antiphon 0.1.0

package/lib/antiphon.py

@@ -0,0 +1,1178 @@
+#!/usr/bin/env python3
+"""Antiphon — an open-identity bridge between Claude Code and the Codex CLI.
+
+Two terminals, two separate agents: what you tell one, the other finds out.
+
+Usage:
+  antiphon setup               # installs the hook on both sides
+  antiphon status              # shows what's happening on both sides (for humans)
+  antiphon summary [side]      # the text that side would see (claude | codex)
+  antiphon hook <side>         # UserPromptSubmit hook (reads JSON from stdin)
+  antiphon push <target>       # Stop hook: pushes `@codex` / `@claude` lines
+  antiphon reply               # sends a Claude Channel reply to Codex (stdin JSON)
+  antiphon channel             # long-lived Node.js MCP Channel server (started by Claude Code)
+  antiphon mcp                 # MCP stdio server for Codex (fallback path)
+
+Design: NO SHARED LOG IS KEPT. Both CLIs already write transcripts; Antiphon
+reads and derives from them. That way there's no write race, no stale record,
+and no second source of truth. The only persistent state is a cursor tracking
+how far each side has read.
+
+Both sides are symmetric: Claude Code and Codex CLI speak the same
+`UserPromptSubmit` hook contract (the same input fields, the same output
+wrapper), so a single `hook` function serves both.
+
+The pull and hook layer uses the Python standard library; the Claude Channel
+server runs on Node.js with the official MCP SDK.
+"""
+
+import glob
+import hashlib
+import json
+import os
+import re
+import socket
+import subprocess
+import sys
+import time
+import uuid
+from datetime import datetime
+
+HOME = os.path.expanduser("~")
+CLAUDE_PROJECTS = os.path.join(HOME, ".claude", "projects")
+CODEX_SESSIONS = os.path.join(HOME, ".codex", "sessions")
+
+TAIL_BYTES = 300_000      # amount to read from the tail of each transcript file
+SUMMARY_BUDGET = 2600     # character budget for the injected summary
+EVENT_LIMIT = 40          # max events that go into the summary
+LOOKBACK = 6 * 3600       # anything older than this doesn't count as part of "this session"
+
+# A marker at the start of a line in a reply says that line should be pushed
+# to the target. The line-start requirement is deliberate: mentioning the
+# marker inside prose shouldn't trigger it.
+PUSH_MARKERS = {
+    "codex": re.compile(r"^\s*@codex\b[:,]?\s*(.+)$", re.MULTILINE),
+    "claude": re.compile(r"^\s*@claude\b[:,]?\s*(.+)$", re.MULTILINE),
+}
+SESSION_ID = re.compile(r"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-"
+                        r"[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$")
+
+# The labels every Claude→Codex message carries. `push()` and `reply()` send
+# these, and the self-injection guard below recognizes them — one definition,
+# so the two can't drift apart.
+PUSH_LABEL = "[Antiphon bridge] Claude:"
+CHANNEL_LABEL = "[Antiphon channel] Claude:"
+
+# A message this bridge pushed arrives on the other side as an ordinary
+# `role: user` event. Skipping those keeps the summary from echoing the
+# bridge's own traffic back at it. Matched on the label, anchored at the start:
+# a substring test would also swallow a user typing "antiphon is dropping
+# messages", and that message would then never reach the other agent.
+_SELF_INJECTION_PREFIXES = tuple(
+    label.lower() for label in (PUSH_LABEL, CHANNEL_LABEL))
+
+
+def _is_self_injected(text):
+    """True if `text` is a message this bridge itself delivered."""
+    return text.lstrip().lower().startswith(_SELF_INJECTION_PREFIXES)
+
+
+# ---------- helpers ----------
+
+def project_dir():
+    return os.path.abspath(os.environ.get("ANTIPHON_CWD") or os.getcwd())
+
+
+def state_path(cwd):
+    return os.path.join(cwd, ".antiphon", "cursor.json")
+
+
+LEGACY_KEYS = {
+    "codex_gordu": "codex_seen",
+    "claude_gordu": "claude_seen",
+    "son_itilen_codex": "last_pushed_codex",
+    "son_itilen_claude": "last_pushed_claude",
+    "son_itilen": "last_pushed_codex",
+}
+
+
+def _translate_cursor_keys(data):
+    return {LEGACY_KEYS.get(k, k): v for k, v in data.items()}
+
+
+def read_cursor(cwd):
+    new_path = state_path(cwd)
+    try:
+        with open(new_path, encoding="utf-8") as f:
+            data = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        return {}
+
+    translated = _translate_cursor_keys(data)
+    if translated != data:
+        write_cursor(cwd, translated)
+    return translated
+
+
+def write_cursor(cwd, data):
+    path = state_path(cwd)
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    tmp = f"{path}.{os.getpid()}.tmp"
+    try:
+        with open(tmp, "w", encoding="utf-8") as f:
+            json.dump(data, f, ensure_ascii=False, indent=1)
+        os.replace(tmp, path)
+        return True
+    except OSError:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        return False
+
+
+def truncate(s, n):
+    s = " ".join((s or "").split())
+    return s if len(s) <= n else s[:n].rstrip() + "…"
+
+
+def tail_lines(path):
+    try:
+        size = os.path.getsize(path)
+        with open(path, "rb") as f:
+            if size > TAIL_BYTES:
+                f.seek(size - TAIL_BYTES)
+                f.readline()
+            return f.read().decode("utf-8", "replace").splitlines()
+    except OSError:
+        return []
+
+
+def head_lines(path, limit=12, num_bytes=64 * 1024):
+    """Returns the lines at the start of the file, used for session metadata."""
