cdx-manager 0.25.8 → 0.25.9

package/src/run_usage.py

@@ -10,6 +10,10 @@ definitions without saying so.
 
 The definitions below are therefore normative, not a suggestion:
 
+  Antigravity exception: the native input/cache/thinking relationship is not
+  established by the measured CLI output. Preserve its counters and reported
+  total rather than inventing a subset relationship or recomputing that total.
+
   input_tokens          Uncached input only. Claude reports it this way
                         natively; Codex does not, so its cache-inclusive count
                         is reduced here rather than left for a reader to guess.
@@ -64,9 +68,9 @@ TOKEN_USAGE_KEYS = (
     "total_tokens",
 )
 USAGE_KEYS = (*TOKEN_USAGE_KEYS, "cache_hit_ratio")
-#: Derived values are never read from a provider.
+#: Derived values are never read from a provider, except Antigravity's native total.
 DERIVED_USAGE_KEYS = ("cached_input_tokens", "total_tokens", "cache_hit_ratio")
-SUPPORTED_PROVIDERS = {"claude", "codex"}
+SUPPORTED_PROVIDERS = {"claude", "codex", "ollama", "antigravity"}
 
 
 def empty_usage():
@@ -456,6 +460,8 @@ def coerce_usage(usage, provider=None):
         reasoning_tokens=usage.get("reasoning_tokens"),
         cache_creation_1h_tokens=usage.get("cache_creation_1h_tokens"),
     )
+    if provider == "antigravity":
+        record["total_tokens"] = _first_int(usage.get("total_tokens"))
     if record["cached_input_tokens"] is None:
         # A legacy record carrying only the fused figure: keep it visible rather
         # than dropping a number someone already recorded, but leave the split
@@ -635,10 +641,25 @@ def _usage_from_dict(value, provider=None):
     tokens. The fix is not arithmetic in this function: it is that the split
     parts go to `normalize_usage`, which owns every derived figure.
     """
+    if provider == "ollama":
+        prompt = _first_int(value.get("prompt_eval_count"))
+        output = _first_int(value.get("eval_count"))
+        return {**normalize_usage(input_tokens=prompt, output_tokens=output),
+                "prompt_eval_count": prompt, "eval_count": output}
     usage = value.get("usage") if isinstance(value.get("usage"), dict) else value
     if not isinstance(usage, dict):
         return empty_usage()
 
+    if provider == "antigravity":
+        # agy reports thinking separately. Without a documented cache subset
+        # relationship, retain its input count and its measured total verbatim.
+        record = normalize_usage(
+            input_tokens=usage.get("input_tokens"), output_tokens=usage.get("output_tokens"),
+            cache_read_tokens=usage.get("cache_read_tokens"), reasoning_tokens=usage.get("thinking_tokens"),
+        )
+        record["total_tokens"] = _first_int(usage.get("total_tokens"))
+        return record
+
     cache_creation = _first_int(usage.get("cache_creation_input_tokens"))
     if cache_creation is None:
         cache_creation = _first_int(usage.get("cache_write_input_tokens"))
@@ -720,3 +741,43 @@ def _int_value(*values):
 
