agy-mcp-bridge 0.1.22 → 0.1.24

package/README.md

@@ -60,7 +60,7 @@ Then call `antigravity_environment` from a fresh session — that is the proof;
 
 | Field | Meaning |
 |---|---|
-| `agent` | id from `agents_list` (`antigravity`, `codex`). Omit for the highest-priority available agent; naming an unavailable agent errors rather than switching silently. |
+| `agent` | id from `agents_list` (`antigravity`, `codex`), or a profile / pool id from [Agents, profiles and pools](#agents-profiles-and-pools). Omit for the highest-priority available agent; naming an unavailable agent errors rather than switching silently. |
 | `isolation` | `none` (default — edits the workspace, globally serial) or `worktree` (branch `bridge/<task_id>` under `.bridge-state/worktrees/<task_id>`, parallel up to `max_parallel_worktrees`). Worktree tasks must declare `owns`, and the repo needs at least one commit. Uncommitted changes in the main checkout are **not** copied in. |
 | `owns` | relative paths the agent may touch. After the run the bridge diffs the worktree against this list and reports anything else in `scope.out_of_scope`. It never auto-merges, never deletes the branch, and does not run repo hooks. |
 | `autonomy` | `suggest` \| `auto` \| `full` — an instruction to the CLI agent, not a permission grant. Destructive actions stay hard-denied (see below). |
@@ -74,11 +74,23 @@ Then call `antigravity_environment` from a fresh session — that is the proof;
 | `antigravity_task_wait` | blocks up to `wait_seconds` (default cap 55 s), returns early when the task ends |
 | `antigravity_task_output` | final response, stdout/stderr, errors, `denied_actions`, truncation |
 | `antigravity_cancel_task` | kills the task's process tree; does not revert file changes |
+| `code_search` | XERJ passage/definition lookup; registered always but **refused while `xerj.enabled` is off** |
 
 `completed` means the CLI exited with a parseable result — always `review_required: true`, `acceptance_verified: false`. A 0 exit code can still be reported as `failed` after a permission denial or a timeout. While a task runs, `wait`/`status` return a short `activity` line instead of making the client read logs.
 
 Two switches control delegation itself: `agy-mcp-bridge delegation off` blocks new tasks immediately without a restart, and `BRIDGE_DELEGATION=off` pins it at startup. Tasks still refuse to be delegated by policy the skill describes (security, auth, secrets, data deletion, deploy, CI and public API changes are not delegated).
 
+## Agents, profiles and pools
+
+`agents.profiles.<id>` declares named agents that inherit an adapter and override its defaults (`env` such as `CODEX_HOME`, `model`, `executable`, `codex_sandbox`, `codex_ask_for_approval`), so one machine can run two logged-in accounts side by side. A profile id is a valid `agent` value and `agents_list` reports each one's availability and warnings. `priority` and `enabled` still order the adapters themselves.
+
+`agents.pools.<id>` groups profiles for quota handling. Delegating to a pool id picks the first healthy member. When a member stops with something that reads like an exhausted quota or rate limit, the bridge marks it cooling for `quota_cooldown_seconds` and re-runs **the same task** on the next member — each member at most once per task, after which the task fails instead of looping. The replaced attempt is kept on the record as `attempts[]` (agent, error, exit, log tails) so a reviewer can still see why the first CLI stopped, and the retry keeps holding the execution lock rather than releasing and re-taking it, so no second ordinary task slips into the gap.
+
+Two knobs are opt-in because they widen what the bridge can reach. Neither is reachable from a task, and neither stays invisible: the codex pair is reported in `agents_list` warnings, and the XERJ pair in `/api/xerj/status` plus the refusal `code_search` gives while it is off.
+
+- `codex_sandbox: "danger-full-access"` / `codex_ask_for_approval: "never"` — readable from the bridge's own config file only. No task, tool argument or MCP client can ask for them, and `--ask-for-approval` is passed where codex accepts it (before `exec`).
+- `xerj.enabled` / `xerj.auto_reference` — both default to `false`. Turning them on sends task text to another local service and can place a retrieved passage inside the prompt an agent follows, which is a decision for the machine's owner, not for a delegating client.
+
 ## Missions
 
