Live worker permission verification

Tested locally on macOS, 2026-10-21, using temporary Git fixtures and the user's existing CLI authentication. No credentials were read/exported and no global provider settings were changed. These are bounded observations of these versions/models, not certification of every model, OS, container or remote worker.

Fixes and boundaries

Code Flow now passes Codex delegation, hook and sandbox overrides in both the CLI arguments and thread start/resume configuration. Feature-list output alone had incorrectly suggested that delegation was disabled: model-driven v2 required the additional agents.enabled control. Claude managed settings disable workflows, Ultracode and hooks and deny native delegation/scheduling tools. Regular-file help capture avoids truncated piped output and handles Antigravity's stderr help.

Mandatory workspace/terminal-network boundaries currently require a compatible local Codex environment. Claude without a container provides tool permissions, not filesystem isolation. Worktrees do not prevent reads outside their directory. With external tools left provider-configured, browser and MCP access continue to follow provider configuration. The adapter rejects mandatory external-tool isolation for Codex instead of claiming its terminal sandbox covers browser/MCP. Antigravity now has a local macOS file-only managed executor; see the latest follow-up below. Other environments remain unsupported.

CLI discovery does not verify every listed model's account entitlement. Real inference observations above apply only to the named models. Remote/container controls and all other model/effort combinations remain unverified. The later Antigravity section records its separately tested local executor. Mock tests cover launch flags, policy intersection, recovery and fail-closed behavior separately.

Official references: Codex configuration, Codex app-server, Claude workflows, Antigravity CLI reference.

Repeatable opt-in probes are in scripts/live-permission-probes/; their README explains fixture creation, provider usage and the bounded checks. Runtime bookkeeping is isolated from the application server. The validated catalog service was also exercised against the installed CLIs: 12 Claude models (11 reporting effort controls), seven Codex models, and six Antigravity models (per-model effort support unknown).

Antigravity Auto feasibility follow-up

On 2026-10-21, two additional real agy 1.4.4 turns used gemini-3.8-flash-low, --sandbox, --disable-slash-commands and a workspace custom agent allowing only view_file, with subagent: false and commandExecutionPolicy: off. Neither turn used --dangerously-skip-permissions.

Both turns read the fixture successfully. In the second, the model was asked to attempt a fixture write and a harmless terminal command only if those tools were offered. It reported them unavailable; only view_file calls were observed and no write marker appeared. This is evidence that a custom-agent allowlist narrowed the observed model surface. It is not a forced-call rejection test. The init.tools event still listed terminal, write, browser, MCP, workflow and native delegation tools; that event is therefore not an attestation of the effective allowlist. A fixture SessionStart hook did not produce its marker; this does not establish that all hooks are disabled.

The current supported CLI interface does not provide verified per-run settings isolation, hook suppression, or scoped MCP configuration. Documented permissions live in shared settings; allowed paths, domains and unsandboxed rules can change the terminal sandbox's effective boundary. Hooks may come from workspace, global settings and plugins. A custom-agent file cannot establish that these independent surfaces obey the run policy. See CLI permissions, terminal sandbox, custom agents and hooks.

Decision: keep managed Antigravity unavailable. The adapter and routing now share an actionable diagnostic, and capability reporting labels its sandbox enforcement unknown rather than tested merely because help exists. Regression tests reject every trust level, read/write turns, Solo, resumed assignments and container/remote choices. The legacy skip-permissions environment setting cannot override that rejection.

Enabling Auto requires either a supported invocation-scoped policy interface or a separately implemented isolated executor. That executor must keep policy/configuration outside worker write access, exclude ambient hooks/plugins/MCP, mediate every exposed tool (including browser and delegation), separate inference connectivity from command networking, and reapply/recheck policy on resume. A container alone does not establish these properties. Temporarily editing global settings would race other sessions; a prompt instruction or post-turn revert is not enforcement. No global settings were modified and no credentials were copied for this investigation.

scripts/live-permission-probes/antigravity.ts repeats the bounded custom-agent check. It remains an opt-in research probe, not a supported managed execution path.

Isolated execution investigation

The next investigation on 2026-10-21 implemented an offline macOS containment prototype, separate from the adapter. agy-isolation-fixture.ts creates a fresh home, restrictive settings, empty MCP/hook configuration and a file-reading custom agent. Its OS policy allows workspace and scratch writes, protects the entire home from changes, excludes workspace customizations from reads, and denies network access for the whole process tree. The child environment is constructed from a small allowlist; it does not inherit provider keys, SSH sockets or Code Flow credentials. Standard system file reads and filesystem metadata remain allowed. This is not a complete cross-platform executor.

