super-dsh 0.1.6 → 0.1.10

package/agent-agy/dist/agy-auth.js

@@ -0,0 +1,179 @@
+/**
+ * agy-auth.ts — the CLI adapter's auth-form detection, fallback ladder, and
+ * the mutation it applies to the user's LOCAL Antigravity configuration.
+ *
+ * The Antigravity CLI has four auth channels (dev-rules §16a, re-probed
+ * 2026-10-02 against `agy` 1.2.14):
+ *
+ *   1. account sign-in   default, `cloudcode-pa.googleapis.com`; the token
+ *                        lives in the freedesktop Secret Service keyring
+ *                        (`gnome-keyring-daemon`, `org.freedesktop.secrets`,
+ *                        entry `service=gemini username=antigravity`) with a
+ *                        file fallback at `~/.gemini/antigravity-cli/
+ *                        antigravity-oauth-token`;
+ *   2. Gemini API key    `modelProvider: "gemini"` in the CLI's settings.json
+ *                        + `GEMINI_API_KEY` in the launch environment
+ *                        (+ optional `GOOGLE_GEMINI_BASE_URL`);
+ *   3. ADC               `AGY_ADC_AUTH=1` — `adc_auth.go` reports
+ *                        "authenticated via adc (effective: adc)". Credentials
+ *                        are `~/.config/gcloud/application_default_credentials
+ *                        .json` (or a GCE metadata server). NOT the keyring;
+ *   4. BYO gateway       `AGY_LLM_GATEWAY_*` (out of scope; see the spec).
+ *
+ * user ruling 2026-10-02 (supersedes the dev-rules §5 "never write the native
+ * home" default for THIS adapter, under §12 per-adapter discretion):
+ *
+ *   「拥抱用户自己的使用环境」 — this adapter is deliberately the configuration
+ *   surface for the user's LOCAL Antigravity. Selecting a form here really does
+ *   rewrite their `~/.gemini/antigravity-cli/settings.json`, so the TUI they
+ *   already use keeps working afterwards. Paths are hard-coded relative to the
+ *   user's home for exactly that reason.
+ *
+ * Fallback order (same ruling) = Gemini API key → OAuth → ADC. OAuth stays a
+ * PLACEHOLDER this round: no eligible account exists to characterise the
+ * native fields a real sign-in stores, so nothing reports it present.
+ *
+ * Pure: every probe result is injected, so `node --test` pins the ladder; the
+ * one filesystem-touching helper (`nativeSettingsPath`) is a pure path fold.
+ *
+ * @module agent-agy/agy-auth
+ */
+import { statSync } from "node:fs";
+import { join } from "node:path";
+/** Declared fallback order (user ruling 2026-10-02). Exported for the UI. */
+export const AGY_AUTH_ORDER = ["apiKey", "oauth", "adc"];
+/** Human labels, shared by the Hub settings panel and diagnostics. */
+export const AGY_AUTH_LABELS = {
+    apiKey: "Gemini API key",
+    oauth: "OAuth (account sign-in)",
+    adc: "ADC (Vertex)",
+};
+/**
+ * The CLI's own app-data directory, hard-coded under the USER's home — the
+ * native Antigravity config we deliberately share with the TUI.
+ *
+ * @param realHome - the user's real `$HOME` (never an isolated override).
+ * @returns the absolute app-data directory.
+ */
+export function nativeCliDir(realHome) {
+    return join(realHome, ".gemini", "antigravity-cli");
+}
+/**
+ * The CLI's settings file. The binary documents the auth flip here: "To switch
+ * back to signing in, remove `modelProvider` from settings.json and restart
+ * the CLI."
+ *
+ * @param realHome - the user's real `$HOME`.
+ * @returns the absolute settings.json path.
+ */
+export function nativeSettingsPath(realHome) {
+    return join(nativeCliDir(realHome), "settings.json");
+}
+/**
+ * The credential file the CLI writes when a Google account signs in. This is
+ * the **Agent Platform** plane: `auth_method: "gcp"`, a `project_id`, and an
+ * access/refresh token pair. It is the backend the interactive TUI uses.
+ *
+ * @param realHome - the user's real `$HOME`.
+ * @returns the absolute path of the CLI's stored sign-in credential.
+ */
+export function signinTokenPath(realHome) {
+    return join(nativeCliDir(realHome), "antigravity-oauth-token");
+}
+/**
+ * Is the CLI's own Google sign-in in place?
