@cluesmith/codev 3.1.6 → 3.1.8

package/dist/commands/consult/index.d.ts

@@ -16,6 +16,7 @@ interface ModelConfig {
     envVar: string | null;
 }
 declare const MODEL_CONFIGS: Record<string, ModelConfig>;
+declare const MODEL_ALIASES: Record<string, string>;
 export interface ConsultOptions {
     model: string;
     prompt?: string;
@@ -63,6 +64,55 @@ declare function computePersistentOutputPath(state: BuilderProjectState, model:
  * Mirrors runClaudeConsultation() — streams events, captures usage, records metrics.
  */
 export declare function runCodexConsultation(queryText: string, role: string, workspaceRoot: string, outputPath?: string, metricsCtx?: MetricsContext): Promise<void>;
+/**
+ * Build the env passed to the Claude Agent SDK subprocess for a consultation.
+ *
+ * Copies the given environment, but when a Claude subscription/OAuth token
+ * (`CLAUDE_CODE_OAUTH_TOKEN`) is present, strips `ANTHROPIC_API_KEY` and
+ * `ANTHROPIC_AUTH_TOKEN` from the *copy* (never the global `process.env`).
+ * The Agent SDK prioritizes the API key over the OAuth token, so leaving the
+ * key in would silently route CMAP/review traffic to the metered Opus API
+ * instead of the Claude subscription (issue #985).
+ *
+ * When no OAuth token is set, the API key is preserved so CI / key-only
+ * environments continue to authenticate.
+ *
+ * The deletion is scoped to this subprocess env only — other callers that need
+ * the API key (persona, dev:local) are unaffected.
+ */
+export declare function buildClaudeConsultEnv(processEnv: NodeJS.ProcessEnv): Record<string, string>;
+export declare const AGY_OAUTH_MARKERS: string[];
+/**
+ * Verify a path is the real headless `agy` CLI, not the Antigravity IDE
+ * launcher. The IDE ships `~/.antigravity/.../bin/agy` as a symlink to the
+ * Electron app binary (`Antigravity.app/.../antigravity`); resolving it and
+ * launching it would open the IDE, never produce a `--print` review. We reject
+ * by realpath WITHOUT executing anything (no risk of launching the GUI).
+ */
+export declare function isRealAgyCli(p: string): boolean;
+/**
+ * Resolve the real `agy` CLI binary deterministically — never trust a bare
+ * PATH lookup (a stale shell or the IDE symlink shadows the CLI). Prefers the
+ * official installer path, then a PATH `agy` verified not to be the IDE.
+ * Returns null if no valid headless CLI is found.
+ */
+/**
+ * Positively verify a candidate behaves like the real headless agy CLI by
+ * running `--version` (read-only, fast). `isRealAgyCli` rejects the IDE launcher
+ * by realpath; this adds behavioral verification for an *untrusted* PATH
+ * candidate so we only run a binary proven to be the CLI.
+ */
+export declare function agyRespondsToVersion(bin: string): boolean;
+export declare function resolveAgyBin(): string | null;
+/** Non-blocking skip artifact: porch's verdict parser treats COMMENT as non-blocking. */
+declare function agySkipContent(reason: string): string;
+/**
+ * Run the `gemini` consult lane via the Antigravity CLI (`agy --print`).
+ * Preserves agentic file-reading (--sandbox --add-dir), folds the role into the
+ * prompt, and NEVER blocks the run: a missing/unauthed/invalid CLI or a
+ * timeout/error produces a non-blocking COMMENT skip instead of throwing.
+ */
+declare function runAgyConsultation(queryText: string, role: string, workspaceRoot: string, outputPath?: string, metricsCtx?: MetricsContext): Promise<void>;
 /**
  * Get a compact diff stat summary and list of changed files.
