@minhspark/codex-mcp-bridge 1.23.0 → 1.24.1

package/src/antigravity-desktop.mjs

@@ -0,0 +1,146 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execute = promisify(execFile);
+const SURFACES = { desktop: "antigravity", cli: "antigravity-cli" };
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+
+function failure(code, message) {
+  return Object.assign(new Error(message), { code, deliveryState: "not_sent" });
+}
+
+function nativeDiagnostic(error, env, args) {
+  const exitCode = Number.isInteger(error.code) ? String(error.code) : /^[A-Z_]{2,40}$/.test(error.code ?? "") ? error.code : "unknown";
+  let detail = "";
+  try {
+    const parsed = JSON.parse(error.stdout);
+    if (typeof parsed.error === "string") detail = parsed.error;
+  } catch {}
+  for (const value of [...Object.entries(env).filter(([key]) => /ANTIGRAVITY|TOKEN|SECRET|PASSWORD|AUTH|KEY/i.test(key)).map(([, value]) => value), ...args.slice(1)]) {
+    if (typeof value === "string" && value) detail = detail.split(value).join("[redacted]");
+  }
+  detail = detail.replace(/https?:\/\/[^\s"']+/gi, "[endpoint]").replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(/[\r\n\x00-\x1f]/g, " ").slice(0, 400);
+  return `exit ${exitCode}${detail ? `: ${detail}` : ""}`;
+}
+
+function canonicalCwd(value) {
+  if (typeof value !== "string" || !path.isAbsolute(value)) throw failure("ANTIGRAVITY_CWD_INVALID", "An absolute existing workspace directory is required");
+  const resolved = fs.realpathSync.native(value);
+  if (!fs.statSync(resolved).isDirectory()) throw failure("ANTIGRAVITY_CWD_INVALID", "Workspace is not a directory");
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+
+function workspaceCwd(uris) {
+  if (typeof uris === "string") uris = JSON.parse(uris);
+  if (!Array.isArray(uris) || uris.length !== 1 || typeof uris[0] !== "string") throw failure("ANTIGRAVITY_WORKSPACE_AMBIGUOUS", "Conversation must have exactly one workspace");
+  const uri = new URL(uris[0]);
+  if (uri.protocol !== "file:" || uri.search || uri.hash) throw failure("ANTIGRAVITY_CWD_INVALID", "Conversation workspace must be a local file URI");
+  return canonicalCwd(fileURLToPath(uri));
+}
+
+export async function listAntigravityConversations({ home = os.homedir(), surface = "all", limit = 100 } = {}) {
+  if (surface !== "all" && !Object.hasOwn(SURFACES, surface)) throw failure("ANTIGRAVITY_SURFACE_INVALID", "Surface must be desktop, cli, or all");
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error("Conversation limit must be between 1 and 1000");
+  const { DatabaseSync } = await import("node:sqlite");
+  const rows = [];
+  for (const [kind, directory] of Object.entries(SURFACES)) {
+    if (surface !== "all" && surface !== kind) continue;
+    const filename = path.join(home, ".gemini", directory, "conversation_summaries.db");
+    if (!fs.existsSync(filename)) continue;
+    const db = new DatabaseSync(filename, { readOnly: true });
+    try {
+      const records = db.prepare("SELECT conversation_id, title, workspace_uris, project_id, status, not_fully_idle, killed, app_data_dir, source FROM conversation_summaries WHERE app_data_dir = ? ORDER BY last_modified_time DESC LIMIT ?").all(directory, limit);
+      for (const row of records) {
+        if (!UUID.test(row.conversation_id) || row.killed) continue;
+        if (kind === "desktop" && ["CORTEX_TRAJECTORY_SOURCE_CLI", "CORTEX_TRAJECTORY_SOURCE_VSCODE", "CORTEX_TRAJECTORY_SOURCE_VISUAL_STUDIO", "CORTEX_TRAJECTORY_SOURCE_SDK", "CORTEX_TRAJECTORY_SOURCE_PYTHON_SDK"].includes(row.source)) continue;
+        let cwd;
+        try { cwd = workspaceCwd(row.workspace_uris); } catch { continue; }
+        rows.push({ conversationId: row.conversation_id, cwd, projectId: row.project_id, title: row.title, status: row.not_fully_idle ? "busy" : row.status || "unknown", surface: kind });
+      }
+    } finally { db.close(); }
+  }
+  return rows;
+}
+
+function nativeMetadata(result) {
+  return result.metadata ?? result.response?.conversationMetadata?.metadata ?? result.response?.conversation_metadata?.metadata ?? result.payload?.conversationMetadata?.metadata ?? result.payload?.conversation_metadata?.metadata ?? result.conversationMetadata?.metadata ?? result.conversation_metadata?.metadata;
+}
+
+function metadataShape(result) {
+  const rows = [];
+  const visit = (value, prefix, depth) => {
+    if (!value || typeof value !== "object" || Array.isArray(value) || depth > 3) return;
+    for (const key of Object.keys(value).slice(0, 20)) {
+      if (!/^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/.test(key)) continue;
+      const field = prefix ? `${prefix}.${key}` : key;
+      rows.push(field);
+      visit(value[key], field, depth + 1);
+    }
+  };
+  visit(result, "", 0);
+  return rows.join(", ").slice(0, 800);
+}
+
+export function sanitizeAntigravityMetadata(result, conversationId) {
+  const metadata = nativeMetadata(result);