+ *
+ * Measured 2026-10-02 (this machine): headless CLI reads this plane first, and
+ * when it is present the transport works with NO Gemini API key, NO
+ * `AGY_ADC_AUTH`, and NO `modelProvider` in settings — the run reaches
+ * `result.status: SUCCESS`.
+ *
+ * This is what the auth ladder's middle rung means in practice: not a
+ * placeholder, but "let the CLI use the account it is already signed in as".
+ * It therefore must be DETECTED rather than assumed absent: treating it as
+ * permanently unavailable is what pushed the ladder onto ADC, whose project
+ * has `cloudcode-pa` disabled, and the adapter could never start a turn.
+ *
+ * @param realHome - the user's real `$HOME`.
+ * @returns whether a non-empty sign-in credential is on disk.
+ */
+export function hasSigninCredential(realHome) {
+    try {
+        return statSync(signinTokenPath(realHome)).size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The settings.json change one form needs.
+ *
+ * Key mode pins the Gemini provider. ADC and OAuth need the DEFAULT backend, so
+ * `modelProvider` must be actively REMOVED — merely not setting it would leave
+ * a previously selected key mode in force and the TUI stuck on "Gemini API key"
+ * with no key exported.
+ *
+ * @param mode - the effective form.
+ * @returns the mutation to apply.
+ */
+export function authSettingsMutation(mode) {
+    return mode === "apiKey"
+        ? { set: { modelProvider: "gemini" }, remove: [] }
+        : { set: {}, remove: ["modelProvider"] };
+}
+/**
+ * Is this mode usable at all right now?
+ *
+ * @param availability - probe result.
+ * @param mode - the form to test.
+ * @returns whether the form is present.
+ */
+export function authAvailable(availability, mode) {
+    return availability[mode];
+}
+/**
+ * Resolve the effective mode: an explicit selection wins when that form is
+ * actually present; otherwise the ladder supplies the first available form.
+ * Nothing present ⇒ `undefined` (the caller gates into onboarding).
+ *
+ * A stale selection (user picked API key, key later removed) deliberately
+ * falls through to the ladder instead of failing — the adapter must not wedge
+ * on config that no longer matches the machine.
+ *
+ * @param availability - probe result.
+ * @param selected - the user's persisted choice, when any.
+ * @returns the effective form, or `undefined` when nothing is available.
+ */
+export function resolveAuthMode(availability, selected) {
+    if (selected !== undefined && authAvailable(availability, selected))
+        return selected;
+    return AGY_AUTH_ORDER.find((mode) => authAvailable(availability, mode));
+}
+/**
+ * The environment additions the spawned CLI needs for one mode.
+ *
+ * `AGY_CLI_DISABLE_AUTO_UPDATE=1` rides every mode: the CLI silently
+ * self-updated 1.2.12 → 1.2.14 on this machine on 2026-10-02, which makes any
+ * acceptance run unreproducible.
+ *
+ * NOTE there is no HOME handling here at all: the adapter runs the CLI against
+ * the user's REAL home in every mode. Isolating HOME (the previous design) both
+ * hid the very settings.json we now maintain and silently destroyed ADC
+ * (`$HOME/.config/gcloud`) and the keyring — which is how this adapter
+ * previously mis-concluded "the CLI cannot use ADC".
+ *
+ * @param mode - the effective form.
+ * @param apiKey - the resolved key (env or adapter state); empty ⇒ omitted.
+ * @returns env entries to ADD to the child's environment.
+ */
+export function authChildEnv(mode, apiKey) {
+    const env = { AGY_CLI_DISABLE_AUTO_UPDATE: "1" };
+    if (mode === "adc") {
+        env.AGY_ADC_AUTH = "1";
+        return env;
+    }
+    if (mode === "apiKey" && apiKey !== undefined && apiKey !== "") {
+        env.GEMINI_API_KEY = apiKey;
+    }
+    return env;
+}

package/agent-agy/dist/agy-cli-client.d.ts

@@ -15,6 +15,7 @@
  *
  * Same surface as AgyBridgeClient so AgyAgent needs no changes.
  */
+import { type AgyAuthMode, type AgySettingsMutation } from "./agy-auth.js";
 export interface AgyCliOptions {
     /** Key or a resolver (onboarding-saved keys become visible at first spawn). */
     apiKey: string | (() => string | undefined);
@@ -34,14 +35,18 @@ export interface AgyCliOptions {
     skipPermissions?: boolean;
     /** agy binary override (tests point at a mock). */
     agyBin?: string;
-    /** Native CLI settings dir override (tests; prod: ~/.gemini). */
-    nativeCliHome?: string;
     /**
-     * HOME override for the spawned agy. The account-OAuth/gcp token in the
-     * real home triggers the region-eligibility gate; an isolated home with
-     * only settings.json + GEMINI_API_KEY runs the pure API-key path.
