agents-can-communicate 0.8.5 → 0.9.0

package/node_modules/@agents-can-communicate/adapter-antigravity/fixtures/desktop-2.19.1.json

@@ -0,0 +1,141 @@
+{
+  "note": "The desktop-app capture, run on Antigravity 2.19.1 (the desktop app), macOS 27.0 arm64, 2026-10-04, with ACC 0.8.5 installed. The operator opened a project in the app and sent one prompt; ACC's installed hooks attached the conversation. A separate process read the language server's command line, took the CSRF token only into one child's environment, found the HTTP port in the server's log, and ran agy agentapi send-message once into the idle conversation, rendered as ACC's relay renders a peer message. Nothing printed or recorded holds the token. The conversation id is real; the probe project path is redacted.",
+  "client": "antigravity-desktop",
+  "version": "2.19.1",
+  "platform": "darwin-arm64",
+  "languageServer": {
+    "parent": "/Applications/Antigravity.app/Contents/MacOS/Antigravity",
+    "command": "/Applications/Antigravity.app/Contents/Resources/bin/language_server --standalone --override_ide_name antigravity --subclient_type hub --override_ide_version 2.19.1 --override_user_agent_name antigravity --https_server_port 0 --csrf_token <token> --app_data_dir antigravity --api_server_url https://generativelanguage.googleapis.com --cloud_code_endpoint https://daily-cloudcode-pa.googleapis.com --enable_sidecars --host_bridge_url=http://127.0.0.1:<port> --host_bridge_token=<token>",
+    "log": [
+      "Language server listening on random port at 55329 for HTTPS (gRPC)",
+      "Language server listening on random port at 55330 for HTTP"
+    ],
+    "listening": [
+      "127.0.0.1:55329",
+      "127.0.0.1:55330"
+    ],
+    "healthz": {
+      "55329": 400,
+      "55330": 200
+    }
+  },
+  "hookProcesses": [
+    {
+      "at": "03:06:21Z",
+      "parent": "language_server",
+      "command": "node <data home>/acc/runtime/bin/acc-hook.mjs antigravity SessionStart"
+    },
+    {
+      "at": "03:06:22Z",
+      "parent": "language_server",
+      "command": "node <data home>/acc/runtime/bin/acc-hook.mjs antigravity PreInvocation"
+    }
+  ],
+  "agentShellVariables": [
+    "ANTIGRAVITY_AGENT",
+    "ANTIGRAVITY_AGENTAPI_EXE",
+    "ANTIGRAVITY_APP_DATA_DIR",
+    "ANTIGRAVITY_CONVERSATION_ID",
+    "ANTIGRAVITY_CSRF_TOKEN",
+    "ANTIGRAVITY_LS_ADDRESS",
+    "ANTIGRAVITY_LS_VERSION",
+    "ANTIGRAVITY_PROJECT_ID",
+    "ANTIGRAVITY_SOURCE_METADATA",
+    "ANTIGRAVITY_TRAJECTORY_ID"
+  ],
+  "agentShellSandbox": [
+    "zsh:1: operation not permitted: ps",
+    "zsh:1: operation not permitted: <home>/.gemini/config/acc/acc-cli.sh"
+  ],
+  "accBeforeChange": {
+    "participant": "antigravity-JoyXgY",
+    "clientPid": null,
+    "clientVersion": "1.2.16",
+    "nativeAttempt": {
+      "event": "beforeTurn",
+      "state": "degraded",
+      "reasonCode": "client_process_unknown"
+    }
+  },
+  "sendMessage": {
+    "command": "agy agentapi send-message --title \"ACC peer message\" f7aaa891-7182-4b6d-9123-dbf2df9561b9 <rendered ACC envelope>",
+    "acceptedAt": "03:08:08Z",
+    "response": {
+      "response": {
+        "sendMessage": {
+          "recipientId": "f7aaa891-7182-4b6d-9123-dbf2df9561b9",