  *
@@ -115,5 +165,5 @@ declare function buildPlanQuery(plan: ContentRef, spec: ContentRef | null): stri
  * Main consult entry point
  */
 export declare function consult(options: ConsultOptions): Promise<void>;
-export { getDiffStat as _getDiffStat, buildSpecQuery as _buildSpecQuery, buildPlanQuery as _buildPlanQuery, buildPRQuery as _buildPRQuery, composePRQueryText as _composePRQueryText, computePersistentOutputPath as _computePersistentOutputPath, MODEL_CONFIGS as _MODEL_CONFIGS, };
+export { getDiffStat as _getDiffStat, buildSpecQuery as _buildSpecQuery, buildPlanQuery as _buildPlanQuery, buildPRQuery as _buildPRQuery, composePRQueryText as _composePRQueryText, computePersistentOutputPath as _computePersistentOutputPath, MODEL_CONFIGS as _MODEL_CONFIGS, MODEL_ALIASES as _MODEL_ALIASES, runAgyConsultation as _runAgyConsultation, agySkipContent as _agySkipContent, };
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/consult/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/consult/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,QAAA,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAG9C,CAAC;AAoBF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AA6JD,UAAU,mBAAmB;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAwED;;;;;;;;;;GAUG;AACH,iBAAS,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAItF;AAsCD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,cAAc,GAC1B,OAAO,CAAC,IAAI,CAAC,CA0Ff;AA8SD;;;;;GAKG;AACH,iBAAS,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAK1F;AAuDD;;;;;;;GAOG;AACH,iBAAS,kBAAkB,CAAC,MAAM,EAAE;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CA+CT;AAED;;;;;;;;;;;GAWG;AACH,iBAAS,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuB1C;AAED;;GAEG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,MAAM,CAoCzE;AAyFD;;GAEG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,MAAM,CAoCzE;AAoWD;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsJpE;AAGD,OAAO,EACL,WAAW,IAAI,YAAY,EAC3B,cAAc,IAAI,eAAe,EACjC,cAAc,IAAI,eAAe,EACjC,YAAY,IAAI,aAAa,EAC7B,kBAAkB,IAAI,mBAAmB,EACzC,2BAA2B,IAAI,4BAA4B,EAC3D,aAAa,IAAI,cAAc,GAChC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/consult/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,QAAA,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAM9C,CAAC;AAcF,QAAA,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AA6JD,UAAU,mBAAmB;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAwED;;;;;;;;;;GAUG;AACH,iBAAS,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAItF;AAsCD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,cAAc,GAC1B,OAAO,CAAC,IAAI,CAAC,CA0Ff;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,CAAC,UAAU,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB;AA2GD,eAAO,MAAM,iBAAiB,UAK7B,CAAC;AAUF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAU/C;AAED;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOzD;AAED,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAmB7C;AAED,yFAAyF;AACzF,iBAAS,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAa9C;AA+CD;;;;;GAKG;AACH,iBAAe,kBAAkB,CAC/B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,cAAc,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmHf;AA2KD;;;;;GAKG;AACH,iBAAS,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAK1F;AAuDD;;;;;;;GAOG;AACH,iBAAS,kBAAkB,CAAC,MAAM,EAAE;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CA+CT;AAED;;;;;;;;;;;GAWG;AACH,iBAAS,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwB1C;AAED;;GAEG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,MAAM,CAoCzE;AAyFD;;GAEG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,MAAM,CAoCzE;AAoWD;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsJpE;AAGD,OAAO,EACL,WAAW,IAAI,YAAY,EAC3B,cAAc,IAAI,eAAe,EACjC,cAAc,IAAI,eAAe,EACjC,YAAY,IAAI,aAAa,EAC7B,kBAAkB,IAAI,mBAAmB,EACzC,2BAA2B,IAAI,4BAA4B,EAC3D,aAAa,IAAI,cAAc,EAC/B,aAAa,IAAI,cAAc,EAC/B,kBAAkB,IAAI,mBAAmB,EACzC,cAAc,IAAI,eAAe,GAClC,CAAC"}

package/dist/commands/consult/index.js

@@ -9,7 +9,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawn, execSync, execFileSync } from 'node:child_process';
-import { tmpdir } from 'node:os';
+import { tmpdir, homedir } from 'node:os';
 import chalk from 'chalk';
 import { query as claudeQuery } from '@anthropic-ai/claude-agent-sdk';
 import { Codex } from '@openai/codex-sdk';
@@ -20,7 +20,10 @@ import { MetricsDB } from './metrics.js';
 import { extractUsage, extractReviewText } from './usage-extractor.js';
 import { executeForgeCommandSync } from '../../lib/forge.js';
 const MODEL_CONFIGS = {
-    gemini: { cli: 'gemini', args: ['--model', 'gemini-3.1-pro-preview'], envVar: 'GEMINI_SYSTEM_MD' },
+    // gemini dispatches to the Antigravity CLI (`agy`) via runAgyConsultation —
+    // this entry exists only for model validation and the `pro` alias; its
+    // cli/args are NOT used for dispatch (agy's binary path is resolved at runtime).