+  if (!metadata || typeof metadata !== "object") throw failure("ANTIGRAVITY_METADATA_UNSUPPORTED", `Native Antigravity metadata is missing or unsupported (fields: ${metadataShape(result)})`);
+  const returnedId = result.conversationId ?? result.conversation_id ?? result.response?.conversationId ?? result.response?.conversation_id ?? metadata.conversationId ?? metadata.conversation_id;
+  if (returnedId !== undefined && returnedId !== conversationId) throw failure("ANTIGRAVITY_METADATA_MISMATCH", "Native metadata identifies a different conversation");
+  return {
+    conversationId,
+    cwd: workspaceCwd(metadata.workspaceUris ?? metadata.workspace_uris),
+    projectId: metadata.projectId ?? metadata.project_id ?? "",
+    surface: "desktop",
+  };
+}
+
+export async function runAgentApi(options) {
+  try { return await executeAgentApi(options); } catch (error) {
+    error.deliveryState ??= "not_sent";
+    throw error;
+  }
+}
+
+async function executeAgentApi({ command, conversationId, prompt, expectedCwd, home = os.homedir(), env = process.env, executable = env.ANTIGRAVITY_AGENTAPI_EXE, run = execute, list = listAntigravityConversations }) {
+  if (!UUID.test(conversationId)) throw failure("ANTIGRAVITY_ID_INVALID", "An exact conversation UUID is required");
+  if (!["metadata", "send"].includes(command)) throw new Error("Unsupported Antigravity agentapi command");
+  if (!env.ANTIGRAVITY_LS_ADDRESS || !env.ANTIGRAVITY_CSRF_TOKEN) throw failure("ANTIGRAVITY_SIDECAR_REQUIRED", "Antigravity must launch the bridge sidecar before native requests are available");
+  if (executable && (!path.isAbsolute(executable) || /\.(bat|cmd|ps1)$/i.test(executable))) throw failure("ANTIGRAVITY_EXECUTABLE_INVALID", "Antigravity agentapi executable must be an absolute native executable path");
+  if (!executable && process.platform === "win32") throw failure("ANTIGRAVITY_EXECUTABLE_MISSING", "The Antigravity sidecar must provide ANTIGRAVITY_AGENTAPI_EXE on Windows");
+  const invoke = async (args) => {
+    let output;
+    try {
+      output = await run(executable || "agentapi", executable ? ["agentapi", ...args] : args, { env, encoding: "utf8", timeout: 30000, maxBuffer: 1048576, windowsHide: true, shell: false });
+    } catch (error) {
+      const nativeError = failure(error.killed || error.code === "ETIMEDOUT" ? "ANTIGRAVITY_OUTCOME_UNKNOWN" : "ANTIGRAVITY_NATIVE_FAILED", `Native Antigravity request failed (${nativeDiagnostic(error, env, args)}); inspect the original conversation before resending`);
+      nativeError.deliveryState = args[0] === "send-message" ? "unknown" : "not_sent";
+      throw nativeError;
+    }
+    let result;
+    try { result = JSON.parse(output.stdout); } catch { throw Object.assign(failure("ANTIGRAVITY_RESPONSE_INVALID", "Native Antigravity returned invalid JSON; do not automatically resend"), { deliveryState: args[0] === "send-message" ? "unknown" : "not_sent" }); }
+    if (!result || typeof result !== "object" || Array.isArray(result) || result.error || result.success === false) throw Object.assign(failure("ANTIGRAVITY_NATIVE_REJECTED", "Native Antigravity rejected the request"), { deliveryState: args[0] === "send-message" ? "unknown" : "not_sent" });
+    return result;
+  };
+  if (command === "metadata") return invoke(["get-conversation-metadata", conversationId]);
+  if (typeof prompt !== "string" || !prompt.trim() || prompt.length > 32768 || prompt.includes("\0")) throw new Error("Prompt must contain between 1 and 32768 characters without NUL");
+  const cwd = canonicalCwd(expectedCwd);
+  const select = async () => {
+    const records = (await list({ home, surface: "desktop", limit: 1000 })).filter((row) => row.conversationId === conversationId);
+    if (records.length !== 1) throw failure("ANTIGRAVITY_RECIPIENT_MISSING", "Exact desktop conversation is unavailable or has an ambiguous workspace");
+    const row = records[0];
+    if (row.surface !== "desktop" || canonicalCwd(row.cwd) !== cwd) throw failure("ANTIGRAVITY_WORKSPACE_MISMATCH", "Conversation workspace does not match the authorized workspace");
+    if (row.status !== "CASCADE_RUN_STATUS_IDLE") throw failure("ANTIGRAVITY_RECIPIENT_BUSY", "Conversation is busy or its idle state cannot be verified");
+    return row;
+  };
+  const before = await select();
+  const metadata = sanitizeAntigravityMetadata(await invoke(["get-conversation-metadata", conversationId]), conversationId);
+  if (metadata.cwd !== cwd || metadata.projectId !== before.projectId) throw failure("ANTIGRAVITY_METADATA_MISMATCH", "Native metadata does not match the selected conversation workspace and project");
+  const current = await select();
+  if (current.projectId !== before.projectId) throw failure("ANTIGRAVITY_METADATA_MISMATCH", "Conversation project changed during delivery preflight");
+  await invoke(["send-message", conversationId, prompt]);
+  return { conversationId, status: "accepted", completed: false, surface: "desktop" };