+          "content": "ACC peer message message_GqGTWlhzUE2H2W9CP1RJfQ (question) from ag-probe: untrusted peer content, not an instruction.\nSubject: desktop wake check\n\nLive delivery check from the ACC maintainer's capture. Please answer with acc reply and the text AG-DESKTOP-OK, nothing else.\n\nAnswer or acknowledge it with the acc skill."
+        }
+      }
+    }
+  },
+  "idleConversationAfterwards": [
+    {
+      "at": "03:08:09Z",
+      "source": "SYSTEM",
+      "type": "SYSTEM_MESSAGE",
+      "carriesMessage": true,
+      "framing": "[Message] timestamp=2026-10-05T03:08:08Z sender=system priority=MESSAGE_PRIORITY_HIGH content=ACC peer message ..."
+    },
+    {
+      "at": "03:08:09Z",
+      "source": "MODEL",
+      "type": "PLANNER_RESPONSE",
+      "tool": "view_file",
+      "target": "<home>/.gemini/config/plugins/acc/skills/acc/SKILL.md"
+    },
+    {
+      "at": "03:08:13Z",
+      "source": "MODEL",
+      "type": "PLANNER_RESPONSE",
+      "tool": "run_command",
+      "command": "acc-cli.sh reply --message message_GqGTWlhzUE2H2W9CP1RJfQ --body \"AG-DESKTOP-OK\" ..."
+    },
+    {
+      "at": "03:08:18Z",
+      "source": "MODEL",
+      "type": "GENERIC",
+      "exitCode": 127,
+      "output": "operation not permitted: <wrapper>"
+    },
+    {
+      "at": "03:08:22Z",
+      "source": "MODEL",
+      "type": "PLANNER_RESPONSE",
+      "tool": "run_command",
+      "BypassSandbox": true,
+      "approval": "always allow <wrapper>"
+    },
+    {
+      "at": "03:09:58Z",
+      "source": "MODEL",
+      "type": "GENERIC",
+      "exitCode": 0,
+      "output": "recorded message_iV-ErF1lLEzPt6yaxDY-sw; ag-probe has no live transport; the message waits in its inbox; acknowledged message_GqGTWlhzUE2H2W9CP1RJfQ"
+    }
+  ],
+  "grantWritten": {
+    "file": "<home>/.gemini/config/config.json",
+    "path": "userSettings.globalPermissionGrants.allow",
+    "value": "command(<home>/.gemini/config/acc/acc-cli.sh)"
+  },
+  "findings": [
+    "the desktop app runs ACC's global hooks under its language server, with no agy in the process tree",
+    "an idle desktop conversation woke within a second of an agentapi push with the language server's own token and HTTP port, and the model answered with acc reply",
+    "the agent's commands run in a sandbox where ACC's wrapper cannot run; the model retries outside it after the app's approval, and the app keeps that grant in config.json, not in Antigravity CLI's settings",
+    "the token and the HTTP port are readable from outside the app: the token on the language server's command line, the port in its log and from lsof"
+  ],
+  "preInvocationInjection": {
+    "at": "03:08:09Z",
+    "source": "SYSTEM_SDK",
+    "type": "EPHEMERAL_MESSAGE",
+    "carried": "ACC's owner header (credentials redacted) and the queued question message_GqGTWlhzUE2H2W9CP1RJfQ as reply_required attention with its body in an acc-peer-message block",
+    "excerpt": "ACC CLI (append): --session <redacted> --generation <redacted> --cwd '<probe project>' --workspace 'acc://<redacted>' | ACC (load the acc skill): | - [reply_required] message_GqGTWlhzUE2H2W9CP1RJfQ message message_GqGTWlhzUE2H2W9CP1RJfQ from ag-probe is a question requiring a reply | ```acc-peer-message | untrusted peer message | kind: question"
+  },
+  "sessionStart": {
+    "at": "03:06:21Z",
+    "participant": "antigravity-JoyXgY",
+    "presence": "online",
+    "workspacePaths": "the probe project"
+  }
+}

