Fix agy update priming and packet sanitization

Dicklesworthstone · Dicklesworthstone · commit ca63e96fab60 · 2026-06-24T22:57:21.000-04:00
diff --git a/README.md b/README.md
@@ -1232,7 +1232,7 @@ Benefits for agentic workflows:
 | **Claude Code** | `claude` | `cc` (dangerous mode) |
 | **Codex CLI** | `codex` | `cod` (dangerous mode) |
 | **Antigravity CLI** | `agy` | `agy` (model-pinned, dangerous mode) |
-| **Gemini CLI** (legacy) | `gemini` | `gmi` (retired 2026-06-18; old-history reads only) |
+| **Gemini CLI** (legacy) | `gemini` | `gmi` (retired 2026-06-18; routes to locked `agy`) |
 
 **Vibe Mode Aliases:**
 ```bash
diff --git a/acfs/onboard/lessons/04_agents_login.md b/acfs/onboard/lessons/04_agents_login.md
@@ -14,7 +14,7 @@ You have three powerful coding agents installed:
 | Codex CLI | `codex` | `cod` | OpenAI |
 | Antigravity CLI | `agy` | `agy` | Google |
 
-> The Gemini CLI (`gmi`) it replaced retired on 2026-06-18. `gmi` is still defined for reading old `~/.gemini/tmp` history, but use `agy` for all new work.
+> The Gemini CLI retired on 2026-06-18. `gmi` is still defined for muscle memory, but ACFS maps it to the same locked Antigravity launcher as `agy`; use `agy` in new docs and workflows.
 
 ---
 
diff --git a/acfs/zsh/acfs.zshrc b/acfs/zsh/acfs.zshrc
@@ -164,7 +164,7 @@ alias install='sudo apt install'
 alias search='apt search'
 
 # Update agent CLIs
-alias uca='(curl -fsSL https://claude.ai/install.sh | bash -s -- latest) && ("$HOME/.bun/bin/bun" install -g --trust @openai/codex@latest || "$HOME/.bun/bin/bun" install -g --trust @openai/codex) && "$HOME/.local/bin/agy" update'
+alias uca='(curl -fsSL https://claude.ai/install.sh | bash -s -- latest) && ("$HOME/.bun/bin/bun" install -g --trust @openai/codex@latest || "$HOME/.bun/bin/bun" install -g --trust @openai/codex) && "$HOME/.local/bin/agy" update && "$HOME/.local/bin/agy-locked" --acfs-prime-settings'
 
 # --- Custom functions ---
 mkcd() { mkdir -p "$1" && cd "$1" || return; }
diff --git a/apps/web/app/learn/commands/page.tsx b/apps/web/app/learn/commands/page.tsx
@@ -133,7 +133,7 @@ const COMMANDS: CommandEntry[] = [
   {
     name: "gmi",
     fullName: "Gemini CLI (legacy)",
-    description: "Retired 2026-06-18 — superseded by `agy`; kept for old sessions",
+    description: "Legacy shortcut retained for old habits; now launches locked `agy`",
     example: 'gmi "explain the repo structure"',
     category: "agents",
     learnMoreHref: "/learn/tools/gemini-cli",
@@ -157,7 +157,7 @@ const COMMANDS: CommandEntry[] = [
   {
     name: "gemini",
     fullName: "Gemini CLI (legacy)",
-    description: "Full command for the retired `gmi`; kept for old sessions",
+    description: "Retired Gemini CLI reference; use `agy` or legacy shortcut `gmi`",
     example: "gemini --help",
     category: "agents",
     learnMoreHref: "/learn/tools/gemini-cli",
diff --git a/apps/web/app/learn/tools/[tool]/tool-data.tsx b/apps/web/app/learn/tools/[tool]/tool-data.tsx
@@ -153,7 +153,7 @@ const RAW_TOOLS: Record<ToolId, ToolCard> = {
   "gemini-cli": {
     id: "gemini-cli",
     title: "Gemini CLI (legacy)",
-    tagline: "Retired 2026-06-18 - superseded by the Antigravity CLI (agy)",
