@elie-laloum/outpost 5.0.0 → 7.0.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 7.0.0
+
+This major release extends public event and conversation unions and adds required context fields. Update exhaustive handling of `AgentEvent`, `WorkflowEvent.type`, `ModelStreamEvent`, `ConversationFormat` and `StoredConversationFormat`; custom context producers and test doubles must provide `TaskContext.idempotencyKey` and `QueueHandlerContext.idempotencyKey`. Existing entry points remain available. Redis queues now require `maxmemory-policy=noeviction`, and token-only workflow budgets reject incomplete usage. Firecracker and speculation remain experimental; 7.0.0 does not complete every roadmap direction.
+
+- Add opt-in durable speculation through Transport with fenced ownership, explicit crash recovery, cumulative budgets, preserved attempts, bounded cleanup and Git merge preflight. Mounted Docker/Podman support resource reconciliation; unsupported providers reject durable mode. Speculation remains experimental.
+- Add confirmed Daytona egress policies with explicit rejection of unsupported rules and account capabilities; snapshot Vercel native firewall configuration against caller mutation. Add opt-in network probes and bilingual capability/ownership documentation. Container allowlists remain unsupported.
+- Add opt-in signed approval/pause gates with rotating Ed25519 approver keys, per-request HTTP queue credential rotation and stable task/worker idempotency keys. Document persistent effect deduplication and multi-worker recovery; queues still do not guarantee exactly-once external effects.
+- Add opt-in capped exponential task retries and full jitter, preserve HTTP model Retry-After minimum waits, and expose selected retry delays. Add cooperative workflow.start({ timeoutMs }) deadlines renewed on resume, preserving checkpoint compatibility and explicit replay authorization.
+
+- Stabilize the built-in harness and OpenAI/Anthropic model contracts, with authenticated delegation validated for both integrations. Add `defineHarnessSubagent()` with serialized shared-sandbox execution, separate captured histories, inherited permissions, bounded depth and cumulative ancestor token budgets. Count final responses and context summaries toward token ceilings, reject incomplete accounting and correlate child lifecycle/usage events. Add deterministic container CI and an opt-in, budgeted live campaign.
+- Add scoped observation hubs with bounded pluggable sinks, correlated workflow/agent/operation events, process stop diagnostics, normalized CLI tool results and opt-in model payloads. Journals and reporters use the shared delivery policy; sink failures are reported independently of execution. OpenTelemetry can consume the unified stream without changing metric names.
+- Add native session capture, warm/cold resume and response repairs for Copilot and Kimi, plus native Kimi fork. Antigravity supports warm resume and repairs only; portable capture/cold resume and automated fork remain unsupported. Copilot automated fork is explicitly refused. Session bundles preserve supported native files and can be archived through Transport.
+
+- Add opt-in Firecracker jailer execution with protected root-owned assets, an unprivileged VMM identity, cgroup v2 CPU/memory/process limits and conservative jail/cgroup cleanup. Direct execution remains compatible; the provider remains experimental pending broader host and adversarial validation.
+- Pin Antigravity CLI 1.2.12 in generated images and remote bootstrap using versioned archives and recorded SHA-512 digests. Expose `agentVersions.antigravity`, compare it in doctor, and disable automatic updates in generated images, agent requests and diagnostics. Existing binaries are reused; existing image recipes must be updated and rebuilt.
+- Collect Copilot and Kimi token usage from sandbox session files, including Kimi sub-agents, and reconcile Copilot streamed usage without double counting. Missing or partial counters carry `Usage.complete: false` through dispatch, workflows, speculation and checkpoints. Token-only workflow budgets fail with `WorkflowUsageUnavailable` when accounting is incomplete; configure an attempt budget and execution time limits for bounded fallback.
+
+- Add `s3Transport({ deleteMode: "tombstone" })` for services such as R2 without atomic conditional DELETE: conditional PUT markers fence stale deletions and concurrent recreation, remain physically stored, and are hidden from reads and lists. The default conditional DELETE mode is unchanged.
+- Refuse BullMQ queues unless Redis INFO confirms `maxmemory-policy=noeviction`, with a configuration error instead of allowing eviction of queue state.
+
+- Stop host `doctor` probes and their descendants on interruption, preserving SIGINT/SIGTERM exit codes.
+- Keep a safe connection diagnostic in CLI-agent timeout errors when the latest failure event reports a connection problem, without copying endpoint URLs or credentials.
+- Fix Copilot account authentication when `config.json` stores the selected account token as an object with a `token` field, while retaining support for string tokens.
+- Fix Kimi Code international account authentication with `kimiHarness({ authentication: "account", region: "global" })`: copy the region-scoped OAuth credential and device identifier, then provision the same region inside the sandbox. Account authentication defaults to `region: "global"` when omitted; Chinese accounts must select `region: "mainland-cn"` explicitly. Conflicting account endpoint overrides are rejected for both explicit and default regions.
+
+## 6.0.1
+
+- Rebuild the English and French Guide from scratch with focused explanations and short, directly usable snippets. Introduce a new page structure, task-based navigation and a dedicated responsive Guide layout.
+- Cover setup, agent configuration, sandboxes, workflows, persistence, monitoring, operations and the experimental model engine across 60 pages per language. Preserve the Reference content and navigation.
+- Redirect retired Guide URLs to their new destinations, including localized links and continuation anchors. Validate rendered links, search, navigation and examples in both languages.
+- Replace workshop preparation generation with compilation of Guide snippets, offline execution of selected examples and real Docker/Podman checks of the documented command example. Public library contracts are unchanged.
+
+## 6.0.0
+
+Breaking changes, without compatibility aliases:
+
+- Unify artifact, checkpoint, journal, resource activity and reservation persistence through Transport, with `localTransport()` for disk storage. Remove `fileArtifactStore`, `fileWorkflowCheckpointStore`, their option types, `logging.file` and `DispatchResult.log`; journals expose `logReference`. Default runtime objects live under `.outpost/storage`. Checkpoint and reservation crash recovery is explicit locally and remotely; old file layouts are not migrated. Git worktrees and execution staging remain filesystem operations. Local transports and inspection reads accept root-owned system links among ancestors, such as `/var` on macOS, and still reject links created by users.
+- Rename `CustomHarness` to `Harness` and `CustomHarnessOptions` to `HarnessOptions`; the former `Harness` union becomes `AgentHarness` (`CliHarness | Harness`). Runtime behavior and discriminants are unchanged.
+- Replace the `{ mode: "api-key" | "oauth-token" | "login", environment?, credentials? }` authentication shapes with `authentication: "account" | "usage" | { account: { file | key | variable } } | { usage: { key | variable } }` on every CLI harness, with the new `AccountCredential` and `UsageCredential` types. There is no automatic mode; unsupported forms fail when the agent is composed and list the accepted forms. `AgentAdapter.authenticate()` becomes `credentials(variables)`, returning a `CredentialPlan`.
