@sabaiway/agent-workflow-kit 14.21.0 → 14.23.0

package/CHANGELOG.md

@@ -4,6 +4,101 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 14.23.0 — a delegated codex or agy run uses Jev as your own run does; ships codex-cli-bridge 5.0.0 and antigravity-cli-bridge 7.0.0 (AD-171)
+
+**Every bridge wrapper now passes `TYPESAFE_API_KEY` to the run, and on Linux with codex-cli 0.160.0 or newer a
+`codex-exec` or `codex-review` run reaches `api.typesafe.ai` and `docs.typesafe.ai` and no other host.** The other
+`*_API_KEY` values and `OPENAI_BASE_URL` stay unset. Where the codex permissions profile is not proven, the run keeps
+the earlier flags with network off and its banner says why. An agy run gets the key and nothing more: no flag, no
+setting.
+
+- **One key rule in every wrapper.** The shared block of `codex-exec.sh`, `codex-review.sh`, `agy.sh` and
+  `agy-review.sh` gains `aw_scrub_billing_keys`, called before the first CLI spawn (login status, version, catalog,
+  run). `test/settings-reader-parity.test.mjs` finds the wrappers from the bridge manifests and
+  `test/jev-every-run.test.mjs` proves that discovery on fixture trees, so a wrapper added later is held to the same
+  block without a test edit.
+- **codex: the permissions profile `jev`.** On Linux (WSL2 included) with codex-cli 0.160.0 or newer, fresh runs,
+  resumes and reviews carry the profile: network to the two Jev hosts only; `codex-exec` writes the repository, `/tmp`
+  and `$TMPDIR`; `codex-review` writes nothing. Not Linux, an older or unreadable codex version, an exec repository
+  or its git common dir under `/tmp` or `$TMPDIR`, or a version and profile recorded as refused: the run takes the
+  earlier flags with network off.
+- **The banner says what the run reaches.** Both codex banners gain `jev=api.typesafe.ai,docs.typesafe.ai` or
+  `jev=unreachable (<reason>)` before `source=`; the exec banner's sandbox field reads `sandbox=jev-profile` or
+  `sandbox=workspace-write`. Receipt schemas are unchanged.
+- **A refused profile stops loudly.** When codex rejects the profile before its first turn, or bwrap fails inside a
+  failed command, the run exits 72 with no success receipt. A rejected profile key records the codex version and
+  profile digest in `${XDG_STATE_HOME:-~/.local/state}/agent-workflow/codex-jev-profile-refused` when that file can
+  be written (otherwise one warning names it), and that wrapper's next run on that pair takes the earlier flags
+  before any spend; a `bwrap: execvp` failure records nothing.
+- **`codex-review` sees the skill.** Its fence home links `.agents/skills` to your real Codex skill root when it
+  exists; the review directives allow reading it and name the two hosts on a profile run only.
+- **Probe passthrough under the profile.** With `CODEX_PROBE=1`, `--add-dir`, `-C`, `--cd`, `--enable` and `--disable`
+  are refused before any spend (exit 2) while the profile is on; under the fallback they stay admitted.
+- **agy.** With the key set, `agy-run` prints one line before dispatch: `jev: TYPESAFE_API_KEY passed; a headless agy
+  runs the Jev request only where your agy permissions allow commands — the first denied command ends the run`.
+  `agy-review` makes no Jev request while its model obeys its prompts, which forbid every tool (an advisory
+  prohibition, not a sandbox).
+- **Manifests.** Both bridges' `networkHosts` gain `api.typesafe.ai` and `docs.typesafe.ai`, so the sandbox
+  Recommendations item shows once more on a project that acknowledged it. Guardrails and banner notes are rewritten,
+  and `tools/detect-backends.mjs`'s role-contract copy follows them.
+- **The sandbox notes no longer promise the tier routes wrappers outside.** On 2026-10-06 Claude Code 2.1.291 ran
+  an agent's plain `codex-review` inside its sandbox although the project excluded it; a sandboxed run's Jev request
+  gets `Tunnel connection failed: 403` from the harness proxy (observed 2026-10-05). `references/modes/recommendations.md`
+  now says the tier routes the wrappers outside only where the harness honours that entry, names the refusal, and
+  points to the hand-apply `allowedDomains` shape with the recipe's hosts, which the kit never writes for you;
+  `references/modes/velocity.md` and the manifest schema's `networkHosts` note say the same.
+- **Stated residuals.** Both bridge `SKILL.md` paragraphs say the key sits in every run's environment; the codex one
+  names codex's server-side `web_search`, which reaches pages outside the profile, the agy one a `web_search` or
+  fetch tool agy is permitted to run. A codex release that stops recognizing a profile key
+  costs one run per version and profile digest before the recorded fallback takes over.