+    tagline: "Retired 2026-06-18 - legacy gmi now routes to locked agy",
     icon: <Search className="h-8 w-8" aria-hidden="true" />,
     gradient: "from-blue-500/20 via-indigo-500/20 to-blue-500/20",
     glowColor: "rgba(99,102,241,0.4)",
diff --git a/apps/web/components/agent-commands/AgentHeroCard.tsx b/apps/web/components/agent-commands/AgentHeroCard.tsx
@@ -62,7 +62,7 @@ export const agentPersonalities: Record<
     glowColor: "oklch(0.75 0.18 195)",
     bgGlow: "bg-[oklch(0.75_0.18_195/0.15)]",
     borderHover: "hover:border-[oklch(0.75_0.18_195/0.5)]",
-    tagline: "Gemini CLI — legacy, retired 2026-06-18",
+    tagline: "Legacy gmi shortcut now launches locked agy",
   },
 };
 
@@ -99,7 +99,7 @@ export function AgentHeroCard({
         return;
       }
 
-      const keyNum = parseInt(e.key);
+      const keyNum = parseInt(e.key, 10);
       if (keyNum === index + 1 && keyNum >= 1 && keyNum <= 4) {
         cardRef.current?.focus();
         onKeyboardFocus?.(true);
diff --git a/apps/web/components/agent-commands/QuickAccessBar.tsx b/apps/web/components/agent-commands/QuickAccessBar.tsx
@@ -18,7 +18,7 @@ export const quickCommands: QuickCommand[] = [
   { alias: "cc", agentType: "claude", label: "Claude", iconGradient: "from-orange-400 to-amber-500" },
   { alias: "cod", agentType: "codex", label: "Codex", iconGradient: "from-emerald-400 to-teal-500" },
   { alias: "agy", agentType: "antigravity", label: "Antigravity", iconGradient: "from-blue-400 to-purple-500" },
-  // Legacy: Gemini CLI was retired 2026-06-18 (kept for users resuming old sessions).
+  // Legacy shortcut: Gemini CLI retired 2026-06-18; ACFS maps gmi to locked agy.
   { alias: "gmi", agentType: "gemini", label: "Gemini (legacy)", iconGradient: "from-blue-400 to-indigo-500" },
 ];
 
diff --git a/apps/web/components/lessons/agents-login-lesson.tsx b/apps/web/components/lessons/agents-login-lesson.tsx
@@ -142,10 +142,10 @@ export function AgentsLoginLesson() {
         </div>
 
         <Paragraph>
-          Legacy: <Highlight>gmi</Highlight> (
-          <Highlight>gemini --yolo</Highlight>) is still defined for reading old
-          sessions, but the Gemini CLI it launched retired 2026-06-18 — reach for{" "}
-          <Highlight>agy</Highlight> instead.
+          Legacy: <Highlight>gmi</Highlight> is still defined, but it now launches
+          the same locked Antigravity path as <Highlight>agy</Highlight>. The
+          Gemini CLI retired 2026-06-18, so use <Highlight>agy</Highlight> for
+          new work and treat old Gemini references as history/context only.
         </Paragraph>
       </Section>
 
@@ -186,7 +186,7 @@ export function AgentsLoginLesson() {
           <LoginStep
             agent="Gemini CLI (legacy)"
             command='export GEMINI_API_KEY="your-gemini-api-key"'
-            description="Legacy path for the retired gemini CLI (kept for old ~/.gemini/tmp history). Put the key in ~/.gemini/.env or your shell config, then run gemini."
+            description="Only for intentionally opening the retired gemini binary or old ~/.gemini/tmp material. The gmi shortcut now launches locked agy."
