dsh-antigravity-auth 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-08-25
+
+- Fixed Windows reads of auth, capability-gate, and controlled live-image records by applying `0700`/`0600` mode rejection only on POSIX while retaining symlink, file-type, size, schema, and content validation on every platform.
+- Raised the minimum and tested DSH package baseline to `0.1.1-rc.2` and regenerated one coherent rc.2 dependency graph.
+- Confirmed that rc.2's additive LLM preparation and normalized request-image pipeline preserve the plugin's public seams; Antigravity keeps its private transport and existing `AttachmentStore.readImage()` path rather than adopting DeepSeek Files API behavior.
+
+## [0.1.0] - 2026-08-22
+
 - Removed callback-URL submission from browser RPC, added closed value-free RPC error validation, and made every settings action abort with component lifetime.
 - Replaced private-endpoint `fetch` dispatch with a plugin-owned TLS/raw HTTP/1.1 serializer that fixes ordered audited `agy` framing and mandatory truthful DSH secondary attribution.
 - Added credential-lineage-fenced, value-free Gate 0/L/S/I/V and independent atomically persisted Gemini/Claude/GPT-OSS outcomes; Auth/LLM is derived directly from all three rather than a separately writable aggregate pass.
@@ -17,9 +25,6 @@
 - Added distinct safe project discovery states for unavailable, authentication, forbidden, rate-limited, offline, malformed, and protocol-drift outcomes; no onboarding or fallback project is attempted.
 - Raised the minimum and tested DSH package baseline to `0.1.1-rc.1`, regenerated a coherent rc.1 lockfile, and added peer-graph verification before the full offline check.
 - Confirmed that the rc.1 credentials/authorization, session-projection, client boot, and sandbox changes require no current Antigravity behavior migration; plugin-owned auth and Wire Identity modules remain unchanged.
-
-## [0.1.0]
-
 - Added the offline-verifiable Host-only single-account PKCE S256 login path with a strict loopback callback listener.
 - Added one-shot state expiry/cancellation, fixed-port conflict handling, remote callback URL submission, and safe value-free login status RPC results.
 - Added injected project validation and versioned owner-only atomic persistence; access tokens remain Host memory and failed validation preserves the existing account.

package/README.md

@@ -5,7 +5,7 @@
 
 English | [中文](README.zh.md)
 
-Current release: **v0.1.0**
+Current release: **v0.1.1**
 
 A self-contained [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
 **Antigravity Capability Bundle**. It integrates Antigravity's private OAuth session
@@ -30,7 +30,7 @@ and Wire Identity for:
 - Uses one Host-only auth coordinator for LLM, Search, Image, Video, and Quota operations.
 - Direct OAuth 2.0 with PKCE S256: Host memory generates verifier and state handle; the browser receives only the authorization URL.
 - The callback listener binds only `127.0.0.1:51121`, accepting only the registered one-shot code/state pair.
-- Resolves credentials through versioned owner-only storage (`0600`), short-lived in-memory cache, and proactive refresh before expiry.
+- Resolves credentials through versioned owner-only storage (POSIX `0600`; Windows user-data ACLs), short-lived in-memory cache, and proactive refresh before expiry.
 - Coalesces concurrent refreshes in-process and enforces account/lineage consistency before persisting refreshed tokens.
 - Shows connection state plus real-time visual progress bars for 5-hour and weekly quotas across Gemini and Claude/GPT model families.
 - Sends no token value over the loopback-only `/antigravity-auth` Connection RPC channel.
@@ -68,7 +68,7 @@ Multimodal `analyze_video` tool accepts workspace MP4 videos, performing bounded
 
 ## Requirements
 
-- DeepSeek Harness `0.1.1-rc.1` or a compatible later `0.1.x` release.
+- DeepSeek Harness `0.1.1-rc.2` or a compatible later `0.1.x` release.
 - Node.js `^22.19.0` or `>=24.0.0`.
 - A Google account with Antigravity access.
 
