@sabaiway/agent-workflow-kit 14.22.0 → 14.23.0

package/CHANGELOG.md

@@ -4,6 +4,55 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 14.23.0 — a delegated codex or agy run uses Jev as your own run does; ships codex-cli-bridge 5.0.0 and antigravity-cli-bridge 7.0.0 (AD-171)
+
+**Every bridge wrapper now passes `TYPESAFE_API_KEY` to the run, and on Linux with codex-cli 0.160.0 or newer a
+`codex-exec` or `codex-review` run reaches `api.typesafe.ai` and `docs.typesafe.ai` and no other host.** The other
+`*_API_KEY` values and `OPENAI_BASE_URL` stay unset. Where the codex permissions profile is not proven, the run keeps
+the earlier flags with network off and its banner says why. An agy run gets the key and nothing more: no flag, no
+setting.
+
+- **One key rule in every wrapper.** The shared block of `codex-exec.sh`, `codex-review.sh`, `agy.sh` and
+  `agy-review.sh` gains `aw_scrub_billing_keys`, called before the first CLI spawn (login status, version, catalog,
+  run). `test/settings-reader-parity.test.mjs` finds the wrappers from the bridge manifests and
+  `test/jev-every-run.test.mjs` proves that discovery on fixture trees, so a wrapper added later is held to the same
+  block without a test edit.
+- **codex: the permissions profile `jev`.** On Linux (WSL2 included) with codex-cli 0.160.0 or newer, fresh runs,
+  resumes and reviews carry the profile: network to the two Jev hosts only; `codex-exec` writes the repository, `/tmp`
+  and `$TMPDIR`; `codex-review` writes nothing. Not Linux, an older or unreadable codex version, an exec repository
+  or its git common dir under `/tmp` or `$TMPDIR`, or a version and profile recorded as refused: the run takes the
+  earlier flags with network off.
+- **The banner says what the run reaches.** Both codex banners gain `jev=api.typesafe.ai,docs.typesafe.ai` or
+  `jev=unreachable (<reason>)` before `source=`; the exec banner's sandbox field reads `sandbox=jev-profile` or
+  `sandbox=workspace-write`. Receipt schemas are unchanged.
+- **A refused profile stops loudly.** When codex rejects the profile before its first turn, or bwrap fails inside a
+  failed command, the run exits 72 with no success receipt. A rejected profile key records the codex version and
+  profile digest in `${XDG_STATE_HOME:-~/.local/state}/agent-workflow/codex-jev-profile-refused` when that file can
+  be written (otherwise one warning names it), and that wrapper's next run on that pair takes the earlier flags
+  before any spend; a `bwrap: execvp` failure records nothing.
+- **`codex-review` sees the skill.** Its fence home links `.agents/skills` to your real Codex skill root when it
+  exists; the review directives allow reading it and name the two hosts on a profile run only.
+- **Probe passthrough under the profile.** With `CODEX_PROBE=1`, `--add-dir`, `-C`, `--cd`, `--enable` and `--disable`
+  are refused before any spend (exit 2) while the profile is on; under the fallback they stay admitted.
+- **agy.** With the key set, `agy-run` prints one line before dispatch: `jev: TYPESAFE_API_KEY passed; a headless agy
+  runs the Jev request only where your agy permissions allow commands — the first denied command ends the run`.
+  `agy-review` makes no Jev request while its model obeys its prompts, which forbid every tool (an advisory
+  prohibition, not a sandbox).
+- **Manifests.** Both bridges' `networkHosts` gain `api.typesafe.ai` and `docs.typesafe.ai`, so the sandbox
+  Recommendations item shows once more on a project that acknowledged it. Guardrails and banner notes are rewritten,
+  and `tools/detect-backends.mjs`'s role-contract copy follows them.
+- **The sandbox notes no longer promise the tier routes wrappers outside.** On 2026-10-06 Claude Code 2.1.291 ran
+  an agent's plain `codex-review` inside its sandbox although the project excluded it; a sandboxed run's Jev request
+  gets `Tunnel connection failed: 403` from the harness proxy (observed 2026-10-05). `references/modes/recommendations.md`
+  now says the tier routes the wrappers outside only where the harness honours that entry, names the refusal, and
+  points to the hand-apply `allowedDomains` shape with the recipe's hosts, which the kit never writes for you;
+  `references/modes/velocity.md` and the manifest schema's `networkHosts` note say the same.
+- **Stated residuals.** Both bridge `SKILL.md` paragraphs say the key sits in every run's environment; the codex one
+  names codex's server-side `web_search`, which reaches pages outside the profile, the agy one a `web_search` or
+  fetch tool agy is permitted to run. A codex release that stops recognizing a profile key
+  costs one run per version and profile digest before the recorded fallback takes over.
+- The tarball pin rises 355 → 358 (the mirrored bridge suites `codex-exec-jev`, `codex-review-jev`, `agy-jev`).
+
 ## 14.22.0 — a story runs in four sessions, each step with one checked result; the advisor renders the new review loop (AD-170)
 
