@sabaiway/agent-workflow-kit 14.22.0 → 14.24.0

package/CHANGELOG.md

@@ -4,6 +4,80 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 14.24.0 — the bridge tier also writes the placed bridges' hosts into the project sandbox, so where the host honours the settings sandbox keys a review the harness keeps sandboxed is not refused them (AD-172)
+
+**`velocity-profile --bridge-tier` now merges the declared hosts of every placed bridge (each bundled manifest's
+`networkHosts`) into the project `.claude/settings.json` `sandbox.network.allowedDomains`.** Before, the tier wrote
+only its allow rules (the review wrappers' code mode and, with agy-review placed, the grounding pre-step) and the
+wrappers' `sandbox.excludedCommands` entries, and a harness that kept a wrapper
+sandboxed anyway (Claude Code 2.1.291, observed 2026-10-06) refused its hosts until the user added them by hand.
+
+- **What the consent covers.** Where the host honours the settings sandbox keys, every sandboxed command of the
+  project can then reach those hosts, not only the wrappers. The printed tier notice, `--help`, the velocity and
+  recommendations mode docs and a new `bridge-tier` posture note say so; the `--autonomy` preview keeps reporting the
+  hosts as a network weakening. `sandbox.filesystem.allowWrite` stays unseeded: the bridges' writable state dirs stay
+  hand-apply.
+- **Same writer rules as the other surfaces.** Dry-run by default; foreign hosts and other `sandbox.network` keys
+  kept; a host already present left where it is; a second `--apply` changes no byte. The dry-run prints
+  `would add sandbox.network.allowedDomains entries: N`, the hosts and `already present (allowedDomains): M`.
+- **Stops with nothing written.** A non-object `sandbox.network` or a non-array `allowedDomains` in the project file
+  ends a `--bridge-tier` run as `VELOCITY_MALFORMED` naming the key; an unreadable or unparsable bundled manifest ends
+  it naming the manifest. The flagless, `--kit-tools` and `--autonomy` runs read those keys as before.
+- **The advisor offers the re-run.** The Recommendations `bridge-tier` item now also counts missing declared hosts,
+  so a project that ran the tier before this release is offered the one re-run at its next upgrade:
+  `bridge-wrappers tier incomplete — {n} entr(ies) missing (allow rules, sandbox exclusions or declared hosts of placed bridges)`.
+- **One reader.** The manifest reader moved unchanged into `tools/bridge-sandbox-recipe.mjs`; the tier and the
+  sandbox-lane recipe both read it. The tarball holds 359 files.
+
+## 14.23.0 — a delegated codex or agy run uses Jev as your own run does; ships codex-cli-bridge 5.0.0 and antigravity-cli-bridge 7.0.0 (AD-171)
+
+**Every bridge wrapper now passes `TYPESAFE_API_KEY` to the run, and on Linux with codex-cli 0.160.0 or newer a
+`codex-exec` or `codex-review` run reaches `api.typesafe.ai` and `docs.typesafe.ai` and no other host.** The other
+`*_API_KEY` values and `OPENAI_BASE_URL` stay unset. Where the codex permissions profile is not proven, the run keeps
+the earlier flags with network off and its banner says why. An agy run gets the key and nothing more: no flag, no
+setting.
+
+- **One key rule in every wrapper.** The shared block of `codex-exec.sh`, `codex-review.sh`, `agy.sh` and
+  `agy-review.sh` gains `aw_scrub_billing_keys`, called before the first CLI spawn (login status, version, catalog,
+  run). `test/settings-reader-parity.test.mjs` finds the wrappers from the bridge manifests and
+  `test/jev-every-run.test.mjs` proves that discovery on fixture trees, so a wrapper added later is held to the same
+  block without a test edit.
+- **codex: the permissions profile `jev`.** On Linux (WSL2 included) with codex-cli 0.160.0 or newer, fresh runs,
+  resumes and reviews carry the profile: network to the two Jev hosts only; `codex-exec` writes the repository, `/tmp`
+  and `$TMPDIR`; `codex-review` writes nothing. Not Linux, an older or unreadable codex version, an exec repository
+  or its git common dir under `/tmp` or `$TMPDIR`, or a version and profile recorded as refused: the run takes the
+  earlier flags with network off.
+- **The banner says what the run reaches.** Both codex banners gain `jev=api.typesafe.ai,docs.typesafe.ai` or
+  `jev=unreachable (<reason>)` before `source=`; the exec banner's sandbox field reads `sandbox=jev-profile` or
+  `sandbox=workspace-write`. Receipt schemas are unchanged.
+- **A refused profile stops loudly.** When codex rejects the profile before its first turn, or bwrap fails inside a
+  failed command, the run exits 72 with no success receipt. A rejected profile key records the codex version and
+  profile digest in `${XDG_STATE_HOME:-~/.local/state}/agent-workflow/codex-jev-profile-refused` when that file can
+  be written (otherwise one warning names it), and that wrapper's next run on that pair takes the earlier flags
+  before any spend; a `bwrap: execvp` failure records nothing.
+- **`codex-review` sees the skill.** Its fence home links `.agents/skills` to your real Codex skill root when it
+  exists; the review directives allow reading it and name the two hosts on a profile run only.
+- **Probe passthrough under the profile.** With `CODEX_PROBE=1`, `--add-dir`, `-C`, `--cd`, `--enable` and `--disable`
+  are refused before any spend (exit 2) while the profile is on; under the fallback they stay admitted.
+- **agy.** With the key set, `agy-run` prints one line before dispatch: `jev: TYPESAFE_API_KEY passed; a headless agy
+  runs the Jev request only where your agy permissions allow commands — the first denied command ends the run`.
+  `agy-review` makes no Jev request while its model obeys its prompts, which forbid every tool (an advisory
+  prohibition, not a sandbox).
+- **Manifests.** Both bridges' `networkHosts` gain `api.typesafe.ai` and `docs.typesafe.ai`, so the sandbox
+  Recommendations item shows once more on a project that acknowledged it. Guardrails and banner notes are rewritten,
+  and `tools/detect-backends.mjs`'s role-contract copy follows them.
+- **The sandbox notes no longer promise the tier routes wrappers outside.** On 2026-10-06 Claude Code 2.1.291 ran
+  an agent's plain `codex-review` inside its sandbox although the project excluded it; a sandboxed run's Jev request
+  gets `Tunnel connection failed: 403` from the harness proxy (observed 2026-10-05). `references/modes/recommendations.md`
+  now says the tier routes the wrappers outside only where the harness honours that entry, names the refusal, and
+  points to the hand-apply `allowedDomains` shape with the recipe's hosts, which the kit never writes for you;
+  `references/modes/velocity.md` and the manifest schema's `networkHosts` note say the same.
+- **Stated residuals.** Both bridge `SKILL.md` paragraphs say the key sits in every run's environment; the codex one
+  names codex's server-side `web_search`, which reaches pages outside the profile, the agy one a `web_search` or
+  fetch tool agy is permitted to run. A codex release that stops recognizing a profile key
+  costs one run per version and profile digest before the recorded fallback takes over.
+- The tarball pin rises 355 → 358 (the mirrored bridge suites `codex-exec-jev`, `codex-review-jev`, `agy-jev`).
+
 ## 14.22.0 — a story runs in four sessions, each step with one checked result; the advisor renders the new review loop (AD-170)
 