@@ -99,7 +99,7 @@ git clone https://github.com/suntianc/dsh-antigravity-auth.git
 cd dsh-antigravity-auth
 pnpm install
 pnpm pack
-dsh plugin --profile web add ./dsh-antigravity-auth-0.1.0.tgz
+dsh plugin --profile web add ./dsh-antigravity-auth-0.1.1.tgz
 ```
 
 ## Upgrade
@@ -107,7 +107,7 @@ dsh plugin --profile web add ./dsh-antigravity-auth-0.1.0.tgz
 Stop the running `dsh web` process and update the Web profile:
 
 ```sh
-dsh plugin --profile web add dsh-antigravity-auth@0.1.0
+dsh plugin --profile web add dsh-antigravity-auth@0.1.1
 dsh plugin --profile web list
 ```
 
@@ -138,6 +138,7 @@ Requests are code-owned: only fixed HTTPS Antigravity origins and enumerated `v1
 ## Security and limitations
 
 - Token values never enter the browser, settings, logs, session events, or tool metadata. Only Host-side requests receive authorization headers.
+- POSIX owner-only modes are enforced for auth, gate-evidence, and controlled live-image files. Windows access is governed by ACLs, so synthetic POSIX group/other bits are not treated as an access decision; symlink, file-type, size, schema, and content checks remain enforced.
 - Single-account only: no account arrays, switching, rotation, quota pools, or identity fallback.
 - Local logout clears local storage and in-memory caches immediately.
 - The status/login RPC channel is restricted to loopback authorities.

package/README.zh.md

@@ -5,7 +5,7 @@
 
 [English](README.md) | 中文
 
-当前版本：**v0.1.0**
+当前版本：**v0.1.1**
 
 这是一个自包含的 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
 **Antigravity 能力包**。它集成了 Antigravity 的私有 OAuth 登录态与 Wire Identity 线路身份，提供：
@@ -27,7 +27,7 @@
 - LLM、搜索、图片、视频与配额操作共用一个仅运行于 Host 的认证协调器。
 - 直连 OAuth 2.0 PKCE S256 流程：Host 内存生成 verifier 与 state 句柄，浏览器仅接收授权链接，密钥绝不跨越 Host 边界。
 - 回调监听器仅绑定 `127.0.0.1:51121`，只接受一次性的已注册 code/state 凭据对。
-- 通过属主权限文件存储（`0600`）、短时内存缓存解析凭证，并在到期前主动刷新。
+- 通过属主权限文件存储（POSIX `0600`；Windows 用户数据目录 ACL）、短时内存缓存解析凭证，并在到期前主动刷新。
 - 进程内合并并发刷新请求；仅在账号与 lineage 未变化时原子提交新 token。
 - 仪表盘实时显示连接状态以及 Gemini 与 Claude/GPT 模型家族的 5 小时和每周额度进度条。
 - 插件自有、仅允许 loopback 的 `/antigravity-auth` Connection RPC 绝不向前端泄露任何 token 敏感值。
@@ -62,7 +62,7 @@
 
 ## 环境要求
 
-- DeepSeek Harness `0.1.1-rc.1` 或兼容的后续 `0.1.x` 版本。
+- DeepSeek Harness `0.1.1-rc.2` 或兼容的后续 `0.1.x` 版本。
 - Node.js `^22.19.0` 或 `>=24.0.0`。
 - 具有 Antigravity 权限的 Google 账号。
 
@@ -91,7 +91,7 @@ git clone https://github.com/suntianc/dsh-antigravity-auth.git
 cd dsh-antigravity-auth
 pnpm install
 pnpm pack
-dsh plugin --profile web add ./dsh-antigravity-auth-0.1.0.tgz
+dsh plugin --profile web add ./dsh-antigravity-auth-0.1.1.tgz
 ```
 
 ## 升级
@@ -99,7 +99,7 @@ dsh plugin --profile web add ./dsh-antigravity-auth-0.1.0.tgz
 先停止正在运行的 `dsh web`，再将 Web Profile 更新到当前版本：
 
 ```sh
-dsh plugin --profile web add dsh-antigravity-auth@0.1.0
+dsh plugin --profile web add dsh-antigravity-auth@0.1.1
 dsh plugin --profile web list
 ```
 