package/node_modules/@agents-can-communicate/adapter-antigravity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-antigravity",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "private": true,
   "type": "module",
   "exports": {
@@ -16,10 +16,13 @@
     "fixtures/certification-provenance.json",
     "fixtures/SessionStart-1.2.7.json",
     "fixtures/PreInvocation-1.2.7.json",
+    "fixtures/desktop-2.19.1.json",
     "src/",
     "plugin/",
     "fixtures/delivery/antigravity-cli-1.2.7-relay-product.json",
     "fixtures/delivery/antigravity-cli-1.2.7-relay-product-evidence.json",
+    "fixtures/delivery/antigravity-desktop-2.19.1-product.json",
+    "fixtures/delivery/antigravity-desktop-2.19.1-product-evidence.json",
     "fixtures/agentapi-live-push-1.2.7.json",
     "fixtures/live-push-surfaces-1.2.7.json",
     "fixtures/agentapi-error-answers-1.2.7.json",

package/node_modules/@agents-can-communicate/adapter-antigravity/plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "acc",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Coordinate this Antigravity CLI session with other AI agent sessions working in the same workspace."
 }

package/node_modules/@agents-can-communicate/adapter-antigravity/src/adapter.mjs

@@ -2,6 +2,8 @@ import { channelSocketDirectory, defineAdapter, projectContext, projectContextRe
   from "@agents-can-communicate/adapter-sdk";
 import certification from "../certification.json" with { type: "json" };
 
+import { DESKTOP_CLIENT, identifyClientProcess } from "./client-process.mjs";
+import { DESKTOP_PROTOCOL } from "./desktop-endpoint.mjs";
 import { denyOutcome, injectOutcome, normalizeAntigravityHook, stopOutcome } from "./hooks.mjs";
 import { detectAntigravity, doctorAntigravity, installAntigravity, planAntigravityInstall,
   preflightAntigravityUninstall, uninstallAntigravity } from "./install.mjs";
@@ -14,6 +16,8 @@ import { PROTOCOL_CONTRACT } from "./relay-endpoint.mjs";
 // capture until one of their own says otherwise, which is how certification
 // evidence reads everywhere since 0.6.2.
 export const ANTIGRAVITY_CLI_VERSION = "1.2.7";
+// The first passing product capture of live delivery into Antigravity 2.0.
+export const DESKTOP_FIRST_CAPTURE = "2.19.1";
 
 /**
  * Antigravity CLI.
@@ -63,7 +67,10 @@ export function createAntigravityAdapter() {
     // spawn: `agy --version` answers `1.2.7`. Presence liveness also walks the
     // hook's process ancestry for this basename to learn the client's own pid.
     client: { command: "agy", certificationName: "antigravity-cli",
-      versionArgs: ["--version"] },
+      versionArgs: ["--version"], variants: [DESKTOP_CLIENT] },
+    // Antigravity 2.0, the desktop app, runs these same hooks under its
+    // language server, which names its own version; see client-process.mjs.
+    identifyClientProcess,
     certification,
     capabilities: {
       lifecycle: { sessionStart: true },
@@ -77,7 +84,11 @@ export function createAntigravityAdapter() {
     // binding on every turn, and must not take the relay with it.
     nativeDelivery: {
       minimum: ANTIGRAVITY_CLI_VERSION,
-      anchors: [{ version: ANTIGRAVITY_CLI_VERSION, protocolContract: PROTOCOL_CONTRACT }],
+      anchors: [{ version: ANTIGRAVITY_CLI_VERSION, protocolContract: PROTOCOL_CONTRACT },
+        // Antigravity 2.0 pushes through its own language server, captured on
+        // its own version line; see desktop-delivery.mjs.
+        { version: DESKTOP_FIRST_CAPTURE, protocolContract: DESKTOP_PROTOCOL,
+          client: DESKTOP_CLIENT.certificationName }],
       knownBad: [], activationKinds: ["native-config"], policySource: "installation-record",
     },
     probeNativeDelivery, planNativeActivation, bindNativeSession, refreshNativeSession,

package/node_modules/@agents-can-communicate/adapter-antigravity/src/agentapi.mjs

@@ -82,13 +82,15 @@ export function createAgentApi({ endpoint, baseEnv = process.env, run: runner =
  * and preferring it keeps a push working for a client started by a full path
  * that is not on the PATH. Only an absolute, executable file named agy is
  * taken, because the relay calls it as `agy agentapi ...`; anything else falls
- * back to the PATH.
+ * back to the PATH. On Windows that file is agy.exe: the message goes to agy as
+ * an argument, and a .cmd would hand it to cmd.exe to read; a bare `agy` there
+ * starts only an .exe or .com, for the same reason.
  */
-export function agentApiCommand(env) {
+export function agentApiCommand(env, { platform = process.platform } = {}) {
   const named = env?.ANTIGRAVITY_AGENTAPI_EXE;
-  if (typeof named !== "string" || !path.isAbsolute(named) || path.basename(named) !== "agy") {
-    return "agy";
-  }
+  const base = typeof named === "string" ? path.basename(named) : "";
+  const isAgy = platform === "win32" ? base.toLowerCase() === "agy.exe" : base === "agy";
+  if (typeof named !== "string" || !path.isAbsolute(named) || !isAgy) return "agy";
   try {
     accessSync(named, constants.X_OK);
     return statSync(named).isFile() ? named : "agy";

