@elie-laloum/outpost 5.0.0 → 6.0.1

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 6.0.1
+
+- Rebuild the English and French Guide from scratch with focused explanations and short, directly usable snippets. Introduce a new page structure, task-based navigation and a dedicated responsive Guide layout.
+- Cover setup, agent configuration, sandboxes, workflows, persistence, monitoring, operations and the experimental model engine across 60 pages per language. Preserve the Reference content and navigation.
+- Redirect retired Guide URLs to their new destinations, including localized links and continuation anchors. Validate rendered links, search, navigation and examples in both languages.
+- Replace workshop preparation generation with compilation of Guide snippets, offline execution of selected examples and real Docker/Podman checks of the documented command example. Public library contracts are unchanged.
+
+## 6.0.0
+
+Breaking changes, without compatibility aliases:
+
+- Unify artifact, checkpoint, journal, resource activity and reservation persistence through Transport, with `localTransport()` for disk storage. Remove `fileArtifactStore`, `fileWorkflowCheckpointStore`, their option types, `logging.file` and `DispatchResult.log`; journals expose `logReference`. Default runtime objects live under `.outpost/storage`. Checkpoint and reservation crash recovery is explicit locally and remotely; old file layouts are not migrated. Git worktrees and execution staging remain filesystem operations. Local transports and inspection reads accept root-owned system links among ancestors, such as `/var` on macOS, and still reject links created by users.
+- Rename `CustomHarness` to `Harness` and `CustomHarnessOptions` to `HarnessOptions`; the former `Harness` union becomes `AgentHarness` (`CliHarness | Harness`). Runtime behavior and discriminants are unchanged.
+- Replace the `{ mode: "api-key" | "oauth-token" | "login", environment?, credentials? }` authentication shapes with `authentication: "account" | "usage" | { account: { file | key | variable } } | { usage: { key | variable } }` on every CLI harness, with the new `AccountCredential` and `UsageCredential` types. There is no automatic mode; unsupported forms fail when the agent is composed and list the accepted forms. `AgentAdapter.authenticate()` becomes `credentials(variables)`, returning a `CredentialPlan`.
+- `outpost init --authentication` accepts `account`, `account-token` (Claude and Copilot) or `usage` and defaults to `account`; generated scripts no longer read credential files.
+- Remove Gemini CLI, which no longer serves free, Google AI Pro and Ultra accounts: `geminiHarness()`, `GeminiSettings`, `agentVersions.gemini` and `doctor --agent gemini` are removed, and generated images no longer install `@google/gemini-cli`.
+
+Unified CLI authentication:
+
+- `account` copies the CLI's own host session into the private sandbox home: Claude `.credentials.json` (only `claudeAiOauth`), Codex `auth.json`, the Antigravity OAuth token file, the Copilot token stored in `config.json` (forwarded as `COPILOT_GITHUB_TOKEN`), and the Kimi Code credentials and device identifier followed by `kimi login` in the sandbox. `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `COPILOT_HOME` and `KIMI_CODE_HOME` relocate the host sources, and `account.file` selects a dedicated profile.
+- `usage` forwards the CLI's standard API-key variable: `ANTHROPIC_API_KEY`, `OPENAI_API_KEY` followed by `codex login --with-api-key` in the sandbox, `GEMINI_API_KEY` with a generated Antigravity `settings.json`, or `KIMI_API_KEY` translated to Kimi's model variables with a required model. Codex with a custom `modelProvider` accepts only usage forms, applied to `apiKeyEnvironment`. Classic `ghp_` tokens are rejected for Copilot.
+- Outpost reads only regular host files up to 1 MiB, never reads a system keychain, and installs credentials through one stdin-fed installer with 0700 directories and 0600 files. The local provider receives variables only: no file is written and no login command runs on the host.
+
+New CLI harnesses:
+
+- Add `antigravityHarness()`, `copilotHarness()` and `kimiHarness()` with `AntigravitySettings`, `CopilotSettings` and `KimiSettings`. They run fresh sessions without native capture, resume, fork or automatic response repairs, accept model names only and disable CLI auto-updates by default. Copilot and Kimi report no token usage. `doctor` accepts `antigravity`, `copilot` and `kimi`.
+- Generated images, the published agent image lock and remote bootstrap pin GitHub Copilot CLI 1.0.88 and Kimi Code 2.1.1. Images install `agy` with the official Antigravity script into `/usr/local/bin`, and remote bootstrap runs the same script when `agy` is missing; `agy` is not version-pinned. Images set `XDG_CACHE_HOME=/tmp/.cache` so Copilot can load its native addon outside the noexec home.
+- Protocols are covered by synthetic fixtures and help checks of the installed CLIs; live model runs of the three CLIs remain unvalidated.
+
 ## 5.0.0
 
 Breaking changes, without compatibility aliases:

package/README.md

@@ -2,13 +2,13 @@
 
 [Documentation](https://elie-laloum.github.io/outpost/) · [Français](https://elie-laloum.github.io/outpost/fr/) · [API](https://elie-laloum.github.io/outpost/reference/) · [Changelog](CHANGELOG.md)
 
-Outpost is a TypeScript library for running coding agents in reusable sandboxes, managing their Git workspaces and composing typed workflows. Claude Code, Codex and Gemini CLI adapters work with Docker, Podman, Vercel, Daytona or explicit host execution. Gemini supports fresh sessions only; native conversation capture, resume and fork are available for Claude Code and Codex.
+Outpost is a TypeScript library for running coding agents in reusable sandboxes, managing their Git workspaces and composing typed workflows. Claude Code, Codex, Antigravity, GitHub Copilot CLI and Kimi Code adapters work with Docker, Podman, Vercel, Daytona or explicit host execution. Each harness authenticates explicitly with your account login or an API key. Antigravity, Copilot and Kimi run fresh sessions only; native conversation capture, resume and fork are available for Claude Code and Codex.