@@ -129,6 +129,7 @@ X-DeepSeek-Harness-Attribution: deepseek-harness/<version> (+repository-url)
 ## 安全与限制
 
 - token 值绝不进入前端、设置、日志、会话事件或工具 metadata，仅在 Host 侧发起私有请求时附带认证 header。
+- auth、gate evidence 与受控 live image 文件在 POSIX 上严格校验属主 mode；Windows 由 ACL 管理访问权限，因此不把合成的 POSIX group/other bits 作为访问判据，但仍执行 symlink、文件类型、大小、schema 与内容校验。
 - 严格单账号模式：不提供账号池、轮换、身份回退或账号切换。
 - 本地登出立即清除 Host 内存与本地存储。
 - RPC 状态与登录通道仅限本机 loopback 访问。

package/lib/{capability-lifecycle--tgGKajs.js → capability-lifecycle-BjW2Jho1.js}

@@ -33,16 +33,18 @@ function defaultAuthStorePath(env = process.env, home = env.HOME, platform = pro
 /** Create one store whose public API never exposes an access token field. */
 function createAuthStore(path, options = {}) {
 	const now = options.now ?? (() => Date.now());
+	const platform = options.platform ?? process.platform;
 	const enqueue = createMutationQueue();
+	const read = () => readAuthRecordForPlatform(path, platform);
 	return {
-		read: () => readAuthRecord(path),
+		read,
 		commit: (draft) => enqueue(() => withStoreLock(path, async () => {
-			const record = makeRecord(draft, ((await readAuthRecord(path))?.revision ?? 0) + 1, now());
+			const record = makeRecord(draft, ((await read())?.revision ?? 0) + 1, now());
 			await writeAuthRecord(path, record);
 			return record;
 		})),
 		compareAndCommit: (expectedRevision, draft, expectedLineage) => enqueue(() => withStoreLock(path, async () => {
-			const current = await readAuthRecord(path);
+			const current = await read();
 			if ((current?.revision ?? 0) !== expectedRevision) return void 0;
 			const lineage = expectedLineage ?? draft.lineage;
 			if (lineage === void 0 ? current?.lineage !== void 0 : current?.lineage !== lineage) return void 0;
@@ -51,7 +53,7 @@ function createAuthStore(path, options = {}) {
 			return record;
 		})),
 		clearIfCurrent: (expectedRevision, expectedLineage) => enqueue(() => withStoreLock(path, async () => {
-			const current = await readAuthRecord(path);
+			const current = await read();
 			if ((current?.revision ?? 0) !== expectedRevision) return false;
 			if (expectedLineage === void 0 ? current?.lineage !== void 0 : current?.lineage !== expectedLineage) return false;
 			try {
@@ -138,7 +140,7 @@ async function removeStaleLock(path) {
 		if (!isNotFound(error)) return;
 	}
 }
-async function readAuthRecord(path) {
+async function readAuthRecordForPlatform(path, platform) {
 	let fileInfo;
 	try {
 		fileInfo = await lstat(path);
@@ -147,7 +149,7 @@ async function readAuthRecord(path) {
 		throw storeIoError();
 	}
 	if (fileInfo.isSymbolicLink() || !fileInfo.isFile()) throw unsafePermissionsError();
-	await assertOwnerOnly(path);
+	await assertOwnerOnly(path, platform);
 	let text;
 	try {
 		text = await readFile(path, "utf8");
@@ -239,11 +241,12 @@ function parseRecord(value) {
 		...lineage === void 0 ? {} : { lineage }
 	};
 }
-async function assertOwnerOnly(path) {
+async function assertOwnerOnly(path, platform) {
 	try {
 		const file = await lstat(path);
 		const parent = await lstat(dirname(path));
-		if (file.isSymbolicLink() || parent.isSymbolicLink() || !parent.isDirectory() || (file.mode & 63) !== 0 || (parent.mode & 63) !== 0) throw unsafePermissionsError();
+		const unsafePosixMode = platform !== "win32" && ((file.mode & 63) !== 0 || (parent.mode & 63) !== 0);
+		if (file.isSymbolicLink() || parent.isSymbolicLink() || !parent.isDirectory() || unsafePosixMode) throw unsafePermissionsError();
 	} catch (error) {
 		if (error instanceof AuthStoreError) throw error;
 		throw storeIoError();
@@ -1418,12 +1421,14 @@ function createMemoryCapabilityGates(initial = {}, now = () => Date.now()) {
 }
 function createFileCapabilityGates(path, options = {}) {
 	const now = options.now ?? (() => Date.now());
+	const platform = options.platform ?? process.platform;
 	let mutation = Promise.resolve();
 	const read = async () => {
 		let text;
 		try {
 			const [file, directory] = await Promise.all([lstat(path), lstat(dirname(path))]);
-			if (file.isSymbolicLink() || !file.isFile() || directory.isSymbolicLink() || !directory.isDirectory() || file.size > MAX_GATE_FILE_BYTES || (file.mode & 63) !== 0 || (directory.mode & 63) !== 0) throw new Error("unsafe gate record");
+			const unsafePosixMode = platform !== "win32" && ((file.mode & 63) !== 0 || (directory.mode & 63) !== 0);
+			if (file.isSymbolicLink() || !file.isFile() || directory.isSymbolicLink() || !directory.isDirectory() || file.size > MAX_GATE_FILE_BYTES || unsafePosixMode) throw new Error("unsafe gate record");
 			text = await readFile(path, "utf8");
 			if (text.length > MAX_GATE_FILE_BYTES) throw new Error("oversized gate record");
 		} catch (error) {

