agentcap-cli 0.1.1__tar.gz → 0.1.2__tar.gz

{agentcap_cli-0.1.1 → agentcap_cli-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentcap-cli
-Version: 0.1.1
+Version: 0.1.2
 Summary: API-key spend guard for unattended Codex CLI and Gemini CLI runs: hard per-run cap, kills the process at the limit.
 Project-URL: Homepage, https://agentcap.launchbench.studio
 Project-URL: Repository, https://github.com/Blitz00X/agentcap
@@ -126,12 +126,13 @@ sign-in (OAuth/subscription) traffic is not metered.
   already sets `model_provider`, `model_providers.*` or `openai_base_url` with
   `-c`/`--config`, AgentCap refuses to start (exit code 2) rather than let
   traffic bypass the proxy.
-- **Gemini CLI 0.58–0.66** needs an auth type in headless mode, so AgentCap
-  writes a temporary settings file (merged over
-  `$GEMINI_CLI_SYSTEM_SETTINGS_PATH` when set) that selects API-key auth, points
-  Gemini at `GEMINI_CLI_SYSTEM_SETTINGS_PATH` for the run, and removes it
-  afterwards; `~/.gemini` is never modified. `--trust-workspace` adds
-  `GEMINI_CLI_TRUST_WORKSPACE=true` for Gemini.
+- **Gemini CLI 0.58–0.66** needs an auth type in headless mode, and from 0.60 it
+  also refuses system settings files that are not root-owned. AgentCap therefore
+  runs Gemini with a temporary `GEMINI_CLI_HOME`: its `.gemini` directory links
+  your real entries (history, `trustedFolders.json`, credentials) and holds a
+  copied `settings.json` with the auth type forced to `gemini-api-key`. The
+  overlay is removed afterwards; nothing in your real `~/.gemini` is modified.
+  `--trust-workspace` adds `GEMINI_CLI_TRUST_WORKSPACE=true` for Gemini.
 - `npx @openai/codex ...` and `npx @google/gemini-cli ...` are recognised too.
 
 Add `--trust-workspace` for Gemini CLI runs in folders you have not trusted yet;
@@ -179,11 +180,12 @@ test suite uses `httpx.MockTransport` and never calls the network.
 | Tool | Verified version | Command and auth | Routing |
 | --- | --- | --- | --- |
 | Codex CLI | 0.163 | `codex exec "…"` with `OPENAI_API_KEY`; ChatGPT sign-in is not metered. | Automatically, via an injected custom provider (`-c model_provider=agentcap …`). |
-| Gemini CLI | 0.58–0.66 | `gemini -p "…"` with `GEMINI_API_KEY`; Google sign-in is not metered. | Automatically, via a temporary `GEMINI_CLI_SYSTEM_SETTINGS_PATH` overlay (api-key auth). Add `--trust-workspace` to `agentcap run` for untrusted folders. |
+| Gemini CLI | 0.58–0.66 | `gemini -p "…"` with `GEMINI_API_KEY`; Google sign-in is not metered. | Automatically, via a temporary `GEMINI_CLI_HOME` overlay (your `~/.gemini` is linked, its `settings.json` is copied with the auth type forced to `gemini-api-key`; nothing in `~/.gemini` is modified). Add `--trust-workspace` to `agentcap run` for untrusted folders. |
 | Your own script | Any | Uses the OpenAI or Gemini SDK with base-URL environment variables. | No code changes: AgentCap sets `OPENAI_BASE_URL` and `GOOGLE_GEMINI_BASE_URL`. |
 
-Tested end-to-end against a local fake API with the real Codex and Gemini CLIs;
-not yet verified against live billing with a real key.
+Tested with a real Gemini API key on Gemini CLI 0.66 (spend metered from Google's
+usageMetadata, output clamped to the cap); Gemini CLI 0.58 and Codex CLI 0.163 are
+tested end-to-end against a local fake API only, not yet with real paid keys.
 
