agy-plugin-codex — Antigravity inside Codex
- TypeScript
- Node.js
- MCP
- Codex Plugin
- Antigravity CLI
- Vitest
A Codex plugin with an MCP server and vendored Skill, built as a sibling of opencode-plugin-codex and grok-plugin-codex. Its agy adapter follows a measured runtime contract: every behavior claim in docs/AGY-RUNTIME-CONTRACT.md carries its probe command rather than relying on CLI analogy. Independent project, not affiliated with Google or OpenAI.
Project overview
Role Sole builder — Codex plugin packaging, measured agy runtime contract, MCP tool surface, workspace isolation, typed refusals, tests
Scenario
agy ignores process cwd and is only ever told about the directory passed to --add-dir — it runs with its permission prompts skipped and is not confined to that directory — and it can report SUCCESS after a nonexistent --add-dir sends it to the wrong place. Its read and write permissions cannot be separated, and its reported outcome is independent of exit code.
Product strategy
The plugin validates a workspace before spawn and returns a typed refusal when it cannot resolve one. Read-only reviews receive a disposable working-tree copy, and completion means resultComplete; exit code remains recorded for failure classification, not agy's verdict or completion decision.
Outcome and current stage
Public v0.1.0 · measured agy runtime contract with published probes · filesystem-isolated read-only reviews · restart-safe background jobs
My contribution
- MCP tools: agy_check, agy_run, agy_continue, agy_rescue, agy_review, agy_adversarial_review, agy_conversations, agy_status, agy_result, and agy_cancel
- Isolation warnings that name writes in the disposable copy as readonly_run_wrote_files and verify the real tree with tree_changed_during_readonly_run
- A conversation_not_found guard because an unknown agy conversation id can silently open a new conversation
- One typed-error envelope for workspace_unavailable, workspace_out_of_bounds, mirror_failed, private_path_blocked, and related boundary failures
- State permissions, CODEX_* environment stripping, a ~/.codex prompt guard, and an explicit note that agy prompts are visible to same-user processes in ps
Technical evidence
- docs/AGY-RUNTIME-CONTRACT.md records the probe command behind every claim; a claim is re-measured before its documentation changes
- Live smoke uses a sentinel file to prove --add-dir reaches the intended workspace and checks git status after a read-only review
- CI covers ubuntu-latest and macos-latest because detached workers and process-group signals differ across the two systems
- Tests keep the vendored Skill and source behavior aligned in both directions; a toolCallCount === 0 verdict remains an opinion, not a review