 def _has_usage(usage):
     return isinstance(usage, dict) and any(usage.get(key) is not None for key in USAGE_KEYS)
+
+
+def antigravity_outcome(info):
+    """Fail closed on missing completion, authentication errors and refused tools."""
+    if info.get("timed_out") or info.get("budget_exceeded"):
+        return info
+    try:
+        with open(info["stdout_path"], encoding="utf-8") as handle:
+            records = _parse_json_records(handle.read())
+        with open(info["stderr_path"], encoding="utf-8") as handle:
+            error_text = handle.read().lower()
+    except OSError:
+        records, error_text = [], ""
+    def objects(value):
+        if isinstance(value, dict):
+            yield value
+            for child in value.values():
+                yield from objects(child)
+        elif isinstance(value, list):
+            for child in value:
+                yield from objects(child)
+
+    statuses = [record.get("status") for record in records if isinstance(record, dict) and "status" in record]
+    errors = [record.get("error") for record in objects(records) if record.get("error")]
+    text = json.dumps(errors if statuses and statuses[-1] == "SUCCESS" else records).lower() + error_text
+    expired = any(word in text for word in ("invalid_grant", "unauthenticated", "session expired", "token expired",
+                                          "login required", "sign in", "not authenticated", "authentication required"))
+    refused = any(record.get(key) for record in objects(records)
+                  for key in ("permission_denials", "refused_actions", "denied_actions"))
+    refused = refused or any(str(record.get("status", "")).upper() in ("REFUSED", "DENIED", "PERMISSION_DENIED")
+                             for record in objects(records))
+    if expired:
+        code, message = "antigravity_session_expired", "Antigravity worker session has expired; sign in again on the worker."
+    elif refused:
+        code, message = "antigravity_action_refused", "Antigravity refused one or more requested actions."
+    elif not statuses or statuses[-1] != "SUCCESS":
+        code, message = "antigravity_status_failed", "Antigravity did not report JSON status SUCCESS."
+    else:
+        return info
+    return {**info, "returncode": info.get("returncode") or 1, "provider_error": code, "provider_message": message}

package/src/session_service.py

@@ -644,6 +644,10 @@ def create_session(base_dir, env, store, name, provider=DEFAULT_PROVIDER):
         _seed_codex_auth_from_global(auth_home, env=env)
     if normalized_provider == PROVIDER_CLAUDE:
         _ensure_claude_attribution_disabled(auth_home)
+    if normalized_provider == "antigravity":
+        from .antigravity_status import install
+
+        install(auth_home)
     now = _local_now_iso()
     session = {
         "name": name,

package/src/session_status.py

@@ -359,6 +359,12 @@ def session_paths(session):
 
 def _status_row_from_session(store, s):
     status = s.get("lastStatus")
+    antigravity = None
+    if s["provider"] == "antigravity":
+        from .antigravity_status import read_status
+
+        antigravity = read_status(s.get("authHome") or s.get("sessionRoot") or "")
+        status = antigravity
     enabled = s.get("enabled", True) is not False
     row_status = status if enabled else None
     runtime = _session_runtime(store, s["name"])
@@ -401,6 +407,13 @@ def _status_row_from_session(store, s):
         "updated_at": _to_local_iso(s.get("lastStatusAt")),
         "last_launched_at": _to_local_iso(s.get("lastLaunchedAt")),
     }
+    if antigravity is not None:
+        row.update({key: antigravity[key] for key in (
+            "quota", "quota_status", "quota_stale", "reading_age_seconds", "plan_tier", "updated_at",
+            "reset_5h_at_iso", "reset_week_at_iso",
+        )})
+        if enabled and antigravity["quota_stale"]:
+            row["status"] = "stale"
     row["runs_out_at_iso"] = _runs_out(row)
     return row
 
@@ -434,6 +447,9 @@ def _resolve_session_status(store, base_dir, env, fetch_codex_status, session,
     cache_only=False,
     status_timeout_seconds=None,):
     current_status = session.get("lastStatus")
+    if session["provider"] == "antigravity":
+        # The local statusLine file is the only Antigravity quota source.
+        return None
     if session.get("enabled", True) is False:
         return current_status
     if cache_only:

package/src/status_view.py

@@ -369,6 +369,7 @@ def _format_status_detail(row, use_color=False):
         f"{_style('Session:', '1', use_color)} {_format_session_name(row)}",
         f"{_style('Provider:', '1', use_color)} {row.get('provider') or 'n/a'}",
         f"{_style('Status:', '1', use_color)} {_style(row.get('status') or ('enabled' if row.get('enabled', True) else 'disabled'), '2' if row.get('enabled', True) is False else '32', use_color)}",
+        *([f"{_style('Plan:', '1', use_color)} {row['plan_tier']}"] if row.get("plan_tier") else []),
         f"{_style('Auth:', '1', use_color)} {_style(auth, auth_color, use_color)}",
         *([f"{_style('Auth type:', '1', use_color)} {_auth_type_label(row)[0]}"] if row.get("auth_type") else []),
         f"{_style('Available:', '1', use_color)} {_style_pct(row.get('available_pct'), use_color)}",