 **Your project's rules now state the story flow the engine's canon (5.12.0) defines: four sessions — spec and plan,

package/README.md

@@ -246,7 +246,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit core-evidence` | any time | **the ONE loop-evidence writer** (strip-the-kit) — every core evidence record lands in a single append-only JSONL store inside the git dir (never committable; versioned schema, latest-per-key supersession, byte-identical duplicates refused, malformed lines fail every reader closed). `red-proof "<file>#<pattern>"` declares an observed-red **BEFORE a bugfix** (N/N red runs + content custody + base + the pre-fix fingerprint; green/mixed/timeout are DISTINGUISHED refusals — nothing written); `degrade --backend --reason` is the ONLY escape for an unavailable review backend (per-tree, never all backends); `summary` renders the whole loop state statelessly (gate result · per-backend verdicts · red-proofs · degrades) — no ledger, no rounds, nothing remembered. Honest residual: records are forgeable — self-discipline, not a security boundary. Never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit coverage-check` | any time | **the final-run checker** (D3(c)+(d)) — **certifies coverage ONLY inside the `--final` run that owns the lcov** (ownership is exclusive by CONVENTION over the fixed path, not enforced — a concurrent writer to it is a stated residual, queued as LCOV-EXCLUSIVE-OWNERSHIP): an artifact on disk proves nothing about the tree it came from, so a standalone run prints its findings and states `attested=no` / `NO VERDICT` rather than a PASS (an lcov that predates an edit would otherwise certify a line the suite never executed). `attested=` claims a verdict was ISSUED, pass or fail — a run over uncovered lines still reads `attested=yes` and still exits 1, and a run whose coverage arm never executed (no lcov) reads `attested=no` even inside `--final`, because nothing was read and nothing is certified. The runner passes a nonce whose one-way commitment over `{nonce, fingerprint, base}` is the `final-start.attempt` it recorded; a context describing another tree, or matching no recorded attempt, is a REFUSAL, never a verdict. Findings are unchanged — reads the lcov the declared `unit-tests` gate produced at the FIXED git-dir path and fails on any uncovered CHANGED executable Node line (listed `file:line`; a changed file absent from the map is a file-level red; out-of-domain/unsupported files are LISTED — the claim narrowed honestly); VERIFIES every current-base red-proof declaration (bound test exists · custody hash unchanged · green N/N now · pre-fix fingerprint differs); prints `lcov-sha256=<hex|none>` of the exact bytes it consumed — the sha the `--final` receipt binds and re-hashes. An absent lcov is a LOUD `skipped-no-lcov`; a symlinked path is a refusal. `--check` is the gate exit code — declare it as the LAST gate (`run-gates --final` refuses otherwise). Read-only. |
 | `/agent-workflow-kit commit-guard` | any time | **the read-only pre-commit guard** (D10) — makes the commit capture the whole current working tree, so «verified» and «about to be committed» are the same bytes (the receipt itself has a stated residual — see the mode doc). FIRST it refuses an **INDEX that lags the verified working tree** (the gates and the fingerprint describe the WORKING tree while `git commit` takes the INDEX alone, and the fingerprint cannot tell them apart — so a lagging index used to ship a strict subset of what was verified): unstaged tracked paths or reviewable untracked-not-ignored paths, named up to a bounded cap with the remainder stated, a dirty tracked **submodule** named separately with its own recovery, and fail-closed on an undecidable probe. This deliberately blocks a partial commit. Then it binds the LATEST completed `run-gates --final` receipt to the EXACT current tree: refuses on a missing/red/stale receipt, fingerprint drift under the run, a dangling later attempt, declaration content drift, evidence-hash or lcov drift, or unsatisfied review obligations (the same review-state decision, recomputed over a sanitized env — forged out-of-repo stores never satisfy). Re-runs NO gate or test. Wire it into `.git/hooks/pre-commit` (the installer writes the RESOLVED invocation). `git commit --no-verify` stays the stated residual. |
-| `/agent-workflow-kit recommendations` | any time (every `upgrade` ends with it) | **read-only deployment advisor** (AD-044) — computes what in THIS deployment is configured sub-optimally (allowlist not seeded, autonomy render drifted, OS sandbox unavailable, gates undeclared, bridge friction, sandbox-mask clutter, an unacknowledged sandbox recipe, a feature-spec layer never adopted) and renders **verdict-first**: one composed verdict line (does anything need attention?), then each item as **{severity · what · one-line benefit · an optional `recipe:` line (the sandbox-lane live recipe, the worktrees-dir hand-apply-first grant advice, the agents hidden-mode reconcile follow-up, the spec-adoption decline preview, or another offer's decline preview) · the exact consent-gated apply one-liner}**. The agent PRESENTS the section in the user's conversational language — every fact and count, nothing added or dropped; commands, paths, hosts and rule strings byte-exact; raw tool block on request — and runs EXACTLY the rendered one-liners only on your yes, surfacing each item's posture note first. Renders **present-even-when-empty** (`no recommendations — flow optimal.