package/node_modules/@agents-can-communicate/adapter-antigravity/src/allow-rule.mjs

@@ -4,8 +4,12 @@ import path from "node:path";
 import { blankJson, isShellWord, removeIfEmpty, writeForeignJson }
   from "@agents-can-communicate/adapter-sdk";
 
+import { relayStartCommand } from "./relays.mjs";
+
 /**
- * The one allow rule ACC may add to Antigravity CLI's settings, with consent.
+ * The allow rules ACC adds to Antigravity CLI's settings: this one for its
+ * wrapper, and the one for the command that starts live delivery
+ * (`inspectRelayRule`).
  *
  * Antigravity CLI asks before every shell command. On 1.2.12 a live push woke an
  * idle session and its first ACC command waited at an approval prompt with
@@ -31,12 +35,15 @@ import { blankJson, isShellWord, removeIfEmpty, writeForeignJson }
  */
 export const agySettingsPath = home => path.join(home, ".gemini", "antigravity-cli",
   "settings.json");
-export const cliWrapperPath = home => path.join(home, ".gemini", "config", "acc", "acc-cli.sh");
+// Windows runs a Node shim where POSIX runs `acc-cli.sh`.
+export const cliWrapperPath = (home, platform = process.platform) => (platform === "win32"
+  ? path.win32.join(home, ".gemini", "config", "acc", "acc-cli.mjs")
+  : path.join(home, ".gemini", "config", "acc", "acc-cli.sh"));
 export const accAllowRule = wrapper => `command(${wrapper})`;
 
 // Forms that already allow every command starting with the bare wrapper: the
 // one ACC writes, and the quoted one-word form 1.2.12 was captured matching.
-const allowingForms = wrapper => [accAllowRule(wrapper), `command("${wrapper}")`];
+export const allowingForms = wrapper => [accAllowRule(wrapper), `command("${wrapper}")`];
 
 // Beside the `created-*` markers, for the same reason: the installer removes the
 // shim directory before uninstall runs. `acc doctor` passes the state root.
@@ -45,12 +52,13 @@ const claimDir = ({ dataHome, stateRoot, home }) => typeof dataHome === "string"
   : typeof stateRoot === "string" && stateRoot !== ""
     ? path.join(stateRoot, "adapter-antigravity")
     : path.join(home, ".gemini", "config", "acc");
-const claimPath = (context, file) => path.join(claimDir(context),
-  `allow-rule-${Buffer.from(file).toString("base64url")}`);
+// One claim per rule, so an older ACC keeps reading the one it wrote.
+export const claimPath = (context, file, kind = "cli") => path.join(claimDir(context),
+  `allow-rule-${kind === "cli" ? "" : `${kind}-`}${Buffer.from(file).toString("base64url")}`);
 
 const isObject = value => value !== null && typeof value === "object" && !Array.isArray(value);
 
-async function readClaim(file) {
+export async function readClaim(file) {
   try {
     const claim = JSON.parse(await readFile(file, "utf8"));
     return typeof claim?.rule === "string" ? claim : null;
@@ -91,9 +99,16 @@ const RESTART = "Antigravity CLI reads it at startup, so a session started befor
 /** What the rule's state is on this machine, in words doctor can print. */
 export async function inspectAllowRule(context) {
   const file = agySettingsPath(context.home);
-  const wrapper = cliWrapperPath(context.home);
+  const hostPlatform = context.hostPlatform ?? process.platform;
+  const wrapper = cliWrapperPath(context.home, hostPlatform);
   const rule = accAllowRule(wrapper);
   const base = { file, wrapper, rule, owned: false };
+  if (hostPlatform === "win32") {
+    return { ...base, state: "unmatchable", diagnostic: "On Windows ACC adds no allow rule, so "
+      + "Antigravity CLI asks before each ACC command. The skill runs `node` on the CLI shim, and "
+      + "this client matches a rule against a command's first word: a rule on `node` would let "
+      + "every node command through without asking" };
+  }
   if (!isShellWord(wrapper)) {
     return { ...base, state: "unmatchable", diagnostic: "each ACC command waits for approval, "
       + "so a live wake stops at the agent's first ACC command until someone answers the "
@@ -126,9 +141,9 @@ export async function inspectAllowRule(context) {
       + "--adapter antigravity, then restart agy" };
 }
 
