fix(codex,antigravity): pass message bodies so a leading dash is never parsed as an option #237

What happened

Security and stability hardening audit finding H10 / P3 (2026-09-28). Priority is an audit recommendation, not a claim of a production incident.

Message bodies are passed to native CLIs as separate argv elements after an option name, so a body that starts with - is parsed as an option instead of text:

• Codex: codex queue --thread <id> --message <text>.
• Antigravity: send-message --title=session-peer <id> <text> with no -- separator.
• Windows-native Codex relay: --message <text> handed to session-peer's own argparse.

With codex-cli 0.157.1 and an empty temporary CODEX_HOME, the bodies --help, - item and -x each failed with a clap usage error (exit 2) before any queue access, while --message=<text> parsed all three and reached the expected "no rollout found" error. With session-peer's argparse, --message -x and --message --help fail with "expected one argument" (exit 2).

A normal send is protected by the From: header prefix. With --no-from, the body is passed unchanged: --dry-run succeeds because it returns before invoking Codex, and the real send then fails. The relay path always uses --no-from --no-reply-to.

The Antigravity case was reviewed in source only; its native parser was not exercised.

What you expected

Any non-empty body, including one starting with - or --, is delivered as text. Use --message=<text> for Codex and the relay argv, and a -- separator (or an equivalent form the native CLI documents) before positional text for Antigravity.

Environment

• Baseline: published session-peer v1.0.2, commit 2046836822b88e53246de73851186598604cb5ec.
• Reproduction: codex-cli 0.157.1 with an empty temporary CODEX_HOME and a nonexistent thread ID; session-peer --dry-run with a synthetic HOME. Nothing was queued.
• Audit environment: macOS arm64, Python 3.14.7.
• No live message tests or production mutation.

Source evidence

• session_peer_core/codex.py#L768-L772 — dry-run returns before the native call
• session_peer_core/codex.py#L780-L783 — ["--message", text]
• session_peer_core/antigravity.py#L231-L233 — positional text without --
• session_peer_relay/native.py#L173-L175 — '--message', text
• session_peer_core/replies.py#L266-L270 — header prefix omitted with --no-from

Acceptance criteria

• Argv contract tests for each adapter with bodies -x, --help, - item, -- and a multiline body starting with -.
• Codex invocation verified against the supported codex-cli version with a temporary home.
• Relay native path accepts the same bodies; existing size and NUL validation unchanged.
• Dry-run and real send agree on whether a body is accepted.

Scope and limitations

Target: v1.0.3 hardening work. This issue does not authorize a release or operating-service changes. No shell is involved; this is option parsing, not command injection.

Checked

• Searched existing issues for duplicates.
• Removed credentials, conversation contents, private paths and real device/session identifiers.
• Used isolated fixtures without weakening inbound permissions.