everything-gemini 2.0.0 → 2.2.0

package/hooks/budget-guard/scripts/budget-gate.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Everything Gemini Budget Guard: Hard Spend & Token Cap Gate
+# Intercepts tool execution to prevent runaway API spend in recursive Harness² loops.
+# Reads protojson hook payload from stdin, evaluates spend against ceiling, outputs JSON on stdout.
+
+set -eo pipefail
+
+PAYLOAD=$(cat)
+
+OUTPUT=$(node -e "
+const fs = require('fs');
+const path = require('path');
+
+const maxUsdEnv = process.env.MAX_USD_BUDGET || process.env.BUDGET_CAP_USD;
+const stateFile = process.env.BUDGET_STATE_FILE || path.join(process.cwd(), '.budget_state.json');
+
+let state = { totalSpentUsd: 0.0, totalInvocations: 0, lastCheck: new Date().toISOString() };
+if (fs.existsSync(stateFile)) {
+  try {
+    state = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
+  } catch (_) {}
+}
+
+let costDelta = 0.005; // Base default estimation per tool step (~1500 tokens Gemini 1.5/2.0)
+try {
+  const p = JSON.parse(process.argv[1] || '{}');
+  if (p.tokens) {
+    const promptTokens = p.tokens.prompt || 0;
+    const completionTokens = p.tokens.completion || 0;
+    // Gemini Flash pricing: $0.075 / 1M prompt, $0.30 / 1M completion
+    costDelta = (promptTokens * 0.000000075) + (completionTokens * 0.00000030);
+  }
+} catch (_) {}
+
+state.totalSpentUsd = parseFloat((state.totalSpentUsd + costDelta).toFixed(5));
+state.totalInvocations += 1;
+state.lastCheck = new Date().toISOString();
+
+try {
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+} catch (_) {}
+
+if (maxUsdEnv) {
+  const maxCap = parseFloat(maxUsdEnv);
+  if (!isNaN(maxCap) && state.totalSpentUsd >= maxCap) {
+    console.log(JSON.stringify({
+      decision: 'deny',
+      reason: \`[Budget Guard] Hard spend limit reached: $\${state.totalSpentUsd.toFixed(3)} >= $\${maxCap.toFixed(2)}. Halting recursive harness execution to prevent credit exhaustion.\`
+    }));
+    process.exit(0);
+  }
+}
+
+console.log(JSON.stringify({ decision: 'allow' }));
+" "$PAYLOAD")
+
+echo "$OUTPUT"

package/hooks/human-gate/hooks.json

@@ -0,0 +1,16 @@
+{
+  "human-gate": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command|write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./scripts/human-gate.sh",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  }
+}

package/hooks/human-gate/scripts/human-gate.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# HumanGate: Event-Driven Human-in-the-Loop Interceptor
+# Intercepts speculative mutations to agent harness surfaces (.agents/, rules/, hooks/)
+# and destructive administrative actions, ensuring human oversight before persistence.
+
+set -eo pipefail
+
+PAYLOAD=$(cat)
+
+CHECK_RESULT=$(node -e "
+try {
+  const p = JSON.parse(process.argv[1]);
+  const tool = p.toolCall?.name || '';
+  const args = p.toolCall?.args || {};
+
+  // 1. Inspect file writes and mutations to core agent governance files
+  const targetFile = args.TargetFile || args.path || args.file || '';
+  const sensitivePaths = [
+    'rules/common/GEMINI.md',
+    'rules/common/AGENTS.md',
+    '.agents/rules',
+    'hooks/',
+    'harness.yaml',
+    'harness.json'
+  ];
+
+  for (const s of sensitivePaths) {
+    if (targetFile.includes(s)) {
+      console.log(JSON.stringify({
+        decision: 'ask',
+        reason: '[HumanGate] Structural modification to agent harness surface (' + s + ') requires explicit engineer confirmation.'
+      }));
+      process.exit(0);
+    }
+  }
+
+  // 2. Inspect command-line actions for high-risk operations
+  const cmd = args.CommandLine || '';
+  const highRiskCmds = [
+    'gcloud projects delete',
+    'bq rm',
+    'terraform apply',
+    'kubectl apply',
+    'git push origin main',
+    'git push --force'
+  ];
+
+  for (const r of highRiskCmds) {
+    if (cmd.includes(r)) {
+      console.log(JSON.stringify({
+        decision: 'ask',
+        reason: '[HumanGate] High-impact command execution (' + r + ') requires explicit interactive confirmation.'
+      }));
+      process.exit(0);
+    }
+  }
+
+  // Safe to proceed
+  console.log(JSON.stringify({ decision: 'allow' }));
+} catch (err) {
+  // Graceful fallback to allow if payload parsing fails
+  console.log(JSON.stringify({ decision: 'allow' }));
+}
+" "$PAYLOAD")
+
+echo "$CHECK_RESULT"
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "everything-gemini",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "Everything Gemini (everything-gemini) - The Ultimate Agent Harness, Multi-Agent Orchestrator & Performance Suite for Gemini & Google Antigravity",
   "main": "bin/everything-gemini",
   "bin": {