+    gemini: { cli: 'agy', args: [], envVar: null },
     hermes: { cli: 'hermes', args: ['chat', '-q'], envVar: null },
 };
 // Models that use an Agent SDK instead of CLI subprocess
@@ -381,6 +384,35 @@ export async function runCodexConsultation(queryText, role, workspaceRoot, outpu
         }
     }
 }
+/**
+ * Build the env passed to the Claude Agent SDK subprocess for a consultation.
+ *
+ * Copies the given environment, but when a Claude subscription/OAuth token
+ * (`CLAUDE_CODE_OAUTH_TOKEN`) is present, strips `ANTHROPIC_API_KEY` and
+ * `ANTHROPIC_AUTH_TOKEN` from the *copy* (never the global `process.env`).
+ * The Agent SDK prioritizes the API key over the OAuth token, so leaving the
+ * key in would silently route CMAP/review traffic to the metered Opus API
+ * instead of the Claude subscription (issue #985).
+ *
+ * When no OAuth token is set, the API key is preserved so CI / key-only
+ * environments continue to authenticate.
+ *
+ * The deletion is scoped to this subprocess env only — other callers that need
+ * the API key (persona, dev:local) are unaffected.
+ */
+export function buildClaudeConsultEnv(processEnv) {
+    const env = {};
+    for (const [key, value] of Object.entries(processEnv)) {
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+        delete env.ANTHROPIC_API_KEY;
+        delete env.ANTHROPIC_AUTH_TOKEN;
+    }
+    return env;
+}
 /**
  * Run Claude consultation via Agent SDK.
  * Uses the SDK's query() function instead of CLI subprocess.
@@ -397,12 +429,7 @@ async function runClaudeConsultation(queryText, role, workspaceRoot, outputPath,
     // the nesting guard. Restore it after the SDK call.
     const savedClaudeCode = process.env.CLAUDECODE;
     delete process.env.CLAUDECODE;
-    const env = {};
-    for (const [key, value] of Object.entries(process.env)) {
-        if (value !== undefined) {
-            env[key] = value;
-        }
-    }
+    const env = buildClaudeConsultEnv(process.env);
     try {
         const session = claudeQuery({
             prompt: queryText,
@@ -474,6 +501,265 @@ async function runClaudeConsultation(queryText, role, workspaceRoot, outputPath,
         }
     }
 }
+// ── Antigravity CLI (`agy`) backend for the `gemini` lane ──────────────────
+// Replaces the retiring Gemini CLI. agy is an agent (reads files from disk via
+// --add-dir under --sandbox), OAuth-only, default model = Flash, plain-text
+// output (no usage JSON). See spec/plan 778.
+// Markers that indicate agy is NOT authenticated (it prints an OAuth URL and
+// waits ~30s for an interactive login that can't complete headlessly). When
+// seen, we terminate early and emit a non-blocking COMMENT skip.
+export const AGY_OAUTH_MARKERS = [
+    'accounts.google.com/o/oauth2',
+    'Authentication required',
+    'paste the authorization code',
+    'Waiting for authentication',
+];
+const AGY_PRINT_TIMEOUT = '5m'; // passed to `agy --print-timeout`
+const AGY_TIMEOUT_MS = 6 * 60 * 1000; // Codev-owned hard cap (> agy's own timeout)
+// OAuth banner appears before any review text; only scan the early stream.
+const AGY_MARKER_SCAN_LIMIT = 8192;
+// agy's own print-timeout message: on an agentic task that outruns --print-timeout,
+// it returns this (often with a "monitoring the task" note) instead of a review.
