dis-gravity 0.0.0-stage → 1.2.4

package/.gitlab-ci.yml

@@ -0,0 +1,9 @@
+pages:
+  stage: deploy
+  script:
+    - powershell -NoProfile -Command "if (Test-Path public) { Remove-Item -Recurse -Force public }; Copy-Item -Recurse -Force docs public"
+  artifacts:
+    paths:
+      - public
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

package/.mcpbignore

@@ -0,0 +1,20 @@
+node_modules/
+.git/
+.disgravity/
+*.vsix
+*.mcpb
+*.dxt
+*.bak
+docs/
+scratch/
+test/
+.vscodeignore
+.npmignore
+.npmrc
+.vsixmanifest
+media/*.gif
+media/*.mp4
+media/icon.png
+media/screenshot*.png
+bin/
+dist/

package/LICENSE.txt

@@ -0,0 +1,20 @@
+MIT License
+
+Copyright (c) 2026 sambath-rethinakumar
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,471 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<p align="center">
+  <img src="media/icon.png" width="140" alt="Dis-Gravity Logo" />
+</p>
+
+<h1 align="center">Dis-Gravity</h1>
+
+<p align="center">
+  <strong>Connect &amp; Control Your IDE from Mobile — The Ultimate Multi-IDE Discord Remote Bridge</strong>
+</p>
+
+<p align="center">
+  <a href="#supported-ides--environments"><img src="https://img.shields.io/badge/Supports-Antigravity%20%7C%20VS%20Code%20%7C%20Cursor%20%7C%20Windsurf%20%7C%20JetBrains-blueviolet?style=flat-square" alt="Supported IDEs"></a>
+  <a href="https://www.npmjs.com/package/dis-gravity"><img src="https://img.shields.io/npm/v/dis-gravity?style=flat-square&color=cb3837&logo=npm" alt="npm version"></a>
+  <a href="#installation"><img src="https://img.shields.io/badge/VS%20Code-v1.93+-007acc?style=flat-square&logo=visualstudiocode" alt="VS Code Version"></a>
+  <a href="LICENSE.txt"><img src="https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square" alt="MIT License"></a>
+  <a href="https://discord.com"><img src="https://img.shields.io/badge/Discord-discord.js%20v14-5865F2?style=flat-square&logo=discord" alt="Discord.js"></a>
+</p>
+
+---
+
+> **Connect your IDE to mobile and control VS Code, Google Antigravity, and Cursor directly from Discord.**
+> Approve AI agent tool executions in 38ms, inspect real-time streaming steps, run terminal commands, view colored git diffs, download artifacts, and control your development workspace from your phone with **zero inbound open ports**.
+
+---
+
+<p align="center">
+  <img src="media/dis-gravity-demo.gif" width="860" alt="Dis-Gravity live 2X split-screen demo: connecting and controlling desktop IDE from mobile Discord in 38 milliseconds" />
+</p>
+
+---
+
+## 📱 How Can I Connect My IDE to Mobile?
+
+Connecting your desktop IDE (VS Code, Google Antigravity, Cursor, Windsurf) to your iOS or Android phone takes under 90 seconds with Dis-Gravity:
+
+1. **Launch Dis-Gravity on your desktop**:
+   Run the zero-install CLI daemon or install the extension (`.vsix`) in your IDE:
+   ```bash
+   npx dis-gravity@latest
+   ```
+2. **Connect your private Discord bot**:
+   Run the frictionless setup wizard and paste your bot token. Dis-Gravity automatically enables Gateway Message Content intent, configures permissions, and provisions a secure channel:
+   ```bash
+   dis-gravity setup
+   ```
+3. **Open Discord on your mobile phone**:
+   Open Discord on your iOS or Android phone. Your IDE is now fully connected to mobile! You can approve prompts in 38ms, run terminal commands, and stream AI coding thoughts on the go with **zero inbound open ports**.
+
+---
+
+## 🎮 How to Control IDE with Mobile
+
+Once your IDE is connected to mobile via Dis-Gravity, you have full remote control:
+
+* **⚡ 1-Tap 38ms AI Approvals**: When an AI agent prompts for terminal or file permission, tap the interactive Discord button on your phone to inject a native DOM click via Chrome DevTools Protocol (CDP) in 38ms.
+* **💻 Remote Mobile Terminal**: Type `/sh pytest`, `/sh npm test`, or `/sh git status` in your mobile Discord chat to run shell commands in your host IDE with real-time output.
+* **📡 In-Place Step Streaming**: Watch AI reasoning, file inspections, and edits update live inside a single Discord embed card without mobile notification spam.
+* **🖼️ 2x Retina Visual Cards**: Inspect high-DPI rendered PNG cards of markdown tables and colorized git diffs directly on mobile screens.
+* **🔄 Multi-IDE Switching**: Control Google Antigravity, VS Code with Copilot, Cursor AI, Windsurf, or Claude Desktop interchangeably.