 
-Version 5.0.0 composes every agent with `agent({ harness, model })`, moves reasoning and output limits onto the agent model, and adds an experimental built-in harness engine: Outpost drives a model provider with tools, hooks, permissions, persisted conversations, context strategies, skills and streaming. It contains breaking API changes. See the [changelog](CHANGELOG.md#500) for details and migration notes, and the [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) for remaining validation and upcoming priorities.
+Version 6.0.0 unifies CLI authentication: every harness selects `account` (your host login, copied into the private sandbox home) or `usage` (an API key), and Outpost never reads a system keychain. It replaces Gemini CLI with Antigravity, GitHub Copilot CLI and Kimi Code harnesses, routes all runtime persistence through storage transports, and renames the harness types. It contains breaking API changes. See the [changelog](CHANGELOG.md#600) for details and migration notes, and the [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) for remaining validation and upcoming priorities.
 
 ## Get started
 
-New to Outpost? Follow the [complete first-run workshop](https://elie-laloum.github.io/outpost/guide/start/quickstart/): choose Codex or Claude and account or API-key access, create a disposable TypeScript repository, then fix and verify a real test. The [Guide](https://elie-laloum.github.io/outpost/guide/) teaches the concepts; the [Reference](https://elie-laloum.github.io/outpost/reference/) explains exact contracts. Every [cookbook recipe](https://elie-laloum.github.io/outpost/guide/cookbook/) includes its own preparation and runnable code.
+Start with [Setup](https://elie-laloum.github.io/outpost/guide/setup/), then [send your first request](https://elie-laloum.github.io/outpost/guide/first-request/). The [Guide](https://elie-laloum.github.io/outpost/guide/introduction/) explains each capability with focused snippets; the [Reference](https://elie-laloum.github.io/outpost/reference/) documents exact API contracts.
 
 Requires Node.js **24+**, Git, a target repository with a commit, and the credentials of your chosen agent. The workflow can live in its own directory. This example uses Docker.
 
@@ -18,37 +18,37 @@ cd workflow1
 npx @elie-laloum/outpost init --yes --repository /path1/repository --install
 ```
 
-Copy `.env.example` to `.env` and declare `OPENAI_API_KEY`. An empty declaration inherits the matching process variable. Then run the generated script:
+The generated script uses `authentication: "account"`: log in to Codex on the host with file credential storage (`codex -c cli_auth_credentials_store='"file"' login`), and Outpost copies that login into the private sandbox home. For API billing instead, add `--authentication usage`, copy `.env.example` to `.env` and declare `OPENAI_API_KEY`; an empty declaration inherits the matching process variable. Then run the generated script:
 
 ```sh
 node run.ts "Add validation, run tests and commit the change"
 ```
 
-`init` creates `package.json`, `run.ts`, `brief.md`, `.env.example`, `.gitignore` and a container recipe directly in the workflow directory. Existing package manifests are preserved; explicit CommonJS projects get `run.mts` for compatibility. The script resolves its brief, environment and relative repository paths from its own directory. See [multi-repository workflows](https://elie-laloum.github.io/outpost/guide/workflows/sandbox-tasks/) to orchestrate several repositories.
+`init` creates `package.json`, `run.ts`, `brief.md`, `.env.example`, `.gitignore` and a container recipe directly in the workflow directory. Existing package manifests are preserved; explicit CommonJS projects get `run.mts` for compatibility. The script resolves its brief, environment and relative repository paths from its own directory. See [multi-repository workflows](https://elie-laloum.github.io/outpost/guide/parallel-repositories/) to orchestrate several repositories.
 
-Generated Codex API-key workflows prepare login inside the sandbox. For account login and credential storage, see [Connect Codex](https://elie-laloum.github.io/outpost/guide/agents/connect-codex/) before dispatching.
+Outpost never reads a system keychain. See [authentication](https://elie-laloum.github.io/outpost/guide/access-credentials/) for every agent's account and API-key forms before dispatching.
 
 ## Use the library
 
-After preparing the selected agent credentials and provider, library calls follow this shape. For a fully runnable version with explicit authentication, use the [dispatch workshop](https://elie-laloum.github.io/outpost/guide/agents/dispatch/).
+After preparing the selected agent credentials and provider, library calls follow this shape. For configuration and a first call, see [First request](https://elie-laloum.github.io/outpost/guide/first-request/).
 
 ```ts
 import { agent, dispatch, codexHarness } from "@elie-laloum/outpost";
 
 const result = await dispatch({
   repository: "/path1/repository",
-  agent: agent({ harness: codexHarness({}) }),
+  agent: agent({ harness: codexHarness({ authentication: "account" }) }),
   branch: { mode: "integrate" },
   brief: { text: "Fix the failing tests, verify and commit." },
 });
 console.log(result.branch, result.commits);
 ```
 
-`repository` selects a local Git checkout; without it, library calls use the current working directory. See [repository paths](https://elie-laloum.github.io/outpost/guide/environment/repositories/) for external checkouts and paths relative to the workflow script.
+`repository` selects a local Git checkout; without it, library calls use the current working directory. See [repository paths](https://elie-laloum.github.io/outpost/guide/repository-context/) for external checkouts and paths relative to the workflow script.
 
-Let Outpost drive a model itself with `harness({ modelProvider, tools, instructions, limits })` and tools from `defineHarnessTool()`, then compose it with `agent({ harness, model })`. See [build a custom harness](https://elie-laloum.github.io/outpost/guide/agents/harness/) for a complete example.
+Let Outpost drive a model itself with `harness({ modelProvider, tools, instructions, limits })` and tools from `defineHarnessTool()`, then compose it with `agent({ harness, model })`. See [build a custom harness](https://elie-laloum.github.io/outpost/guide/model-loop/) for configuration.
 
-Learn about [sandboxes](https://elie-laloum.github.io/outpost/guide/environment/lifecycle/), [workflows](https://elie-laloum.github.io/outpost/guide/workflows/graph/), [providers](https://elie-laloum.github.io/outpost/guide/environment/providers/overview/) and [recovery](https://elie-laloum.github.io/outpost/guide/operations/recovery/) in the English/French documentation. The [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) describes future work.
