gaslamp 2.2.1 → 2.2.2

package/README.md

@@ -288,15 +288,18 @@ threads, `--schema`, fleets — with these differences:
   kernel sandbox (`--sandbox read-only`: Seatbelt on macOS, Landlock on Linux;
   writes only to `~/.grok` and temp dirs). Grok's permission layer is not a
   substitute: headless `--permission-mode default` denied its write tool but
-  ran an arbitrary shell `touch`. Antigravity's print mode soft-denies file
-  writes, shell commands and URL fetches under its default `request-review`
-  preset; standing allow rules in its permission files would run
-  unprompted, so a read-only consult refuses to start when they grant more
-  than reads, read-only git and the end_session off-ramp, or set a lax
-  `toolPermission` or `agentMode: auto` (which approves writes and commands
-  under any preset, unreported), and fails if the
-  harness doesn't confirm the preset in its init event. Like claude's
-  read-only, that is read-capable rather than airtight: an allowed
+  ran an arbitrary shell `touch`. On macOS, a read-only gemini consult runs
+  agy under Seatbelt (`sandbox-exec`): it can write its own state directory
+  (`~/.gemini/antigravity-cli`, minus the files that configure it) and temp
+  dirs, nothing else, whatever Antigravity's permission settings say — so a
+  user can keep `always-proceed` / `agentMode: auto` for interactive work, and
+  search and read-only commands still run. Elsewhere (Linux, or inside a
+  Codex sandbox, where Seatbelt does not nest) the guarantee is Antigravity's
+  `request-review` preset: the consult refuses to start when its permission
+  files grant more than reads, read-only git and the end_session off-ramp, or
+  set a lax `toolPermission` or `agentMode: auto` (which approves writes and
+  commands under any preset, unreported), and fails if init doesn't confirm
+  the preset. That path is read-capable rather than airtight: an allowed
   `git diff` still accepts git's own `--output=<file>`.
   Antigravity has no headless `workspace-write` (`--mode accept-edits` did
   not enable writes in print mode), so that is a usage error there.
@@ -337,6 +340,7 @@ it. This is loop prevention, not a security boundary. Set
 | `GASLAMP_DEBUG` | unset | verbose stderr (spawn argv) |
 | `CLAUDE_BIN` / `CODEX_BIN` / `AGY_BIN` / `GROK_BIN` | autodetected | backend binaries |
 | `GROK_HOME` | `~/.grok` | where grok keeps sessions (the system prompt hash is read from there) |
+| `GASLAMP_GEMINI_SEATBELT` | on (macOS) | `0` runs read-only gemini consults on Antigravity's preset check instead of Seatbelt |
 | `CODEX_HOME` | `~/.codex` | where `setup --skill` puts Codex's copy |
 
 Exit codes: `0` ok · `1` consult failed/killed · `2` usage · `3` nested

package/bin/gaslamp.mjs

@@ -120,6 +120,8 @@ Env knobs:
   GASLAMP_DEBUG            verbose stderr (spawn argv)
   CLAUDE_BIN / CODEX_BIN / AGY_BIN / GROK_BIN
                            backend binaries (autodetected otherwise)
+  GASLAMP_GEMINI_SEATBELT  0 = read-only gemini consults rely on Antigravity's
+                           preset check instead of Seatbelt (macOS default)
 
 Every job record (meta.json) carries provenance: provider, harness version,
 the model the backend reported (or unknown), the vendor system prompt's hash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gaslamp",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Let Claude Code and Codex consult each other from the shell, and consult Gemini and Grok.",
   "type": "module",
   "bin": {

package/src/consult.mjs

@@ -47,6 +47,7 @@ import {
   newJobId, readMeta, renderTrailer, writeMeta,
 } from "./jobs.mjs";
 import { readThread, validThreadName, writeThread } from "./threads.mjs";
+import { readStdin } from "./stdin.mjs";
 
