antigravity-sdk 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ade58fad8a0ce76edf2cb631fa0ff4e8c21efc86bfa2ae48d5489372145a6756
-  data.tar.gz: f06feea8e5aaae71a0b1a24167b8da5f89cead824e5ea4f858aac409b9431574
+  metadata.gz: 449edf2b1bf5f2aaa389a0e79b74c6ed93bc5b7623a957068b2bd704b292347b
+  data.tar.gz: c876958eb74ccac96717634b5a0c1d7314e837f2a3695a557d1d19eee4b6d853
 SHA512:
-  metadata.gz: 72b602c3732ca8e6a24f9684b8e595492381509afeae41493b75a05de9107e605cfffae134b48f58bed7414725a24a73a5fdd42514bbda19a220fb0831543e94
-  data.tar.gz: f8b3367309f54ae8e667eff77fb9e33da87943a279d5edebe2275c4ba1f2a7183db3a7da61c300efe771a64f8d9dee8299e99cd7d337f14d1a6221e9c5966b3e
+  metadata.gz: 6ccc779048181412d94425b9a9c4901339acfb957e4646b047ce4fe1b96e4d2b4f4b6096c560178920f68b22733a6d424b3d010769e17b592f90bc77d2004220
+  data.tar.gz: e170353f68f1fdbe47ab3c487136be397636a8855223204e72b4d216bd37c7d04592f935d22b207314d9ecd35c95b7ef3741397204005b89eaccdb7564578427

data/lib/antigravity/agent.rb

@@ -15,19 +15,9 @@ module Antigravity
       @hooks = Hooks.new
       @client = Client.new
 
-      # Auto-attach default safety guardrails
-      use_safety_defaults!
-
       yield(self) if block_given?
     end
 
-    def use_safety_defaults!
-      # Pre-tool guard against editing protected files (.env, Gemfile, etc.)
-      before_tool_call(&Safety::ProtectedFilesGuard.new)
-      # Post-tool secret masking
-      after_tool_call(&Safety::SecretMasker.new)
-    end
-
     def register_tool(tool_or_name = nil, description: "", &block)
       if block_given? && tool_or_name
         tool = Tool::Dynamic.new(tool_or_name, description: description, &block)

data/lib/antigravity/guards.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Antigravity
+  module Guards
+    # Configurable opt-in file protection guard
+    class FileProtection
+      DEFAULT_FILES = [
+        /\.env(\..*)?$/i,
+        /Gemfile(\.lock)?$/i,
+        /config\/secrets\.yml$/i,
+        /config\/database\.yml$/i
+      ].freeze
+
+      attr_reader :protected_files
+
+      def initialize(files: nil, add: [], remove: [])
+        initial_patterns = files ? Array(files) : DEFAULT_FILES
+        patterns = initial_patterns.map { |f| f.is_a?(Regexp) ? f : /#{Regexp.escape(f.to_s)}$/i }
+        patterns += Array(add).map { |f| f.is_a?(Regexp) ? f : /#{Regexp.escape(f.to_s)}$/i }
+        patterns -= Array(remove).map { |f| f.is_a?(Regexp) ? f : /#{Regexp.escape(f.to_s)}$/i }
+        @protected_files = patterns.freeze
+      end
+
+      def call(_tool_name, params)
+        path = extract_path(params)
+        return :allow unless path
+
+        if protected_path?(path)
+          { status: :deny, reason: "FileProtection Guard: Modifications to '#{path}' are restricted." }
+        else
+          :allow
+        end
+      end
+
+      def to_proc
+        method(:call).to_proc
+      end
+
+      private
+
+      def extract_path(params)
+        return nil unless params.is_a?(Hash)
+        params[:path] || params["path"] || params[:file] || params["file"] || params[:target]
+      end
+
+      def protected_path?(path)
+        filename = File.basename(path)
+        @protected_files.any? { |pattern| path =~ pattern || filename =~ pattern }
+      end
+    end
+
+    # Configurable opt-in secret masking filter
+    class SecretMasker
+      DEFAULT_PATTERNS = [
+        /(AIzaSy[A-Za-z0-9_-]{25,45})/,           # Google API Keys
+        /(sk-[A-Za-z0-9]{25,50})/,                # OpenAI API Keys
+        /(ghp_[A-Za-z0-9]{25,45})/,               # GitHub Tokens
+        /(bearer\s+[A-Za-z0-9\._-]{20,})/i       # Bearer Tokens
+      ].freeze
+
+      attr_reader :patterns, :replacement
+
+      def initialize(patterns: nil, replacement: "[REDACTED_SECRET]")
+        @patterns = (patterns ? Array(patterns) : DEFAULT_PATTERNS).freeze
+        @replacement = replacement
+      end
+
+      def call(_tool_name, _params, result)
+        return result unless result.is_a?(String)
+
+        sanitized = result.dup
+        @patterns.each do |pattern|
+          sanitized.gsub!(pattern, @replacement)
+        end
+        sanitized
+      end
+
+      def to_proc
+        method(:call).to_proc
+      end
+    end
+  end
+end