 ## How it works
 

{agentcap_cli-0.1.1 → agentcap_cli-0.1.2}/README.md

@@ -96,12 +96,13 @@ sign-in (OAuth/subscription) traffic is not metered.
   already sets `model_provider`, `model_providers.*` or `openai_base_url` with
   `-c`/`--config`, AgentCap refuses to start (exit code 2) rather than let
   traffic bypass the proxy.
-- **Gemini CLI 0.58–0.66** needs an auth type in headless mode, so AgentCap
-  writes a temporary settings file (merged over
-  `$GEMINI_CLI_SYSTEM_SETTINGS_PATH` when set) that selects API-key auth, points
-  Gemini at `GEMINI_CLI_SYSTEM_SETTINGS_PATH` for the run, and removes it
-  afterwards; `~/.gemini` is never modified. `--trust-workspace` adds
-  `GEMINI_CLI_TRUST_WORKSPACE=true` for Gemini.
+- **Gemini CLI 0.58–0.66** needs an auth type in headless mode, and from 0.60 it
+  also refuses system settings files that are not root-owned. AgentCap therefore
+  runs Gemini with a temporary `GEMINI_CLI_HOME`: its `.gemini` directory links
+  your real entries (history, `trustedFolders.json`, credentials) and holds a
+  copied `settings.json` with the auth type forced to `gemini-api-key`. The
+  overlay is removed afterwards; nothing in your real `~/.gemini` is modified.
+  `--trust-workspace` adds `GEMINI_CLI_TRUST_WORKSPACE=true` for Gemini.
 - `npx @openai/codex ...` and `npx @google/gemini-cli ...` are recognised too.
 
 Add `--trust-workspace` for Gemini CLI runs in folders you have not trusted yet;
@@ -149,11 +150,12 @@ test suite uses `httpx.MockTransport` and never calls the network.
 | Tool | Verified version | Command and auth | Routing |
 | --- | --- | --- | --- |
 | Codex CLI | 0.163 | `codex exec "…"` with `OPENAI_API_KEY`; ChatGPT sign-in is not metered. | Automatically, via an injected custom provider (`-c model_provider=agentcap …`). |
-| Gemini CLI | 0.58–0.66 | `gemini -p "…"` with `GEMINI_API_KEY`; Google sign-in is not metered. | Automatically, via a temporary `GEMINI_CLI_SYSTEM_SETTINGS_PATH` overlay (api-key auth). Add `--trust-workspace` to `agentcap run` for untrusted folders. |
+| Gemini CLI | 0.58–0.66 | `gemini -p "…"` with `GEMINI_API_KEY`; Google sign-in is not metered. | Automatically, via a temporary `GEMINI_CLI_HOME` overlay (your `~/.gemini` is linked, its `settings.json` is copied with the auth type forced to `gemini-api-key`; nothing in `~/.gemini` is modified). Add `--trust-workspace` to `agentcap run` for untrusted folders. |
 | Your own script | Any | Uses the OpenAI or Gemini SDK with base-URL environment variables. | No code changes: AgentCap sets `OPENAI_BASE_URL` and `GOOGLE_GEMINI_BASE_URL`. |
 
-Tested end-to-end against a local fake API with the real Codex and Gemini CLIs;
-not yet verified against live billing with a real key.
+Tested with a real Gemini API key on Gemini CLI 0.66 (spend metered from Google's
+usageMetadata, output clamped to the cap); Gemini CLI 0.58 and Codex CLI 0.163 are
+tested end-to-end against a local fake API only, not yet with real paid keys.
 
 ## How it works
 

{agentcap_cli-0.1.1 → agentcap_cli-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentcap-cli"
-version = "0.1.1"
+version = "0.1.2"
 description = "API-key spend guard for unattended Codex CLI and Gemini CLI runs: hard per-run cap, kills the process at the limit."
 readme = "README.md"
 requires-python = ">=3.11"

{agentcap_cli-0.1.1 → agentcap_cli-0.1.2}/src/agentcap/__init__.py

@@ -2,6 +2,6 @@
 
 from __future__ import annotations
 
-__version__ = "0.1.1"
+__version__ = "0.1.2"
 
