pitroom 0.23.0 → 0.24.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pitroom",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
-  "version": "0.23.0",
+  "version": "0.24.1",
   "author": {
     "name": "TahaAtas"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.23.0",
+  "version": "0.24.1",
   "description": "A free pit crew for your expensive coding agent: delegate research, fixes, tests, reviews and parallel investigations to cheap worker agents running your own models, with verified answers, exact diffs and cost receipts.",
   "author": {
     "name": "TahaAtas"

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.24.1
+
+### Workers
+- **Antigravity: a task that names files outside the project no longer stops halfway.** agy's file tools stay in the workspace, and a headless agy cannot ask for more, so a read outside it ("copy the components from /tmp/ui-source") was refused and ended the turn without an answer. The folders and files a task names by absolute path (or `~/…`) that exist outside the workspace are now granted read-only (the sandbox mounts them read-only too), with every secret-looking file in them denied (found at any depth and in every folder; a folder too big to check, with a link leading out of it or nowhere, or with a folder that cannot be read, is not granted, and a named path counts where its links lead). Never the root or a top-level folder such as `/tmp`, your home itself or a folder above it, a folder holding the workspace or the project, a dot-folder in your home (`~/.config` and the like) or `~/Library`, Pitroom's own state or a secret-looking file, and nothing on Windows (agy compares paths there without their drive letter); the secrets in your home stay denied. In a snapshot or an isolated copy the project's own paths in the task are turned into the copy's (links resolved, so `/tmp/…` and `/private/tmp/…` alike): the worker reads and edits its copy instead of being refused at the project.
+
+## 0.24.0
+
+### Workers
+- **Antigravity CLI worker (beta)**: `-W antigravity[:model]`, Google's `agy`, with the user's Google account sign-in (which Gemini CLI now refuses). Checked against agy 1.3.5 on macOS: a read, a follow-up, an isolated edit and the deny rules were run against the real CLI, and the fixtures are its recorded output. agy has no read-only mode for headless runs (`--mode plan` is reported to still write), so **its read runs read a read-only snapshot of their own**, made right before its attempt: never the project, and never the snapshot other read runs share, where a stray file would outlive the run (a new `readOnly: 'snapshot'` capability). What git sees newly changed there afterwards is a `READ-ONLY VIOLATION`, and the worker after it in the chain reads where it was meant to, never that snapshot; as a fallback it costs nothing until it runs, pruning keeps these snapshots apart from the shared one, and a follow-up whose snapshot was pruned gets it made again; if the snapshot cannot be made it is skipped, never run in the project; `--in-place`, reviews and folders outside git warn instead, and `doctor --probe` runs it in an empty folder. Its answers are cached under where they were read. Write and isolate runs use `--mode accept-edits`; shell commands run in agy's terminal sandbox (`--sandbox`: the workspace writable, `.git` read-only, no network).