 A mission is a plan the bridge **records and gates but never runs**: up to 12 steps in one workspace, each carrying its own `delegate` arguments and a list of `depends_on`. An MCP client writes the plan and dispatches it one step at a time; the bridge refuses to start a step whose dependencies did not all complete, so no agent is sent at a step whose inputs do not exist yet. Nothing ever starts by itself — a restart restores every plan and re-dispatches nothing.

package/config/workspaces.example.json

@@ -12,7 +12,40 @@
   "default_autonomy": "auto",
   "agents": {
     "priority": ["antigravity", "codex"],
-    "enabled": ["antigravity", "codex"]
+    "enabled": ["antigravity", "codex"],
+    "codex_sandbox": "workspace-write",
+    "codex_ask_for_approval": "on-request",
+    "profiles": {
+      "codex-work": {
+        "adapter": "codex",
+        "label": "Codex (Work Account)",
+        "env": {
+          "CODEX_HOME": "C:/Users/name/.codex-work"
+        }
+      },
+      "codex-backup": {
+        "adapter": "codex",
+        "label": "Codex (Backup Account)",
+        "env": {
+          "CODEX_HOME": "C:/Users/name/.codex-backup"
+        }
+      }
+    },
+    "pools": {
+      "codex-smart-pool": {
+        "strategy": "quota-adaptive",
+        "members": ["codex-work", "codex-backup"],
+        "hard_task_profile": "codex-work",
+        "quota_cooldown_seconds": 900
+      }
+    }
+  },
+  "xerj": {
+    "enabled": false,
+    "url": "http://127.0.0.1:9200",
+    "default_index": "mcp-bridge-docs",
+    "auto_reference": false,
+    "max_passages": 3
   },
   "tree_watch": {
     "enabled": true,

package/dist/src/agents/antigravity.js

@@ -1,15 +1,16 @@
 import { finalEnvelope, invocationFor } from '../antigravity/invocation.js';
 import { extractStats } from '../usage.js';
+import { isQuotaError } from './quota.js';
 const CAPABILITIES = ['code', 'review', 'test', 'research', 'long-run'];
-export function antigravityAdapter(executable, defaultTransport) {
+export function antigravityAdapter(executable, defaultTransport, options = {}) {
     return {
-        id: 'antigravity',
-        label: 'Antigravity',
+        id: options.id ?? 'antigravity',
+        label: options.label ?? 'Antigravity',
         capabilities: CAPABILITIES,
         buildInvocation(task) {
             const transport = task.promptTransport ?? defaultTransport;
             const invocation = invocationFor(task.prompt, task.timeoutSeconds, transport, task.model ?? null, task.extraArgs ?? []);
-            return { executable, args: invocation.args, stdin: invocation.stdin, transport };
+            return { executable, args: invocation.args, stdin: invocation.stdin, transport, customEnv: options.env };
         },
         async parseResult(raw) {
             const transport = raw.transport ?? defaultTransport;
@@ -48,7 +49,9 @@ export function antigravityAdapter(executable, defaultTransport) {
             }
             // A stream result that is not the expected envelope is reported by field name, because that is what tells the owner to turn step progress off.
             const fields = transport === 'argv' ? '' : ` (stream result fields: ${Object.keys(envelope).slice(0, 12).join(', ') || 'none'}; if step progress is on, turn it off in Settings to return to the JSON mode)`;
-            return { ...result, error: typeof envelope.error === 'string' ? envelope.error : `CLI did not provide a complete successful response${fields}` };
+            const finalErr = typeof envelope.error === 'string' ? envelope.error : `CLI did not provide a complete successful response${fields}`;
+            const quotaHit = isQuotaError(raw.stderr) || isQuotaError(finalErr) || isQuotaError(raw.stdout);
+            return { ...result, error: finalErr, isQuotaExceeded: quotaHit };
         }
     };
 }