+}

package/src/antigravity-ipc.mjs

@@ -0,0 +1,141 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { protectCurrentUserPipe } from "./windows-pipe-acl.mjs";
+import { relayFileIdentity, removeRelayFile } from "./native-relay-files.mjs";
+
+const LIMIT = 2 * 1024 * 1024;
+
+async function socketRefused(socketPath) {
+  return new Promise((resolve) => {
+    const socket = net.createConnection(socketPath);
+    let settled = false;
+    const done = (refused) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(refused);
+    };
+    const timer = setTimeout(() => done(false), 1000);
+    socket.on("connect", () => done(false));
+    socket.on("error", (error) => done(error.code === "ECONNREFUSED"));
+  });
+}
+
+export function antigravityBridgeDirectory(home = os.homedir()) {
+  return path.join(home, ".codex", "antigravity-bridge");
+}
+
+export function antigravitySocket(directory = antigravityBridgeDirectory()) {
+  const hash = crypto.createHash("sha256").update(path.resolve(directory).toLowerCase()).digest("hex").slice(0, 24);
+  return process.platform === "win32" ? `\\\\.\\pipe\\LOCAL\\codex-bridge-antigravity-${hash}` : path.join(directory, "desktop.sock");
+}
+
+export function ensureBridgeDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("Bridge directory must be a real directory");
+  if (typeof process.getuid === "function" && (stat.uid !== process.getuid() || (stat.mode & 0o077))) throw new Error("Bridge directory must be owned by this user with mode 0700");
+  return directory;
+}
+
+export function callAntigravityDesktop(request, { directory = antigravityBridgeDirectory(), timeoutMs = 30000 } = {}) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(antigravitySocket(directory));
+    let buffer = Buffer.alloc(0);
+    let finished = false;
+    let dispatched = false;
+    const done = (error, result) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      socket.destroy();
+      if (error) {
+        error.deliveryState ??= dispatched ? "unknown" : "not_sent";
+        reject(error);
+      } else resolve(result);
+    };
+    const timer = setTimeout(() => done(Object.assign(new Error("Antigravity sidecar did not reply; inspect the original requestId before retrying"), { deliveryState: "unknown" })), timeoutMs);
+    socket.on("error", (error) => done(error));
+    socket.on("end", () => done(new Error("Antigravity sidecar disconnected before replying")));
+    socket.on("connect", () => {
+      const frame = JSON.stringify(request) + "\n";
+      if (Buffer.byteLength(frame) > LIMIT) return done(new Error("Request exceeds size limit"));
+      dispatched = true;
+      socket.write(frame);
+    });
+    socket.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      if (buffer.length > LIMIT) return done(new Error("Sidecar response exceeds size limit"));
+      const end = buffer.indexOf(10);
+      if (end < 0) return;
+      try {
+        const response = JSON.parse(buffer.subarray(0, end).toString("utf8"));
+        if (response.error) return done(Object.assign(new Error(response.error), { deliveryState: response.deliveryState }));
+        done(null, response.result);
+      } catch (error) { done(error); }
+    });
+  });
+}
+
+export async function serveAntigravityDesktop(handler, { directory = antigravityBridgeDirectory() } = {}) {
+  ensureBridgeDirectory(directory);
+  const socketPath = antigravitySocket(directory);
+  let ready = false;
+  const connections = new Set();
+  const server = net.createServer((socket) => {
+    if (!ready || connections.size >= 32) return socket.destroy();
+    connections.add(socket);
+    socket.on("close", () => connections.delete(socket));
+    socket.on("error", () => {});
+    socket.setTimeout(35000, () => socket.destroy());
+    let buffer = Buffer.alloc(0);
+    let received = false;
+    socket.on("data", async (chunk) => {
+      if (received) return;
+      buffer = Buffer.concat([buffer, chunk]);
+      if (buffer.length > LIMIT) return socket.destroy();
+      const end = buffer.indexOf(10);
+      if (end < 0) return;
+      received = true;
+      try {
+        const result = await handler(JSON.parse(buffer.subarray(0, end).toString("utf8")));
+        const frame = JSON.stringify({ result }) + "\n";
+        if (Buffer.byteLength(frame) > LIMIT) throw new Error("Sidecar response exceeds size limit");
+        socket.end(frame);
+      } catch (error) { socket.end(JSON.stringify({ error: error.message, deliveryState: error.deliveryState }) + "\n"); }
+    });
+  });
+  const privatePath = process.platform === "win32" ? socketPath : path.join(directory, `.${crypto.randomBytes(6).toString("hex")}.sock`);
+  let identity;
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(privatePath, () => { server.off("error", reject); resolve(); });
+  });
+  try {
+    if (process.platform === "win32") await protectCurrentUserPipe(socketPath);