 __all__ = ["__version__"]

{agentcap_cli-0.1.1 → agentcap_cli-0.1.2}/src/agentcap/adapters.py

@@ -6,13 +6,19 @@ Some agent CLIs do not honour a plain base-URL environment variable:
   transport.  It has to be pointed at the proxy with ``-c`` configuration
   overrides (``model_provider`` plus a custom provider that uses the Responses
   API over plain HTTP).
-* Gemini CLI reads a settings file for its authentication type when it runs
-  headless; a gateway base URL alone makes it pick an auth type that headless
-  mode rejects.  A temporary settings file selects ``gemini-api-key`` and is
-  removed after the run.
-
-Everything here is pure (apart from creating the temporary Gemini settings
-directory) so it can be unit-tested without spawning a process.
+* Gemini CLI reads settings for its authentication type when it runs headless;
+  a gateway base URL alone makes it pick an auth type that headless mode
+  rejects.  Gemini CLI >= 0.60 also refuses system settings files whose parent
+  directory is not owned by root, so the old
+  ``GEMINI_CLI_SYSTEM_SETTINGS_PATH`` overlay is silently skipped.  Instead a
+  temporary ``GEMINI_CLI_HOME`` is used: its ``.gemini`` directory links every
+  real user entry (history, ``trustedFolders.json``, OAuth credentials, ...)
+  and carries a real ``settings.json`` that selects ``gemini-api-key``.  The
+  overlay is removed after the run and nothing in the real ``~/.gemini`` is
+  modified.
+
+Everything here is pure (apart from creating the temporary Gemini home) so it
+can be unit-tested without spawning a process.
 """
 
 from __future__ import annotations
@@ -20,6 +26,7 @@ from __future__ import annotations
 import json
 import os
 import shutil
+import sys
 import tempfile
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -180,17 +187,128 @@ def ensure_codex_routing_is_safe(argv: Sequence[str]) -> None:
 
 
 # -------------------------------------------------------------------- Gemini
-def _read_settings(path: str | None) -> dict[str, object]:
-    """Read the existing settings JSON; unreadable/invalid files are ignored."""
+GEMINI_SETTINGS_FILENAME = "settings.json"
+
+_GEMINI_SETTINGS_WARNING = (
+    "agentcap: could not parse ~/.gemini/settings.json; "
+    "using defaults for this run"
+)
+
+
+def gemini_home(env: Mapping[str, str]) -> Path:
+    """The home directory Gemini would use without AgentCap's overlay."""
+
+    for name in ("GEMINI_CLI_HOME", "HOME"):
+        value = env.get(name)
+        if value and value.strip():
+            return Path(value)
+    return Path(os.path.expanduser("~"))
+
+
+def _strip_jsonc(text: str) -> str:
+    """Drop ``//`` and ``/* */`` comments plus trailing commas outside strings."""
+
+    without_comments: list[str] = []
+    in_string = False
+    escaped = False
+    index = 0
+    length = len(text)
+    while index < length:
+        char = text[index]
+        if in_string:
+            without_comments.append(char)
+            if escaped:
+                escaped = False
+            elif char == "\\":
+                escaped = True
+            elif char == '"':
+                in_string = False
+            index += 1
+            continue
+        if char == '"':
+            in_string = True
+            without_comments.append(char)
+            index += 1
+            continue
+        if char == "/" and index + 1 < length:
+            following = text[index + 1]
+            if following == "/":
+                index += 2
+                while index < length and text[index] not in "\r\n":
+                    index += 1
+                continue
+            if following == "*":
+                index += 2
+                while index + 1 < length and not (
+                    text[index] == "*" and text[index + 1] == "/"
+                ):
+                    index += 1
+                index += 2
+                continue
+        without_comments.append(char)
+        index += 1
+
+    text = "".join(without_comments)
+
+    result: list[str] = []
+    in_string = False
+    escaped = False
+    index = 0
+    length = len(text)
+    while index < length:
+        char = text[index]
+        if in_string:
+            result.append(char)
+            if escaped:
+                escaped = False
+            elif char == "\\":
+                escaped = True
+            elif char == '"':
+                in_string = False
+            index += 1
+            continue
+        if char == '"':
+            in_string = True
+            result.append(char)
+            index += 1
+            continue
+        if char == ",":
+            lookahead = index + 1
+            while lookahead < length and text[lookahead] in " \t\r\n":
+                lookahead += 1
+            if lookahead < length and text[lookahead] in "}]":
+                index += 1
+                continue
+        result.append(char)
+        index += 1
+    return "".join(result)
+
+
+def _parse_settings_text(text: str) -> dict[str, object] | None:
+    for candidate in (text, _strip_jsonc(text)):
+        try:
+            payload = json.loads(candidate)
+        except ValueError:
+            continue
+        return payload if isinstance(payload, dict) else None
+    return None
+
+
+def _read_user_settings(path: Path) -> dict[str, object]:
+    """Read the user's Gemini settings; missing files simply mean defaults."""
 