 **Your project's rules now state the story flow the engine's canon (5.12.0) defines: four sessions — spec and plan,

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow". New to the epic, story and task tier? Run `/agent-workflow-kit tier`. A typed decision with a confidence from Jev? Run `/agent-workflow-kit jev`.
 disable-model-invocation: true
 metadata:
-  version: '14.22.0'
+  version: '14.23.0'
 ---
 
 # agent-workflow-kit

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its headless behaviour.
 metadata:
-  version: '6.0.0'
+  version: '7.0.0'
 ---
 
 # antigravity-cli-bridge
@@ -43,9 +43,10 @@ wrapper [`bin/agy.sh`](bin/agy.sh) on `PATH` as `agy-run`.
 ```
 
 Never read, print, copy, commit, or package that token — it is personal and is **never bundled** with
-this skill. The wrapper [`bin/agy.sh`](bin/agy.sh) **unsets every `*_API_KEY`** (`ANTIGRAVITY_API_KEY`,
-`GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_GENAI_API_KEY`) before invoking `agy`, so a stray key can
-never silently switch you to pay-as-you-go billing.
+this skill. The wrapper [`bin/agy.sh`](bin/agy.sh) **unsets `OPENAI_BASE_URL` and every `*_API_KEY` except
+`TYPESAFE_API_KEY`** (`ANTIGRAVITY_API_KEY`, `GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_GENAI_API_KEY`
+included; `TYPESAFE_API_KEY` passes as given) before invoking `agy`, so a stray key can never silently
+switch you to pay-as-you-go billing.
 
 **Caveat:** the subscription has a finite quota. Keep probes short (see *How the main agent drives
 agy*); the model every review and kept run uses is the host posture below, never a per-call pick.
@@ -223,11 +224,15 @@ AGY_MODEL="<an offered display string>" agy-run \
 ```
 
 **The Jev skill in a delegated run.** A headless `agy-run` loads the vendor's Jev skill from the user root the kit's
-`jev-skill` command fills, `~/.gemini/config/skills` — measured 2026-10-02 on agy 1.2.14: a probe skill under that
-root was listed, and none under `~/.gemini/antigravity-cli/skills`. The run never inherits `TYPESAFE_API_KEY`: the
-wrapper unsets every `*_API_KEY` before agy starts. Jev requests are the orchestrator's own, made in the user's
-environment, and their answers are passed into a brief as text; whether a headless agy command reaches a network
-host is governed by the user's agy permissions and sandbox settings, not by the bridge.
+`jev-skill` command fills, `~/.gemini/config/skills` (measured 2026-10-02 on agy 1.2.14: a probe skill under that
+root was listed, none under `~/.gemini/antigravity-cli/skills`), and `TYPESAFE_API_KEY` passes the wrappers as given
+while every other `*_API_KEY` is unset; nothing in agy's permissions is widened, no flag is added and no setting is
+written. With the key set, `agy-run` prints one line before dispatch: a headless agy runs the Jev request only where
+the user's agy permissions allow commands, and the first denied command ends the run. `agy-review` makes no Jev
+request while its model obeys its prompts, which forbid every tool; that prohibition is advisory, not a sandbox. The documented opt-in `-- --dangerously-skip-permissions`
+stays admitted, and such a run carries the key into an agy whose network and file tool are unconfined. Two residuals
+stand: the key now sits in every run's environment, and a `web_search` or fetch tool agy is permitted to run may reach
+hosts the bridge never names.
 
 ## How the main agent drives `agy` efficiently
 
@@ -250,7 +255,8 @@ checklist, prompt templates, output handling). Essentials:
   writes (branch/add/commit/stash/reset/rewrite) with the orchestrator, and tell `agy` in the prompt
   to return findings only. Add `-- --sandbox` when delegating anything that could trigger
   terminal/tool work; opt into `-- --add-dir . --dangerously-skip-permissions` only for a flow that
-  genuinely needs writes, then review the diff afterwards.
+  genuinely needs writes, then review the diff afterwards (such a run also carries `TYPESAFE_API_KEY`,
+  when set, into an agy whose network and file tool are unconfined).
 
