Skip to content

Commit 2ea06c5

Browse files
Fix Antigravity locked setup gaps
1 parent 4daaec5 commit 2ea06c5

11 files changed

Lines changed: 182 additions & 17 deletions

File tree

acfs.manifest.yaml

Lines changed: 72 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1059,22 +1059,90 @@ modules:
10591059
- base.system
10601060
installed_check:
10611061
run_as: target_user
1062-
command: 'test -x "${ACFS_BIN_DIR:-$HOME/.local/bin}/agy" || test -x "$HOME/.local/bin/agy"'
1062+
command: 'target_bin="${ACFS_BIN_DIR:-$HOME/.local/bin}"; test -x "$target_bin/agy" && test -x "$target_bin/agy-locked" && test -x "$target_bin/gmi"'
10631063
# agy is a standalone self-updating native binary (no bun/node runtime needed).
10641064
# The installer is supply-chain-verified via the external-installer checksum store
10651065
# (checksums.yaml -> antigravity); it SHA512-verifies the downloaded binary itself,
10661066
# drops agy into ~/.local/bin, and is idempotent (no-op if already present).
10671067
verified_installer:
10681068
tool: antigravity
10691069
runner: bash
1070-
install: []
1070+
install:
1071+
- |
1072+
# acfs-summary: install agy-locked launchers and prime settings
1073+
target_bin="${ACFS_BIN_DIR:-$HOME/.local/bin}"
1074+
source_file=""
1075+
for candidate in \
1076+
"${ACFS_LIB_DIR:-$HOME/.acfs/scripts/lib}/agy_locked.py" \
1077+
"$HOME/.acfs/scripts/lib/agy_locked.py"; do
1078+
if [[ -f "$candidate" ]]; then
1079+
source_file="$candidate"
1080+
break
1081+
fi
1082+
done
1083+
1084+
if [[ -z "$source_file" ]]; then
1085+
echo "agents.antigravity: agy locked launcher asset not found" >&2
1086+
exit 1
1087+
fi
1088+
1089+
mkdir -p "$target_bin"
1090+
install -m 0755 "$source_file" "$target_bin/agy-locked"
1091+
install -m 0755 "$source_file" "$target_bin/gmi"
1092+
1093+
if "$target_bin/agy-locked" --acfs-prime-settings; then
1094+
echo "agents.antigravity: agy locked settings and dcg hook primed" >&2
1095+
else
1096+
echo "agents.antigravity: warning: settings will be primed on first agy launch" >&2
1097+
fi
10711098
verify:
10721099
- |
1100+
# acfs-summary: verify agy-locked launchers and pinned settings
10731101
target_bin="${ACFS_BIN_DIR:-$HOME/.local/bin}"
1074-
"$target_bin/agy" --version || "$target_bin/agy" --help
1102+
test -x "$target_bin/agy"
1103+
test -x "$target_bin/agy-locked"
1104+
test -x "$target_bin/gmi"
1105+
python3 - <<'PY'
1106+
import json
1107+
import pathlib
1108+
import sys
1109+
1110+
settings_path = pathlib.Path.home() / ".gemini" / "antigravity-cli" / "settings.json"
1111+
hook_path = pathlib.Path.home() / ".gemini" / "config" / "hooks" / "dcg-antigravity-hook.py"
1112+
try:
1113+
settings = json.loads(settings_path.read_text(encoding="utf-8"))
1114+
except Exception as exc:
1115+
print(f"invalid or missing Antigravity settings: {settings_path}: {exc}", file=sys.stderr)
1116+
raise SystemExit(1)
1117+
1118+
expected = {
1119+
"model": "Gemini 3.1 Pro (High)",
1120+
"toolPermission": "always-proceed",
1121+
"artifactReviewPolicy": "always-proceed",
1122+
"enableTelemetry": False,
1123+
"enableTerminalSandbox": False,
1124+
"allowNonWorkspaceAccess": True,
1125+
"notifications": False,
1126+
"showTips": False,
1127+
"showFeedbackSurvey": False,
1128+
"useG1Credits": False,
1129+
"verbosity": "high",
1130+
"runningLightSpeed": "medium",
1131+
"colorScheme": "terminal",
1132+
"editor": "auto",
1133+
"altScreenMode": "never",
1134+
}
1135+
for key, value in expected.items():
1136+
if settings.get(key) != value:
1137+
print(f"Antigravity setting {key} is {settings.get(key)!r}, expected {value!r}", file=sys.stderr)
1138+
raise SystemExit(1)
1139+
if not hook_path.is_file():
1140+
print(f"Antigravity dcg hook is missing: {hook_path}", file=sys.stderr)
1141+
raise SystemExit(1)
1142+
PY
10751143
notes:
10761144
- "Pin the model to 'Gemini 3.1 Pro (High)' on every invocation (see scripts/lib/agy_model_guard.sh)"
1077-
- "Auth is Google OAuth (a human step); the agy() shell function in acfs.zshrc launches it model-pinned"
1145+
- "Auth is Google OAuth (a human step); the agy shell alias in acfs.zshrc launches the locked policy wrapper"
10781146
- "ACFS installs agy-locked and maps both agy and gmi to it; the legacy Gemini CLI module is not installed by default"
10791147