+
+---
+
+## 📑 Table of Contents
+
+- [📱 How Can I Connect My IDE to Mobile?](#-how-can-i-connect-my-ide-to-mobile)
+- [🎮 How to Control IDE with Mobile](#-how-to-control-ide-with-mobile)
+- [Supported IDEs & Environments](#supported-ides--environments)
+- [📦 Installation](#-installation)
+  - [Option 1: Instant via npx (Zero Install)](#option-1-instant-via-npx-zero-install)
+  - [Option 2: Install Global CLI via npm](#option-2-install-global-cli-via-npm)
+  - [Option 3: Install VS Code / Antigravity Extension (.vsix)](#option-3-install-vs-code--antigravity-extension-vsix)
+  - [Option 4: Install Claude Desktop Extension (.mcpb / .dxt)](#option-4-install-claude-desktop-extension-mcpb--dxt)
+  - [Option 5: Build .vsix or .mcpb from Source](#option-5-build-vsix-or-mcpb-from-source)
+- [🚀 3-Minute Quickstart Guide](#-3-minute-quickstart-guide)
+  - [Step 1: Create Your Discord Bot](#step-1-create-your-discord-bot)
+  - [Step 2: Invite the Bot to Your Server](#step-2-invite-the-bot-to-your-server)
+  - [Step 3: Retrieve Channel ID & User ID](#step-3-retrieve-channel-id--user-id)
+  - [Step 4: Configure Dis-Gravity in Your IDE](#step-4-configure-dis-gravity-in-your-ide)
+- [Connecting Your Specific IDE](#connecting-your-specific-ide)
+  - [1. Visual Studio Code & GitHub Copilot (Zero Port Required)](#1-visual-studio-code--github-copilot-zero-port-required)
+  - [2. Google Antigravity, Cursor AI & Windsurf (Port 9000)](#2-google-antigravity-cursor-ai--windsurf-port-9000)
+  - [3. JetBrains, Neovim & Headless Servers (Standalone CLI Daemon)](#3-jetbrains-neovim--headless-servers-standalone-cli-daemon)
+  - [4. Claude Desktop & Claude Code (Model Context Protocol / MCP)](#4-claude-desktop--claude-code-model-context-protocol--mcp)
+- [🛡️ Security Best Practices (`allowedUsers`)](#️-security-best-practices-allowedusers)
+- [🌟 Key Features](#-key-features)
+- [⌨️ Slash Commands & Text Shortcuts](#️-slash-commands--text-shortcuts)
+- [⚙️ Configuration Reference](#️-configuration-reference)
+- [❓ Troubleshooting & FAQ](#-troubleshooting--faq)
+- [📄 License](#-license)
+
+---
+
+## Supported IDEs & Environments
+
+| IDE / Environment | Provider Mode (`agentProvider`) | Connection Type | Autonomous Tools |
+|---|---|---|---|
+| **Google Antigravity** | `antigravity` or `auto` | CDP (`:9000`) | Native IDE Agent + Approval Dialogs + Lexical Mode Chips |
+| **VS Code + GitHub Copilot** | `copilot` or `auto` | Native `vscode.lm` | Autonomous ReAct Loop (`view`, `edit`, `sh`, `git`, `tree`) |
+| **Cursor AI** | `cursor` or `auto` | CDP (`:9000`) | Composer & Chat (`/plan`, `/edit`, `@Codebase`) |
+| **Windsurf** | `windsurf` or `auto` | CDP (`:9000`) | Cascade Chat Webview with deep iframe traversal |
+| **Claude Desktop & Claude Code** | `mcp` (`mcp/server.js`) | Model Context Protocol (`stdio`) | Interactive Discord Approval Buttons (`allow`/`deny`), Notifications, Bridge Status |
+| **JetBrains / Neovim / Headless** | `cli` (`bin/dis-gravity.js`) | Subprocess / PTY | Universal CLI (`agy`, `claude`, `aider`, `shell`) |
+
+---
+
+## 📦 Installation
+
+Choose the setup that best fits your workflow:
+
+### Option 1: Instant via npx (Zero Install)
+Run the standalone Dis-Gravity CLI daemon directly from npm without installing:
+
+```bash
+npx dis-gravity --token="YOUR_BOT_TOKEN" --channel="YOUR_CHANNEL_ID" --provider="cli"
+```
+
+### Option 2: Install Global CLI via npm
+Install the `dis-gravity` command globally on your machine:
+
+```bash
+npm install -g dis-gravity
+dis-gravity --help
+```
+
+### Option 3: Install VS Code / Antigravity Extension (.vsix)
+1. Download `dis-gravity-1.2.3.vsix` from [GitLab Releases](https://gitlab.com/rethinakumarsambath8/dis-gravity/-/releases) or the root of this repository.
+2. In VS Code or Google Antigravity IDE:
+   - Press `Ctrl+Shift+P` (or `Cmd+Shift+P` on macOS).
+   - Type **Extensions: Install from VSIX...** and select `dis-gravity-1.2.3.vsix`.
