@sabaiway/agent-workflow-kit 6.0.0 → 7.0.0

package/bridges/antigravity-cli-bridge/references/review-prompt.md

@@ -61,15 +61,31 @@ the operator can split.
   of the change set. Only BODIES concatenate, and they concatenate **byte-for-byte**: nothing the
   wrapper adds ever enters the reviewed artifact, and the receipt's fingerprint domain is untouched.
 - **Delivery is proven, never assumed.** After assembly the wrapper picks, per part, an interior line
-  the model cannot anticipate, and asks for it **by address only**. The mandated shape gains
-  `### Delivery proof` as its **FIRST** section, so output truncation cannot silently drop it:
+  the model cannot anticipate, and asks for it **by address only**. The candidate walk starts at the
+  part's HEAD, which MINIMIZES the address rather than bounding it — the model is denied every tool
+  and must count by reading, and a midpoint address it cannot count to is a false refusal on a
+  correctly delivered change set.
+  A line the ASSEMBLER emits — one of its own `=== repo file map / git status / staged diff /
+  unstaged diff / untracked … ===` banners, per-path forms included — is never a candidate (with one
+  stated exception below). The change set's OWN banner-shaped lines stay admissible: refusing the
+  shape rather than the vocabulary would discard real content and re-earn the refusal this
+  design removes.
+  Nor is a line a model could **derive** without the part it belongs to. The repo-map and status
+  blocks travel in part 1 and name every path, so those blocks and all git diff METADATA (the
+  `diff --git`, `@@`, `index`, mode, rename and copy headers) would prove nothing about a LATER part.
+  They are sliced out of the assembled change set — its own bytes, never recomputed, so a rename's
+  headers and git's quoting of an awkward name are covered without guessing what git wrote — and fed
+  to the same non-body filter. Untracked file CONTENTS are deliberately NOT in that set: nothing in
+  part 1 reveals them, so they stay the proof material this lane depends on.
+  The mandated shape gains `### Delivery proof` as its **FIRST** section, so output truncation cannot
+  silently drop it:
 
 ```text
 ### Delivery proof
 part <K> line <L>: <the text of line L of part K, VERBATIM>
 Requested addresses, one per line:
-part 1 line 743
-part 2 line 512
+part 1 line 16
+part 2 line 2
 ### Verdict
 …
 ```
@@ -105,6 +121,28 @@ itself can never reveal the very text it asks for, and the wrapper needs no seco
 - A change set whose parts carry **no unique interior line** in the 24..200-byte window (a single
   huge minified line, for instance) cannot be proven delivered, so the wrapper **refuses** rather
   than reviewing unprovably. Split the review, or exclude the blob.
+- The head-first walk **minimizes** the requested address; it does not BOUND it. A part whose head is
+  a long run of unusable lines — too short, not unique, or an assembler banner — still yields a large
+  address, and the miscount case above returns with it. No runtime maximum is enforced: refusing on
+  address size would trade a false refusal for a different false refusal.
+- The banner reject matches the assembler's **vocabulary**, so a change set carrying a line like
+  `=== untracked notes ===` of its own loses that one candidate. Harmless while any other line
+  qualifies; the walk simply continues.
+- The derivable set is computed **once for the whole change set**, not per part, and the partition
+  cuts by BYTES — so the repo-map and status blocks are not guaranteed to sit in part 1. A change set
+  with thousands of changed paths can put a whole part inside the status block, whose every line is
+  then excluded, and that part refuses for want of a candidate. The failure is **fail-closed** — a
+  named refusal telling the operator to split the review, never an unsound proof — and the repo map is
+  already budget-truncated, so only an unbounded status block reaches it. A per-part exclusion would
+  have to carry derivation provenance (which path was named where) to avoid re-opening the leak it
+  exists to close; that is queued, not smuggled in here.
+- The reject is by vocabulary, **not exact by origin**. An untracked path containing a literal
+  NEWLINE splits its own `=== untracked: <p> ===` banner across lines, and the tail fragment
+  (`<rest> ===`) does not carry the vocabulary, so it stays admissible — while a model holding
+  part 1 could rebuild it from the quoted git-status entry there. The exposure is strictly SMALLER
+  than before the reject existed (the whole banner line was admissible then) and needs a newline in
+  a filename; closing it exactly means escaping the dynamic field, which changes the assembled
+  artifact BYTES and so must move in both bridges together under the fingerprint-parity contract.
 
