Route Gemini entrypoints through locked agy

Author: Dicklesworthstone

README.md

@@ -91,7 +91,7 @@ graph LR
     subgraph agents ["AI Agents"]
         CLAUDE["Claude Code"]
         CODEX["Codex CLI"]
-        GEMINI["Gemini CLI"]
+        AGY["Antigravity CLI"]
     end
 
     LAPTOP --> BROWSER
@@ -101,7 +101,7 @@ graph LR
     INSTALLER --> CONFIGURED
     CONFIGURED --> CLAUDE
     CONFIGURED --> CODEX
-    CONFIGURED --> GEMINI
+    CONFIGURED --> AGY
 
     classDef user fill:#e3f2fd,stroke:#90caf9,stroke-width:2px
     classDef wizard fill:#fff8e1,stroke:#ffcc80,stroke-width:2px
@@ -171,7 +171,7 @@ flowchart TB
     AcfsHome["~/.acfs/<br/>configs + scripts + state.json"]
     Commands["Commands<br/>acfs doctor / acfs update / acfs services-setup / onboard"]
     Tools["Installed tools<br/>bun/uv/rust/go + tmux/rg/gh + vault + ..."]
-    Agents["Agent CLIs<br/>claude / codex / gemini"]
+    Agents["Agent CLIs<br/>claude / codex / agy"]
     Stack["Stack tools<br/>ntm / mcp_agent_mail / ubs / bv / cass / cm / caam / slb / dcg / ru"]
   end
 
@@ -466,7 +466,7 @@ graph TD
     C["Phase 3: Shell Setup<br/><small>zsh, oh-my-zsh, powerlevel10k</small>"]
     D["Phase 4: CLI Tools<br/><small>ripgrep, fzf, lazygit, etc.</small>"]
     E["Phase 5: Language Runtimes<br/><small>bun, uv, rust, go</small>"]
-    F["Phase 6: AI Agents<br/><small>claude, codex, gemini</small>"]
+    F["Phase 6: AI Agents<br/><small>claude, codex, agy</small>"]
     G["Phase 7: Cloud Tools<br/><small>vault, wrangler, supabase, vercel</small>"]
     H["Phase 8: Dicklesworthstone Stack<br/><small>ntm, dcg, ru, ubs, mcp_agent_mail, etc.</small>"]
     I["Phase 9: Configuration<br/><small>Deploy acfs.zshrc, tmux.conf</small>"]
@@ -947,7 +947,7 @@ The Learning Hub provides interactive lessons with progress tracking:
 | 3 | tmux Basics | 7 min | Sessions, windows, panes, survival |
 | 4 | Git Essentials | 10 min | Version control, dangerous operations |
 | 5 | GitHub CLI | 8 min | Issues, PRs, releases via `gh` |
-| 6 | Agent Commands | 10 min | Claude, Codex, Gemini usage |
+| 6 | Agent Commands | 10 min | Claude, Codex, Antigravity usage |
 | 7 | NTM Command Center | 8 min | Session orchestration |
 | 8 | NTM Prompt Palette | 6 min | Quick command access |
 | 9 | The Flywheel Loop | 8 min | How all 10 tools work together |
@@ -1241,11 +1241,9 @@ alias cc='NODE_OPTIONS="--max-old-space-size=32768" claude --dangerously-skip-pe
 # Codex with bypass and dangerous filesystem access
 alias cod='codex --dangerously-bypass-approvals-and-sandbox'
 
-# Antigravity CLI (successor to the retired Gemini CLI), model-pinned + auto-approve
-agy() { command agy --model "Gemini 3.1 Pro (High)" --dangerously-skip-permissions "$@"; }
-
-# Gemini CLI — LEGACY (retired 2026-06-18; kept only to read old ~/.gemini/tmp history)
-alias gmi='gemini --yolo'
+# Antigravity CLI, model/settings/DCG locked by the ACFS launcher
+alias agy='$HOME/.local/bin/agy-locked'
+alias gmi='$HOME/.local/bin/agy-locked'
 ```
 
 **Installation & Updates:**
@@ -1331,7 +1329,7 @@ $ acfs doctor
 ║ Agents                                                        ║
 ║   ✔ claude 1.0.24                                             ║
 ║   ✔ codex 0.1.2504252326                                      ║
-║   ✔ gemini 0.1.12                                             ║
+║   ✔ agy 1.0.12                                                ║