+
+### Option 4: Install Claude Desktop Extension (.mcpb / .dxt)
+Dis-Gravity packages as a native **Anthropic Model Context Protocol Bundle** (`.mcpb`) and legacy DXT archive (`.dxt`):
+
+1. Download `dis-gravity-1.2.3.mcpb` (or `dis-gravity-1.2.3.dxt`) from [GitLab Releases](https://gitlab.com/rethinakumarsambath8/dis-gravity/-/releases).
+2. In **Claude Desktop**:
+   - Double-click `dis-gravity-1.2.3.mcpb` or go to **Settings** → **Extensions** → **Install Extension...** and select the file.
+   - Enter your `bot_token`, `channel_id`, and optional `allowed_users` in the configuration panel.
+3. For **Claude Code CLI**, connect directly via stdio:
+```bash
+claude mcp add dis-gravity node /path/to/Dis-Gravity/mcp/server.js \
+  -e DISCORD_BOT_TOKEN="YOUR_BOT_TOKEN" \
+  -e DISCORD_CHANNEL_ID="YOUR_CHANNEL_ID" \
+  -e ALLOWED_USERS="YOUR_DISCORD_USER_ID"
+```
+
+### Option 5: Build .vsix or .mcpb from Source
+```bash
+git clone https://gitlab.com/rethinakumarsambath8/dis-gravity.git
+cd Dis-Gravity
+npm install
+
+# Build VS Code .vsix package:
+npm run package
+
+# Build Claude Desktop .mcpb & .dxt bundles:
+npm run package:mcpb
+```
+*(The production extension and CLI bundles are pre-compiled and self-contained; packaging produces `dis-gravity-1.2.0.vsix` immediately).*
+
+---
+
+## ⚡ 60-Second Frictionless Setup Wizard (Recommended)
+
+Dis-Gravity automates all tedious Discord developer configurations—Message Content intents, OAuth2 permissions, private `#dis-gravity` channel creation, owner whitelisting, and secure secret storage—in **under 90 seconds**. You only do **one manual thing**: paste your Discord bot token.
+
+### For VS Code, Google Antigravity IDE & Cursor (Extension)
+1. Open the Command Palette (`Ctrl+Shift+P` / `Cmd+Shift+P`).
+2. Run **`Dis-Gravity: Run Setup Wizard`** (or click **⚡ Launch Setup Wizard** in the Dis-Gravity sidebar).
+3. Paste your Discord bot token.
+4. The wizard automatically enables **Message Content Intent** via Discord API, generates your invite link, configures a private locked `#dis-gravity` channel, whitelists your user ID, and connects securely via `SecretStorage`.
+
+### For Standalone CLI, JetBrains, Neovim & Headless (CLI)
+Run the interactive CLI wizard in any terminal:
+```bash
+npx dis-gravity setup
+```
+Dis-Gravity will inspect your bot, auto-enable intents, open the browser for server authorization, create `#dis-gravity`, and save credentials to `~/.dis-gravity/config.json` with strict `0600` permissions.
+
+<details>
+<summary><b>🛠️ Manual Setup Guide (Click to expand)</b></summary>
+
+### Step 1: Create Your Discord Bot
+
+1. Open the **[Discord Developer Portal](https://discord.com/developers/applications)** and sign in.
+2. Click **New Application** (top right), enter `Dis-Gravity` (or your preferred name), and click **Create**.
+3. In the left navigation, select **Bot**:
+   - Under **Build-A-Bot**, click **Reset Token** and copy the **Bot Token** (keep this secret!).
+4. Scroll down to **Privileged Gateway Intents**:
+   > [!IMPORTANT]
+   > You **MUST** turn ON the following intents, otherwise Discord will silently drop message text and your bot will fail to process chat commands:
+   - ✅ **MESSAGE CONTENT INTENT** *(Required to read messages and slash prompts)*
+   - ✅ **SERVER MEMBERS INTENT** *(Recommended for user whitelist lookups)*
+5. Click **Save Changes**.
+
+---
+
+### Step 2: Invite the Bot to Your Server
+
+1. In the left navigation, go to **OAuth2** → **OAuth2 URL Generator**.
+2. Under **Scopes**, select:
+   - ✅ `bot`
+   - ✅ `applications.commands` *(Required for native slash commands `/`)*
+3. Under **Bot Permissions**, select:
+   - ✅ `Send Messages`
+   - ✅ `Create Public Threads`
+   - ✅ `Send Messages in Threads`
+   - ✅ `Embed Links`
+   - ✅ `Attach Files`
+   - ✅ `Read Message History`
+   - ✅ `Use Slash Commands`
+4. Copy the generated **OAuth2 URL** at the bottom, paste it into your browser, choose your server, and click **Authorize**.
+
+---
+
+### Step 3: Retrieve Channel ID & User ID
+
+1. In Discord, go to **User Settings** (⚙️ bottom left) → **Advanced** → turn **ON** **Developer Mode**.
+2. Right-click the channel where you want Dis-Gravity to chat → click **Copy Channel ID**.
+3. Right-click your own avatar/profile in the chat → click **Copy User ID** (used for security access control).
+
+---
+
+### Step 4: Configure Dis-Gravity in Your IDE
+
+1. Open VS Code or Antigravity IDE with the Dis-Gravity extension installed.