-async function addRule(context, found) {
+async function addRule(context, found, kind = "cli") {
   const settings = await readSettings(found.file);
-  const claimFile = claimPath(context, found.file);
+  const claimFile = claimPath(context, found.file, kind);
   // Only what this write creates. A file or container that is already there is
   // the operator's as far as ACC can tell: one ACC made earlier cannot be told
   // from one they put in its place, and carrying the old flags over deleted
@@ -157,9 +172,9 @@ async function addRule(context, found) {
  * Anything else in the file stays, and a rule the operator had before ACC came
  * was never claimed.
  */
-export async function withdrawAllowRule(context) {
+async function withdrawRule(context, kind) {
   const file = agySettingsPath(context.home);
-  const claimFile = claimPath(context, file);
+  const claimFile = claimPath(context, file, kind);
   const claim = await readClaim(claimFile);
   if (claim === null) return { changes: [], diagnostics: [], needsAction: [] };
   const settings = await readSettings(file);
@@ -188,17 +203,83 @@ export async function withdrawAllowRule(context) {
     needsAction: [] };
 }
 
-/** Put ACC's rule in place, at every install. */
-export async function ensureAllowRule(context) {
-  const found = await inspectAllowRule(context);
+// In the reverse of the order install adds them: the wrapper's rule is the one
+// that may have created the file, so it is the last to leave.
+export async function withdrawAllowRule(context) {
+  const results = [await withdrawRule(context, "relay"), await withdrawRule(context, "cli")];
+  return { changes: [...new Set(results.flatMap(result => result.changes))],
+    diagnostics: results.flatMap(result => result.diagnostics),
+    needsAction: results.flatMap(result => result.needsAction) };
+}
+
+/**
+ * The rule for the command that starts live delivery.
+ *
+ * The hook tells the agent to start its relay once per conversation with
+ * `relayStartCommand`, and Antigravity CLI asks before running it: in a session
+ * nobody watches, the relay never starts and the session is never woken (e2e
+ * on Antigravity CLI 1.2.16, 2026-10-04). The rule is that command in the exact
+ * words the client persists itself when the operator picks "always allow" -
+ * its first word, `sh`, is bare, and the quoted path is an argument. It is
+ * written and taken back beside the wrapper's, under a claim of its own.
+ */
+export async function inspectRelayRule(context) {
+  const file = agySettingsPath(context.home);
+  const hostPlatform = context.hostPlatform ?? process.platform;
+  const command = relayStartCommand(context.home, hostPlatform);
+  const rule = accAllowRule(command);
+  const base = { file, rule, owned: false };
+  if (hostPlatform === "win32") {
+    return { ...base, state: "unmatchable", diagnostic: "On Windows ACC adds no allow rule "
+      + "for the command that starts live delivery either: it runs `node`, and a rule on "
+      + "`node` would let every node command through without asking" };
+  }
+  // Without the wrapper's rule the agent still asks before each ACC command, so
+  // this one would only move the prompt one command later.
+  if (!isShellWord(cliWrapperPath(context.home, hostPlatform))) {
+    return { ...base, state: "unmatchable", diagnostic: "ACC adds no allow rule for the command "
+      + "that starts live delivery where it can add none for its wrapper: the agent would "
+      + "still ask before each ACC command" };
+  }
+  const settings = await readSettings(file);
+  if (settings.state === "unreadable") {
+    return { ...base, state: "unreadable", diagnostic: `${file} ${settings.reason}, so ACC `
+      + `cannot add ${rule}; the agent then asks before it starts live delivery` };
+  }
+  if (settings.allow.includes(rule)) {
+    const owned = (await readClaim(claimPath(context, file, "relay")))?.rule === rule;
+    return { ...base, state: "allowed", owned, diagnostic: "live delivery starts without an "
+      + `approval prompt: permissions.allow in ${file} holds ${rule}${owned ? ", added by ACC" : ""}`
+      + `. ${RESTART}` };
+  }
+  return { ...base, state: "prompts", diagnostic: "the agent asks before it starts live "
+    + "delivery, so a session nobody watches is never woken. ACC's install adds "
+    + `${rule} to permissions.allow in ${file}, and it is not there: run acc install `
+    + "--adapter antigravity, then restart agy" };
+}
+
+async function ensureRule(context, found, kind, added) {
   if (found.state === "unmatchable" || found.state === "unreadable") {
     return { changes: [], diagnostics: [found.diagnostic], needsAction: [found.diagnostic] };
   }
   if (found.state === "allowed") {
     return { changes: [], diagnostics: [found.diagnostic], needsAction: [] };
   }
-  await addRule(context, found);
+  await addRule(context, found, kind);
   return { changes: [found.file], needsAction: [], diagnostics: [`added ${found.rule} to `
-    + `permissions.allow in ${found.file}: ACC commands run without an approval prompt in `
-    + "Antigravity sessions started from now on; restart agy for a session already open"] };
+    + `permissions.allow in ${found.file}: ${added} without an approval prompt in Antigravity `
+    + "sessions started from now on; restart agy for a session already open"] };
+}
+
+/** Put ACC's rules in place, at every install. */
+export async function ensureAllowRule(context) {
+  const cli = await ensureRule(context, await inspectAllowRule(context), "cli",
+    "ACC commands run");
+  // A settings file that does not read is reported once, by the wrapper's rule.
+  const relayFound = await inspectRelayRule(context);
+  const relay = relayFound.state === "unreadable" ? { changes: [], diagnostics: [], needsAction: [] }
+    : await ensureRule(context, relayFound, "relay", "live delivery starts");
+  return { changes: [...new Set([...cli.changes, ...relay.changes])],
+    diagnostics: [...cli.diagnostics, ...relay.diagnostics],
+    needsAction: [...cli.needsAction, ...relay.needsAction] };
 }