+- The tarball pin rises 355 → 358 (the mirrored bridge suites `codex-exec-jev`, `codex-review-jev`, `agy-jev`).
+
+## 14.22.0 — a story runs in four sessions, each step with one checked result; the advisor renders the new review loop (AD-170)
+
+**Your project's rules now state the story flow the engine's canon (5.12.0) defines: four sessions — spec and plan,
+tests, code, then diff review, release and record — with review on the spec with the plan's ledger and on the staged
+diff.** The canon adds the epic's review by the review lens alone and the one commit after the diff review;
+`/agent-workflow-kit procedures` renders both. Both rules templates' §2.6 (the lens) and §2.7
+(Story sessions) carry the new bodies; the outgoing ones are priors, so an upgrade refreshes an unedited region and
+keeps a custom edit, flagged.
+
+- **`/agent-workflow-kit procedures` renders the loop the canon states.** One fold ask per member per round, carrying
+  all of its findings; round two with the folded artifact, the decided register and the fold diffs; a fold of the
+  last round re-read by its raiser; for `plan-execution`, the re-check of a staged tree that moves after a member's
+  last ship-class verdict. The round render, the cap triage and the red-proof instrument are gone from the
+  plan-authoring and plan-execution renders; `feedback-triage` keeps its round table. plan-authoring's agy review
+  reads the spec review file, and the unarmed flow line names no arming command. On a project that armed the flow
+  chain itself, `plan-execution` still renders the armed pre-fold line, a stated residual.
+- **The epic by the lens.** `procedures epic` renders the lens review and, whatever `epic.review` resolves to, no
+  bridge wrapper, driving contract or grounding pre-step; the slot keys and the Slots line are unchanged.
+  `references/modes/agents.md` and the README say the lens is the whole review of an epic and never replaces the
+  review recipe of a plan or a diff; the `agents` report and `dispatch advise` say it never replaces a plan or diff
+  review recipe.
+- **Cleanup after the commit.** The rules template's §1.3 Task Completion asks before committing first and runs the
+  plan's Phase: Cleanup after the commit.
+- **One fold line.** Under a delegated execute slot the fold lane is one line: resume the run's session with
+  `codex-exec --resume <session id> --nonce <n> <prompt file>`, the id read from the run's exec receipt. The advisor
+  no longer reads the delegation ledger; `tools/held-session.mjs` drops `foldLaneLines`, which nothing else read.
+- **`task.author` dispatches no slice.** `tools/carriers.mjs`: the orchestrator writes each row's prompt, so under
+  `subagent` `dispatchForm` prints the slot's sentence alone, without the executor dispatch lines; under `delegated`
+  the slot still renders `codex-exec` and its driving contract, which no step reads (display only, recorded debt).
+  `task.execute`'s slice is one prompt the orchestrator wrote from one ledger row; `references/modes/{agents,recipes,
+  set-recipe,procedures}.md` say the same.
+- `tools/tier-guide.mjs`, `references/modes/tier.md` and the reference profile say four story sessions;
+  `references/templates/SPEC_TEMPLATE.md` says a draft exists at the spec review.
+- Recorded debt (`docs/debt.md`): `recipes --active-line` (`→ codex-review`), the orchestration README default
+  sentence, the tier offer and `status` still render `epic.review` as a bridge review (`reviewed`), and `recipes
+  --active-line`, `procedures task` and the tier offer still name `codex-exec` for a delegated `task.author`; no
+  step reads either slot; display only.
+- **The tier guide walks a story on this flow.** `tools/tier-guide.mjs` says a task is one plan row handed out in
+  one prompt from the task template, and the story commits once, after its diff review.
+  `references/authoring/TASK_TEMPLATE.md` is that prompt's form: Row, Files, Reads, Run and Do not run, seven keys;
+  a bridge prompt adds the contract block with a fresh nonce that the engine's *The task* names. The
+  guide's story stages are S1-S4: it reads each row's prompt at its canonical name, and a landed story's leftover
+  (read the staged diff, check the review state, the one commit, remove the plan) holds every other story and
+  every other epic's close until it is done, so the story commits before its epic closes. The guide no longer judges the plan, mints a checkpoint, stamps
+  or checks a brief, or commits per task; it prints `plan-shape-cli --check` as a step.
+
 ## 14.21.0 — the bridge model is one host setting: your choice, else the default, checked against the installed CLI before any run (AD-169)
 