+2. Click the **Discord** icon in the Activity Bar (left sidebar) to open Dis-Gravity settings.
+3. Fill in the fields:
+   - **Bot Token**: Paste the token from Step 1.
+   - **Channel ID**: Paste the Channel ID from Step 3.
+   - **Allowed Users**: Paste your Discord User ID from Step 3.
+   - **Agent Provider**: Choose `auto` (or `copilot`, `antigravity`, `cursor`, `windsurf`, `cli`).
+4. Click **Save Settings** or reload your window (`Developer: Reload Window`). Both status dots will turn green:
+   - 🟢 **Discord: Connected**
+   - 🟢 **CDP / Agent: Connected**
+
+</details>
+
+---
+
+## Connecting Your Specific IDE
+
+### 1. Visual Studio Code & GitHub Copilot (Zero Port Required)
+
+If you are using standard Visual Studio Code with GitHub Copilot Chat:
+1. In settings, set `antigravity-discord.agentProvider` to `"copilot"`.
+2. **Zero debug port is needed!** Dis-Gravity communicates directly via VS Code's native Language Model API (`vscode.lm`).
+3. Dis-Gravity automatically activates an **autonomous ReAct tool loop** supporting `view_file`, `edit_file`, `run_command`, and `git_diff` with live step streaming and Discord confirmation buttons (`[ 🟢 Allow ]`, `[ 🔴 Deny ]`) for sensitive changes.
+
+---
+
+### 2. Google Antigravity, Cursor AI & Windsurf (Port 9000)
+
+These IDEs drive agent chat via Chrome DevTools Protocol (CDP) and require launching the application with `--remote-debugging-port=9000`.
+
+#### **Windows**
+1. Right-click your desktop shortcut for Antigravity / Cursor / Windsurf → select **Properties**.
+2. In the **Target** box, append ` --remote-debugging-port=9000` to the end of the path:
+   ```text
+   "C:\Users\...\AppData\Local\Programs\Antigravity\Antigravity.exe" --remote-debugging-port=9000
+   ```
+3. Click **Apply** and launch the IDE from this shortcut.
+
+#### **macOS**
+Launch via Terminal or save a shell script / Automator app:
+```bash
+# Google Antigravity
+open -a "Google Antigravity" --args --remote-debugging-port=9000
+
+# Cursor
+open -a "Cursor" --args --remote-debugging-port=9000
+
+# Windsurf
+open -a "Windsurf" --args --remote-debugging-port=9000
+```
+
+#### **Linux**
+```bash
+antigravity --remote-debugging-port=9000
+# or cursor --remote-debugging-port=9000
+```
+
+---
+
+### 3. JetBrains, Neovim & Headless Servers (Standalone CLI Daemon)
+
+Dis-Gravity includes a standalone, editor-agnostic daemon that runs in any terminal or remote SSH session:
+
+```bash
+# Run instantly with npx:
+npx dis-gravity --token="YOUR_BOT_TOKEN" --channel="CHANNEL_ID" --workspace="." --allowed-users="YOUR_USER_ID"
+
+# Or run globally via npm:
+npm install -g dis-gravity
+dis-gravity --token="YOUR_BOT_TOKEN" --channel="CHANNEL_ID" --provider="cli"
+```
+
+**CLI Daemon Flags:**
+- `--token`, `-t`: Discord Bot Token (or `DISCORD_BOT_TOKEN` env var)
+- `--channel`, `-c`: Discord Channel ID (or `DISCORD_CHANNEL_ID` env var)
+- `--guild`, `-g`: Discord Guild ID for instant slash command registration
+- `--allowed-users`, `-u`: Comma-separated Discord User IDs allowed to issue commands
+- `--provider`, `-p`: AI engine (`cli`, `antigravity`, `cursor`, `windsurf`)
+- `--workspace`, `-w`: Path to root workspace directory (defaults to current working directory)
+- `--table-style`: Tabular style (`image`, `cards`, `rounded`, `boxed`, `ascii`)
+- `--port`: Remote debugging CDP port (defaults to `9000`)
+
+---
+
+### 4. Claude Desktop & Claude Code (Model Context Protocol / MCP)
+
+Dis-Gravity provides a native MCP server (`mcp/server.js`) and Anthropic MCP bundle (`.mcpb` / `.dxt`). It allows Claude Desktop and Claude Code agents to proactively request approval directly on mobile Discord before running critical tools, as well as sending notifications to your channel:
+
+- **`ask_discord_approval`**: Sends an interactive Discord embed with `[ 🟢 Allow ]` and `[ 🔴 Deny ]` buttons directly to your phone. Claude waits in real-time until you tap a button or timeout expires.
+- **`notify_discord`**: Streams status updates, alerts, or completed agent summaries to your Discord channel.
+- **`get_discord_bridge_status`**: Inspects Discord gateway latency, connected channel ID, and active permissions.