`); a failed probe degrades to a stated skip line. Registry strings are fact-true frozen one-line data (posture/risk notes live in the mode doc at the consent moment); the kit never seeds `sandbox.network.allowedDomains` / `filesystem.allowWrite` (**HAND-APPLY** territory), and the sandbox-lane item's convergence is a neutral fingerprint acknowledgement recorded by a consent-gated ack writer into `docs/ai/acks.json` — never a security key (the recipe is documented per bridge in `capability.json` `networkHosts` + `writableDirs`). `--cwd` is required (the target project is explicit); never writes, never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit recommendations` | any time (every `upgrade` ends with it) | **read-only deployment advisor** (AD-044) — computes what in THIS deployment is configured sub-optimally (allowlist not seeded, autonomy render drifted, OS sandbox unavailable, gates undeclared, bridge friction, sandbox-mask clutter, an unacknowledged sandbox recipe, a feature-spec layer never adopted) and renders **verdict-first**: one composed verdict line (does anything need attention?), then each item as **{severity · what · one-line benefit · an optional `recipe:` line (the sandbox-lane live recipe, the worktrees-dir hand-apply-first grant advice, the agents hidden-mode reconcile follow-up, the spec-adoption decline preview, or another offer's decline preview) · the exact consent-gated apply one-liner}**. The agent PRESENTS the section in the user's conversational language — every fact and count, nothing added or dropped; commands, paths, hosts and rule strings byte-exact; raw tool block on request — and runs EXACTLY the rendered one-liners only on your yes, surfacing each item's posture note first. Renders **present-even-when-empty** (`no recommendations — flow optimal.`); a failed probe degrades to a stated skip line. Registry strings are fact-true frozen one-line data (posture/risk notes live in the mode doc at the consent moment); `velocity --bridge-tier` seeds the placed bridges' declared hosts into `sandbox.network.allowedDomains`, `filesystem.allowWrite` stays **HAND-APPLY** territory, and the sandbox-lane item's convergence is a neutral fingerprint acknowledgement recorded by a consent-gated ack writer into `docs/ai/acks.json` — never a security key (the recipe is documented per bridge in `capability.json` `networkHosts` + `writableDirs`). `--cwd` is required (the target project is explicit); never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit doc-parity` | any time | **read-only doc-parity lint** (AD-049) — kills the doc-drift class where a mode-contract doc silently lags a code constant (a `--check` doc still reading `300` after the diff cap moved to `400`): a **closed, exported registry** binds each live constant (review caps, schema versions, the ledger's own class/scope vocabulary, and the autonomy-doctor EXIT/status/trusted-dir contract) to the exact token its `references/modes/*.md` contract must carry, and asserts the CURRENT value renders into every bound file — a drifted doc, an unreadable file, or an absent token **fails closed**. The values are sourced from the live imports (never re-typed), so the lint can't itself go stale; adding a binding is adding a checked entry (closed-world, edit-safe). `--check` is the gate exit code a kit maintainer runs: the lint checks the kit's own package. Never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit dispatch` | any time | **the delegation engine** — makes "how much does delegating a sub-task actually buy?" a measured number instead of a feeling. `check <file>` validates a sub-task brief's contract block and exits 0/1 naming the first violated field — **form only**: whether the task is genuinely bounded, its design decided and its acceptance adequate stays your judgment, and a well-formed absurdity passes here by construction. `advise --step-class <c>` answers the question that comes BEFORE that one — which vehicle should carry this kind of sub-task, whether it is even present on this machine, and what the ledger has already recorded for threads of that class (finished, failed, closed without a fold, and still open — counted separately) — and it decides nothing: it refuses no dispatch, gates no verb, and a choice that diverges from the advice is noted rather than blocked. It reads the filesystem only: nothing is launched to find out what is installed, an absent ledger prints "no recorded history", an unreadable one prints the store's own words, and either way the advice still prints. The same block appears as a footer under a form-valid `check` — never under a refusal, so it can never hide one. `register` pre-registers an acceptance wave (step classes, pairing key, minimum observations per class, the mean and first-pass thresholds) so the bar can never be chosen after the results it judges — immutable per wave. `observe` records ONE hand-written observation (`solo-construction`, the baseline whose ratio is 1 by construction — except over a scope measuring zero bytes, which has no ratio at all and is recorded ineligible by name — or `self-reported`) — delegated numbers are never hand-written, they are derived. The writer verbs are where that derivation happens: `open` puts a delegated thread on the record with every mint-time field copied from the brief's own header, refusing a deadline the wrapper's cap plus its kill grace would not fit inside, and recording whether the tree it started from was clean against the thread's base — HEAD by default, or the tree `--checkpoint <oid>` names, so the second task of a story is measured over the first one's uncommitted work instead of opening dirty (a dirty one makes the result honestly unmeasurable rather than quietly counted), while `--task <brief>` also records which task brief the thread carries out and the files that brief lists, refusing, since the last commit, a task thread whose files overlap by path prefix those of an open task thread or of a folded thread of another brief (`files-overlap`), and a mix of the two kinds — an untasked open beside an open task thread or, for a `code` open of backend `codex`, after a task fold, and a task open beside an open untasked thread (`mixed-open`), refusing at open a Files path the snapshot scope can never hold (`task-files-scope`), and measuring a task thread over its files alone, so `return` and `fold` refuse a changed path that no open or folded task thread on the same base claims (`out-of-files`); `await` waits for that one dispatch to answer and writes nothing — only the finished receipt satisfies it, a run still holding the nonce means keep waiting, and a wait that runs out says so with its own exit