package/lib/image.js

@@ -1,4 +1,4 @@
-import { i as createAntigravityAuthService, n as registerCapabilitySet, t as mountCapabilityLifecycle } from "./capability-lifecycle--tgGKajs.js";
+import { i as createAntigravityAuthService, n as registerCapabilitySet, t as mountCapabilityLifecycle } from "./capability-lifecycle-BjW2Jho1.js";
 import { d as privateStatusError, i as DEFAULT_PRIVATE_RESPONSE_BYTES, l as createPrivateTransport, m as PrivateTransportError, p as readPrivateText } from "./private-transport-urF138qW.js";
 import { ANTIGRAVITY_WIRE_ORIGIN } from "./wire-identity.js";
 import { t as classifyPrivateFailure } from "./private-failure-B9vzUkQ7.js";

package/lib/index.js

@@ -1,4 +1,4 @@
-import { _ as defaultAuthStorePath, a as maskEmail, c as defaultCapabilityGatePath, d as ANTIGRAVITY_TOKEN_ENDPOINT, f as CredentialOperationError, g as credentialErrorMessage, h as createGoogleRevokeTransport, i as createAntigravityAuthService, l as OAuthFlowError, m as createGoogleRefreshTransport, o as createFileCapabilityGates, p as createCredentialCoordinator, r as AntigravityAuthService, s as createMemoryCapabilityGates, t as mountCapabilityLifecycle, u as ANTIGRAVITY_REVOKE_ENDPOINT } from "./capability-lifecycle--tgGKajs.js";
+import { _ as defaultAuthStorePath, a as maskEmail, c as defaultCapabilityGatePath, d as ANTIGRAVITY_TOKEN_ENDPOINT, f as CredentialOperationError, g as credentialErrorMessage, h as createGoogleRevokeTransport, i as createAntigravityAuthService, l as OAuthFlowError, m as createGoogleRefreshTransport, o as createFileCapabilityGates, p as createCredentialCoordinator, r as AntigravityAuthService, s as createMemoryCapabilityGates, t as mountCapabilityLifecycle, u as ANTIGRAVITY_REVOKE_ENDPOINT } from "./capability-lifecycle-BjW2Jho1.js";
 import { a as DEFAULT_PRIVATE_RESPONSE_HEADER_TIMEOUT_MS, c as assertPrivateEndpoint, d as privateStatusError, f as readPrivateBytes, i as DEFAULT_PRIVATE_RESPONSE_BYTES, l as createPrivateTransport, m as PrivateTransportError, n as DEFAULT_PRIVATE_IDLE_TIMEOUT_MS, o as DEFAULT_PRIVATE_TOTAL_TIMEOUT_MS, p as readPrivateText, r as DEFAULT_PRIVATE_REQUEST_BYTES, s as MAX_PRIVATE_REQUEST_BYTES, t as DEFAULT_PRIVATE_FRAME_BYTES, u as iteratePrivateSse } from "./private-transport-urF138qW.js";
 import { AGY_PROVIDER_USER_AGENT, ANTIGRAVITY_WIRE_ORIGIN, ANTIGRAVITY_WIRE_ORIGINS, ANTIGRAVITY_WIRE_PATHS, DSH_ATTRIBUTION_HEADER, WireIdentityError, assertWireIdentityInvariant, buildWireIdentityHeaders, createWireIdentity } from "./wire-identity.js";
 import { PROJECT_DISCOVERY_ENDPOINT, PROJECT_DISCOVERY_PATH, ProjectDiscoveryError, createProjectContext, createProjectDiscovery, normalizeProjectId } from "./project-context.js";