+    try:
+        with open(path, "rb") as f:
+            return f.read(num_bytes).decode("utf-8", "replace").splitlines()[:limit]
+    except OSError:
+        return []
+
+
+def iso_epoch(s):
+    if not s:
+        return 0.0
+    try:
+        return datetime.fromisoformat(s.replace("Z", "+00:00")).timestamp()
+    except (ValueError, TypeError):
+        return 0.0
+
+
+# ---------- Claude side ----------
+
+def _claude_slug(cwd):
+    """The ~/.claude/projects directory name Claude Code derives from a path.
+
+    Every character that isn't alphanumeric becomes `-`, not just `/`: an
+    underscore, a dot and an existing `-` all end up as `-`. Getting this
+    wrong is silent — the slug simply names no directory, and the whole
+    Claude→Codex direction goes empty forever."""
+    return re.sub(r"[^A-Za-z0-9]", "-", cwd)
+
+
+def _transcript_cwd(path):
+    """The project directory a Claude transcript records, or None."""
+    for line in head_lines(path, limit=40):
+        if '"cwd"' not in line:       # cheap pre-filter, skips parsing big lines
+            continue
+        try:
+            d = json.loads(line)
+        except (json.JSONDecodeError, ValueError):
+            continue
+        if isinstance(d, dict) and isinstance(d.get("cwd"), str):
+            return d["cwd"]
+    return None
+
+
+def _find_claude_project_dir(cwd):
+    """Finds the project directory by the cwd its transcripts carry.
+
+    The fallback for when the slug rule names no existing directory — an older
+    naming rule, or a new one. Only reached when the slug misses, so the
+    common path never pays for the scan."""
+    try:
+        entries = [os.path.join(CLAUDE_PROJECTS, name)
+                   for name in os.listdir(CLAUDE_PROJECTS)]
+    except OSError:
+        return None
+    def mtime(path):
+        try:
+            return os.path.getmtime(path)
+        except OSError:               # vanished mid-scan; sort it last
+            return 0.0
+
+    candidates = [p for p in entries if os.path.isdir(p)]
+    candidates.sort(key=mtime, reverse=True)               # most recently used first
+    for directory in candidates:
+        transcripts = sorted(glob.glob(os.path.join(directory, "*.jsonl")),
+                             key=mtime, reverse=True)
+        for path in transcripts[:3]:
+            recorded = _transcript_cwd(path)
+            if recorded is not None:
+                if recorded == cwd:
+                    return directory
+                break                 # this directory belongs to another project
+    return None
+
+
+def claude_project_dir(cwd):
+    """The ~/.claude/projects directory holding this project's transcripts."""
+    directory = os.path.join(CLAUDE_PROJECTS, _claude_slug(cwd))
+    if os.path.isdir(directory):
+        return directory
+    return _find_claude_project_dir(cwd)
+
+
+def claude_transcripts(cwd):
+    """Claude Code transcript files belonging to this project directory (newest first)."""
+    directory = claude_project_dir(cwd)
+    if not directory:
+        return []
+    files = [p for p in glob.glob(os.path.join(directory, "*.jsonl"))
+             if os.path.getsize(p) > 0]
+    files.sort(key=os.path.getmtime, reverse=True)
+    return files
+
+
+def claude_events(cwd, start=0.0):
+    """(time, type, text) — type: you | claude | tool"""
+    events = []
+    for path in claude_transcripts(cwd)[:3]:
+        for line in tail_lines(path):
+            try:
+                d = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            if d.get("isMeta"):
+                continue
+            ts = iso_epoch(d.get("timestamp"))
+            if ts <= start:
+                continue
+            kind = d.get("type")
+            msg = d.get("message") or {}
+            content = msg.get("content")
+            if kind == "user":
+                text = ""
+                if isinstance(content, str):
+                    text = content
+                elif isinstance(content, list):
+                    text = " ".join(c.get("text", "") for c in content
+                                    if isinstance(c, dict) and c.get("type") == "text")
+                text = text.strip()
+                # tool results and system injections are not the user's own words
+                if text and not text.startswith("<") and not _is_self_injected(text):
+                    events.append((ts, "you", text))
+            elif kind == "assistant":
+                for c in content if isinstance(content, list) else []:
+                    if c.get("type") == "text" and c.get("text", "").strip():
+                        events.append((ts, "claude", c["text"].strip()))
+                    elif c.get("type") == "tool_use":
+                        i = c.get("input") or {}
+                        detail = i.get("file_path") or i.get("command") or i.get("pattern") or ""
+                        events.append((ts, "tool", f"{c.get('name', '?')} {detail}".strip()))
+    return sorted(events)
+
+
+# ---------- Codex side ----------
+
+def _rollout_cwd(lines):
+    """The cwd a Codex rollout records in its session metadata (None if absent)."""
+    for line in lines:
+        if '"cwd"' not in line:       # cheap pre-filter, skips parsing big lines
+            continue
+        try:
+            d = json.loads(line)
+        except (json.JSONDecodeError, ValueError):
+            continue
+        if not isinstance(d, dict):
+            continue
+        for holder in (d, d.get("payload")):
+            if isinstance(holder, dict) and isinstance(holder.get("cwd"), str):
+                return holder["cwd"]
+    return None
+
+
+def codex_rollout_files(cwd, days=3):
+    """Codex rollout files whose cwd matches this project (newest first)."""