+
+**Using with Claude Desktop:**
+Double-click `dis-gravity-1.2.0.mcpb` to install the extension automatically, or configure your `claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "dis-gravity": {
+      "command": "node",
+      "args": ["/path/to/Dis-Gravity/mcp/server.js"],
+      "env": {
+        "DISCORD_BOT_TOKEN": "YOUR_BOT_TOKEN",
+        "DISCORD_CHANNEL_ID": "YOUR_CHANNEL_ID",
+        "ALLOWED_USERS": "YOUR_DISCORD_USER_ID"
+      }
+    }
+  }
+}
+```
+
+---
+
+## 🛡️ Security Best Practices & Architecture (`allowedUsers`)
+
+> [!CAUTION]
+> **Never connect Dis-Gravity to a public or multi-user Discord channel without configuring `allowedUsers`!**
+
+Dis-Gravity is engineered for high-security, privacy-conscious developer workflows with a **zero-inbound-ports threat model**:
+
+- **🔒 Zero Inbound Listening Ports:** Operates 100% via outbound TLS WebSocket connections (`wss://gateway.discord.gg`). No open ports on your router, no port forwarding, no ngrok tunnels, and zero public IP exposure.
+- **🛑 Strict Fail-Closed Authorization:** Every command, shortcut, and button click is verified against `allowedUsers` (`isUserAllowed`). Unlisted users are rejected immediately with an audit log.
+- **🌐 Localhost-Only CDP Isolation:** Chrome DevTools Protocol connections for Google Antigravity, Cursor AI, and Windsurf are strictly bound to local loopback (`127.0.0.1:9000`) and never exposed to the network.
+- **📂 Path Traversal Containment:** All filesystem operations (`/cat`, `/open`, `/diff`, `/tree`) pass through `safeResolveWorkspacePath` to prevent directory traversal outside workspace boundaries.
+- **🔐 Local Credential Storage:** Bot tokens are stored locally in `~/.dis-gravity/config.json` with restricted file permissions (`0o600`). Dis-Gravity transmits zero telemetry to third-party servers.
+
+For comprehensive threat model details, comparative security analysis, and vulnerability disclosure policies, see **[SECURITY.md](SECURITY.md)**.
+
+1. **Always configure `allowedUsers`**: Enter your Discord User ID (e.g. `123456789012345678`). Multiple authorized users can be separated by commas (`123456789,987654321`). Unauthorized users and unconfigured environments receive an explicit rejection notice.
+2. **Use a Private Channel**: Dedicate a private Discord text channel accessible only to you and the bot.
+3. **Interactive Approvals**: File modifications and terminal executions in Copilot / CLI modes prompt you with interactive `[ 🟢 Allow ]` and `[ 🔴 Deny ]` buttons before changes take effect.
+
+---
+
+## 🌟 Key Features
+
+### 🖼️ High-Resolution Visual Table Image Cards (`/table`, `!table`)
+Discord mobile apps suffer from a notorious line-wrapping bug that scrambles monospaced ASCII tables into unreadable text blocks. Dis-Gravity dynamically converts Markdown tables into **high-resolution 2x retina PNG cards** rendered natively in Discord messages, complete with dark theme styling, zebra rows, bold headers, colored status chips (`#57f287` green, `#fee75c` yellow, `#ed4245` red), full-color emojis, and pinch-to-zoom support. Features headless browser fallback (`msedge`/`chrome`) for environments without CDP ports.
+
+### 🎮 1-Click Command Palette (`/palette`, `/action`)
+Execute any of VS Code's 1,000+ commands remotely from your phone with 1 tap. Pre-built buttons across Developer (Reload Window, Restart Extension Host), Terminal (New, Toggle, Kill), Files (Save All, Close All), and Git (Sync, Pull, Push), plus live autocomplete search for any IDE command.
+
+### 💻 Remote Shell & Git Suite (`/sh`, `/git`, `/diff`)
+Execute terminal commands in your workspace root (`/sh npm test`), inspect syntax-highlighted stdout/stderr with exit codes and execution duration, review git status (`/git status`), browse colored unified diffs (`/diff`), stage all changes, and export `.patch` files.
+
+### 📁 Remote File Explorer & Slicer (`/cat`, `/tree`, `/open`)
+Read files with syntax highlighting and line numbers (`/cat src/index.js 1 50`), inspect visual directory trees (`/tree src 2`), or open files directly in your desktop IDE editor tabs remotely (`/open README.md`).
+
+### 📦 Artifact Discovery & Download (`/artifact`, `/get`)
+Browse and download AI-generated walkthroughs, architectural plans, patch files, diagrams, or workspace assets directly in Discord with interactive dropdown menus and path-traversal security protection.
+
+### ⏳ Live Step Streaming & Observability
+Replaces static wait timers with real-time DOM step updates: `⏳ Working (18s): 🔍 Viewing file package.json`, `⚡ Running command npm test`, `💭 Thinking...`.
+
+### 🖥️ Host Health & Workspace Dashboard (`/info`, `/workspace`)
+Check active workspace, git branch, dirty file count, open editor tabs, host OS, CPU load, memory utilization, and uptime directly from chat.