package/node_modules/@agents-can-communicate/adapter-antigravity/src/client-process.mjs

@@ -0,0 +1,64 @@
+import path from "node:path";
+
+/**
+ * Which Antigravity product a hook runs under.
+ *
+ * Antigravity CLI runs hooks under `agy`, which the adapter's client command
+ * already names. Antigravity 2.0 - the desktop app - runs the same
+ * `~/.gemini/config/hooks.json` under its language server, with no `agy` at
+ * all, on a version line of its own. Captured on 2.19.1, 2026-10-04:
+ *
+ *   /Applications/Antigravity.app/Contents/Resources/bin/language_server --standalone
+ *     --override_ide_name antigravity --subclient_type hub --override_ide_version 2.19.1 ...
+ *     --https_server_port 0 --csrf_token <uuid> --app_data_dir antigravity ...
+ *
+ * One language server serves every window and conversation of the app. The
+ * IDE's language server has another name, and the CLI keeps its own data in
+ * `antigravity-cli`, so `--standalone` with `--app_data_dir antigravity` names
+ * the desktop app alone.
+ */
+export const DESKTOP_CLIENT = Object.freeze({ certificationName: "antigravity-desktop",
+  displayName: "Antigravity" });
+
+const STABLE = /^\d+\.\d+\.\d+$/;
+
+/** The value of `--name value` or `--name=value` among the words, or null. */
+export function flagValue(words, name) {
+  for (let index = 0; index < words.length; index += 1) {
+    if (words[index] === name) return words[index + 1] ?? null;
+    if (words[index].startsWith(`${name}=`)) return words[index].slice(name.length + 1);
+  }
+  return null;
+}
+
+/**
+ * The desktop language server's command line, split into its executable and
+ * the words after it, or null for any other process. `ps` drops quoting, so the
+ * executable is everything before the first option: the bundle path may hold
+ * spaces, the options never do.
+ */
+export function desktopServer(args) {
+  if (typeof args !== "string") return null;
+  const cut = args.search(/\s--/);
+  if (cut === -1) return null;
+  const executable = args.slice(0, cut);
+  if (path.basename(executable) !== "language_server" || !path.isAbsolute(executable)) return null;
+  const words = args.slice(cut).trim().split(/\s+/);
+  if (!words.includes("--standalone") || flagValue(words, "--app_data_dir") !== "antigravity") return null;
+  const version = flagValue(words, "--override_ide_version");
+  return { executable, words, version: STABLE.test(version ?? "") ? version : null };
+}
+
+/** The adapter's identifyClientProcess: the desktop app, or null for the runner's own match. */
+export function identifyClientProcess(entry) {
+  const server = desktopServer(entry?.args);
+  if (server === null) return null;
+  return { certificationName: DESKTOP_CLIENT.certificationName,
+    ...(server.version === null ? {} : { version: server.version }) };
+}
+
+/** Whether a process's argv is Antigravity CLI itself: `agy`, by path or bare, `.exe` on Windows. */
+export function isAgy(argv) {
+  const program = (argv?.[0] ?? "").split(/[\\/]/).at(-1).replace(/\.exe$/i, "").toLowerCase();
+  return program === "agy";
+}