code, names whether the deadline or your own timeout ended it, and authorizes nothing: a wait that ended without an answer is a question for you, never permission to dispatch again; `return` absorbs the receipt the wrapper minted — only a finished one, checked against the contract it actually ran, its deadline and its own report, and refused outright when the tree hides changes from git or moves while the return is being computed — and derives the bytes from git rather than from anyone's claim; `fold` is the acceptance, and it refuses if the tree moved since the return — precisely, it re-confirms **equality of the visible canonical payload**, which is a change detector rather than a cryptographic identity of the tree: under the default head base that payload's untracked section is unframed and carries no file mode, so a content or symlink target that imitates the marker opening the next entry can alias two trees, and making an untracked file executable moves nothing (both named as residuals in the mode doc, with the fix queued); under a checkpoint base it is one indexed diff that carries modes. A change set carrying a binary, a non-regular path, a submodule, or a symlink whose target is not valid UTF-8 is **refused** at `return` and `fold` — CONSERVATIVELY, rather than promise what the default head payload may not be able to follow — and the same refusals hold for a checkpoint thread. `degrade` closes a thread that never earned a fold, on the record and with its reason. `aggregate` prints one wave: the registered thresholds, every observation as context, and per step class the finished threads — a folded success with git-provable bytes contributes its ratio, one whose bytes are unprovable is excluded from the mean but still counts in the first-pass rate, and a failed thread, a degrade-closed one, or one folded after failing acceptance each count as a real zero. Below the registered minimum nothing is computed (insufficient); at or above it is computed and labeled PILOT evidence. It REFUSES rather than guessing: no pre-registration, an unfinished thread in scope, a recorded refusal-to-delegate that never opened a thread, or an ambiguous wave each stop the computation by name. `handoff-return --slug <s>` closes the worktree loop after `land --prepare`: it re-attests that main still holds exactly the prepared tree under the same HEAD (both recorded in the handoff at prepare time), prints the satellite handoff's user-owned content byte for byte with its boundaries, byte lengths and the main-owned destinations each part folds into, prints the handoff digest and both OIDs as its proof, states the after-the-fold order (a fold landed after the gates leaves them stale), and records ONE self-reported worktree-stream observation only when the whole prepared change set is measurable — a deletion, a rename, a symlink, a submodule or a mode-only change ends with a named NOT RECORDED instead, never a partial number. Appends only to its own ledger inside the git dir (never committable); it also writes `handoff-return`'s `write-tree` tree object and, for a checkpoint measurement, the leaf's OWN temporary index file and the blobs its forced adds store — never a ref, never the real index; never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit worktrees` | any time | **parallel feature worktrees** — run several features in DIFFERENT agent sessions on one repo, zero interference on working-tree files (the ONE exception is the dependency cache, below): `provision <slug> --plan <file>` creates a sibling git worktree on branch `aw/<slug>` and populates it (registry-derived footprint copy-if-missing — a tracked file is never overwritten; EXACTLY ONE seeded feature plan; the `handoff-<slug>.md` record from minute zero; `node_modules` symlinked where the link stays ignored — a shared MUTABLE dependency cache: writes through it hit MAIN's node_modules; for isolation run the printed isolated-install command (`--install` only PRINTS it; on `--resume` run the printed unlink-first recovery first — printed only for a link whose RAW TARGET is MAIN's `node_modules`, since a foreign or unreadable link is reported as such with no removal advised); absolute root-pinned gate commands rebased on untracked copies only, and only while their bytes equal the MAIN source or its rebased form — user-modified copies stay untouched); `list` is read-only (slug, branch, base, dirty, handoff); `prompt <slug>` is read-only too and re-prints the satellite's cold-start prompt — the same text `provision` ends its report with: where the worktree is, its ONE seeded plan, the handoff as the one channel back, MAIN's orientation (shared series index, landing) and, under its own heading because it is probed on the satellite, that checkout's install posture — every value derived LIVE rather than replayed from the frozen provision record, a recorded value that no longer matches NAMED as a divergence (with the cause its source makes likely) instead of printed as the runnable one, every offered command marked with WHO runs it (`MAIN $ …` for the landing, `HERE $ …` for this checkout's own install, a posture with nothing to run staying prose), and a control character in any rendered value a typed STOP rather than a forged prompt line; `land <slug> --prepare` locks the common git dir, fail-closes on divergence or incomplete satellite state, transfers the complete accepted satellite diff onto a CLEAN main, runs sync plus the declared gates, and reports HEAD/TRANSFER/PREPARED OIDs — the commit ALWAYS stays a dialogue ask; `cleanup <slug>` takes the same lock and removes a LANDED worktree only after live landed-verification against main HEAD, while `--abandon` is the ONE destructive arm (destroys unlanded work; **no preview step** on any writer). The parent dir is the `docs/ai/worktrees.json` `parentDir` setting (default: the repo's sibling parent); an unwritable parent degrades to printed maintainer-pasted commands, and the one-time host consent that makes it promptless surfaces via `recommendations`. Never commits, never pushes, never runs a subscription CLI. |