+    else {
+      fs.chmodSync(privatePath, 0o600);
+      try { fs.linkSync(privatePath, socketPath); }
+      catch (error) {
+        if (error.code !== "EEXIST") throw error;
+        const existing = relayFileIdentity(socketPath, "socket");
+        if (!await socketRefused(socketPath)) throw new Error("Another Antigravity sidecar owns the socket");
+        removeRelayFile(socketPath, { expected: existing });
+        fs.linkSync(privatePath, socketPath);
+      }
+      fs.unlinkSync(privatePath);
+      identity = relayFileIdentity(socketPath, "socket");
+    }
+    ready = true;
+  } catch (error) { server.close(); throw error; }
+  return { server, close: () => new Promise((resolve) => {
+    ready = false;
+    for (const socket of connections) socket.destroy();
+    if (identity) removeRelayFile(socketPath, { expected: identity });
+    server.close(resolve);
+  }) };
+}

package/src/antigravity-outbound-bridge.mjs

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { resolveAntigravitySenderContext } from "./antigravity-sender-context.mjs";
+import { createAntigravityOutboundTargets } from "./antigravity-outbound-targets.mjs";
+import { AntigravityDeliveries } from "./antigravity-deliveries.mjs";
+import { antigravityBridgeDirectory } from "./antigravity-ipc.mjs";
+import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
+import { stopProcessInspectors } from "./claude-sender-context.mjs";
+import { exitForVersionRequest } from "./cli-version.mjs";
+import { assertAccountIdentity } from "./bridge-account-context.mjs";
+
+const { version } = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+const result = (value) => ({ content: [{ type: "text", text: JSON.stringify(value, null, 2) }] });
+const targetSchema = { target: z.enum(["codex", "claude"]) };
+const taskSchema = { ...targetSchema, conversationId: z.string().uuid(), taskId: z.string().min(1).max(256).optional() };
+
+export function createAntigravityOutboundBridge({ resolveSender = resolveAntigravitySenderContext, targets = createAntigravityOutboundTargets(), deliveries = new AntigravityDeliveries(path.join(antigravityBridgeDirectory(), "outbound-deliveries")), rootPolicy = createHardenedRootPolicy() } = {}) {
+  const server = new McpServer({ name: "agent-bridge", version }, { instructions: "Send user-authorized work FROM the current Antigravity Desktop conversation to an exact existing Codex Desktop task or Claude Desktop Code session in the same project. Use list_agent_tasks first, verify title and identity, then send_to_agent_task with a fresh requestId. Keep requestId after uncertainty and read_agent_delivery; never automatically resend. Native permissions and sender identity are verified on every call. Do not launch a CLI substitute, impersonate Codex/Claude, or change permissions to overcome a rejection. Native acceptance is not task completion; read_agent_task for Codex or read_agent_delivery for a Claude reply. Independent new work requires a separate native conversation; this bridge only continues existing tasks. Agent-authored handoffs must be in English and name Antigravity as the author." });
+
+  function scope(expected, actual) {
+    if (!path.isAbsolute(expected) || !path.isAbsolute(actual)) throw new Error("An absolute project directory is required");
+    const canonical = fs.realpathSync.native(expected);
+    if (path.relative(canonical, fs.realpathSync.native(actual))) throw new Error("Destination must match the verified Antigravity sender's project");
+    rootPolicy.assert(canonical, "Antigravity sender project");
+    return canonical;
+  }
+
+  async function sender(extra) {
+    const identity = await resolveSender(extra?._meta);
+    if (identity.status !== "verified" || identity.provider !== "antigravity" || !identity.id || !["bypass", "prompting"].includes(identity.mode)) throw new Error(identity.reason ?? "Antigravity sender is not verified");
+    scope(identity.cwd, identity.cwd);
+    return identity;
+  }
+
+  function recheck(identity, extra) {
+    return async () => {
+      const current = await sender(extra);
+      if (JSON.stringify(current) !== JSON.stringify(identity)) throw Object.assign(new Error("Antigravity sender identity or permissions changed before delivery"), { deliveryState: "not_sent" });
+    };
+  }
+
+  function register(name, description, inputSchema, readOnly, handler) {
+    server.registerTool(name, { description, inputSchema, annotations: { readOnlyHint: readOnly, destructiveHint: !readOnly, idempotentHint: true, openWorldHint: !readOnly } }, async (args, extra) => {
+      try { return result(await handler(args, extra)); }
+      catch (error) { return { ...result({ error: error.message, deliveryState: error.deliveryState ?? "not_sent" }), isError: true }; }
+    });
+  }
+
+  register("agent_bridge_status", "Check this Antigravity caller's native identity and outbound bridge capabilities without sending work.", {}, true, async (_, extra) => {