 // Tools permitted under the claude `read-only` override (advisory reviewer).
 // The git reads matter: a reviewer that can't run `git diff`/`git log` is
@@ -81,9 +82,14 @@ const RETRIEVAL_TOOLS = {
   claude: /^(WebSearch|WebFetch)$/,
   codex: /^web_search/,
   gemini: /^(search_web|read_url_content|open_browser_url|read_browser_page|browser_)/,
-  grok: /^(web_search|web_fetch|x_search|x_)/,
+  grok: /^(web_search|web_fetch|x_)/,
 };
 
+// Grok's X search is a backend tool: init never lists it, and a call arrives
+// as a tool_use named "X search:" ({"variant":"XSearch","backend":true}) whose
+// tool_result names the tool that ran (x_keyword_search, x_semantic_search).
+const toolKey = (name) => String(name).toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+
 // Variables a third-party harness has no business inheriting from the calling
 // agent: Claude Code's session id, messaging socket token, account and OAuth
 // details; Codex's and the API keys' equivalents. They reach the consultee's
@@ -113,9 +119,36 @@ function backendEnv(backend) {
   if (backend === "gemini" || backend === "grok")
     for (const k of Object.keys(env)) if (FOREIGN_ENV.test(k)) delete env[k];
   if (backend === "grok") Object.assign(env, GROK_COMPAT_OFF, { GROK_DISABLE_AUTOUPDATER: "1" });
+  if (backend === "gemini") env.AGY_CLI_DISABLE_AUTO_UPDATE = "true";
   return env;
 }
 