 ║                                                               ║
 ║ Cloud                                                         ║
 ║   ✔ vault 1.18.3                                              ║
@@ -1845,7 +1843,7 @@ Component update logic with version tracking and logging:
 ```bash
 update_apt()       # apt update/upgrade with lock detection
 update_bun()       # bun upgrade with version tracking
-update_agents()    # Claude, Codex, Gemini (version before/after)
+update_agents()    # Claude, Codex, Antigravity (version before/after)
 update_cloud()     # Wrangler, Supabase, Vercel (Supabase uses verified release tarball)
 update_rust()      # rustup update stable
 update_uv()        # uv self update
@@ -1971,7 +1969,7 @@ interface SessionExport {
   schema_version: 1;
   exported_at: string;              // ISO8601
   session_id: string;
-  agent: "claude-code" | "codex" | "gemini";
+  agent: "claude-code" | "codex" | "agy";
   model: string;
   summary: string;
   duration_minutes: number;
@@ -3226,7 +3224,7 @@ scripts/generated/
 ├── install_network.sh     # Tailscale
 ├── install_lang.sh        # bun, uv, rust, go
 ├── install_tools.sh       # ast-grep, atuin, zoxide
-├── install_agents.sh      # claude, codex, gemini
+├── install_agents.sh      # claude, codex, agy
 ├── install_db.sh          # PostgreSQL 18, Vault
 ├── install_cloud.sh       # wrangler, supabase, vercel
 ├── install_stack.sh       # Dicklesworthstone 10-tool stack + utilities
@@ -4168,13 +4166,13 @@ codex --version
 codex  # Follow first-run sign-in prompts
 ```
 
-**Gemini CLI**:
+**Antigravity CLI**:
 ```bash
 # Check auth status
-gemini --version
+agy --version
 
 # Re-authenticate
-gemini  # Follow Google login flow, or use /auth inside Gemini CLI
+agy  # Follow Google login flow
 ```
 
 ### "Command Not Found" After Install

acfs.manifest.yaml

@@ -801,7 +801,7 @@ modules:
 
               parent_comm="$(ps -o comm= -p "${PPID:-0}" 2>/dev/null || true)"
               case "$parent_comm" in
-                  claude|codex|cod|cc|gmi|gemini|bun|node) return 0 ;;
+                  claude|codex|cod|cc|agy|antigravity|agy-locked|gmi|gemini|bun|node) return 0 ;;
                   *) return 1 ;;
               esac
           }
@@ -947,13 +947,13 @@ modules:
         "$target_bin/codex" --version || "$target_bin/codex" --help
 
   - id: agents.gemini
-    description: Google Gemini CLI
+    description: Legacy Google Gemini CLI (retired; not installed by default)
     category: agents
     phase: 7
     run_as: target_user
-    optional: false
-    enabled_by_default: true
-    tags: [recommended, agent]
+    optional: true
+    enabled_by_default: false
+    tags: [legacy, agent]
     dependencies:
       - lang.bun
       - lang.nvm
@@ -1074,7 +1074,7 @@ modules:
     notes:
       - "Pin the model to 'Gemini 3.1 Pro (High)' on every invocation (see scripts/lib/agy_model_guard.sh)"
       - "Auth is Google OAuth (a human step); the agy() shell function in acfs.zshrc launches it model-pinned"
-      - "Legacy gmi/Gemini CLI (agents.gemini) is kept only for reading old ~/.gemini/tmp history"
+      - "ACFS installs agy-locked and maps both agy and gmi to it; the legacy Gemini CLI module is not installed by default"
 
   - id: agents.opencode
     description: OpenCode (multi-provider agent harness)
@@ -3334,7 +3334,7 @@ modules:
     dependencies:
       - agents.claude