package/src/update_all.py

@@ -241,9 +241,15 @@ def apply_update_all_plan(plan, service, env=None, runner=None, progress=None):
             advanced = (_newer(after, item["version"]) and
                         (not item["latest_version"] or after == item["latest_version"] or _newer(after, item["latest_version"])))
             if not (advanced or (after and after == item["version"] and reports_current)):
-                result["returncode"] = 1
-                result["reason"] = "Update verification failed: installed version did not advance to the expected release and updater did not confirm it is current."
-                result["stderr"] = (result["stderr"] + "\n" + result["reason"]).strip()
+                if item["name"] == PROVIDER_ANTIGRAVITY and not _newer(item["latest_version"], item["version"]):
+                    result["warning"] = {
+                        "code": "update_unverified",
+                        "message": "agy update exited successfully, but currency could not be verified: no expected newer CLI version is known. Status remains unknown.",
+                    }
+                else:
+                    result["returncode"] = 1
+                    result["reason"] = "Update verification failed: installed version did not advance to the expected release and updater did not confirm it is current."
+                    result["stderr"] = (result["stderr"] + "\n" + result["reason"]).strip()
         results.append(result)
         if result["returncode"] == 0 and step.get("id"):
             completed.add(step["id"])

package/src/workspace_sandbox.py

@@ -5,9 +5,12 @@ Provider authentication is the only credential deliberately passed to the provid
 """
 from __future__ import annotations
 
+import ipaddress
 import json
 import os
 import shutil
+import socket
+import stat
 import tempfile
 from contextlib import contextmanager
 from pathlib import Path
@@ -28,7 +31,17 @@ NETWORK_RULES = """table inet mission_egress {
 PUBLIC_RESOLV_CONF = "nameserver 1.1.1.1\nnameserver 9.9.9.9\n"
 
 # Keep the trusted setup outside the agent's filesystem/PID/user namespaces.
-NETWORK_SETUP = """
+CLAUDE_STDIN_EXEC = """
+import json
+import os
+import sys
+token = json.loads(sys.stdin.buffer.readline())
+os.environ["CLAUDE_CODE_OAUTH_TOKEN"] = token
+os.dup2(os.open(os.devnull, os.O_RDONLY), 0)
+os.execv(sys.argv[1], sys.argv[1:])
+"""
+
+NETWORK_SETUP = r"""
 import pathlib
 import subprocess
 import sys
@@ -68,6 +81,61 @@ def private_auth_home(auth):
         yield directory
 