+     * The USER's real home. The CLI always runs against it (never an isolated
+     * override), and this is where the native Antigravity settings we maintain
+     * live — see the module header for the 2026-10-02 「拥抱用户自己的使用环境」
+     * ruling.
      */
-    home?: string;
+    realHome?: string;
+    /**
+     * The resolved auth form (agy-auth.ts). Absent defaults to `apiKey`, so an
+     * unconfigured machine still reaches the §17 onboarding path.
+     */
+    authMode?: AgyAuthMode;
     spawnAttempts?: number;
     trace?: (...parts: unknown[]) => void;
 }
@@ -81,8 +86,21 @@ export type CliEvent = {
     error: string;
     recoverable: boolean;
 };
-/** Merge `modelProvider: "gemini"` into the CLI's own settings (single key). */
-export declare function ensureCliKeyMode(nativeCliHome: string): void;
+/**
+ * Apply one auth form's mutation to the user's LOCAL Antigravity settings.
+ *
+ * user ruling 2026-10-02 (「拥抱用户自己的使用环境」): this adapter is
+ * deliberately the configuration surface for the user's own Antigravity, so it
+ * really does rewrite their `~/.gemini/antigravity-cli/settings.json` — pick
+ * Gemini API key here and their TUI runs on the Gemini API key too; pick ADC or
+ * OAuth and the `modelProvider` pin is REMOVED so the TUI falls back to the
+ * default backend. Idempotent, and a no-op when the file already matches.
+ *
+ * @param realHome - the user's real `$HOME` (never an isolated override).
+ * @param mutation - keys to set and keys to remove.
+ * @returns `true` when the file changed on disk.
+ */
+export declare function applyAgySettings(realHome: string, mutation: AgySettingsMutation): boolean;
 export declare class AgyCliClient {
     private child?;
     private buffer;
@@ -121,8 +139,20 @@ export declare class AgyCliClient {
         total_tokens: number;
     } | undefined;
     private lastUsageValue;
-    private nativeCliHome;
+    /** The user's real home (the CLI and the settings we maintain both live here). */
+    private realHome;
     private spawnCli;
+    /**
+     * Bounded tail of what the CLI said OUTSIDE its structured stream: stderr,
+     * plus stdout lines that were not JSONL frames. The CLI announces refusals
+     * this way and then exits (or reports a failed result), so dropping these
+     * lines is what turns every failure into "unknown error".
+     */
+    private diagnostics;
+    /** Record one diagnostic line, keeping only a short tail. */
+    private noteDiagnostic;
+    /** Append the recorded CLI diagnostics to a failure message, once. */
+    private withDiagnostics;
     private consume;
     private consumeStep;
     private dispatch;

package/agent-agy/dist/agy-cli-client.js

@@ -18,11 +18,23 @@
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-/** Merge `modelProvider: "gemini"` into the CLI's own settings (single key). */
-export function ensureCliKeyMode(nativeCliHome) {
-    const dir = join(nativeCliHome, "antigravity-cli");
-    mkdirSync(dir, { recursive: true });
-    const p = join(dir, "settings.json");
+import { authChildEnv, authSettingsMutation, nativeSettingsPath, } from "./agy-auth.js";
+/**
+ * Apply one auth form's mutation to the user's LOCAL Antigravity settings.
+ *
+ * user ruling 2026-10-02 (「拥抱用户自己的使用环境」): this adapter is
+ * deliberately the configuration surface for the user's own Antigravity, so it
+ * really does rewrite their `~/.gemini/antigravity-cli/settings.json` — pick
+ * Gemini API key here and their TUI runs on the Gemini API key too; pick ADC or
+ * OAuth and the `modelProvider` pin is REMOVED so the TUI falls back to the
+ * default backend. Idempotent, and a no-op when the file already matches.
+ *
+ * @param realHome - the user's real `$HOME` (never an isolated override).
+ * @param mutation - keys to set and keys to remove.
+ * @returns `true` when the file changed on disk.