+- `outpost init --authentication` accepts `account`, `account-token` (Claude and Copilot) or `usage` and defaults to `account`; generated scripts no longer read credential files.
+- Remove Gemini CLI, which no longer serves free, Google AI Pro and Ultra accounts: `geminiHarness()`, `GeminiSettings`, `agentVersions.gemini` and `doctor --agent gemini` are removed, and generated images no longer install `@google/gemini-cli`.
+
+Unified CLI authentication:
+
+- `account` copies the CLI's own host session into the private sandbox home: Claude `.credentials.json` (only `claudeAiOauth`), Codex `auth.json`, the Antigravity OAuth token file, the Copilot token stored in `config.json` (forwarded as `COPILOT_GITHUB_TOKEN`), and the Kimi Code credentials and device identifier followed by `kimi login` in the sandbox. `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `COPILOT_HOME` and `KIMI_CODE_HOME` relocate the host sources, and `account.file` selects a dedicated profile.
+- `usage` forwards the CLI's standard API-key variable: `ANTHROPIC_API_KEY`, `OPENAI_API_KEY` followed by `codex login --with-api-key` in the sandbox, `GEMINI_API_KEY` with a generated Antigravity `settings.json`, or `KIMI_API_KEY` translated to Kimi's model variables with a required model. Codex with a custom `modelProvider` accepts only usage forms, applied to `apiKeyEnvironment`. Classic `ghp_` tokens are rejected for Copilot.
+- Outpost reads only regular host files up to 1 MiB, never reads a system keychain, and installs credentials through one stdin-fed installer with 0700 directories and 0600 files. The local provider receives variables only: no file is written and no login command runs on the host.
+
+New CLI harnesses:
+
+- Add `antigravityHarness()`, `copilotHarness()` and `kimiHarness()` with `AntigravitySettings`, `CopilotSettings` and `KimiSettings`. They run fresh sessions without native capture, resume, fork or automatic response repairs, accept model names only and disable CLI auto-updates by default. Copilot and Kimi report no token usage. `doctor` accepts `antigravity`, `copilot` and `kimi`.
+- Generated images, the published agent image lock and remote bootstrap pin GitHub Copilot CLI 1.0.88 and Kimi Code 2.1.1. Images install `agy` with the official Antigravity script into `/usr/local/bin`, and remote bootstrap runs the same script when `agy` is missing; `agy` is not version-pinned. Images set `XDG_CACHE_HOME=/tmp/.cache` so Copilot can load its native addon outside the noexec home.
+- Protocols are covered by synthetic fixtures and help checks of the installed CLIs; live model runs of the three CLIs remain unvalidated.
+
 ## 5.0.0
 
 Breaking changes, without compatibility aliases:

package/README.md

@@ -2,13 +2,13 @@
 
 [Documentation](https://elie-laloum.github.io/outpost/) · [Français](https://elie-laloum.github.io/outpost/fr/) · [API](https://elie-laloum.github.io/outpost/reference/) · [Changelog](CHANGELOG.md)
 
-Outpost is a TypeScript library for running coding agents in reusable sandboxes, managing their Git workspaces and composing typed workflows. Claude Code, Codex and Gemini CLI adapters work with Docker, Podman, Vercel, Daytona or explicit host execution. Gemini supports fresh sessions only; native conversation capture, resume and fork are available for Claude Code and Codex.
+Outpost is a TypeScript library for running coding agents in reusable sandboxes, managing their Git workspaces and composing typed workflows. Claude Code, Codex, Antigravity, GitHub Copilot CLI and Kimi Code adapters work with Docker, Podman, Vercel, Daytona or explicit host execution. Each harness authenticates explicitly with your account login or an API key. Claude Code, Codex and Kimi support native capture, resume and fork. Copilot supports capture and resume; Antigravity resumes conversations only while their sandbox remains open. These continuation additions are available in 7.0.0.
 
-Version 5.0.0 composes every agent with `agent({ harness, model })`, moves reasoning and output limits onto the agent model, and adds an experimental built-in harness engine: Outpost drives a model provider with tools, hooks, permissions, persisted conversations, context strategies, skills and streaming. It contains breaking API changes. See the [changelog](CHANGELOG.md#500) for details and migration notes, and the [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) for remaining validation and upcoming priorities.
+Version 7.0.0 stabilizes the built-in harness and adds bounded subagents, unified observation, native CLI continuation, signed workflow decisions and recoverable speculation. It extends public TypeScript unions and context contracts: see the [changelog](CHANGELOG.md#700) for migration notes. Firecracker and speculation remain experimental; the [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) records remaining validation and planned work.
 
 ## Get started
 
-New to Outpost? Follow the [complete first-run workshop](https://elie-laloum.github.io/outpost/guide/start/quickstart/): choose Codex or Claude and account or API-key access, create a disposable TypeScript repository, then fix and verify a real test. The [Guide](https://elie-laloum.github.io/outpost/guide/) teaches the concepts; the [Reference](https://elie-laloum.github.io/outpost/reference/) explains exact contracts. Every [cookbook recipe](https://elie-laloum.github.io/outpost/guide/cookbook/) includes its own preparation and runnable code.
+Start with [Setup](https://elie-laloum.github.io/outpost/guide/setup/), then [send your first request](https://elie-laloum.github.io/outpost/guide/first-request/). The [Guide](https://elie-laloum.github.io/outpost/guide/introduction/) explains each capability with focused snippets; the [Reference](https://elie-laloum.github.io/outpost/reference/) documents exact API contracts.
 
 Requires Node.js **24+**, Git, a target repository with a commit, and the credentials of your chosen agent. The workflow can live in its own directory. This example uses Docker.
 
@@ -18,37 +18,37 @@ cd workflow1
 npx @elie-laloum/outpost init --yes --repository /path1/repository --install
 ```
 
-Copy `.env.example` to `.env` and declare `OPENAI_API_KEY`. An empty declaration inherits the matching process variable. Then run the generated script:
+The generated script uses `authentication: "account"`: log in to Codex on the host with file credential storage (`codex -c cli_auth_credentials_store='"file"' login`), and Outpost copies that login into the private sandbox home. For API billing instead, add `--authentication usage`, copy `.env.example` to `.env` and declare `OPENAI_API_KEY`; an empty declaration inherits the matching process variable. Then run the generated script:
 
 ```sh
 node run.ts "Add validation, run tests and commit the change"
 ```
 
-`init` creates `package.json`, `run.ts`, `brief.md`, `.env.example`, `.gitignore` and a container recipe directly in the workflow directory. Existing package manifests are preserved; explicit CommonJS projects get `run.mts` for compatibility. The script resolves its brief, environment and relative repository paths from its own directory. See [multi-repository workflows](https://elie-laloum.github.io/outpost/guide/workflows/sandbox-tasks/) to orchestrate several repositories.
