity-tools-2026-10-22-later-update">Task-scoped Antigravity tools (2026-10-22, later update)</a></aside>
129
+ <aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
130
+ <dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
131
+ </body></html>
package/public/index.html ADDED
@@ -0,0 +1,17 @@
1
+ <!doctype html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
6
+ <title>code-flow</title>
7
+ <script>
8
+ // The theme you picked (ui/theme.ts), applied before the first paint so the page never flashes the other one.
9
+ try { var t = localStorage.getItem("theme"); if (t === "light" || t === "dark") document.documentElement.dataset.theme = t; } catch (e) {}
10
+ </script>
11
+ <link rel="stylesheet" href="/assets/styles-18792BB4.css" />
12
+ </head>
13
+ <body>
14
+ <div id="root"></div>
15
+ <script type="module" src="/assets/main-65EW73SB.js"></script>
16
+ </body>
17
+ </html>
package/scripts/check-node.mjs ADDED
@@ -0,0 +1,7 @@
1
+ // Imported first by `npm start`'s and `npm run dev`'s scripts: an older Node would otherwise
2
+ // fail later with an error that doesn't say why.
3
+ const [major, minor] = process.versions.node.split(".").map(Number);
4
+ if (major < 22 || (major === 22 && minor < 13)) {
5
+ console.error(`code-flow needs Node.js 22.13 or newer, and this is Node ${process.version}. Install a newer Node (https://nodejs.org), then run this again.`);
6
+ process.exit(1);
7
+ }
package/scripts/codeflow.mjs ADDED
@@ -0,0 +1,55 @@
1
+ #!/usr/bin/env node
2
+ // The documented HTTP client never shells out, reads provider credentials, or infers consent.
3
+ import { readFile, writeFile } from "node:fs/promises";
4
+
5
+ const [command = "help", ...args] = process.argv.slice(2);
6
+ const usage = `code-flow client
7
+
8
+ codeflow client status
9
+ codeflow client runs [search]
10
+ codeflow client run request.json
11
+ codeflow client readiness /absolute/repo [--execute]
12
+ codeflow client verify /absolute/repo [profile.json]
13
+ codeflow client pause RUN_ID
14
+ codeflow client continue RUN_ID
15
+ codeflow client resume RUN_ID
16
+ codeflow client export RUN_ID [output.json]
17
+ codeflow client diagnostics [output.json]
18
+
19
+ Set CODEFLOW_URL (default http://127.0.0.1:4317) and CODEFLOW_TOKEN to the
20
+ server's explicit Bearer token. Commands use the versioned /api/v1 routes.
21
+ Maintenance is separate: npm run maintenance -- --help.
22
+ `;
23
+ if (["help", "--help", "-h"].includes(command)) { process.stdout.write(usage); process.exit(0); }
24
+ const known = new Set(["status", "runs", "run", "readiness", "verify", "pause", "continue", "resume", "export", "diagnostics"]);
25
+ if (!known.has(command)) { process.stderr.write(`Unknown command: ${command}\n${usage}`); process.exit(2); }
26
+ const token = process.env.CODEFLOW_TOKEN;
27
+ if (!token) { process.stderr.write("Set CODEFLOW_TOKEN to the explicit token used by your server.\n"); process.exit(2); }
28
+ const origin = new URL(process.env.CODEFLOW_URL || "http://127.0.0.1:4317");
29
+ if (!["http:", "https:"].includes(origin.protocol) || origin.username || origin.password) throw new Error("CODEFLOW_URL must be an HTTP(S) origin without embedded credentials");
30
+ const requestFile = async (path) => {
31
+ if (!path) throw new Error("Name a JSON request file");
32
+ const text = await readFile(path, "utf8");
33
+ if (text.length > 40 * 1024 * 1024) throw new Error("Request file exceeds 40 MB");
34
+ return JSON.parse(text);
35
+ };
36