 **Each bridge now runs the model you set, and `/agent-workflow-kit bridge-settings` shows and sets it.** The read-out

package/README.md

@@ -252,7 +252,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit worktrees` | any time | **parallel feature worktrees** — run several features in DIFFERENT agent sessions on one repo, zero interference on working-tree files (the ONE exception is the dependency cache, below): `provision <slug> --plan <file>` creates a sibling git worktree on branch `aw/<slug>` and populates it (registry-derived footprint copy-if-missing — a tracked file is never overwritten; EXACTLY ONE seeded feature plan; the `handoff-<slug>.md` record from minute zero; `node_modules` symlinked where the link stays ignored — a shared MUTABLE dependency cache: writes through it hit MAIN's node_modules; for isolation run the printed isolated-install command (`--install` only PRINTS it; on `--resume` run the printed unlink-first recovery first — printed only for a link whose RAW TARGET is MAIN's `node_modules`, since a foreign or unreadable link is reported as such with no removal advised); absolute root-pinned gate commands rebased on untracked copies only, and only while their bytes equal the MAIN source or its rebased form — user-modified copies stay untouched); `list` is read-only (slug, branch, base, dirty, handoff); `prompt <slug>` is read-only too and re-prints the satellite's cold-start prompt — the same text `provision` ends its report with: where the worktree is, its ONE seeded plan, the handoff as the one channel back, MAIN's orientation (shared series index, landing) and, under its own heading because it is probed on the satellite, that checkout's install posture — every value derived LIVE rather than replayed from the frozen provision record, a recorded value that no longer matches NAMED as a divergence (with the cause its source makes likely) instead of printed as the runnable one, every offered command marked with WHO runs it (`MAIN $ …` for the landing, `HERE $ …` for this checkout's own install, a posture with nothing to run staying prose), and a control character in any rendered value a typed STOP rather than a forged prompt line; `land <slug> --prepare` locks the common git dir, fail-closes on divergence or incomplete satellite state, transfers the complete accepted satellite diff onto a CLEAN main, runs sync plus the declared gates, and reports HEAD/TRANSFER/PREPARED OIDs — the commit ALWAYS stays a dialogue ask; `cleanup <slug>` takes the same lock and removes a LANDED worktree only after live landed-verification against main HEAD, while `--abandon` is the ONE destructive arm (destroys unlanded work; **no preview step** on any writer). The parent dir is the `docs/ai/worktrees.json` `parentDir` setting (default: the repo's sibling parent); an unwritable parent degrades to printed maintainer-pasted commands, and the one-time host consent that makes it promptless surfaces via `recommendations`. Never commits, never pushes, never runs a subscription CLI. |
 | `/agent-workflow-kit uninstall` | opt-in, any time | **guarded teardown** — the inverse of `init` / `setup`. Removes only what's **provably ours** (managed skill dirs + bridge wrappers; in a project, the hidden-mode git-ignore block it added + the pre-commit hook it installed); **never deletes** your `docs/ai` / `AGENTS.md` (prints the exact `rm` to run by hand) or your `.claude/settings.json` (prints an **edit** — remove the attribution key, review any velocity `permissions.*` — never an `rm`). Always `--dry-run` first; preflight-then-mutate; never commits. |
 | `/agent-workflow-kit velocity` | Claude Code · opt-in | **onboarding velocity profile** — seeds a fixed, audited **read-only** allowlist into `.claude/settings.json` so routine read-only commands stop idling on approval prompts while you're away; opt-in `acceptEdits`; plus a **read-only advisory** of likely project gate commands to add by hand. Writes **only** `.claude/settings.json` — **never** allowlists commit/push/publish, never writes `settings.local.json`, never commits. A seeded entry is a **trust posture, not a sandbox** (a runtime residual remains at the settings level — its guard ships as the opt-in `hook` command); a direct commit/push/publish still asks. `--dry-run` first. |
-| `/agent-workflow-kit agents` | Claude Code · opt-in | **subagent vehicles** — places the five bundled subagent definitions into `.claude/agents/`: **four read-only vehicles + one full-tool `executor`**. **No read-only vehicle gets `Bash`**, and that is the load-bearing property: a read-only fan-out on a full-tool subagent shells out for facts it could have read, and every shelled command is an approval prompt you never needed to see. Three of the four ride a **cheap model** (haiku, low effort) for mechanical work — extraction sweeps, changelog fact-skeletons, gate-failure triage; the fourth, **`review-lens`**, is an ADDITIONAL independent read-only review opinion on code your configured backends have already seen (never a replacement for your review recipe, advisory like every review). The fifth, **`executor`** (all tools; model and effort from `docs/ai/vehicles.json`), is the ONE vehicle with a shell and the instrument behind the **Subagent** recipe: dispatched only for a bounded, file-disjoint execution / authoring / routine slice you verify afterwards — never for read-only work, never as a review backend, and it never commits. Its state (`placed` / `customized` / `unusable` / `missing`) is what a `subagent` slot's readiness resolves from. Writing code and running gates stay off the four read-only vehicles; the executor carries a bounded slice you re-verify on your main lane, and every vehicle's output is verified. Preview by default (`--apply` writes); an existing customized read-only vehicle or lens is **preserved, never overwritten**; the executor's body is re-derived from `docs/ai/vehicles.json` (a hand edit is replaced); never touches `settings*.json`, never commits. |