 ## agy's own permission ask — surfaced, never applied
 

package/bridges/codex-cli-bridge/SKILL.md

@@ -48,12 +48,25 @@ this skill. Both wrappers enforce the subscription path before invoking codex:
 
 ## Models quality-first pinned
 
-Delegated codex work ALWAYS runs on the **frontier model at maximum reasoning effort**: the wrappers
+Delegated codex work ALWAYS runs on the **PINNED model at maximum reasoning effort**: the wrappers
 **pin** `gpt-5.6-sol` / `xhigh` and **refuse** (exit 2, loud) a non-default `CODEX_MODEL` / `CODEX_EFFORT`
-— knowingly-worse output is never traded for quota. The pin is deliberate (an explicit `-m gpt-5.6-sol`
-guarantees the *strongest* model, not merely the CLI's current default); a release-time gate against
-<https://developers.openai.com/codex/models> re-checks that `gpt-5.6-sol` is still the strongest selectable
-Codex model. Economy comes only from **quality-neutral waste removal** (clean capture, a hard timeout,
+— knowingly-worse output is never traded for quota. The pin is deliberate: an explicit `-m gpt-5.6-sol`
+names one model rather than following the CLI's current default. That the pinned id is also the
+*strongest* selectable Codex model is a **separate, time-bounded claim**, checked BY HAND against
+<https://developers.openai.com/codex/models>. There is **no automated gate and this file records no
+date for that check**, so treat "strongest" as unverified until someone looks. Upstream can move
+either way between releases:
+- **retirement** is loud — the pinned id stops being served and codex fails with an error naming the
+  model. That is an upstream failure, not a wrapper refusal; the fix is a pin bump in its own reviewed
+  commit, never a `CODEX_PROBE=1` run, whose output is never delegated work.
+- **a newer, stronger model is SILENT** — nothing fails, and the pin simply stops being the best
+  available until someone re-checks the page.
+
+The guard is therefore a **pin-integrity** guard, not a quality guarantee: it enforces that runs use
+the id named here, and it refuses a *stronger* model exactly as it refuses a weaker one. Read a
+refusal as "not the pinned id", never as "a downgrade was prevented".
+
+Economy comes only from **quality-neutral waste removal** (clean capture, a hard timeout,
 a precomputed review diff, `resume` instead of re-sending context), never from a downgrade.
 
 The ONLY escape is a **throwaway probe** whose result is effort-independent (a reachability / smoke