-    if not path:
-        return {}
     try:
-        with open(path, "r", encoding="utf-8") as handle:
-            payload = json.load(handle)
-    except (OSError, ValueError):
+        text = path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return {}
+    except OSError:
+        print(_GEMINI_SETTINGS_WARNING, file=sys.stderr)
+        return {}
+    payload = _parse_settings_text(text)
+    if payload is None:
+        print(_GEMINI_SETTINGS_WARNING, file=sys.stderr)
         return {}
-    return payload if isinstance(payload, dict) else {}
+    return payload
 
 
 def _deep_merge(
@@ -213,15 +331,42 @@ def gemini_settings_payload(existing: Mapping[str, object] | None) -> dict[str,
     return _deep_merge(existing or {}, GEMINI_SETTINGS)
 
 
-def _write_gemini_settings(source: str | None, directory: Path) -> Path:
-    payload = gemini_settings_payload(_read_settings(source))
-    path = directory / "settings.json"
-    with open(path, "w", encoding="utf-8") as handle:
+def _write_gemini_settings(existing: Mapping[str, object] | None, path: Path) -> Path:
+    payload = gemini_settings_payload(existing)
+    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
         json.dump(payload, handle, sort_keys=True)
         handle.write("\n")
+    os.chmod(path, 0o600)
     return path
 
 
+def _build_gemini_home(real_gemini: Path, root: Path) -> Path:
+    """Create ``<root>/.gemini`` linking the real entries and forcing auth."""
+
+    overlay = root / ".gemini"
+    overlay.mkdir(mode=0o700, exist_ok=True)
+    os.chmod(overlay, 0o700)
+    if real_gemini.is_dir():
+        for entry in sorted(real_gemini.iterdir()):
+            if entry.name == GEMINI_SETTINGS_FILENAME:
+                continue
+            try:
+                os.symlink(
+                    os.path.abspath(str(entry)),
+                    overlay / entry.name,
+                    target_is_directory=entry.is_dir(),
+                )
+            except OSError:
+                # Unsupported entry (or a race); the overlay still works.
+                continue
+    _write_gemini_settings(
+        _read_user_settings(real_gemini / GEMINI_SETTINGS_FILENAME),
+        overlay / GEMINI_SETTINGS_FILENAME,
+    )
+    return overlay
+
+
 # --------------------------------------------------------------------- entry
 def prepare_child(
     argv: Sequence[str],
@@ -234,7 +379,7 @@ def prepare_child(
     """Apply the routing adapter for the detected CLI, if any.
 
     The returned ``env`` is a copy: the caller's environment is never changed,
-    and the temporary Gemini settings directory is removed by ``cleanup``.
+    and the temporary Gemini home is removed by ``cleanup``.
     """
 
     prepared_argv = list(argv)
@@ -249,20 +394,21 @@ def prepare_child(
         prepared_argv[index:index] = codex_config_arguments(port)
         return PreparedChild(prepared_argv, prepared_env)
 
-    source = prepared_env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH")
-    directory = tempdir_factory(prefix="agentcap-gemini-")
-    path = Path(directory)
+    real_gemini = gemini_home(prepared_env) / ".gemini"
+    root = Path(tempdir_factory(prefix="agentcap-gemini-"))
     try:
-        settings_path = _write_gemini_settings(source, path)
+        os.chmod(root, 0o700)
+        _build_gemini_home(real_gemini, root)
     except BaseException:
-        shutil.rmtree(path, ignore_errors=True)
+        shutil.rmtree(root, ignore_errors=True)
         raise
-    prepared_env["GEMINI_CLI_SYSTEM_SETTINGS_PATH"] = str(settings_path)
+    prepared_env["GEMINI_CLI_HOME"] = str(root)
     if trust_workspace:
         prepared_env["GEMINI_CLI_TRUST_WORKSPACE"] = "true"
 
     def cleanup() -> None:
-        shutil.rmtree(path, ignore_errors=True)
+        # rmtree unlinks the entry symlinks instead of descending into them.
+        shutil.rmtree(root, ignore_errors=True)
 
     return PreparedChild(prepared_argv, prepared_env, cleanup)
 
@@ -271,11 +417,13 @@ __all__ = [
     "AdapterConflict",
     "CODEX_CONFLICT_MESSAGE",
     "GEMINI_SETTINGS",
+    "GEMINI_SETTINGS_FILENAME",
     "PreparedChild",
     "codex_config_arguments",
     "codex_conflicts",
     "detect_agent",
     "ensure_codex_routing_is_safe",
+    "gemini_home",
     "gemini_settings_payload",
     "prepare_child",
 ]