+Learn about [sandboxes](https://elie-laloum.github.io/outpost/guide/sandbox-sessions/), [workflows](https://elie-laloum.github.io/outpost/guide/task-dependencies/), [providers](https://elie-laloum.github.io/outpost/guide/execution-backends/) and [recovery](https://elie-laloum.github.io/outpost/guide/failure-recovery/) in the English/French documentation. The [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) describes future work.
 
 ## Development
 

package/SECURITY.md

@@ -12,6 +12,8 @@ Remote providers upload repository history and inputs to the selected cloud acco
 
 Prompt command expansion only recognizes commands present in the original prompt file. Substitution cannot introduce new expansion fragments. Values substituted inside an original shell command still have shell semantics and must be trusted or quoted by the prompt author.
 
+Agent authentication is explicit. `account` reads only the selected CLI's own session file (or the file or profile named by `account.file`) on the host, refuses links, directories and files above 1 MiB, and never reads a system keychain. Isolated providers receive a copy in the private sandbox home through stdin, with 0700 directories and 0600 files; `localSandboxProvider()` receives credential variables only and no host file is written. A sandbox copy can refresh and rotate a subscription refresh token, invalidating the host login; use a dedicated profile through `account.file` when that matters. Agents can read every credential they receive, so give them only the access their task requires. Generated images and remote bootstrap install npm CLIs at pinned versions, but install the Antigravity CLI with Google's official script, which fetches the current release: build and pin your own image when you need a reviewed agent binary.
+
 Conversation transcripts, logs, bundles and patches may contain secrets. Runtime files are ignored by Git and sensitive files are created with restrictive permissions where supported. Keep API keys in environment variables or ignored `.env` files. Never embed tokens in tracked configuration, remote URLs or examples.
 
 Report vulnerabilities privately using the repository's security reporting channel when enabled, or contact the maintainer through the hosting profile. Do not include live credentials in reports. V1 receives fixes for reproducible security defects.

package/dist/adapters/agents/antigravity-adapter.d.ts

@@ -0,0 +1,3 @@
+import type { CliHarness } from "../../domain/agent.types.ts";
+import type { AntigravitySettings } from "./antigravity.types.ts";
+export declare function antigravityHarness(settings?: AntigravitySettings): CliHarness;

package/dist/adapters/agents/antigravity-adapter.js

@@ -0,0 +1,39 @@
+import { antigravityCredentials } from "./antigravity-authentication.js";
+import { antigravityEvents } from "./antigravity-events.js";
+import { antigravityRequest } from "./antigravity-request.js";
+import { credentialPlanner } from "./authentication.js";
+import { antigravityModelSupport } from "./model-support.constants.js";
+import { harnessSettings, supportModel } from "./model-support.js";
+function bindAntigravity(settings) {
+    supportModel(antigravityModelSupport, settings.model);
+    const credentials = credentialPlanner("Antigravity", antigravityCredentials, settings.authentication, settings.model);
+    return Object.freeze({
+        name: "antigravity",
+        ...(credentials ? { credentials } : {}),
+        bootstrap: "antigravity",
+        resumable: false,
+        capture: false,
+        requiresFinishedEvent: true,
+        variables: Object.freeze({
+            AGY_CLI_DISABLE_AUTO_UPDATE: "true",
+            ...settings.variables,
+        }),
+        request: (input) => antigravityRequest(settings, input),
+        events: antigravityEvents,
+    });
+}
+export function antigravityHarness(settings = {}) {
+    harnessSettings(settings);
+    const configured = Object.freeze({
+        ...settings,
+        variables: Object.freeze({ ...settings.variables }),
+    });
+    return Object.freeze({
+        kind: "cli",
+        bind: (model) => bindAntigravity({
+            ...configured,
+            ...(model === undefined ? {} : { model }),
+        }),
+    });
+}
+//# sourceMappingURL=antigravity-adapter.js.map

package/dist/adapters/agents/antigravity-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-adapter.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGnE,SAAS,eAAe,CAAC,QAAoC;IAC3D,YAAY,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,iBAAiB,CACnC,aAAa,EACb,sBAAsB,EACtB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,KAAK,CACf,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,aAAa;QACnB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,2BAA2B,EAAE,MAAM;YACnC,GAAG,QAAQ,CAAC,SAAS;SACtB,CAAC;QACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;QACvD,MAAM,EAAE,iBAAiB;KACH,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAgC,EAAE;IAElC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,GAAG,QAAQ;QACX,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,CAAC,KAAkB,EAAE,EAAE,CAC3B,eAAe,CAAC;YACd,GAAG,UAAU;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { AgentAdapter, CliHarness } from \"../../domain/agent.types.ts\";\nimport type { AgentModel } from \"../../domain/model.types.ts\";\nimport { antigravityCredentials } from \"./antigravity-authentication.ts\";\nimport { antigravityEvents } from \"./antigravity-events.ts\";\nimport { antigravityRequest } from \"./antigravity-request.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport { credentialPlanner } from \"./authentication.ts\";\nimport { antigravityModelSupport } from \"./model-support.constants.ts\";\nimport { harnessSettings, supportModel } from \"./model-support.ts\";\nimport type { Bound } from \"./settings.types.ts\";\n\nfunction bindAntigravity(settings: Bound<AntigravitySettings>): AgentAdapter {\n  supportModel(antigravityModelSupport, settings.model);\n  const credentials = credentialPlanner(\n    \"Antigravity\",\n    antigravityCredentials,\n    settings.authentication,\n    settings.model,\n  );\n  return Object.freeze({\n    name: \"antigravity\",\n    ...(credentials ? { credentials } : {}),\n    bootstrap: \"antigravity\",\n    resumable: false,\n    capture: false,\n    requiresFinishedEvent: true,\n    variables: Object.freeze({\n      AGY_CLI_DISABLE_AUTO_UPDATE: \"true\",\n      ...settings.variables,\n    }),\n    request: (input) => antigravityRequest(settings, input),\n    events: antigravityEvents,\n  } satisfies AgentAdapter);\n}\n\nexport function antigravityHarness(\n  settings: AntigravitySettings = {},\n): CliHarness {\n  harnessSettings(settings);\n  const configured = Object.freeze({\n    ...settings,\n    variables: Object.freeze({ ...settings.variables }),\n  });\n  return Object.freeze({\n    kind: \"cli\",\n    bind: (model?: AgentModel) =>\n      bindAntigravity({\n        ...configured,\n        ...(model === undefined ? {} : { model }),\n      }),\n  });\n}\n"]}