+`init` creates `package.json`, `run.ts`, `brief.md`, `.env.example`, `.gitignore` and a container recipe directly in the workflow directory. Existing package manifests are preserved; explicit CommonJS projects get `run.mts` for compatibility. The script resolves its brief, environment and relative repository paths from its own directory. See [multi-repository workflows](https://elie-laloum.github.io/outpost/guide/parallel-repositories/) to orchestrate several repositories.
 
-Generated Codex API-key workflows prepare login inside the sandbox. For account login and credential storage, see [Connect Codex](https://elie-laloum.github.io/outpost/guide/agents/connect-codex/) before dispatching.
+Outpost never reads a system keychain. See [authentication](https://elie-laloum.github.io/outpost/guide/access-credentials/) for every agent's account and API-key forms before dispatching.
 
 ## Use the library
 
-After preparing the selected agent credentials and provider, library calls follow this shape. For a fully runnable version with explicit authentication, use the [dispatch workshop](https://elie-laloum.github.io/outpost/guide/agents/dispatch/).
+After preparing the selected agent credentials and provider, library calls follow this shape. For configuration and a first call, see [First request](https://elie-laloum.github.io/outpost/guide/first-request/).
 
 ```ts
 import { agent, dispatch, codexHarness } from "@elie-laloum/outpost";
 
 const result = await dispatch({
   repository: "/path1/repository",
-  agent: agent({ harness: codexHarness({}) }),
+  agent: agent({ harness: codexHarness({ authentication: "account" }) }),
   branch: { mode: "integrate" },
   brief: { text: "Fix the failing tests, verify and commit." },
 });
 console.log(result.branch, result.commits);
 ```
 
-`repository` selects a local Git checkout; without it, library calls use the current working directory. See [repository paths](https://elie-laloum.github.io/outpost/guide/environment/repositories/) for external checkouts and paths relative to the workflow script.
+`repository` selects a local Git checkout; without it, library calls use the current working directory. See [repository paths](https://elie-laloum.github.io/outpost/guide/repository-context/) for external checkouts and paths relative to the workflow script.
 
-Let Outpost drive a model itself with `harness({ modelProvider, tools, instructions, limits })` and tools from `defineHarnessTool()`, then compose it with `agent({ harness, model })`. See [build a custom harness](https://elie-laloum.github.io/outpost/guide/agents/harness/) for a complete example.
+Let Outpost drive a model itself with `harness({ modelProvider, tools, instructions, limits })` and tools from `defineHarnessTool()`, then compose it with `agent({ harness, model })`. Use `defineHarnessSubagent()` to expose a built-in child as a tool with its own history and limits; its token usage also counts toward the parent budget. The built-in contracts and OpenAI and Anthropic integrations are stable in 7.0.0. See [build a custom harness](https://elie-laloum.github.io/outpost/guide/model-loop/) for configuration.
 
-Learn about [sandboxes](https://elie-laloum.github.io/outpost/guide/environment/lifecycle/), [workflows](https://elie-laloum.github.io/outpost/guide/workflows/graph/), [providers](https://elie-laloum.github.io/outpost/guide/environment/providers/overview/) and [recovery](https://elie-laloum.github.io/outpost/guide/operations/recovery/) in the English/French documentation. The [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) describes future work.
+Learn about [sandboxes](https://elie-laloum.github.io/outpost/guide/sandbox-sessions/), [workflows](https://elie-laloum.github.io/outpost/guide/task-dependencies/), [providers](https://elie-laloum.github.io/outpost/guide/execution-backends/) and [recovery](https://elie-laloum.github.io/outpost/guide/failure-recovery/) in the English/French documentation. The [roadmap](https://elie-laloum.github.io/outpost/project/roadmap/) describes future work.
 
 ## Development
 

package/SECURITY.md

@@ -12,8 +12,18 @@ Remote providers upload repository history and inputs to the selected cloud acco
 
 Prompt command expansion only recognizes commands present in the original prompt file. Substitution cannot introduce new expansion fragments. Values substituted inside an original shell command still have shell semantics and must be trusted or quoted by the prompt author.
 
+Agent authentication is explicit. `account` reads only the selected CLI's own session file (or the file or profile named by `account.file`) on the host, refuses links, directories and files above 1 MiB, and never reads a system keychain. Isolated providers receive a copy in the private sandbox home through stdin, with 0700 directories and 0600 files; `localSandboxProvider()` receives credential variables only and no host file is written. A sandbox copy can refresh and rotate a subscription refresh token, invalidating the host login; use a dedicated profile through `account.file` when that matters. Agents can read every credential they receive, so give them only the access their task requires. Generated images and remote bootstrap install pinned CLI versions. Antigravity archives use versioned Google URLs and SHA-512 digests recorded in Outpost; installation rejects mismatches before extraction. Generated images and Outpost's Antigravity requests and diagnostics disable automatic updates. Bootstrap reuses an existing executable without replacing or verifying its bytes; `outpost doctor --agent antigravity` compares its reported version with `agentVersions.antigravity`. A checksum verifies the selected archive's integrity, not the safety of its code.
+
 Conversation transcripts, logs, bundles and patches may contain secrets. Runtime files are ignored by Git and sensitive files are created with restrictive permissions where supported. Keep API keys in environment variables or ignored `.env` files. Never embed tokens in tracked configuration, remote URLs or examples.
 
 Report vulnerabilities privately using the repository's security reporting channel when enabled, or contact the maintainer through the hosting profile. Do not include live credentials in reports. V1 receives fixes for reproducible security defects.
 
 Explicit storage transports can send artifacts, journals, transcripts, recovery payloads and operational metadata to the configured object store. The caller owns the S3 client and credentials; they are not forwarded to agents. Use a dedicated private bucket prefix and access policy. Object revisions fence cooperating writers but do not authenticate artifact producers or operators. Stop an abandoned runner independently before releasing its checkpoint ownership; a remote PID is not proof of inactivity.
+
+The optional Firecracker jailer mode requires a trusted root supervisor and root-owned boot assets, executables, SSH trust files, jail base and cgroup v2 parent. Outpost does not elevate privileges. The VMM drops to the explicitly selected non-root UID/GID, uses the jailer's mount namespace and receives CPU, memory, swap and process limits. The supervisor remains privileged and outside the VMM cgroup; its workflow code, configuration, dependencies and transfer destinations must be trusted. Guest file downloads currently buffer individual files in the supervisor, so the VMM memory limit is not a total host-resource budget. Kernel work outside that cgroup is likewise not charged to its CPU quota. Operators own TAP setup, network filtering, parent resources and crash recovery. This mode remains experimental pending the remaining control-plane resource and adversarial validation.