package/dist/src/agents/codex.js

@@ -1,24 +1,29 @@
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
+import { isQuotaError } from './quota.js';
 import { startProcess, terminateOwned } from '../antigravity/process.js';
 const CAPABILITIES = ['code', 'review', 'test', 'research', 'long-run'];
 const REQUIRED_FLAGS = ['--json', '--sandbox', '--cd', '--output-last-message', '--ephemeral', '--skip-git-repo-check'];
 const MAX_RESULT_BYTES = 1024 * 1024;
 export function codexAdapter(command, options = {}) {
     return {
-        id: 'codex',
-        label: 'Codex',
+        id: options.id ?? 'codex',
+        label: options.label ?? 'Codex',
         capabilities: CAPABILITIES,
         buildInvocation(task) {
             const resultFile = path.join(task.stateDirectory, 'results', `${task.taskId}.txt`);
             const args = [
-                'exec', '--json', '--sandbox', 'workspace-write', '--skip-git-repo-check', '--ephemeral',
+                'exec', '--json', '--sandbox', options.sandbox ?? 'workspace-write', '--skip-git-repo-check', '--ephemeral',
                 '--cd', task.workspace, '--color', 'never', '-o', resultFile
             ];
+            // A global codex flag, so it goes before the `exec` subcommand: `codex exec --ask-for-approval never` exits
+            // with "unexpected argument" on codex-cli 0.163.0 and the task never starts.
+            if (options.askForApproval)
+                args.unshift('--ask-for-approval', options.askForApproval);
             if (options.model)
                 args.push('-m', options.model);
             args.push('-');
-            return { executable: command.executable, args, stdin: `${task.prompt}\n`, resultFile };
+            return { executable: command.executable, args, stdin: `${task.prompt}\n`, resultFile, customEnv: options.env };
         },
         async parseResult(raw) {
             const events = [];
@@ -71,7 +76,9 @@ export function codexAdapter(command, options = {}) {
             if (raw.signal)
                 return { ...result, error: `Codex was terminated (${raw.signal})` };
             const stderrTail = raw.stderr.trim().split(/\r?\n/).filter(Boolean).at(-1);
-            return { ...result, error: errors.at(-1) ?? stderrTail?.slice(0, 500) ?? 'Codex did not provide a final message' };
+            const finalErr = errors.at(-1) ?? stderrTail?.slice(0, 500) ?? 'Codex did not provide a final message';
+            const quotaHit = isQuotaError(raw.stderr) || isQuotaError(finalErr) || isQuotaError(raw.stdout);
+            return { ...result, error: finalErr, isQuotaExceeded: quotaHit };
         }
     };
 }