package/dist/adapters/agents/antigravity-authentication.d.ts

@@ -0,0 +1,2 @@
+import type { CredentialStrategy } from "./authentication.types.ts";
+export declare const antigravityCredentials: CredentialStrategy;

package/dist/adapters/agents/antigravity-authentication.js

@@ -0,0 +1,27 @@
+import { credentialRecipes, credentialVariables, } from "./authentication.constants.js";
+import { hostFile, variableCredential } from "./authentication.js";
+const file = hostFile({
+    source: { path: "~/.gemini/antigravity-cli/antigravity-oauth-token" },
+    destination: { file: ".gemini/antigravity-cli/antigravity-oauth-token" },
+    login: "agy and sign in with your Google account",
+    alternative: `"usage" with ${credentialVariables.antigravity.usage}`,
+});
+const key = variableCredential({
+    variable: credentialVariables.antigravity.usage,
+    expose: () => ({
+        files: [
+            {
+                path: ".gemini/antigravity-cli/settings.json",
+                content: credentialRecipes.antigravitySettings,
+            },
+        ],
+    }),
+});
+export const antigravityCredentials = Object.freeze({
+    account: file.preset,
+    "account.file": file.file,
+    usage: key.preset,
+    "usage.key": key.key,
+    "usage.variable": key.variable,
+});
+//# sourceMappingURL=antigravity-authentication.js.map

package/dist/adapters/agents/antigravity-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-authentication.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGnE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACpB,MAAM,EAAE,EAAE,IAAI,EAAE,mDAAmD,EAAE;IACrE,WAAW,EAAE,EAAE,IAAI,EAAE,iDAAiD,EAAE;IACxE,KAAK,EAAE,0CAA0C;IACjD,WAAW,EAAE,gBAAgB,mBAAmB,CAAC,WAAW,CAAC,KAAK,EAAE;CACrE,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,mBAAmB,CAAC,WAAW,CAAC,KAAK;IAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACb,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,uCAAuC;gBAC7C,OAAO,EAAE,iBAAiB,CAAC,mBAAmB;aAC/C;SACF;KACF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAuB,MAAM,CAAC,MAAM,CAAC;IACtE,OAAO,EAAE,IAAI,CAAC,MAAM;IACpB,cAAc,EAAE,IAAI,CAAC,IAAI;IACzB,KAAK,EAAE,GAAG,CAAC,MAAM;IACjB,WAAW,EAAE,GAAG,CAAC,GAAG;IACpB,gBAAgB,EAAE,GAAG,CAAC,QAAQ;CAC/B,CAAC,CAAC","sourcesContent":["import {\n  credentialRecipes,\n  credentialVariables,\n} from \"./authentication.constants.ts\";\nimport { hostFile, variableCredential } from \"./authentication.ts\";\nimport type { CredentialStrategy } from \"./authentication.types.ts\";\n\nconst file = hostFile({\n  source: { path: \"~/.gemini/antigravity-cli/antigravity-oauth-token\" },\n  destination: { file: \".gemini/antigravity-cli/antigravity-oauth-token\" },\n  login: \"agy and sign in with your Google account\",\n  alternative: `\"usage\" with ${credentialVariables.antigravity.usage}`,\n});\n\nconst key = variableCredential({\n  variable: credentialVariables.antigravity.usage,\n  expose: () => ({\n    files: [\n      {\n        path: \".gemini/antigravity-cli/settings.json\",\n        content: credentialRecipes.antigravitySettings,\n      },\n    ],\n  }),\n});\n\nexport const antigravityCredentials: CredentialStrategy = Object.freeze({\n  account: file.preset,\n  \"account.file\": file.file,\n  usage: key.preset,\n  \"usage.key\": key.key,\n  \"usage.variable\": key.variable,\n});\n"]}

package/dist/adapters/agents/antigravity-diagnostics.d.ts

@@ -0,0 +1 @@
+export declare function antigravityDiagnostics(): readonly import("./cli-diagnostics.types.ts").AgentCliDiagnostic[];

package/dist/adapters/agents/antigravity-diagnostics.js

@@ -0,0 +1,6 @@
+import { antigravityRequest } from "./antigravity-request.js";
+import { helpDiagnostics } from "./cli-diagnostics.js";
+export function antigravityDiagnostics() {
+    return helpDiagnostics((input) => antigravityRequest({}, input), "Usage of agy:");
+}
+//# sourceMappingURL=antigravity-diagnostics.js.map

package/dist/adapters/agents/antigravity-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-diagnostics.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,UAAU,sBAAsB;IACpC,OAAO,eAAe,CACpB,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,EACxC,eAAe,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import { antigravityRequest } from \"./antigravity-request.ts\";\nimport { helpDiagnostics } from \"./cli-diagnostics.ts\";\n\nexport function antigravityDiagnostics() {\n  return helpDiagnostics(\n    (input) => antigravityRequest({}, input),\n    \"Usage of agy:\",\n  );\n}\n"]}

package/dist/adapters/agents/antigravity-events.d.ts

@@ -0,0 +1,2 @@
+import type { AgentEvent } from "../../domain/agent.types.ts";
+export declare function antigravityEvents(line: string): AgentEvent[];

package/dist/adapters/agents/antigravity-events.js

@@ -0,0 +1,66 @@
+import { decodeLine } from "./event-decoder.js";
+import { asRecord, numberOrZero } from "./protocol.js";
+const steps = {
+    agent_response: (step) => typeof step.text_delta === "string" && step.text_delta
+        ? [{ kind: "text", text: step.text_delta }]
+        : [],
+    tool: (step) => typeof step.tool_name === "string" &&
+        (step.state === "DONE" || step.state === "ERROR")
+        ? [
+            {
+                kind: "tool",
+                name: step.tool_name,