+    pattern = os.path.join(CODEX_SESSIONS, "**", "rollout-*.jsonl")
+    candidates = []
+    now = time.time()
+    for path in glob.glob(pattern, recursive=True):
+        try:
+            if now - os.path.getmtime(path) > days * 86400:
+                continue
+        except OSError:
+            continue
+        candidates.append(path)
+    candidates.sort(key=os.path.getmtime, reverse=True)
+    matched = []
+    for path in candidates[:60]:
+        # cwd lives in the session metadata. Reading the tail of a growing,
+        # active rollout could miss it and match the wrong, already-closed
+        # subsession instead.
+        lines = head_lines(path)
+        recorded = _rollout_cwd(lines)
+        if recorded is not None:
+            # An equality test, never a substring one: `/x/api` used to match
+            # a rollout recorded for `/x/api-v2`, and a push then landed in
+            # the sibling project's Codex.
+            if recorded == cwd:
+                matched.append(path)
+            continue
+        # No head line carries a cwd field: fall back to the old substring
+        # test rather than dropping a file we can't read properly.
+        if any(cwd in line for line in lines):
+            matched.append(path)
+    return matched
+
+
+def codex_events(cwd, start=0.0):
+    """(time, type, text) — type: you | codex | tool"""
+    events = []
+    for path in codex_rollout_files(cwd)[:3]:
+        for line in tail_lines(path):
+            try:
+                d = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            ts = iso_epoch(d.get("timestamp"))
+            if ts <= start:
+                continue
+            kind, p = d.get("type"), d.get("payload") or {}
+            if kind == "response_item" and p.get("type") == "message":
+                role = p.get("role")
+                text = " ".join(
+                    c.get("text") or c.get("input_text") or ""
+                    for c in p.get("content") or [] if isinstance(c, dict)
+                ).strip()
+                if not text or role == "developer":
+                    continue
+                if role == "user":
+                    if text.startswith("<") or _is_self_injected(text):
+                        continue
+                    events.append((ts, "you", text))
+                elif role == "assistant":
+                    events.append((ts, "codex", text))
+            elif kind == "event_msg" and p.get("type") == "exec_command_begin":
+                cmd = p.get("command")
+                if isinstance(cmd, list):
+                    cmd = " ".join(cmd)
+                if cmd:
+                    events.append((ts, "tool", f"shell {cmd}"))
+    return sorted(events)
+
+
+# ---------- summary ----------
+
+LABEL = {"you": "YOU", "claude": "Claude", "codex": "Codex", "tool": "·"}
+
+
+# side -> (the other side's key, its display name for headings, its phrasing in notices)
+OTHER_SIDE = {
+    "claude": ("codex", "Codex", "from Codex"),
+    "codex": ("claude", "Claude Code", "from Claude Code"),
+}
+
+
+def build_summary(cwd, side, start=0.0):
+    """`side` is the side that will READ the summary ('claude' | 'codex').
+    Turns what happened on the other side, and what the user said, into
+    compact text.
+
+    Returns: (text, last_event_time, message_count). `message_count` doesn't
+    count tool calls — the notice shown in the terminal uses it."""
+    if side == "claude":
+        events = codex_events(cwd, start)
+    else:
+        events = claude_events(cwd, start)
+    other = OTHER_SIDE[side][1]
+
+    if not events:
+        return "", 0.0, 0
+
+    events = events[-EVENT_LIMIT:]
+    last_time = events[-1][0]
+    count = sum(1 for _, kind, _ in events if kind != "tool")
+
+    lines = []
+    tools = []
+    for ts, kind, text in events:
+        if kind == "tool":
+            tools.append(truncate(text, 70))
+            continue
+        if tools:
+            lines.append(f"  · {len(tools)} tool calls: " + truncate(" | ".join(tools[-3:]), 130))
+            tools = []
+        clock = datetime.fromtimestamp(ts).strftime("%H:%M")
+        lines.append(f"[{clock}] {LABEL.get(kind, kind)}: {truncate(text, 420)}")
+    if tools:
+        lines.append(f"  · {len(tools)} tool calls: " + truncate(" | ".join(tools[-3:]), 130))
+
+    body = "\n".join(lines)
+    truncated = False
+    if len(body) > SUMMARY_BUDGET:
+        # keep the newest; trim from the front
+        while len(body) > SUMMARY_BUDGET and len(lines) > 1:
+            lines.pop(0)
+            body = "\n".join(lines)
+        truncated = True
+
+    head = f"## What happened on the {other} side (since your last turn)"
+    foot = ("\nThis record belongs to the Antiphon bridge — this is what actually happened "
+            "there. Do not assume anything that is not in it.")
+    if truncated:
+        foot = "\n(older lines were cut for budget)" + foot
+    return f"{head}\n{body}{foot}", last_time, count
+
+
+# ---------- hook (both sides share the same contract) ----------
+
+def hook(side="claude"):
+    """UserPromptSubmit hook: injects the other side's summary into the context.
+
+    `side` is which CLI this hook is running inside ('claude' | 'codex').
+    Claude Code and Codex CLI speak the same input fields (`cwd`) and the same
+    output wrapper, so a single `hook` function serves both."""
+    if side not in OTHER_SIDE:
+        print(f"hook: unknown side {side!r} (claude | codex)", file=sys.stderr)
+        return 1
+    try:
+        input_data = json.load(sys.stdin)
+    except (json.JSONDecodeError, ValueError):
+        input_data = {}
+    cwd = os.path.abspath(input_data.get("cwd") or project_dir())
+
+    cursor = read_cursor(cwd)
+    key = f"{side}_seen"
+    start = float(cursor.get(key) or (time.time() - LOOKBACK))
+    text, last, _ = build_summary(cwd, side, start)
+    if text and last:
+        cursor[key] = last
+        write_cursor(cwd, cursor)
+
+    if not text:
+        return 0
+
+    # The hook prints nothing to the terminal. The counter used to say
+    # "message" but it was counting the other side's transcript events;
+    # incoming channel messages already show up via their own notices.