             gradient="from-blue-500/10 to-indigo-500/10"
           />
         </div>
diff --git a/apps/web/lib/commands.ts b/apps/web/lib/commands.ts
@@ -135,7 +135,7 @@ export const COMMANDS: CommandRef[] = [
   {
     name: "gmi",
     fullName: "Gemini CLI (legacy)",
-    description: "Retired 2026-06-18 — superseded by agy. Kept for old sessions.",
+    description: "Legacy shortcut retained for old habits; now launches locked agy.",
     category: "agents",
     example: 'gmi "review this PR"',
     aliases: ["gemini"],
diff --git a/apps/web/lib/jargon.ts b/apps/web/lib/jargon.ts
@@ -354,9 +354,9 @@ export const jargonDictionary: Record<string, JargonTerm> = {
   "gemini-cli": {
     term: "Gemini CLI (legacy)",
     short: "Google's retired predecessor to Antigravity CLI",
-    long: "Gemini CLI was Google's earlier terminal coding assistant. ACFS keeps legacy references so old session history and docs remain understandable, but new work should use Antigravity CLI through the `agy` command.",
+    long: "Gemini CLI was Google's earlier terminal coding assistant. ACFS keeps legacy references so old session history and docs remain understandable, but the `gmi` shortcut now routes to the same locked Antigravity path as `agy`.",
     analogy: "Gemini CLI is the old doorway into the Google model family. Antigravity is the current doorway for new sessions.",
-    why: "Legacy Gemini references matter for reading old history and migration notes. For new coding-agent work, use Antigravity CLI instead.",
+    why: "Legacy Gemini references matter for reading old history and migration notes. For new coding-agent work, use Antigravity CLI through `agy`; `gmi` remains only as a familiar shortcut to that same path.",
     related: ["ai-agents", "claude-code", "codex", "antigravity-cli"],
   },
 
diff --git a/apps/web/lib/providerProvisioningPacket.test.ts b/apps/web/lib/providerProvisioningPacket.test.ts
@@ -253,6 +253,28 @@ describe("buildProviderProvisioningPacket", () => {
     expect(json).not.toContain("PRIVATE");
   });
 
+  test("sanitizes free-form provider metadata before support-safe serialization", () => {
+    const packet = buildProviderProvisioningPacket({
+      ...baseInput,
+      providerId: "Linode\napi_token=sk_live_1234567890",
+      planName: "Shared 32 GB password=hunter2",
+      ubuntuVersion: "24.04 bearer abcdef",
+      region: "newark 203.0.113.42",
+      sshPublicKeyFingerprint: "SHA256:fixture",
+    });
+    const json = serializeProviderProvisioningPacketJson(packet);
+
+    expect(packet.provider.id).toBe("other");
+    expect(packet.provider.name).toBe("Other provider");
+    expect(packet.size.planName).toBe("custom plan");
+    expect(packet.osImage.version).toBe("25.10");
+    expect(packet.region.id).toBe("not-listed");
+    expect(json).not.toContain("sk_live_1234567890");
+    expect(json).not.toContain("hunter2");
+    expect(json).not.toContain("bearer abcdef");
+    expect(json).not.toContain("203.0.113.42");
+  });
+
   test("carries ref pins and module profile selectors into the install command", () => {
     const packet = buildProviderProvisioningPacket({
       ...baseInput,
diff --git a/apps/web/lib/providerProvisioningPacket.ts b/apps/web/lib/providerProvisioningPacket.ts
@@ -408,6 +408,45 @@ const PROVIDER_PACKET_PRESETS: Record<string, ProviderPacketPreset> = {
   },
 };
 
+function collapsePacketText(value: string): string {
+  return value.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+}
+
+function looksSensitivePacketText(value: string): boolean {
+  if (/-----begin [a-z ]*private key-----/i.test(value)) return true;
+  if (/^[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^@\s]+@/i.test(value)) return true;
+  if (/\bbearer\s+\S+/i.test(value)) return true;