+
+Egress policies restrict sandbox outbound connections, not host model-provider calls, image downloads or cloud control-plane traffic. Vercel domain rules inspect TLS SNI rather than encrypted HTTP Host headers; allowed CIDRs grant independent IP access and denied CIDRs take precedence. A domain allowlist is not a general defense against exfiltration through allowed services or shared infrastructure. Mounted host sockets can expose separate network capabilities. Outpost copies network configuration at provider composition.
+
+Daytona egress is sent at creation and confirmed through its network-update API before Outpost prepares the workspace or exposes the lease. A rejected confirmation fails acquisition and triggers deletion. Tier 3/4 and WRITE_SANDBOXES are required; native creation options alone do not establish this guarantee. Autonomous image startup precedes confirmation and must be trusted, without embedded secrets or startup workloads. Unsupported combinations and wildcard patterns that would implicitly grant apex access are rejected. Docker/Podman allowlists remain unsupported; local and Firecracker execution reject Outpost egress policies. See the bilingual outbound-network guide for capabilities and live-validation limits.
+
+Signed workflow gates verify an Ed25519 key bound to an approver, not a human login. The signing service must authenticate the user and their intent. Keep private keys outside worker sandboxes; trust the configured verifier and public-key source. Gate authentication requirements participate in checkpoint identity, but signatures do not authenticate checkpoint storage. Revocation rejects new proofs and does not undo already persisted decisions. HTTP queue bearer tokens authorize all queue operations; dynamic token sources allow rotation, not tenant isolation. Use trusted TLS termination for remote connections. Idempotency keys only prevent duplicate external effects when the effect service atomically deduplicates them and retains receipts throughout the replay window.

package/dist/adapters/agents/antigravity-adapter.d.ts

@@ -0,0 +1,3 @@
+import type { CliHarness } from "../../domain/agent.types.ts";
+import type { AntigravitySettings } from "./antigravity.types.ts";
+export declare function antigravityHarness(settings?: AntigravitySettings): CliHarness;

package/dist/adapters/agents/antigravity-adapter.js

@@ -0,0 +1,41 @@
+import { antigravityCredentials } from "./antigravity-authentication.js";
+import { antigravityVariables } from "./antigravity.constants.js";
+import { antigravityEvents } from "./antigravity-events.js";
+import { antigravityRequest } from "./antigravity-request.js";
+import { credentialPlanner } from "./authentication.js";
+import { antigravityModelSupport } from "./model-support.constants.js";
+import { harnessSettings, supportModel } from "./model-support.js";
+function bindAntigravity(settings) {
+    supportModel(antigravityModelSupport, settings.model);
+    const credentials = credentialPlanner("Antigravity", antigravityCredentials, settings.authentication, settings.model);
+    return Object.freeze({
+        name: "antigravity",
+        ...(credentials ? { credentials } : {}),
+        bootstrap: "antigravity",
+        resumable: true,
+        forkable: false,
+        capture: false,
+        requiresFinishedEvent: true,
+        variables: Object.freeze({
+            ...antigravityVariables,
+            ...settings.variables,
+        }),
+        request: (input) => antigravityRequest(settings, input),
+        events: antigravityEvents,
+    });
+}
+export function antigravityHarness(settings = {}) {
+    harnessSettings(settings);
+    const configured = Object.freeze({
+        ...settings,
+        variables: Object.freeze({ ...settings.variables }),
+    });
+    return Object.freeze({
+        kind: "cli",
+        bind: (model) => bindAntigravity({
+            ...configured,
+            ...(model === undefined ? {} : { model }),
+        }),
+    });
+}
+//# sourceMappingURL=antigravity-adapter.js.map

package/dist/adapters/agents/antigravity-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-adapter.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGnE,SAAS,eAAe,CAAC,QAAoC;IAC3D,YAAY,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,iBAAiB,CACnC,aAAa,EACb,sBAAsB,EACtB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,KAAK,CACf,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,aAAa;QACnB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,GAAG,oBAAoB;YACvB,GAAG,QAAQ,CAAC,SAAS;SACtB,CAAC;QACF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;QACvD,MAAM,EAAE,iBAAiB;KACH,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAgC,EAAE;IAElC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,GAAG,QAAQ;QACX,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,CAAC,KAAkB,EAAE,EAAE,CAC3B,eAAe,CAAC;YACd,GAAG,UAAU;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { AgentAdapter, CliHarness } from \"../../domain/agent.types.ts\";\nimport type { AgentModel } from \"../../domain/model.types.ts\";\nimport { antigravityCredentials } from \"./antigravity-authentication.ts\";\nimport { antigravityVariables } from \"./antigravity.constants.ts\";\nimport { antigravityEvents } from \"./antigravity-events.ts\";\nimport { antigravityRequest } from \"./antigravity-request.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport { credentialPlanner } from \"./authentication.ts\";\nimport { antigravityModelSupport } from \"./model-support.constants.ts\";\nimport { harnessSettings, supportModel } from \"./model-support.ts\";\nimport type { Bound } from \"./settings.types.ts\";\n\nfunction bindAntigravity(settings: Bound<AntigravitySettings>): AgentAdapter {\n  supportModel(antigravityModelSupport, settings.model);\n  const credentials = credentialPlanner(\n    \"Antigravity\",\n    antigravityCredentials,\n    settings.authentication,\n    settings.model,\n  );\n  return Object.freeze({\n    name: \"antigravity\",\n    ...(credentials ? { credentials } : {}),\n    bootstrap: \"antigravity\",\n    resumable: true,\n    forkable: false,\n    capture: false,\n    requiresFinishedEvent: true,\n    variables: Object.freeze({\n      ...antigravityVariables,\n      ...settings.variables,\n    }),\n    request: (input) => antigravityRequest(settings, input),\n    events: antigravityEvents,\n  } satisfies AgentAdapter);\n}\n\nexport function antigravityHarness(\n  settings: AntigravitySettings = {},\n): CliHarness {\n  harnessSettings(settings);\n  const configured = Object.freeze({\n    ...settings,\n    variables: Object.freeze({ ...settings.variables }),\n  });\n  return Object.freeze({\n    kind: \"cli\",\n    bind: (model?: AgentModel) =>\n      bindAntigravity({\n        ...configured,\n        ...(model === undefined ? {} : { model }),\n      }),\n  });\n}\n"]}

package/dist/adapters/agents/antigravity-authentication.d.ts

@@ -0,0 +1,2 @@