package/node_modules/@agents-can-communicate/adapter-antigravity/src/desktop-allow-rule.mjs

@@ -0,0 +1,140 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { isShellWord, writeForeignJson } from "@agents-can-communicate/adapter-sdk";
+
+import { accAllowRule, allowingForms, claimPath, cliWrapperPath, readClaim } from "./allow-rule.mjs";
+
+/**
+ * The allow rule for ACC commands in Antigravity 2.0, the desktop app.
+ *
+ * The desktop keeps its own grants: picking "always allow" for ACC's wrapper on
+ * 2.19.1 wrote `command(<wrapper>)` to `~/.gemini/config/config.json` under
+ * `userSettings.globalPermissionGrants.allow`, and the rule ACC writes for
+ * Antigravity CLI in `~/.gemini/antigravity-cli/settings.json` never stopped
+ * the desktop from asking. The desktop creates config.json at its first
+ * launch, so a machine without the file has no desktop to allow anything for,
+ * and ACC does not create it.
+ */
+export const desktopConfigPath = home => path.join(home, ".gemini", "config", "config.json");
+
+const isObject = value => value !== null && typeof value === "object" && !Array.isArray(value);
+const none = { changes: [], diagnostics: [], needsAction: [] };
+
+async function readConfig(file) {
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return { state: "missing" };
+    return { state: "unreadable", reason: `could not be read (${error.code ?? error.message})` };
+  }
+  let value;
+  try {
+    value = JSON.parse(text.replace(/^/, ""));
+  } catch {
+    return { state: "unreadable", reason: "is not valid JSON" };
+  }
+  if (!isObject(value)) return { state: "unreadable", reason: "does not hold a JSON object" };
+  const settings = value.userSettings;
+  if (settings !== undefined && !isObject(settings)) {
+    return { state: "unreadable", reason: "has a userSettings value that is not an object" };
+  }
+  const grants = settings?.globalPermissionGrants;
+  if (grants !== undefined && !isObject(grants)) {
+    return { state: "unreadable", reason: "has a globalPermissionGrants value that is not an object" };
+  }
+  const allow = grants?.allow;
+  if (allow !== undefined && !Array.isArray(allow)) {
+    return { state: "unreadable", reason: "has a globalPermissionGrants.allow value that is not a list" };
+  }
+  return { state: "read", value, allow: allow ?? [] };
+}
+
+/** What the desktop rule's state is on this machine, in words doctor can print. */
+export async function inspectDesktopRule(context) {
+  const file = desktopConfigPath(context.home);
+  const hostPlatform = context.hostPlatform ?? process.platform;
+  const wrapper = cliWrapperPath(context.home, hostPlatform);
+  const rule = accAllowRule(wrapper);
+  const base = { file, wrapper, rule, owned: false };
+  if (hostPlatform === "win32" || !isShellWord(wrapper)) {
+    return { ...base, state: "unmatchable", diagnostic: "Antigravity (the desktop app) asks before "
+      + "each ACC command: no allow rule can name ACC's wrapper here" };
+  }
+  const config = await readConfig(file);
+  if (config.state === "missing") return { ...base, state: "absent", diagnostic: null };
+  if (config.state === "unreadable") {
+    return { ...base, state: "unreadable", diagnostic: `${file} ${config.reason}, so ACC leaves it `
+      + "as it is, and Antigravity (the desktop app) asks before each ACC command. Repair the "
+      + `file, then run acc install --adapter antigravity to add ${rule}` };
+  }
+  const matched = config.allow.find(entry => allowingForms(wrapper).includes(entry));
+  if (matched !== undefined) {
+    const owned = (await readClaim(claimPath(context, file, "desktop")))?.rule === matched;