+
+### ⏰ Scheduled & Cron Prompts (`/schedule`, `!schedule`)
+Schedule one-shot delayed prompts (`15m`, `2h`, `in 30m`), recurring intervals (`every 30m`, `@hourly`, `@daily`), or standard 5-field cron expressions (`0 9 * * 1-5`, `*/15 * * * *`) directly from Discord. Automatically triggers AI prompts or `/sh` commands at the scheduled time with 1-tap `[ 🛑 Cancel ]` buttons.
+
+### 🧵 Thread-per-Session & Multi-Workspace Mapping (`/bind`, `/threads`)
+Bind individual Discord threads to dedicated local project directories (`/bind workspace:/path/to/repo`) so `/sh`, `/git`, `/diff`, `/cat`, `/tree`, and AI prompts inside each thread execute isolated against that thread's bound workspace without colliding.
+
+### 🎙️ Mobile Voice Messages & Voicecoding
+Send a native Discord mobile voice message (or audio attachment `.ogg`, `.mp3`, `.wav`, `.m4a`) in your channel or thread. Dis-Gravity automatically transcribes your voice prompt using OpenAI/Groq Whisper API (`OPENAI_API_KEY` / `GROQ_API_KEY` / `antigravity-discord.whisperApiKey`), local Whisper CLI (`whisper-cli` / `whisper`), or Windows native `System.Speech`, posts the transcription, and executes the prompt or command hands-free.
+
+---
+
+## ⌨️ Slash Commands & Text Shortcuts
+
+| Command | Chat Shortcut | Description |
+|---|---|---|
+| `/home` | `!home`, `!dash` | Dis-Gravity Mission Control Cockpit (1-tap remote dashboard) |
+| `/plan <prompt>` | `!plan <prompt>` | Activates Planning Mode with auto-thread isolation & chip |
+| `/goal <prompt>` | `!goal <prompt>` | Activates Goal Mode with autonomous execution instructions |
+| `/grill <prompt>` | `!grill <prompt>` | Activates Alignment Interview mode |
+| `/sh <cmd>` | `!sh <cmd>` or `$ <cmd>` | Execute shell command with contextual follow-up action buttons |
+| `/git [status\|diff\|log]` | `!git [subcommand]` | Remote Git repository management |
+| `/diff [file] [staged]` | `!diff` | 2x Retina Visual Diff card with 1-tap Stage/Push/Review |
+| `/cat <path> [start] [end]` | `!cat <path>` | Read file contents with syntax highlighting |
+| `/tree [dir] [depth]` | `!tree` | Visual workspace directory tree |
+| `/open <path>` | `!open <path>` | Open file in active desktop IDE editor tab |
+| `/palette [category]` | `!palette` | 1-click command palette dashboard |
+| `/action <command>` | `!run <id>` | Trigger any IDE command with live autocomplete |
+| `/info` | `!info`, `!workspace` | Host hardware, CPU, memory & workspace health |
+| `/status` | `!status` | Bridge connection status, model & queue health |
+| `/models` | `!models` | Interactive AI model selector dropdown |
+| `/effort <level>` | `!effort <level>`, `!high` | Reasoning effort switcher (Low, Medium, High) |
+| `/table [style]` | `!table [style]` | Tabular style switcher (`image`, `cards`, `rounded`, `boxed`, `ascii`) |
+| `/artifact [name]` | `!artifact` | Browse and download AI-generated artifacts |
+| `/get <path>` | `!get <path>` | Download file from workspace or brain directory |
+| `/stop` | `!stop`, `cancel` | Emergency abort running AI generation |
+| `/new` | `!new` | Clear conversation history and reset context |
+| `/schedule <when> [prompt]` | `!schedule <spec> \| <prompt>` | Schedule one-shot delays (`15m`), intervals (`every 1h`), or cron tasks (`0 9 * * 1-5`) |
+| `/bind [workspace]` | `!bind [path\|unbind]` | Bind current Discord thread to a dedicated project directory |
+| `/threads` | `!threads` | List all active Discord thread-to-workspace bindings |
+| `/help` | `!help` | Display command help guide |
+
+---
+
+## ⚙️ Configuration Reference
+
+Configure via VS Code Settings GUI or in `.vscode/settings.json`:
+
+```json
+{
+  "antigravity-discord.botToken": "YOUR_DISCORD_BOT_TOKEN",
+  "antigravity-discord.channelId": "YOUR_DISCORD_CHANNEL_ID",
+  "antigravity-discord.allowedUsers": "123456789012345678",
+  "antigravity-discord.agentProvider": "auto",
+  "antigravity-discord.tableStyle": "image",
+  "antigravity-discord.autoAttachTableImages": true,
+  "antigravity-discord.debugPort": 9000,
+  "antigravity-discord.cursorPort": 9000,
+  "antigravity-discord.windsurfPort": 9000,
+  "antigravity-discord.cliAgentPath": "auto",
+  "antigravity-discord.enableCopilotReAct": true,
+  "antigravity-discord.copilotMaxToolSteps": 10,
+  "antigravity-discord.renderVisualDiffs": true,
+  "antigravity-discord.autoThreadTasks": true,
+  "antigravity-discord.voiceConfirmationGuard": true,
+  "antigravity-discord.urgentMentionOnApproval": true
+}
+```
+
+---
+
+## ❓ Troubleshooting & FAQ
+
+#### 1. "The bot is online in Discord, but it doesn't respond to messages."