+// Treat it as a non-response → non-blocking skip rather than a garbage "review".
+const AGY_NONRESPONSE_MARKER = 'timed out waiting for response';
+/**
+ * Verify a path is the real headless `agy` CLI, not the Antigravity IDE
+ * launcher. The IDE ships `~/.antigravity/.../bin/agy` as a symlink to the
+ * Electron app binary (`Antigravity.app/.../antigravity`); resolving it and
+ * launching it would open the IDE, never produce a `--print` review. We reject
+ * by realpath WITHOUT executing anything (no risk of launching the GUI).
+ */
+export function isRealAgyCli(p) {
+    try {
+        if (!fs.existsSync(p))
+            return false;
+        const real = fs.realpathSync(p);
+        if (real.includes('Antigravity.app'))
+            return false; // IDE app bundle
+        if (/[/\\]antigravity(\.exe)?$/.test(real))
+            return false; // IDE launcher binary
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolve the real `agy` CLI binary deterministically — never trust a bare
+ * PATH lookup (a stale shell or the IDE symlink shadows the CLI). Prefers the
+ * official installer path, then a PATH `agy` verified not to be the IDE.
+ * Returns null if no valid headless CLI is found.
+ */
+/**
+ * Positively verify a candidate behaves like the real headless agy CLI by
+ * running `--version` (read-only, fast). `isRealAgyCli` rejects the IDE launcher
+ * by realpath; this adds behavioral verification for an *untrusted* PATH
+ * candidate so we only run a binary proven to be the CLI.
+ */
+export function agyRespondsToVersion(bin) {
+    try {
+        const out = execSync(`"${bin}" --version 2>/dev/null`, { encoding: 'utf-8', timeout: 5000 }).trim();
+        return out.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function resolveAgyBin() {
+    // Explicit override (advanced users / tests): use it if valid, never silently
+    // fall back to a different binary the user didn't ask for.
+    const override = process.env.CODEV_AGY_BIN;
+    if (override)
+        return isRealAgyCli(override) ? override : null;
+    // Canonical install path — trusted location; realpath-reject the IDE only.
+    const preferred = path.join(homedir(), '.local', 'bin', 'agy');
+    if (isRealAgyCli(preferred))
+        return preferred;
+    // A bare PATH `agy` is untrusted: require it to NOT be the IDE (realpath) AND
+    // to behave like the headless CLI (`--version`) before we'll run it.
+    try {
+        const found = execSync('command -v agy 2>/dev/null', { encoding: 'utf-8' }).trim();
+        if (found && isRealAgyCli(found) && agyRespondsToVersion(found))
+            return found;
+    }
+    catch {
+        // not on PATH
+    }
+    return null;
+}
+/** Non-blocking skip artifact: porch's verdict parser treats COMMENT as non-blocking. */
+function agySkipContent(reason) {
+    return [
+        '---',
+        'VERDICT: COMMENT',
+        `SUMMARY: Gemini lane skipped — ${reason}`,
+        'CONFIDENCE: LOW',
+        '---',
+        '',
+        `The Gemini (Antigravity \`agy\`) reviewer was skipped: ${reason}.`,
+        'This is a non-blocking skip; the remaining reviewers still apply. To enable the',
+        'Gemini lane, install the CLI (https://antigravity.google/cli/install.sh) and run',
+        '`agy` once to sign in.',
+    ].join('\n');
+}
+/**
+ * Per-process sandbox temp dir for consult artifacts (the PR diff written by
+ * buildPRQuery, and the large-prompt file written by runAgyConsultation).
+ *
+ * Created once per CLI invocation (each `consult` run is its own process), so the
+ * sandboxed `agy` reviewer can be granted exactly this directory via `--add-dir`
+ * instead of the entire OS temp dir — keeping the grant scoped to the artifacts
+ * this flow creates. `mkdtempSync` yields a private, user-owned dir; callers still
+ * write with mode 0o600 / flag 'wx' to defeat symlink/clobber races.