+    return { ...base, state: "allowed", owned, diagnostic: "ACC commands run without an approval "
+      + `prompt in Antigravity (the desktop app): ${file} allows ${matched}`
+      + `${owned ? ", added by ACC" : ""}` };
+  }
+  return { ...base, state: "prompts", diagnostic: "Antigravity (the desktop app) asks before each "
+    + `ACC command: ${file} does not allow ${rule}. Run acc install --adapter antigravity` };
+}
+
+/** Add the rule where the desktop keeps its grants, when the desktop is there. */
+export async function ensureDesktopRule(context) {
+  const found = await inspectDesktopRule(context);
+  if (found.state === "absent") return none;
+  if (found.state === "unmatchable" || found.state === "unreadable") {
+    return { changes: [], diagnostics: [found.diagnostic], needsAction: [found.diagnostic] };
+  }
+  if (found.state === "allowed") return { ...none, diagnostics: [found.diagnostic] };
+  const config = await readConfig(found.file);
+  const settings = config.value.userSettings;
+  const grants = settings?.globalPermissionGrants;
+  const created = { userSettings: settings === undefined, grants: grants === undefined,
+    allow: grants?.allow === undefined };
+  const claimFile = claimPath(context, found.file, "desktop");
+  // The claim first, as for the CLI rule: a crash between the two leaves a claim
+  // with no rule, which uninstall drops, never a rule nobody can tell is ACC's.
+  await mkdir(path.dirname(claimFile), { recursive: true });
+  await writeFile(claimFile, `${JSON.stringify({ file: found.file, rule: found.rule, created })}\n`);
+  await writeForeignJson(found.file, { ...config.value, userSettings: { ...settings,
+    globalPermissionGrants: { ...grants, allow: [...config.allow, found.rule] } } },
+  { readFile, writeFile, mkdir });
+  return { changes: [found.file], needsAction: [], diagnostics: [`added ${found.rule} to `
+    + `${found.file}: ACC commands run without an approval prompt in Antigravity (the desktop `
+    + "app); restart the app if it is open"] };
+}
+
+/** Take back exactly what ACC recorded adding, and containers it created if empty. */
+export async function withdrawDesktopRule(context) {
+  const file = desktopConfigPath(context.home);
+  const claimFile = claimPath(context, file, "desktop");
+  const claim = await readClaim(claimFile);
+  if (claim === null) return none;
+  const config = await readConfig(file);
+  if (config.state === "missing") {
+    await rm(claimFile, { force: true });
+    return none;
+  }
+  if (config.state === "unreadable") {
+    return { changes: [], diagnostics: [], needsAction: [`${file} ${config.reason}; ACC left it as `
+      + `it is and still has to remove its ${claim.rule}`] };
+  }
+  if (!config.allow.includes(claim.rule)) {
+    await rm(claimFile, { force: true });
+    return none;
+  }
+  const grants = { ...config.value.userSettings.globalPermissionGrants,
+    allow: config.allow.filter(rule => rule !== claim.rule) };
+  if (claim.created?.allow === true && grants.allow.length === 0) delete grants.allow;
+  const settings = { ...config.value.userSettings, globalPermissionGrants: grants };
+  if (claim.created?.grants === true && Object.keys(grants).length === 0) {
+    delete settings.globalPermissionGrants;
+  }
+  const next = { ...config.value, userSettings: settings };
+  if (claim.created?.userSettings === true && Object.keys(settings).length === 0) delete next.userSettings;
+  await writeForeignJson(file, next, { readFile, writeFile, mkdir });
+  await rm(claimFile, { force: true });
+  return { changes: [file], diagnostics: [`removed ACC's ${claim.rule} from ${file}`], needsAction: [] };
+}