package/bridges/codex-cli-bridge/bin/codex-await-guard.test.mjs

@@ -0,0 +1,161 @@
+// codex-await-guard.test.mjs — the source-level guard that makes this bridge's asynchronous
+// dispatch lane self-checking. Twin of the antigravity bridge's guard; a bridge dir ships WHOLE and
+// is placed on its own, so neither guard can read the other's suite and the rule lives once per
+// bundle rather than once per family.
+//
+// Why it exists. Both suites drive a bash wrapper, and every dispatch used to be a blocking
+// `spawnSync` that pinned the file to one core. The dispatches are awaited now so a describe can
+// declare concurrency — which turns a MISSING `await` into a real hazard.
+//
+// The tempting claim is that a missing `await` announces itself, because an assertion against a
+// Promise never matches a status. That claim is FALSE at the sites where the dispatch's RESULT IS
+// DISCARDED (`run(sb, {...});` as a bare statement, the capture read on the next line). Un-awaited,
+// such a test reads the fixture before the wrapper has written it and tears the sandbox down under
+// a live child. Nothing in the suites can catch that; only the source can.
+//
+// It is a separate FILE rather than a describe inside a suite because the repo's survivor-corpus
+// checker (`scripts/suite-parity.mjs`) binds each SURVIVING file's assert-call-site COUNT and
+// `--accept-rewrites` exempts only the assertion-expression hash, never the count. A guard added to
+// a suite would fail the very acceptance it exists to serve; a NEW file is counted separately.
+//
+// Dependency-free, Node >= 22. No side effects on import.
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SUITES = Object.freeze(['codex-exec.test.mjs', 'codex-review.test.mjs']);
+
+// A CALL, not a definition and not prose: the callee name, `(`, then an identifier or object start.
+// A definition reads `const run = (`, and a comment's `run()` carries no argument, so neither
+// matches. Keying on the ARGUMENT NAME instead would be a trap — the sandboxes are called `sb`,
+// `single`, `nested`, and a pattern pinned to one name silently skips the rest.
+const DISPATCH_CALL = /\b(?:run|runAsync)\(\s*[A-Za-z_${]/g;
+
+// A call site is DISCHARGED when the code immediately before it hands the promise on. Two rules,
+// and they are NOT the same rule — reading the raw prefix for either keyword is a false green in
+// the one guard that exists to prevent false greens:
+//   • `return` counts ONLY on the call's own line. ASI ends a bare `return` at the newline, so
+//     `return\n  run(...)` returns undefined and leaves the dispatch unheld.
+//   • `await` and an arrow head may sit on an earlier line, so those are read across newlines —
+//     but only after TRAILING PROSE is dropped, because a comment line ending in the word "await"
+//     or "return" looks exactly like the keyword to a suffix test.
+// The keyword must come from CODE. A line-oriented prose filter is not enough — `previous(); //
+// await` is a code line whose tail is a comment — so comment and string bodies are masked to
+// spaces in one pass first. Newlines survive the mask so the per-line `return` rule still sees
+// them. Not a parser: it tracks the states a JS prefix can be in, and every ambiguity it cannot
+// resolve leaves MORE text masked, which can only make the guard stricter.
+// Mask ONE line: a comment tail and every string body become spaces, so no keyword can come from
+// prose. Per LINE on purpose — a whole-file scan accumulates state, and one quote inside a regex
+// leaves it "in a string" for the rest of the file (measured: 29 real call sites reported as
+// un-awaited). A `'`/`"` string cannot span a newline and neither can a `//` comment, so a
+// line-scoped mask resynchronises at every newline and cannot desync at all.
+// Stated residual: a line INSIDE a multi-line template literal or block comment is read as code.
+export const maskLine = (line) => {
+  if (/^\s*\*/.test(line)) return ' '.repeat(line.length);
+  const out = [...line];
+  let quote = null;
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i];
+    if (quote === null) {
+      if (ch === '/' && line[i + 1] === '/') { for (let j = i; j < line.length; j += 1) out[j] = ' '; break; }
+      if (ch === "'" || ch === '"' || ch === '`') quote = ch;
+      continue;
+    }
+    if (ch === '\\') { out[i] = ' '; if (i + 1 < line.length) out[i + 1] = ' '; i += 1; continue; }
+    if (ch === quote) { quote = null; continue; }
+    out[i] = ' ';
+  }
+  return out.join('');
+};
+
+// Two rules, and they are NOT the same rule:
+//   • `return` counts ONLY on the call's own line — ASI ends a bare `return` at the newline, so
+//     `return\n  run(...)` returns undefined and leaves the dispatch unheld;
+//   • `await` and an arrow head may sit on an earlier line, so the walk skips blank and
+//     fully-masked lines to find the nearest line that carries code.
+// Neither keyword counts when it is part of a longer name or a member access (`x.await`).
+const RETURNED_HERE = /(?<![.$\w])return[ \t]*$/;
+const HANDED_ON = /(?:(?<![.$\w])await|=>)\s*$/;
+
+export const isDischarged = (rawPrefix) => {
+  const lines = rawPrefix.split('\n').map(maskLine);
+  if (RETURNED_HERE.test(lines[lines.length - 1])) return true;
+  let at = lines.length - 1;
+  while (at >= 0 && /^\s*$/.test(lines[at])) at -= 1;
+  return at >= 0 && HANDED_ON.test(lines[at]);
+};
+
+export const dispatchSites = (source) => {
+  const sites = [];
+  for (const match of source.matchAll(DISPATCH_CALL)) {
+    const before = source.slice(0, match.index);
+    sites.push({
+      line: before.split('\n').length,
+      call: match[0],
+      discharged: isDischarged(before),
+    });
+  }
+  return sites;
+};
+
+describe('codex bridge suites — every wrapper dispatch is awaited (concurrency guard)', () => {
+  // A guard that matches nothing passes for the wrong reason. The two suites carried 262 dispatch
+  // call sites when this guard was written; the floor sits well below that so ordinary editing does
+  // not trip it, and far above zero so a broken pattern cannot read as "all clear".
+  it('the guard really finds the suite dispatch sites (never a vacuous pass)', () => {
+    const total = SUITES.reduce((n, rel) => n + dispatchSites(readFileSync(join(HERE, rel), 'utf8')).length, 0);
+    assert.ok(total >= 200, `only ${total} dispatch call site(s) matched — the pattern stopped seeing the suites`);
+  });
+
+  it('no dispatch call site is left un-awaited', () => {
+    const loose = SUITES.flatMap((rel) => dispatchSites(readFileSync(join(HERE, rel), 'utf8'))
+      .filter((site) => !site.discharged)
+      .map((site) => `${rel}:${site.line} ${site.call}`));
+    assert.deepEqual(loose, [], 'each listed site starts a dispatch whose promise nothing holds — prefix it with await');
+  });
+
+  // The predicate must be able to REPORT a violation, or the green above proves nothing.
+  it('the predicate reports a bare dispatch and accepts a discharged one', () => {
+    assert.deepEqual(dispatchSites('  run(sb, { args: [] });\n').map((s) => s.discharged), [false]);
+    assert.deepEqual(
+      dispatchSites('  const r = await run(sb, {});\n  return runAsync(nested);\n  const f = (sb) =>\n    run(sb, {});\n').map((s) => s.discharged),
+      [true, true, true],
+    );
+    // The three shapes that LOOK discharged to a prefix test and are not. Each fixture really ends
+    // in the keyword — a fixture whose comment trails off into another word tests nothing.
+    assert.deepEqual(
+      dispatchSites('  // do not await\n  run(sb, {});\n').map((s) => s.discharged),
+      [false],
+      'a comment ending in await is prose, not a discharge',
+    );
+    assert.deepEqual(
+      dispatchSites('  // early return\n  run(sb, {});\n').map((s) => s.discharged),
+      [false],
+      'a comment ending in return is prose, not a discharge',
+    );
+    assert.deepEqual(
+      dispatchSites('  return\n  run(sb, {});\n').map((s) => s.discharged),
+      [false],
+      'ASI ends a bare return at the newline, so the next call is NOT returned',
+    );
+    assert.deepEqual(
+      dispatchSites('  previous(); // await\n  run(sb, {});\n').map((s) => s.discharged),
+      [false],
+      'a CODE line whose tail is a comment ending in await is still prose',
+    );
+    assert.deepEqual(
+      dispatchSites('  const x = thing.await\n  run(sb, {});\n').map((s) => s.discharged),
+      [false],
+      'a member access named await is not the operator',
+    );
+    assert.deepEqual(
+      dispatchSites("  const s = 'await ';\n  run(sb, {});\n").map((s) => s.discharged),
+      [false],
+      'a string whose body ends in await is not the operator',
+    );
+  });
+});