+  - **A home of its own per workspace.** agy reads its settings only from `~/.gemini/antigravity-cli/settings.json` (`ANTIGRAVITY_APP_DATA_DIR` is ignored), so a worker runs with `HOME` set to `<pitroom home>/antigravity-home/<id>`, one per workspace, so that a follow-up finds its conversation; the sign-in is linked in (the keychain folder on macOS, the token file elsewhere), and homes unused for two weeks are removed. Its settings grant sandboxed commands (`command(*)`: without a grant a headless agy refuses every command and ends the turn without an answer), let agy write its plan into its own folder (plan mode does), keep file tools in the workspace, mount the toolchains of your PATH under your home read-only (an nvm node, so `npm test` works in the sandbox), and deny: the workspace's secret files and the secrets in your home by absolute path (`read_file` rules take no patterns, and a relative one breaks the sandbox), the forbidden commands, MCP tools and the web (`--web` does not apply to these workers).
+  - **Deny rules in agy's own matching**: a rule is a command prefix compared word by word after agy has split the line at `&&`, `;`, `|` and taken off wrappers such as `env -i` and `timeout 60`, and a `regex:` rule compares word by word too, with backslashes dropped. So each forbidden command is denied as it is, by path (`/usr/bin/git`), behind git's global options (`git -c x=y commit`, `git --no-pager push`), and any recursive `rm` (`rm src -rf`, `rm -r -f`); `sh -c`, `eval`, find with `-exec`, `-ok` or `-delete` (agy does not look inside it, so it is refused outright), and xargs running a forbidden command. A line with `{}` in it is not split, and is matched whole: rules for that find xargs, find, `git <subcommand>` and `rm -r` anywhere in it. They are patterns, a layer on top and not a guarantee: other spellings can get past them, so the git guard (and `.git`, read-only in the sandbox) holds for git, and the snapshot or the isolated copy holds for your files; use `-i` for changes, not `-w`.
+  - **Its stream as agy writes it**: `{"event": …}` with the payload under the event's name (`result.response`, `result.usage`, `init.model`), tool steps that end in state `ERROR` when refused, and `result.denied_actions`. `--continue` resumes by conversation id; agy starts a new conversation for an id it does not know and says so only on stderr, which the run now shows as a warning. A run without an answer is a failure, never an empty answer: a refused command can end agy's turn with `SUCCESS`, no answer and exit 0. A used-up quota exits 3 with an `AGY_ERROR` line (`rate-limited`, so the chain moves on), an unknown model exits 1 (`model-unavailable`), a missing sign-in is `auth`. A prompt the model's safety filter blocks (`This request was blocked by Gemini's filters…`, status `SUCCESS`) is a failure, not the answer. `agy` is added to the "other agents" every worker is denied.
+- **A run's own snapshot no longer blames the worker for every file.** A snapshot is a checkout without a commit, so git calls each of its files "added"; the check for what a worker wrote there counted them all, and every Antigravity read run came out a `READ-ONLY VIOLATION` (exit 5, answer not cached). Only what differs from the snapshot's index counts now.
+- **A worker can add warnings of its own** to a finished run (Antigravity's lost conversation).
+- **One list of forbidden commands** (`src/backends/deny.ts`) for Claude Code, Qwen Code and Antigravity, now with `rm -r`, `rm -R` and `rm --recursive` (OpenCode already denied them); a test keeps Gemini's rule file and OpenCode's profiles in step. Gemini's private home is now written atomically (retried, then written in place, while Windows holds the file open) and repairs a dangling sign-in link (a shared helper with Antigravity's).
+
 ## 0.23.0
 