+import type { CredentialStrategy } from "./authentication.types.ts";
+export declare const antigravityCredentials: CredentialStrategy;

package/dist/adapters/agents/antigravity-authentication.js

@@ -0,0 +1,27 @@
+import { credentialRecipes, credentialVariables, } from "./authentication.constants.js";
+import { hostFile, variableCredential } from "./authentication.js";
+const file = hostFile({
+    source: { path: "~/.gemini/antigravity-cli/antigravity-oauth-token" },
+    destination: { file: ".gemini/antigravity-cli/antigravity-oauth-token" },
+    login: "agy and sign in with your Google account",
+    alternative: `"usage" with ${credentialVariables.antigravity.usage}`,
+});
+const key = variableCredential({
+    variable: credentialVariables.antigravity.usage,
+    expose: () => ({
+        files: [
+            {
+                path: ".gemini/antigravity-cli/settings.json",
+                content: credentialRecipes.antigravitySettings,
+            },
+        ],
+    }),
+});
+export const antigravityCredentials = Object.freeze({
+    account: file.preset,
+    "account.file": file.file,
+    usage: key.preset,
+    "usage.key": key.key,
+    "usage.variable": key.variable,
+});
+//# sourceMappingURL=antigravity-authentication.js.map

package/dist/adapters/agents/antigravity-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-authentication.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGnE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACpB,MAAM,EAAE,EAAE,IAAI,EAAE,mDAAmD,EAAE;IACrE,WAAW,EAAE,EAAE,IAAI,EAAE,iDAAiD,EAAE;IACxE,KAAK,EAAE,0CAA0C;IACjD,WAAW,EAAE,gBAAgB,mBAAmB,CAAC,WAAW,CAAC,KAAK,EAAE;CACrE,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,mBAAmB,CAAC,WAAW,CAAC,KAAK;IAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACb,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,uCAAuC;gBAC7C,OAAO,EAAE,iBAAiB,CAAC,mBAAmB;aAC/C;SACF;KACF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAuB,MAAM,CAAC,MAAM,CAAC;IACtE,OAAO,EAAE,IAAI,CAAC,MAAM;IACpB,cAAc,EAAE,IAAI,CAAC,IAAI;IACzB,KAAK,EAAE,GAAG,CAAC,MAAM;IACjB,WAAW,EAAE,GAAG,CAAC,GAAG;IACpB,gBAAgB,EAAE,GAAG,CAAC,QAAQ;CAC/B,CAAC,CAAC","sourcesContent":["import {\n  credentialRecipes,\n  credentialVariables,\n} from \"./authentication.constants.ts\";\nimport { hostFile, variableCredential } from \"./authentication.ts\";\nimport type { CredentialStrategy } from \"./authentication.types.ts\";\n\nconst file = hostFile({\n  source: { path: \"~/.gemini/antigravity-cli/antigravity-oauth-token\" },\n  destination: { file: \".gemini/antigravity-cli/antigravity-oauth-token\" },\n  login: \"agy and sign in with your Google account\",\n  alternative: `\"usage\" with ${credentialVariables.antigravity.usage}`,\n});\n\nconst key = variableCredential({\n  variable: credentialVariables.antigravity.usage,\n  expose: () => ({\n    files: [\n      {\n        path: \".gemini/antigravity-cli/settings.json\",\n        content: credentialRecipes.antigravitySettings,\n      },\n    ],\n  }),\n});\n\nexport const antigravityCredentials: CredentialStrategy = Object.freeze({\n  account: file.preset,\n  \"account.file\": file.file,\n  usage: key.preset,\n  \"usage.key\": key.key,\n  \"usage.variable\": key.variable,\n});\n"]}

package/dist/adapters/agents/antigravity-diagnostics.d.ts

@@ -0,0 +1 @@
+export declare function antigravityDiagnostics(): readonly import("./cli-diagnostics.types.ts").AgentCliDiagnostic[];

package/dist/adapters/agents/antigravity-diagnostics.js

@@ -0,0 +1,6 @@
+import { antigravityRequest } from "./antigravity-request.js";
+import { helpDiagnostics } from "./cli-diagnostics.js";
+export function antigravityDiagnostics() {
+    return helpDiagnostics((input) => antigravityRequest({}, input), "Usage of agy:", true);
+}
+//# sourceMappingURL=antigravity-diagnostics.js.map

package/dist/adapters/agents/antigravity-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-diagnostics.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,UAAU,sBAAsB;IACpC,OAAO,eAAe,CACpB,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,EACxC,eAAe,EACf,IAAI,CACL,CAAC;AACJ,CAAC","sourcesContent":["import { antigravityRequest } from \"./antigravity-request.ts\";\nimport { helpDiagnostics } from \"./cli-diagnostics.ts\";\n\nexport function antigravityDiagnostics() {\n  return helpDiagnostics(\n    (input) => antigravityRequest({}, input),\n    \"Usage of agy:\",\n    true,\n  );\n}\n"]}

package/dist/adapters/agents/antigravity-events.d.ts

@@ -0,0 +1,2 @@
+import type { AgentEvent } from "../../domain/agent.types.ts";
+export declare function antigravityEvents(line: string): AgentEvent[];

package/dist/adapters/agents/antigravity-events.js

@@ -0,0 +1,75 @@
+import { toolResult } from "./tool-result.js";
+import { decodeLine } from "./event-decoder.js";
+import { asRecord, numberOrZero } from "./protocol.js";
+const steps = {
+    agent_response: (step) => typeof step.text_delta === "string" && step.text_delta
+        ? [{ kind: "text", text: step.text_delta }]
+        : [],
+    tool: (step) => {
+        if (typeof step.tool_name !== "string")
+            return [];
+        const callId = typeof step.step_index === "number" &&
+            Number.isSafeInteger(step.step_index)
+            ? `${String(step.conversation_id ?? "turn")}:${step.step_index}`
+            : undefined;
+        const info = asRecord(step.tool_info);
+        if (step.state === "ACTIVE" && callId)
+            return [
+                { kind: "tool", name: step.tool_name, input: info.parameters, callId },
+            ];
+        if (step.state !== "DONE" && step.state !== "ERROR")
+            return [];
+        if (callId)
+            return toolResult(callId, step.tool_name, info.result ?? info.output, step.state === "ERROR");
+        return [{ kind: "tool", name: step.tool_name, input: info.parameters }];
+    },
+};
+function failure(result, response) {
+    if (typeof result.error === "string" && result.error)
+        return result.error;
+    if (result.status === "SUCCESS" && !response.trim())
+        return "Antigravity returned an empty response";
+    return `Antigravity ended the turn with status ${String(result.status ?? "unknown")}`;
+}
+function result(event) {
+    const result = asRecord(event.result);
+    const usage = asRecord(result.usage);
+    const response = typeof result.response === "string" ? result.response : "";
+    const events = Object.keys(usage).length
+        ? [
+            {
+                kind: "usage",
+                tokens: {
+                    input: numberOrZero(usage.input_tokens),
+                    cached: numberOrZero(usage.cache_read_tokens),
+                    output: numberOrZero(usage.output_tokens) +
+                        numberOrZero(usage.thinking_tokens),
+                },
+            },
+        ]
+        : [];
+    if (result.status === "SUCCESS" && response.trim())
+        return [
+            ...events,