+| `/agent-workflow-kit agents` | Claude Code · opt-in | **subagent vehicles** — places the five bundled subagent definitions into `.claude/agents/`: **four read-only vehicles + one full-tool `executor`**. **No read-only vehicle gets `Bash`**, and that is the load-bearing property: a read-only fan-out on a full-tool subagent shells out for facts it could have read, and every shelled command is an approval prompt you never needed to see. Three of the four ride a **cheap model** (haiku, low effort) for mechanical work — extraction sweeps, changelog fact-skeletons, gate-failure triage; the fourth, **`review-lens`**, is an ADDITIONAL independent read-only review opinion on code your configured backends have already seen (never a replacement for your plan or diff review recipe, advisory like every review; an epic is reviewed by the lens alone, whatever `epic.review` resolves to). The fifth, **`executor`** (all tools; model and effort from `docs/ai/vehicles.json`), is the ONE vehicle with a shell and the instrument behind the **Subagent** recipe: dispatched only for a bounded, file-disjoint execution / authoring / routine slice you verify afterwards — never for read-only work, never as a review backend, and it never commits. Its state (`placed` / `customized` / `unusable` / `missing`) is what a `subagent` slot's readiness resolves from. Writing code and running gates stay off the four read-only vehicles; the executor carries a bounded slice you re-verify on your main lane, and every vehicle's output is verified. Preview by default (`--apply` writes); an existing customized read-only vehicle or lens is **preserved, never overwritten**; the executor's body is re-derived from `docs/ai/vehicles.json` (a hand edit is replaced); never touches `settings*.json`, never commits. |
 | `/agent-workflow-kit hook` | Claude Code · opt-in | **gate-approval hook** — places a self-contained PreToolUse hook (`.claude/hooks/`) and wires it into `.claude/settings.json`: a Bash command **byte-identical** to a gate you declared in `docs/ai/gates.json` (run from the project root) is auto-approved — no prompt, no idle; a seeded read-only command carrying a runtime residual (output redirection, command substitution, `--output` writes) now **asks** even where an allow rule would have silently passed it (proven live — hook `ask` overrides an allow rule). Detection is a conservative string scan, so it over-asks on a byte that is ordinary text — searching for `=>`, or a read wearing `2>/dev/null`, prompts. That is a documented open limit: 4.1.0 built three mechanisms to narrow it and removed all three in review, each counterexample kept as a test (see Mode: hook). Exact matches only, never patterns; never `deny`; a broken `gates.json` only disables auto-approval, never the guard. An opt-in **read-lane** (`--read-lane` → `docs/ai/lanes.json`, a **separate** file from `gates.json`) additionally auto-approves *compounds* of seeded read-only commands carrying no shell metaprogramming; `--apply --read-lane` verifies the placed hook is current first (delete-to-reseed otherwise). Preview by default; never writes `settings.local.json`; never commits. |
 | `/agent-workflow-kit state-block-guard` | Claude Code · opt-in | **closing-block detector** — a `Stop` hook that reads the turn's final assistant message and warns when the closing state block is defective: the «what I need from you» slot answering *nothing* (a turn that ENDS always needs a resume, so the answer is false, not merely unhelpful), or a first-person promise of imminent work in a turn that is over. Judged on the slot's first clause, so a real ask followed by a clause break and "nothing else" passes, and a promise gated on something named passes; matching is word-bounded and Unicode-aware, quoted and fenced examples are stripped, and the last STARTED block decides — an incomplete tail counts as no block rather than falling back to an earlier one. A message carrying no block at all is silent unless you pass `--require-block` — this kit does not mandate the block, and a hook that runs every turn must not warn every turn. The judgement is lexical and the mode doc names every residual it leaves. **Detection, never prevention** — a `Stop` hook cannot un-send the message it judges; what it buys is that a silent recurrence becomes a visible one. Warns via `systemMessage` and **exits 0 on every path**: never `deny`, never blocks the stop, never re-enters the model. Reads nothing but the message, makes no network call, approves nothing. This mode is **read-only and has no writer** — it ships the self-contained hook and a paste-ready wiring block you merge into `.claude/settings.json` yourself. |
 | `/agent-workflow-kit bridge-settings` | opt-in, any time | **host-level bridge settings** — read or change the bridges' `KEY=VALUE` config file (`${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf`), the **one place a knob survives kit upgrades** (it lives outside every kit tree; a refresh never touches it, and now states loudly if it ever overwrote a local edit). The **model each bridge runs**: `CODEX_MODEL` + `CODEX_EFFORT` (default `gpt-6.1-sol` at `high`) and `AGY_MODEL` (default `Gemini 3.8 Flash (High)`) — the read-out shows the models each installed CLI offers, and a set one is checked against that list before anything is written. Other knobs: the **codex Fast tier** (`CODEX_SERVICE_TIER=priority` — "2x speed, **increased usage**" in the catalog's own words, quality-neutral, default off — a consented spend), the codex/agy hard timeouts, the codex review byte cap, and `AGY_REVIEW_MAX_TOTAL_BYTES` (the ceiling on what an oversized agy code review may feed before it refuses pre-spend). `AGY_REVIEW_ALLOW_ADDDIR` is a **retired** compatibility key: still recognized so an existing line never warns as unknown, but it arms nothing — the writer refuses to set it and `--unset` clears it. Allowed keys + value rules come from the bundled bridge manifests. **Previews by default**; refuses an unknown key, an out-of-range value, a model or effort the catalog does not offer, or a duplicate-carrying file; writes atomically (symlink/TOCTOU-safe). Never commits, never runs a model (only the read-only catalog commands). |