+    # Context is injected silently.
+    print(json.dumps({
+        "hookSpecificOutput": {
+            "hookEventName": "UserPromptSubmit",
+            "additionalContext": text,
+        }
+    }, ensure_ascii=False))
+    return 0
+
+
+def notice_text(side, count):
+    """The one-line notice in `status` output (the hook no longer uses this)."""
+    noun = "message" if count == 1 else "messages"
+    return f"💬 {count} new {noun} {OTHER_SIDE[side][2]}"
+
+
+# ---------- push (both directions) ----------
+
+def last_claude_reply(transcript_path):
+    """Returns the most recent assistant text in the Claude transcript."""
+    chunks = []
+    for line in tail_lines(transcript_path):
+        try:
+            d = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if d.get("type") != "assistant" or d.get("isMeta"):
+            continue
+        content = (d.get("message") or {}).get("content")
+        texts = [c.get("text", "") for c in content or []
+                if isinstance(c, dict) and c.get("type") == "text"]
+        if texts:
+            chunks = texts            # each new assistant message supersedes the last
+    return "\n".join(chunks).strip()
+
+
+def last_codex_reply(transcript_path):
+    """Returns the most recent assistant text in the Codex rollout."""
+    chunks = []
+    for line in tail_lines(transcript_path):
+        try:
+            d = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        p = d.get("payload") or {}
+        if (d.get("type") != "response_item" or p.get("type") != "message"
+                or p.get("role") != "assistant"):
+            continue
+        texts = [c.get("text") or c.get("output_text") or c.get("input_text") or ""
+                for c in p.get("content") or [] if isinstance(c, dict)]
+        if any(texts):
+            chunks = texts
+    return "\n".join(chunks).strip()
+
+
+def codex_session_id(cwd):
+    """The UUID of the newest Codex session matching cwd (None if there isn't one)."""
+    for path in codex_rollout_files(cwd)[:1]:
+        m = SESSION_ID.search(os.path.basename(path))
+        if m:
+            return m.group(1)
+    return None
+
+
+def push(target="codex"):
+    """Stop hook: pushes explicit target lines in the latest reply to the other side.
+
+    `target=codex` is called from Claude's Stop hook, `target=claude` from
+    Codex's Stop hook. Addressing is never inferred from free text — only an
+    explicit `@codex` or `@claude` marker at the start of a line triggers a
+    push.
+    """
+    if target not in PUSH_MARKERS:
+        print(f"push: unknown target {target!r} (claude | codex)", file=sys.stderr)
+        return 1
+    try:
+        input_data = json.load(sys.stdin)
+    except (json.JSONDecodeError, ValueError):
+        input_data = {}
+    if input_data.get("stop_hook_active"):
+        return 0                          # don't re-enter a turn we triggered ourselves
+    cwd = os.path.abspath(input_data.get("cwd") or project_dir())
+    transcript = input_data.get("transcript_path")
+    if not transcript or not os.path.exists(transcript):
+        return 0
+
+    reply_reader = last_claude_reply if target == "codex" else last_codex_reply
+    reply_text = reply_reader(transcript)
+    messages = [m.strip() for m in PUSH_MARKERS[target].findall(reply_text) if m.strip()]
+    if not messages:
+        return 0
+
+    outgoing = "\n".join(messages)
+    cursor = read_cursor(cwd)
+    key = f"last_pushed_{target}"
+    previous = cursor.get(key)
+    if previous == outgoing:
+        return 0                          # don't push the same message twice
+
+    if target == "codex":
+        session_id = codex_session_id(cwd)
+        if not session_id:
+            print("antiphon: no Codex session found in this directory, not pushed", file=sys.stderr)
+            return 0
+        ok, detail = send_to_codex(session_id, f"{PUSH_LABEL} {outgoing}")
+    else:
+        ok, detail = send_to_claude(cwd, outgoing)
+
+    if ok:
+        cursor[key] = outgoing
+        write_cursor(cwd, cursor)
+        print(f"antiphon: delivered to {target.title()} ({len(outgoing)} characters)",
+              file=sys.stderr)
+    else:
+        print(f"antiphon: delivery failed — {detail}", file=sys.stderr)
+    return 0
+
+
+def send_to_codex(session, message):
+    """Leaves a message with the running session via `codex queue`. Returns: (success, detail)."""
+    try:
+        result = subprocess.run(
+            ["codex", "queue", "--thread", session, "--message", message],
+            capture_output=True, text=True, timeout=15, stdin=subprocess.DEVNULL,
+        )
+    except FileNotFoundError:
+        return False, "codex command not found"
+    except subprocess.SubprocessError as e:
+        return False, f"{type(e).__name__}"
+    if result.returncode != 0:
+        return False, (result.stderr or result.stdout or "unknown error").strip()[:200]
+    return True, ""
+
+
+def claude_socket_path(cwd):
+    """Deterministic path to this project's MCP Channel Unix socket."""
+    key = hashlib.sha256(os.path.abspath(cwd).encode()).hexdigest()[:20]
+    return os.path.join(os.environ.get("TMPDIR") or "/tmp",
+                        f"antiphon-channel-{key}.sock")
+
+
+def send_to_claude(cwd, text):
+    """Sends a Codex message to Claude Code's MCP Channel socket."""
