Engineering / Agent collaboration
Antigravity for Codex
Bounded Antigravity review and collaboration inside Codex.
Archived · 2026-10-05 · No longer maintained. Continued in · turnweft
- 01Define the scope
- 02Delegate the task
- 03Verify the result
01The project
A Codex plugin with an MCP server and vendored Skill, built as a sibling of opencode-plugin-codex and grok-plugin-codex. Its agy adapter follows a measured runtime contract: every behavior claim in docs/AGY-RUNTIME-CONTRACT.md carries its probe command rather than relying on CLI analogy. Independent project, not affiliated with Google or OpenAI.
02The problem
agy ignores process cwd and is only ever told about the directory passed to --add-dir — it runs with its permission prompts skipped and is not confined to that directory — and it can report SUCCESS after a nonexistent --add-dir sends it to the wrong place. Its read and write permissions cannot be separated, and its reported outcome is independent of exit code.
03Key decisions
The plugin validates a workspace before spawn and returns a typed refusal when it cannot resolve one. Read-only reviews receive a disposable working-tree copy, and completion means resultComplete; exit code remains recorded for failure classification, not agy's verdict or completion decision.
04My contribution
- Current source version 0.1.1: an explicit absolute cwd grants the target directory for that call only. Workspace grants are checked independently on subsequent calls rather than becoming a session-wide permission.
- MCP tools: agy_check, agy_run, agy_continue, agy_rescue, agy_review, agy_adversarial_review, agy_conversations, agy_status, agy_result, and agy_cancel
- Isolation warnings that name writes in the disposable copy as readonly_run_wrote_files and verify the real tree with tree_changed_during_readonly_run
More contributions
- A conversation_not_found guard because an unknown agy conversation id can silently open a new conversation
- One typed-error envelope for workspace_unavailable, workspace_out_of_bounds, mirror_failed, private_path_blocked, and related boundary failures
- State permissions, CODEX_* environment stripping, a ~/.codex prompt guard, and an explicit note that agy prompts are visible to same-user processes in ps
05Outcome and current stage
Public v0.1.1 · measured agy runtime contract with published probes · filesystem-isolated read-only reviews · restart-safe background jobs
Technical details & evidence
Role · Sole builder — Codex plugin packaging, measured agy runtime contract, MCP tool surface, workspace isolation, typed refusals, tests
- docs/AGY-RUNTIME-CONTRACT.md records the probe command behind every claim; a claim is re-measured before its documentation changes
- Live smoke uses a sentinel file to prove --add-dir reaches the intended workspace and checks git status after a read-only review
- CI covers ubuntu-latest and macos-latest because detached workers and process-group signals differ across the two systems
- Tests keep the vendored Skill and source behavior aligned in both directions; a toolCallCount === 0 verdict remains an opinion, not a review
- TypeScript
- Node.js
- MCP
- Codex Plugin
- Antigravity CLI
- Vitest