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow". New to the epic, story and task tier? Run `/agent-workflow-kit tier`. A typed decision with a confidence from Jev? Run `/agent-workflow-kit jev`.
 disable-model-invocation: true
 metadata:
-  version: '14.21.0'
+  version: '14.23.0'
 ---
 
 # agent-workflow-kit

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its headless behaviour.
 metadata:
-  version: '6.0.0'
+  version: '7.0.0'
 ---
 
 # antigravity-cli-bridge
@@ -43,9 +43,10 @@ wrapper [`bin/agy.sh`](bin/agy.sh) on `PATH` as `agy-run`.
 ```
 
 Never read, print, copy, commit, or package that token — it is personal and is **never bundled** with
-this skill. The wrapper [`bin/agy.sh`](bin/agy.sh) **unsets every `*_API_KEY`** (`ANTIGRAVITY_API_KEY`,
-`GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_GENAI_API_KEY`) before invoking `agy`, so a stray key can
-never silently switch you to pay-as-you-go billing.
+this skill. The wrapper [`bin/agy.sh`](bin/agy.sh) **unsets `OPENAI_BASE_URL` and every `*_API_KEY` except
+`TYPESAFE_API_KEY`** (`ANTIGRAVITY_API_KEY`, `GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_GENAI_API_KEY`
+included; `TYPESAFE_API_KEY` passes as given) before invoking `agy`, so a stray key can never silently
+switch you to pay-as-you-go billing.
 
 **Caveat:** the subscription has a finite quota. Keep probes short (see *How the main agent drives
 agy*); the model every review and kept run uses is the host posture below, never a per-call pick.
@@ -223,11 +224,15 @@ AGY_MODEL="<an offered display string>" agy-run \
 ```
 
 **The Jev skill in a delegated run.** A headless `agy-run` loads the vendor's Jev skill from the user root the kit's
-`jev-skill` command fills, `~/.gemini/config/skills` — measured 2026-10-02 on agy 1.2.14: a probe skill under that
-root was listed, and none under `~/.gemini/antigravity-cli/skills`. The run never inherits `TYPESAFE_API_KEY`: the
-wrapper unsets every `*_API_KEY` before agy starts. Jev requests are the orchestrator's own, made in the user's
-environment, and their answers are passed into a brief as text; whether a headless agy command reaches a network
-host is governed by the user's agy permissions and sandbox settings, not by the bridge.
+`jev-skill` command fills, `~/.gemini/config/skills` (measured 2026-10-02 on agy 1.2.14: a probe skill under that
+root was listed, none under `~/.gemini/antigravity-cli/skills`), and `TYPESAFE_API_KEY` passes the wrappers as given
+while every other `*_API_KEY` is unset; nothing in agy's permissions is widened, no flag is added and no setting is
+written. With the key set, `agy-run` prints one line before dispatch: a headless agy runs the Jev request only where
+the user's agy permissions allow commands, and the first denied command ends the run. `agy-review` makes no Jev
+request while its model obeys its prompts, which forbid every tool; that prohibition is advisory, not a sandbox. The documented opt-in `-- --dangerously-skip-permissions`
+stays admitted, and such a run carries the key into an agy whose network and file tool are unconfined. Two residuals
+stand: the key now sits in every run's environment, and a `web_search` or fetch tool agy is permitted to run may reach
+hosts the bridge never names.
 
 ## How the main agent drives `agy` efficiently
 
@@ -250,7 +255,8 @@ checklist, prompt templates, output handling). Essentials:
   writes (branch/add/commit/stash/reset/rewrite) with the orchestrator, and tell `agy` in the prompt
   to return findings only. Add `-- --sandbox` when delegating anything that could trigger
   terminal/tool work; opt into `-- --add-dir . --dangerously-skip-permissions` only for a flow that
-  genuinely needs writes, then review the diff afterwards.
+  genuinely needs writes, then review the diff afterwards (such a run also carries `TYPESAFE_API_KEY`,
+  when set, into an agy whose network and file tool are unconfined).
 