+ */
+let _consultSandboxDir = null;
+function consultSandboxDir() {
+    if (!_consultSandboxDir) {
+        _consultSandboxDir = fs.mkdtempSync(path.join(tmpdir(), 'codev-consult-'));
+    }
+    return _consultSandboxDir;
+}
+function writeConsultOutput(outputPath, content) {
+    if (!outputPath || content.length === 0)
+        return;
+    const outputDir = path.dirname(outputPath);
+    if (!fs.existsSync(outputDir))
+        fs.mkdirSync(outputDir, { recursive: true });
+    fs.writeFileSync(outputPath, content);
+    console.error(`\nOutput written to: ${outputPath}`);
+}
+function recordAgyMetrics(metricsCtx, startTime, exitCode, errorMessage) {
+    if (!metricsCtx)
+        return;
+    recordMetrics(metricsCtx, {
+        durationSeconds: (Date.now() - startTime) / 1000,
+        // agy --print emits plain text, no token usage → cost rows degrade gracefully (null).
+        inputTokens: null,
+        cachedInputTokens: null,
+        outputTokens: null,
+        costUsd: null,
+        exitCode,
+        errorMessage,
+    });
+}
+/**
+ * Run the `gemini` consult lane via the Antigravity CLI (`agy --print`).
+ * Preserves agentic file-reading (--sandbox --add-dir), folds the role into the
+ * prompt, and NEVER blocks the run: a missing/unauthed/invalid CLI or a
+ * timeout/error produces a non-blocking COMMENT skip instead of throwing.
+ */
+async function runAgyConsultation(queryText, role, workspaceRoot, outputPath, metricsCtx) {
+    const startTime = Date.now();
+    const bin = resolveAgyBin();
+    if (!bin) {
+        const reason = 'agy CLI not found (install: https://antigravity.google/cli/install.sh)';
+        const content = agySkipContent(reason);
+        process.stdout.write(content);
+        writeConsultOutput(outputPath, content);
+        recordAgyMetrics(metricsCtx, startTime, 0, reason);
+        console.error(`\n[gemini (agy) skipped: ${reason}]`);
+        return;
+    }
+    // agy has no system-prompt flag — fold the role into the prompt (hermes precedent).
+    const prompt = `${role}\n\n---\n\n${queryText}`;
+    // Grant the sandboxed agent read access to the workspace AND the dedicated consult
+    // sandbox dir (where buildPRQuery writes the diff and, below, a large-prompt file
+    // lands) — NOT the entire OS temp dir, which would over-expose unrelated /tmp files.
+    const addDirs = [workspaceRoot, consultSandboxDir()];
+    let tempFile = null;
+    let promptArg = prompt;
+    // Large prompts can exceed ARG_MAX (E2BIG) — write to a temp file and point agy at it.
+    if (prompt.length > CLI_PROMPT_INLINE_MAX_CHARS) {
+        tempFile = path.join(consultSandboxDir(), `codev-consult-prompt-${Date.now()}.md`);
+        fs.writeFileSync(tempFile, prompt);
+        promptArg = [
+            `Read the full consultation prompt from this file: ${tempFile}`,
+            'You have file access. Read files directly from disk to review code.',
+        ].join('\n\n');
+    }
+    const args = ['--print', '--sandbox', '--print-timeout', AGY_PRINT_TIMEOUT];
+    for (const d of addDirs)
+        args.push('--add-dir', d);
+    args.push(promptArg);
+    const cleanup = () => {
+        if (tempFile && fs.existsSync(tempFile)) {
+            try {
+                fs.unlinkSync(tempFile);
+            }
+            catch { /* best-effort */ }
+        }
+    };
+    return new Promise((resolve) => {
+        const proc = spawn(bin, args, {
+            cwd: workspaceRoot,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const outChunks = [];
+        let scanBuf = '';
+        let settled = false;
+        const settleSkip = (reason, exitCode = 0) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                proc.kill('SIGTERM');
+            }
+            catch { /* already gone */ }
+            cleanup();
+            const content = agySkipContent(reason);
+            process.stdout.write(content);
+            writeConsultOutput(outputPath, content);
+            recordAgyMetrics(metricsCtx, startTime, exitCode, reason);
+            console.error(`\n[gemini (agy) skipped: ${reason}]`);
+            resolve();
+        };