10801148
- id: agents.opencode

apps/web/lib/generated/manifest-modules.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ export interface ManifestProvenanceMetadata {
3232

3333
export const manifestProvenance = {
3434
acfsVersion: "0.7.0",
35-
manifestSha256: "0ea8f58cf9f79d6e8bc93b2b52ba90ca5f432105167d88fa70267bf7bfcf89ee",
35+
manifestSha256: "54c33682d22748e67e2a0108fe196e2fa7020d362c36e4c1aa7c9420024ab4b6",
3636
checksumsYamlSha256: "3c3f1fb130915218c4d1f3b567775986e7640a1daeb9ce8263485c9d546abc04",
3737
} as const satisfies ManifestProvenanceMetadata;
3838

scripts/generated/doctor_checks.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -368,7 +368,7 @@ declare -a MANIFEST_CHECKS=(
368368
"agents.claude Claude Code target_bin=\"\${ACFS_BIN_DIR:-\$HOME/.local/bin}\"\\n\"\$target_bin/claude\" --version || \"\$target_bin/claude\" --help required target_user"
369369
"agents.codex OpenAI Codex CLI target_bin=\"\${ACFS_BIN_DIR:-\$HOME/.local/bin}\"\\n\"\$target_bin/codex\" --version || \"\$target_bin/codex\" --help required target_user"
370370
"agents.gemini Legacy Google Gemini CLI (retired; not installed by default) target_bin=\"\${ACFS_BIN_DIR:-\$HOME/.local/bin}\"\\n\"\$target_bin/gemini\" --version || \"\$target_bin/gemini\" --help optional target_user"
371-
"agents.antigravity Antigravity CLI (agy) — Google, successor to the retired Gemini CLI target_bin=\"\${ACFS_BIN_DIR:-\$HOME/.local/bin}\"\\n\"\$target_bin/agy\" --version || \"\$target_bin/agy\" --help required target_user"
371+
"agents.antigravity Antigravity CLI (agy) — Google, successor to the retired Gemini CLI # acfs-summary: verify agy-locked launchers and pinned settings\\ntarget_bin=\"\${ACFS_BIN_DIR:-\$HOME/.local/bin}\"\\ntest -x \"\$target_bin/agy\"\\ntest -x \"\$target_bin/agy-locked\"\\ntest -x \"\$target_bin/gmi\"\\npython3 - <<'PY'\\nimport json\\nimport pathlib\\nimport sys\\n\\nsettings_path = pathlib.Path.home() / \".gemini\" / \"antigravity-cli\" / \"settings.json\"\\nhook_path = pathlib.Path.home() / \".gemini\" / \"config\" / \"hooks\" / \"dcg-antigravity-hook.py\"\\ntry:\\n settings = json.loads(settings_path.read_text(encoding=\"utf-8\"))\\nexcept Exception as exc:\\n print(f\"invalid or missing Antigravity settings: {settings_path}: {exc}\", file=sys.stderr)\\n raise SystemExit(1)\\n\\nexpected = {\\n \"model\": \"Gemini 3.1 Pro (High)\",\\n \"toolPermission\": \"always-proceed\",\\n \"artifactReviewPolicy\": \"always-proceed\",\\n \"enableTelemetry\": False,\\n \"enableTerminalSandbox\": False,\\n \"allowNonWorkspaceAccess\": True,\\n \"notifications\": False,\\n \"showTips\": False,\\n \"showFeedbackSurvey\": False,\\n \"useG1Credits\": False,\\n \"verbosity\": \"high\",\\n \"runningLightSpeed\": \"medium\",\\n \"colorScheme\": \"terminal\",\\n \"editor\": \"auto\",\\n \"altScreenMode\": \"never\",\\n}\\nfor key, value in expected.items():\\n if settings.get(key) != value:\\n print(f\"Antigravity setting {key} is {settings.get(key)!r}, expected {value!r}\", file=sys.stderr)\\n raise SystemExit(1)\\nif not hook_path.is_file():\\n print(f\"Antigravity dcg hook is missing: {hook_path}\", file=sys.stderr)\\n raise SystemExit(1)\\nPY required target_user"
372372
"agents.opencode OpenCode (multi-provider agent harness) opencode --version || opencode --help optional target_user"
373373
"tools.vault HashiCorp Vault CLI vault --version optional root"
374374
"db.postgres18.1 PostgreSQL 18 psql --version optional root"