package/lib/live-gate-runner.js

@@ -1,5 +1,5 @@
 import { t as isBoundedSafeText } from "./safe-text-AlEyN8q_.js";
-import { _ as defaultAuthStorePath, c as defaultCapabilityGatePath, i as createAntigravityAuthService, o as createFileCapabilityGates } from "./capability-lifecycle--tgGKajs.js";
+import { _ as defaultAuthStorePath, c as defaultCapabilityGatePath, i as createAntigravityAuthService, o as createFileCapabilityGates } from "./capability-lifecycle-BjW2Jho1.js";
 import { ANTIGRAVITY_PROVIDER, AntigravityAdapter } from "./llm-adapter.js";
 import { AntigravitySearchProvider } from "./search.js";
 import { ANTIGRAVITY_IMAGE_MODEL, createAntigravityImageTools } from "./image.js";
@@ -58,7 +58,8 @@ const PNG_SIGNATURE = Uint8Array.from([
 	10
 ]);
 /** Create a persistent, owner-only PNG store for controlled live image fixtures. */
-function createDurableLiveAttachmentStore(root) {
+function createDurableLiveAttachmentStore(root, options = {}) {
+	const platform = options.platform ?? process.platform;
 	const imageLimits = Object.freeze({
 		maxImageBytes: MAX_LIVE_IMAGE_BYTES,
 		maxImagesPerMessage: 2,
@@ -86,7 +87,7 @@ function createDurableLiveAttachmentStore(root) {
 				await link(temporary, target);
 			} catch (error) {
 				if (error.code !== "EEXIST") throw error;
-				const existing = await readBounded(target);
+				const existing = await readBounded(target, platform);
 				if (createHash("sha256").update(existing).digest("hex") !== digest) throw new Error("collision");
 			}
 			await chmod(target, 384);
@@ -111,7 +112,7 @@ function createDurableLiveAttachmentStore(root) {
 		if (!/^[a-f0-9]{64}$/u.test(digest) || ref.mediaType !== "image/png") throw admissionError();
 		let data;
 		try {
-			data = await readBounded(join(root, `${digest}.png`));
+			data = await readBounded(join(root, `${digest}.png`), platform);
 		} catch {
 			throw admissionError();
 		}
@@ -224,9 +225,10 @@ async function ensureRoot(root) {
 		throw admissionError();
 	}
 }
-async function readBounded(path) {
+async function readBounded(path, platform) {
 	const info = await lstat(path);
-	if (info.isSymbolicLink() || !info.isFile() || info.size < 1 || info.size > MAX_LIVE_IMAGE_BYTES || (info.mode & 63) !== 0) throw admissionError();
+	const unsafePosixMode = platform !== "win32" && (info.mode & 63) !== 0;
+	if (info.isSymbolicLink() || !info.isFile() || info.size < 1 || info.size > MAX_LIVE_IMAGE_BYTES || unsafePosixMode) throw admissionError();
 	const data = await readFile(path);
 	if (data.byteLength !== info.size) throw admissionError();
 	return data;