+                input: asRecord(step.tool_info).parameters,
+            },
+        ]
+        : [],
+};
+function failure(result, response) {
+    if (typeof result.error === "string" && result.error)
+        return result.error;
+    if (result.status === "SUCCESS" && !response.trim())
+        return "Antigravity returned an empty response";
+    return `Antigravity ended the turn with status ${String(result.status ?? "unknown")}`;
+}
+function result(event) {
+    const result = asRecord(event.result);
+    const usage = asRecord(result.usage);
+    const response = typeof result.response === "string" ? result.response : "";
+    const events = Object.keys(usage).length
+        ? [
+            {
+                kind: "usage",
+                tokens: {
+                    input: numberOrZero(usage.input_tokens),
+                    cached: numberOrZero(usage.cache_read_tokens),
+                    output: numberOrZero(usage.output_tokens) +
+                        numberOrZero(usage.thinking_tokens),
+                },
+            },
+        ]
+        : [];
+    if (result.status === "SUCCESS" && response.trim())
+        return [
+            ...events,
+            { kind: "result", text: response },
+            { kind: "finished" },
+        ];
+    return [...events, { kind: "failure", message: failure(result, response) }];
+}
+export function antigravityEvents(line) {
+    return decodeLine(line, {
+        init: (event) => typeof event.conversation_id === "string"
+            ? [{ kind: "conversation", id: event.conversation_id }]
+            : [],
+        step_update: (event) => {
+            const step = asRecord(event.step_update);
+            const decode = typeof step.step_type === "string" &&
+                Object.hasOwn(steps, step.step_type)
+                ? steps[step.step_type]
+                : undefined;
+            return decode?.(step) ?? [];
+        },
+        result,
+    }, "event");
+}
+//# sourceMappingURL=antigravity-events.js.map

package/dist/adapters/agents/antigravity-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-events.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-events.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGvD,MAAM,KAAK,GAAkB;IAC3B,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CACvB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU;QACpD,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3C,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;QAC/C,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS;gBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU;aAC3C;SACF;QACH,CAAC,CAAC,EAAE;CACT,CAAC;AAEF,SAAS,OAAO,CAAC,MAAsB,EAAE,QAAgB;IACvD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjD,OAAO,wCAAwC,CAAC;IAClD,OAAO,0CAA0C,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,MAAM,CAAC,KAAqB;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAiB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QACpD,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE;oBACN,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;oBACvC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC;oBAC7C,MAAM,EACJ,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;wBACjC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC;iBACtC;aACF;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE;QAChD,OAAO;YACL,GAAG,MAAM;YACT,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,UAAU,EAAE;SACrB,CAAC;IACJ,OAAO,CAAC,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CACf,IAAI,EACJ;QACE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CACd,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACvC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBACvB,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM;KACP,EACD,OAAO,CACR,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentEvent } from \"../../domain/agent.types.ts\";\nimport { decodeLine } from \"./event-decoder.ts\";\nimport { asRecord, numberOrZero } from \"./protocol.ts\";\nimport type { EventDecoders, ProtocolRecord } from \"./protocol.types.ts\";\n\nconst steps: EventDecoders = {\n  agent_response: (step) =>\n    typeof step.text_delta === \"string\" && step.text_delta\n      ? [{ kind: \"text\", text: step.text_delta }]\n      : [],\n  tool: (step) =>\n    typeof step.tool_name === \"string\" &&\n    (step.state === \"DONE\" || step.state === \"ERROR\")\n      ? [\n          {\n            kind: \"tool\",\n            name: step.tool_name,\n            input: asRecord(step.tool_info).parameters,\n          },\n        ]\n      : [],\n};\n\nfunction failure(result: ProtocolRecord, response: string): string {\n  if (typeof result.error === \"string\" && result.error) return result.error;\n  if (result.status === \"SUCCESS\" && !response.trim())\n    return \"Antigravity returned an empty response\";\n  return `Antigravity ended the turn with status ${String(result.status ?? \"unknown\")}`;\n}\n\nfunction result(event: ProtocolRecord): AgentEvent[] {\n  const result = asRecord(event.result);\n  const usage = asRecord(result.usage);\n  const response = typeof result.response === \"string\" ? result.response : \"\";\n  const events: AgentEvent[] = Object.keys(usage).length\n    ? [\n        {\n          kind: \"usage\",\n          tokens: {\n            input: numberOrZero(usage.input_tokens),\n            cached: numberOrZero(usage.cache_read_tokens),\n            output:\n              numberOrZero(usage.output_tokens) +\n              numberOrZero(usage.thinking_tokens),\n          },\n        },\n      ]\n    : [];\n  if (result.status === \"SUCCESS\" && response.trim())\n    return [\n      ...events,\n      { kind: \"result\", text: response },\n      { kind: \"finished\" },\n    ];\n  return [...events, { kind: \"failure\", message: failure(result, response) }];\n}\n\nexport function antigravityEvents(line: string): AgentEvent[] {\n  return decodeLine(\n    line,\n    {\n      init: (event) =>\n        typeof event.conversation_id === \"string\"\n          ? [{ kind: \"conversation\", id: event.conversation_id }]\n          : [],\n      step_update: (event) => {\n        const step = asRecord(event.step_update);\n        const decode =\n          typeof step.step_type === \"string\" &&\n          Object.hasOwn(steps, step.step_type)\n            ? steps[step.step_type]\n            : undefined;\n        return decode?.(step) ?? [];\n      },\n      result,\n    },\n    \"event\",\n  );\n}\n"]}