+    request = {
+        "content": text,
+        "message_id": str(uuid.uuid4()),
+    }
+    last_error = None
+    for path in (claude_socket_path(cwd),):
+        try:
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+                sock.settimeout(5)
+                sock.connect(path)
+                sock.sendall(json.dumps(request, ensure_ascii=False).encode())
+                sock.shutdown(socket.SHUT_WR)
+                reply_bytes = b""
+                while len(reply_bytes) < 64 * 1024:
+                    chunk = sock.recv(8192)
+                    if not chunk:
+                        break
+                    reply_bytes += chunk
+            break
+        except OSError as e:
+            last_error = e
+    else:
+        return False, ("Claude MCP Channel is down: "
+                       f"{last_error.strerror or type(last_error).__name__}")
+    try:
+        result = json.loads(reply_bytes.decode())
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return False, "Claude MCP Channel returned an invalid response"
+    if not result.get("ok"):
+        return False, str(result.get("error") or "channel delivery failed")[:200]
+    return True, ""
+
+
+def reply(*_):
+    """Sends the reply from the Claude channel reply tool to the running Codex session."""
+    try:
+        input_data = json.load(sys.stdin)
+    except (json.JSONDecodeError, ValueError):
+        input_data = {}
+    text = input_data.get("text")
+    if not isinstance(text, str) or not text.strip():
+        print("reply: empty text", file=sys.stderr)
+        return 1
+    cwd = project_dir()
+    session_id = codex_session_id(cwd)
+    if not session_id:
+        print("reply: no running Codex session found", file=sys.stderr)
+        return 1
+    ok, detail = send_to_codex(session_id, f"{CHANNEL_LABEL} {text.strip()}")
+    if not ok:
+        print(f"reply: {detail}", file=sys.stderr)
+        return 1
+    return 0
+
+
+# ---------- Codex MCP server ----------
+
+TOOLS = [{
+    "name": "antiphon_read",
+    "description": ("Returns what happened on the Claude Code side since your last turn. "
+                    "This normally arrives automatically via the hook, no extra effort "
+                    "required; this tool is the fallback — call it by hand if you suspect "
+                    "the bridge has gone quiet."),
+    "inputSchema": {"type": "object", "properties": {}},
+}]
+
+
+def _mcp_result(mid, result):
+    sys.stdout.write(json.dumps({"jsonrpc": "2.0", "id": mid, "result": result},
+                                ensure_ascii=False) + "\n")
+    sys.stdout.flush()
+
+
+def mcp():
+    """The MCP stdio server Codex connects to."""
+    cwd = project_dir()
+    for line in sys.stdin:
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            request = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        method, mid = request.get("method"), request.get("id")
+        if method == "initialize":
+            _mcp_result(mid, {
+                "protocolVersion": "2024-11-05",
+                "capabilities": {"tools": {}},
+                "serverInfo": {"name": "antiphon", "version": "0.1.0"},
+            })
+        elif method == "tools/list":
+            _mcp_result(mid, {"tools": TOOLS})
+        elif method == "tools/call":
+            p = request.get("params") or {}
+            name = p.get("name")
+            if name == "antiphon_read":
+                cursor = read_cursor(cwd)
+                start = float(cursor.get("codex_seen") or (time.time() - LOOKBACK))
+                text, last, _ = build_summary(cwd, "codex", start)
+                if text and last:
+                    cursor["codex_seen"] = last
+                    write_cursor(cwd, cursor)
+                output = text or "Nothing new on the Claude Code side since your last turn."
+            else:
+                output = f"unknown tool: {name}"
+            _mcp_result(mid, {"content": [{"type": "text", "text": output}]})
+        elif mid is not None:
+            _mcp_result(mid, {})
+    return 0
+
+
+# ---------- setup ----------
+
+HOOK_COMMAND = "antiphon hook {side}"
+PUSH_COMMAND = "antiphon push {target}"
+
+SECTION_HEADING = "## The Antiphon bridge"
+
+AGENTS_RULE = ("\n## The Antiphon bridge\n\n"
+               "You are working alongside Claude Code on this project. What happens on the "
+               "other side is injected into your context automatically at the start of each "
+               "turn — you don't need to do anything else. If you suspect the bridge has gone "
+               "quiet, you can call the `antiphon_read` tool by hand.\n\n"
+               "When Claude wants to tell you something directly, you'll see it as a user "
+               "message starting with `[Antiphon bridge] Claude:` (pushed from Claude's Stop "
+               "hook) or `[Antiphon channel] Claude:` (a direct reply through the channel) — "
+               "either way, these are Claude's words, not the user's. When you want to hand "
+               "Claude a task directly, put `@claude` at the start of a line in your reply; "
+               "only that line is sent to the running Claude session as an MCP Channel event.\n")
+
+CLAUDE_RULE = ("\n## The Antiphon bridge\n\n"
+               "You are working alongside another agent on this project. What happens on the "
+               "other side is injected into your context at the start of each turn. Events "
+               "that come directly from that agent are marked "
+               "`<channel source=\"antiphon\" sender=\"codex\" sender_kind=\"agent\">`; they "
+               "are the words of the Codex agent, not of the human user. Use the "
+               "`reply_to_codex` tool to answer them.\n")
+
+
+class ConfigFileError(Exception):
+    """A config file exists but can't be read, so it must not be rewritten.
+
+    A trailing comma, a `//` comment or a UTF-8 BOM is enough to make a
+    hand-edited settings file unparseable. Overwriting it would silently throw
+    away the user's permissions, env, statusLine and every other tool's hooks,
+    so `setup` reports the file and leaves it exactly as it found it."""
+
+
+def _read_json_object(path):
+    """Reads a JSON object from `path`. A missing (or empty) file reads as {}.
+
+    Raises ConfigFileError for anything that exists but can't be understood —
+    the caller must not overwrite such a file."""