Real kernel checks passed for a local workspace write and scratch write, and rejected:

• Reading a fixture outside the workspace through a symlink.
• Reading workspace .agents/hooks.json.
• Changing settings permissions, overwriting settings, or replacing their parent directory.
• Writing an outside sentinel or connecting to a local TCP server (zero accepted connections).

The actual Antigravity 1.4.4 executable returned its version inside this boundary. agy models exited unsuccessfully there; no inference was attempted. A separate discovery-only check with a fresh home and normal network access returned “Please sign in.” Existing host authentication was not copied. This establishes that starting the binary and enforcing fixture containment are possible, but it does not establish authenticated model access, native tool enforcement, hook suppression by the vendor runtime, or session recovery.

Antigravity's official authentication documentation describes interactive sign-in and alternative API-key/enterprise ADC paths. Those alternatives are not interchangeable with the user's current subscription and were not enabled as a workaround.

Docker is installed on this machine, but its daemon socket was unavailable before and after a Desktop startup attempt. The ordinary container wrapper is also insufficient by itself: its writable home/auth volume could retain ambient settings, and its network permits inference and shell traffic together. No container compatibility claim was made and no Docker security settings were relaxed.

At this stage Auto remained blocked (superseded by the login-reuse follow-up below). To proceed, the isolated executor needs separately provisioned authentication, inference connectivity separated from command networking, and real tests of browser/MCP/delegation denial and fresh/resumed execution. A production container implementation would additionally need immutable policy mounts and a clean workspace customization namespace. The experimental profile deliberately grants no inference network access and cannot be promoted into production by a successful fixture test or a user-supplied readiness flag. The current adapter and recovery gates are unchanged.

Existing login reuse and managed file workers

The 2026-10-21 follow-up found a working path for macOS / Antigravity CLI 1.4.4. A clean HOME can reuse the existing login through the native macOS Keychain. Code Flow creates a temporary Library/Keychains symlink, grants read-only access to its target, and lets the official CLI call /usr/bin/security. It never extracts a password, exports an OAuth token, copies a credential file, or substitutes API-key billing. The CLI also needs reads of macOS security-module metadata and write-data access to the existing mds.lock cache lock. Broad cache writes are not granted. Merely linking legacy OAuth files did not authenticate the CLI.

src/adapters/agy-isolation.ts now implements the narrowly scoped executor. Each turn gets a fresh private home, an allowlisted environment, immutable provider settings/custom agent, empty MCP/hook configuration and a protected default project record. The macOS policy restricts writes to the workspace (write turns only), runtime state, scratch and the one native cache lock. Policy files and ancestors, workspace customizations, Git metadata and host login files are protected. Only the verified CLI binary and Apple's security helper can execute. File tools are separately denied access to authentication, security-cache and runtime paths, including canonicalized symlink targets. Terminal, browser, MCP, workflow and native agent tools are excluded. The vendor's local manage_task bookkeeping tool can still appear; it is not the native delegation tool.

Inference networking remains enabled. This is file-only execution, not a general-purpose network-denied shell sandbox. Code Flow's check/setup commands retain their separately configured execution environment. System runtime files/metadata remain readable. This is not a complete VM boundary or a claim that every provider has identical isolation.

Bounded observations from the real CLI and gemini-3.8-flash-low:

• Six model candidates were discovered inside this executor with the existing login.
• A file-reading/editing turn completed, and its JSON response was parsed through Code Flow's normal structured-result fallback.
• A later read-only turn read the saved result with fresh provider state. Neither turn retained a native session ID.
• A synthetic outside-file symlink read failed. A direct write and reads/writes through a symlink into protected profile state matched the provider deny rule; sentinels remained unchanged.
• The workspace hook marker remained absent. The local browser fixture received zero requests. Terminal/browser/native delegation tools were not used; this is observed behavior plus configured controls, not arbitrary forced-tool-call fuzzing.
• Deterministic tests exercise both read/write OS profiles, protected files, outside paths, Git metadata, child execution, environment scrubbing, forged policy rejection, unknown CLI versions, native-session rejection, catalog separation and mocked Auto dispatch/recovery.
• A real end-to-end Auto fixture completed with verdict passed: gpt-6.1-sol/low coordinated, gemini-3.8-flash-low made the requested README edit, and the configured Node check plus independent review completed. Five steps completed with no failed steps. The Antigravity step recorded os-sandbox, macos-file-only-v1, isolated catalog revision 1 and no native session ID. This verifies that the adapter is reached through actual Auto dispatch, beyond standalone CLI probes.