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -13,11 +13,11 @@
 #   - network access OFF: new dependencies / network installs are done by a human
 #   - approval_policy=never: there is no TTY in exec; anything needing escalation
 #     is refused and reported, then handled by hand
-#   - strongest model at maximum reasoning effort (quality-first — see below)
+#   - the PINNED model at maximum reasoning effort (quality-first — see below)
 #   - git WRITES are blocked by a physical shim (codex spawns git via execve, which
 #     bypasses shell functions) — the orchestrator owns the commit boundary.
 #
-# Quality-first (hard rule): delegated codex work ALWAYS runs on the frontier
+# Quality-first (hard rule): delegated codex work ALWAYS runs on the PINNED
 # model at maximum reasoning effort. The defaults below are pinned and the wrapper
 # REFUSES a non-default CODEX_MODEL/CODEX_EFFORT — knowingly-worse output is never
 # traded for quota. The ONLY exception is a throwaway probe whose result does not
@@ -319,7 +319,7 @@ aw_resolve_timeout_bin() {
   printf '%s' "$bin"
 }
 
-DEFAULT_CODEX_MODEL="gpt-5.6-sol"   # frontier coding model (verified locally) — pinned
+DEFAULT_CODEX_MODEL="gpt-5.6-sol"   # pinned model id (see SKILL.md: strongest-model status is hand-checked, ungated)
 DEFAULT_CODEX_EFFORT="xhigh"    # maximum reasoning effort — pinned
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
@@ -378,16 +378,16 @@ AW_BRIDGE_VERSION="3.5.0"  # aw-version-anchor
 # actually applied.
 CODEX_KILL_GRACE_S=15
 