package/scripts/harness_rollback.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Everything Gemini Harness² Rollback Tool
+# Restores the workspace state from an ephemeral snapshot when a candidate probe fails.
+
+set -eo pipefail
+
+SNAPSHOT_DIR="${1:-.harness_snapshot}"
+
+if [ ! -d "$SNAPSHOT_DIR" ]; then
+  echo "{\"status\": \"error\", \"message\": \"No snapshot directory found at $SNAPSHOT_DIR\"}"
+  exit 0
+fi
+
+# 1. If patch file exists, restore
+if [ -f "$SNAPSHOT_DIR/worktree.patch" ] && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  # Revert changes made during probe
+  git checkout . 2>/dev/null || true
+  if [ -s "$SNAPSHOT_DIR/worktree.patch" ]; then
+    git apply "$SNAPSHOT_DIR/worktree.patch" 2>/dev/null || true
+  fi
+fi
+
+# Clean up snapshot directory
+rm -rf "$SNAPSHOT_DIR"
+
+echo "{\"status\": \"rollback_complete\", \"snapshotDir\": \"$SNAPSHOT_DIR\"}"

package/scripts/harness_snapshot.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Everything Gemini Harness² Snapshot Tool
+# Takes an ephemeral state snapshot of the workspace before running candidate probes.
+
+set -eo pipefail
+
+SNAPSHOT_DIR="${1:-.harness_snapshot}"
+mkdir -p "$SNAPSHOT_DIR"
+
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+# 1. Git-based diff snapshot if in git worktree
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  git diff HEAD > "$SNAPSHOT_DIR/worktree.patch" 2>/dev/null || true
+  git status --porcelain > "$SNAPSHOT_DIR/status.txt" 2>/dev/null || true
+  GIT_HEAD=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
+else
+  GIT_HEAD="non-git"
+fi
+
+cat <<EOF > "$SNAPSHOT_DIR/snapshot_manifest.json"
+{
+  "timestamp": "$TIMESTAMP",
+  "gitHead": "$GIT_HEAD",
+  "snapshotDir": "$SNAPSHOT_DIR",
+  "status": "active"
+}
+EOF
+
+echo "{\"status\": \"snapshot_created\", \"timestamp\": \"$TIMESTAMP\", \"snapshotDir\": \"$SNAPSHOT_DIR\"}"

package/scripts/validate.sh

@@ -149,7 +149,7 @@ if [ -f "$REPO_ROOT/tests/cli.test.js" ]; then
     echo "    ❌ ERROR: CLI test suite failed."
     ERRORS=$((ERRORS + 1))
   else
-    echo "    ✔ CLI test suite passed (31 assertions)"
+    echo "    ✔ CLI test suite passed (33 assertions)"
   fi
 fi
 