+    try:
+        with open(path, encoding="utf-8") as f:
+            text = f.read()
+    except FileNotFoundError:
+        return {}                     # the normal first install
+    except OSError as e:
+        raise ConfigFileError(
+            f"{path} could not be read ({e.strerror or type(e).__name__}); "
+            "refusing to overwrite it. Fix the file's permissions or move it "
+            "aside, then run `antiphon setup` again.") from e
+    except UnicodeDecodeError as e:
+        raise ConfigFileError(
+            f"{path} is not valid UTF-8; refusing to overwrite it. Fix the "
+            "file or move it aside, then run `antiphon setup` again.") from e
+    if not text.strip():
+        return {}                     # an empty file has nothing to lose
+    try:
+        data = json.loads(text)
+    except json.JSONDecodeError as e:
+        raise ConfigFileError(
+            f"{path} is not valid JSON ({e.msg}, line {e.lineno} column "
+            f"{e.colno}); refusing to overwrite it — that would throw away "
+            "everything else in the file. Fix the file (a trailing comma, a "
+            "`//` comment and a byte-order mark are the usual culprits) or "
+            "move it aside, then run `antiphon setup` again.") from e
+    if not isinstance(data, dict):
+        raise ConfigFileError(
+            f"{path} holds a JSON {type(data).__name__}, not an object; "
+            "refusing to overwrite it. Fix the file or move it aside, then "
+            "run `antiphon setup` again.")
+    return data
+
+
+def _update_json(path, mutate):
+    """Update existing JSON in place without clobbering it. Returns True if the file changed."""
+    data = _read_json_object(path)
+    if not mutate(data):
+        return False
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "w", encoding="utf-8") as f:
+        json.dump(data, f, ensure_ascii=False, indent=2)
+    return True
+
+
+def _legacy_commands(script, verb, arg):
+    """Values/patterns for finding legacy Python hooks pinned to an absolute path."""
+    exact = [f"python3 {script} {verb} {arg}", f"python3 {script} {verb}"]
+    # A global npm install has no way to know where the old clone lived; also
+    # recognize any legacy absolute path safely, by filename and subcommand.
+    pattern = re.compile(
+        rf"^python3\s+\S*antiphon\.py\s+{re.escape(verb)}"
+        rf"(?:\s+{re.escape(arg)})?$"
+    )
+    return [*exact, pattern]
+
+
+def _dedupe_hooks(hooks, command):
+    """Leaves a single entry for `command`. Returns True if anything was dropped.
+
+    Upgrading a legacy entry can land on a command that is already installed —
+    or two legacy entries can upgrade to the same one. Without this collapse
+    the hook is listed twice and fires twice per turn."""
+    seen = False
+    dropped = False
+    emptied = []
+    for group in hooks:
+        entries = group.get("hooks")
+        if not isinstance(entries, list):
+            continue
+        kept = []
+        for entry in entries:
+            if isinstance(entry, dict) and entry.get("command") == command:
+                if seen:
+                    dropped = True
+                    continue          # a duplicate of one we already keep
+                seen = True
+            kept.append(entry)
+        if len(kept) == len(entries):
+            continue
+        group["hooks"] = kept
+        if not kept:
+            emptied.append(id(group))
+    if emptied:
+        hooks[:] = [group for group in hooks if id(group) not in emptied]
+    return dropped
+
+
+def _add_hook(hooks, command, legacy_commands=None, label=None):
+    """Adds the command to the UserPromptSubmit list; does nothing if it's already there.
+
+    If `legacy_commands` is given, upgrade those first — otherwise, once the
+    side argument gets added, the old entry would stick around and the hook
+    would fire twice."""
+    changed = False
+    if legacy_commands:
+        if isinstance(legacy_commands, (str, re.Pattern)):
+            legacy_commands = [legacy_commands]
+        for group in hooks:
+            for entry in group.get("hooks") or []:
+                current = entry.get("command", "")
+                matched = any(
+                    (candidate.fullmatch(current) if isinstance(candidate, re.Pattern)
+                     else current == candidate)
+                    for candidate in legacy_commands
+                )
+                if matched:
+                    entry["command"] = command
+                    if label:
+                        entry["statusMessage"] = label
+                    changed = True
+    if _dedupe_hooks(hooks, command):
+        changed = True
+    for group in hooks:
+        for entry in group.get("hooks") or []:
+            if entry.get("command") == command:
+                if label and entry.get("statusMessage") != label:
+                    entry["statusMessage"] = label
+                    changed = True
+                return changed
+    new_entry = {"type": "command", "command": command}
+    if label:
+        new_entry["statusMessage"] = label
+    hooks.append({"hooks": [new_entry]})
+    return True
+
+
+def _update_instructions(current, rule):
+    """Adds the Antiphon section, or edits it in place if it's stale.
+
+    Just checking the heading and skipping wasn't enough: when the rule text
+    changed, the old text stayed put and kept telling the agent something no
+    longer true."""
+    heading = SECTION_HEADING
+    start = current.find(heading)
+    if start == -1:
+        return current + rule, "added"
+    end = current.find("\n## ", start + len(heading))
+    old_section = current[start:] if end == -1 else current[start:end]
+    if old_section.strip() == rule.strip():
+        return current, "already up to date"
+    tail = "" if end == -1 else current[end:]
+    return current[:start].rstrip("\n") + rule + tail, "updated"
+
+
+CODEX_MCP_TABLE = "mcp_servers.antiphon"
+# Matches `[table]` and `[[table]]` headers, capturing the name between them.
+TOML_HEADER = re.compile(r"^\s*\[\[?\s*([^\[\]]+?)\s*\]\]?\s*$")
+
+
+def _codex_config_block(cwd):
+    """The `.codex/config.toml` entry that gives Codex the `antiphon_read` tool.