-# --- Quality-first guard: refuse a silent model/effort downgrade ---------------
-# Real delegated runs must use the frontier model at max effort. A throwaway probe
+# --- Quality-first guard: refuse any non-pinned model/effort ---------------
+# Real delegated runs must use the pinned model at max effort. A throwaway probe
 # (effort-independent result) may opt out with CODEX_PROBE=1, announced loudly.
 if [[ "${CODEX_PROBE:-}" == "1" ]]; then
   echo "warning: CODEX_PROBE=1 — THROWAWAY PROBE MODE. Quality guards relaxed; do NOT use this run's" >&2
   echo "         output as real delegated work (model='$CODEX_MODEL' effort='$CODEX_EFFORT')." >&2
 else
   if [[ "$CODEX_MODEL" != "$DEFAULT_CODEX_MODEL" ]]; then
-    echo "error: CODEX_MODEL='$CODEX_MODEL' is not the pinned frontier model '$DEFAULT_CODEX_MODEL'." >&2
-    echo "       Delegated codex work must run on the frontier model at max effort (quality-first)." >&2
+    echo "error: CODEX_MODEL='$CODEX_MODEL' is not the pinned model '$DEFAULT_CODEX_MODEL'." >&2
+    echo "       Delegated codex work must run on the pinned model at max effort (quality-first)." >&2
     echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
     exit 2
   fi
@@ -623,7 +623,7 @@ else
   #  (1) ALWAYS rejected — they would defeat the subscription / sandbox / approval /
   #      config-isolation policy (-c/-s/--full-auto/bypass), switch the provider off
   #      the subscription (--oss/--local-provider), load alternate config (-p/--profile),
-  #      override the pinned frontier model (-m), or break the wrapper-owned clean
+  #      override the pinned model (-m), or break the wrapper-owned clean
   #      output / session capture (-o/--json/--color/--output-schema/--ephemeral).
   #      CODEX_PROBE=1 NEVER relaxes these: a probe still runs on the subscription, in
   #      the sandbox, with clean capture; its model is chosen via CODEX_MODEL, not -m.
@@ -634,7 +634,7 @@ else
       case "$_arg" in
         -c*|--config*|-s*|--sandbox*|--dangerously-bypass-approvals-and-sandbox|--dangerously-bypass-hook-trust|--full-auto|--oss|--local-provider*|-p*|--profile*|-m*|--model*|-o*|--output-last-message*|--json*|--color*|--output-schema*|--ephemeral*)
           echo "error: passthrough flag '$_arg' is not allowed — it would defeat the subscription / sandbox /" >&2
-          echo "       approval / config-isolation policy, the pinned frontier model, or the clean output/session" >&2
+          echo "       approval / config-isolation policy, the pinned model, or the clean output/session" >&2
           echo "       capture. It stays blocked even under CODEX_PROBE=1. Invoke 'codex' directly if you must." >&2
           exit 2
           ;;
@@ -1146,12 +1146,16 @@ aw_ns_is_string_content() {
 # a hostile parent environment): the trace's only non-CLI content is plain stderr, which does not
 # start with `{`, and a tool call's own output is JSON-escaped into a string and cannot inject
 # structure. Anything not matching the walk is "not evidence" — never an error, never a stop.
-# Every slice is taken by a SHORT-pattern `#*` cut plus length arithmetic. That is not a style
-# choice: `${var%%<long>*}` and a prefix removal whose PATTERN is a huge variable are both
-# quadratic in bash, and either one hangs the wrapper outright on a 200KB aggregated_output
-# (measured, not assumed — a real tool call's output reaches that size).
+# Slice costs are MEASURED, never assumed — a real tool call's aggregated_output reaches 200KB.
+# `${var%%<long>*}` and a prefix removal whose PATTERN is a huge variable both hang the wrapper
+# outright at that size. A SHORT-pattern `#*` cut is cheap only while the delimiter sits NEAR the
+# start: bash tries each prefix in turn, so the same cut costs 20.7s when the delimiter sits at
+# the far end of a 200KB value. That is exactly where `","exit_code":` sits, so that one cut
+# reads the delimiter's first-match offset from ONE linear grep pass instead (8ms, same slices).
+# The whole walk runs in byte semantics for it: grep reports BYTES and the slices index by them.
 aw_ns_item_evidence() {
-  local line="$1" d1='","aggregated_output":"' d2='","exit_code":' rest tail cmd agg code after
+  local LC_ALL=C
+  local line="$1" d1='","aggregated_output":"' d2='","exit_code":' rest tail cmd agg code after off
   case "$line" in '{'*) ;; *) return 1 ;; esac
   rest="${line#*'"type":"command_execution","command":"'}"
   if [[ "$rest" == "$line" ]]; then return 1; fi
@@ -1159,9 +1163,10 @@ aw_ns_item_evidence() {
   if [[ "$tail" == "$rest" ]]; then return 1; fi
   cmd="${rest:0:$(( ${#rest} - ${#tail} - ${#d1} ))}"
   aw_ns_is_string_content "$cmd" || return 1
-  after="${tail#*"$d2"}"
-  if [[ "$after" == "$tail" ]]; then return 1; fi
-  agg="${tail:0:$(( ${#tail} - ${#after} - ${#d2} ))}"
+  while IFS=: read -r off _; do break; done < <(grep -aboF -- "$d2" <<<"$tail")
+  if [[ -z "$off" ]]; then return 1; fi
+  agg="${tail:0:off}"
+  after="${tail:$(( off + ${#d2} ))}"
   aw_ns_is_string_content "$agg" || return 1
   code="${after%%,*}"
   if [[ "$code" =~ ^-?[0-9]+$ && "$code" != "0" ]]; then