agy-worker

Delegate repository work and verify the result

Use this skill for useful repository exploration, bounded implementation, or broad project work through agy. The worker discovers ordinary structure and proposes or makes changes; Codex remains responsible for scope, diff review, driver-owned checks, repair decisions, and the final assurance label.

Resolve the installed package instead of guessing a checkout path:

PIPELINE="$(bash "$SKILL_ROOT/scripts/resolve-pipeline.sh")" || exit $?

Optionally check offline prerequisites before spending provider quota:

"$PIPELINE/doctor.sh" --repo /absolute/path/to/target

ready covers offline prerequisites only. It does not prove authentication, provider availability, task quality, or future job success. For installation and package orientation, read Package README.

Before every provider launch

Obtain explicit approval for the exact transmission mode, repository content, and task being sent unless that exact provider transmission was already approved.

For an ordinary job, prepare one concrete approval package covering foreseeable provider work, readable/writable scope, derived repair feedback, model, and budgets. Reuse that authority while it remains applicable. Fresh state hashes and internal candidate checks are mechanical bindings, not requests for another human approval. Ask again only for a material change in authority, content exposure, destination, or budget. Minimize approvals without treating exactly one approval as a hard requirement. Prepare manifests and private paths for the user; ordinary jobs require neither hand-authored JSON nor a Goal.

Prefer --provider-scope FILE --approve-transmission-sha SHA256 for bounded jobs. It binds exact reviewed read entries, their selected-content digest, and a write subset, then stages only selected entries in a fresh owner-private mode-0700 Gitless provider cwd. Whole-worktree dispatch remains an explicit exception. Treat the entire disposable worktree passed as --workdir as worker-readable and potentially transmissible to Google/Gemini, regardless of requested edit paths; --add-dir, prompt denylist instructions, qa-gate --only, and --allow do not narrow that read boundary. Neither workflow.sh run nor the advanced agy-worker.sh initial dispatch has an implicit transmission mode: launch requires either --approve-whole-worktree LAUNCH_APPROVAL_SHA256 or the scoped pair above. The deprecated facade-only --approve-preview-sha spelling cannot launch by itself and remains temporarily available only with --legacy-preview-approval. New jobs default to --provider-isolation session, which uses the existing AGY session without AGY sandbox or native host containment. AGY has normal user filesystem/network authority; selected-file staging and reconciliation are not host isolation. Include this execution mode in the initial approval alongside task/content, then reuse that approval while its scope remains unchanged. Explicit --provider-isolation native retains supported macOS scoped containment with private HOME/TMP and reviewed network/Keychain access; it never falls back to session mode. The native /usr/bin/security exception allows broader same-user Keychain operations, and its listener rule permits wildcard binds. Read Security and compatibility for those limits. Preserve the job's selected mode across continuation and repair. Provider-scope approval grants neither provider execution, Git action, driver acceptance, nor publication. Before each launch, ensure secrets, credentials, private keys, user-denied paths, and unrelated private files are absent from every entry approved for provider transmission; telling the worker not to read an approved entry is not a control.