 ## Complementary skills (optional, standalone-first)
 

package/bridges/antigravity-cli-bridge/bin/agy-jev.test.mjs

@@ -0,0 +1,105 @@
+// agy-jev.test.mjs — spec jev-every-run, the agy group (D5(a)): agy-run and agy-review pass TYPESAFE_API_KEY by the
+// shared key rule and widen nothing; agy-run prints its one limit line, never as agy-review's child; the documented
+// opt-in stays admitted. A recording stub stands in front of the harness fake agy.
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { makeSandbox, farmFor, FAKE_AGY } from './agy-review-harness.test.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REVIEW = join(HERE, 'agy-review.sh');
+const AGY_RUN = join(HERE, 'agy.sh');
+const LIMIT = `jev: TYPESAFE_API_KEY passed; a headless agy runs the Jev request only where your agy permissions allow commands ${String.fromCharCode(0x2014)} the first denied command ends the run`;
+const KEYS = { TYPESAFE_API_KEY: 'jev-key', ANTIGRAVITY_API_KEY: 'a', GEMINI_API_KEY: 'g', GOOGLE_API_KEY: 'o', GOOGLE_GENAI_API_KEY: 'n', FOO_API_KEY: 'foo' };
+const PASSED = 'key=[jev-key] google=unset,unset,unset,unset foo=unset';
+
+// Every spawn of agy appends its kind and the key states; a run also says so on stderr before the fake answers.
+const RECORDER = [
+  '#!/usr/bin/env bash',
+  'st() { if [[ -n "${!1+x}" ]]; then printf "[%s]" "${!1}"; else printf unset; fi; }',
+  'case "${1:-}" in --help|-h) kind=help ;; --version) kind=version ;; models) kind=models ;; *) kind=run; echo STUB-DISPATCH >&2 ;; esac',
+  'echo "$kind key=$(st TYPESAFE_API_KEY) google=$(st ANTIGRAVITY_API_KEY),$(st GEMINI_API_KEY),$(st GOOGLE_API_KEY),$(st GOOGLE_GENAI_API_KEY) foo=$(st FOO_API_KEY) child=$(st AW_AGY_REVIEW_CHILD)" >>"$AGY_JEV_LOG"',
+  'exec "$AGY_JEV_FAKE" "$@"',
+  '',
+].join('\n');
+
+const made = [];
+after(() => {
+  for (const home of made) rmSync(home, { recursive: true, force: true });
+});
+const sandbox = () => {
+  const sb = makeSandbox();
+  made.push(sb.home);
+  writeFileSync(join(sb.home, 'agy-fake'), FAKE_AGY, { mode: 0o755 });
+  writeFileSync(join(sb.bin, 'agy'), RECORDER, { mode: 0o755 });
+  writeFileSync(join(sb.repo, 'plan.md'), '# a plan under review\n');
+  return sb;
+};
+const drive = (sb, wrapper, args, env = {}) => {
+  const cap = (name) => join(sb.home, name);
+  for (const name of ['jev-log', 'jev-argv']) rmSync(cap(name), { force: true });
+  const r = spawnSync('bash', [wrapper, ...args], {
+    cwd: sb.repo, input: '', encoding: 'utf8', timeout: 60000,
+    env: { HOME: sb.home, PATH: `${sb.bin}:${farmFor(['agy', 'agy-run'])}`, TMPDIR: process.env.TMPDIR ?? '/tmp',
+      AGY_JEV_LOG: cap('jev-log'), AGY_JEV_FAKE: cap('agy-fake'), AGY_FAKE_ARGV: cap('jev-argv'), ...env },
+  });
+  const read = (name) => (existsSync(cap(name)) ? readFileSync(cap(name), 'utf8') : '');
+  const spawns = read('jev-log').split('\n').filter(Boolean).map((line) => [line.slice(0, line.indexOf(' ')), line.slice(line.indexOf(' ') + 1)]);
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, spawns, argv: read('jev-argv').split('\n').slice(0, -1) };
+};
+const runDirect = (sb, env, extra = []) => drive(sb, AGY_RUN, ['a probe prompt', ...extra], env);
+const keysOf = (env) => env.split(' child=')[0];
+const runSpawn = (r) => (r.spawns.find(([kind]) => kind === 'run') ?? [])[1] ?? '';
+const limitLines = (r) => r.stderr.split('\n').filter((line) => line.startsWith('jev:'));
+
+describe('agy-run and agy-review pass the key and unset the rest — spec:jev-every-run/S4', () => {
+  for (const [label, wrapper, args] of [['agy-run', AGY_RUN, ['a probe prompt']], ['agy-review plan', REVIEW, ['plan', 'plan.md']]]) {
+    it(`${label}: every spawn of agy sees TYPESAFE_API_KEY with the four Google keys and FOO_API_KEY unset`, () => {
+      const r = drive(sandbox(), wrapper, args, KEYS);
+      assert.equal(r.status, 0, r.stderr);
+      assert.ok(r.spawns.some(([kind]) => kind === 'run'), 'agy ran');
+      for (const [kind, env] of r.spawns) assert.equal(keysOf(env), PASSED, `${kind} spawn`);
+    });
+  }
+});
+
+describe('the agy half of S5: an empty key and an unset key on agy-run', () => {
+  it('an empty TYPESAFE_API_KEY reaches agy empty, an unset one stays unset, and the argv is the same with the key set', () => {
+    const runs = ['jev-key', '', undefined].map((value) => runDirect(sandbox(), { TYPESAFE_API_KEY: value }));
+    assert.deepEqual(runs.map((r) => keysOf(runSpawn(r)).split(' ')[0]), ['key=[jev-key]', 'key=[]', 'key=unset']);
+    assert.deepEqual([runs[1].argv, runs[2].argv], [runs[0].argv, runs[0].argv]);
+  });
+});
+
+describe('agy-run prints its one limit line — spec:jev-every-run/S20', () => {
+  it('a non-empty key: exactly the one limit line, before dispatch; an empty or an unset key: none', () => {
+    const r = runDirect(sandbox(), { TYPESAFE_API_KEY: 'jev-key' });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(limitLines(r), [LIMIT]);
+    const lines = r.stderr.split('\n');
+    assert.ok(lines.indexOf(LIMIT) < lines.indexOf('STUB-DISPATCH'), r.stderr);
+    for (const value of ['', undefined]) {
+      const quiet = runDirect(sandbox(), { TYPESAFE_API_KEY: value });
+      assert.equal(quiet.status, 0, quiet.stderr);
+      assert.deepEqual(limitLines(quiet), [], JSON.stringify(value));
+    }
+  });
+  it('as agy-review\'s child: agy-run runs marked AW_AGY_REVIEW_CHILD=1 with the key, and no limit line is printed', () => {
+    const r = drive(sandbox(), REVIEW, ['plan', 'plan.md'], { TYPESAFE_API_KEY: 'jev-key' });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(runSpawn(r), `${PASSED} child=[1]`);
+    assert.deepEqual(limitLines(r), []);
+  });
+});
+
+describe('the documented opt-in stays admitted — spec:jev-every-run/S21', () => {
+  it('agy-run -- --dangerously-skip-permissions reaches agy\'s argv, the key beside it', () => {
+    const r = runDirect(sandbox(), { TYPESAFE_API_KEY: 'jev-key' }, ['--', '--dangerously-skip-permissions']);
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(r.argv.includes('--dangerously-skip-permissions'), r.argv.join(' '));
+    assert.equal(keysOf(runSpawn(r)), PASSED);
+  });
+});