+  if (/(?:token|api[_-]?key|secret|password|private[_-]?key|cookie|session|credential|client[_-]?secret|webhook[_-]?secret|vault[_-]?token)/i.test(value)) {
+    return true;
+  }
+  if (/(?:^|[^0-9])(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:[^0-9]|$)/.test(value)) {
+    return true;
+  }
+
+  const compact = value.replace(/[^A-Za-z0-9]/g, "");
+  return compact.length >= 40 && /[A-Za-z]/.test(compact) && /[0-9]/.test(compact);
+}
+
+function safePacketText(value: string | null | undefined, fallback: string, maxLength = 80): string {
+  const collapsed = collapsePacketText(value ?? "");
+  if (!collapsed || looksSensitivePacketText(collapsed)) return fallback;
+  return collapsed.slice(0, maxLength);
+}
+
+function safePacketSlug(value: string | null | undefined, fallback: string): string {
+  const slug = safePacketText(value, fallback, 80)
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, "-")
+    .replace(/^[._-]+|[._-]+$/g, "")
+    .slice(0, 64);
+  return slug || fallback;
+}
+
+function safePacketUbuntuVersion(value: string | null | undefined): string {
+  const safe = safePacketText(value, "25.10", 16);
+  return /^[0-9]{2}\.[0-9]{2}$/.test(safe) ? safe : "25.10";
+}
+
 function readinessCheckStatus(
   checks: VPSReadinessCheck[],
   id: VPSReadinessCheck["id"],
@@ -416,7 +455,7 @@ function readinessCheckStatus(
 }
 
 function providerPresetFor(providerId: string): ProviderPacketPreset {
-  const normalizedProviderId = providerId.trim().toLowerCase();
+  const normalizedProviderId = safePacketSlug(providerId, "other");
   const provider = VPS_PROVIDERS.find((entry) => entry.id === normalizedProviderId);
   if (provider) {
     return {
@@ -430,7 +469,9 @@ function providerPresetFor(providerId: string): ProviderPacketPreset {
 
   return PROVIDER_PACKET_PRESETS[normalizedProviderId] ?? {
     id: normalizedProviderId || "other",
-    name: normalizedProviderId === "other" || !normalizedProviderId ? "Other provider" : providerId,
+    name: normalizedProviderId === "other" || !normalizedProviderId
+      ? "Other provider"
+      : safePacketText(providerId, "Other provider"),
     productUrl: "",
     automationLevel: "manual",
     cloudInitMode: "none",
@@ -485,17 +526,21 @@ function buildCloudInit(
 export function buildProviderProvisioningPacket(
   input: ProviderProvisioningPacketInput,
 ): ProviderProvisioningPacket {
-  const rawProviderId = input.providerId.trim();
-  const providerId = rawProviderId.toLowerCase() || "other";
+  const rawProviderId = safePacketText(input.providerId, "other");
+  const providerId = safePacketSlug(rawProviderId, "other");
+  const planName = safePacketText(input.planName, "custom plan");
+  const ubuntuVersion = safePacketUbuntuVersion(input.ubuntuVersion);
+  const regionId = safePacketSlug(input.region, "not-listed");
+  const regionLabel = safePacketText(input.region, "Not listed");
   const preset = providerPresetFor(rawProviderId || providerId);
   const requestedAgents = Number.isFinite(input.targetAgents) ? input.targetAgents : 10;
   const targetAgents = Math.max(1, Math.floor(requestedAgents));
   const targetUsername = normalizeSSHUsername(input.username) ?? "ubuntu";
   const readiness = validateVPSReadiness({
     providerId,
-    planName: input.planName,
-    ubuntuVersion: input.ubuntuVersion,
-    region: input.region,
+    planName,
+    ubuntuVersion,
+    region: regionId,
     targetAgents,
     workloadId: input.workloadId,
   });
@@ -547,13 +592,13 @@ export function buildProviderProvisioningPacket(
       manualStepsRemaining: manualStepsForProvider(preset.id),
     },
     region: {
-      id: input.region || "not-listed",
-      label: input.region || "Not listed",
+      id: regionId,
+      label: regionLabel,
       readinessStatus: regionReadiness === "unsupported" ? "unknown" : regionReadiness,