Managed eligibility now permits this local executor and rejects remote/container execution, interactive approvals and unverified CLI versions. Every launch rechecks the environment; CODEFLOW_AGY_SKIP_PERMISSIONS cannot bypass managed controls. Inventory describes the file-only restriction to the coordinator. The effective executor version is recorded on steps, while model assignments retain the isolated catalog revision/environment/provenance. A native session supplied during recovery is rejected as unavailable so the engine rebuilds a fresh turn from portable context. No session is transferred across providers.

The exact CLI version is deliberately pinned. Updating Antigravity requires re-verifying controls before changing that pin. Windows/Linux, container authentication reuse, other models/efforts and arbitrary forbidden-call injection are unverified. Authentication tests used a valid existing login; expired-login refresh was not tested. Read-only Keychain file rules do not claim to constrain the macOS security service's own credential lifecycle. The old offline prototype and earlier blocked decisions above remain historical investigation evidence, not the current production path.

Repeat the adapter probe with node --import tsx scripts/live-permission-probes/managed-antigravity.ts; repeat a real mixed-provider Auto fixture with node --import tsx scripts/live-permission-probes/managed-antigravity-auto.ts. Both consume provider usage and touch only synthetic project files. Official control references: custom agents and permission rules.

Antigravity permission and recovery review (2026-10-21)

The review found and fixed these gaps in the managed executor:

• Version inspection previously executed the candidate binary outside isolation. It now runs in a separate default-deny profile without host HOME, credentials or networking. Version and model probes use tracked process groups, so timeout and server recovery cover their children too.
• Nested workspace .agents, .gemini and .git paths were not protected. Kernel rules now cover nested paths and canonical symlink targets, including workspace names containing regex metacharacters.
• Native authentication/refresh errors could be classified as ordinary failures, and raw diagnostics could reach run history. Managed output now withholds native diagnostics and buffers response text until success; expired/revoked tokens and locked Keychains produce a safe auth failure. No automatic interactive login, global settings edits, credential export or permissive retry was added.
• Recovery could retain the signed-out cooldown after the user repaired the login. Explicit Resume now requires fresh isolated discovery before clearing that cooldown. Failed/offline discovery and stale cached models leave it blocked. The original assignments/provenance and partial work remain recorded, and new execution rechecks model eligibility and effective permissions with a fresh provider home.
• Workflow revisions previously rejected even an unchanged idle member whose login became unavailable. They can now retain that member and stop cleanly; adding, reassigning or retrying work still requires an eligible provider and preserves user pins.
• Unexpected runtime tool events stop the worker and override a subsequent success result. This is drift detection, not pre-execution mediation; protected native policy and the OS sandbox remain the enforcement boundary. Preparation cleanup also runs if the initial event listener throws.

Deterministic tests cover auth-result and diagnostic-only failures, secret-marker non-persistence, fresh-turn recovery, unchanged permission receipts, forbidden tool drift, cleanup, and a full Auto stop/reload/login-repair/resume with preserved partial files and model pins. Actual macOS kernel probes cover nested configuration, policy and authentication writes, outside symlinks and unauthorized executable launch.

The real CLI 1.4.4 passed the updated adapter read/write probes with gemini-3.8-flash-low: the edit and structured result succeeded, the outside read was denied, the outside file stayed unchanged, no hook marker appeared, no browser requests reached the fixture, and no native session was retained. These are bounded existing-login observations. Expired-login refresh is still not real-provider verified: tests simulate failures and repair without revoking, replacing or exporting the user's login. The native CLI owns refresh inside the existing boundary; if refresh needs additional access, the turn fails instead of expanding permissions. macOS security-service credential lifecycle access remains a documented trust boundary. See the provider's locked-Keychain troubleshooting.

The updated real mixed-provider Auto probe also completed successfully: Codex coordinated, one isolated Antigravity turn edited the fixture, and independent review plus the check passed (five completed steps, zero failed steps). The worker recorded its catalog revision and macos-file-only-v1 permissions without retaining a native session.

Non-destructive native refresh investigation (2026-10-21)

The official CLI command reference and installed 1.4.4 help expose no documented force-refresh command. The authentication guide describes silent native-Keychain reuse and a destructive /logout; logout was not used. Inspection of the installed executable's static messages identified native refresh and credential-persistence diagnostics. This inspected the executable, not stored credential values, and does not establish a supported refresh API.