package/dist/adapters/agents/antigravity-request.d.ts

@@ -0,0 +1,5 @@
+import type { AgentInput } from "../../domain/agent.types.ts";
+import type { Command } from "../../domain/command.types.ts";
+import type { AntigravitySettings } from "./antigravity.types.ts";
+import type { Bound } from "./settings.types.ts";
+export declare function antigravityRequest(settings: Bound<AntigravitySettings>, input: AgentInput): Command;

package/dist/adapters/agents/antigravity-request.js

@@ -0,0 +1,29 @@
+import { invariant } from "../../domain/errors.js";
+export function antigravityRequest(settings, input) {
+    invariant(!input.continuation, "Antigravity does not support continuation or fork in Outpost");
+    const args = [];
+    if (settings.model)
+        args.push("--model", settings.model.name);
+    if (settings.mode)
+        args.push("--mode", settings.mode);
+    if (input.interactive)
+        return {
+            executable: "agy",
+            arguments: [
+                ...args,
+                ...(input.text === undefined
+                    ? []
+                    : ["--prompt-interactive", input.text]),
+            ],
+            interactive: true,
+        };
+    if (!settings.mode)
+        args.push("--dangerously-skip-permissions");
+    args.push("--input-format", "stream-json", "--output-format", "stream-json");
+    return {
+        executable: "agy",
+        arguments: args,
+        stdin: `${JSON.stringify({ event: "user", message: { content: input.text ?? "" } })}\n`,
+    };
+}
+//# sourceMappingURL=antigravity-request.js.map

package/dist/adapters/agents/antigravity-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-request.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAInD,MAAM,UAAU,kBAAkB,CAChC,QAAoC,EACpC,KAAiB;IAEjB,SAAS,CACP,CAAC,KAAK,CAAC,YAAY,EACnB,8DAA8D,CAC/D,CAAC;IACF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,WAAW;QACnB,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE;gBACT,GAAG,IAAI;gBACP,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,CAAC,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAC1C;YACD,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI;KACxF,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentInput } from \"../../domain/agent.types.ts\";\nimport type { Command } from \"../../domain/command.types.ts\";\nimport { invariant } from \"../../domain/errors.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport type { Bound } from \"./settings.types.ts\";\n\nexport function antigravityRequest(\n  settings: Bound<AntigravitySettings>,\n  input: AgentInput,\n): Command {\n  invariant(\n    !input.continuation,\n    \"Antigravity does not support continuation or fork in Outpost\",\n  );\n  const args: string[] = [];\n  if (settings.model) args.push(\"--model\", settings.model.name);\n  if (settings.mode) args.push(\"--mode\", settings.mode);\n  if (input.interactive)\n    return {\n      executable: \"agy\",\n      arguments: [\n        ...args,\n        ...(input.text === undefined\n          ? []\n          : [\"--prompt-interactive\", input.text]),\n      ],\n      interactive: true,\n    };\n  if (!settings.mode) args.push(\"--dangerously-skip-permissions\");\n  args.push(\"--input-format\", \"stream-json\", \"--output-format\", \"stream-json\");\n  return {\n    executable: \"agy\",\n    arguments: args,\n    stdin: `${JSON.stringify({ event: \"user\", message: { content: input.text ?? \"\" } })}\\n`,\n  };\n}\n"]}

package/dist/adapters/agents/{gemini.types.d.ts → antigravity.types.d.ts}

@@ -1,7 +1,7 @@
 import type { AgentAuthentication } from "../../domain/agent.types.ts";
 import type { Variables } from "../../domain/command.types.ts";
-export interface GeminiSettings {
+export interface AntigravitySettings {
     readonly authentication?: AgentAuthentication;
     readonly variables?: Variables;
-    readonly approvalMode?: "default" | "auto_edit" | "yolo" | "plan";
+    readonly mode?: "accept-edits" | "plan";
 }

package/dist/adapters/agents/antigravity.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=antigravity.types.js.map

package/dist/adapters/agents/antigravity.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity.types.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AgentAuthentication } from \"../../domain/agent.types.ts\";\nimport type { Variables } from \"../../domain/command.types.ts\";\n\nexport interface AntigravitySettings {\n  readonly authentication?: AgentAuthentication;\n  readonly variables?: Variables;\n  readonly mode?: \"accept-edits\" | \"plan\";\n}\n"]}

package/dist/adapters/agents/authentication.constants.d.ts

@@ -1,13 +1,23 @@
-export declare const authenticationRecipes: {
+export declare const credentialRecipes: Readonly<{
+    tool: "const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const [binary,...args]=process.argv.slice(1); const installed=join(homedir(),\".outpost-tools\",\"bin\",binary); const result=spawnSync(existsSync(installed)?installed:binary,args,{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);";
+    antigravitySettings: "{\"modelProvider\":\"gemini\"}\n";
+}>;
+export declare const credentialVariables: Readonly<{
+    readonly claude: {
+        readonly account: "CLAUDE_CODE_OAUTH_TOKEN";
+        readonly usage: "ANTHROPIC_API_KEY";
+    };
     readonly codex: {
-        readonly environment: "OPENAI_API_KEY=\n";
-        readonly login: "const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const installed=join(homedir(),\".outpost-tools\",\"bin\",\"codex\"); const result=spawnSync(existsSync(installed)?installed:\"codex\",[\"login\",\"--with-api-key\"],{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);";
