@codeam/shared 2.75.2 → 2.75.4

package/dist/index.mjs

@@ -322,12 +322,34 @@ var AGENT_REGISTRY = {
     displayName: "Gemini CLI",
     binaryName: "gemini",
     enabled: true,
-    // OAuth via `gemini auth login` (captured by `codeam link gemini`
-    // from ~/.gemini/oauth_creds.json) AND GEMINI_API_KEY are both
-    // accepted by the backend's GeminiProvisioningStrategy and propagated
-    // into codespace deploys.
-    supportedAuthKinds: ["oauth_token", "api_key"],
-    preferredAuthKind: "oauth_token",
+    // ⚠️ API KEY ONLY since 2026-06-18, when Google stopped Gemini CLI (and the
+    // Gemini Code Assist IDE extensions) serving requests for AI Pro, AI Ultra
+    // and free users, in the move to Antigravity CLI. Its announcement is
+    // explicit about what survives: "Gemini CLI will remain accessible via paid
+    // Gemini and Gemini Enterprise Agent Platform API keys."
+    //
+    // So the agent stays — `@google/gemini-cli` is NOT deprecated, it still
+    // ships weekly — but the OAuth door has to go: it captures a
+    // `~/.gemini/oauth_creds.json` from a CONSUMER Google account, which is
+    // exactly the tier that no longer serves requests. We used to PREFER that
+    // path, so it was the one we recommended first; on 2026-09-15 prod held 63
+    // Gemini links, 46 of them OAuth, 19 created after 2026-09-01 and the
+    // newest that same day. Three months of sending people through a bricked
+    // door — each one landing on `isGeminiIneligibleTier` at first use.
+    //
+    // ⚠️ Antigravity CLI is NOT a drop-in replacement for us: no official ACP
+    // mode (google-antigravity/antigravity-cli#31 open, 192 comments, zero
+    // `acp` hits in the repo as of 2026-09-15), and every third-party ACP
+    // adapter warns that driving `agy` that way matches what Google's FAQ calls
+    // a ToS violation — risking the USER's Google account. Our whole Gemini
+    // path is ACP, so adopting it would mean shipping that risk. Revisit only
+    // when #31 ships an official mode.
+    //
+    // Existing OAuth rows are NOT migrated: `supportedAuthMethods` gates the
+    // LINK call only, so the 46 stay readable and simply keep failing at the
+    // provider, where the ineligible-tier message already explains why.
+    supportedAuthKinds: ["api_key"],
+    preferredAuthKind: "api_key",
     // Not listed by `headroom wrap --help` — runs native.
     headroomWrappable: false,
     // Native ACP server: `gemini --skip-trust --acp`.
@@ -1585,6 +1607,16 @@ var INTEGRATION_REGISTRY = {
     // tools ourselves via a BUILT-IN MCP (delivery.builtin) against that admin
     // API — see apps/cli/src/integrations/convex-admin-mcp.ts. The user still
     // pastes a deploy key (Dashboard → Project Settings → Deploy Keys).
+    //
+    // ⚠️ That built-in ALSO owns `deploy`, and it is the only way an agent can
+    // push `convex/` changes. Deploying is bundle + push, not a REST call, so
+    // that one tool drives Convex's own CLI with the deploy key injected into
+    // THAT CHILD's env — the agent's shell never sees the credential. Before
+    // it existed the agent had the credential's power through the MCP but no
+    // way to deploy, so it looped on `npx convex dev` (interactive login) and
+    // asked the user to paste the token into the chat; the user ended up
+    // re-entering the SAME key by hand in Environment Variables, after burning
+    // real credits (2026-09-15).
     enabled: true,
     auth: {
       kind: "api_key",
@@ -2499,6 +2531,26 @@ var AGENT_STANDARD_TEXT = `# Working standard
 
 You are an AI coding agent working on the user's project through CodeAgent Mobile. Follow this standard on every task.
 
+## How to answer \u2014 you are being read on a PHONE
+
+Your reply is read on a narrow screen, often one-handed, often while the user is doing something else. Length is a cost they pay. Write accordingly.
+
+- **Lead with the answer.** First line = the result, the decision, or what changed. No preamble, no restating the request, no "Great question!", no narrating what you are about to do.
+- **Default to a few sentences.** Most replies fit in 1-2 short paragraphs or 3-6 tight bullets. A long reply is a deliberate choice you make because the task genuinely needs it \u2014 not the default.
+- **Say it once.** No summary of the summary, no closing paragraph that repeats the opening, no "let me know if you need anything else".
+- **Cut every word that carries no information** \u2014 hedges, filler adverbs, throat-clearing, and praise for the question.
+- **Expand when asked.** "Explain in detail", "walk me through it", "why?" are requests for depth: give it fully. Brevity is the default, not a ceiling.
+
+**Formatting for a narrow screen:**
+- Short paragraphs (1-3 sentences). Bullets over prose for anything that is a list. Never a wall of text.
+- **No wide tables** \u2014 they force horizontal scrolling and become unreadable. Use bullets, or at most two columns.
+- Code blocks only when the user needs the exact characters (a command to run, the changed lines). Show the relevant lines, not the whole file. Keep lines short so they don't wrap badly.
+- File references as \`path/to/file.ts:42\`, not pasted paths inside long prose.
+- Bold sparingly, for the one thing that matters in a block. Headings only when the reply genuinely has multiple sections.
+- No ASCII art, no banners, no decorative separators, no emoji unless the user uses them first.
+
+**Compress evidence, don't drop it.** Report the outcome, not the transcript: "tests: 128/128 green", "build failed \u2014 \`TS2322\` in \`api/client.ts:80\`". Paste raw output only when the user needs to read it themselves, and only the relevant lines.
+
 ## How to work
 - **Understand before acting.** Restate the goal, read the relevant code, and be clear on what "done" looks like before changing anything.
 - **Plan first for anything non-trivial** (3+ steps or a design decision): outline the approach and the files you'll touch, and share it before implementing. Skip the ceremony for small, obvious fixes.