+
+    Note `args = ["mcp"]`, not `["channel"]`: the channel server is Claude's side
+    and hands out `reply_to_codex`. Pointing Codex at it would let Codex publish
+    messages labelled as Claude's — the one thing this bridge exists to prevent."""
+    return (f'[{CODEX_MCP_TABLE}]\n'
+            'command = "antiphon"\n'
+            'args = ["mcp"]\n'
+            '# read-only local bridge; no need to ask on every turn\n'
+            'default_tools_approval_mode = "approve"\n'
+            f'\n[{CODEX_MCP_TABLE}.env]\n'
+            f'ANTIPHON_CWD = "{cwd}"\n')
+
+
+def _strip_toml_table(text, table):
+    """Drops `[table]` and its sub-tables, leaving every other section intact."""
+    kept, skipping = [], False
+    for line in text.splitlines(keepends=True):
+        header = TOML_HEADER.match(line)
+        if header:
+            name = header.group(1)
+            skipping = name == table or name.startswith(table + ".")
+        if not skipping:
+            kept.append(line)
+    return "".join(kept)
+
+
+def _update_codex_config(path, cwd):
+    """Rewrites our own table in place; anything else in the file survives."""
+    current = ""
+    if os.path.exists(path):
+        with open(path, encoding="utf-8") as f:
+            current = f.read()
+    kept = _strip_toml_table(current, CODEX_MCP_TABLE).rstrip()
+    block = _codex_config_block(cwd)
+    new_text = f"{kept}\n\n{block}" if kept else block
+    if new_text == current:
+        return False
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "w", encoding="utf-8") as f:
+        f.write(new_text)
+    return True
+
+
+def setup():
+    cwd = project_dir()
+    script = os.path.abspath(__file__)
+    failures = []
+
+    def install(target, mutate, done, already):
+        """Applies one config change and reports it.
+
+        A file that can't be parsed is left alone and recorded as a failure;
+        the rest of the installation still runs, so one broken file doesn't
+        cost the user everything else. `setup` fails at the end instead."""
+        if target in failures:
+            return                    # already reported; two hooks share a file
+        try:
+            changed = _update_json(target, mutate)
+        except ConfigFileError as error:
+            failures.append(target)
+            print(f"✗ {error}", file=sys.stderr)
+            return
+        print(f"{'✓' if changed else '·'} {done if changed else already}: {target}")
+
+    # --- Claude Code side: .claude/settings.json ---
+    claude_target = os.path.join(cwd, ".claude", "settings.json")
+    claude_command = HOOK_COMMAND.format(side="claude")
+    legacy_commands = _legacy_commands(script, "kanca", "claude")
+
+    def claude_mutate(data):
+        hooks = data.setdefault("hooks", {}).setdefault("UserPromptSubmit", [])
+        changed = _add_hook(hooks, claude_command, legacy_commands)
+        allowed = data.setdefault("permissions", {}).setdefault("allow", [])
+        reply_tool = "mcp__antiphon__reply_to_codex"
+        if reply_tool not in allowed:
+            allowed.append(reply_tool)
+            changed = True
+        return changed
+
+    install(claude_target, claude_mutate,
+            "Claude hook installed", "Claude hook already installed")
+
+    # --- Claude side: push to Codex (Stop hook) ---
+    push_command = PUSH_COMMAND.format(target="codex")
+    legacy_push_commands = _legacy_commands(script, "it", "codex")
+
+    def push_mutate(data):
+        hooks = data.setdefault("hooks", {}).setdefault("Stop", [])
+        return _add_hook(hooks, push_command, legacy_push_commands)
+
+    install(claude_target, push_mutate,
+            "Push-to-Codex hook installed (Stop)",
+            "Push-to-Codex hook already installed")
+
+    # --- Codex side: .codex/hooks.json (same contract, same body) ---
+    codex_target = os.path.join(cwd, ".codex", "hooks.json")
+    codex_command = HOOK_COMMAND.format(side="codex")
+    legacy_codex_commands = _legacy_commands(script, "kanca", "codex")
+
+    def codex_mutate(data):
+        hooks = data.setdefault("hooks", {}).setdefault("UserPromptSubmit", [])
+        return _add_hook(hooks, codex_command, legacy_codex_commands,
+                         label="Antiphon bridge")
+
+    install(codex_target, codex_mutate,
+            "Codex hook installed", "Codex hook already installed")
+
+    # --- Codex side: push to Claude (Stop hook) ---
+    reverse_push_command = PUSH_COMMAND.format(target="claude")
+    legacy_reverse_push_commands = _legacy_commands(script, "it", "claude")
+
+    def reverse_push_mutate(data):
+        hooks = data.setdefault("hooks", {}).setdefault("Stop", [])
+        return _add_hook(hooks, reverse_push_command, legacy_reverse_push_commands)
+
+    install(codex_target, reverse_push_mutate,
+            "Push-to-Claude hook installed (Stop)",
+            "Push-to-Claude hook already installed")
+
+    # --- Codex side: the antiphon_read MCP tool (.codex/config.toml) ---
+    codex_config = os.path.join(cwd, ".codex", "config.toml")
+    written = _update_codex_config(codex_config, cwd)
+    print(f"{'✓' if written else '·'} Codex MCP tool "
+          f"{'registered' if written else 'already registered'}: {codex_config}")
+
+    # --- Claude Code MCP Channel ---
+    mcp_target = os.path.join(cwd, ".mcp.json")
+    channel_config = {
+        "command": "antiphon",
+        "args": ["channel"],
+        "env": {"ANTIPHON_CWD": cwd},
+    }
+
+    def mcp_mutate(data):
+        servers = data.setdefault("mcpServers", {})
+        if servers.get("antiphon") == channel_config:
+            return False
+        servers["antiphon"] = channel_config
+        return True
+
+    install(mcp_target, mcp_mutate,
+            "Claude MCP Channel registered", "Claude MCP Channel already registered")
+
+    # Claude Code may also keep .mcp.json servers in a local allowlist.