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow". New to the epic, story and task tier? Run `/agent-workflow-kit tier`. A typed decision with a confidence from Jev? Run `/agent-workflow-kit jev`.
 disable-model-invocation: true
 metadata:
-  version: '14.22.0'
+  version: '14.24.0'
 ---
 
 # agent-workflow-kit

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its headless behaviour.
 metadata:
-  version: '6.0.0'
+  version: '7.0.0'
 ---
 
 # antigravity-cli-bridge
@@ -43,9 +43,10 @@ wrapper [`bin/agy.sh`](bin/agy.sh) on `PATH` as `agy-run`.
 ```
 
 Never read, print, copy, commit, or package that token — it is personal and is **never bundled** with
-this skill. The wrapper [`bin/agy.sh`](bin/agy.sh) **unsets every `*_API_KEY`** (`ANTIGRAVITY_API_KEY`,
-`GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_GENAI_API_KEY`) before invoking `agy`, so a stray key can
-never silently switch you to pay-as-you-go billing.
+this skill. The wrapper [`bin/agy.sh`](bin/agy.sh) **unsets `OPENAI_BASE_URL` and every `*_API_KEY` except
+`TYPESAFE_API_KEY`** (`ANTIGRAVITY_API_KEY`, `GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_GENAI_API_KEY`
+included; `TYPESAFE_API_KEY` passes as given) before invoking `agy`, so a stray key can never silently
+switch you to pay-as-you-go billing.
 
 **Caveat:** the subscription has a finite quota. Keep probes short (see *How the main agent drives
 agy*); the model every review and kept run uses is the host posture below, never a per-call pick.
@@ -223,11 +224,15 @@ AGY_MODEL="<an offered display string>" agy-run \
 ```
 
 **The Jev skill in a delegated run.** A headless `agy-run` loads the vendor's Jev skill from the user root the kit's
-`jev-skill` command fills, `~/.gemini/config/skills` — measured 2026-10-02 on agy 1.2.14: a probe skill under that
-root was listed, and none under `~/.gemini/antigravity-cli/skills`. The run never inherits `TYPESAFE_API_KEY`: the
-wrapper unsets every `*_API_KEY` before agy starts. Jev requests are the orchestrator's own, made in the user's
-environment, and their answers are passed into a brief as text; whether a headless agy command reaches a network
-host is governed by the user's agy permissions and sandbox settings, not by the bridge.
+`jev-skill` command fills, `~/.gemini/config/skills` (measured 2026-10-02 on agy 1.2.14: a probe skill under that
+root was listed, none under `~/.gemini/antigravity-cli/skills`), and `TYPESAFE_API_KEY` passes the wrappers as given
+while every other `*_API_KEY` is unset; nothing in agy's permissions is widened, no flag is added and no setting is
+written. With the key set, `agy-run` prints one line before dispatch: a headless agy runs the Jev request only where
+the user's agy permissions allow commands, and the first denied command ends the run. `agy-review` makes no Jev
+request while its model obeys its prompts, which forbid every tool; that prohibition is advisory, not a sandbox. The documented opt-in `-- --dangerously-skip-permissions`
+stays admitted, and such a run carries the key into an agy whose network and file tool are unconfined. Two residuals
+stand: the key now sits in every run's environment, and a `web_search` or fetch tool agy is permitted to run may reach
+hosts the bridge never names.
 
 ## How the main agent drives `agy` efficiently
 
@@ -250,7 +255,8 @@ checklist, prompt templates, output handling). Essentials:
   writes (branch/add/commit/stash/reset/rewrite) with the orchestrator, and tell `agy` in the prompt
   to return findings only. Add `-- --sandbox` when delegating anything that could trigger
   terminal/tool work; opt into `-- --add-dir . --dangerously-skip-permissions` only for a flow that
-  genuinely needs writes, then review the diff afterwards.
+  genuinely needs writes, then review the diff afterwards (such a run also carries `TYPESAFE_API_KEY`,
+  when set, into an agy whose network and file tool are unconfined).
 