+ const requireId = () => { if (!args[0] || !/^[a-zA-Z0-9-]{1,100}$/.test(args[0])) throw new Error("Choose a run ID"); return args[0]; };
37
+ let path = "/health", method = "GET", body, output;
38
+ try {
39
+ switch (command) {
40
+ case "runs": path = `/runs?limit=50${args[0] ? `&q=${encodeURIComponent(args[0])}` : ""}`; break;
41
+ case "run": path = "/runs"; method = "POST"; body = await requestFile(args[0]); break;
42
+ case "readiness": path = "/readiness"; method = "POST"; body = { repo: args[0], execute: args.includes("--execute") }; break;
43
+ case "verify": path = "/verification"; method = "POST"; body = { repo: args[0], ...(args[1] ? { profile: await requestFile(args[1]) } : {}) }; break;
44
+ case "pause": case "continue": path = `/runs/${requireId()}/pause`; method = "POST"; body = { paused: command === "pause" }; break;
45
+ case "resume": path = `/runs/${requireId()}/resume`; method = "POST"; body = {}; break;
46
+ case "export": path = `/runs/${requireId()}/export?transcript=1`; output = args[1]; break;
47
+ case "diagnostics": path = "/diagnostics"; output = args[0]; break;
48
+ }
49
+ const response = await fetch(new URL(`/api/v1${path}`, origin), { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(command === "verify" || command === "readiness" ? 65 * 60_000 : 120_000), redirect: "error" });
50
+ const value = await response.json();
51
+ if (!response.ok) throw new Error(value.error || `HTTP ${response.status}`);
52
+ const text = `${JSON.stringify(value, null, 2)}\n`;
53
+ if (output) { await writeFile(output, text, { mode: 0o600, flag: "wx" }); process.stdout.write(`Saved ${output}\n`); }
54
+ else process.stdout.write(text);
55
+ } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
package/scripts/computer-use.swift ADDED
@@ -0,0 +1,64 @@
1
+ import Foundation
2
+ import AppKit
3
+ import ApplicationServices
4
+ import CoreGraphics
5
+ import Carbon
6
+
7
+ // One JSON request on stdin, one JSON response on stdout. No prompts or shell interpretation.
8
+ func fail(_ message: String) -> Never {
9
+ let data = try! JSONSerialization.data(withJSONObject: ["error": message])
10
+ FileHandle.standardOutput.write(data); exit(1)
11
+ }
12
+ let input = FileHandle.standardInput.readDataToEndOfFile()
13
+ guard let request = (try? JSONSerialization.jsonObject(with: input)) as? [String: Any], let action = request["action"] as? String else { fail("Invalid computer request") }
14
+ let bounds = CGDisplayBounds(CGMainDisplayID())
15
+ func reply(_ value: [String: Any]) {
16
+ let data = try! JSONSerialization.data(withJSONObject: value); FileHandle.standardOutput.write(data)
17
+ }
18
+ if action == "status" {
19
+ reply(["screenRecording": CGPreflightScreenCaptureAccess(), "accessibility": AXIsProcessTrusted(), "secureInput": IsSecureEventInputEnabled(), "width": bounds.width, "height": bounds.height]); exit(0)
20
+ }
21
+ if let expected = request["expectedApp"] as? String, NSWorkspace.shared.frontmostApplication?.localizedName != expected { fail("The foreground app changed (expected \(expected), found \(NSWorkspace.shared.frontmostApplication?.localizedName ?? "Unknown")). Take a new screenshot of the intended app before acting.") }
22
+ if action == "screenshot" {
23
+ guard CGPreflightScreenCaptureAccess() else { fail("Enable Screen Recording for Codeflow in macOS System Settings → Privacy & Security, then restart Codeflow.") }
24
+ let path = FileManager.default.temporaryDirectory.appendingPathComponent("codeflow-screen-\(UUID().uuidString).png")
25
+ defer { try? FileManager.default.removeItem(at: path) }
26