package/skills/bigquery-vector-search/SKILL.md

@@ -0,0 +1,205 @@
+---
+name: bigquery-vector-search
+description: Implements Google BigQuery native vector search, VECTOR_SEARCH SQL statements, ML.GENERATE_TEXT_EMBEDDING, IVF indexing, and BigLake hybrid semantic RAG.
+---
+
+# BigQuery Vector Search & Semantic Analytics
+
+Architects, indexes, and queries large-scale vector embeddings directly inside Google BigQuery using native `VECTOR_SEARCH` syntax, Inverted File (IVF) vector indexes, and `ML.GENERATE_TEXT_EMBEDDING` with Gemini models.
+
+---
+
+## 1. Architecture: BigQuery In-Database Vector Analytics
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                            Google Cloud BigQuery                            │
+│                                                                             │
+│   ┌────────────────────┐      ┌──────────────────┐      ┌─────────────────┐ │
+│   │ Structured Records │      │ Unstructured     │      │ BigLake Object  │ │
+│   │ (SQL Tables)       │      │ Text & Metadata  │      │ Tables (GCS)    │ │
+│   └─────────┬──────────┘      └────────┬─────────┘      └────────┬────────┘ │
+│             │                          │                         │          │
+│             └──────────────────┬───────┴─────────────────────────┘          │
+│                                │                                            │
+│                                ▼                                            │
+│            ┌───────────────────────────────────────────────┐                │
+│            │ ML.GENERATE_TEXT_EMBEDDING (Vertex AI Gemini) │                │
+│            │ 768-dim embeddings stored as ARRAY<FLOAT64>   │                │
+│            └───────────────────────┬───────────────────────┘                │
+│                                    │                                        │
+│                                    ▼                                        │
+│            ┌───────────────────────────────────────────────┐                │
+│            │ IVF Vector Index (Inverted File Partitioning) │                │
+│            │ Distance: COSINE / EUCLIDEAN / DOT_PRODUCT    │                │
+│            └───────────────────────┬───────────────────────┘                │
+│                                    │                                        │
+│                                    ▼                                        │
+│            ┌───────────────────────────────────────────────┐                │
+│            │ VECTOR_SEARCH + Post-Filter SQL Join          │                │
+│            │ Sub-second Top-K nearest neighbor retrieval   │                │
+│            └───────────────────────────────────────────────┘                │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. IVF Vector Indexing
+
+BigQuery supports Inverted File Flat (IVF) indexes to partition vector space into Voronoi cells, accelerating approximate nearest neighbor (ANN) retrieval across billions of rows.
+
+```sql
+-- 1. Create native vector index on embedding column
+CREATE VECTOR INDEX IF NOT EXISTS knowledge_vector_idx
+ON `my_project.agent_knowledge.document_chunks`(embedding)
+STORING(chunk_id, doc_id, section_title)
+OPTIONS(
+  index_type = 'IVF',
+  distance_type = 'COSINE',
+  ivf_options = '{"num_lists": 1000}'
+);
+```
+
+- **`num_lists`**: The number of Voronoi partitions (rule of thumb: $\sqrt{N}$ where $N$ is row count).
+- **`distance_type`**: `COSINE` (recommended for normalized embeddings), `EUCLIDEAN`, or `DOT_PRODUCT`.
+- **`STORING`**: Co-locates frequently queried payload attributes in the vector index leaf nodes, eliminating secondary table lookups.
+
+---
+
+## 3. In-Database Embeddings Generation with Gemini
+
+Connect BigQuery directly to Vertex AI Gemini text-embedding models:
+
+```sql
+-- 1. Create connection to Vertex AI Remote Model
+CREATE OR REPLACE MODEL `my_project.agent_knowledge.gemini_embedding_model`
+REMOTE WITH CONNECTION `projects/my_project/locations/us-central1/connections/vertex-ai-conn`
+OPTIONS(
+  endpoint = 'text-embedding-004'
+);
+
+-- 2. Batch generate embeddings for newly inserted document chunks