       - agents.codex
-      - agents.gemini
+      - agents.antigravity
       - cli.modern
     installed_check:
       run_as: target_user
@@ -3359,7 +3359,7 @@ modules:
           "    0:welcome  - This instructions window" \
           "    1:claude   - Claude Code (Anthropic)" \
           "    2:codex    - Codex CLI (OpenAI)" \
-          "    3:gemini   - Gemini CLI (Google)" \
+          "    3:agy      - Antigravity CLI (Google)" \
           "" \
           "  TMUX BASICS:" \
           "    Ctrl-b d        - Detach (keep session running)" \
@@ -3370,7 +3370,7 @@ modules:
           "  START AN AGENT:" \
           "    claude          - Start Claude Code" \
           "    codex           - Start Codex CLI" \
-          "    gemini          - Start Gemini CLI" \
+          "    agy             - Start Antigravity CLI" \
           "" \
           "  PROJECT: /data/projects/my_first_project" \
           "  (Rename with: mv /data/projects/my_first_project /data/projects/NEW_NAME)" \
@@ -3385,7 +3385,7 @@ modules:
           # Add agent windows
           tmux new-window -t "$SESSION_NAME" -n "claude" -c /data/projects/my_first_project
           tmux new-window -t "$SESSION_NAME" -n "codex" -c /data/projects/my_first_project
-          tmux new-window -t "$SESSION_NAME" -n "gemini" -c /data/projects/my_first_project
+          tmux new-window -t "$SESSION_NAME" -n "agy" -c /data/projects/my_first_project
 
           # Send instructions to welcome window
           tmux send-keys -t "$SESSION_NAME:welcome" "cat ~/.acfs/workspace-instructions.txt" Enter

acfs/zsh/acfs.zshrc

@@ -164,7 +164,7 @@ alias install='sudo apt install'
 alias search='apt search'
 
 # Update agent CLIs
-alias uca='(curl -fsSL https://claude.ai/install.sh | bash -s -- latest) && ("$HOME/.bun/bin/bun" install -g --trust @openai/codex@latest || "$HOME/.bun/bin/bun" install -g --trust @openai/codex) && (curl -fsSL https://antigravity.google/cli/install.sh | bash) && ("$HOME/.bun/bin/bun" install -g --trust @google/gemini-cli@latest && curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/misc_coding_agent_tips_and_scripts/main/fix-gemini-cli-ebadf-crash.sh | bash)'
+alias uca='(curl -fsSL https://claude.ai/install.sh | bash -s -- latest) && ("$HOME/.bun/bin/bun" install -g --trust @openai/codex@latest || "$HOME/.bun/bin/bun" install -g --trust @openai/codex) && "$HOME/.local/bin/agy" update'
 
 # --- Custom functions ---
 mkcd() { mkdir -p "$1" && cd "$1" || return; }
@@ -527,25 +527,9 @@ fi
 alias cc='NODE_OPTIONS="--max-old-space-size=32768" ~/.local/bin/claude --dangerously-skip-permissions'
 alias cod='codex --dangerously-bypass-approvals-and-sandbox'
 
-# gmi: LEGACY — the Gemini CLI retired June 18, 2026 (no longer serves Pro/Ultra/free
-# tiers). Kept only to read/resume already-existing ~/.gemini/tmp history. Use `agy`
-# for all new work. Updates gemini-cli via bun, applies patches, then launches.
-gmi() {
-  echo "▶ Updating gemini-cli to latest..."
-  "$HOME/.bun/bin/bun" install -g --trust @google/gemini-cli@latest 2>&1 | tail -1
-  echo "▶ Applying patches..."
-  curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/misc_coding_agent_tips_and_scripts/main/fix-gemini-cli-ebadf-crash.sh | bash
-  echo "▶ Launching gemini..."
-  "$HOME/.bun/bin/gemini" --yolo "$@"
-}
-
-# agy: Antigravity CLI (Google) — the successor to the retired gmi/Gemini CLI.