 ## Complementary skills (optional, standalone-first)
 

package/bridges/antigravity-cli-bridge/bin/agy-jev.test.mjs

@@ -0,0 +1,105 @@
+// agy-jev.test.mjs — spec jev-every-run, the agy group (D5(a)): agy-run and agy-review pass TYPESAFE_API_KEY by the
+// shared key rule and widen nothing; agy-run prints its one limit line, never as agy-review's child; the documented
+// opt-in stays admitted. A recording stub stands in front of the harness fake agy.
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { makeSandbox, farmFor, FAKE_AGY } from './agy-review-harness.test.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REVIEW = join(HERE, 'agy-review.sh');
+const AGY_RUN = join(HERE, 'agy.sh');
+const LIMIT = `jev: TYPESAFE_API_KEY passed; a headless agy runs the Jev request only where your agy permissions allow commands ${String.fromCharCode(0x2014)} the first denied command ends the run`;
+const KEYS = { TYPESAFE_API_KEY: 'jev-key', ANTIGRAVITY_API_KEY: 'a', GEMINI_API_KEY: 'g', GOOGLE_API_KEY: 'o', GOOGLE_GENAI_API_KEY: 'n', FOO_API_KEY: 'foo' };
+const PASSED = 'key=[jev-key] google=unset,unset,unset,unset foo=unset';
+
+// Every spawn of agy appends its kind and the key states; a run also says so on stderr before the fake answers.
+const RECORDER = [
+  '#!/usr/bin/env bash',
+  'st() { if [[ -n "${!1+x}" ]]; then printf "[%s]" "${!1}"; else printf unset; fi; }',
+  'case "${1:-}" in --help|-h) kind=help ;; --version) kind=version ;; models) kind=models ;; *) kind=run; echo STUB-DISPATCH >&2 ;; esac',
+  'echo "$kind key=$(st TYPESAFE_API_KEY) google=$(st ANTIGRAVITY_API_KEY),$(st GEMINI_API_KEY),$(st GOOGLE_API_KEY),$(st GOOGLE_GENAI_API_KEY) foo=$(st FOO_API_KEY) child=$(st AW_AGY_REVIEW_CHILD)" >>"$AGY_JEV_LOG"',
+  'exec "$AGY_JEV_FAKE" "$@"',
+  '',
+].join('\n');
+
+const made = [];
+after(() => {
+  for (const home of made) rmSync(home, { recursive: true, force: true });
+});
+const sandbox = () => {
+  const sb = makeSandbox();
+  made.push(sb.home);
+  writeFileSync(join(sb.home, 'agy-fake'), FAKE_AGY, { mode: 0o755 });
+  writeFileSync(join(sb.bin, 'agy'), RECORDER, { mode: 0o755 });
+  writeFileSync(join(sb.repo, 'plan.md'), '# a plan under review\n');
+  return sb;
+};
+const drive = (sb, wrapper, args, env = {}) => {
+  const cap = (name) => join(sb.home, name);
+  for (const name of ['jev-log', 'jev-argv']) rmSync(cap(name), { force: true });
+  const r = spawnSync('bash', [wrapper, ...args], {
+    cwd: sb.repo, input: '', encoding: 'utf8', timeout: 60000,
+    env: { HOME: sb.home, PATH: `${sb.bin}:${farmFor(['agy', 'agy-run'])}`, TMPDIR: process.env.TMPDIR ?? '/tmp',
+      AGY_JEV_LOG: cap('jev-log'), AGY_JEV_FAKE: cap('agy-fake'), AGY_FAKE_ARGV: cap('jev-argv'), ...env },
+  });
+  const read = (name) => (existsSync(cap(name)) ? readFileSync(cap(name), 'utf8') : '');
+  const spawns = read('jev-log').split('\n').filter(Boolean).map((line) => [line.slice(0, line.indexOf(' ')), line.slice(line.indexOf(' ') + 1)]);
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, spawns, argv: read('jev-argv').split('\n').slice(0, -1) };
+};
+const runDirect = (sb, env, extra = []) => drive(sb, AGY_RUN, ['a probe prompt', ...extra], env);
+const keysOf = (env) => env.split(' child=')[0];
+const runSpawn = (r) => (r.spawns.find(([kind]) => kind === 'run') ?? [])[1] ?? '';
+const limitLines = (r) => r.stderr.split('\n').filter((line) => line.startsWith('jev:'));
+
+describe('agy-run and agy-review pass the key and unset the rest — spec:jev-every-run/S4', () => {
+  for (const [label, wrapper, args] of [['agy-run', AGY_RUN, ['a probe prompt']], ['agy-review plan', REVIEW, ['plan', 'plan.md']]]) {
+    it(`${label}: every spawn of agy sees TYPESAFE_API_KEY with the four Google keys and FOO_API_KEY unset`, () => {
+      const r = drive(sandbox(), wrapper, args, KEYS);
+      assert.equal(r.status, 0, r.stderr);
+      assert.ok(r.spawns.some(([kind]) => kind === 'run'), 'agy ran');
+      for (const [kind, env] of r.spawns) assert.equal(keysOf(env), PASSED, `${kind} spawn`);
+    });
+  }
+});
+
+describe('the agy half of S5: an empty key and an unset key on agy-run', () => {
+  it('an empty TYPESAFE_API_KEY reaches agy empty, an unset one stays unset, and the argv is the same with the key set', () => {
+    const runs = ['jev-key', '', undefined].map((value) => runDirect(sandbox(), { TYPESAFE_API_KEY: value }));
+    assert.deepEqual(runs.map((r) => keysOf(runSpawn(r)).split(' ')[0]), ['key=[jev-key]', 'key=[]', 'key=unset']);
+    assert.deepEqual([runs[1].argv, runs[2].argv], [runs[0].argv, runs[0].argv]);
+  });
+});
+
+describe('agy-run prints its one limit line — spec:jev-every-run/S20', () => {
+  it('a non-empty key: exactly the one limit line, before dispatch; an empty or an unset key: none', () => {
+    const r = runDirect(sandbox(), { TYPESAFE_API_KEY: 'jev-key' });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(limitLines(r), [LIMIT]);
+    const lines = r.stderr.split('\n');
+    assert.ok(lines.indexOf(LIMIT) < lines.indexOf('STUB-DISPATCH'), r.stderr);
+    for (const value of ['', undefined]) {
+      const quiet = runDirect(sandbox(), { TYPESAFE_API_KEY: value });
+      assert.equal(quiet.status, 0, quiet.stderr);
+      assert.deepEqual(limitLines(quiet), [], JSON.stringify(value));
+    }
+  });
+  it('as agy-review\'s child: agy-run runs marked AW_AGY_REVIEW_CHILD=1 with the key, and no limit line is printed', () => {
+    const r = drive(sandbox(), REVIEW, ['plan', 'plan.md'], { TYPESAFE_API_KEY: 'jev-key' });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(runSpawn(r), `${PASSED} child=[1]`);
+    assert.deepEqual(limitLines(r), []);
+  });
+});
+
+describe('the documented opt-in stays admitted — spec:jev-every-run/S21', () => {
+  it('agy-run -- --dangerously-skip-permissions reaches agy\'s argv, the key beside it', () => {
+    const r = runDirect(sandbox(), { TYPESAFE_API_KEY: 'jev-key' }, ['--', '--dangerously-skip-permissions']);
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(r.argv.includes('--dangerously-skip-permissions'), r.argv.join(' '));
+    assert.equal(keysOf(runSpawn(r)), PASSED);
+  });
+});