+    const identity = await resolveSender(extra?._meta);
+    const metadataFields = Object.fromEntries(Object.entries(extra?._meta ?? {}).filter(([key]) => key.startsWith("antigravity.google/")).map(([key, value]) => [key, Array.isArray(value) ? "array" : typeof value]));
+    return { version, sender: identity, metadataFields, targets: ["codex-desktop", "claude-desktop"], permissions: "native-unchanged", createsConversations: false };
+  });
+
+  register("list_agent_tasks", "List exact existing native tasks in this Antigravity conversation's project before selecting a destination.", targetSchema, true, async (args, extra) => {
+    const identity = await sender(extra);
+    return targets.list({ ...args, sender: identity, beforeSend: recheck(identity, extra) });
+  });
+
+  register("send_to_agent_task", "Continue an exact existing Codex or Claude Desktop task with authorized work. Preserve requestId across retries; inspect the durable receipt.", { ...taskSchema, requestId: z.string().uuid(), cwd: z.string().min(1), prompt: z.string().min(1).max(30000) }, false, async (args, extra) => {
+    const identity = await sender(extra);
+    const cwd = scope(identity.cwd, args.cwd);
+    if (args.prompt.includes("\0")) throw new Error("Prompt must not contain NUL");
+    const prompt = `[From Antigravity Desktop · ${path.basename(cwd)} · Authorized task handoff]\n[Source conversation: ${identity.id}]\n\n${args.prompt}`;
+    return deliveries.dispatch({ ...args, cwd, surface: args.target, sender: { provider: identity.provider, id: identity.id }, prompt }, async () => {
+      await recheck(identity, extra)();
+      const sent = await targets.send({ ...args, cwd, prompt, sender: identity, ...(args.target === "codex" ? { threadId: args.conversationId } : { sessionId: args.conversationId }), beforeSend: recheck(identity, extra) });
+      return { ...sent, completed: false };
+    });
+  });
+
+  register("read_agent_delivery", "Read an owned delivery without resending. Accepted or pending does not prove a completed response.", { requestId: z.string().uuid() }, true, async ({ requestId }, extra) => {
+    const identity = await sender(extra);
+    const record = deliveries.read(requestId);
+    if (!record || record.sender?.provider !== "antigravity" || record.sender.id !== identity.id) throw new Error("Delivery does not belong to this Antigravity conversation");
+    scope(identity.cwd, record.cwd);
+    if (record.result?.accountContext) assertAccountIdentity(record.result.accountContext);
+    if (record.surface === "claude" && record.result?.msgId) {
+      try {
+        return { ...record, nativeReceipt: await targets.read({ target: "claude", msgId: record.result.msgId, sender: identity, beforeSend: recheck(identity, extra) }) };
+      } catch (error) {
+        if (error.code !== "ANTIGRAVITY_NATIVE_RECEIPT_UNAVAILABLE") throw error;
+        return { ...record, nativeReceipt: null, recovery: "The original native receipt is unavailable. Inspect the exact Claude Desktop task before further action; do not resend.", receiptError: error.message };
+      }
+    }
+    return record;
+  });
+
+  register("read_agent_task", "Read the exact destination task's current native state and available response in the same project.", taskSchema, true, async (args, extra) => {
+    const identity = await sender(extra);
+    return targets.read({ ...args, cwd: identity.cwd, sender: identity, ...(args.target === "codex" ? { threadId: args.conversationId } : { sessionId: args.conversationId }), beforeSend: recheck(identity, extra) });
+  });
+
+  return { server, close: async () => { await targets.close(); await server.close(); } };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  exitForVersionRequest(import.meta.url);
+  const bridge = createAntigravityOutboundBridge();
+  let stopping = false;
+  const stop = async () => {
+    if (stopping) return;
+    stopping = true;
+    await bridge.close();
+    await stopProcessInspectors();
+  };
+  for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => { void stop(); });
+  process.stdin.once("end", () => { void stop(); });
+  await bridge.server.connect(new StdioServerTransport());
+}

package/src/antigravity-outbound-targets.mjs

@@ -0,0 +1,244 @@
+import fs from "node:fs";
+import path from "node:path";
+import { NativeDesktopRelay, desktopTaskSocketPath, accountRelaySocketPath } from "./native-relay.mjs";
+import { readBridgeAccounts, requireBridgeAccounts, assertAccountIdentity } from "./bridge-account-context.mjs";
+import { PeerEndpoint, listClaudeSessions, assertClaudeSessionProcess } from "./peer-protocol.mjs";
+import { readClaudeDesktopContext } from "./claude-desktop-context.mjs";
+import { readClaudeInboundPolicy } from "./claude-inbound-policy.mjs";
+import { assertRecipientClass } from "./recipient-preflight.mjs";
+import { sameClaudeDesktopRecipient } from "./claude-session-router.mjs";