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -372,11 +372,24 @@ aw_resolve_timeout_bin() {
   [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
   printf '%s' "$bin"
 }
+aw_scrub_billing_keys() {
+  # The one key rule (spec jev-every-run): OPENAI_BASE_URL and every *_API_KEY are unset, so a stray key can never
+  # switch a run to paid billing; TYPESAFE_API_KEY is neither read nor set, so it reaches the CLI exactly as given.
+  local name
+  unset OPENAI_BASE_URL 2>/dev/null || true
+  for name in $(compgen -v); do
+    case "$name" in
+      TYPESAFE_API_KEY) ;;
+      *_API_KEY) unset "$name" 2>/dev/null || true ;;
+    esac
+  done
+  return 0
+}
 
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="6.0.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="7.0.0"  # aw-version-anchor
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE any interpolation can echo raw
 # newline/ESC bytes into stderr/the terminal (round-2 fold).
 if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
@@ -563,12 +576,9 @@ read_agy_envelope() {  # $1 = captured payload, $2 = response destination, $3 =
   node "$AGY_ENVELOPE_READER" "${args[@]}"
 }
 
-# --- Subscription invariant (reuse agy.sh's security pattern verbatim) --------
+# --- Subscription invariant: the shared key rule, before the first spawn of agy --------
 export PATH="$HOME/.local/bin:$PATH"
-unset ANTIGRAVITY_API_KEY GEMINI_API_KEY GOOGLE_API_KEY GOOGLE_GENAI_API_KEY 2>/dev/null || true
-while IFS= read -r _api_key_var; do
-  unset "$_api_key_var" 2>/dev/null || true
-done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
+aw_scrub_billing_keys
 
 if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. See this skill's setup/README.md." >&2
@@ -763,6 +773,10 @@ aw_agy_catalog_check() {
   exit 2
 }
 export AW_AGY_CATALOG_READ=1
+# Every child agy-run is this review's (spec jev-every-run): its prompts forbid every tool, so a review whose model
+# obeys them sends no request to api.typesafe.ai (an advisory prohibition, not a sandbox), and the child prints no
+# TYPESAFE_API_KEY limit line.
+export AW_AGY_REVIEW_CHILD=1
 if [[ -n "$AGY_MODEL" ]]; then aw_agy_catalog_check "$aw_review_timeout_bin" "$DEFAULT_AGY_REVIEW_MODEL"; fi
 if [[ "$AGY_MODEL" != "$HOST_AGY_MODEL" && "$AGY_PROBE" != "1" ]]; then
   echo "error: $(aw_agy_shown_model) is a one-off — the host posture is '$HOST_AGY_MODEL', and only a probe (AGY_PROBE=1) runs a one-off; refusing before any run is spent." >&2

package/bridges/antigravity-cli-bridge/bin/agy.sh

@@ -8,9 +8,9 @@
 #
 # Auth: SUBSCRIPTION ONLY. We use the cached OAuth token at
 # ~/.gemini/antigravity-cli/antigravity-oauth-token (Google AI Pro) and the
-# quota that comes with it. To make that guarantee hard, the wrapper unsets any
-# API-key env var so a stray key can never silently switch us to paid
-# pay-as-you-go billing.
+# quota that comes with it. To make that guarantee hard, the wrapper unsets
+# every *_API_KEY except TYPESAFE_API_KEY (which passes as given), so a stray
+# key can never silently switch us to paid pay-as-you-go billing.
 #
 # This is a THIN, FLOW-AGNOSTIC wrapper on purpose: it just runs one headless
 # prompt and prints the text response. It does NOT encode any orchestration
@@ -65,14 +65,6 @@ esac
 # 1. Make `agy` findable even when ~/.bashrc was not sourced.
 export PATH="$HOME/.local/bin:$PATH"
 
-# 2. Force the subscription path: never let an API key hijack billing. Unset EVERY *_API_KEY for the
-#    agy subprocess — the explicit Google/Antigravity ones first, then any other *_API_KEY that may
-#    have been added later (`compgen` is a bash builtin; the shebang guarantees bash).
-unset ANTIGRAVITY_API_KEY GEMINI_API_KEY GOOGLE_API_KEY GOOGLE_GENAI_API_KEY 2>/dev/null || true
-while IFS= read -r _api_key_var; do
-  unset "$_api_key_var" 2>/dev/null || true
-done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
-
 # This wrapper's applied settings-file subset (see the shared reader block below).
 AW_SETTINGS_APPLIED="AGY_HARD_TIMEOUT"
 DEFAULT_AGY_MODEL="Gemini 3.8 Flash (High)"
@@ -262,6 +254,23 @@ aw_resolve_timeout_bin() {
   [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
   printf '%s' "$bin"
 }
+aw_scrub_billing_keys() {
+  # The one key rule (spec jev-every-run): OPENAI_BASE_URL and every *_API_KEY are unset, so a stray key can never
+  # switch a run to paid billing; TYPESAFE_API_KEY is neither read nor set, so it reaches the CLI exactly as given.
+  local name
+  unset OPENAI_BASE_URL 2>/dev/null || true
+  for name in $(compgen -v); do
+    case "$name" in
+      TYPESAFE_API_KEY) ;;
+      *_API_KEY) unset "$name" 2>/dev/null || true ;;
+    esac
+  done
+  return 0
+}
+
+# 2. Force the subscription path before the first spawn of agy: the shared key rule (the Google and
+#    Antigravity keys included) — no API key can hijack billing.
+aw_scrub_billing_keys
 
 if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. Install it and run 'agy' once to sign in." >&2
@@ -422,6 +431,12 @@ fi
 
 agy_cmd=(agy "${model_flag[@]}" --print-timeout "$AGY_TIMEOUT" "${passthrough[@]}" -p "$prompt")
 