package/lib/search.js

@@ -1,4 +1,4 @@
-import { i as createAntigravityAuthService, t as mountCapabilityLifecycle } from "./capability-lifecycle--tgGKajs.js";
+import { i as createAntigravityAuthService, t as mountCapabilityLifecycle } from "./capability-lifecycle-BjW2Jho1.js";
 import { d as privateStatusError, l as createPrivateTransport, m as PrivateTransportError, n as DEFAULT_PRIVATE_IDLE_TIMEOUT_MS, o as DEFAULT_PRIVATE_TOTAL_TIMEOUT_MS, t as DEFAULT_PRIVATE_FRAME_BYTES, u as iteratePrivateSse } from "./private-transport-urF138qW.js";
 import { ANTIGRAVITY_WIRE_ORIGIN } from "./wire-identity.js";
 import { t as classifyPrivateFailure } from "./private-failure-B9vzUkQ7.js";

package/lib/types/auth-store.d.ts

@@ -19,6 +19,8 @@ export interface AntigravityAuthRecord {
 }
 export interface AuthStoreOptions {
     readonly now?: () => number;
+    /** Override process.platform only for deterministic cross-platform tests. */
+    readonly platform?: NodeJS.Platform;
 }
 export interface AntigravityAuthStore {
     read(): Promise<AntigravityAuthRecord | undefined>;

package/lib/types/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/auth-store.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAOvE,eAAO,MAAM,mBAAmB,EAAG,CAAU,CAAA;AAO7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,IAAI,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC9D,gBAAgB,CACd,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,eAAe,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;IAC7C,6EAA6E;IAC7E,cAAc,CAAC,gBAAgB,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,MAAM,kBAAkB,GAC1B,oBAAoB,GACpB,gCAAgC,GAChC,+BAA+B,GAC/B,qBAAqB,GACrB,eAAe,CAAA;AAEnB,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;gBAErB,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM;CAKtD;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,qBAAW,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAaR;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,oBAAoB,CA0ClG;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,OAAO,GAAE,gBAAqB,GAAG,oBAAoB,CAyB3H;AAyED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAwB7F;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhG;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,qBAAqB,CAEhH"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/auth-store.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAOvE,eAAO,MAAM,mBAAmB,EAAG,CAAU,CAAA;AAO7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,IAAI,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC9D,gBAAgB,CACd,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,eAAe,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;IAC7C,6EAA6E;IAC7E,cAAc,CAAC,gBAAgB,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,MAAM,kBAAkB,GAC1B,oBAAoB,GACpB,gCAAgC,GAChC,+BAA+B,GAC/B,qBAAqB,GACrB,eAAe,CAAA;AAEnB,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;gBAErB,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM;CAKtD;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,qBAAW,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAaR;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,oBAAoB,CA4ClG;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,OAAO,GAAE,gBAAqB,GAAG,oBAAoB,CAyB3H;AAyED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAE7F;AA+BD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhG;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,qBAAqB,CAEhH"}

package/lib/types/capability-gates.d.ts

@@ -10,6 +10,8 @@ export interface CapabilityGateRegistry {
 }
 export interface FileCapabilityGateOptions {
     readonly now?: () => number;
+    /** Override process.platform only for deterministic cross-platform tests. */
+    readonly platform?: NodeJS.Platform;
 }
 /** Resolve a gate record next to the plugin-owned auth record without reading either. */
 export declare function defaultCapabilityGatePath(authStorePath: string): string;