 
+ANTIGRAVITY_TOKEN_PATH = ".gemini/antigravity-cli/antigravity-oauth-token"
+# Candidate endpoints extracted from agy 1.4.12; live acceptance is pending.
+ANTIGRAVITY_DESTINATIONS = ("oauth2.googleapis.com", "cloudcode-pa.googleapis.com",
+                            "daily-cloudcode-pa.googleapis.com")
+
+
+def antigravity_token():
+    path = Path.home() / ANTIGRAVITY_TOKEN_PATH
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        raise RuntimeError("Antigravity worker is not signed in; sign in once on the worker.") from None
+    if (not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid()
+            or stat.S_IMODE(info.st_mode) != 0o600 or not info.st_size
+            or any(parent.is_symlink() for parent in path.parents)):
+        raise RuntimeError("Antigravity worker session file is unsafe; restore an owner-only regular token file.")
+    return path
+
+
+def antigravity_secrets():
+    text = antigravity_token().read_text().strip()
+
+    def values(value):
+        if isinstance(value, dict):
+            return [item for child in value.values() for item in values(child)]
+        if isinstance(value, list):
+            return [item for child in value for item in values(child)]
+        return [value] if isinstance(value, str) and value else []
+
+    try:
+        return [text, *values(json.loads(text))]
+    except ValueError:
+        return [text]
+
+
+@contextmanager
+def antigravity_attempt(parent="/dev/shm"):
+    import fcntl
+
+    location = Path(parent).resolve()
+    mounts = [row.split() for row in Path('/proc/mounts').read_text().splitlines()]
+    enclosing = [row for row in mounts if Path(row[1]) == location or Path(row[1]) in location.parents]
+    if not enclosing or max(enclosing, key=lambda row: len(row[1]))[2] != 'tmpfs':
+        raise RuntimeError('Antigravity attempts require memory-backed storage')
+    token = antigravity_token()
+    # Lock the file itself without modifying it; every cdx attempt uses this inode.
+    with token.open("rb") as lock:
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            raise RuntimeError("Antigravity worker session is busy with another attempt.") from None
+        with tempfile.TemporaryDirectory(prefix="cdx-agy-", dir=parent) as directory:
+            yield directory
+
+
 def clean_env(source: dict) -> dict:
     allowed = ("PATH", "LANG", "LC_ALL", "TERM", "TZ")
     env = {key: source[key] for key in allowed if key in source}
@@ -85,7 +153,7 @@ def clean_env(source: dict) -> dict:
 