{agentcap_cli-0.1.1 → agentcap_cli-0.1.2}/src/agentcap/clamp.py

@@ -137,6 +137,8 @@ def apply_output_clamp(
     * Gemini: ``generationConfig.maxOutputTokens`` and, for thinking models,
       ``generationConfig.thinkingConfig.thinkingBudget``.  Both are billed as
       output, so the two limits together are kept within ``allowed_output``.
+      A client-supplied ``thinkingLevel`` is replaced by the budget: Gemini 3
+      rejects a request that sets both.
     """
 
     allowed = _positive_int(allowed_output)
@@ -232,6 +234,12 @@ def _apply_gemini_clamp(
     config["maxOutputTokens"] = text_limit
     thinking_key = _thinking_config_key(config)
     thinking_config = dict(config.get(thinking_key) or {})
+    # Gemini 3 rejects a thinking config that carries both limits ("You can
+    # only set only one of thinking budget and thinking level").  A requested
+    # level is therefore replaced by the explicit budget; every other key
+    # (``includeThoughts`` in particular) is preserved.
+    thinking_config.pop("thinkingLevel", None)
+    thinking_config.pop("thinking_level", None)
     thinking_config["thinkingBudget"] = thinking
     config[thinking_key] = thinking_config
     body[config_key] = config

{agentcap_cli-0.1.1 → agentcap_cli-0.1.2}/src/agentcap/devtools/fake_upstream.py

@@ -25,7 +25,10 @@ Prompt usage is realistic rather than fixed: ``max(1, ceil(text characters /
 Output usage is ``min(requested output limit, 2000)`` tokens, so a clamped
 request visibly produces a different bill.  For Gemini, ``thinkingBudget`` is
 honoured too: ``thoughtsTokenCount`` is ``min(thinkingBudget, 2000)`` and is
-billed as output, exactly like the real API.  Every response carries
+billed as output, exactly like the real API.  A thinking config that sets both
+``thinkingBudget`` and ``thinkingLevel`` is rejected with the real Gemini 3
+400 error ("You can only set only one of thinking budget and thinking level"),
+so a clamp regression fails loudly.  Every response carries
 ``x-fake-output-limit`` with the limit that was actually received (``none``
 when the request had no output limit).
 
@@ -130,13 +133,33 @@ def _gemini_limit(payload: Mapping[str, Any]) -> int | None:
     )
 
 
-def _gemini_thinking_budget(payload: Mapping[str, Any]) -> int | None:
+def _gemini_thinking_config(payload: Mapping[str, Any]) -> Mapping[str, Any]:
     config = _mapping(payload.get("generationConfig"))
     if not config:
         config = _mapping(payload.get("generation_config"))
     thinking = _mapping(config.get("thinkingConfig"))
     if not thinking:
         thinking = _mapping(config.get("thinking_config"))
+    return thinking
+
+
+def _gemini_thinking_limits_conflict(payload: Mapping[str, Any]) -> bool:
+    """Whether a thinking config sets both a budget and a level.
+
+    The real Gemini 3 API rejects that combination with a 400, so the fake
+    upstream must too (it catches clamp regressions end to end).
+    """
+
+    thinking = _gemini_thinking_config(payload)
+    has_budget = any(
+        key in thinking for key in ("thinkingBudget", "thinking_budget")
+    )
+    has_level = any(key in thinking for key in ("thinkingLevel", "thinking_level"))
+    return has_budget and has_level
+
+
+def _gemini_thinking_budget(payload: Mapping[str, Any]) -> int | None:
+    thinking = _gemini_thinking_config(payload)
     value = thinking.get("thinkingBudget", thinking.get("thinking_budget"))
     if isinstance(value, bool) or value is None:
         return None
@@ -208,6 +231,21 @@ def _not_found(what: str) -> JSONResponse:
     )
 
 
+def _gemini_thinking_conflict() -> JSONResponse:
+    return JSONResponse(
+        {
+            "error": {
+                "code": 400,
+                "message": (
+                    "You can only set only one of thinking budget and thinking level."
+                ),
+                "status": "INVALID_ARGUMENT",
+            }
+        },
+        status_code=400,
+    )
+
+
 # ------------------------------------------------------------------- OpenAI
 async def openai_chat(request: Request) -> Response:
     payload = await _json_body(request)
@@ -356,6 +394,8 @@ async def gemini_model(request: Request) -> Response:
     payload = await _json_body(request)
     if payload is None:
         return _invalid_body()
+    if _gemini_thinking_limits_conflict(payload):
+        return _gemini_thinking_conflict()
     limit = _gemini_limit(payload)
     thinking = _gemini_thinking_budget(payload)
     headers = _limit_header(limit)