+// Read-only for a gemini consult, on macOS: agy runs under Seatbelt, writing
+// nothing but its own state directory and temp — the guarantee no longer
+// depends on Antigravity's permission settings, which a user may keep lax
+// for interactive work (toolPermission always-proceed, agentMode auto) and
+// which no flag overrides per run. Inside that state directory the files
+// that configure agy stay write-denied (later deny rules win in SBPL).
+// (bin/ stays writable: agy extracts a helper, bin/agentapi, before running
+// any shell command, and denying it breaks read-only commands like git diff.)
+// Elsewhere — Linux, or inside a sandbox of Codex's own, where Seatbelt does
+// not nest — the preset check below is the guarantee.
+const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+const useSeatbelt = () => process.platform === "darwin" && existsSync(SANDBOX_EXEC)
+  && !process.env.CODEX_SANDBOX && process.env.GASLAMP_GEMINI_SEATBELT !== "0";
+function agySeatbeltProfile() {
+  const q = (p) => '"' + p.replace(/[\\"]/g, (c) => "\\" + c) + '"';
+  const state = join(homedir(), ".gemini", "antigravity-cli");
+  return [
+    "(version 1)",
+    "(allow default)",
+    "(deny file-write*)",
+    `(allow file-write* (subpath ${q(state)}) (subpath "/private/tmp") (subpath "/private/var/folders") (subpath "/dev"))`,
+    `(deny file-write* ${["settings.json", "keybindings.json"].map((f) => `(literal ${q(join(state, f))})`).join(" ")} ` +
+      `${["rules", "plugins", "skills", "updater"].map((d) => `(subpath ${q(join(state, d))})`).join(" ")})`,
+  ].join("\n");
+}
+
 // What a read-only gemini consult may find pre-allowed in Antigravity's
 // permission files: reads, read-only git (read-capable like the claude read
 // set — git's own --output flags aside), and the end_session off-ramp. Any
@@ -491,12 +524,12 @@ export function runConsult(backend, argv) {
   let prompt = o.prompt;
   if (prompt == null || prompt === "-") {
     if (prompt == null && process.stdin.isTTY) die(2, "no prompt — pass one as an argument or pipe it on stdin");
-    prompt = readFileSync(0, "utf8");
+    prompt = readStdin();
   } else if (!process.stdin.isTTY) {
     // Prompt on argv AND piped stdin: stdin is evidence — the diff, the log,
     // the failing output — appended as a <stdin> block. This is codex exec's
     // own convention for exactly this case, applied uniformly to both backends.
-    const evidence = readFileSync(0, "utf8");
+    const evidence = readStdin();
     if (evidence.trim())
       prompt += "\n\n<stdin>\n" + (evidence.endsWith("\n") ? evidence : evidence + "\n") + "</stdin>";
   }
@@ -522,19 +555,28 @@ export function runConsult(backend, argv) {
   // must not strand either.
   const bin = resolveBin(backend);
   const env = backendEnv(backend);
-  let grants = null;
+  let grants = null, agySettings = null, wrap = null;
+  let enforcement = sandbox === "read-only" ? {
+    claude: "permission-mode default + read allowlist", codex: "codex read-only sandbox",
+    grok: "grok --sandbox read-only (kernel)", gemini: null,
+  }[backend] : null;
   if (backend === "gemini" && sandbox === "read-only") {
     const state = agyPermissionState();
+    grants = state.grants.map((g) => g.rule);
+    agySettings = [...state.presets.map((p) => `toolPermission ${p.preset}`), ...state.modes.map((m) => `agentMode ${m.mode}`)];
     const lax = state.presets.filter((p) => AGY_LAX_PRESETS.has(p.preset));
     const modes = state.modes.filter((m) => AGY_LAX_MODES.has(m.mode));
     const open = state.grants.filter((g) => !AGY_READ_GRANT.test(g.rule));
-    if (lax.length || modes.length || open.length)
+    if (useSeatbelt()) {
+      wrap = [SANDBOX_EXEC, "-p", agySeatbeltProfile()];
+      enforcement = "seatbelt (sandbox-exec)";
+    } else if (lax.length || modes.length || open.length)
       die(1, "Antigravity's settings would let a read-only consult act unprompted — " +
         [...lax.map((p) => `toolPermission "${p.preset}" (${p.file})`),
           ...modes.map((m) => `agentMode "${m.mode}" (${m.file})`),
           ...open.map((g) => `${g.rule} (${g.file})`)].join(", ") +
         ". Remove them, or pass --sandbox danger-full-access to consult without the guarantee.");
-    grants = state.grants.map((g) => g.rule);
+    else enforcement = "agy request-review preset";
   }
   const model = resolveModel(backend, o.model, bin, env);
   const version = harnessVersion(bin, env);
@@ -558,8 +600,8 @@ export function runConsult(backend, argv) {
       // `model` is what the backend reported answering with; unknown until it
       // does (codex never reports one in its event stream).
       model: "unknown", modelRequested: o.model ?? null, modelPassed: model,
-      permissionMode: null, sandbox,
-      ...(grants ? { grants } : {}),
+      permissionMode: null, sandbox, enforcement,
+      ...(grants ? { grants, agySettings } : {}),
       systemPrompt: { known: false },
       retrieval: { available: null, used: [] },
       gaslamp: { version: PKG_VERSION, revision: gaslampRevision() },
@@ -584,10 +626,13 @@ export function runConsult(backend, argv) {
     : backend === "gemini" ? geminiArgs(o, resumeSid, schemaText, model, sandbox)
     : grokArgs(o, resumeSid, schemaText, sandbox);
 