 ## Complementary skills (optional, standalone-first)
 

package/bridges/antigravity-cli-bridge/bin/agy-jev.test.mjs

@@ -0,0 +1,105 @@
+// agy-jev.test.mjs — spec jev-every-run, the agy group (D5(a)): agy-run and agy-review pass TYPESAFE_API_KEY by the
+// shared key rule and widen nothing; agy-run prints its one limit line, never as agy-review's child; the documented
+// opt-in stays admitted. A recording stub stands in front of the harness fake agy.
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { makeSandbox, farmFor, FAKE_AGY } from './agy-review-harness.test.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REVIEW = join(HERE, 'agy-review.sh');
+const AGY_RUN = join(HERE, 'agy.sh');
+const LIMIT = `jev: TYPESAFE_API_KEY passed; a headless agy runs the Jev request only where your agy permissions allow commands ${String.fromCharCode(0x2014)} the first denied command ends the run`;
+const KEYS = { TYPESAFE_API_KEY: 'jev-key', ANTIGRAVITY_API_KEY: 'a', GEMINI_API_KEY: 'g', GOOGLE_API_KEY: 'o', GOOGLE_GENAI_API_KEY: 'n', FOO_API_KEY: 'foo' };
+const PASSED = 'key=[jev-key] google=unset,unset,unset,unset foo=unset';
+
+// Every spawn of agy appends its kind and the key states; a run also says so on stderr before the fake answers.
+const RECORDER = [
+  '#!/usr/bin/env bash',
+  'st() { if [[ -n "${!1+x}" ]]; then printf "[%s]" "${!1}"; else printf unset; fi; }',
+  'case "${1:-}" in --help|-h) kind=help ;; --version) kind=version ;; models) kind=models ;; *) kind=run; echo STUB-DISPATCH >&2 ;; esac',
+  'echo "$kind key=$(st TYPESAFE_API_KEY) google=$(st ANTIGRAVITY_API_KEY),$(st GEMINI_API_KEY),$(st GOOGLE_API_KEY),$(st GOOGLE_GENAI_API_KEY) foo=$(st FOO_API_KEY) child=$(st AW_AGY_REVIEW_CHILD)" >>"$AGY_JEV_LOG"',
+  'exec "$AGY_JEV_FAKE" "$@"',
+  '',
+].join('\n');
+
+const made = [];
+after(() => {
+  for (const home of made) rmSync(home, { recursive: true, force: true });
+});
+const sandbox = () => {
+  const sb = makeSandbox();
+  made.push(sb.home);
+  writeFileSync(join(sb.home, 'agy-fake'), FAKE_AGY, { mode: 0o755 });
+  writeFileSync(join(sb.bin, 'agy'), RECORDER, { mode: 0o755 });
+  writeFileSync(join(sb.repo, 'plan.md'), '# a plan under review\n');
+  return sb;
+};
+const drive = (sb, wrapper, args, env = {}) => {
+  const cap = (name) => join(sb.home, name);
+  for (const name of ['jev-log', 'jev-argv']) rmSync(cap(name), { force: true });
+  const r = spawnSync('bash', [wrapper, ...args], {
+    cwd: sb.repo, input: '', encoding: 'utf8', timeout: 60000,
+    env: { HOME: sb.home, PATH: `${sb.bin}:${farmFor(['agy', 'agy-run'])}`, TMPDIR: process.env.TMPDIR ?? '/tmp',
+      AGY_JEV_LOG: cap('jev-log'), AGY_JEV_FAKE: cap('agy-fake'), AGY_FAKE_ARGV: cap('jev-argv'), ...env },
+  });
+  const read = (name) => (existsSync(cap(name)) ? readFileSync(cap(name), 'utf8') : '');
+  const spawns = read('jev-log').split('\n').filter(Boolean).map((line) => [line.slice(0, line.indexOf(' ')), line.slice(line.indexOf(' ') + 1)]);
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, spawns, argv: read('jev-argv').split('\n').slice(0, -1) };
+};
+const runDirect = (sb, env, extra = []) => drive(sb, AGY_RUN, ['a probe prompt', ...extra], env);
+const keysOf = (env) => env.split(' child=')[0];
+const runSpawn = (r) => (r.spawns.find(([kind]) => kind === 'run') ?? [])[1] ?? '';
+const limitLines = (r) => r.stderr.split('\n').filter((line) => line.startsWith('jev:'));
+
+describe('agy-run and agy-review pass the key and unset the rest — spec:jev-every-run/S4', () => {
+  for (const [label, wrapper, args] of [['agy-run', AGY_RUN, ['a probe prompt']], ['agy-review plan', REVIEW, ['plan', 'plan.md']]]) {
+    it(`${label}: every spawn of agy sees TYPESAFE_API_KEY with the four Google keys and FOO_API_KEY unset`, () => {
+      const r = drive(sandbox(), wrapper, args, KEYS);
+      assert.equal(r.status, 0, r.stderr);
+      assert.ok(r.spawns.some(([kind]) => kind === 'run'), 'agy ran');
+      for (const [kind, env] of r.spawns) assert.equal(keysOf(env), PASSED, `${kind} spawn`);
+    });
+  }
+});
+
+describe('the agy half of S5: an empty key and an unset key on agy-run', () => {
+  it('an empty TYPESAFE_API_KEY reaches agy empty, an unset one stays unset, and the argv is the same with the key set', () => {
+    const runs = ['jev-key', '', undefined].map((value) => runDirect(sandbox(), { TYPESAFE_API_KEY: value }));
+    assert.deepEqual(runs.map((r) => keysOf(runSpawn(r)).split(' ')[0]), ['key=[jev-key]', 'key=[]', 'key=unset']);
+    assert.deepEqual([runs[1].argv, runs[2].argv], [runs[0].argv, runs[0].argv]);
+  });
+});
+
+describe('agy-run prints its one limit line — spec:jev-every-run/S20', () => {
+  it('a non-empty key: exactly the one limit line, before dispatch; an empty or an unset key: none', () => {
+    const r = runDirect(sandbox(), { TYPESAFE_API_KEY: 'jev-key' });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(limitLines(r), [LIMIT]);
+    const lines = r.stderr.split('\n');
+    assert.ok(lines.indexOf(LIMIT) < lines.indexOf('STUB-DISPATCH'), r.stderr);
+    for (const value of ['', undefined]) {
+      const quiet = runDirect(sandbox(), { TYPESAFE_API_KEY: value });
+      assert.equal(quiet.status, 0, quiet.stderr);
+      assert.deepEqual(limitLines(quiet), [], JSON.stringify(value));
+    }
+  });
+  it('as agy-review\'s child: agy-run runs marked AW_AGY_REVIEW_CHILD=1 with the key, and no limit line is printed', () => {
+    const r = drive(sandbox(), REVIEW, ['plan', 'plan.md'], { TYPESAFE_API_KEY: 'jev-key' });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(runSpawn(r), `${PASSED} child=[1]`);
+    assert.deepEqual(limitLines(r), []);
+  });
+});
+
+describe('the documented opt-in stays admitted — spec:jev-every-run/S21', () => {
+  it('agy-run -- --dangerously-skip-permissions reaches agy\'s argv, the key beside it', () => {
+    const r = runDirect(sandbox(), { TYPESAFE_API_KEY: 'jev-key' }, ['--', '--dangerously-skip-permissions']);
+    assert.equal(r.status, 0, r.stderr);
+    assert.ok(r.argv.includes('--dangerously-skip-permissions'), r.argv.join(' '));
+    assert.equal(keysOf(runSpawn(r)), PASSED);
+  });
+});