package/dist/src/agents/quota.js

@@ -0,0 +1,82 @@
+export const QUOTA_ERROR_PATTERNS = [
+    /insufficient_quota/i,
+    /rate[_\s-]?limit(?:ed|_exceeded)?/i,
+    /quota[_\s-]?exceeded/i,
+    /credits?[_\s-]?exhausted/i,
+    /check your plan and billing/i,
+    /billing details/i,
+    /too many requests/i,
+    /credit limit/i,
+    /model[_\s-]?capacity/i,
+    /\boverloaded\b/i,
+    /exceeded your current quota/i,
+    /resource_exhausted/i,
+    /\b429\b/
+];
+/** Check if stdout/stderr/error text indicates an account quota exhaustion or rate limit. */
+export function isQuotaError(text) {
+    if (!text)
+        return false;
+    return QUOTA_ERROR_PATTERNS.some(pattern => pattern.test(text));
+}
+const HARD_KEYWORDS = /(?:refactor|architecture|concurrency|tái cấu trúc|bảo mật|tối ưu|redesign|deadlock|race condition|migration|distributed)/i;
+/** Assess whether a task is considered 'hard' (high complexity, multi-file, or architectural). */
+export function isHardTask(input) {
+    if ((input.owns?.length ?? 0) >= 3)
+        return true;
+    if ((input.acceptance_criteria?.length ?? 0) >= 4)
+        return true;
+    const fullText = `${input.task ?? ''} ${input.context ?? ''}`;
+    if (fullText.length >= 3000)
+        return true;
+    if (HARD_KEYWORDS.test(fullText))
+        return true;
+    if ((input.timeout_seconds ?? 0) >= 600)
+        return true;
+    if (input.effort === 'high')
+        return true;
+    return false;
+}
+export class ProfileHealthTracker {
+    cooldowns = new Map();
+    /** Mark a profile as exhausted / in cooldown until now + durationSeconds. */
+    markCooldown(profileId, durationSeconds = 900) {
+        const expiresAt = Date.now() + durationSeconds * 1000;
+        this.cooldowns.set(profileId, expiresAt);
+    }
+    /** Check if a profile is currently available (not cooled down). */
+    isAvailable(profileId) {
+        const expiresAt = this.cooldowns.get(profileId);
+        if (!expiresAt)
+            return true;
+        if (Date.now() >= expiresAt) {
+            this.cooldowns.delete(profileId);
+            return true;
+        }
+        return false;
+    }
+    /** Clear cooldown for testing or explicit manual recovery. */
+    clearCooldown(profileId) {
+        this.cooldowns.delete(profileId);
+    }
+    /**
+     * Intelligently select the best profile from a pool based on task difficulty and health status.
+     * Never returns a member listed in `exclude` (already tried this task) or currently in cooldown.
+     * Returns null when nothing healthy remains — callers must fail the task rather than loop.
+     */
+    selectProfile(pool, isHard, isAgentAvailable, exclude = new Set()) {
+        const usableMembers = pool.members.filter(id => isAgentAvailable(id) && !exclude.has(id));
+        if (!usableMembers.length)
+            return null;
+        const healthyMembers = usableMembers.filter(id => this.isAvailable(id));
+        if (!healthyMembers.length)
+            return null;
+        if (isHard && pool.hard_task_profile && healthyMembers.includes(pool.hard_task_profile)) {
+            return pool.hard_task_profile;
+        }
+        // 'quota-adaptive', 'priority-failover', and the current round-robin stub: first healthy in pool order
+        return healthyMembers[0];
+    }
+}
+export const globalHealthTracker = new ProfileHealthTracker();
+//# sourceMappingURL=quota.js.map