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -372,11 +372,24 @@ aw_resolve_timeout_bin() {
   [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
   printf '%s' "$bin"
 }
+aw_scrub_billing_keys() {
+  # The one key rule (spec jev-every-run): OPENAI_BASE_URL and every *_API_KEY are unset, so a stray key can never
+  # switch a run to paid billing; TYPESAFE_API_KEY is neither read nor set, so it reaches the CLI exactly as given.
+  local name
+  unset OPENAI_BASE_URL 2>/dev/null || true
+  for name in $(compgen -v); do
+    case "$name" in
+      TYPESAFE_API_KEY) ;;
+      *_API_KEY) unset "$name" 2>/dev/null || true ;;
+    esac
+  done
+  return 0
+}
 
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="6.0.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="7.0.0"  # aw-version-anchor
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE any interpolation can echo raw
 # newline/ESC bytes into stderr/the terminal (round-2 fold).
 if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
@@ -563,12 +576,9 @@ read_agy_envelope() {  # $1 = captured payload, $2 = response destination, $3 =
   node "$AGY_ENVELOPE_READER" "${args[@]}"
 }
 
-# --- Subscription invariant (reuse agy.sh's security pattern verbatim) --------
+# --- Subscription invariant: the shared key rule, before the first spawn of agy --------
 export PATH="$HOME/.local/bin:$PATH"
-unset ANTIGRAVITY_API_KEY GEMINI_API_KEY GOOGLE_API_KEY GOOGLE_GENAI_API_KEY 2>/dev/null || true
-while IFS= read -r _api_key_var; do
-  unset "$_api_key_var" 2>/dev/null || true
-done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
+aw_scrub_billing_keys
 
 if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. See this skill's setup/README.md." >&2
@@ -763,6 +773,10 @@ aw_agy_catalog_check() {
   exit 2
 }
 export AW_AGY_CATALOG_READ=1
+# Every child agy-run is this review's (spec jev-every-run): its prompts forbid every tool, so a review whose model
+# obeys them sends no request to api.typesafe.ai (an advisory prohibition, not a sandbox), and the child prints no
+# TYPESAFE_API_KEY limit line.
+export AW_AGY_REVIEW_CHILD=1
 if [[ -n "$AGY_MODEL" ]]; then aw_agy_catalog_check "$aw_review_timeout_bin" "$DEFAULT_AGY_REVIEW_MODEL"; fi
 if [[ "$AGY_MODEL" != "$HOST_AGY_MODEL" && "$AGY_PROBE" != "1" ]]; then
   echo "error: $(aw_agy_shown_model) is a one-off — the host posture is '$HOST_AGY_MODEL', and only a probe (AGY_PROBE=1) runs a one-off; refusing before any run is spent." >&2