-        readonly seed: "const {mkdirSync,writeFileSync,readFileSync,chmodSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const directory=join(homedir(),\".codex\"); mkdirSync(directory,{recursive:true,mode:0o700}); const target=join(directory,\"auth.json\"); writeFileSync(target,readFileSync(0),{mode:0o600}); chmodSync(target,0o600);";
+        readonly usage: "OPENAI_API_KEY";
     };
-    readonly claude: {
-        readonly environment: "ANTHROPIC_API_KEY=\n";
+    readonly antigravity: {
+        readonly usage: "GEMINI_API_KEY";
+    };
+    readonly copilot: {
+        readonly account: "COPILOT_GITHUB_TOKEN";
     };
-    readonly gemini: {
-        readonly environment: "GEMINI_API_KEY=\n";
+    readonly kimi: {
+        readonly usage: "KIMI_API_KEY";
     };
-};
+}>;
+export declare const KIMI_LOGIN_DEADLINE_MS = 120000;

package/dist/adapters/agents/authentication.constants.js

@@ -1,10 +1,13 @@
-export const authenticationRecipes = {
-    codex: {
-        environment: "OPENAI_API_KEY=\n",
-        login: 'const {spawnSync}=require("node:child_process"); const {existsSync}=require("node:fs"); const {join}=require("node:path"); const {homedir}=require("node:os"); const installed=join(homedir(),".outpost-tools","bin","codex"); const result=spawnSync(existsSync(installed)?installed:"codex",["login","--with-api-key"],{stdio:"inherit",shell:process.platform==="win32"}); process.exit(result.status ?? 1);',
-        seed: 'const {mkdirSync,writeFileSync,readFileSync,chmodSync}=require("node:fs"); const {join}=require("node:path"); const {homedir}=require("node:os"); const directory=join(homedir(),".codex"); mkdirSync(directory,{recursive:true,mode:0o700}); const target=join(directory,"auth.json"); writeFileSync(target,readFileSync(0),{mode:0o600}); chmodSync(target,0o600);',
-    },
-    claude: { environment: "ANTHROPIC_API_KEY=\n" },
-    gemini: { environment: "GEMINI_API_KEY=\n" },
-};
+export const credentialRecipes = Object.freeze({
+    tool: 'const {spawnSync}=require("node:child_process"); const {existsSync}=require("node:fs"); const {join}=require("node:path"); const {homedir}=require("node:os"); const [binary,...args]=process.argv.slice(1); const installed=join(homedir(),".outpost-tools","bin",binary); const result=spawnSync(existsSync(installed)?installed:binary,args,{stdio:"inherit",shell:process.platform==="win32"}); process.exit(result.status ?? 1);',
+    antigravitySettings: '{"modelProvider":"gemini"}\n',
+});
+export const credentialVariables = Object.freeze({
+    claude: { account: "CLAUDE_CODE_OAUTH_TOKEN", usage: "ANTHROPIC_API_KEY" },
+    codex: { usage: "OPENAI_API_KEY" },
+    antigravity: { usage: "GEMINI_API_KEY" },
+    copilot: { account: "COPILOT_GITHUB_TOKEN" },
+    kimi: { usage: "KIMI_API_KEY" },
+});
+export const KIMI_LOGIN_DEADLINE_MS = 120_000;
 //# sourceMappingURL=authentication.constants.js.map

package/dist/adapters/agents/authentication.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.constants.js","sourceRoot":"","sources":["../../../src/adapters/agents/authentication.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE;QACL,WAAW,EAAE,mBAAmB;QAChC,KAAK,EACH,iZAAiZ;QACnZ,IAAI,EAAE,sWAAsW;KAC7W;IACD,MAAM,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAC/C,MAAM,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;CACpC,CAAC","sourcesContent":["export const authenticationRecipes = {\n  codex: {\n    environment: \"OPENAI_API_KEY=\\n\",\n    login:\n      'const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const installed=join(homedir(),\".outpost-tools\",\"bin\",\"codex\"); const result=spawnSync(existsSync(installed)?installed:\"codex\",[\"login\",\"--with-api-key\"],{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);',\n    seed: 'const {mkdirSync,writeFileSync,readFileSync,chmodSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const directory=join(homedir(),\".codex\"); mkdirSync(directory,{recursive:true,mode:0o700}); const target=join(directory,\"auth.json\"); writeFileSync(target,readFileSync(0),{mode:0o600}); chmodSync(target,0o600);',\n  },\n  claude: { environment: \"ANTHROPIC_API_KEY=\\n\" },\n  gemini: { environment: \"GEMINI_API_KEY=\\n\" },\n} as const;\n"]}
+{"version":3,"file":"authentication.constants.js","sourceRoot":"","sources":["../../../src/adapters/agents/authentication.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,uaAAua;IAC7a,mBAAmB,EAAE,8BAA8B;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAC1E,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAClC,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACxC,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC5C,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;CACvB,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC","sourcesContent":["export const credentialRecipes = Object.freeze({\n  tool: 'const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const [binary,...args]=process.argv.slice(1); const installed=join(homedir(),\".outpost-tools\",\"bin\",binary); const result=spawnSync(existsSync(installed)?installed:binary,args,{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);',\n  antigravitySettings: '{\"modelProvider\":\"gemini\"}\\n',\n});\n\nexport const credentialVariables = Object.freeze({\n  claude: { account: \"CLAUDE_CODE_OAUTH_TOKEN\", usage: \"ANTHROPIC_API_KEY\" },\n  codex: { usage: \"OPENAI_API_KEY\" },\n  antigravity: { usage: \"GEMINI_API_KEY\" },\n  copilot: { account: \"COPILOT_GITHUB_TOKEN\" },\n  kimi: { usage: \"KIMI_API_KEY\" },\n} as const);\n\nexport const KIMI_LOGIN_DEADLINE_MS = 120_000;\n"]}

package/dist/adapters/agents/authentication.d.ts

@@ -1,2 +1,11 @@
-import type { AgentAdapter, AgentAuthentication } from "../../domain/agent.types.ts";
-export declare function authenticationCommand(name: "codex" | "claude" | "gemini", authentication: AgentAuthentication | undefined, externalModel?: boolean): NonNullable<AgentAdapter["authenticate"]>;
+import type { AgentAdapter, AgentAuthentication, CredentialPlan } from "../../domain/agent.types.ts";
+import type { Command, Variables } from "../../domain/command.types.ts";
+import type { AgentModel } from "../../domain/model.types.ts";
+import type { CredentialRecipe, CredentialStrategy, HostFileOptions, VariableCredentialOptions } from "./authentication.types.ts";