+            { kind: "result", text: response },
+            { kind: "finished" },
+        ];
+    return [...events, { kind: "failure", message: failure(result, response) }];
+}
+export function antigravityEvents(line) {
+    return decodeLine(line, {
+        init: (event) => typeof event.conversation_id === "string"
+            ? [{ kind: "conversation", id: event.conversation_id }]
+            : [],
+        step_update: (event) => {
+            const step = asRecord(event.step_update);
+            const decode = typeof step.step_type === "string" &&
+                Object.hasOwn(steps, step.step_type)
+                ? steps[step.step_type]
+                : undefined;
+            return decode?.(step) ?? [];
+        },
+        result,
+    }, "event");
+}
+//# sourceMappingURL=antigravity-events.js.map

package/dist/adapters/agents/antigravity-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-events.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGvD,MAAM,KAAK,GAAkB;IAC3B,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CACvB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU;QACpD,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3C,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACb,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YACnC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE;YAChE,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM;YACnC,OAAO;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;aACvE,CAAC;QACJ,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QAC/D,IAAI,MAAM;YACR,OAAO,UAAU,CACf,MAAM,EACN,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAC1B,IAAI,CAAC,KAAK,KAAK,OAAO,CACvB,CAAC;QACJ,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;CACF,CAAC;AAEF,SAAS,OAAO,CAAC,MAAsB,EAAE,QAAgB;IACvD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjD,OAAO,wCAAwC,CAAC;IAClD,OAAO,0CAA0C,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,MAAM,CAAC,KAAqB;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAiB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QACpD,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE;oBACN,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;oBACvC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC;oBAC7C,MAAM,EACJ,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;wBACjC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC;iBACtC;aACF;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE;QAChD,OAAO;YACL,GAAG,MAAM;YACT,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,UAAU,EAAE;SACrB,CAAC;IACJ,OAAO,CAAC,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CACf,IAAI,EACJ;QACE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CACd,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACvC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBACvB,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM;KACP,EACD,OAAO,CACR,CAAC;AACJ,CAAC","sourcesContent":["import { toolResult } from \"./tool-result.ts\";\nimport type { AgentEvent } from \"../../domain/agent.types.ts\";\nimport { decodeLine } from \"./event-decoder.ts\";\nimport { asRecord, numberOrZero } from \"./protocol.ts\";\nimport type { EventDecoders, ProtocolRecord } from \"./protocol.types.ts\";\n\nconst steps: EventDecoders = {\n  agent_response: (step) =>\n    typeof step.text_delta === \"string\" && step.text_delta\n      ? [{ kind: \"text\", text: step.text_delta }]\n      : [],\n  tool: (step) => {\n    if (typeof step.tool_name !== \"string\") return [];\n    const callId =\n      typeof step.step_index === \"number\" &&\n      Number.isSafeInteger(step.step_index)\n        ? `${String(step.conversation_id ?? \"turn\")}:${step.step_index}`\n        : undefined;\n    const info = asRecord(step.tool_info);\n    if (step.state === \"ACTIVE\" && callId)\n      return [\n        { kind: \"tool\", name: step.tool_name, input: info.parameters, callId },\n      ];\n    if (step.state !== \"DONE\" && step.state !== \"ERROR\") return [];\n    if (callId)\n      return toolResult(\n        callId,\n        step.tool_name,\n        info.result ?? info.output,\n        step.state === \"ERROR\",\n      );\n    return [{ kind: \"tool\", name: step.tool_name, input: info.parameters }];\n  },\n};\n\nfunction failure(result: ProtocolRecord, response: string): string {\n  if (typeof result.error === \"string\" && result.error) return result.error;\n  if (result.status === \"SUCCESS\" && !response.trim())\n    return \"Antigravity returned an empty response\";\n  return `Antigravity ended the turn with status ${String(result.status ?? \"unknown\")}`;\n}\n\nfunction result(event: ProtocolRecord): AgentEvent[] {\n  const result = asRecord(event.result);\n  const usage = asRecord(result.usage);\n  const response = typeof result.response === \"string\" ? result.response : \"\";\n  const events: AgentEvent[] = Object.keys(usage).length\n    ? [\n        {\n          kind: \"usage\",\n          tokens: {\n            input: numberOrZero(usage.input_tokens),\n            cached: numberOrZero(usage.cache_read_tokens),\n            output:\n              numberOrZero(usage.output_tokens) +\n              numberOrZero(usage.thinking_tokens),\n          },\n        },\n      ]\n    : [];\n  if (result.status === \"SUCCESS\" && response.trim())\n    return [\n      ...events,\n      { kind: \"result\", text: response },\n      { kind: \"finished\" },\n    ];\n  return [...events, { kind: \"failure\", message: failure(result, response) }];\n}\n\nexport function antigravityEvents(line: string): AgentEvent[] {\n  return decodeLine(\n    line,\n    {\n      init: (event) =>\n        typeof event.conversation_id === \"string\"\n          ? [{ kind: \"conversation\", id: event.conversation_id }]\n          : [],\n      step_update: (event) => {\n        const step = asRecord(event.step_update);\n        const decode =\n          typeof step.step_type === \"string\" &&\n          Object.hasOwn(steps, step.step_type)\n            ? steps[step.step_type]\n            : undefined;\n        return decode?.(step) ?? [];\n      },\n      result,\n    },\n    \"event\",\n  );\n}\n"]}

package/dist/adapters/agents/antigravity-request.d.ts

@@ -0,0 +1,5 @@
+import type { AgentInput } from "../../domain/agent.types.ts";
+import type { Command } from "../../domain/command.types.ts";
+import type { AntigravitySettings } from "./antigravity.types.ts";
+import type { Bound } from "./settings.types.ts";
+export declare function antigravityRequest(settings: Bound<AntigravitySettings>, input: AgentInput): Command;

package/dist/adapters/agents/antigravity-request.js

@@ -0,0 +1,37 @@
+import { validId } from "../../infrastructure/conversations/identity.js";
+import { invariant } from "../../domain/errors.js";
+import { antigravityVariables } from "./antigravity.constants.js";
+export function antigravityRequest(settings, input) {
+    invariant(!input.continuation?.fork, "Antigravity does not support automated fork in Outpost");