package/bridges/antigravity-cli-bridge/bin/agy.sh

@@ -8,9 +8,9 @@
 #
 # Auth: SUBSCRIPTION ONLY. We use the cached OAuth token at
 # ~/.gemini/antigravity-cli/antigravity-oauth-token (Google AI Pro) and the
-# quota that comes with it. To make that guarantee hard, the wrapper unsets any
-# API-key env var so a stray key can never silently switch us to paid
-# pay-as-you-go billing.
+# quota that comes with it. To make that guarantee hard, the wrapper unsets
+# every *_API_KEY except TYPESAFE_API_KEY (which passes as given), so a stray
+# key can never silently switch us to paid pay-as-you-go billing.
 #
 # This is a THIN, FLOW-AGNOSTIC wrapper on purpose: it just runs one headless
 # prompt and prints the text response. It does NOT encode any orchestration
@@ -65,14 +65,6 @@ esac
 # 1. Make `agy` findable even when ~/.bashrc was not sourced.
 export PATH="$HOME/.local/bin:$PATH"
 
-# 2. Force the subscription path: never let an API key hijack billing. Unset EVERY *_API_KEY for the
-#    agy subprocess — the explicit Google/Antigravity ones first, then any other *_API_KEY that may
-#    have been added later (`compgen` is a bash builtin; the shebang guarantees bash).
-unset ANTIGRAVITY_API_KEY GEMINI_API_KEY GOOGLE_API_KEY GOOGLE_GENAI_API_KEY 2>/dev/null || true
-while IFS= read -r _api_key_var; do
-  unset "$_api_key_var" 2>/dev/null || true
-done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
-
 # This wrapper's applied settings-file subset (see the shared reader block below).
 AW_SETTINGS_APPLIED="AGY_HARD_TIMEOUT"
 DEFAULT_AGY_MODEL="Gemini 3.8 Flash (High)"
@@ -262,6 +254,23 @@ aw_resolve_timeout_bin() {
   [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
   printf '%s' "$bin"
 }
+aw_scrub_billing_keys() {
+  # The one key rule (spec jev-every-run): OPENAI_BASE_URL and every *_API_KEY are unset, so a stray key can never
+  # switch a run to paid billing; TYPESAFE_API_KEY is neither read nor set, so it reaches the CLI exactly as given.
+  local name
+  unset OPENAI_BASE_URL 2>/dev/null || true
+  for name in $(compgen -v); do
+    case "$name" in
+      TYPESAFE_API_KEY) ;;
+      *_API_KEY) unset "$name" 2>/dev/null || true ;;
+    esac
+  done
+  return 0
+}
+
+# 2. Force the subscription path before the first spawn of agy: the shared key rule (the Google and
+#    Antigravity keys included) — no API key can hijack billing.
+aw_scrub_billing_keys
 
 if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. Install it and run 'agy' once to sign in." >&2
@@ -422,6 +431,12 @@ fi
 
 agy_cmd=(agy "${model_flag[@]}" --print-timeout "$AGY_TIMEOUT" "${passthrough[@]}" -p "$prompt")
 
+# A non-empty TYPESAFE_API_KEY rides into agy and nothing is widened (spec jev-every-run, D5(a)): the limit, once,
+# before dispatch — never in agy-review's child, whose prompts forbid every tool.
+if [[ -n "${TYPESAFE_API_KEY:-}" && "${AW_AGY_REVIEW_CHILD:-}" != "1" ]]; then
+  echo "jev: TYPESAFE_API_KEY passed; a headless agy runs the Jev request only where your agy permissions allow commands — the first denied command ends the run" >&2
+fi
+
 # Hard wall-clock cap via timeout(1) (GNU `timeout` on Linux, `gtimeout` from coreutils on macOS).
 # This is the real guard — a backgrounded, hung agy survives its own --print-timeout otherwise.
 # aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.8 Flash (High)" },
   "roles": {
@@ -180,7 +180,7 @@
         { "slot": "<extra agy flags...>", "required": false, "description": "raw agy flags after -- (a --model* or --effort* flag refuses pre-spend: the model is the host posture or the AGY_MODEL environment value)" }
       ],
       "guardrails": [
-        { "value": "subscription-only — every *_API_KEY env var is unset before the run", "enforcement": "enforced", "source": "bin/agy.sh" },
+        { "value": "subscription-only — every *_API_KEY env var except TYPESAFE_API_KEY is unset before the run; TYPESAFE_API_KEY passes as given and nothing in agy's permissions is widened", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "the model is the host posture (AGY_MODEL in the bridge settings file, else Gemini 3.8 Flash (High)); AGY_MODEL in the environment sets it for one run", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "hard wall-clock cap AGY_HARD_TIMEOUT (built-in default 5m)", "enforcement": "enforced", "condition": "only while timeout(1)/gtimeout is on PATH — otherwise the wrapper warns and runs uncapped", "source": "capability.json settings.AGY_HARD_TIMEOUT" },
         { "value": "the prompt rides a single argv — over AGY_MAX_PROMPT_BYTES (120000) the run refuses", "enforcement": "enforced", "source": "bin/agy.sh" },
@@ -240,7 +240,7 @@
       "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every feed-turn framing block, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
     }
   ],
-  "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com"],
+  "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com", "api.typesafe.ai", "docs.typesafe.ai"],
   "writableDirs": [{ "env": null, "default": "~/.gemini/antigravity-cli" }],
   "detect": {
     "installed": {