+        const timer = setTimeout(() => settleSkip('agy timed out (no response)', 1), AGY_TIMEOUT_MS);
+        const watch = (buf, isStdout) => {
+            if (isStdout)
+                outChunks.push(buf);
+            if (scanBuf.length < AGY_MARKER_SCAN_LIMIT) {
+                scanBuf += buf.toString('utf-8');
+                if (AGY_OAUTH_MARKERS.some((m) => scanBuf.includes(m))) {
+                    settleSkip('agy not authenticated — run `agy` once to sign in (OAuth)', 1);
+                }
+            }
+        };
+        proc.stdout?.on('data', (b) => watch(b, true));
+        proc.stderr?.on('data', (b) => watch(b, false));
+        proc.on('error', (err) => {
+            settleSkip(`agy failed to start: ${err.message}`, 1);
+        });
+        proc.on('close', (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            cleanup();
+            const raw = Buffer.concat(outChunks).toString('utf-8').trim();
+            if (code !== 0 || raw.length === 0 || raw.includes(AGY_NONRESPONSE_MARKER)) {
+                const reason = code !== 0
+                    ? `agy exited with code ${code}`
+                    : raw.includes(AGY_NONRESPONSE_MARKER)
+                        ? 'agy timed out producing the review'
+                        : 'agy produced no review output';
+                const content = agySkipContent(reason);
+                process.stdout.write(content);
+                writeConsultOutput(outputPath, content);
+                recordAgyMetrics(metricsCtx, startTime, code ?? 1, reason);
+                console.error(`\n[gemini (agy) skipped: ${reason}]`);
+                resolve();
+                return;
+            }
+            // Plain-text stdout IS the review.
+            process.stdout.write(raw);
+            writeConsultOutput(outputPath, raw);
+            recordAgyMetrics(metricsCtx, startTime, 0, null);
+            console.error(`\n[gemini (agy) completed in ${((Date.now() - startTime) / 1000).toFixed(1)}s]`);
+            resolve();
+        });
+    });
+}
 /**
  * Run the consultation — dispatches to the correct model runner.
  */
@@ -495,6 +781,14 @@ async function runConsultation(model, query, workspaceRoot, role, outputPath, me
         console.error(`\n[${model} completed in ${duration.toFixed(1)}s]`);
         return;
     }
+    // gemini lane → Antigravity CLI (`agy`); handles its own logging, metrics,
+    // and non-blocking skip (see runAgyConsultation).
+    if (model === 'gemini') {
+        const startTime = Date.now();
+        await runAgyConsultation(query, role, workspaceRoot, outputPath, metricsCtx);
+        logQuery(workspaceRoot, model, query, (Date.now() - startTime) / 1000);
+        return;
+    }
     const config = MODEL_CONFIGS[model];
     if (!config) {
         throw new Error(`Unknown model: ${model}`);
@@ -504,31 +798,8 @@ async function runConsultation(model, query, workspaceRoot, role, outputPath, me
         throw new Error(`${config.cli} not found. Please install it first.`);
     }
     let tempFile = null;
-    const env = {};
     let cmd;
-    // When true, the query is written to the child's stdin instead of argv.
-    // Used for gemini to avoid V8 heap exhaustion on large prompts (#680).
-    let stdinPayload = null;
-    if (model === 'gemini') {
-        // Gemini uses GEMINI_SYSTEM_MD env var for role
-        tempFile = path.join(tmpdir(), `codev-role-${Date.now()}.md`);
-        fs.writeFileSync(tempFile, role);
-        env['GEMINI_SYSTEM_MD'] = tempFile;
-        // Bugfix #680: gemini-cli v0.37.x crashes on large PR diffs (>500KB) due to
-        // V8 old-space exhaustion in the spawned subprocess. Mitigations:
-        //   1. Bump heap via NODE_OPTIONS (survives gemini-cli's internal relaunch).
-        //   2. Pipe the prompt via stdin instead of argv — avoids ARG_MAX and keeps
-        //      V8 from holding the full prompt buffer twice.
-        env['NODE_OPTIONS'] = [process.env.NODE_OPTIONS ?? '', '--max-old-space-size=8192']
-            .join(' ')
-            .trim();
-        stdinPayload = query;
-        // Use --output-format json to capture token usage/cost in structured output.