+ */
+export function applyAgySettings(realHome, mutation) {
+    const p = nativeSettingsPath(realHome);
     let settings = {};
     if (existsSync(p)) {
         try {
@@ -32,10 +44,15 @@ export function ensureCliKeyMode(nativeCliHome) {
             settings = {};
         }
     }
-    if (settings.modelProvider === "gemini")
-        return;
-    settings.modelProvider = "gemini";
+    const before = JSON.stringify(settings);
+    for (const key of mutation.remove)
+        delete settings[key];
+    Object.assign(settings, mutation.set);
+    if (JSON.stringify(settings) === before)
+        return false;
+    mkdirSync(join(p, ".."), { recursive: true });
     writeFileSync(p, JSON.stringify(settings, null, 2) + "\n");
+    return true;
 }
 export class AgyCliClient {
     child;
@@ -66,13 +83,21 @@ export class AgyCliClient {
         return this.lastUsageValue;
     }
     lastUsageValue;
-    nativeCliHome() {
-        return this.opts.nativeCliHome ?? join(process.env.HOME ?? "", ".gemini");
+    /** The user's real home (the CLI and the settings we maintain both live here). */
+    realHome() {
+        return this.opts.realHome ?? process.env.HOME ?? "";
     }
     spawnCli() {
         if (this.child || this.dead)
             return;
-        ensureCliKeyMode(this.nativeCliHome());
+        const mode = this.opts.authMode ?? "apiKey";
+        // Only key mode patches settings (`modelProvider: "gemini"`); ADC and OAuth
+        // need the DEFAULT backend, where that key must be ABSENT — the binary
+        // documents the flip: "To switch back to signing in, remove modelProvider
+        // from settings.json and restart the CLI". Per the 2026-10-02 ruling this
+        // lands in the USER's real native settings, so their TUI behaves the same
+        // way afterwards (「拥抱用户自己的使用环境」).
+        applyAgySettings(this.realHome(), authSettingsMutation(mode));
         const attempts = this.opts.spawnAttempts ?? 3;
         const agyBin = this.opts.agyBin ?? "agy";
         // Order matters: --print swallows the next token as a prompt value
@@ -96,11 +121,16 @@ export class AgyCliClient {
         for (let attempt = 1; attempt <= attempts; attempt++) {
             try {
                 const key = typeof this.opts.apiKey === "function" ? this.opts.apiKey() : this.opts.apiKey;
-                if (!key)
+                if (mode === "apiKey" && !key)
                     throw new Error("agy cli: no GEMINI_API_KEY resolved");
-                const env = { ...process.env, GEMINI_API_KEY: key, NO_PROXY: "127.0.0.1,localhost" };
-                if (this.opts.home)
-                    env.HOME = this.opts.home;
+                // The auth ladder rides the child env (agy-auth.ts): AGY_ADC_AUTH for
+                // ADC, the key for key mode, and the auto-update pin on EVERY mode.
+                // NO_PROXY keeps the dev3 loopback bridge reachable.
+                const env = { ...process.env, NO_PROXY: "127.0.0.1,localhost", ...authChildEnv(mode, key) };
+                // No HOME override, ever: the settings we just maintained live at
+                // `$HOME/.gemini`, ADC at `$HOME/.config/gcloud`, and the sign-in token
+                // in the keyring — isolating HOME destroys all three. That was the
+                // 2026-10-02 bug behind "the CLI cannot use ADC".
                 if (this.opts.proxy) {
                     env.HTTPS_PROXY = this.opts.proxy;
                     env.HTTPS_PROXY = this.opts.proxy;
@@ -119,12 +149,45 @@ export class AgyCliClient {
         child.stdout.setEncoding("utf8");
         child.stdout.on("data", (d) => this.consume(d));
         child.stderr.setEncoding("utf8");
-        child.stderr.on("data", (d) => this.opts.trace?.("[agy stderr]", d.trimEnd()));
+        child.stderr.on("data", (d) => {
+            this.opts.trace?.("[agy stderr]", d.trimEnd());
+            this.noteDiagnostic(d);
+        });
         child.on("exit", (code) => {
             this.child = undefined;
-            this.dispatch({ event: "error", error: `agy exited code=${code}`, recoverable: !this.dead });
+            // The CLI reports its refusals on stderr / as non-JSON stdout lines and
+            // then exits non-zero. Those lines ARE the diagnosis ("--effort is not
+            // supported for model …", "Eligibility check failed: …"), so the exit
+            // error carries them: an opaque "exited code=1" leaves the user with a
+            // dead turn and nothing to act on.