-# The agy binary self-updates in the background (no bun reinstall needed). Per the
-# agy_model_guard mandate the model is pinned to "Gemini 3.1 Pro (High)" — never a
-# Flash or non-High Pro tier. See ACFS scripts/lib/agy_model_guard.sh (source of truth).
-agy() {
-  command agy --model "Gemini 3.1 Pro (High)" --dangerously-skip-permissions "$@"
-}
+# agy/gmi: Antigravity CLI (Google), locked to ACFS policy.
+alias agy='$HOME/.local/bin/agy-locked'
+alias gmi='$HOME/.local/bin/agy-locked'
 
 # bun project helpers (common)
 alias bdev='bun run dev'

apps/web/lib/generated/manifest-modules.ts

@@ -32,7 +32,7 @@ export interface ManifestProvenanceMetadata {
 
 export const manifestProvenance = {
   acfsVersion: "0.7.0",
-  manifestSha256: "87d6c7762648da45c90b2bf7f8439a45b31b67d44905d09695d56165107b538c",
+  manifestSha256: "68ada50689c30f1a9212481f5a53da562d704ed881ad92658e68a41b52d421ec",
   checksumsYamlSha256: "3c3f1fb130915218c4d1f3b567775986e7640a1daeb9ce8263485c9d546abc04",
 } as const satisfies ManifestProvenanceMetadata;
 
@@ -336,19 +336,19 @@ export const manifestModules: ManifestModuleMetadata[] = [
   },
   {
     id: "agents.gemini",
-    description: "Google Gemini CLI",
+    description: "Legacy Google Gemini CLI (retired; not installed by default)",
     category: "agents",
     phase: 7,
     dependencies: [
       "lang.bun",
       "lang.nvm",
     ],
     tags: [
-      "recommended",
+      "legacy",
       "agent",
     ],
-    enabledByDefault: true,
-    optional: false,
+    enabledByDefault: false,
+    optional: true,
   },
   {
     id: "agents.antigravity",
@@ -990,7 +990,7 @@ export const manifestModules: ManifestModuleMetadata[] = [
     dependencies: [
       "agents.claude",
       "agents.codex",
-      "agents.gemini",
+      "agents.antigravity",
       "cli.modern",
     ],
     tags: [
@@ -1084,7 +1084,7 @@ export const manifestSelectionProfiles: ManifestSelectionProfile[] = [
       "lang.uv",
       "agents.claude",
       "agents.codex",
-      "agents.gemini",
+      "agents.antigravity",
       "stack.ntm",
       "stack.mcp_agent_mail",
       "stack.ultimate_bug_scanner",

docs/AGY_MIGRATION_REFERENCE.md

@@ -27,7 +27,7 @@ agy --version                                                 # -> 1.0.7
 | `brain/<uuid>/.system_generated/logs/transcript.jsonl` | ⭐ **Clean JSONL transcript of the conversation** — the recommended READ source (§3). Also `transcript_full.jsonl`. |
 | `brain/<uuid>/.system_generated/messages/*.json` | Per-message JSON. |
 | `brain/<uuid>/*.md` | Working docs (implementation_plan.md / task.md / walkthrough.md) — only for substantive conversations. |
-| `settings.json` | `{ "enableTelemetry": false, "model": "Gemini 3.1 Pro (High)" }` — the persisted default model + telemetry flag. |
+| `settings.json` | ACFS pins `enableTelemetry: false`, `model: "Gemini 3.1 Pro (High)"`, `toolPermission: "always-proceed"`, `artifactReviewPolicy: "always-proceed"`, native-terminal rendering, sandbox off, and the other `agy-locked` defaults before every launch. |
 | `cache/projects.json`, `cache/onboarding.json` | Workspace/onboarding metadata only (NOT history). |
 | `antigravity-oauth-token`, `installation_id`, `keybindings.json`, `builtin/`, `implicit/`, `log/cli-*.log` | Auth, ids, config, logs. |
 | `~/.gemini/config/mcp_config.json` | MCP server registration (empty by default; see §7). |
@@ -121,7 +121,7 @@ agy reads MCP servers from `~/.gemini/config/mcp_config.json` — **empty by def
 
 | gmi (legacy) | agy |
 |---|---|
-| `gmi` (interactive) | `agy` (interactive) |
+| `gmi` (interactive) | `agy-locked` (same forward path as `agy`) |
 | scripted prompt | `agy --print "<prompt>" --model "Gemini 3.1 Pro (High)"` |
 | history `~/.gemini/tmp/<hash>/chats/session-*.json` (JSON) | `~/.gemini/antigravity-cli/conversations/<uuid>.db` + `brain/<uuid>/…/transcript.jsonl` |
 | resume | `agy --continue` / `agy --conversation <uuid>` |

docs/AGY_ROLLOUT_CUTOVER.md

@@ -16,7 +16,8 @@ forward path for all new work.