data/lib/antigravity.rb

@@ -5,7 +5,7 @@ require_relative "antigravity/config"
 require_relative "antigravity/message"
 require_relative "antigravity/harness"
 require_relative "antigravity/hooks"
-require_relative "antigravity/safety"
+require_relative "antigravity/guards"
 require_relative "antigravity/sidecar"
 require_relative "antigravity/tool"
 require_relative "antigravity/skill"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: antigravity-sdk
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Riccardo Carlesso
@@ -49,10 +49,10 @@ files:
 - lib/antigravity/agent.rb
 - lib/antigravity/client.rb
 - lib/antigravity/config.rb
+- lib/antigravity/guards.rb
 - lib/antigravity/harness.rb
 - lib/antigravity/hooks.rb
 - lib/antigravity/message.rb
-- lib/antigravity/safety.rb
 - lib/antigravity/sidecar.rb
 - lib/antigravity/skill.rb
 - lib/antigravity/tool.rb

data/lib/antigravity/safety.rb

@@ -1,74 +0,0 @@
-# frozen_string_literal: true
-
-module Antigravity
-  module Safety
-    # Pre-hook guardrail to prevent dangerous file edits or destructive operations
-    class ProtectedFilesGuard
-      PROTECTED_PATTERNS = [
-        /\.env(\..*)?$/i,
-        /Gemfile(\.lock)?$/i,
-        /config\/secrets\.yml$/i,
-        /config\/database\.yml$/i,
-        /\.git\//i,
-        /\/etc\//i
-      ].freeze
-
-      attr_reader :blocked_patterns
-
-      def initialize(additional_patterns: [])
-        @blocked_patterns = PROTECTED_PATTERNS + additional_patterns
-      end
-
-      def call(tool_name, params)
-        path = extract_path(params)
-        return :allow unless path
-
-        if protected_file?(path)
-          { status: :deny, reason: "Security Policy Violation: Modifications to '#{path}' are restricted and require explicit approval." }
-        else
-          :allow
-        end
-      end
-
-      def to_proc
-        method(:call).to_proc
-      end
-
-      private
-
-      def extract_path(params)
-        return nil unless params.is_a?(Hash)
-        params[:path] || params["path"] || params[:file] || params["file"] || params[:target]
-      end
-
-      def protected_file?(path)
-        filename = File.basename(path)
-        @blocked_patterns.any? { |pattern| path =~ pattern || filename =~ pattern }
-      end
-    end
-
-    # Post-hook sanitizer to redact sensitive API keys and tokens from tool outputs
-    class SecretMasker
-      SECRET_PATTERNS = [
-        /(AIzaSy[A-Za-z0-9_-]{25,45})/,           # Google API Keys
-        /(sk-[A-Za-z0-9]{25,50})/,                # OpenAI API Keys
-        /(ghp_[A-Za-z0-9]{25,45})/,               # GitHub Tokens
-        /(bearer\s+[A-Za-z0-9\._-]{20,})/i       # Bearer Tokens
-      ].freeze
-
-      def call(_tool_name, _params, result)
-        return result unless result.is_a?(String)
-
-        sanitized = result.dup
-        SECRET_PATTERNS.each do |pattern|
-          sanitized.gsub!(pattern, "[REDACTED_SECRET]")
-        end
-        sanitized
-      end
-
-      def to_proc
-        method(:call).to_proc
-      end
-    end
-  end
-end