+ let capture = Process(); capture.executableURL = URL(fileURLWithPath: "/usr/sbin/screencapture"); capture.arguments = ["-x", "-D", "1", "-t", "png", path.path]
27
+ capture.standardError = FileHandle.nullDevice
28
+ do { try capture.run(); capture.waitUntilExit() } catch { fail("Screen capture failed") }
29
+ guard capture.terminationStatus == 0, let data = try? Data(contentsOf: path), let image = NSBitmapImageRep(data: data) else { fail("Screen capture failed") }
30
+ if let expected = request["expectedApp"] as? String, NSWorkspace.shared.frontmostApplication?.localizedName != expected { fail("The foreground app changed during capture. Take a new screenshot of the intended app before acting.") }
31
+ reply(["data": data.base64EncodedString(), "width": image.pixelsWide, "height": image.pixelsHigh, "pointWidth": bounds.width, "pointHeight": bounds.height, "app": NSWorkspace.shared.frontmostApplication?.localizedName ?? "Unknown"]); exit(0)
32
+ }
33
+ guard AXIsProcessTrusted() else { fail("Enable Accessibility for Codeflow in macOS System Settings → Privacy & Security, then restart Codeflow.") }
34
+ if (action == "type" || action == "key") && IsSecureEventInputEnabled() { fail("macOS Secure Keyboard Entry is active. Close the secure input field before typing with computer tools.") }
35
+ let source = CGEventSource(stateID: .privateState)
36
+ source?.localEventsSuppressionInterval = 0
37
+ if action == "click" {
38
+ guard let x = request["x"] as? Double, let y = request["y"] as? Double, x >= 0, y >= 0, x < bounds.width, y < bounds.height else { fail("Coordinates are outside the display") }
39
+ let point = CGPoint(x: bounds.minX + x, y: bounds.minY + y)
40
+ CGEvent(mouseEventSource: source, mouseType: .leftMouseDown, mouseCursorPosition: point, mouseButton: .left)?.post(tap: .cghidEventTap)
41
+ CGEvent(mouseEventSource: source, mouseType: .leftMouseUp, mouseCursorPosition: point, mouseButton: .left)?.post(tap: .cghidEventTap)
42
+ } else if action == "type" {
43
+ guard let text = request["text"] as? String, text.count <= 10000 else { fail("Keep computer text within 10000 characters") }
44
+ let chars = Array(text.utf16)
45
+ for start in stride(from: 0, to: chars.count, by: 20) {
46
+ let chunk = Array(chars[start..<min(start + 20, chars.count)])
47
+ for down in [true, false] {
48
+ let event = CGEvent(keyboardEventSource: source, virtualKey: 0, keyDown: down)
49
+ event?.flags = []
50
+ event?.keyboardSetUnicodeString(stringLength: chunk.count, unicodeString: chunk)
51
+ event?.post(tap: .cghidEventTap)
52
+ }
53
+ }
54
+ } else if action == "key" {
55
+ let keys: [String: CGKeyCode] = ["Enter": 36, "Tab": 48, "Escape": 53, "Backspace": 51, "ArrowLeft": 123, "ArrowRight": 124, "ArrowDown": 125, "ArrowUp": 126, "Space": 49]
56
+ guard let key = request["key"] as? String, let code = keys[key] else { fail("Unsupported computer key") }
57
+ CGEvent(keyboardEventSource: source, virtualKey: code, keyDown: true)?.post(tap: .cghidEventTap)
58
+ CGEvent(keyboardEventSource: source, virtualKey: code, keyDown: false)?.post(tap: .cghidEventTap)
59
+ } else if action == "scroll" {
60
+ let amount = max(-1000, min(1000, request["pixels"] as? Int ?? 500))
61
+ CGEvent(scrollWheelEvent2Source: source, units: .pixel, wheelCount: 1, wheel1: Int32(-amount), wheel2: 0, wheel3: 0)?.post(tap: .cghidEventTap)
62
+ } else { fail("Unknown computer action") }
63
+ Thread.sleep(forTimeInterval: 0.1)
64
+ reply(["ok": true, "app": NSWorkspace.shared.frontmostApplication?.localizedName ?? "Unknown"])