+            this.dispatch({ event: "error", error: this.withDiagnostics(`agy exited code=${code}`), recoverable: !this.dead });
         });
     }
+    /**
+     * Bounded tail of what the CLI said OUTSIDE its structured stream: stderr,
+     * plus stdout lines that were not JSONL frames. The CLI announces refusals
+     * this way and then exits (or reports a failed result), so dropping these
+     * lines is what turns every failure into "unknown error".
+     */
+    diagnostics = [];
+    /** Record one diagnostic line, keeping only a short tail. */
+    noteDiagnostic(chunk) {
+        for (const raw of chunk.split("\n")) {
+            const line = raw.trim();
+            if (line === "")
+                continue;
+            this.diagnostics.push(line);
+        }
+        // A chatty child must not grow this without bound mid-turn.
+        if (this.diagnostics.length > 12)
+            this.diagnostics = this.diagnostics.slice(-12);
+    }
+    /** Append the recorded CLI diagnostics to a failure message, once. */
+    withDiagnostics(message) {
+        const tail = this.diagnostics.join(" | ");
+        this.diagnostics = [];
+        return tail === "" ? message : `${message}: ${tail}`;
+    }
     consume(data) {
         this.buffer += data;
         let idx;
@@ -138,6 +201,7 @@ export class AgyCliClient {
                 parsed = JSON.parse(line);
             }
             catch (err) {
+                this.noteDiagnostic(line);
                 this.opts.trace?.("bad agy json:", line.slice(0, 120), err);
                 continue;
             }
@@ -154,7 +218,7 @@ export class AgyCliClient {
                 if (r?.conversation_id)
                     this.conversationIdValue = r.conversation_id;
                 if (r?.status !== "SUCCESS") {
-                    this.dispatch({ event: "error", error: r?.error ?? `agy result status=${r?.status}`, recoverable: false });
+                    this.dispatch({ event: "error", error: this.withDiagnostics(r?.error ?? `agy result status=${r?.status}`), recoverable: false });
                 }
                 else {
                     this.dispatch({ event: "done", conversation_id: this.conversationIdValue, turn_ms: 0 });

package/agent-agy/dist/agy-store.d.ts

@@ -9,11 +9,19 @@
  *   injectable so tests use fixtures instead of env knobs (prod path has no
  *   redirection).
  */
+import type { AgyAuthMode } from "./agy-auth.js";
 export interface AgyAdapterState {
     /** Gemini API key the user pasted through the onboarding session. */
     apiKey?: string;
     /** Cached default model slug (from native settings or catalog head). */
     defaultModel?: string;
+    /**
+     * The user's explicit auth-form choice for the CLI transport (the Hub's
+     * single-select). Absent ⇒ the agy-auth ladder decides. A stale choice (the
+     * form is gone from the machine) deliberately falls through to the ladder
+     * rather than wedging the adapter.
+     */
+    authMode?: AgyAuthMode;
 }
 export declare function adapterStatePath(worldHome: string): string;
 export declare function readAdapterState(worldHome: string): AgyAdapterState;

package/agent-agy/dist/index.d.ts

@@ -1,25 +1,43 @@
+/**
+ * agent-agy provider — Google Antigravity provider plugin for DeepSeek Harness
+ * (Super D, consumer-first line, 2026-09-18).
+ *
+ * An `AgentFactory` that drives an `AgyCliClient` — the user's OWN Antigravity
+ * CLI in headless stream-json mode. 2026-10-02 ruling 「拥抱用户自己的使用环境」:
+ * the adapter shares the user's real `~/.gemini` (native settings.json), their
+ * ADC (`~/.config/gcloud`), and their keyring, instead of isolating a HOME the
+ * CLI never had. The SDK/bridge transport lives in its own opt-in package,
+ * `@pgmi-builds/agent-agy-sdk`.
+ *
+ * Session identity ("mapping only"): the DSH session id is the authority,
+ * supplied by the harness. The CLI conversation id materializes after the
+ * first turn, so the pairing is persisted in `<worldHome>/dsh-sessions.json`
+ * (agy-sessions.ts). Resume resolves that record and fails CLOSED
+ * (CONVERSATION_NOT_FOUND) when no conversation is recorded. The DSH session
+ * log is the transcript authority, written through the upstream
+ * `sessionPersistence` service (hermes create/resume transaction shape).