package/dist/src/agents/registry.js

@@ -9,8 +9,9 @@ export async function createAgentRegistry(config, antigravity) {
     const enabled = settings.enabled ?? DEFAULT_ENABLED;
     const priority = settings.priority ?? DEFAULT_PRIORITY;
     const warnings = [];
+    const known = new Set([...KNOWN, ...Object.keys(settings.profiles ?? {}), ...Object.keys(settings.pools ?? {})]);
     for (const id of [...enabled, ...priority]) {
-        if (!KNOWN.includes(id))
+        if (!known.has(id))
             warnings.push(`Unknown agent "${id}" in the bridge config is ignored`);
     }
     const agents = [];
@@ -40,7 +41,88 @@ export async function createAgentRegistry(config, antigravity) {
             codexStatus = { ...codexStatus, warnings: [`Codex CLI not found: ${error instanceof Error ? error.message : 'unknown error'}`] };
         }
     }
-    agents.push(codexAgent(codexCommand, codexStatus, { model: settings.codex_model }));
+    if (settings.codex_sandbox === 'danger-full-access' || settings.codex_ask_for_approval === 'never') {
+        const dangerWarn = `Agent "codex" is configured with dangerous permissions (sandbox: ${settings.codex_sandbox ?? 'workspace-write'}, approval: ${settings.codex_ask_for_approval ?? 'on-request'})`;
+        codexStatus.warnings.push(dangerWarn);
+        warnings.push(dangerWarn);
+    }
+    agents.push(codexAgent(codexCommand, codexStatus, {
+        model: settings.codex_model,
+        sandbox: settings.codex_sandbox,
+        askForApproval: settings.codex_ask_for_approval
+    }));
+    if (settings.profiles) {
+        for (const [profileId, profile] of Object.entries(settings.profiles)) {
+            const isProfileEnabled = enabled.includes(profileId) || (!settings.enabled && true);
+            const adapterType = profile.adapter;
+            const label = profile.label ?? (adapterType === 'codex' ? `Codex (${profileId})` : `Antigravity (${profileId})`);
+            const profileWarnings = [];
+            if (!isProfileEnabled)
+                profileWarnings.push('Disabled in the bridge config');
+            if (adapterType === 'antigravity') {
+                let cmd = antigravity.executable;
+                let prefixArgs = antigravity.prefixArgs;
+                let supported = antigravity.supported;
+                let version = antigravity.version;
+                if (profile.executable) {
+                    try {
+                        const resolved = await resolveCommand(profile.executable);
+                        cmd = resolved.executable;
+                        prefixArgs = resolved.prefixArgs;
+                    }
+                    catch (error) {
+                        supported = false;
+                        profileWarnings.push(`Executable not found: ${error instanceof Error ? error.message : 'unknown error'}`);
+                    }
+                }
+                const status = {
+                    id: profileId, label, available: isProfileEnabled && supported,
+                    version: version || null, executable: cmd || null,
+                    capabilities: ['code', 'review', 'test', 'research', 'long-run'],
+                    warnings: isProfileEnabled ? [...antigravity.warnings, ...profileWarnings] : profileWarnings
+                };
+                agents.push({
+                    adapter: antigravityAdapter(cmd, config.prompt_transport, { id: profileId, label, env: profile.env }),
+                    status, enabled: isProfileEnabled, prefixArgs
+                });
+            }
+            else if (adapterType === 'codex') {
+                let cmd = codexCommand;
+                let statusAvailable = codexStatus.available;
+                let version = codexStatus.version;
+                if (profile.executable) {
+                    try {
+                        cmd = await resolveCommand(profile.executable);
+                        const detected = await detectCodex(cmd, { cwd: process.cwd(), extraEnvPassthrough: config.extra_env_passthrough });
+                        statusAvailable = detected.available;
+                        version = detected.version;
+                        profileWarnings.push(...detected.warnings);
+                    }
+                    catch (error) {
+                        statusAvailable = false;
+                        profileWarnings.push(`Codex CLI not found: ${error instanceof Error ? error.message : 'unknown error'}`);
+                    }
+                }
+                const sandbox = profile.codex_sandbox ?? settings.codex_sandbox;
+                const askForApproval = profile.codex_ask_for_approval ?? settings.codex_ask_for_approval;
+                if (sandbox === 'danger-full-access' || askForApproval === 'never') {
+                    const dangerMsg = `Agent "${profileId}" is configured with dangerous permissions (sandbox: ${sandbox ?? 'workspace-write'}, approval: ${askForApproval ?? 'on-request'})`;
+                    profileWarnings.push(dangerMsg);
+                    warnings.push(dangerMsg);
+                }
+                const status = {
+                    id: profileId, label, available: isProfileEnabled && statusAvailable,
+                    version: version || null, executable: cmd.source || null,
+                    capabilities: ['code', 'review', 'test', 'research', 'long-run'],
+                    warnings: isProfileEnabled ? [...codexStatus.warnings.filter(w => !w.includes('Disabled') && !w.includes('dangerous permissions')), ...profileWarnings] : profileWarnings
+                };
+                agents.push(codexAgent(cmd, status, {
+                    id: profileId, label, model: profile.model ?? settings.codex_model,
+                    sandbox, askForApproval, env: profile.env
+                }));
+            }
+        }
+    }
     const usable = (agent) => agent.enabled && agent.status.available;
     const defaultAgent = priority.find(id => agents.some(agent => agent.adapter.id === id && usable(agent)))
         ?? agents.find(usable)?.adapter.id ?? null;