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -372,11 +372,24 @@ aw_resolve_timeout_bin() {
   [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
   printf '%s' "$bin"
 }
+aw_scrub_billing_keys() {
+  # The one key rule (spec jev-every-run): OPENAI_BASE_URL and every *_API_KEY are unset, so a stray key can never
+  # switch a run to paid billing; TYPESAFE_API_KEY is neither read nor set, so it reaches the CLI exactly as given.
+  local name
+  unset OPENAI_BASE_URL 2>/dev/null || true
+  for name in $(compgen -v); do
+    case "$name" in
+      TYPESAFE_API_KEY) ;;
+      *_API_KEY) unset "$name" 2>/dev/null || true ;;
+    esac
+  done
+  return 0
+}
 
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="6.0.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="7.0.0"  # aw-version-anchor
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE any interpolation can echo raw
 # newline/ESC bytes into stderr/the terminal (round-2 fold).
 if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
@@ -563,12 +576,9 @@ read_agy_envelope() {  # $1 = captured payload, $2 = response destination, $3 =
   node "$AGY_ENVELOPE_READER" "${args[@]}"
 }
 
-# --- Subscription invariant (reuse agy.sh's security pattern verbatim) --------
+# --- Subscription invariant: the shared key rule, before the first spawn of agy --------
 export PATH="$HOME/.local/bin:$PATH"
-unset ANTIGRAVITY_API_KEY GEMINI_API_KEY GOOGLE_API_KEY GOOGLE_GENAI_API_KEY 2>/dev/null || true
-while IFS= read -r _api_key_var; do
-  unset "$_api_key_var" 2>/dev/null || true
-done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
+aw_scrub_billing_keys
 
 if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. See this skill's setup/README.md." >&2
@@ -763,6 +773,10 @@ aw_agy_catalog_check() {
   exit 2
 }
 export AW_AGY_CATALOG_READ=1
+# Every child agy-run is this review's (spec jev-every-run): its prompts forbid every tool, so a review whose model
+# obeys them sends no request to api.typesafe.ai (an advisory prohibition, not a sandbox), and the child prints no
+# TYPESAFE_API_KEY limit line.
+export AW_AGY_REVIEW_CHILD=1
 if [[ -n "$AGY_MODEL" ]]; then aw_agy_catalog_check "$aw_review_timeout_bin" "$DEFAULT_AGY_REVIEW_MODEL"; fi
 if [[ "$AGY_MODEL" != "$HOST_AGY_MODEL" && "$AGY_PROBE" != "1" ]]; then
   echo "error: $(aw_agy_shown_model) is a one-off — the host posture is '$HOST_AGY_MODEL', and only a probe (AGY_PROBE=1) runs a one-off; refusing before any run is spent." >&2

package/bridges/antigravity-cli-bridge/bin/agy.sh

@@ -8,9 +8,9 @@
 #
 # Auth: SUBSCRIPTION ONLY. We use the cached OAuth token at
 # ~/.gemini/antigravity-cli/antigravity-oauth-token (Google AI Pro) and the
-# quota that comes with it. To make that guarantee hard, the wrapper unsets any
-# API-key env var so a stray key can never silently switch us to paid
-# pay-as-you-go billing.
+# quota that comes with it. To make that guarantee hard, the wrapper unsets
+# every *_API_KEY except TYPESAFE_API_KEY (which passes as given), so a stray
+# key can never silently switch us to paid pay-as-you-go billing.
 #
 # This is a THIN, FLOW-AGNOSTIC wrapper on purpose: it just runs one headless
 # prompt and prints the text response. It does NOT encode any orchestration
@@ -65,14 +65,6 @@ esac
 # 1. Make `agy` findable even when ~/.bashrc was not sourced.
 export PATH="$HOME/.local/bin:$PATH"
 
-# 2. Force the subscription path: never let an API key hijack billing. Unset EVERY *_API_KEY for the
-#    agy subprocess — the explicit Google/Antigravity ones first, then any other *_API_KEY that may
-#    have been added later (`compgen` is a bash builtin; the shebang guarantees bash).
-unset ANTIGRAVITY_API_KEY GEMINI_API_KEY GOOGLE_API_KEY GOOGLE_GENAI_API_KEY 2>/dev/null || true
-while IFS= read -r _api_key_var; do
-  unset "$_api_key_var" 2>/dev/null || true
-done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
-
 # This wrapper's applied settings-file subset (see the shared reader block below).
 AW_SETTINGS_APPLIED="AGY_HARD_TIMEOUT"
 DEFAULT_AGY_MODEL="Gemini 3.8 Flash (High)"
@@ -262,6 +254,23 @@ aw_resolve_timeout_bin() {
   [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
   printf '%s' "$bin"
 }
+aw_scrub_billing_keys() {
+  # The one key rule (spec jev-every-run): OPENAI_BASE_URL and every *_API_KEY are unset, so a stray key can never
+  # switch a run to paid billing; TYPESAFE_API_KEY is neither read nor set, so it reaches the CLI exactly as given.
+  local name
+  unset OPENAI_BASE_URL 2>/dev/null || true
+  for name in $(compgen -v); do
+    case "$name" in
+      TYPESAFE_API_KEY) ;;
+      *_API_KEY) unset "$name" 2>/dev/null || true ;;
+    esac
+  done
+  return 0
+}
+
+# 2. Force the subscription path before the first spawn of agy: the shared key rule (the Google and
+#    Antigravity keys included) — no API key can hijack billing.
+aw_scrub_billing_keys
 