+export declare function credentialPlan(plan?: Partial<CredentialPlan>): CredentialPlan;
+export declare function toolCommand(binary: string, args: readonly string[], options?: Pick<Command, "stdin" | "deadlineMs">): Command;
+export declare function requiredVariable(variables: Variables, name: string): string;
+export declare function variableCredential(options: VariableCredentialOptions): Readonly<Record<"preset" | "key" | "variable", CredentialRecipe>>;
+export declare function hostFile(options: HostFileOptions): Readonly<Record<"preset" | "file", CredentialRecipe>>;
+export declare function excluding(recipe: CredentialRecipe, variable: string, message: string): CredentialRecipe;
+export declare function credentialPlanner(agent: string, strategy: CredentialStrategy, authentication: AgentAuthentication | undefined, model?: AgentModel): AgentAdapter["credentials"];

package/dist/adapters/agents/authentication.js

@@ -1,52 +1,75 @@
+import { authenticationForm } from "../../domain/authentication.js";
 import { invariant } from "../../domain/errors.js";
-import { authenticationRecipes } from "./authentication.constants.js";
-export function authenticationCommand(name, authentication, externalModel = false) {
-    if (!authentication)
-        return () => undefined;
-    const mode = authentication.mode;
-    invariant(mode === "api-key" ||
-        (mode === "oauth-token" && name === "claude") ||
-        (mode === "login" && name === "codex" && !externalModel), "Unsupported harness authentication mode");
-    if (mode === "login") {
-        const credentials = authentication.credentials;
-        if (credentials === undefined)
-            return () => undefined;
-        try {
-            JSON.parse(credentials);
-        }
-        catch {
-            throw new Error("Invalid Codex credential JSON");
-        }
-        return () => ({
-            executable: "node",
-            arguments: ["-e", authenticationRecipes.codex.seed],
-            stdin: credentials,
-        });
-    }
-    const environment = mode === "oauth-token"
-        ? "CLAUDE_CODE_OAUTH_TOKEN"
-        : (authentication.environment ??
-            authenticationRecipes[name].environment.trim().replace("=", ""));
-    invariant(/^[A-Za-z_][A-Za-z0-9_]*$/.test(environment), "Invalid authentication environment variable");
-    invariant(name === "codex" ||
-        mode === "oauth-token" ||
-        environment ===
-            authenticationRecipes[name].environment.trim().replace("=", ""), "This CLI requires its standard authentication environment variable");
-    return (variables) => {
-        invariant(variables[environment], `Missing ${environment}. Declare the selected credential explicitly.`);
-        if (name === "claude") {
-            const conflict = mode === "oauth-token"
-                ? "ANTHROPIC_API_KEY"
-                : "CLAUDE_CODE_OAUTH_TOKEN";
-            invariant(!variables[conflict], "Conflicting Claude authentication methods");
-        }
-        if (name !== "codex" || externalModel)
-            return undefined;
-        return {
-            executable: "node",
-            arguments: ["-e", authenticationRecipes.codex.login],
-            stdin: variables[environment],
+import { credentialRecipes } from "./authentication.constants.js";
+export function credentialPlan(plan = {}) {
+    return Object.freeze({
+        variables: Object.freeze({ ...plan.variables }),
+        host: Object.freeze([...(plan.host ?? [])]),
+        files: Object.freeze([...(plan.files ?? [])]),
+        commands: Object.freeze([...(plan.commands ?? [])]),
+    });
+}
+export function toolCommand(binary, args, options = {}) {
+    return {
+        executable: "node",
+        arguments: ["-e", credentialRecipes.tool, binary, ...args],
+        ...options,
+    };
+}
+export function requiredVariable(variables, name) {
+    const value = variables[name];
+    invariant(value, `Missing ${name}. Declare the selected credential explicitly.`);
+    return value;
+}
+export function variableCredential(options) {
+    const recipe = (read) => (input) => {
+        options.bind?.(input);
+        return (variables) => {
+            const secret = read(input.value, variables);
+            options.accept?.(secret);
+            const exposed = options.expose?.(secret, input) ?? {};
+            return credentialPlan({
+                ...exposed,
+                variables: { [options.variable]: secret, ...exposed.variables },
+            });
         };
     };
+    return {
+        preset: recipe((_, variables) => requiredVariable(variables, options.variable)),
+        key: (input) => {
+            options.accept?.(input.value);
+            return recipe((value) => value)(input);
+        },
+        variable: recipe((value, variables) => requiredVariable(variables, value)),
+    };
+}
+export function hostFile(options) {
+    const { files, source, ...credential } = options;
+    const recipe = (path) => () => credentialPlan({
+        host: [{ ...credential, source: path }],
+        ...(files ? { files } : {}),
+    });
+    return {
+        preset: () => recipe(source),
+        file: (input) => recipe({ path: input.value }),
+    };
+}
+export function excluding(recipe, variable, message) {
+    return (input) => {
+        const planFor = recipe(input);
+        return (variables) => {
+            invariant(!variables[variable], message);
+            return planFor(variables);
+        };
+    };
+}
+export function credentialPlanner(agent, strategy, authentication, model) {
+    if (authentication === undefined)
+        return undefined;
+    const { form, value = "" } = authenticationForm(authentication);
+    const recipe = Object.hasOwn(strategy, form) ? strategy[form] : undefined;
+    const accepted = Object.keys(strategy);
+    invariant(recipe, `${agent} does not support ${form} authentication. Accepted forms: ${accepted.length ? accepted.join(", ") : "none"}`);
+    return recipe(model === undefined ? { value } : { value, model });
 }
 //# sourceMappingURL=authentication.js.map