package/dist/src/antigravity/process.js

@@ -71,7 +71,7 @@ export function childEnvironment(parent, extra = []) {
         (explicit.has(key.toUpperCase()) || (base.test(key) && !/TOKEN|SECRET|PASSWORD|API_KEY/i.test(key)))));
 }
 export function startProcess(executable, args, cwd, options = {}) {
-    const env = childEnvironment(process.env, options.extraEnvPassthrough);
+    const env = { ...childEnvironment(process.env, options.extraEnvPassthrough), ...(options.customEnv ?? {}) };
     const child = spawn(executable, args, {
         cwd, env, shell: false, windowsHide: true, detached: process.platform !== 'win32',
         stdio: ['pipe', 'pipe', 'pipe']

package/dist/src/config.js

@@ -2,7 +2,38 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { paths, packageRoot } from './paths.js';
 import * as z from 'zod/v4';
+export const codexSandboxSchema = z.enum(['workspace-write', 'danger-full-access', 'read-only']);
+// The two policies codex-cli 0.163.0 accepts for --ask-for-approval; anything else makes codex exit before it reads the prompt.
+export const codexApprovalSchema = z.enum(['on-request', 'never']);
+export const agentProfileSchema = z.object({
+    adapter: z.enum(['codex', 'antigravity']),
+    label: z.string().min(1).max(100).optional(),
+    env: z.record(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), z.string()).optional(),
+    codex_sandbox: codexSandboxSchema.optional(),
+    codex_ask_for_approval: codexApprovalSchema.optional(),
+    model: z.string().min(1).max(200).optional(),
+    executable: z.string().min(1).max(4096).optional()
+}).strict();
+export const poolSchema = z.object({
+    strategy: z.enum(['quota-adaptive', 'priority-failover', 'round-robin']).default('quota-adaptive'),
+    members: z.array(z.string().min(1).max(64)).min(1).max(50),
+    hard_task_profile: z.string().min(1).max(64).optional(),
+    quota_cooldown_seconds: z.number().int().min(10).max(86400).default(900)
+}).strict();
+export const xerjSchema = z.object({
+    // Off unless the owner turns it on: enabling it sends task text to another local service and prepends retrieved
+    // passages to the prompt an agent follows, so a search hit becomes an instruction the agent never got from the client.
+    enabled: z.boolean().default(false),
+    url: z.string().default('http://127.0.0.1:9200'),
+    default_index: z.string().default('mcp-bridge-docs'),
+    auto_reference: z.boolean().default(false),
+    max_passages: z.number().int().min(1).max(10).default(3)
+}).strict();
 const agentsSchema = z.object({
+    codex_sandbox: codexSandboxSchema.optional(),
+    codex_ask_for_approval: codexApprovalSchema.optional(),
+    profiles: z.record(z.string().min(1).max(64), agentProfileSchema).optional(),
+    pools: z.record(z.string().min(1).max(64), poolSchema).optional(),
     priority: z.array(z.string().min(1).max(64)).max(50).optional(),
     enabled: z.array(z.string().min(1).max(64)).max(50).optional(),
     codex_executable: z.string().min(1).max(4096).optional(),
@@ -19,6 +50,7 @@ const schema = z.object({
     max_parallel_worktrees: z.number().int().min(1).max(8).optional(),
     default_autonomy: z.enum(['suggest', 'auto', 'full']).optional(),
     agents: agentsSchema.optional(),
+    xerj: xerjSchema.optional(),
     /**
      * The process-tree watcher that runs while a task is live. One poll costs a full process-table query (about half a
      * second on the reference machine), so the cadence is owner-tunable and the whole watch can be turned off; without