-        // Never use --yolo — it allows Gemini to write files (#370).
-        // No positional query arg: prompt arrives on stdin (triggers non-interactive mode).
-        cmd = [config.cli, '--output-format', 'json', ...config.args];
-    }
-    else if (model === 'hermes') {
+    if (model === 'hermes') {
         // Hermes does not have a dedicated system prompt flag for single-shot mode.
         // Include role context at the top of the prompt.
         const hermesPrompt = `${role}\n\n---\n\n${query}`;
@@ -551,27 +822,14 @@ async function runConsultation(model, query, workspaceRoot, role, outputPath, me
     else {
         throw new Error(`Unknown model: ${model}`);
     }
-    // Execute with passthrough stdio.
-    // Use 'ignore' for stdin when no payload — prevents blocking when spawned as subprocess.
-    // Use 'pipe' when we need to stream the prompt in (e.g. gemini, see #680).
-    const fullEnv = { ...process.env, ...env };
+    // Execute with passthrough stdio. stdin is 'ignore' (hermes passes its prompt
+    // via argv) — prevents blocking when spawned as a subprocess.
     const startTime = Date.now();
-    const stdinMode = stdinPayload !== null ? 'pipe' : 'ignore';
     return new Promise((resolve, reject) => {
         const proc = spawn(cmd[0], cmd.slice(1), {
             cwd: workspaceRoot,
-            env: fullEnv,
-            stdio: [stdinMode, 'pipe', 'inherit'],
+            stdio: ['ignore', 'pipe', 'inherit'],
         });
-        if (stdinPayload !== null && proc.stdin) {
-            proc.stdin.on('error', (err) => {
-                // EPIPE can happen if the child exits before reading all input — not fatal.
-                if (err.code !== 'EPIPE') {
-                    reject(err);
-                }
-            });
-            proc.stdin.end(stdinPayload, 'utf-8');
-        }
         const chunks = [];
         if (proc.stdout) {
             proc.stdout.on('data', (chunk) => {
@@ -774,9 +1032,10 @@ function buildPRQuery(prId) {
     const prData = fetchPRData(prId);
     const diff = fetchPRDiff(prId);
     // Private-per-user dir to avoid world-readable /tmp diffs + symlink/clobber
-    // races: mkdtempSync creates a fresh dir owned by us; writeFileSync with
+    // races: consultSandboxDir() is a fresh mkdtempSync dir owned by us (and the
+    // only temp dir granted to the sandboxed agy reviewer); writeFileSync with
     // flag 'wx' refuses to follow a symlink or overwrite an existing file.
-    const diffDir = fs.mkdtempSync(path.join(tmpdir(), 'codev-pr-'));
+    const diffDir = consultSandboxDir();
     const diffPath = path.join(diffDir, `pr-${prId}.diff`);
     fs.writeFileSync(diffPath, diff, { encoding: 'utf-8', mode: 0o600, flag: 'wx' });
     const diffBytes = Buffer.byteLength(diff, 'utf-8');
@@ -1400,5 +1659,5 @@ export async function consult(options) {
     await runConsultation(model, query, workspaceRoot, role, outputPath, metricsCtx, isGeneralMode);
 }
 // Exported for testing
-export { getDiffStat as _getDiffStat, buildSpecQuery as _buildSpecQuery, buildPlanQuery as _buildPlanQuery, buildPRQuery as _buildPRQuery, composePRQueryText as _composePRQueryText, computePersistentOutputPath as _computePersistentOutputPath, MODEL_CONFIGS as _MODEL_CONFIGS, };
+export { getDiffStat as _getDiffStat, buildSpecQuery as _buildSpecQuery, buildPlanQuery as _buildPlanQuery, buildPRQuery as _buildPRQuery, composePRQueryText as _composePRQueryText, computePersistentOutputPath as _computePersistentOutputPath, MODEL_CONFIGS as _MODEL_CONFIGS, MODEL_ALIASES as _MODEL_ALIASES, runAgyConsultation as _runAgyConsultation, agySkipContent as _agySkipContent, };
 //# sourceMappingURL=index.js.map