+    const args = [];
+    if (input.continuation) {
+        validId(input.continuation.id);
+        args.push("--conversation", input.continuation.id);
+    }
+    if (settings.model)
+        args.push("--model", settings.model.name);
+    if (settings.mode)
+        args.push("--mode", settings.mode);
+    if (input.interactive)
+        return {
+            executable: "agy",
+            variables: antigravityVariables,
+            arguments: [
+                ...args,
+                ...(input.text === undefined
+                    ? []
+                    : ["--prompt-interactive", input.text]),
+            ],
+            interactive: true,
+        };
+    if (!settings.mode)
+        args.push("--dangerously-skip-permissions");
+    args.push("--input-format", "stream-json", "--output-format", "stream-json");
+    return {
+        executable: "agy",
+        variables: antigravityVariables,
+        arguments: args,
+        stdin: `${JSON.stringify({ event: "user", message: { content: input.text ?? "" } })}\n`,
+    };
+}
+//# sourceMappingURL=antigravity-request.js.map

package/dist/adapters/agents/antigravity-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-request.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,gDAAgD,CAAC;AAGzE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAIlE,MAAM,UAAU,kBAAkB,CAChC,QAAoC,EACpC,KAAiB;IAEjB,SAAS,CACP,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EACzB,wDAAwD,CACzD,CAAC;IACF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,WAAW;QACnB,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,oBAAoB;YAC/B,SAAS,EAAE;gBACT,GAAG,IAAI;gBACP,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,CAAC,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAC1C;YACD,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI;KACxF,CAAC;AACJ,CAAC","sourcesContent":["import { validId } from \"../../infrastructure/conversations/identity.ts\";\nimport type { AgentInput } from \"../../domain/agent.types.ts\";\nimport type { Command } from \"../../domain/command.types.ts\";\nimport { invariant } from \"../../domain/errors.ts\";\nimport { antigravityVariables } from \"./antigravity.constants.ts\";\nimport type { AntigravitySettings } from \"./antigravity.types.ts\";\nimport type { Bound } from \"./settings.types.ts\";\n\nexport function antigravityRequest(\n  settings: Bound<AntigravitySettings>,\n  input: AgentInput,\n): Command {\n  invariant(\n    !input.continuation?.fork,\n    \"Antigravity does not support automated fork in Outpost\",\n  );\n  const args: string[] = [];\n  if (input.continuation) {\n    validId(input.continuation.id);\n    args.push(\"--conversation\", input.continuation.id);\n  }\n  if (settings.model) args.push(\"--model\", settings.model.name);\n  if (settings.mode) args.push(\"--mode\", settings.mode);\n  if (input.interactive)\n    return {\n      executable: \"agy\",\n      variables: antigravityVariables,\n      arguments: [\n        ...args,\n        ...(input.text === undefined\n          ? []\n          : [\"--prompt-interactive\", input.text]),\n      ],\n      interactive: true,\n    };\n  if (!settings.mode) args.push(\"--dangerously-skip-permissions\");\n  args.push(\"--input-format\", \"stream-json\", \"--output-format\", \"stream-json\");\n  return {\n    executable: \"agy\",\n    variables: antigravityVariables,\n    arguments: args,\n    stdin: `${JSON.stringify({ event: \"user\", message: { content: input.text ?? \"\" } })}\\n`,\n  };\n}\n"]}

package/dist/adapters/agents/antigravity.constants.d.ts

@@ -0,0 +1,3 @@
+export declare const antigravityVariables: Readonly<{
+    AGY_CLI_DISABLE_AUTO_UPDATE: "true";
+}>;

package/dist/adapters/agents/antigravity.constants.js

@@ -0,0 +1,4 @@
+export const antigravityVariables = Object.freeze({
+    AGY_CLI_DISABLE_AUTO_UPDATE: "true",
+});
+//# sourceMappingURL=antigravity.constants.js.map

package/dist/adapters/agents/antigravity.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity.constants.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,2BAA2B,EAAE,MAAM;CACpC,CAAC,CAAC","sourcesContent":["export const antigravityVariables = Object.freeze({\n  AGY_CLI_DISABLE_AUTO_UPDATE: \"true\",\n});\n"]}

package/dist/adapters/agents/{gemini.types.d.ts → antigravity.types.d.ts}

@@ -1,7 +1,7 @@
 import type { AgentAuthentication } from "../../domain/agent.types.ts";
 import type { Variables } from "../../domain/command.types.ts";
-export interface GeminiSettings {
+export interface AntigravitySettings {
     readonly authentication?: AgentAuthentication;
     readonly variables?: Variables;
-    readonly approvalMode?: "default" | "auto_edit" | "yolo" | "plan";
+    readonly mode?: "accept-edits" | "plan";
 }

package/dist/adapters/agents/antigravity.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=antigravity.types.js.map

package/dist/adapters/agents/antigravity.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity.types.js","sourceRoot":"","sources":["../../../src/adapters/agents/antigravity.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AgentAuthentication } from \"../../domain/agent.types.ts\";\nimport type { Variables } from \"../../domain/command.types.ts\";\n\nexport interface AntigravitySettings {\n  readonly authentication?: AgentAuthentication;\n  readonly variables?: Variables;\n  readonly mode?: \"accept-edits\" | \"plan\";\n}\n"]}

package/dist/adapters/agents/authentication.constants.d.ts

@@ -1,13 +1,23 @@
-export declare const authenticationRecipes: {
+export declare const credentialRecipes: Readonly<{
+    tool: "const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const [binary,...args]=process.argv.slice(1); const installed=join(homedir(),\".outpost-tools\",\"bin\",binary); const result=spawnSync(existsSync(installed)?installed:binary,args,{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);";
+    antigravitySettings: "{\"modelProvider\":\"gemini\"}\n";
+}>;
+export declare const credentialVariables: Readonly<{
+    readonly claude: {
+        readonly account: "CLAUDE_CODE_OAUTH_TOKEN";
+        readonly usage: "ANTHROPIC_API_KEY";
+    };
     readonly codex: {
-        readonly environment: "OPENAI_API_KEY=\n";
-        readonly login: "const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const installed=join(homedir(),\".outpost-tools\",\"bin\",\"codex\"); const result=spawnSync(existsSync(installed)?installed:\"codex\",[\"login\",\"--with-api-key\"],{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);";
-        readonly seed: "const {mkdirSync,writeFileSync,readFileSync,chmodSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const directory=join(homedir(),\".codex\"); mkdirSync(directory,{recursive:true,mode:0o700}); const target=join(directory,\"auth.json\"); writeFileSync(target,readFileSync(0),{mode:0o600}); chmodSync(target,0o600);";
+        readonly usage: "OPENAI_API_KEY";
     };