 ### Answers

package/README.md

@@ -6,7 +6,7 @@
 
 **Cheaper and faster: hand the reading, fixes, tests and reviews to workers that run in parallel. Keep the decisions.**
 
-Model-agnostic · Verified answers · Receipts, not vibes · OpenCode / Codex / Claude Code / Gemini CLI / Qwen Code / Kilo Code workers
+Model-agnostic · Verified answers · Receipts, not vibes · OpenCode / Codex / Claude Code / Gemini CLI / Qwen Code / Kilo Code / Antigravity workers
 
 <br />
 
@@ -72,7 +72,7 @@ Pitroom uses your worker CLI's default model: a free tier, a local MLX/Ollama mo
 
 ### Any worker CLI
 
-OpenCode, Codex CLI, Claude Code, Gemini CLI, Qwen Code and Kilo Code.
+OpenCode, Codex CLI, Claude Code, Gemini CLI, Qwen Code, Kilo Code and Antigravity CLI (beta).
 
 One group can mix them, and a fallback chain can cross them ([how adapters work](docs/backends.md)).
 
@@ -283,7 +283,7 @@ macOS and Linux are the main platforms. **Windows** runs the same test suite in
 
 ## Quick start
 
-You need Node.js 22.13+ and at least one worker CLI: [OpenCode](https://opencode.ai) v2+ (the default worker, with free models), [Codex CLI](https://github.com/openai/codex), [Claude Code](https://claude.com/claude-code) [Gemini CLI](https://github.com/google-gemini/gemini-cli) (beta; it needs an API key from [Google AI Studio](https://aistudio.google.com/apikey), a Google account sign-in no longer works for it) [Qwen Code](https://github.com/QwenLM/qwen-code) (beta; any OpenAI-compatible provider, a DashScope key, or a local model) or [Kilo Code](https://kilo.ai)'s CLI (beta; `npm i -g @kilocode/cli`, its 500+ models and providers).
+You need Node.js 22.13+ and at least one worker CLI: [OpenCode](https://opencode.ai) v2+ (the default worker, with free models), [Codex CLI](https://github.com/openai/codex), [Claude Code](https://claude.com/claude-code) [Gemini CLI](https://github.com/google-gemini/gemini-cli) (beta; it needs an API key from [Google AI Studio](https://aistudio.google.com/apikey), a Google account sign-in no longer works for it) [Qwen Code](https://github.com/QwenLM/qwen-code) (beta; any OpenAI-compatible provider, a DashScope key, or a local model) [Kilo Code](https://kilo.ai)'s CLI (beta; `npm i -g @kilocode/cli`, its 500+ models and providers) or the [Antigravity CLI](https://antigravity.google) (beta; `agy`, signed in with your Google account).
 
 ### 1. Install: pick your agent
 
@@ -682,6 +682,7 @@ pitroom run -W claude:haiku "…"                          # Claude Code on a ch
 pitroom run -W gemini:gemini-3.8-flash "…"               # Gemini CLI (beta; needs a Google AI Studio API key)
 pitroom run -W qwen:qwen3-coder-plus "…"                 # Qwen Code (beta; your provider from ~/.qwen/settings.json)
 pitroom run -W kilo:kilo/<model> "…"                      # Kilo Code's CLI (beta; any model from `kilo models`)
+pitroom run -i -W antigravity "…"                         # Antigravity CLI (beta; your Google account, models from `agy models`)
 pitroom run -m nvidia/z-ai/glm-5.3 "…"                   # another model on the preferred worker
 ```
 
@@ -693,6 +694,7 @@ pitroom run -m nvidia/z-ai/glm-5.3 "…"                   # another model on th
 | Gemini CLI | beta | `--approval-mode plan` plus Pitroom's policy rules | tokens only | an API key from Google AI Studio (sign in with `gemini` or set `GEMINI_API_KEY`; Google account sign-in is refused by Google); workers run in a private Gemini home without your hooks, MCP servers and skills; secret-file rules are not enforced by Gemini 0.62, but a read run with secret-looking files reads a [clean snapshot](#modes) without them; pin a model, e.g. `-W gemini:gemini-3.8-flash`; `--continue` works (by session id; see [the notes](docs/backends.md#gemini-cli-notes)) |
 | Qwen Code | beta | `--approval-mode plan`; edits only inside the working directory, the rest declined | tokens only | checked against Qwen Code 0.25 with a scripted model, not yet with a real provider; uses your sign-in and model from `~/.qwen/settings.json` (any OpenAI-compatible provider, DashScope, a local model); `--safe-mode` keeps your QWEN.md, hooks, skills and MCP servers out and stops the CLI writing memories of the run; reads `.env` if asked, so a read run with secret-looking files reads a [clean snapshot](#modes); see [the notes](docs/backends.md#qwen-code-notes) |
 | Kilo Code | beta | per-run permission rules (OpenCode's profiles) | reported | the CLI of `@kilocode/cli` (an OpenCode fork): the same `pitroom-read`/`pitroom-write` profiles through `KILO_CONFIG_CONTENT`, your sign-in and providers as they are; workers use a private state folder so a running `kilo daemon` (which would ignore the profiles) is never attached to; checked against Kilo 7.8.8 with a scripted model, not yet with a real provider; see [the notes](docs/backends.md#kilo-code-notes) |
+| Antigravity CLI | beta | a read-only [snapshot](#modes) of its own for every read run (agy has no read-only mode for headless runs) | tokens only | checked against agy 1.3.5 (macOS); use `-i` for changes, not `-w` (its deny rules are patterns, a layer on top of the git guard and the isolated copy); runs with a home of its own per workspace (agy reads its settings only from `~/.gemini`), so its commands do not see your dotfiles; an answerless run (a refused command can end its turn with no answer and exit 0) is a failure; your Google account sign-in (the one Gemini CLI now refuses); shell in agy's terminal sandbox (macOS, Linux); no web access for these workers; give it a fallback, its quota is per account; see [the notes](docs/backends.md#antigravity-cli-notes) |
 
 ### Models, costs and effort