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -51,9 +51,10 @@ Environment:
 | `AGY_HARD_TIMEOUT` | `= AGY_TIMEOUT` | hard `timeout(1)` wall-clock cap (a duration string) |
 | `AGY_MAX_PROMPT_BYTES` | `120000` | single-argv byte ceiling. `agy` takes the prompt as ONE `-p` argv; past `MAX_ARG_STRLEN` (~131072) `execve` fails with a cryptic `Argument list too long`. The wrapper measures the resolved `-`/`@file` prompt and fails loud over the ceiling. A huge **literal** `agy-run "<huge>"` fails at the wrapper's own `exec`, so route large prompts via `-`/`@file`. |
 
-Subscription invariant: the wrapper prepends `$HOME/.local/bin` to `PATH` and clears
-`ANTIGRAVITY_API_KEY` / `GEMINI_API_KEY` / `GOOGLE_API_KEY` / `GOOGLE_GENAI_API_KEY` before execution.
-Auth comes from the user's cached OAuth token, never from bundled credentials.
+Subscription invariant: the wrapper prepends `$HOME/.local/bin` to `PATH` and clears `OPENAI_BASE_URL`
+and every `*_API_KEY` except `TYPESAFE_API_KEY` (`ANTIGRAVITY_API_KEY` / `GEMINI_API_KEY` /
+`GOOGLE_API_KEY` / `GOOGLE_GENAI_API_KEY` included) before execution; `TYPESAFE_API_KEY` passes as
+given and widens nothing. Auth comes from the user's cached OAuth token, never from bundled credentials.
 
 ## `agy-review` contract (review role)
 

package/bridges/antigravity-cli-bridge/setup/README.md

@@ -34,7 +34,8 @@ agy
 This caches an OAuth token under `~/.gemini/antigravity-cli/` (`antigravity-oauth-token`). That token
 is **personal** — never copy, commit, package, print, or share that directory or token. This skill
 needs no API keys and must not be configured with API-key billing; the wrapper unsets every
-`*_API_KEY` so billing can never silently fall back to pay-as-you-go.
+`*_API_KEY` except `TYPESAFE_API_KEY` (the one key a run passes, as given) so billing can never
+silently fall back to pay-as-you-go.
 
 ## 3. Put the wrappers on `PATH` (`agy-run` + `agy-review`)
 

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '4.0.0'
+  version: '5.0.0'
 ---
 
 # codex-cli-bridge
@@ -18,7 +18,8 @@ or a working-tree diff and only emits findings (`codex-review`).
 
 Use this skill when the user wants to:
 
-- Delegate plan or instruction EXECUTION to `codex` in a workspace-write sandbox (network OFF).
+- Delegate plan or instruction EXECUTION to `codex` in a workspace-write sandbox (network to
+  `api.typesafe.ai` and `docs.typesafe.ai` only where the permissions profile `jev` runs, off elsewhere).
 - Get a second-opinion ADVISORY review of an implementation plan or the current diff.
 - Install, authenticate, smoke-test, or troubleshoot `codex`, or understand its sandbox/flags/models.
 - Drive codex efficiently from the main agent (exec vs review, `resume`, the commit boundary).
@@ -39,8 +40,9 @@ binary, run `codex login` once under a ChatGPT subscription, then expose this sk
 print, copy, commit, or package `~/.codex/auth.json` — it is personal and is **never bundled** with
 this skill. Both wrappers enforce the subscription path before invoking codex:
 