+# A non-empty TYPESAFE_API_KEY rides into agy and nothing is widened (spec jev-every-run, D5(a)): the limit, once,
+# before dispatch — never in agy-review's child, whose prompts forbid every tool.
+if [[ -n "${TYPESAFE_API_KEY:-}" && "${AW_AGY_REVIEW_CHILD:-}" != "1" ]]; then
+  echo "jev: TYPESAFE_API_KEY passed; a headless agy runs the Jev request only where your agy permissions allow commands — the first denied command ends the run" >&2
+fi
+
 # Hard wall-clock cap via timeout(1) (GNU `timeout` on Linux, `gtimeout` from coreutils on macOS).
 # This is the real guard — a backgrounded, hung agy survives its own --print-timeout otherwise.
 # aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.8 Flash (High)" },
   "roles": {
@@ -180,7 +180,7 @@
         { "slot": "<extra agy flags...>", "required": false, "description": "raw agy flags after -- (a --model* or --effort* flag refuses pre-spend: the model is the host posture or the AGY_MODEL environment value)" }
       ],
       "guardrails": [
-        { "value": "subscription-only — every *_API_KEY env var is unset before the run", "enforcement": "enforced", "source": "bin/agy.sh" },
+        { "value": "subscription-only — every *_API_KEY env var except TYPESAFE_API_KEY is unset before the run; TYPESAFE_API_KEY passes as given and nothing in agy's permissions is widened", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "the model is the host posture (AGY_MODEL in the bridge settings file, else Gemini 3.8 Flash (High)); AGY_MODEL in the environment sets it for one run", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "hard wall-clock cap AGY_HARD_TIMEOUT (built-in default 5m)", "enforcement": "enforced", "condition": "only while timeout(1)/gtimeout is on PATH — otherwise the wrapper warns and runs uncapped", "source": "capability.json settings.AGY_HARD_TIMEOUT" },
         { "value": "the prompt rides a single argv — over AGY_MAX_PROMPT_BYTES (120000) the run refuses", "enforcement": "enforced", "source": "bin/agy.sh" },
@@ -240,7 +240,7 @@
       "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every feed-turn framing block, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
     }
   ],
-  "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com"],
+  "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com", "api.typesafe.ai", "docs.typesafe.ai"],
   "writableDirs": [{ "env": null, "default": "~/.gemini/antigravity-cli" }],
   "detect": {
     "installed": {

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -51,9 +51,10 @@ Environment:
 | `AGY_HARD_TIMEOUT` | `= AGY_TIMEOUT` | hard `timeout(1)` wall-clock cap (a duration string) |
 | `AGY_MAX_PROMPT_BYTES` | `120000` | single-argv byte ceiling. `agy` takes the prompt as ONE `-p` argv; past `MAX_ARG_STRLEN` (~131072) `execve` fails with a cryptic `Argument list too long`. The wrapper measures the resolved `-`/`@file` prompt and fails loud over the ceiling. A huge **literal** `agy-run "<huge>"` fails at the wrapper's own `exec`, so route large prompts via `-`/`@file`. |
 
-Subscription invariant: the wrapper prepends `$HOME/.local/bin` to `PATH` and clears
-`ANTIGRAVITY_API_KEY` / `GEMINI_API_KEY` / `GOOGLE_API_KEY` / `GOOGLE_GENAI_API_KEY` before execution.
-Auth comes from the user's cached OAuth token, never from bundled credentials.
+Subscription invariant: the wrapper prepends `$HOME/.local/bin` to `PATH` and clears `OPENAI_BASE_URL`
+and every `*_API_KEY` except `TYPESAFE_API_KEY` (`ANTIGRAVITY_API_KEY` / `GEMINI_API_KEY` /
+`GOOGLE_API_KEY` / `GOOGLE_GENAI_API_KEY` included) before execution; `TYPESAFE_API_KEY` passes as
+given and widens nothing. Auth comes from the user's cached OAuth token, never from bundled credentials.
 
 ## `agy-review` contract (review role)
 

package/bridges/antigravity-cli-bridge/setup/README.md

@@ -34,7 +34,8 @@ agy
 This caches an OAuth token under `~/.gemini/antigravity-cli/` (`antigravity-oauth-token`). That token
 is **personal** — never copy, commit, package, print, or share that directory or token. This skill
 needs no API keys and must not be configured with API-key billing; the wrapper unsets every
-`*_API_KEY` so billing can never silently fall back to pay-as-you-go.
+`*_API_KEY` except `TYPESAFE_API_KEY` (the one key a run passes, as given) so billing can never
+silently fall back to pay-as-you-go.
 
 ## 3. Put the wrappers on `PATH` (`agy-run` + `agy-review`)