+INSERT INTO `my_project.agent_knowledge.document_chunks` (chunk_id, doc_id, content, embedding)
+SELECT
+  ml_generate_embedding_result.chunk_id,
+  ml_generate_embedding_result.doc_id,
+  ml_generate_embedding_result.content,
+  ml_generate_embedding_result.text_embedding AS embedding
+FROM ML.GENERATE_TEXT_EMBEDDING(
+  MODEL `my_project.agent_knowledge.gemini_embedding_model`,
+  (
+    SELECT chunk_id, doc_id, content
+    FROM `my_project.agent_knowledge.raw_chunks`
+    WHERE processed_at IS NULL
+  ),
+  STRUCT(
+    'RETRIEVAL_DOCUMENT' AS task_type,
+    768 AS output_dimensionality
+  )
+) AS ml_generate_embedding_result;
+```
+
+---
+
+## 4. Native `VECTOR_SEARCH` Execution
+
+Query embeddings directly with sub-second latency and zero external vector database infrastructure:
+
+```sql
+-- Top-10 semantic search with structured tenant/date pre-filtering
+SELECT
+  base.chunk_id,
+  base.doc_id,
+  base.content,
+  distance
+FROM VECTOR_SEARCH(
+  TABLE `my_project.agent_knowledge.document_chunks`,
+  'embedding',
+  (
+    -- Embed user query dynamically using Gemini
+    SELECT text_embedding AS query_vector
+    FROM ML.GENERATE_TEXT_EMBEDDING(
+      MODEL `my_project.agent_knowledge.gemini_embedding_model`,
+      (SELECT 'What are the spend limit policies for autonomous subagents?' AS content),
+      STRUCT('RETRIEVAL_QUERY' AS task_type, 768 AS output_dimensionality)
+    )
+  ),
+  top_k => 10,
+  distance_type => 'COSINE',
+  options => '{"fraction_lists_to_search": 0.05}'
+);
+```
+
+- **`fraction_lists_to_search`**: Controls recall vs. latency tradeoff (0.01 to 0.20). Higher values increase recall at slightly higher compute cost.
+
+---
+
+## 5. Hybrid Search (Lexical BM25 + Semantic Vector)
+
+Combine BigQuery native search indexes (`SEARCH`) with `VECTOR_SEARCH` using Reciprocal Rank Fusion (RRF):
+
+```sql
+WITH vector_matches AS (
+  SELECT
+    base.chunk_id,
+    base.content,
+    ROW_NUMBER() OVER (ORDER BY distance ASC) AS vector_rank
+  FROM VECTOR_SEARCH(
+    TABLE `my_project.agent_knowledge.document_chunks`,
+    'embedding',
+    (SELECT text_embedding FROM ML.GENERATE_TEXT_EMBEDDING(
+      MODEL `my_project.agent_knowledge.gemini_embedding_model`,
+      (SELECT 'subagent spend guardrails' AS content),
+      STRUCT('RETRIEVAL_QUERY' AS task_type)
+    )),
+    top_k => 50,
+    distance_type => 'COSINE'
+  )
+),
+keyword_matches AS (
+  SELECT
+    chunk_id,
+    content,
+    ROW_NUMBER() OVER () AS keyword_rank
+  FROM `my_project.agent_knowledge.document_chunks`
+  WHERE SEARCH(content, 'guardrail spend budget ceiling')
+  LIMIT 50
+)
+SELECT
+  COALESCE(v.chunk_id, k.chunk_id) AS chunk_id,
+  COALESCE(v.content, k.content) AS content,
+  (
+    COALESCE(1.0 / (60 + v.vector_rank), 0.0) +
+    COALESCE(1.0 / (60 + k.keyword_rank), 0.0)
+  ) AS rrf_score
+FROM vector_matches v
+FULL OUTER JOIN keyword_matches k ON v.chunk_id = k.chunk_id
+ORDER BY rrf_score DESC
+LIMIT 10;
+```
+
+---
+
+## 6. Enterprise Best Practices & Anti-Patterns
+
+| Category | Recommended Pattern | Anti-Pattern |
+| :--- | :--- | :--- |
+| **Index Choice** | Use IVF with `num_lists` scaled to $\sqrt{N}$ for $N > 100,000$ rows | Querying `ARRAY<FLOAT64>` with brute-force `COSINE_DISTANCE()` |
+| **Payload Storage** | Store lightweight metadata with `STORING(...)` inside index | Joining 10 high-cardinality tables after vector search |
+| **Embedding Types** | Specify `RETRIEVAL_DOCUMENT` during indexing, `RETRIEVAL_QUERY` during search | Using default task types causing asymmetric vector drift |
+| **Partitioning** | Partition and cluster base table on tenant ID or ingestion date | Single unpartitioned table forcing full-table vector scans |
+
+---
+
+## 7. CLI Runbook (`bq` CLI)
+
+```bash
+# 1. Create BigQuery dataset for vector embeddings
+bq mk --dataset --location=us-central1 my_project:agent_knowledge
+
+# 2. Check vector index status and coverage
+bq show --format=prettyjson my_project:agent_knowledge.document_chunks | jq '.vectorSearchStatistics'
+
+# 3. Dry-run vector query to estimate bytes scanned
+bq query --use_legacy_sql=false --dry_run < vector_query.sql
+```