scripts/generated/install_agents.sh

Lines changed: 80 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1195,17 +1195,94 @@ install_agents_antigravity() {
11951195
return 1
11961196
fi
11971197
fi
1198+
if [[ "${DRY_RUN:-false}" = "true" ]]; then
1199+
log_info "dry-run: install: install agy-locked launchers and prime settings (target_user)"
1200+
else
1201+
if ! run_as_target_shell <<'INSTALL_AGENTS_ANTIGRAVITY'
1202+
# acfs-summary: install agy-locked launchers and prime settings
1203+
target_bin="${ACFS_BIN_DIR:-$HOME/.local/bin}"
1204+
source_file=""
1205+
for candidate in \
1206+
"${ACFS_LIB_DIR:-$HOME/.acfs/scripts/lib}/agy_locked.py" \
1207+
"$HOME/.acfs/scripts/lib/agy_locked.py"; do
1208+
if [[ -f "$candidate" ]]; then
1209+
source_file="$candidate"
1210+
break
1211+
fi
1212+
done
1213+
1214+
if [[ -z "$source_file" ]]; then
1215+
echo "agents.antigravity: agy locked launcher asset not found" >&2
1216+
exit 1
1217+
fi
1218+
1219+
mkdir -p "$target_bin"
1220+
install -m 0755 "$source_file" "$target_bin/agy-locked"
1221+
install -m 0755 "$source_file" "$target_bin/gmi"
1222+
1223+
if "$target_bin/agy-locked" --acfs-prime-settings; then
1224+
echo "agents.antigravity: agy locked settings and dcg hook primed" >&2
1225+
else
1226+
echo "agents.antigravity: warning: settings will be primed on first agy launch" >&2
1227+
fi
1228+
INSTALL_AGENTS_ANTIGRAVITY
1229+
then
1230+
log_error "agents.antigravity: install command failed: install agy-locked launchers and prime settings"
1231+
return 1
1232+
fi
1233+
fi
11981234

11991235
# Verify
12001236
if [[ "${DRY_RUN:-false}" = "true" ]]; then
1201-
log_info "dry-run: verify: \"\$target_bin/agy\" --version || \"\$target_bin/agy\" --help (target_user)"
1237+
log_info "dry-run: verify: verify agy-locked launchers and pinned settings (target_user)"
12021238
else
12031239
if ! run_as_target_shell <<'INSTALL_AGENTS_ANTIGRAVITY'
1240+
# acfs-summary: verify agy-locked launchers and pinned settings
12041241
target_bin="${ACFS_BIN_DIR:-$HOME/.local/bin}"
1205-
"$target_bin/agy" --version || "$target_bin/agy" --help
1242+
test -x "$target_bin/agy"
1243+
test -x "$target_bin/agy-locked"
1244+
test -x "$target_bin/gmi"
1245+
python3 - <<'PY'
1246+
import json
1247+
import pathlib
1248+
import sys
1249+
1250+
settings_path = pathlib.Path.home() / ".gemini" / "antigravity-cli" / "settings.json"
1251+
hook_path = pathlib.Path.home() / ".gemini" / "config" / "hooks" / "dcg-antigravity-hook.py"
1252+
try:
1253+
settings = json.loads(settings_path.read_text(encoding="utf-8"))
1254+
except Exception as exc:
1255+
print(f"invalid or missing Antigravity settings: {settings_path}: {exc}", file=sys.stderr)
1256+
raise SystemExit(1)
1257+
1258+
expected = {
1259+
"model": "Gemini 3.1 Pro (High)",
1260+
"toolPermission": "always-proceed",
1261+
"artifactReviewPolicy": "always-proceed",
1262+
"enableTelemetry": False,
1263+
"enableTerminalSandbox": False,
1264+
"allowNonWorkspaceAccess": True,
1265+
"notifications": False,
1266+
"showTips": False,
1267+
"showFeedbackSurvey": False,
1268+
"useG1Credits": False,
1269+
"verbosity": "high",
1270+
"runningLightSpeed": "medium",
1271+
"colorScheme": "terminal",
1272+
"editor": "auto",
1273+
"altScreenMode": "never",
1274+
}
1275+
for key, value in expected.items():
1276+
if settings.get(key) != value:
1277+
print(f"Antigravity setting {key} is {settings.get(key)!r}, expected {value!r}", file=sys.stderr)
1278+
raise SystemExit(1)
1279+
if not hook_path.is_file():
1280+
print(f"Antigravity dcg hook is missing: {hook_path}", file=sys.stderr)
1281+
raise SystemExit(1)
1282+
PY
12061283
INSTALL_AGENTS_ANTIGRAVITY
12071284
then
1208-
log_error "agents.antigravity: verify failed: \"\$target_bin/agy\" --version || \"\$target_bin/agy\" --help"
1285+
log_error "agents.antigravity: verify failed: verify agy-locked launchers and pinned settings"
12091286
return 1
12101287
fi
12111288
fi

