(formerly Agent Bridge)
Slipgates is a standalone app for watching and driving AI coding agent sessions (GitHub Copilot CLI, Claude Code, Codex) across your machines and your phone. A question asked on a Dev Box shows up on your phone, and your answer goes straight back. It is the successor to agent-ha-bridge, without the need for Home Assistant.
Contributing, with or without agents? Start here. The guide covers choosing work, working safely alongside other contributors, checks, reviews and handoffs. Fresh agent sessions start with AGENTS.md.
The name. The product is called Slipgates (brand). The repository (
danswett/agent-bridge), project and namespace names (AgentBridge.*), commands (agent-bridge-host), install paths, environment variables and the web app's address are legacy names, kept until Phase 3 (#541) migrates them (what stays). The protocol's name, Bridge Protocol v1, is also a legacy name kept until Phase 3.
Project context: docs/status.md distinguishes dated migration snapshots from live work references. Product priorities determine the order of work; canonical issues and PRs hold current ownership and evidence. The architecture is in docs/design.md, and feature-by-feature parity with evidence is in docs/parity.md.
Nothing depends on Windows: the host, hook, relay, protocol and all product logic are shared on Windows, macOS and Linux, and each desktop gets a native app of equal standing.
- The Slipgates host (C#/.NET, Windows, macOS and Linux): one per machine. It does what the agent-ha-bridge daemon does today: picks up hook events, tails transcripts, and delivers answers, replies, launches and stops. It holds all the product logic.
- Slipgates apps: WinUI 3 on Windows and SwiftUI on macOS. Both are thin native shells over the host, providing the desktop UI, notifications, and the installer and manager for the host and agent hooks. Linux runs the host only, for now.
- Relay: an untrusted, end-to-end-encrypted rendezvous so your machines and phone can reach each other from anywhere. It can be self-hosted, and there are LAN-only options.
- Phone: the Slipgates web app (a PWA) first, native apps later.
Slipgates' protocol (Bridge Protocol v1) connects them, and is specified in docs/protocol.
| Path | What it is |
|---|---|
src/AgentBridge.Protocol |
Bridge Protocol v1 records and their JSON |
src/AgentBridge.Host.Core |
Discovers the live Copilot, Claude and Codex sessions on a machine and keeps each as a protocol Session, strictly read-only: it never writes, locks, renames or deletes anything the agents or agent-ha-bridge own. The one exception is its hook intake on a machine explicitly migrated from agent-ha-bridge, which takes over that installation's hook spool, heartbeat and session registrations (docs/host-hooks.md). Also reads each agent's allowance (Copilot, Claude, Codex) at agent-ha-bridge's pace |
src/AgentBridge.Host |
agent-bridge-host: sign-in --relay <url> then serve shows the machine's sessions to the user's devices through the relay (Protocol v1), reconnecting on its own, types their answers to pending questions (session.answer) and their replies (session.reply), with files and images sent ahead (attachment.*), ends sessions (session.stop), notifies the account's phones by Web Push when a session asks or finishes (push), reports each agent's usage (usage, v1-usage.md), launches or resumes sessions in workspaces approved at the machine (session.launch, v1-launch.md), and carries its app's updates to the account's other devices, which may ask for one (update.*, v1-update.md); sessions, get <id>, watch and usage check what the core sees, workspace and config edit the profile's config.json (docs/host-config.md), shadow compares what it shows with agent-ha-bridge's daemon, read-only, for a machine's cutover (docs/host-shadow.md), hooks status reports hook handling (docs/host-hooks.md), and migrate / rollback move a machine from agent-ha-bridge and back (docs/migration.md) |
src/AgentBridge.Host.Delivery |
Answering a question, sending a reply, ending a session and launching one: the keys for each question shape (pure and unit-tested), the transcript checks before and after typing, the two-press rule and process identity for ending, agent-ha-bridge detection, and the injector worker client. See docs/host-answers.md, docs/host-replies.md, docs/host-stop.md and docs/host-launch.md |
src/AgentBridge.Hook, src/AgentBridge.Hooks |
agent-bridge-host-hook: the NativeAOT hook the agents run on a migrated machine, and the hook spool contract it shares with agent-ha-bridge's Go hook and daemon. It never fails an agent: with the host down it gives the fixed reply. docs/host-hooks.md |
src/AgentBridge.Injector |