-  log("spawn", bin, JSON.stringify(args));
+  // sandbox-exec applies the profile and execs the harness in place (same
+  // pid), so the group, the signals and the process name are agy's own.
+  const [cmd, argv0] = wrap ? [wrap[0], [...wrap.slice(1), bin, ...args]] : [bin, args];
+  log("spawn", cmd, JSON.stringify(argv0));
   // detached → the child leads its own process group, so signal forwarding can
   // kill the whole tree (backend + whatever it spawned), never just the top.
-  const child = spawn(bin, args, { cwd: meta.cwd, env, stdio: ["pipe", "pipe", "pipe"], detached: true });
+  const child = spawn(cmd, argv0, { cwd: meta.cwd, env, stdio: ["pipe", "pipe", "pipe"], detached: true });
   meta.childPid = child.pid ?? null;
   writeMeta(meta);
   const killGroup = (sig) => {
@@ -680,12 +725,20 @@ export function runConsult(backend, argv) {
       if (j.model) prov.model = j.model;
       prov.permissionMode = j.permissionMode ?? null;
       if (Array.isArray(j.tools)) prov.retrieval.available = j.tools.filter((t) => RETRIEVAL_TOOLS[backend].test(t));
+      // Grok's backend X search is never listed but is there (see toolKey).
+      if (backend === "grok" && prov.retrieval.available) prov.retrieval.available.push("x_search");
       writeMeta(meta);
     } else if (claudeShaped && j.type === "assistant") {
       for (const c of j.message?.content ?? []) {
-        if (c.type === "tool_use" || c.type === "server_tool_use") noteTool(c.name);
+        if (c.type === "tool_use" || c.type === "server_tool_use") noteTool(toolKey(c.name));
         if (c.type === "tool_use" && c.name === "use_tool") noteTool(c.input?.tool_name);
       }
+    } else if (backend === "grok" && j.type === "user") {
+      for (const c of j.message?.content ?? []) {
+        if (c.type !== "tool_result" || typeof c.content !== "string") continue;
+        let r; try { r = JSON.parse(c.content); } catch { continue; }
+        if (typeof r?.name === "string") noteTool(r.name);
+      }
     } else if (backend === "gemini" && j.event === "init") {
       initSeen = true;
       const init = j.init ?? {};
@@ -695,9 +748,9 @@ export function runConsult(backend, argv) {
       if (Array.isArray(init.tools)) prov.retrieval.available = [...new Set(init.tools
         .filter((t) => RETRIEVAL_TOOLS.gemini.test(t)).map((t) => t.startsWith("browser_") ? "browser_*" : t))];
       writeMeta(meta);
-      // Read-only rests on Antigravity's request-review (or strict) preset;
-      // a laxer one would let the consult act unprompted.
-      if (sandbox === "read-only" && !["request-review", "strict"].includes(prov.permissionMode))
+      // Without Seatbelt, read-only rests on Antigravity's request-review (or
+      // strict) preset; a laxer one would let the consult act unprompted.
+      if (sandbox === "read-only" && !wrap && !["request-review", "strict"].includes(prov.permissionMode))
         refuse(`agy reports permission mode "${prov.permissionMode}", not request-review — refusing a read-only consult it would not enforce`);
       else initValidated = true;
     } else if (backend === "gemini" && j.event === "step_update") {
@@ -816,7 +869,7 @@ export function runConsult(backend, argv) {
       : structuredOut !== undefined ? JSON.stringify(structuredOut) : resultText;
 
     let status = killedBy ? "killed" : (refusal || code !== 0 || resultErr) ? "failed" : "done";
-    if (status === "done" && backend === "gemini" && sandbox === "read-only" && !initValidated) {
+    if (status === "done" && backend === "gemini" && sandbox === "read-only" && !wrap && !initValidated) {
       status = "failed";
       refusal = "agy reported no init event, so its permission mode — the read-only guarantee — went unconfirmed";
       writeSync(2, `[gaslamp] ${refusal}\n`);

package/src/fleet.mjs

@@ -43,6 +43,7 @@ import {
 } from "./jobs.mjs";
 import { BACKEND_NAMES, isBackend } from "./backends.mjs";
 import { readThread } from "./threads.mjs";
+import { readStdin } from "./stdin.mjs";
 
 const GASLAMP_BIN = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "gaslamp.mjs");
 // Quota-shaped, not CPU-shaped: the bottleneck is API rate limits, not cores
@@ -116,7 +117,7 @@ function buildTasks(backend, o) {
   let raw;
   const stdinRequested = o.stdin || (o.prompt == null && !process.stdin.isTTY);
   if (stdinRequested) {
-    const lines = readFileSync(0, "utf8").split("\n").map((l) => l.trim()).filter(Boolean);
+    const lines = readStdin().split("\n").map((l) => l.trim()).filter(Boolean);
     if (!lines.length) die(2, "no tasks on stdin");
     raw = lines.map((line, i) => norm(line.startsWith("{") ? parseJsonLine(line, i) : line, i));
   } else {
@@ -125,7 +126,7 @@ function buildTasks(backend, o) {
     // <stdin> convention as a single consult (git diff | gaslamp fleet …).
     let prompt = o.prompt;
     if (!process.stdin.isTTY) {
-      const evidence = readFileSync(0, "utf8");
+      const evidence = readStdin();
       if (evidence.trim())
         prompt += "\n\n<stdin>\n" + (evidence.endsWith("\n") ? evidence : evidence + "\n") + "</stdin>";
     }