+import { createHardenedRootPolicy } from "./hardened-root-policy.mjs";
+import { protectCurrentUserPipe } from "./windows-pipe-acl.mjs";
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function blocked(message) {
+  return Object.assign(new Error(message), { deliveryState: "not_sent" });
+}
+
+function captureDirectory(value) {
+  if (typeof value !== "string" || !path.isAbsolute(value)) throw blocked("An absolute existing project directory is required");
+  const canonical = fs.realpathSync.native(value);
+  const stat = fs.statSync(canonical, { bigint: true });
+  if (!stat.isDirectory()) throw blocked("The project path must be a directory");
+  return { path: canonical, identity: `${stat.dev}:${stat.ino}:${stat.birthtimeNs}` };
+}
+
+function sameDirectory(left, right) {
+  return path.relative(left, right) === "";
+}
+
+function senderIdentity(sender) {
+  if (sender?.provider !== "antigravity" || !UUID.test(sender.id ?? "") || sender.conversationId !== sender.id
+      || !["bypass", "prompting"].includes(sender.mode) || typeof sender.permissionFingerprint !== "string" || !sender.permissionFingerprint) {
+    throw blocked("Verified Antigravity conversation identity and permission evidence are required");
+  }
+  return Object.freeze({ provider: sender.provider, id: sender.id, conversationId: sender.conversationId, cwd: sender.cwd, mode: sender.mode, permissionFingerprint: sender.permissionFingerprint });
+}
+
+export function createAntigravityOutboundTargets(options = {}) {
+  const env = options.env ?? process.env;
+  const relay = options.relay ?? new NativeDesktopRelay({ env, socketPath: desktopTaskSocketPath(env), accountSocketPath: accountRelaySocketPath(env) });
+  const readAccounts = options.readAccounts ?? readBridgeAccounts;
+  const assertAccounts = options.assertAccounts ?? ((identity) => assertAccountIdentity(identity, readAccounts()));
+  const listSessions = options.listSessions ?? listClaudeSessions;
+  const readContext = options.readContext ?? ((session, account) => readClaudeDesktopContext(session, { account }));
+  const readInbound = options.readInbound ?? readClaudeInboundPolicy;
+  const assertProcess = options.assertProcess ?? assertClaudeSessionProcess;
+  const roots = options.roots ?? createHardenedRootPolicy(env);
+  const peerFactory = options.peerFactory ?? ((settings) => new PeerEndpoint(settings));
+  const receipts = new Map();
+  let peer;
+  let closed = false;
+
+  function operation(sender, beforeSend, required = false) {
+    if (closed) throw blocked("Antigravity outbound targets have been closed");
+    if (required && typeof beforeSend !== "function") throw blocked("A live Antigravity sender revalidation callback is required");
+    const identity = senderIdentity(sender);
+    const cwd = captureDirectory(identity.cwd);
+    const root = roots.capture(cwd.path, "Antigravity sender project");
+    const accounts = readAccounts();
+    const accountContext = requireBridgeAccounts(accounts);
+    const check = async () => {
+      if (closed) throw blocked("Antigravity outbound targets have been closed");
+      assertAccounts(accountContext);
+      roots.recheck(root, "Antigravity sender project");
+      const current = captureDirectory(identity.cwd);
+      if (!sameDirectory(current.path, cwd.path) || current.identity !== cwd.identity) throw blocked("Antigravity sender project changed before delivery");
+      const refreshed = await beforeSend?.();
+      if (refreshed?.provider && JSON.stringify(senderIdentity(refreshed)) !== JSON.stringify(identity)) throw blocked("Antigravity sender identity or permissions changed before delivery");
+      assertAccounts(accountContext);
+    };
+    return { identity, cwd: cwd.path, accounts, accountContext, check };
+  }
+
+  async function request(context, name, args, beforeSend = context.check) {
+    const response = await relay.requestDesktop(name, args, { accountContext: context.accountContext, beforeSend });
+    try { await context.check(); }
+    catch (error) { if (name === "send_message_to_thread") error.deliveryState = "unknown"; throw error; }
+    return response.result;
+  }
+
+  async function projects(context) {
+    const result = await request(context, "list_projects", {});
+    if (!Array.isArray(result?.projects)) throw blocked("Native Codex saved projects are unavailable");
+    const matches = result.projects.filter((project) => {
+      try { return project.projectKind === "local" && project.hostId === "local" && typeof project.projectId === "string" && project.projectId && sameDirectory(captureDirectory(project.path).path, context.cwd); }
+      catch { return false; }
+    });
+    if (matches.length !== 1 || result.projects.filter((project) => project.projectId === matches[0].projectId).length !== 1) throw blocked("Sender project must match exactly one saved local Codex project");
+    return matches[0];
+  }
+