The new opt-in scripts/live-permission-probes/antigravity-refresh.ts runs only a normal agy models request in the production read-only sandbox with a fresh provider home. It observes a private native log using bounded, symlink-rejecting reads, emits only a closed set of boolean/status fields, and removes the temporary profile/log afterward. It does not export tokens, read Keychain values directly, change the clock or expiry, revoke credentials, change account settings, intercept TLS, or redirect OAuth endpoints. Normal token renewal is owned by the official CLI and may update its stored tokens; the probe does not promise byte-for-byte unchanged native credential storage.

Actual isolated requests returned six model candidates. Native logging explicitly reported a non-expired loaded token, with no refresh event, interactive authentication attempt or credential-persistence failure observed. This verifies ordinary login reuse. Actual expired-token renewal and successful persistence remain unverified. Repeating valid-token requests is not proof of refresh. The script returns exit code 2 when refresh was not observed, 1 when the native request/authentication failed, and 0 only when a native refresh event and successful discovery were observed. credentialPersistence: not-attested remains explicit even then; expiredTokenRefreshVerified additionally requires a native expired-at-load observation. Evidence cannot grant runtime permissions or clear a known failure on its own.

This investigation also found native messages for refresh persistence failure and fallback to credential files that were missing from Code Flow's error handling. Managed inference and isolated discovery now inspect their private native auth logs before accepting success. Known persistence/fallback or interactive-auth diagnostics reject the operation safely, even if inference returned success; raw diagnostics and structured failure payloads are not copied into run history. These are detection checks after native execution, not interception of the macOS security service or a guarantee that the CLI never attempted a fallback write. The existing sandbox and model-tool restrictions remain unchanged. Unreadable/missing/oversized logs are explicitly inconclusive to the refresh probe, never evidence that renewal succeeded.

Deterministic tests cover valid-token reuse versus refresh, persistence/fallback errors, successful-result override, secret-marker non-persistence, bounded/symlink-safe log reads and interactive authentication observation. No live credentials were deliberately expired, replaced, exported or revoked to exercise these cases. Safe completion of expired-token verification requires observing a naturally due refresh or a provider-supported test interface; Code Flow does not bypass that constraint.

Explicit unrestricted native mode (2026-10-21)

User-authorized antigravityExecution: "native" reuses the installed CLI's existing host login and normal configuration. It deliberately removes Code Flow's file-only isolation and vendor sandbox for Antigravity, and records agy-native-v1, isolation: none, full trust, allowed command networking, provider-configured external tools and native delegation. This is an explicit permission exception, not verified sandbox enforcement. Default and historical isolated runs retain their original behavior.

Real acceptance: node --import tsx scripts/live-permission-probes/managed-antigravity-auto.ts --native completed with five successful steps, one Antigravity write turn, final verdict passed, expected README marker and no native session reuse. The recorded tools included Antigravity run_command; the synthetic task requested its terminal test. Codex coordinated and independently reviewed. No login/logout command, credential export, forced expiry, revocation or user configuration edit was performed. Native catalog discovery also returned six models through the existing profile.

Browser, MCP, hooks and native child agents were not exercised in the live probe. They are not restricted by this mode; native child usage cannot be bounded by Code Flow's roster/invocation budget. Native expired-token refresh remains unverified. Deterministic tests simulate refresh-persistence failures, verify private diagnostic handling and cleanup, and exercise restart/recovery for both native and isolated modes without widening authority.

Antigravity 1.4.5 compatibility (2026-10-22)

The installed CLI updated to 1.4.5. The explicit supported-version list now includes 1.4.4 and 1.4.5; unknown versions still stop before an isolated launch. Agent mode preserves the Antigravity executor's native-delegation setting instead of applying Claude/Codex conversation permissions to it.

The production adapter's live write/read probe passed on 1.4.5: a workspace edit and structured answer succeeded, the outside symlink read produced a tool denial, the outside sentinel stayed unchanged, no hook marker appeared, no request reached the browser fixture, and no native session was retained. Kernel fixture tests still cover policy/configuration/authentication-write denials. A real Claude → Codex → Antigravity UI fork also recovered the carried conversation token. These observations retain the existing file-only scope and authentication limitations; they do not certify arbitrary future runtime versions or unrestricted browser/MCP behavior.