-- they **unset every `*_API_KEY`** (plus `OPENAI_API_KEY` / `CODEX_API_KEY` / `OPENAI_BASE_URL`) so a
-  stray key can never silently switch you to paid api-key billing;
+- they **unset `OPENAI_BASE_URL` and every `*_API_KEY` except `TYPESAFE_API_KEY`** (`OPENAI_API_KEY`
+  and `CODEX_API_KEY` included; `TYPESAFE_API_KEY` passes as given) so a stray key can never silently
+  switch you to paid api-key billing;
 - they pass **`--ignore-user-config`** so a personal `~/.codex/config.toml` cannot change model,
   sandbox, or approval behaviour (auth still works — codex reads the login from `CODEX_HOME`
   regardless of that flag);
@@ -97,7 +99,7 @@ waste, never lowering quality. Full knob list: [§ Environment knobs](#environme
 Drive codex only through the two wrappers (installed on `PATH`), run from the target project root:
 
 ```bash
-# EXECUTION (workspace-write sandbox, network OFF, never prompts):
+# EXECUTION (workspace writes; network to api.typesafe.ai and docs.typesafe.ai under the profile `jev`, else off; never prompts):
 codex-exec docs/plans/<slug>.md                 # drive a plan file
 echo "apply review fix: ..." | codex-exec -      # ad-hoc instruction from stdin
 codex-exec <file|-> -- <extra codex flags...>     # GUARDED passthrough after `--` (policy/model/capture flags rejected; some relaxed only under CODEX_PROBE=1)
@@ -109,7 +111,7 @@ echo "now do step 2 ..." | codex-exec --resume <session-id> -
 # ACCOUNTED EXECUTION (the delegation ledger's exec lane — see "Dispatch identity" below):
 codex-exec --nonce <n> docs/plans/<slug>-dispatch.md   # mints a fail-closed exec receipt
 
-# REVIEW (read-only sandbox — codex cannot edit anything, only emits findings):
+# REVIEW (read-only: the profile `jev` with no write entry, or --sandbox read-only — codex only emits findings):
 codex-review plan docs/plans/<slug>.md           # critique a plan
 codex-review code                                # review the current working-tree diff (precomputed)
 codex-review code "focus on the new reducer"     # review with extra focus
@@ -118,12 +120,20 @@ codex-review code "focus on the new reducer"     # review with extra focus
 **Honesty + posture (D4/D5):** a run whose final message has no recognized
 `Verdict: <ship|revise|rethink>` line — empty or missing output included — **exits 4 with NO
 receipt**: treat it as a *failed review to re-run*, never a fatal session error. One stderr banner
-states the actual posture (`review posture: model=… effort=… tier=… source=… timeout=…`) and the
+states the actual posture (`review posture: model=… effort=… tier=… jev=… source=… timeout=…`) and the
 receipt records the same `posture {model, effort, tier}` (tier `null` on the standard tier); control
 bytes in a posture value refuse pre-spend in every mode. `codex-exec` states its posture the same way —
-ONE `exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id>
-source=… timeout=…` stderr line before dispatch (the resume id validated pre-spend). The `source=`
-field (`model:<s>,effort:<s>`, each `default`, `setting` or `environment`) and the `timeout=` field
+ONE `exec posture: model=… effort=… tier=… sandbox=jev-profile|workspace-write session=fresh|resume:<id>
+jev=… source=… timeout=…` stderr line before dispatch (the resume id validated pre-spend). The `jev=`
+field says what the run reaches: `jev=api.typesafe.ai,docs.typesafe.ai` under the permissions profile `jev`
+(Linux, codex-cli 0.160.0 or newer, for `codex-exec` a repository outside every temp root, a codex
+version and profile digest not recorded as refused), else `jev=unreachable (<reason>)` on today's flags.
+A run whose codex refuses the profile (a profile error before the turn starts, or `bwrap: execvp` in a
+failed command) **exits 72** with no success receipt (a review writes none); a refused profile key is
+recorded in `${XDG_STATE_HOME:-~/.local/state}/agent-workflow/codex-jev-profile-refused` when that file
+can be written, so the next run of that wrapper on that version and digest takes today's flags; a
+`bwrap: execvp` failure records nothing. The `jev=`, `source=` (`model:<s>,effort:<s>`,
+each `default`, `setting` or `environment`) and `timeout=` fields
 are **banner-only** (`timeout=` is exactly the duration handed to `timeout(1)`; on exec `uncapped`
 without a capping binary, while `codex-review` **fails CLOSED pre-spend** there) — informational,
 never a receipt field. **Quote the posture banner verbatim** when labeling a dispatch.
@@ -172,8 +182,9 @@ anything that would defeat a policy is guarded — see [§ Models](#models-the-h
 | `CODEX_REVIEW_SCHEMA` | unset | `codex-review`: `=1` returns findings as a validated JSON object (`--output-schema`), with a raw-text fallback. Default off. |
 | `CODEX_PROBE` | unset | `=1` ⇒ throwaway-probe mode: the one route to a one-off model or effort, and it relaxes the tier-2 passthrough guard (echoed loudly); a probe review's receipt never attests. Never for real work. |
 
-The git-write shim, `--ignore-user-config`, and the `*_API_KEY` scrub are NOT env-tunable — they are