+  function threadRecord(thread, threadId, project, context, requireProjectId = true) {
+    if (thread?.id !== threadId || thread.kind !== "codex" || thread.hostId !== "local"
+        || (requireProjectId || thread.projectId !== undefined) && thread.projectId !== project.projectId
+        || !sameDirectory(captureDirectory(thread.cwd).path, context.cwd)) throw blocked("Exact Codex task does not belong to the current account's matching saved project");
+    return { threadId, projectId: project.projectId, cwd: context.cwd, title: thread.title ?? null, status: thread.status ?? null, hostId: "local", target: "codex" };
+  }
+
+  async function codexRecipient(context, threadId) {
+    if (!UUID.test(threadId ?? "")) throw blocked("An exact existing Codex task UUID is required");
+    const project = await projects(context);
+    const inventory = await request(context, "list_threads", { limit: 50 });
+    if (!Array.isArray(inventory?.threads) || !Array.isArray(inventory?.pinnedThreads ?? [])) throw blocked("Native Codex task inventory is unavailable");
+    const matches = [...(inventory.pinnedThreads ?? []), ...inventory.threads].filter((thread) => thread?.id === threadId);
+    if (!matches.length) throw blocked("Exact Codex task must be an existing recent or pinned task");
+    for (const thread of matches) threadRecord(thread, threadId, project, context);
+    const result = await request(context, "read_thread", { threadId, hostId: "local", turnLimit: 1, includeOutputs: false, maxOutputCharsPerItem: 1 });
+    return threadRecord(result?.thread, threadId, project, context, false);
+  }
+
+  function claudeRecipient(context, sessionId, taskId) {
+    if (typeof sessionId !== "string" || !sessionId || typeof taskId !== "string" || !taskId) throw blocked("Exact Claude sessionId and native taskId are required");
+    const candidates = listSessions().filter((session) => session.sessionId === sessionId);
+    if (candidates.length !== 1) throw blocked("Exact Claude session is missing or ambiguous");
+    const session = candidates[0];
+    if (!session.alive || session.entrypoint !== "claude-desktop" || !session.socket || !sameDirectory(captureDirectory(session.cwd).path, context.cwd)) throw blocked("Claude destination must be a live Desktop Code session in the sender project");
+    assertProcess(session);
+    const desktop = readContext(session, context.accounts.claude);
+    if (desktop?.status !== "matched" || desktop.taskId !== taskId || desktop.accountFingerprint !== context.accountContext.claude
+        || !sameDirectory(captureDirectory(desktop.cwd).path, context.cwd)) throw blocked("Claude native task identity or current account does not match");
+    return { ...session, desktop, inbound: readInbound(session.cwd) };
+  }
+
+  async function list({ target, sender, beforeSend } = {}) {
+    const context = operation(sender, beforeSend);
+    await context.check();
+    if (target === "codex") {
+      const project = await projects(context);
+      const result = await request(context, "list_threads", { limit: 50 });
+      if (!Array.isArray(result?.threads) || !Array.isArray(result?.pinnedThreads ?? [])) throw blocked("Native Codex task inventory is unavailable");
+      const records = [];
+      const seen = new Set();
+      for (const thread of [...(result.pinnedThreads ?? []), ...result.threads]) {
+        if (seen.has(thread?.id)) continue;
+        try {
+          const row = threadRecord(thread, thread.id, project, context);
+          if (!UUID.test(row.threadId)) continue;
+          records.push(row);
+          seen.add(thread.id);
+        } catch {}
+      }
+      return records;
+    }
+    if (target !== "claude") throw blocked("Target must be codex or claude");
+    const rows = [];
+    for (const session of listSessions()) {
+      try {
+        const desktop = readContext(session, context.accounts.claude);
+        const verified = claudeRecipient(context, session.sessionId, desktop?.taskId);
+        rows.push({ target: "claude", sessionId: verified.sessionId, taskId: verified.desktop.taskId, cwd: context.cwd, title: verified.desktop.title ?? null, permissionClass: verified.desktop.permissionClass ?? null, inboundPolicy: verified.inbound?.value ?? null });
+      } catch {}
+    }
+    await context.check();
+    return rows;
+  }
+
+  async function send({ target, threadId, sessionId, taskId, cwd, prompt, sender, beforeSend } = {}) {
+    const context = operation(sender, beforeSend, true);
+    if (!sameDirectory(captureDirectory(cwd).path, context.cwd)) throw blocked("Destination directory must match the verified Antigravity sender project");
+    if (typeof prompt !== "string" || !prompt.trim() || Buffer.byteLength(prompt) > 65536) throw blocked("Prompt must contain between 1 and 65536 UTF-8 bytes");
+    await context.check();
+    const text = `[Agent handoff from Antigravity conversation ${context.identity.id}; native recipient permissions remain in effect.]\n\n${prompt}`;