package/skills/cloud-run-agents/SKILL.md

@@ -0,0 +1,167 @@
+---
+name: cloud-run-agents
+description: Packages, deploys, and scales autonomous Antigravity and Gemini agents on Google Cloud Run services and Cloud Run Jobs with Eventarc triggers and GPU scheduling.
+---
+
+# Cloud Run Autonomous Agents
+
+Packages, containerizes, and deploys autonomous Google Antigravity & Gemini agents on Google Cloud Run. Covers HTTP agent services, batch-oriented Cloud Run Jobs for recursive Harness² probing, Eventarc event triggers, and NVIDIA L4 GPU acceleration.
+
+---
+
+## 1. Architecture: Cloud Run Agent Execution Models
+
+```
+                                Google Cloud Run
+┌─────────────────────────────────────────────────────────────────────────────┐
+│ 1. CLOUD RUN SERVICE (Interactive / Webhook Agents)                         │
+│    • Real-time Gemini Live WebSocket / HTTP streaming                        │
+│    • Automatic scale-to-zero when idle                                      │
+│    • Up to 60-minute request timeout with WebSockets enabled                │
+├─────────────────────────────────────────────────────────────────────────────┤
+│ 2. CLOUD RUN JOBS (Batch / Recursive Probing Agents)                         │
+│    • Long-running Harness² Propose-Probe-Compose workflows (up to 24 hours) │
+│    • Parallel array task execution for multi-candidate testing              │
+│    • Zero HTTP gateway overhead; triggered via Cloud Scheduler / Workflows │
+├─────────────────────────────────────────────────────────────────────────────┤
+│ 3. CLOUD RUN WITH GPU (NVIDIA L4 / T4)                                      │
+│    • Co-locates agent logic with local verification models (vLLM / Triton)   │
+│    • Direct hardware acceleration for code analysis & AST parsing           │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Agent Container Specification (Dockerfile)
+
+Production multi-stage Dockerfile bundling the agent runtime, Node CLI, and Python SDK:
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM python:3.11-slim AS base
+
+ENV PYTHONUNBUFFERED=1 \
+    DEBIAN_FRONTEND=noninteractive \
+    PORT=8080
+
+WORKDIR /app
+
+# Install system dependencies & Node.js for CLI tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    git \
+    ca-certificates \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install everything-gemini CLI globally
+RUN npm install -g everything-gemini
+
+# Copy Python requirements & install
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy agent definitions and source code
+COPY . .
+
+# Run as non-root user for enterprise container security
+RUN useradd -m -u 10001 agentuser && chown -R agentuser:agentuser /app
+USER 10001
+
+EXPOSE 8080
+ENTRYPOINT ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "8080"]
+```
+
+---
+
+## 3. Cloud Run Service Deployment (`gcloud`)
+
+Deploy an interactive agent service with Workload Identity and automated secret injection:
+
+```bash
+gcloud run deploy antigravity-agent-service \