scripts/generated/internal_checksums.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@
99

1010
declare -gA ACFS_INTERNAL_CHECKSUMS=(
1111
[scripts/lib/security.sh]="95366fc1c2497ff0e36a1f59f34621fdcec06f4da0ed439828ad601a626f4f75"
12-
[scripts/lib/agents.sh]="103628ecedcadaaa5300c6880ac9e031cb113b628c436ce55b37d99d6590dc44"
12+
[scripts/lib/agents.sh]="ae0cec5811a00648983c39ecf27e6ec477f3dd616f65dff3db27c154a4ff7304"
1313
[scripts/lib/update.sh]="f310c474b5401acef9e502f71cf4ce3562788650299a189e025cffc990f8f681"
1414
[scripts/lib/doctor.sh]="0e047fa9166d5babb0d992dac0bf4df135f77df8db010459b9036d4703ab8591"
1515
[scripts/lib/doctor_fix.sh]="4be6bbc3a878bc9f8fbfc67373f236fe0557ea023fffa8177cd7330aea2ef93c"
1616
[scripts/lib/offline_artifact_pack.sh]="5f6fa7e5a9e115904656a627853b2c7d556183532a3d8fd42a0363bf3570c7eb"
1717
[scripts/lib/autofix.sh]="0468d4889d304a404f161778ddf393a71fa7657317f88f692a47442760ed78d9"
18-
[scripts/lib/install_helpers.sh]="64090126443ec0ff501afeada886b2342eedd9f20ae8bc98362a791017746210"
18+
[scripts/lib/install_helpers.sh]="d401c94ef9e3d807ecdf8f4512933230ef6e49ee17417abca2a25c4975e9a4a3"
1919
[scripts/lib/logging.sh]="890d8e6e44332bede591e462b277a903ae8d8679adebd8cc4fc76face078f6be"
2020
[scripts/lib/state.sh]="76e29a1a9e66d3576ddcb3875ec5bbe366ecedec11ab243d574eeec2995ff20b"
2121
[scripts/lib/session.sh]="8a2ab64a67006c62ac0db8d89ea6d71d160f3f2efd2cb99ffe6ea0857abde3e5"

scripts/generated/manifest_index.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# ============================================================
77
# Data-only manifest index. Safe to source.
88

9-
ACFS_MANIFEST_SHA256="0ea8f58cf9f79d6e8bc93b2b52ba90ca5f432105167d88fa70267bf7bfcf89ee"
9+
ACFS_MANIFEST_SHA256="54c33682d22748e67e2a0108fe196e2fa7020d362c36e4c1aa7c9420024ab4b6"
1010