-      providerSpecificCode: input.region || undefined,
+      providerSpecificCode: regionId === "not-listed" ? undefined : regionId,
     },
     size: {
-      planName: input.planName || "custom plan",
+      planName,
       ramGB: readiness.plan?.ramGB ?? requiredSpecs.ramGB,
       vCPU: readiness.plan?.vCPU ?? requiredSpecs.vCPU,
       storageGB: readiness.plan?.storageGB ?? requiredSpecs.storageGB,
@@ -562,7 +607,7 @@ export function buildProviderProvisioningPacket(
     },
     osImage: {
       distribution: "ubuntu",
-      version: input.ubuntuVersion,
+      version: ubuntuVersion,
       minimumVersion: readiness.provider?.readiness.minimumUbuntu ?? "22.04",
       preferredVersions: readiness.provider?.readiness.preferredUbuntuVersions ?? ["25.10", "24.04"],
       readinessStatus: osReadiness,
diff --git a/scripts/generated/internal_checksums.sh b/scripts/generated/internal_checksums.sh
@@ -10,7 +10,7 @@
 declare -gA ACFS_INTERNAL_CHECKSUMS=(
   [scripts/lib/security.sh]="95366fc1c2497ff0e36a1f59f34621fdcec06f4da0ed439828ad601a626f4f75"
   [scripts/lib/agents.sh]="ae0cec5811a00648983c39ecf27e6ec477f3dd616f65dff3db27c154a4ff7304"
-  [scripts/lib/update.sh]="f310c474b5401acef9e502f71cf4ce3562788650299a189e025cffc990f8f681"
+  [scripts/lib/update.sh]="5db44415e65fe0bfebe049bc21a3f5a45049fab8ed73dab5d0766f3337042c76"
   [scripts/lib/doctor.sh]="0e047fa9166d5babb0d992dac0bf4df135f77df8db010459b9036d4703ab8591"
   [scripts/lib/doctor_fix.sh]="4be6bbc3a878bc9f8fbfc67373f236fe0557ea023fffa8177cd7330aea2ef93c"
   [scripts/lib/offline_artifact_pack.sh]="5f6fa7e5a9e115904656a627853b2c7d556183532a3d8fd42a0363bf3570c7eb"
diff --git a/scripts/lib/update.sh b/scripts/lib/update.sh
@@ -5022,6 +5022,11 @@ update_install_agy_locked_launchers() {
         update_run_in_target_context "" mkdir -p "$target_bin" || return 1
         update_run_in_target_context "" install -m 0755 "$source_file" "$target_bin/agy-locked" || return 1
         update_run_in_target_context "" install -m 0755 "$source_file" "$target_bin/gmi" || return 1
+        if update_run_in_target_context "" "$target_bin/agy-locked" --acfs-prime-settings; then
+            log_item "fix" "Antigravity locked settings" "model, permissions, and dcg hook primed"
+        else
+            log_item "warn" "Antigravity locked settings" "will be primed on next agy launch"
+        fi
         log_item "fix" "agy locked launchers" "$target_bin/agy-locked, $target_bin/gmi"
         return 0
     done
diff --git a/tests/unit/test_agy_install.sh b/tests/unit/test_agy_install.sh
@@ -58,6 +58,8 @@ check "acfs.zshrc maps gmi to the locked agy launcher" \
   "grep -q \"alias gmi='\\\$HOME/.local/bin/agy-locked'\" acfs/zsh/acfs.zshrc"
 check "uca updates agy instead of gemini-cli" \
   "grep '^alias uca=' acfs/zsh/acfs.zshrc | grep -q 'agy\" update' && ! grep '^alias uca=' acfs/zsh/acfs.zshrc | grep -q '@google/gemini-cli'"
+check "uca re-primes locked Antigravity settings after update" \
+  "grep '^alias uca=' acfs/zsh/acfs.zshrc | grep -q 'agy-locked\" --acfs-prime-settings'"
 check "agy locked launcher pins the required model" \
   "grep -q 'MODEL = \"Gemini 3.1 Pro (High)\"' scripts/lib/agy_locked.py"
 check "agy locked launcher pins always-proceed tool permission" \

Original file line number	Diff line number	Diff line change
`@@ -135,7 +135,7 @@ export const COMMANDS: CommandRef[] = [`
`135`	`135`	`{`
`136`	`136`	`name: "gmi",`
`137`	`137`	`fullName: "Gemini CLI (legacy)",`
`138`		`- description: "Retired 2026-06-18 — superseded by agy. Kept for old sessions.",`
	`138`	`+ description: "Legacy shortcut retained for old habits; now launches locked agy.",`
`139`	`139`	`category: "agents",`
`140`	`140`	`example: 'gmi "review this PR"',`
`141`	`141`	`aliases: ["gemini"],`