package/dist/src/http.js

@@ -52,6 +52,31 @@ export async function startHttpBridge(options) {
             reply(200, { status: 'ok', transport: 'streamable-http', mcp_endpoint: `${baseUrl}/mcp`, ...options.manager.overview(), missions: options.missions.overview() });
             return;
         }
+        if (req.url === '/api/xerj/status' && req.method === 'GET') {
+            const xerj = options.manager.getXerjClient();
+            if (!options.manager.isXerjEnabled()) {
+                reply(200, { enabled: false, available: false, url: xerj.url, default_index: xerj.defaultIndex, indices: [] });
+                return;
+            }
+            void xerj.isAvailable().then(async (available) => {
+                const indices = available ? await xerj.listIndices() : [];
+                reply(200, { available, url: xerj.url, default_index: xerj.defaultIndex, indices });
+            }).catch(() => reply(200, { available: false, url: xerj.url, default_index: xerj.defaultIndex, indices: [] }));
+            return;
+        }
+        if (req.url?.startsWith('/api/xerj/search') && req.method === 'GET') {
+            if (!options.manager.isXerjEnabled()) {
+                reply(404, { error: 'XERJ search is disabled: set "xerj.enabled" to true in workspaces.json' });
+                return;
+            }
+            const parsed = new URL(req.url, baseUrl || 'http://127.0.0.1:3000');
+            const q = parsed.searchParams.get('q') ?? '';
+            const limit = parseInt(parsed.searchParams.get('limit') ?? '5', 10);
+            const index = parsed.searchParams.get('index') ?? undefined;
+            const xerj = options.manager.getXerjClient();
+            void xerj.search(q, { limit, index }).then(result => reply(200, result)).catch(() => reply(500, { error: 'Search failed' }));
+            return;
+        }
         if (req.url !== '/mcp') {
             reply(404, { error: 'Use /mcp for MCP or GET /health for health checks' });
             return;

package/dist/src/runtime.js

@@ -81,7 +81,7 @@ export async function createRuntime() {
         limits: { max_timeout_seconds: config.max_timeout_seconds, max_output_bytes_per_stream: config.max_output_bytes, max_retained_tasks: config.max_retained_tasks, max_mission_steps: MAX_STEPS_PER_MISSION, max_retained_missions: MAX_RETAINED_MISSIONS, concurrent_tasks: maxParallelWorktrees + 1, concurrent_normal_tasks: 1, max_parallel_worktrees: maxParallelWorktrees, max_queued_tasks: config.max_queued_tasks },
         limitations: [
             `Antigravity requires agy 1.4.x with all required flags; real execution was verified on ${VERIFIED_AGY_VERSIONS.join(' and ')}.`,
-            'Codex runs non-interactively with sandbox workspace-write; approval-requiring actions still fail instead of bypassing the sandbox.',
+            'Codex defaults to sandbox workspace-write; the bridge owner may raise sandbox/approval in config (danger-full-access / ask-for-approval never), which is surfaced as agent warnings.',
             'Ordinary tasks are serialized globally. Only tasks with isolation "worktree" run concurrently, each in its own git worktree and branch.',
             'Mission plans are recorded and gated by the bridge, but the bridge never dispatches a step by itself: every step starts on a client call, and a canceled or completed plan grants nothing.',
             'Worktree tasks declare owns; files outside that list are reported for review and are never merged automatically.',
@@ -92,7 +92,7 @@ export async function createRuntime() {
             'Workspace preflight is not an OS sandbox and cannot prevent concurrent link swaps.',
             'Existing agent permissions, hooks, MCP and credential access remain governed by each CLI configuration.',
             'Antigravity permission flags are off unless the bridge owner raises the level in the web UI (a client cannot change it). At the default level, actions that need approval are denied (see denied_actions).',
-            'No permission bypass flags. Dangerous actions require separate interactive approval.',
+            'Antigravity has no client-side permission bypass. Codex sandbox/approval are owner-config only; dangerous settings emit warnings and still require the owner to opt in via workspaces.json.',
             `After an agent process exits, the bridge releases the process trees it left behind (Windows: taskkill on every subtree still hanging below the agent or below a process recorded while it ran, after re-checking that each pid still names the same process; POSIX: the exited process group). The outcome is published as the task's cleanup field, and a graceful shutdown waits for it. A bridge killed abruptly, or tree_watch disabled in config, can still orphan processes.`,
             'Worktree directories of finished tasks are kept for review. Only empty leftovers are removed at startup, a directory a live process still holds is reported instead of forced, and a repository left holding a record whose directory is gone is pruned.',
             'Redaction recognizes known patterns only. Never include credentials in task data.'