+- **Root Cause**: The **Message Content Intent** is disabled in the Discord Developer Portal.
+- **Fix**: Go to [Discord Developer Portal](https://discord.com/developers/applications) → select your Application → **Bot** tab → under **Privileged Gateway Intents**, turn **ON** **MESSAGE CONTENT INTENT** → click **Save Changes**.
+
+#### 2. "Bridge Status shows 🔴 Disconnected."
+- **If using Antigravity, Cursor, or Windsurf**: Launch the IDE with `--remote-debugging-port=9000` (see instructions [above](#2-google-antigravity-cursor-ai--windsurf-port-9000)).
+- **If using standard VS Code**: Change `antigravity-discord.agentProvider` to `"copilot"` in settings. It connects natively via `vscode.lm` with zero ports required.
+
+#### 3. "I received `⛔ Unauthorized: Your Discord User ID is not on the whitelist`."
+- Right-click your profile in Discord → click **Copy User ID**. Open Dis-Gravity settings in the IDE and paste your User ID into **Allowed Users**.
+
+#### 4. "My table columns are wrapping into a jumble on my mobile phone."
+- Run `/table image` or `!table image` in Discord. Dis-Gravity will automatically render tables into high-DPI visual PNG image cards that display cleanly without text wrapping on any screen size.
+
+---
+
+## 📄 License
+
+MIT © [Anon King](https://gitlab.com/rethinakumarsambath8/dis-gravity)

package/SECURITY.md

@@ -0,0 +1,105 @@
+# Dis-Gravity Security Policy & Architecture
+
+Dis-Gravity is designed from the ground up for high-security, privacy-conscious developer workflows. When connecting an IDE and agentic coding environment to an external messaging platform like Discord, execution boundaries, credential handling, and network isolation are critical.
+
+This document outlines Dis-Gravity's threat model, security architecture, fail-closed authorization, and responsible disclosure policy.
+
+---
+
+## 🛡️ Core Security Architecture
+
+```
+┌────────────────────────────────────────────────────────────────────────┐
+│                        DEVELOPER LOCAL MACHINE                         │
+│                                                                        │
+│  ┌─────────────────────────┐          ┌─────────────────────────────┐  │
+│  │   Desktop IDE / Agent   │          │     Dis-Gravity Engine      │  │
+│  │ (Antigravity / Cursor / │◄── CDP ──┤  - Snowflake Allowlist      │  │
+│  │   VS Code / Windsurf)   │:9000     │  - Path Traversal Guard     │  │
+│  └─────────────────────────┘(local)   │  - Shell Buffer Limits      │  │
+│                                       └──────────────┬──────────────┘  │
+│                                                      │                 │
+│                                        Outbound TLS  │ (ZERO INBOUND   │
+│                                        WebSocket WSS │  OPEN PORTS)    │
+└──────────────────────────────────────────────────────┼─────────────────┘
+                                                       │
+                                                       ▼
+                                            ┌─────────────────────┐
+                                            │   Discord Gateway   │
+                                            │  (discord.gg / API) │
+                                            └──────────┬──────────┘
+                                                       │
+                                                       ▼
+                                            ┌─────────────────────┐
+                                            │ Mobile Discord App  │
+                                            │  (Authorized User)  │
+                                            └─────────────────────┘
+```
+
+### 1. Zero Inbound Listening Ports
+* **Outbound-Only Ingress:** Dis-Gravity establishes a persistent, TLS-encrypted outbound WebSocket connection (`wss://gateway.discord.gg`) to the Discord Gateway.
+* **No Open Ports on WAN:** Dis-Gravity **never** opens an inbound TCP/UDP port on your host router or public network. It does not require port forwarding, ngrok tunnels, reverse proxies, or dynamic DNS.
+* **Attack Surface Reduction:** External port scanners, automated botnets, and local network peers cannot probe or connect to Dis-Gravity because there is no listening network socket.
+
+### 2. Strict Fail-Closed Authorization (`allowedUsers`)
+* **Snowflake ID Verification:** Every incoming interaction (slash commands, text shortcuts, button clicks, modal submissions, thread creations) is verified against `allowedUsers` in `lib/core.js` (`isUserAllowed`).
+* **Fail-Closed Default:** If `allowedUsers` is empty, unconfigured, or contains an unverified ID, access is **strictly denied immediately**. The command is dropped and never reaches the shell or the IDE.
+* **Channel Partitioning:** During onboarding (`dis-gravity setup`), Dis-Gravity automatically configures strict channel permission overwrites, hiding the bot control channel from `@everyone` and granting access solely to your specific user account.
+
+### 3. Localhost-Only CDP Isolation (Chrome DevTools Protocol)
+* **Loopback Binding Only:** For IDEs that utilize Chrome DevTools Protocol (Google Antigravity, Cursor AI, Windsurf), Dis-Gravity communicates strictly over local loopback (`127.0.0.1:9000`).