agent-bridge-injector: the NativeAOT worker the host starts to type into an agent's console, so a console closing mid-answer can never take the host down |
src/AgentBridge.Transport |
The end-to-end channel (Noise XX over P-256), the relay client, channels with requests, responses and events, sign-in, device keys (TPM, DPAPI or an owner-only file) and Web Push encryption. Promoted from spikes S2, S4, S5 and S6 |
src/AgentBridge.Relay |
The relay (ASP.NET Core), promoted from S4. docker build -f src/AgentBridge.Relay/Dockerfile . from the repository root. Deployed to Azure Container Apps from infra/ (Bicep) by .github/workflows/relay.yml: staging, a smoke test, then production on approval. See docs/relay-deploy.md |
src/AgentBridge.Local |
The local API between a desktop app and its host: Protocol v1 over a named pipe (a Unix socket elsewhere) that only the same user at the same elevation can use, plus local-only host management ops. serve always opens it, and goes to the relay only once signed in. docs/protocol/local-pipe.md |
src/AgentBridge.App |
The Windows app (WinUI 3, unpackaged, Velopack): this machine's sessions as cards at parity with the PWA, usage, toasts that take answers, and installing, starting, signing in and updating the host it ships with. --demo runs it against a pretend host. docs/app-windows.md; build/pack-app.ps1 builds the package |
src/AgentBridge.App.Core |
Everything in the app that is not drawing (connection, view models, toast plans, host lifecycle), platform-neutral and tested on Linux too |
src/AgentBridge.HostLauncher |
agent-bridge-hostw: starts the host with no console window, for the logon task |
src/AgentBridge.HomeAssistant |
The Home Assistant connector: a migrated machine's sessions, liveness, version and usage on the existing agent-ha-bridge dashboard, in agent-ha-bridge's own per-machine MQTT contract (status only so far; off by default). docs/ha-connector.md; tools/ha-contract records the contract fixtures from agent-ha-bridge's source |
tools/AgentBridge.RelaySmoke |
relay-smoke --relay <url>: checks a deployed relay from outside, and with its token key connects two devices over a Noise channel |
tools/AgentBridge.Rehearsal |
agent-bridge-rehearsal: the automated checks of the migrate-and-rollback rehearsal on a disposable VM. It reads the host's pipe state, the agents' transcripts after a mark, a disposable Home Assistant, and hashes of agent-ha-bridge's install. The runbook is docs/parity-checklist.md |
tests/ |
dotnet test AgentBridge.slnx, on Windows and Linux in CI |
- Releases of this product are published only here, never in agent-ha-bridge, whose installed bridges update from that repository's latest release.
- This product installs under its own paths and names, leaves agent hook registrations alone, and never writes to an existing Home Assistant setup until a machine is explicitly migrated.
| Spike | Question | Result |
|---|---|---|
| S1 | Can a console-less .NET process type into agent sessions? | GO, through an injector worker process |
| S2 | Can .NET and browser WebCrypto share one end-to-end encrypted channel? | GO: byte-identical in Node, Chromium and WebKit. Run it on your phone |
| S3 | Can an unpackaged WinUI 3 app install, update and uninstall itself with Velopack, and take answers from toasts? | GO, with OS toast activation instead of Windows App SDK's, and EnableMsixTooling for publish |
| S4 | Can one untrusted relay serve every user, with GitHub sign-in and end-to-end channels from hosts and a PWA? | GO, live on Azure Container Apps. Needs a cross-replica backplane to deploy without splitting. PWA |
| S5 | Can a host notify the phone PWA through Web Push without the relay or push service reading it? | GO on a real iPhone: lock-screen notice, tap, answer back at the host in 10 s |
| S6 | Can a device's long-term key live non-exportable in the TPM and still do Noise, the relay proof and the device id? | GO, live with the relay and the iPhone. Needs NCrypt directly; .NET's wrappers fail with the TPM provider |
Copyright (c) 2026 Dan Swett. Licensed under the GNU Affero General Public License, version 3 only (AGPL-3.0-only), not any later version. Under its section 13, if you modify it and users interact with your version remotely through a computer network (the relay, for example), you must prominently offer all of those users an opportunity to receive the Corresponding Source of your version. For a commercial license on other terms, open an issue asking for one.
Versions up to and including commit
05ee682
were released under the MIT License, and stay available under it. Slipgates Mono, in
design/fonts/slipgates-mono/, is licensed separately under the SIL Open Font License 1.1
(see its README), not this project's AGPL.