-    readonly claude: {
-        readonly environment: "ANTHROPIC_API_KEY=\n";
+    readonly antigravity: {
+        readonly usage: "GEMINI_API_KEY";
+    };
+    readonly copilot: {
+        readonly account: "COPILOT_GITHUB_TOKEN";
     };
-    readonly gemini: {
-        readonly environment: "GEMINI_API_KEY=\n";
+    readonly kimi: {
+        readonly usage: "KIMI_API_KEY";
     };
-};
+}>;
+export declare const KIMI_LOGIN_DEADLINE_MS = 120000;

package/dist/adapters/agents/authentication.constants.js

@@ -1,10 +1,13 @@
-export const authenticationRecipes = {
-    codex: {
-        environment: "OPENAI_API_KEY=\n",
-        login: 'const {spawnSync}=require("node:child_process"); const {existsSync}=require("node:fs"); const {join}=require("node:path"); const {homedir}=require("node:os"); const installed=join(homedir(),".outpost-tools","bin","codex"); const result=spawnSync(existsSync(installed)?installed:"codex",["login","--with-api-key"],{stdio:"inherit",shell:process.platform==="win32"}); process.exit(result.status ?? 1);',
-        seed: 'const {mkdirSync,writeFileSync,readFileSync,chmodSync}=require("node:fs"); const {join}=require("node:path"); const {homedir}=require("node:os"); const directory=join(homedir(),".codex"); mkdirSync(directory,{recursive:true,mode:0o700}); const target=join(directory,"auth.json"); writeFileSync(target,readFileSync(0),{mode:0o600}); chmodSync(target,0o600);',
-    },
-    claude: { environment: "ANTHROPIC_API_KEY=\n" },
-    gemini: { environment: "GEMINI_API_KEY=\n" },
-};
+export const credentialRecipes = Object.freeze({
+    tool: 'const {spawnSync}=require("node:child_process"); const {existsSync}=require("node:fs"); const {join}=require("node:path"); const {homedir}=require("node:os"); const [binary,...args]=process.argv.slice(1); const installed=join(homedir(),".outpost-tools","bin",binary); const result=spawnSync(existsSync(installed)?installed:binary,args,{stdio:"inherit",shell:process.platform==="win32"}); process.exit(result.status ?? 1);',
+    antigravitySettings: '{"modelProvider":"gemini"}\n',
+});
+export const credentialVariables = Object.freeze({
+    claude: { account: "CLAUDE_CODE_OAUTH_TOKEN", usage: "ANTHROPIC_API_KEY" },
+    codex: { usage: "OPENAI_API_KEY" },
+    antigravity: { usage: "GEMINI_API_KEY" },
+    copilot: { account: "COPILOT_GITHUB_TOKEN" },
+    kimi: { usage: "KIMI_API_KEY" },
+});
+export const KIMI_LOGIN_DEADLINE_MS = 120_000;
 //# sourceMappingURL=authentication.constants.js.map

package/dist/adapters/agents/authentication.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.constants.js","sourceRoot":"","sources":["../../../src/adapters/agents/authentication.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE;QACL,WAAW,EAAE,mBAAmB;QAChC,KAAK,EACH,iZAAiZ;QACnZ,IAAI,EAAE,sWAAsW;KAC7W;IACD,MAAM,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAC/C,MAAM,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;CACpC,CAAC","sourcesContent":["export const authenticationRecipes = {\n  codex: {\n    environment: \"OPENAI_API_KEY=\\n\",\n    login:\n      'const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const installed=join(homedir(),\".outpost-tools\",\"bin\",\"codex\"); const result=spawnSync(existsSync(installed)?installed:\"codex\",[\"login\",\"--with-api-key\"],{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);',\n    seed: 'const {mkdirSync,writeFileSync,readFileSync,chmodSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const directory=join(homedir(),\".codex\"); mkdirSync(directory,{recursive:true,mode:0o700}); const target=join(directory,\"auth.json\"); writeFileSync(target,readFileSync(0),{mode:0o600}); chmodSync(target,0o600);',\n  },\n  claude: { environment: \"ANTHROPIC_API_KEY=\\n\" },\n  gemini: { environment: \"GEMINI_API_KEY=\\n\" },\n} as const;\n"]}
+{"version":3,"file":"authentication.constants.js","sourceRoot":"","sources":["../../../src/adapters/agents/authentication.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,uaAAua;IAC7a,mBAAmB,EAAE,8BAA8B;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAC1E,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAClC,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACxC,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC5C,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;CACvB,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC","sourcesContent":["export const credentialRecipes = Object.freeze({\n  tool: 'const {spawnSync}=require(\"node:child_process\"); const {existsSync}=require(\"node:fs\"); const {join}=require(\"node:path\"); const {homedir}=require(\"node:os\"); const [binary,...args]=process.argv.slice(1); const installed=join(homedir(),\".outpost-tools\",\"bin\",binary); const result=spawnSync(existsSync(installed)?installed:binary,args,{stdio:\"inherit\",shell:process.platform===\"win32\"}); process.exit(result.status ?? 1);',\n  antigravitySettings: '{\"modelProvider\":\"gemini\"}\\n',\n});\n\nexport const credentialVariables = Object.freeze({\n  claude: { account: \"CLAUDE_CODE_OAUTH_TOKEN\", usage: \"ANTHROPIC_API_KEY\" },\n  codex: { usage: \"OPENAI_API_KEY\" },\n  antigravity: { usage: \"GEMINI_API_KEY\" },\n  copilot: { account: \"COPILOT_GITHUB_TOKEN\" },\n  kimi: { usage: \"KIMI_API_KEY\" },\n} as const);\n\nexport const KIMI_LOGIN_DEADLINE_MS = 120_000;\n"]}

package/dist/adapters/agents/authentication.d.ts

@@ -1,2 +1,11 @@
-import type { AgentAdapter, AgentAuthentication } from "../../domain/agent.types.ts";
-export declare function authenticationCommand(name: "codex" | "claude" | "gemini", authentication: AgentAuthentication | undefined, externalModel?: boolean): NonNullable<AgentAdapter["authenticate"]>;
+import type { AgentAdapter, AgentAuthentication, CredentialPlan } from "../../domain/agent.types.ts";
+import type { Command, Variables } from "../../domain/command.types.ts";
+import type { AgentModel } from "../../domain/model.types.ts";
+import type { CredentialRecipe, CredentialStrategy, HostFileOptions, VariableCredentialOptions } from "./authentication.types.ts";
+export declare function credentialPlan(plan?: Partial<CredentialPlan>): CredentialPlan;
+export declare function toolCommand(binary: string, args: readonly string[], options?: Pick<Command, "stdin" | "deadlineMs">): Command;
+export declare function requiredVariable(variables: Variables, name: string): string;
+export declare function variableCredential(options: VariableCredentialOptions): Readonly<Record<"preset" | "key" | "variable", CredentialRecipe>>;
+export declare function hostFile(options: HostFileOptions): Readonly<Record<"preset" | "file", CredentialRecipe>>;
+export declare function excluding(recipe: CredentialRecipe, variable: string, message: string): CredentialRecipe;
+export declare function credentialPlanner(agent: string, strategy: CredentialStrategy, authentication: AgentAuthentication | undefined, model?: AgentModel): AgentAdapter["credentials"];