+* **No Remote CDP Exposure:** CDP is never bridged over the network. Only the local Dis-Gravity process running on the host machine connects to the IDE's debugging port.
+* **Deterministic Native Clicks:** Approvals (such as "Always Allow" or "Allow Once") are resolved through precise DOM inspection and native mouse click injection. Dis-Gravity never executes arbitrary scripts inside the IDE's webview sandbox.
+
+### 4. Filesystem Boundary & Path Traversal Containment
+* **Safe Path Resolution:** All filesystem inspection commands (`/cat`, `/open`, `/diff`, `/tree`, `/get`) pass through `safeResolveWorkspacePath(workspaceRoot, targetPath)`.
+* **Escaped Path Rejection:** If a relative path or symlink attempts to traverse outside the bounded workspace directory (e.g., `../../etc/passwd` or `..\\Windows\\System32`), Dis-Gravity throws an explicit error and rejects the request.
+* **Thread-Bound Sandboxes:** When using thread-to-workspace mapping (`/bind`), commands executed in that thread are strictly anchored to the assigned directory.
+
+### 5. Safe Shell Subprocess Execution
+* **Hard Timeouts:** Shell commands dispatched via `/sh` or `!sh` are governed by a strict timeout (default: 30 seconds) to prevent runaway or hanging processes.
+* **Buffer Overflow Prevention:** Subprocess outputs are capped at a maximum buffer of 10 MB (`maxBuffer`) to prevent memory exhaustion and denial-of-service on the host machine.
+* **Destructive Keyword Warnings:** Dis-Gravity heuristics detect dangerous operations (`rm -rf`, `mkfs`, `format`, `dd`) and require explicit interactive confirmation before execution.
+
+### 6. Local Credential Isolation
+* **Local Storage Only:** Your Discord bot token and preferences are stored locally on your machine at `~/.dis-gravity/config.json`.
+* **Strict File Permissions:** Configuration files are saved with restricted filesystem permissions (`0o600`).
+* **Zero External Telemetry:** Dis-Gravity does **not** transmit your bot tokens, workspace code, command histories, diffs, or prompts to any external third-party analytics, metrics, or telemetry servers.
+
+---
+
+## 🔍 Comparison: Dis-Gravity vs. Insecure Bridge Architectures
+
+| Security Vector | Insecure / Unaudited Bridges | Dis-Gravity Architecture |
+|---|---|---|
+| **Installation Hooks** | Risky npm `postinstall` scripts that download remote binaries or patch system files | **Zero postinstall scripts.** Pure npm/VS Code standard extension packaging. |
+| **Network Ingress** | Exposes HTTP webhooks, ngrok tunnels, or open WAN ports | **Zero inbound open ports.** 100% outbound TLS WebSocket via Discord.js Gateway. |
+| **User Authorization** | Checks username strings or allows any user in the Discord server | **Fail-closed Discord snowflake ID check.** Cryptographically unforgeable user ID. |
+| **Filesystem Access** | Unrestricted `fs.readFile` allowing full disk access | **`safeResolveWorkspacePath`** strictly enforces directory boundaries. |
+| **Code Execution** | Unchecked background auto-execution | **Explicit 1-tap interactive approvals**; dangerous commands flagged before running. |
+| **Telemetry & Leaks** | Sends tokens or telemetry to creator's backend | **Zero third-party telemetry.** All communication stays strictly between you and Discord. |
+
+---
+
+## ⚙️ Recommended Security Practices for Users
+
+1. **Keep Your Bot Private:** When creating your bot in the [Discord Developer Portal](https://discord.com/developers/applications), ensure **"Public Bot"** is unchecked so third parties cannot invite your bot to other servers.
+2. **Restrict Bot Intents:** Dis-Gravity only requires **Message Content Intent** to process your typed commands and voice messages. It does not require Server Members Intent or Presence Intent.
+3. **Use Dedicated Channels:** Create a private server or private channel accessible only to you. Do not run Dis-Gravity in shared public Discord channels.
+4. **Never Commit Your Bot Token:** Keep your Discord bot token strictly in `~/.dis-gravity/config.json` or as an environment variable (`DISGRAVITY_BOT_TOKEN`). Never commit it to git repositories.
+
+---
+
+## 🚨 Reporting a Vulnerability
+
+We take the security of Dis-Gravity seriously. If you discover a security vulnerability, please do **not** open a public issue.
+
+Instead, please report it via one of the following confidential channels:
+* **Private GitLab Vulnerability Report:** Submit a confidential vulnerability advisory through [Dis-Gravity Security Advisories](https://gitlab.com/rethinakumarsambath8/dis-gravity/-/security/advisories/new).
+* **Direct Email:** Send an encrypted email with reproduction steps to `rethinakumarsambath8@gmail.com`.
+
+### Response SLA
+* **Initial Response:** Within 24 hours of receipt.
+* **Assessment & Triage:** Within 48 hours.
+* **Patch & Coordinated Disclosure:** Within 7 business days for critical vulnerabilities.
+