1111
ACFS_MODULES_IN_ORDER=(
1212
"base.system"
@@ -597,7 +597,7 @@ declare -gA ACFS_MODULE_INSTALLED_CHECK=(
597597
['agents.claude']="test -x \"\${ACFS_BIN_DIR:-\$HOME/.local/bin}/claude\" || test -x \"\$HOME/.local/bin/claude\""
598598
['agents.codex']="test -x \"\${ACFS_BIN_DIR:-\$HOME/.local/bin}/codex\" || test -x \"\$HOME/.local/bin/codex\""
599599
['agents.gemini']="test -x \"\${ACFS_BIN_DIR:-\$HOME/.local/bin}/gemini\" || test -x \"\$HOME/.local/bin/gemini\""
600-
['agents.antigravity']="test -x \"\${ACFS_BIN_DIR:-\$HOME/.local/bin}/agy\" || test -x \"\$HOME/.local/bin/agy\""
600+
['agents.antigravity']="target_bin=\"\${ACFS_BIN_DIR:-\$HOME/.local/bin}\"; test -x \"\$target_bin/agy\" && test -x \"\$target_bin/agy-locked\" && test -x \"\$target_bin/gmi\""
601601
['agents.opencode']="command -v opencode"
602602
['tools.vault']="command -v vault"
603603
['db.postgres18']="command -v psql"

scripts/lib/agents.sh

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1263,7 +1263,14 @@ upgrade_antigravity_cli() {
12631263
fi
12641264

12651265
log_warn "Antigravity CLI self-update failed, attempting verified reinstall..."
1266-
install_antigravity_cli
1266+
if _agent_run_verified_upstream_installer "antigravity" "bash"; then
1267+
_configure_antigravity_settings "$target_home" || true
1268+
log_success "Antigravity CLI upgraded via verified installer"
1269+
return 0
1270+
fi
1271+
1272+
log_warn "Antigravity CLI upgrade failed"
1273+
return 1
12671274
}
12681275

12691276
# ============================================================

scripts/lib/agy_locked.py

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ def emit(decision, reason=None):
5454
payload = {"decision": decision}
5555
if reason:
5656
payload["reason"] = reason
57+
if decision == "block":
58+
payload["action"] = "block"
59+
if reason:
60+
payload["message"] = reason
5761
print(json.dumps(payload), flush=True)
5862
5963
@@ -117,7 +121,7 @@ def main():
117121
rule_id = result.get("rule_id")
118122
if rule_id:
119123
reason = f"{reason} ({rule_id})"
120-
emit("deny", f"Blocked by dcg: {reason}")
124+
emit("block", f"Blocked by dcg: {reason}")
121125
return 0
122126
123127
emit("allow")

scripts/lib/install_helpers.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -392,6 +392,9 @@ acfs_resolve_selection() {
392392
fi
393393
fi
394394
done
395+
396+
ACFS_GENERATED_SELECTION_READY=true
397+
export ACFS_GENERATED_SELECTION_READY
395398
}
396399

397400
should_run_module() {

tests/unit/lib/test_update.bats

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1342,7 +1342,7 @@ EOF
13421342
run grep -F 'output=$("$bun_bin" install -g --trust "$pkg" 2>&1)' "$update"
13431343
assert_failure
13441344

1345-
run grep -F 'run_cmd_bun_with_retry "Gemini CLI" update_run_in_target_context "" "$bun_bin" install -g --trust @google/gemini-cli@latest' "$update"
1345+
run grep -F 'run_cmd "Antigravity CLI" update_run_in_target_context "" "$agy_bin" update' "$update"
13461346
assert_success
13471347

13481348
run grep -F 'run_cmd_bun_with_retry "Wrangler (Cloudflare)" update_run_in_target_context "" "$bun_bin" install -g --trust wrangler@latest' "$update"
@@ -1351,7 +1351,7 @@ EOF
13511351
run grep -F 'run_cmd_bun_with_retry "Vercel CLI" update_run_in_target_context "" "$bun_bin" install -g --trust vercel@latest' "$update"
13521352
assert_success
13531353

1354-
run grep -F 'run_cmd_bun_with_retry "Gemini CLI" "$bun_bin" install -g --trust @google/gemini-cli@latest' "$update"
1354+
run grep -F 'run_cmd_bun_with_retry "Gemini CLI" update_run_in_target_context "" "$bun_bin" install -g --trust @google/gemini-cli@latest' "$update"
13551355
assert_failure
13561356

13571357
run grep -F 'run_cmd_bun_with_retry "Wrangler (Cloudflare)" "$bun_bin" install -g --trust wrangler@latest' "$update"

0 commit comments

Comments
 (0)