+    if (target === "codex") {
+      const recipient = await codexRecipient(context, threadId);
+      try {
+        const result = await request(context, "send_message_to_thread", { threadId, prompt: text }, async () => {
+          await context.check();
+          const current = await codexRecipient(context, threadId);
+          if (current.projectId !== recipient.projectId || !sameDirectory(current.cwd, recipient.cwd)) throw blocked("Codex destination changed before delivery");
+          await context.check();
+        });
+        return { target, threadId, cwd: context.cwd, status: "accepted", completed: false, accountContext: context.accountContext, result };
+      } catch (error) {
+        if (!error.deliveryState) error.deliveryState = error.sent === false || error.reachedCompanion === false ? "not_sent" : "unknown";
+        if (error.deliveryState === "unknown") error.accountContext = context.accountContext;
+        throw error;
+      }
+    }
+    if (target !== "claude") throw blocked("Target must be codex or claude");
+    const recipient = claudeRecipient(context, sessionId, taskId);
+    assertRecipientClass(recipient, context.identity);
+    if (!peer) peer = peerFactory({ name: `antigravity-${process.pid}`, cwd: context.cwd, signalExit: false, env, protectSocket: protectCurrentUserPipe });
+    await peer.start();
+    let msgId;
+    try {
+      const outcome = await peer.sendAndWait(recipient.socket, text, {
+        timeoutMs: 0, permissionMode: context.identity.mode, transcriptSession: recipient, accountContext: context.accountContext,
+        recipient: { permissionMode: recipient.desktop.permissionMode ?? null, permissionClass: recipient.desktop.permissionClass ?? null, inboundPolicy: recipient.inbound?.value ?? null },
+        beforeSend: async () => {
+          await context.check();
+          const current = claudeRecipient(context, sessionId, taskId);
+          if (!sameClaudeDesktopRecipient(recipient, current)) throw blocked("Claude session process or socket changed before delivery");
+          assertRecipientClass(current, context.identity);
+          await context.check();
+        },
+      });
+      msgId = outcome.msgId;
+      receipts.set(msgId, { sender: context.identity, accountContext: context.accountContext, cwd: context.cwd });
+      await context.check();
+      return { target, sessionId, taskId, cwd: context.cwd, msgId, status: outcome.delivery?.status ?? "sent_unconfirmed", completed: false, accountContext: context.accountContext };
+    } catch (error) {
+      if (error.msgId) receipts.set(error.msgId, { sender: context.identity, accountContext: context.accountContext, cwd: context.cwd });
+      if (msgId) error.msgId = msgId;
+      if (msgId || error.deliveryUncertain) error.deliveryState = "unknown";
+      else if (!error.deliveryState) error.deliveryState = "not_sent";
+      if (error.deliveryState === "unknown") error.accountContext = context.accountContext;
+      throw error;
+    }
+  }
+
+  async function read({ target, threadId, sessionId, taskId, cwd, msgId, sender, beforeSend } = {}) {
+    const context = operation(sender, beforeSend);
+    if (cwd !== undefined && !sameDirectory(captureDirectory(cwd).path, context.cwd)) throw blocked("Destination directory must match the verified Antigravity sender project");
+    await context.check();
+    if (target === "codex") {
+      const recipient = await codexRecipient(context, threadId);
+      const result = await request(context, "read_thread", { threadId, hostId: "local", turnLimit: 3, includeOutputs: false, maxOutputCharsPerItem: 4000 });
+      threadRecord(result?.thread, threadId, { projectId: recipient.projectId }, context, false);
+      return { target, threadId, cwd: context.cwd, result };
+    }
+    if (target !== undefined && target !== "claude") throw blocked("Target must be codex or claude");
+    if (msgId === undefined) {
+      const recipient = claudeRecipient(context, sessionId, taskId);
+      await context.check();
+      return { target: "claude", sessionId, taskId, cwd: context.cwd, title: recipient.desktop.title ?? null, permissionClass: recipient.desktop.permissionClass ?? null, inboundPolicy: recipient.inbound?.value ?? null };
+    }
+    const receipt = receipts.get(msgId);
+    if (!receipt) throw Object.assign(blocked("The native receipt is unavailable in this bridge process"), { code: "ANTIGRAVITY_NATIVE_RECEIPT_UNAVAILABLE" });
+    if (receipt.sender.id !== context.identity.id || !sameDirectory(receipt.cwd, context.cwd)) throw blocked("Receipt does not belong to this Antigravity conversation");
+    assertAccounts(receipt.accountContext);
+    const result = peer.readDelivery(msgId);
+    await context.check();
+    return result;
+  }
+
+  async function close() {
+    closed = true;
+    peer?.stop();
+    await peer?.closed;
+  }
+
+  return { list, send, read, close };
+}