 
 ## Guiding principle (applied everywhere)
 
-- **Operational** ("start a session" / spawn / recommend / default swarm) → `agy`.
+- **Operational** ("start a session" / spawn / recommend / default swarm) → `agy`
+  through the ACFS `agy-locked` launcher.
 - **Historical** (resume/read/discover an existing Gemini session) → keep `gmi`/`gemini`.
 - **Model mandate**: every `agy` invocation is pinned to **`Gemini 3.1 Pro (High)`** —
   the only allowed model. Single source of truth: `scripts/lib/agy_model_guard.sh`
@@ -29,7 +30,7 @@ forward path for all new work.
 
 | Surface | Status | Notes |
 |---|---|---|
-| **ACFS install** | ✅ | `agents.antigravity` manifest module (verified_installer, checksum-gated); `uca` updates agy; `agy()` model-pinned launcher in acfs.zshrc; `doctor` checks `agent.alias.agy`. |
+| **ACFS install** | ✅ | `agents.antigravity` manifest module (verified_installer, checksum-gated); `uca` updates agy; `agy-locked` pins settings/model, installs the Antigravity dcg hook, and backs both `agy` and `gmi`. |
 | **ACFS docs/onboarding** | ✅ | AGENTS.md, README, onboarding lessons, info/report/continue/cheatsheet, swarm-default mixes (`--agy=`). |
 | **ACFS checksum monitor** | ✅ | `antigravity` in `KNOWN_INSTALLERS` + `checksums.yaml`; monitored like uv/rustup/bun. |
 | **Shared e2e harness** | ✅ | `scripts/lib/agy_e2e_harness.sh` (structured logging, skip-if-unauth, model-guard, headless round-trip). |
@@ -65,15 +66,16 @@ history and must not break:
 
 - casr `src/providers/gemini.rs`, ntm/cass gemini discovery, dcg `Agent::GeminiCli`,
   caam legacy gemini account handling, franken gemini connector.
-- ACFS `agents.gemini` manifest module + `gmi()` zshrc launcher (relabelled legacy).
+- ACFS `agents.gemini` manifest module is optional legacy; `gmi` now launches the
+  same `agy-locked` forward path as `agy`.
 - Doc tables that list `--gmi=N` as a legacy flag alongside `--agy=N`.
 
 ## Keep / remove decision (final) + user comms
 
-- **Decision: keep `gmi` as a labeled legacy reader everywhere; never remove it.**
-  Old `~/.gemini/tmp/<hash>/chats/*.json` history must stay readable/resumable
-  indefinitely so previously-indexed data is never stranded. Only the *forward*
-  path (spawn / recommend / default swarm / new sessions) moved to `agy`.
+- **Decision: keep the old Gemini history readable through history/indexing tools,
+  but make the `gmi` command launch `agy-locked`.** Old
+  `~/.gemini/tmp/<hash>/chats/*.json` data must stay readable/resumable by tools
+  that understand it, but the shell command no longer starts the retired CLI.
 - **Sequencing met the deadline**: the user-facing path — ACFS install, `ntm spawn`,
   cass index, casr resume, the skills, and the swarm helpers — all drive `agy`
   before the 2026-06-18 retirement; agy was installed+authed on all 7 machines first.