+    local_target = os.path.join(cwd, ".claude", "settings.local.json")
+
+    def local_mutate(data):
+        enabled = data.setdefault("enabledMcpjsonServers", [])
+        if "antiphon" in enabled:
+            return False
+        enabled.append("antiphon")
+        return True
+
+    install(local_target, local_mutate,
+            "Claude MCP local permission updated",
+            "Claude MCP local permission already up to date")
+
+    # --- AGENTS.md rule ---
+    agents = os.path.join(cwd, "AGENTS.md")
+    current = ""
+    if os.path.exists(agents):
+        with open(agents, encoding="utf-8") as f:
+            current = f.read()
+    new_text, status_word = _update_instructions(current, AGENTS_RULE)
+    if new_text != current:
+        with open(agents, "w", encoding="utf-8") as f:
+            f.write(new_text)
+    print(f"{'✓' if new_text != current else '·'} AGENTS.md rule {status_word}: {agents}")
+
+    # --- CLAUDE.md rule ---
+    claude_md = os.path.join(cwd, "CLAUDE.md")
+    current = ""
+    if os.path.exists(claude_md):
+        with open(claude_md, encoding="utf-8") as f:
+            current = f.read()
+    new_text, status_word = _update_instructions(current, CLAUDE_RULE)
+    if new_text != current:
+        with open(claude_md, "w", encoding="utf-8") as f:
+            f.write(new_text)
+    print(f"{'✓' if new_text != current else '·'} CLAUDE.md rule {status_word}: {claude_md}")
+
+    print("\n— One last step: Codex hooks need a one-time security approval.")
+    print("  Open `codex` in this directory; approve the hook at the 'New hook - review required' prompt.")
+    print("  Approval is granted once and then persists (it asks again only if the file changes).")
+    print("\n— Start Claude with the channel enabled:")
+    print("  claude --dangerously-load-development-channels server:antiphon")
+    print("  In the research preview, the first launch needs both a development channel and an MCP approval.")
+    if failures:
+        listed = "\n  ".join(failures)
+        print(f"\n✗ setup did not finish. {len(failures)} file(s) were left untouched "
+              f"because they could not be read:\n  {listed}\n"
+              "  Fix or move them, then run `antiphon setup` again.", file=sys.stderr)
+        return 1
+    return 0
+
+
+# ---------- status, for humans ----------
+
+def status():
+    cwd = project_dir()
+    print(f"project: {cwd}\n")
+    c = claude_transcripts(cwd)
+    x = codex_rollout_files(cwd)
+    print(f"Claude transcripts: {len(c)} files" + (f" (newest: {os.path.basename(c[0])})" if c else " — none"))
+    print(f"Codex rollouts:     {len(x)} files" + (f" (newest: {os.path.basename(x[0])})" if x else " — none"))
+    socket_path = claude_socket_path(cwd)
+    print(f"Claude channel:     {'live' if os.path.exists(socket_path) else 'down'} ({socket_path})")
+    cursor = read_cursor(cwd)
+    for k, v in (cursor or {}).items():
+        if k.endswith("_seen") and isinstance(v, (int, float)):
+            shown = datetime.fromtimestamp(v).strftime('%H:%M:%S') if v else '—'
+        else:
+            shown = truncate(str(v), 80) if v else '—'
+        print(f"cursor {k}: {shown}")
+    for side in ("claude", "codex"):
+        start = float((cursor or {}).get(f"{side}_seen") or (time.time() - LOOKBACK))
+        text, _, count = build_summary(cwd, side, start)
+        print(f"\n=== what {side} would see ===")
+        if count:
+            print(notice_text(side, count))
+        print(text or "(nothing new)")
+    return 0
+
+
+def print_summary(side="claude"):
+    cwd = project_dir()
+    text, _, _ = build_summary(cwd, side, time.time() - LOOKBACK)
+    print(text or "(nothing new)")
+    return 0
+
+
+COMMANDS = {
+    "setup": setup, "status": status, "hook": hook, "summary": print_summary,
+    "push": push, "reply": reply, "mcp": mcp,
+    # Legacy aliases for old local installs, kept during the transition period.
+    "kur": setup, "durum": status, "kanca": hook, "ozet": print_summary,
+    "it": push, "yanit": reply,
+}
+
+_CO_VARARGS = 0x04                    # CO_VARARGS, without importing inspect
+
+
+def _max_args(func):
+    """How many positional arguments a command takes (None means any)."""
+    if func.__code__.co_flags & _CO_VARARGS:
+        return None
+    return func.__code__.co_argcount
+
+
+if __name__ == "__main__":
+    command = sys.argv[1] if len(sys.argv) > 1 else "status"
+    func = COMMANDS.get(command)
+    if not func:
+        print(__doc__)
+        sys.exit(1)
+    args = sys.argv[2:]
+    limit = _max_args(func)
+    if limit is not None and len(args) > limit:
+        wanted = "no arguments" if limit == 0 else f"at most {limit} argument"
+        print(f"antiphon: `{command}` takes {wanted}, got {len(args)}: "
+              f"{' '.join(args)}", file=sys.stderr)
+        print("Run `antiphon` with no arguments to see the usage.", file=sys.stderr)
+        sys.exit(2)
+    sys.exit(func(*args) or 0)