 
 def sandbox_command(command: list[str], tree: Path, *, network: bool, writable: bool = True,
-                    source: dict | None = None, auth_home: str = "", provider: str = "", observation_home: str = "") -> tuple[list[str], dict]:
+                    source: dict | None = None, auth_home: str = "", provider: str = "", observation_home: str = "", ollama_relay: str = "", claude_token_stdin: bool = False) -> tuple[list[str], dict]:
     source = os.environ if source is None else source
     env = clean_env(source)
     binary = shutil.which(command[0], path=env["PATH"])
@@ -98,7 +166,7 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
     CACHE.mkdir(parents=True, exist_ok=True)
     (CACHE / "rtk").mkdir(exist_ok=True)
     # Provider transport uses the same restricted egress, even for read-only tools.
-    online = bool(network or provider)
+    online = bool(network or (provider and provider != "ollama"))
     if online:
         pasta = shutil.which("pasta", path=source.get("PATH"))
         nft = shutil.which("nft", path=os.defpath + ":/usr/sbin:/sbin")
@@ -112,6 +180,10 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
              if online else ["--unshare-all"])
     args += ["--cap-drop", "ALL"]
     args += ["--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--dir", "/home/agent"]
+    if (provider == "claude" and claude_token_stdin) or provider == "antigravity":
+        if not observation_home:
+            raise RuntimeError("Provider requires a volatile attempt home")
+        args += ["--bind", observation_home, "/home/agent"]
     # An allowlist avoids overlooking another secret file or a credential symlink.
     paths = [Path(p) for p in ("/usr", "/bin", "/sbin", "/lib", "/lib64")]
     home = Path.home()
@@ -170,15 +242,63 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
         args += ["--ro-bind", str(Path(auth_home) / "auth.json"), "/home/agent/.codex/auth.json"]
     elif provider == "claude":
         token = source.get("CLAUDE_CODE_OAUTH_TOKEN")
-        if not token:
+        if not token and not claude_token_stdin:
             raise RuntimeError("Isolated Claude runs require a cdx OAuth setup token")
-        env.update(CLAUDE_CODE_OAUTH_TOKEN=token, CLAUDE_CODE_SUBPROCESS_ENV_SCRUB="1",
+        if claude_token_stdin:
+            env["XDG_CACHE_HOME"] = "/home/agent/.cache"
+            python = shutil.which("python3", path=os.defpath)
+            if not python:
+                raise RuntimeError("Remote Claude requires Python 3")
+            command = [python, "-I", "-c", CLAUDE_STDIN_EXEC, binary, *command[1:]]
+            binary = python
+        else:
+            env["CLAUDE_CODE_OAUTH_TOKEN"] = token
+        env.update(CLAUDE_CODE_SUBPROCESS_ENV_SCRUB="1",
                    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1")
+    elif provider == "antigravity":
+        token = antigravity_token()
+        args += ["--ro-bind", str(token), "/home/agent/" + ANTIGRAVITY_TOKEN_PATH]
+        env["AGY_CLI_DISABLE_AUTO_UPDATE"] = "true"
+        env["XDG_CACHE_HOME"] = "/home/agent/.cache"
+    elif provider == "ollama":
+        if not ollama_relay:
+            raise RuntimeError("Isolated Ollama requires a supervisor-owned relay")
+        args += ["--ro-bind", ollama_relay, "/run/cdx-ollama"]
     elif provider:
         raise RuntimeError("Unsupported isolated provider: " + provider)
     args += ["--chdir", str(tree), "--", binary, *command[1:]]
     if online:
-        setup = "RULES = " + repr(NETWORK_RULES) + "\nRESOLVER = " + repr(PUBLIC_RESOLV_CONF) + "\n" + NETWORK_SETUP
+        rules = NETWORK_RULES
+        if provider == "claude" and claude_token_stdin and not network:
+            # Resolve on the trusted worker before pasta replaces the DNS namespace.
+            addresses = {entry[4][0] for entry in socket.getaddrinfo("api.anthropic.com", 443, type=socket.SOCK_STREAM)}
+            inference = []
+            for family, values in (("ip", sorted(address for address in addresses if ":" not in address)),
+                                   ("ip6", sorted(address for address in addresses if ":" in address))):
+                if values:
+                    inference.append(f"        {family} daddr {{ {', '.join(values)} }} tcp dport 443 accept")
+            if not inference:
+                raise RuntimeError("No Anthropic inference addresses")
+            rules = rules.replace("policy accept", "policy drop").replace(
+                "        oif", "        ct state established,related accept\n        oif")
+            rules = rules.replace("    }\n}", "        ip daddr { 1.1.1.1, 9.9.9.9 } udp dport 53 accept\n"
+                                  "        ip daddr { 1.1.1.1, 9.9.9.9 } tcp dport 53 accept\n"
+                                  + "\n".join(inference) + "\n    }\n}")
+        if provider == "antigravity":
+            addresses = {entry[4][0] for host in ANTIGRAVITY_DESTINATIONS
+                         for entry in socket.getaddrinfo(host, 443, type=socket.SOCK_STREAM)}
+            if not addresses or any(not ipaddress.ip_address(address).is_global for address in addresses):
+                raise RuntimeError("Antigravity destinations must resolve to public addresses")
+            rules = NETWORK_RULES.replace("policy accept", "policy drop")
+            inference = []
+            for family in ("ip", "ip6"):
+                values = sorted(a for a in addresses if (":" in a) == (family == "ip6"))
+                if values:
+                    inference.append(f"        {family} daddr {{ {', '.join(values)} }} tcp dport 443 accept")
+            rules = rules.replace("    }\n}", "        ip daddr { 1.1.1.1, 9.9.9.9 } udp dport 53 accept\n"
+                                  "        ip daddr { 1.1.1.1, 9.9.9.9 } tcp dport 53 accept\n"
+                                  + "\n".join(inference) + "\n    }\n}")
+        setup = "RULES = " + repr(rules) + "\nRESOLVER = " + repr(PUBLIC_RESOLV_CONF) + "\n" + NETWORK_SETUP
         # Disable both directions explicitly: automatic host-loopback splicing
         # bypasses output filtering unless -T/-U are also disabled.
         args = [pasta, "--config-net", "--no-map-gw", "-t", "none", "-u", "none",