 if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. Install it and run 'agy' once to sign in." >&2
@@ -422,6 +431,12 @@ fi
 
 agy_cmd=(agy "${model_flag[@]}" --print-timeout "$AGY_TIMEOUT" "${passthrough[@]}" -p "$prompt")
 
+# A non-empty TYPESAFE_API_KEY rides into agy and nothing is widened (spec jev-every-run, D5(a)): the limit, once,
+# before dispatch — never in agy-review's child, whose prompts forbid every tool.
+if [[ -n "${TYPESAFE_API_KEY:-}" && "${AW_AGY_REVIEW_CHILD:-}" != "1" ]]; then
+  echo "jev: TYPESAFE_API_KEY passed; a headless agy runs the Jev request only where your agy permissions allow commands — the first denied command ends the run" >&2
+fi
+
 # Hard wall-clock cap via timeout(1) (GNU `timeout` on Linux, `gtimeout` from coreutils on macOS).
 # This is the real guard — a backgrounded, hung agy survives its own --print-timeout otherwise.
 # aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.8 Flash (High)" },
   "roles": {
@@ -180,7 +180,7 @@
         { "slot": "<extra agy flags...>", "required": false, "description": "raw agy flags after -- (a --model* or --effort* flag refuses pre-spend: the model is the host posture or the AGY_MODEL environment value)" }
       ],
       "guardrails": [
-        { "value": "subscription-only — every *_API_KEY env var is unset before the run", "enforcement": "enforced", "source": "bin/agy.sh" },
+        { "value": "subscription-only — every *_API_KEY env var except TYPESAFE_API_KEY is unset before the run; TYPESAFE_API_KEY passes as given and nothing in agy's permissions is widened", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "the model is the host posture (AGY_MODEL in the bridge settings file, else Gemini 3.8 Flash (High)); AGY_MODEL in the environment sets it for one run", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "hard wall-clock cap AGY_HARD_TIMEOUT (built-in default 5m)", "enforcement": "enforced", "condition": "only while timeout(1)/gtimeout is on PATH — otherwise the wrapper warns and runs uncapped", "source": "capability.json settings.AGY_HARD_TIMEOUT" },
         { "value": "the prompt rides a single argv — over AGY_MAX_PROMPT_BYTES (120000) the run refuses", "enforcement": "enforced", "source": "bin/agy.sh" },
@@ -240,7 +240,7 @@
       "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every feed-turn framing block, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
     }
   ],
-  "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com"],
+  "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com", "api.typesafe.ai", "docs.typesafe.ai"],
   "writableDirs": [{ "env": null, "default": "~/.gemini/antigravity-cli" }],
   "detect": {
     "installed": {

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -51,9 +51,10 @@ Environment:
 | `AGY_HARD_TIMEOUT` | `= AGY_TIMEOUT` | hard `timeout(1)` wall-clock cap (a duration string) |
 | `AGY_MAX_PROMPT_BYTES` | `120000` | single-argv byte ceiling. `agy` takes the prompt as ONE `-p` argv; past `MAX_ARG_STRLEN` (~131072) `execve` fails with a cryptic `Argument list too long`. The wrapper measures the resolved `-`/`@file` prompt and fails loud over the ceiling. A huge **literal** `agy-run "<huge>"` fails at the wrapper's own `exec`, so route large prompts via `-`/`@file`. |
 
-Subscription invariant: the wrapper prepends `$HOME/.local/bin` to `PATH` and clears
-`ANTIGRAVITY_API_KEY` / `GEMINI_API_KEY` / `GOOGLE_API_KEY` / `GOOGLE_GENAI_API_KEY` before execution.
-Auth comes from the user's cached OAuth token, never from bundled credentials.
+Subscription invariant: the wrapper prepends `$HOME/.local/bin` to `PATH` and clears `OPENAI_BASE_URL`
+and every `*_API_KEY` except `TYPESAFE_API_KEY` (`ANTIGRAVITY_API_KEY` / `GEMINI_API_KEY` /
+`GOOGLE_API_KEY` / `GOOGLE_GENAI_API_KEY` included) before execution; `TYPESAFE_API_KEY` passes as
+given and widens nothing. Auth comes from the user's cached OAuth token, never from bundled credentials.
 
 ## `agy-review` contract (review role)
 

package/bridges/antigravity-cli-bridge/setup/README.md

@@ -34,7 +34,8 @@ agy
 This caches an OAuth token under `~/.gemini/antigravity-cli/` (`antigravity-oauth-token`). That token
 is **personal** — never copy, commit, package, print, or share that directory or token. This skill
 needs no API keys and must not be configured with API-key billing; the wrapper unsets every
-`*_API_KEY` so billing can never silently fall back to pay-as-you-go.
+`*_API_KEY` except `TYPESAFE_API_KEY` (the one key a run passes, as given) so billing can never
+silently fall back to pay-as-you-go.
 
 ## 3. Put the wrappers on `PATH` (`agy-run` + `agy-review`)