package/src/setup.mjs

@@ -121,7 +121,7 @@ Omit \`--model\` to use ${Other}'s own configured default. Match the tier to the
 
 Same contract as above — threads, \`--schema\`, fleets, records — with two differences:
 
-- **Read-only unless you say otherwise.** An omitted \`--sandbox\` means read-only, enforced by the harness: Grok runs in its kernel sandbox; Antigravity's print mode denies writes, shell commands and URL fetches, and gaslamp refuses the consult if Antigravity's settings pre-allow more than reads, read-only git and the end_session off-ramp. A denied tool call can end a turn with nothing to say, which gaslamp marks failed — so pipe the evidence in rather than asking them to go fetch it. Gemini has no \`workspace-write\`; \`danger-full-access\` exists on both.
+- **Read-only unless you say otherwise.** An omitted \`--sandbox\` means read-only, kernel-enforced where possible: Grok runs in its own sandbox, and on macOS gaslamp runs Antigravity under Seatbelt, so neither writes outside its own state and temp dirs (Antigravity elsewhere relies on its request-review preset, and gaslamp refuses lax settings). Inside that they read local files and search — Google search on Gemini, web and X search on Grok — so for a search consult send the question and its constraints and let them fetch; for a review of material you already hold, pipe it in. What fails is writing: a write or a writing shell command errors and the turn goes on, except on Antigravity's preset path, where writes and shell commands are refused outright and can end the turn with nothing to say (gaslamp marks that failed), and its URL fetch is not offered at all. Gemini has no \`workspace-write\`; \`danger-full-access\` exists on both.
 - **Provenance on every job.** \`meta.json\` records the model the harness reported (Grok also shows the model it billed), the harness version, a hash of the vendor system prompt where the harness exposes it (Grok) or \`known: false\`, and which web/X retrieval tools the consultee had and actually used.
 
 \`gaslamp gemini --model\` takes \`argon\` (the default) or \`flash\`, resolved to the newest \`gemini-<version>-<tier>\` in Antigravity's own catalog; Antigravity also serves Claude and GPT models under the same account, so the target always pins a Gemini unless you pass another id. \`gaslamp grok\` uses the account's default model unless \`--model\` names one (\`grok models\` lists them).

package/src/stdin.mjs

@@ -0,0 +1,28 @@
+// stdin.mjs — read all of stdin, cat-like, even when it is non-blocking.
+//
+// readFileSync(0) throws EAGAIN instead of waiting when the caller hands
+// gaslamp a stdin with O_NONBLOCK set (seen from an agent harness's shell),
+// and the consult died before reading its evidence. Reading in a loop that
+// naps on EAGAIN waits for the data and the EOF the way a blocking read would;
+// on macOS reopening /dev/stdin is no escape, since it dups the same
+// non-blocking file description.
+
+import { readSync } from "node:fs";
+
+export function readStdin() {
+  const chunks = [];
+  const buf = Buffer.alloc(1 << 16);
+  const nap = new Int32Array(new SharedArrayBuffer(4));
+  for (;;) {
+    let n;
+    try { n = readSync(0, buf, 0, buf.length, null); }
+    catch (e) {
+      if (e.code === "EAGAIN") { Atomics.wait(nap, 0, 0, 10); continue; }
+      if (e.code === "EOF") break;
+      throw e;
+    }
+    if (n === 0) break;
+    chunks.push(Buffer.from(buf.subarray(0, n)));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}