+  --image="gcr.io/my_project/antigravity-agent:v2.2.0" \
+  --region="us-central1" \
+  --platform="managed" \
+  --service-account="agent-runner@my_project.iam.gserviceaccount.com" \
+  --cpu=4 \
+  --memory=8Gi \
+  --concurrency=10 \
+  --timeout=3600 \
+  --min-instances=0 \
+  --max-instances=20 \
+  --set-env-vars="GEMINI_MODEL=gemini-2.0-flash,MAX_USD_BUDGET=15.00" \
+  --set-secrets="GEMINI_API_KEY=gemini-api-key:latest" \
+  --vpc-egress=private-ranges-only \
+  --ingress=internal-and-cloud-load-balancing
+```
+
+---
+
+## 4. Cloud Run Jobs for Harness² Recursive Probing
+
+When running test-time recursive optimization (Propose-Probe-Compose) that exceeds standard HTTP request limits, package the run into a Cloud Run Job:
+
+```bash
+# 1. Create Cloud Run Job with 3 parallel task instances
+gcloud run jobs create harness2-probe-runner \
+  --image="gcr.io/my_project/harness2-runner:v2.2.0" \
+  --region="us-central1" \
+  --tasks=3 \
+  --max-retries=1 \
+  --task-timeout=7200s \
+  --cpu=8 \
+  --memory=16Gi \
+  --command="everything-gemini" \
+  --args="harness2,run,--bench,local,--max-usd,25,--snapshot,--json"
+
+# 2. Trigger asynchronous execution of the probe job
+gcloud run jobs execute harness2-probe-runner --region="us-central1" --wait
+```
+
+---
+
+## 5. Eventarc Trigger Binding (Event-Driven Agent Workflow)
+
+Automatically invoke agents whenever new code repositories or error traces land in Cloud Storage:
+
+```bash
+gcloud eventarc triggers create trace-ingestion-trigger \
+  --location="us-central1" \
+  --destination-run-service="antigravity-agent-service" \
+  --destination-run-region="us-central1" \
+  --destination-run-path="/webhooks/trace-ingest" \
+  --event-filters="type=google.cloud.storage.object.v1.finalized" \
+  --event-filters="bucket=production-failure-traces" \
+  --service-account="eventarc-invoker@my_project.iam.gserviceaccount.com"
+```
+
+---
+
+## 6. NVIDIA L4 GPU Configuration
+
+Accelerate on-container verification models or local embedding calculations:
+
+```bash
+gcloud beta run deploy local-verifier-agent \
+  --image="gcr.io/my_project/verifier-agent-l4:latest" \
+  --region="us-central1" \
+  --cpu=8 \
+  --memory=32Gi \
+  --gpu=1 \
+  --gpu-type=nvidia-l4 \
+  --no-cpu-throttling \
+  --timeout=1800
+```
+
+---
+
+## 7. Enterprise Production Checklist
+
+| Category | Requirement | Verification Method |
+| :--- | :--- | :--- |
+| **IAM Security** | Dedicated service account with least-privilege Vertex AI roles | `roles/aiplatform.user` only; no Owner/Editor permissions |
+| **Secret Management** | Mount API keys directly from Google Secret Manager | Use `--set-secrets`; never bake keys into Docker layers |
+| **Budget Enforcement** | Enforce `--set-env-vars="MAX_USD_BUDGET=..."` bound to `budget-guard` | Verification in PreToolUse hook |
+| **Graceful Shutdown** | Handle `SIGTERM` within 10s to flush ephemeral logs to Cloud Storage | Python `signal.signal(signal.SIGTERM, handler)` |