chenhg5/cc-connect · error

permission bridge environment is missing

Error message

permission bridge environment is missing

What it means

Relay in the antigravity permission hook refuses to run when either the bridge address or token environment variable (CC_CONNECT_AGY_PERMISSION_ADDR / CC_CONNECT_AGY_PERMISSION_TOKEN) is empty or whitespace. The hook cannot forward the permission decision without knowing where the owning cc-connect session listens and how to authenticate.

Source

Thrown at agent/antigravityhook/protocol.go:34

	maxHookInput          = 4 << 20
	bridgeDialTimeout     = 5 * time.Second
	bridgeResponseTimeout = 24 * time.Hour
)

type BridgeRequest struct {
	Token     string          `json:"token"`
	HookInput json.RawMessage `json:"hook_input"`
}

type BridgeResponse struct {
	Decision string `json:"decision"`
	Reason   string `json:"reason,omitempty"`
}

// Relay forwards one Agy hook invocation to the owning cc-connect session.
func Relay(in io.Reader, out io.Writer, address, token string) error {
	if strings.TrimSpace(address) == "" || strings.TrimSpace(token) == "" {
		return fmt.Errorf("permission bridge environment is missing")
	}

	input, err := io.ReadAll(io.LimitReader(in, maxHookInput+1))
	if err != nil {
		return fmt.Errorf("read hook input: %w", err)
	}
	if len(input) > maxHookInput {
		return fmt.Errorf("hook input exceeds %d bytes", maxHookInput)
	}
	if !json.Valid(input) {
		return fmt.Errorf("hook input is not valid JSON")
	}

	conn, err := net.DialTimeout("tcp", address, bridgeDialTimeout)
	if err != nil {
		return fmt.Errorf("connect permission bridge: %w", err)
	}
	defer func() { _ = conn.Close() }()

View on GitHub (pinned to 4000b2338a)

Solutions

1. Ensure CC_CONNECT_AGY_PERMISSION_ADDR and CC_CONNECT_AGY_PERMISSION_TOKEN are exported in the environment that launches agy
2. Run agy through cc-connect so the hook inherits the bridge env automatically
3. Check hook config (wrapper script) uses `env` passthrough and doesn't scrub env vars
4. Add a debug print of the two vars inside the hook to confirm they are set at invocation time

Example fix

// before
Relay(os.Stdin, os.Stdout, os.Getenv("ADDR"), os.Getenv("TOKEN"))
// after
addr, tok := os.Getenv(antigravityhook.EnvAddress), os.Getenv(antigravityhook.EnvToken)
if addr == "" || tok == "" { /* fail with clear message */ }
Relay(os.Stdin, os.Stdout, addr, tok)

addr, tok := os.Getenv(antigravityhook.EnvAddress), os.Getenv(antigravityhook.EnvToken)
if strings.TrimSpace(addr) == "" || strings.TrimSpace(tok) == "" {
    return fmt.Errorf("set %s and %s before invoking the hook", antigravityhook.EnvAddress, antigravityhook.EnvToken)
}

if err := antigravityhook.Relay(os.Stdin, os.Stdout, addr, token); err != nil && strings.Contains(err.Error(), "environment is missing") {
    fmt.Fprintln(os.Stderr, "hook must run inside cc-connect-launched agy")
    os.Exit(2)
}

When it happens

Trigger: runAntigravityPermissionHook invokes Relay but the parent process did not export both env vars, or exported them blank; hook configured outside the cc-connect-spawned agy environment.

Common situations: Running agy manually from a shell without cc-connect's env; hook script copied elsewhere and executed without env inheritance; cc-connect failed to inject env when spawning agy.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• antigravity: permission responses are only available in defa
• codex: mkdir codex home: %w
• codex: write config.toml: %w
• create temp config: %w
• create temp file: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/66bf163738540ae5. Report an issue: GitHub.