package/lib/types/capability-gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-gates.d.ts","sourceRoot":"","sources":["../../src/capability-gates.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAIjF,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAE1B,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAA;AAMpB,KAAK,qBAAqB,GAAG,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,WAAW,sBAAsB;IACrC,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACvC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC7F,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACtH,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC7H,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,sBAA2B,EACpC,GAAG,GAAE,MAAM,MAAyB,GACnC,sBAAsB,CAoBxB;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,yBAA8B,GACtC,sBAAsB,CAgDxB"}
+{"version":3,"file":"capability-gates.d.ts","sourceRoot":"","sources":["../../src/capability-gates.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAIjF,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAE1B,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAA;AAMpB,KAAK,qBAAqB,GAAG,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,WAAW,sBAAsB;IACrC,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACvC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC7F,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACtH,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC7H,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CACpC;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,sBAA2B,EACpC,GAAG,GAAE,MAAM,MAAyB,GACnC,sBAAsB,CAoBxB;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,yBAA8B,GACtC,sBAAsB,CAiDxB"}

package/lib/types/live-gate-attachments.d.ts

@@ -1,6 +1,10 @@
 /** Durable, content-addressed AttachmentStore seam used only by explicitly run Gate I. */
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 export type DurableLiveAttachmentStore = Pick<AttachmentStore, 'imageLimits' | 'validateImage' | 'saveImage' | 'saveImages' | 'readImage'>;
+export interface DurableLiveAttachmentStoreOptions {
+    /** Override process.platform only for deterministic cross-platform tests. */
+    readonly platform?: NodeJS.Platform;
+}
 /** Create a persistent, owner-only PNG store for controlled live image fixtures. */
-export declare function createDurableLiveAttachmentStore(root: string): DurableLiveAttachmentStore;
+export declare function createDurableLiveAttachmentStore(root: string, options?: DurableLiveAttachmentStoreOptions): DurableLiveAttachmentStore;
 //# sourceMappingURL=live-gate-attachments.d.ts.map

package/lib/types/live-gate-attachments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-gate-attachments.d.ts","sourceRoot":"","sources":["../../src/live-gate-attachments.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAO1F,OAAO,KAAK,EACV,eAAe,EAIhB,MAAM,6BAA6B,CAAA;AAUpC,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,eAAe,EACf,aAAa,GAAG,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAC3E,CAAA;AAED,oFAAoF;AACpF,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAsEzF"}
+{"version":3,"file":"live-gate-attachments.d.ts","sourceRoot":"","sources":["../../src/live-gate-attachments.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAO1F,OAAO,KAAK,EACV,eAAe,EAIhB,MAAM,6BAA6B,CAAA;AAUpC,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,eAAe,EACf,aAAa,GAAG,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAC3E,CAAA;AAED,MAAM,WAAW,iCAAiC;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CACpC;AAED,oFAAoF;AACpF,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,iCAAsC,GAC9C,0BAA0B,CAuE5B"}

package/lib/video.js

@@ -1,4 +1,4 @@
-import { i as createAntigravityAuthService, t as mountCapabilityLifecycle } from "./capability-lifecycle--tgGKajs.js";
+import { i as createAntigravityAuthService, t as mountCapabilityLifecycle } from "./capability-lifecycle-BjW2Jho1.js";
 import { d as privateStatusError, i as DEFAULT_PRIVATE_RESPONSE_BYTES, l as createPrivateTransport, m as PrivateTransportError, p as readPrivateText } from "./private-transport-urF138qW.js";
 import { ANTIGRAVITY_WIRE_ORIGIN } from "./wire-identity.js";
 import { t as classifyPrivateFailure } from "./private-failure-B9vzUkQ7.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-antigravity-auth",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Private, single-account, unofficial Antigravity OAuth capability bundle for DeepSeek Harness",
   "type": "module",
   "engines": {
@@ -119,46 +119,46 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-api-remotes": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-attachment": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-fs": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-session": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-web": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-agent": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-fs": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-web": "^0.1.1-rc.2",
     "@deepseek-ai/schemastery": "^3.18.1",
     "react": "^18.2.0"
   },
   "devDependencies": {
     "@cortexkit/antigravity-auth-core": "2.1.0",
     "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-agent": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-api-remotes": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-attachment": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-fs": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-apiproxy": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.1",
-    "@deepseek-ai/dsh-web": "0.1.1-rc.1",
+    "@deepseek-ai/dsh-agent": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-apiproxy": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-web": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.20.0",