Antigravity 1.4.6 compatibility (2026-10-23)

The installed CLI updated to 1.4.6, which the previous exact-version check rejected before starting a side chat. The supported-version list now includes 1.4.6; other unverified versions still stop before launch. The macOS sandbox and protected per-turn settings are unchanged.

The production file-only probe passed on 1.4.6 with gemini-3.8-flash-low: the workspace edit and structured answer succeeded, the fresh read-only turn denied the outside symlink read, the outside sentinel stayed unchanged, no hook marker appeared, no browser request reached the fixture, and no native session was retained. The probe now recognizes the existing structured finish completion tool in its write turn, matching the production profile.

Isolated model discovery returned six candidates. A separate read-only fixture read its workspace marker and called the scoped codeflow_team/read_inbox MCP tool once, returning the expected synthetic inbox marker without retaining a native session. These observations cover installed-version file access and scoped MCP transport; live browser/computer acceptance remains recorded for 1.4.5 below. All 40 targeted isolation, authentication, recovery, shared-tool, side-chat, permission and model-catalog tests passed, along with TypeScript checking.

Antigravity 1.4.7 compatibility (2026-10-24)

The supported-version list now includes the installed CLI 1.4.7. The production adapter's gemini-3.8-flash-low write/read probe passed: the workspace edit and structured completion succeeded, the read-only turn denied the outside symlink read, the outside sentinel stayed unchanged, and no hook marker, browser request or retained native session appeared. All 22 targeted isolation, authentication, recovery and shared-tool tests passed. Unknown versions still fail closed; the execution permissions are unchanged.

Live adaptive-team acceptance passed for Claude leading Codex, Codex leading Antigravity, and Antigravity leading Claude. In each case the configured check passed, the team's changes returned to the original chat workspace without modifying its branch or an existing draft, and the conversation continued after switching AI team off. Antigravity's gemini-3.8-flash-high planning turn took 241 seconds before completing. A three-provider recovery fixture passed selective Codex cancellation, Antigravity's scoped teammate message, independent Claude review and conflict resolution with a fresh check and review. Additional live tests recovered a reviewer after restart and replaced failed coordinator/reviewer providers without repeating completed implementation work.

Task-scoped Antigravity tools (2026-10-22, later update)

Interactive Antigravity Agent and Team turns can now use the shared Codeflow browser and computer bridge. Their isolated receipt is macos-task-tools-v2 with externalTools: task-scoped; required no-external-tools retains the existing macos-file-only-v1 profile and exposes no bridge. This supersedes earlier statements that isolated Antigravity is always file-only. Native shell/browser, ambient customizations and provider delegation remain unavailable in the isolated profile.

A fresh private HOME contains sealed settings and a custom agent exposing only the known codeflow_agent tool names. HTTP MCP uses a loopback endpoint and an expiring invocation token. Its transport shares the same read/write, task ownership, approval, cancellation and revocation checks as the Claude/Codex stdio bridge. MCP resources are empty; discovery does not grant access to host resources. The native-mode path uses a private configuration overlay and leaves global settings unchanged. No ambient MCP server is imported into the isolated profile.

Computer tools operate outside the workspace and remain gated by Full access for Antigravity, plus macOS Screen Recording and Accessibility permissions. Every action requires a fresh screenshot token and the same foreground app; foreground identity is checked before and after capture. Pixel coordinates remain the default for existing callers. Antigravity explicitly selects the normalized 0–1000 coordinate format, which the host converts to display points. Invocation-private offloaded screenshot files are readable so the model can inspect its tool results; private settings, MCP configuration and authentication data remain protected.

Schema-constrained turns permit Antigravity's built-in finish control tool. Only its injected toolAction and toolSummary metadata are removed when not requested by the schema; other unexpected properties remain subject to validation. Successful browser/computer effects record tool names and timestamps, without arguments, as host evidence. These receipts establish that an action succeeded at the tool boundary, not that the user's task is correct; independent review and configured checks still apply.

Real Antigravity 1.4.5 validation passed the shared browser form, file/folder uploads and authenticated downloads after human/Claude/Codex use. Real Agent and Team computer turns filled and submitted a dedicated native fixture, with exact output verified by Codeflow. Earlier failed foreground/coordinate attempts were retained and corrected without removing the app guard. See output/agent-mode/agy-browser-structured-final.log, agy-transfers-live.log and agy-computer-normalized-final.log, and the detailed validation record in docs/plans/agent-mode-validation.md. These are bounded observations of the installed versions, not certification of arbitrary native tools, future versions or expired-token renewal.