-fixed invariants.
+The git-write shim, `--ignore-user-config`, the key rule (`OPENAI_BASE_URL` and every `*_API_KEY` but
+`TYPESAFE_API_KEY` unset) and the choice between the profile and today's flags are NOT env-tunable —
+they are fixed invariants.
 
 ### Dispatch identity — the accounted exec lane
 
@@ -238,11 +249,17 @@ avoided). And the execution contract tells codex: if the project declares **no**
 set, **STOP and report** rather than invent checks. Pass `--skip-git-repo-check` to codex only when
 you truly mean it.
 
-**The Jev skill in a delegated run.** A `codex-exec` run loads the vendor's Jev skill from the user root the kit's
-`jev-skill` command fills, `~/.agents/skills` — measured 2026-10-02: a run under `--ignore-user-config` listed the
-skills of that root. The run never inherits `TYPESAFE_API_KEY`: the wrappers unset every `*_API_KEY` before codex
-starts. codex exec has no network, so Jev requests are the orchestrator's own, made in the user's environment, and
-their answers are passed into a brief as text.
+**The Jev skill in a delegated run.** A `codex-exec` or `codex-review` run loads the vendor's Jev skill from the
+user root the kit's `jev-skill` command fills, `~/.agents/skills` (a run under `--ignore-user-config` listed its
+skills, measured 2026-10-02; `codex-review` links that root into its fence home), and `TYPESAFE_API_KEY` passes the
+wrappers as given while every other `*_API_KEY` is unset. On Linux with codex-cli 0.160.0 or newer, off a codex
+version and profile digest recorded as refused and, for `codex-exec`, from a repository outside every temp root, the
+run carries the permissions profile `jev`: it reaches `api.typesafe.ai` and `docs.typesafe.ai` and no other host, a review still
+writes nothing, and the banner reads `jev=api.typesafe.ai,docs.typesafe.ai`; anywhere else the run keeps today's
+flags with network off and the banner says `jev=unreachable (<reason>)`. Two residuals stand: codex's server-side
+`web_search` reaches pages outside the profile, and the key now sits in every run's environment, the `web_search`
+channel included. A codex release that stops recognizing a profile key costs one run per version and profile digest
+(exit 72), while the state file can be written, before the recorded fallback takes over.
 
 ## How the main agent drives `codex` efficiently
 
@@ -263,11 +280,12 @@ See [`references/driving-codex.md`](references/driving-codex.md) for the full pl
   resume entrypoint re-establishes EVERY wrapper invariant (subscription-only, `--ignore-user-config`,
   the host posture's model/effort) and **restates the full posture via `-c`** — `codex exec resume` resets the
   sandbox/approval/network posture and rejects the `-s`/`--add-dir`/`-C` posture flags, so the wrapper
-  sets `sandbox_mode=workspace-write` + `approval_policy=never` +
-  `sandbox_workspace_write.network_access=false` explicitly. It reads the session id from the sidecar
-  (`--resume-last`) or takes it as an argument.
-- **Network is OFF in exec.** New dependencies and any network step are installed by hand, then codex
-  is re-dispatched.
+  sets `approval_policy=never` and the run's own posture explicitly — the profile `jev`'s four overrides,
+  or `sandbox_mode=workspace-write` + `sandbox_workspace_write.network_access=false` — chosen afresh on
+  each resume. It reads the session id from the sidecar (`--resume-last`) or takes it as an argument.
+- **Network: two hosts at most in exec.** Under the profile `jev` a run reaches `api.typesafe.ai` and
+  `docs.typesafe.ai` only; under today's flags none. New dependencies and any other network step are
+  installed by hand, then codex is re-dispatched.
 - **`codex-review code` precomputes the diff.** The wrapper assembles the change set (repo map, status,
   staged + unstaged diff, untracked file contents) and feeds it in, so codex does not roam the
   filesystem rediscovering it; a clean tree exits 0 before a run is spent. Native `codex review` is
@@ -293,8 +311,10 @@ The wrappers work in any git repo where `codex` is installed and authenticated.
 
 ## Known limitations
 
-- **Network is OFF** in `codex-exec` (`sandbox_workspace_write.network_access=false`): codex cannot
-  install dependencies or reach the network — do that by hand, then re-dispatch.
+- **Network: two hosts at most** in `codex-exec` — the profile `jev` reaches `api.typesafe.ai` and
+  `docs.typesafe.ai` only, today's flags (`sandbox_workspace_write.network_access=false`) none: codex
+  cannot install dependencies — do that by hand, then re-dispatch. The profile runs only on Linux with
+  codex-cli 0.160.0 or newer; Windows and macOS keep today's flags until its round-trip is probed there.
 - **No live approvals** — `codex exec` has no TTY, so `approval_policy=never`; an action that would
   need escalation is reported, not approved interactively.
 - **`resume` resets the posture** — `codex exec resume` rejects `-s`/`--add-dir`/`-C` and forgets the