+ */
 import { Context, Service } from "@deepseek-ai/cordis";
 import type { AgentFactory, AgentHandle, CreateAgentOptions, ResumeAgentOptions } from "@deepseek-ai/dsh-agent";
 /** Test/override knobs for the bridge child (prod: all unset). */
 export interface AgyProviderOptions {
-    bridgePath?: string;
-    pythonBin?: string;
     spawnAttempts?: number;
     /** Native home override for tests (prod: ~/.gemini, read-only). */
     nativeHome?: string;
-    /** Vertex project/location override (ADC mode). Default: gcloud CLI config. */
-    project?: string;
-    location?: string;
-    /** Tool-approval posture surfaced to every session's bridge start frame. */
-    approvalMode?: "allow" | "ask";
     /** danger-full-access → CLI --dangerously-skip-permissions (default: true, patch default preset). */
     skipPermissions?: boolean;
     /** agy binary override (CLI path tests). */
     agyBin?: string;
     /** Forward proxy for the geo-fenced Gemini API (CLI path; dev3 gost). */
     proxy?: string;
-    /** HOME override for the CLI child (isolated key-mode home; dev knob). */
-    cliHome?: string;
+    /**
+     * The USER's real home (default `$HOME`). The CLI always runs against it —
+     * 2026-10-02 ruling: the adapter shares the user's own Antigravity
+     * configuration (settings.json, ADC, keyring) instead of isolating it. The
+     * old isolated-HOME knob was removed with that ruling: it both hid the
+     * settings.json we maintain and silently destroyed ADC + the keyring.
+     */
+    realHome?: string;
 }
 export declare class AgyProvider extends Service implements AgentFactory {
     static inject: string[];
@@ -30,6 +48,8 @@ export declare class AgyProvider extends Service implements AgentFactory {
     private readonly opts;
     private defaultModelKey;
     constructor(ctx: Context, opts?: AgyProviderOptions);
+    /** Which auth forms are present on this machine right now (probe, not choice). */
+    private authAvailability;
     /** The world's DSH home: boot-provided dshHomePath first, env last. */
     private resolveHome;
     /** Effective Gemini API key: adapter state first, then the environment. */
@@ -46,7 +66,7 @@ export declare class AgyProvider extends Service implements AgentFactory {
     private resolveDefaultModel;
     /** Static route: provider `agy` + the resolved default (or the explicit ask).
      *  The selected model id (`slug` or `slug@level`) rides in `options.model`
-     *  so clientOptions can forward slug+thinkingLevel to the bridge start frame. */
+     *  so cliOptions can forward slug+thinkingLevel to the CLI child. */
     private sessionAgentOptions;
     private requirePersistence;
     private agentRuntime;
@@ -58,12 +78,24 @@ export declare class AgyProvider extends Service implements AgentFactory {
     createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle>;
     resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle>;
     /**
-     * Live transport routing (2026-09-18 user ruling): gemini-api-key > oauth >
-     * adc. Key present → CLI stream (richest surface). ADC-only → SDK bridge.
-     * Neither → CLI as well (auth fails at first prompt; the §17 onboarding
-     * branch answers locally before any spawn).
+     * Live transport: CLI-ONLY (2026-10-02 user ruling).
+     *
+     * The SDK/bridge route moved to its own package
+     * (`@pgmi-builds/agent-agy-sdk`, delivered disabled by default): the product
+     * case is that the user ALREADY runs Antigravity, so the CLI reuses that
+     * environment for free while the SDK is an opt-in extra. Auth-form selection
+     * still rides the agy-auth ladder.
      */
     private createLiveClient;
+    /**
+     * The auth form this machine should use: an explicitly selected, actually
+     * available form wins; otherwise the ladder Gemini API key → OAuth → ADC
+     * (user ruling 2026-10-02). OAuth is a placeholder this round — no eligible
+     * account exists to characterise which native fields a real sign-in stores —
+     * so nothing reports it present and it can never win. Falls back to `apiKey`
+     * so an unconfigured machine still reaches the §17 onboarding path.
+     */
+    private effectiveAuthMode;
     /**
      * The effective permission preset this provider was mounted with. The
      * cordis.patch.yml default is danger-full-access; a patch-level override
@@ -73,8 +105,6 @@ export declare class AgyProvider extends Service implements AgentFactory {
     private currentPermissionPreset;
     /** CLI transport options: key-first default is the cheapest live pair. */
     private cliOptions;
-    /** Bridge child options: world cwd + overrides; the api key rides the start config. */
-    private clientOptions;
     private createStoredSession;
 }
 export default AgyProvider;