coderouter-cli 2.7.8__py3-none-any.whl → 2.7.10__py3-none-any.whl

coderouter/adapters/agent_cli.py

@@ -1,9 +1,9 @@
 """External coding-agent CLI adapter (``kind="agent_cli"``).
 
 This adapter invokes an external coding-agent CLI (Claude Code / Codex /
-Gemini / Grok) as a single one-shot ``exec`` and returns the agent's final
-answer as one ``prompt in → text out`` transformation. It is the in-core
-implementation of the external-agents-adapter design
+Antigravity / Grok) as a single one-shot ``exec`` and returns the agent's
+final answer as one ``prompt in → text out`` transformation. It is the
+in-core implementation of the external-agents-adapter design
 (``docs/designs/external-agents-adapter.md``).
 
 Design in one paragraph
@@ -18,36 +18,68 @@ CodeRouter merely performs the one conversion. Following the
 ``openai_compat`` precedent, a *single* adapter class fronts *multiple*
 target agents, dispatched on the ``agent`` field.
 
-Implemented agents (Phase 1a + 1d)
-==================================
+Implemented agents (Phase 1 complete: 1a + 1b + 1c + 1d)
+==========================================================
 
-Two targets are implemented here:
+Four targets are implemented here:
 
 * ``claude`` (Claude Code CLI, Phase 1a) — the most stable CLI, the most
   fine-grained safety controls, and the only one that emits
   ``total_cost_usd`` directly (making it the reference implementation for
   the parser / cost path).
+* ``codex`` (codex CLI, Phase 1b) — headless one-shot via ``codex exec
+  --json``, prompt on stdin (like claude). The CLI is pre-1.0 and emits
+  defensively-parsed JSONL (one event per line); usage comes from
+  ``turn.completed`` events, normalized per design §5.1.6 with
+  ``cached_input_tokens`` kept as a *subset* of ``input_tokens`` (unlike
+  claude, which folds its cache buckets into ``prompt_tokens``).
+  ``--skip-git-repo-check`` and ``--ephemeral`` are always passed — the
+  isolated workdir is not a git repo, and the adapter never wants
+  session persistence.
 * ``grok`` (grok CLI, Phase 1d) — headless one-shot via ``--prompt-file`` +
   ``--output-format json``. The CLI emits no token/cost figures, so usage
   is reported as zeros (cost stays 0 unless the operator sets
   ``ProviderConfig.cost``, design §5.1.6). ``--no-memory`` is always passed
   so a user-level cross-session memory setting cannot leak state between
   requests.
-
-The remaining agents (codex / gemini) are declared in the config schema so
-providers.yaml is forward-compatible, but constructing an adapter for them
-raises a clear ``AdapterError`` until their phase (1b / 1c) lands.
+* ``antigravity`` (Antigravity CLI, command ``agy``, Phase 1c, in lieu of
+  ``gemini``) — headless one-shot via ``agy -p <prompt> --mode ...``.
+  Google discontinued the legacy Gemini CLI's OAuth for individual
+  accounts in June 2026 (field-verified ``IneligibleTierError`` /
+  ``UNSUPPORTED_CLIENT``); its successor, the Antigravity CLI, is a
+  separate Go implementation (not a gemini-cli fork) fulfilling the design's
+  "gemini" slot. It has no stdin or ``--prompt-file`` channel — piped stdin
+  hangs the CLI (field-verified on agy 1.1.1) — so the prompt rides argv
+  (see the security note below). Output is plain text with no
+  ``--output-format`` flag, no token/cost figures, and no session id, so
+  usage is reported as zeros and meta is empty, mirroring grok's rationale.
+  It is also the only agent with a CLI-side self-termination flag
+  (``--print-timeout``), layered *underneath* the adapter's own
+  ``asyncio.wait_for`` + PGID SIGKILL rather than replacing it.
+
+``gemini`` itself is declared in the config schema for backward-compatible
+config parsing, but constructing an adapter for it raises a clear
+``AdapterError`` with a migration pointer to ``agent="antigravity"``.
 
 Security (design §6, non-negotiable)
 ====================================
 
 * **allowlist argv only** — the child is launched with
   :func:`asyncio.create_subprocess_exec` and a list argv. ``shell=True`` is
-  never used; the prompt is never subject to shell interpretation (claude
-  reads it from stdin; grok reads it from a private ``0600`` prompt file
-  inside the resolved workdir — its ``-p`` requires the prompt as an argv
-  value, and argv would both hit Linux's ~128KiB ``MAX_ARG_STRLEN`` on huge
-  prompts and leak the text into ``ps`` output).
+  never used. Prompt delivery is one of three mechanisms depending on the
+  agent: claude and codex read it from stdin (codex's argv carries a
+  trailing ``-`` sentinel making that explicit); grok reads it from a
+  private ``0600`` prompt file inside the resolved workdir (its ``-p``
+  requires the prompt as an argv value, and argv would both hit Linux's
+  ~128KiB ``MAX_ARG_STRLEN`` on huge prompts and leak the text into ``ps``
+  output); antigravity has neither a stdin nor a ``--prompt-file`` channel
+  (piped stdin hangs the CLI, field-verified), so its prompt is carried on
+  argv — accepting the same ``MAX_ARG_STRLEN`` cap and local ``ps``
+  visibility that grok's file delivery was specifically designed to avoid.
+  No shell is involved in any case (list argv, never shell text), and the
+  documented threat model (an isolated, single-operator workstation) treats
+  local ``ps`` visibility as an accepted, documented limitation for
+  antigravity rather than a defect.
 * **default read-only** — ``allow_file_writes=False`` /
   ``sandbox_mode="read_only"`` are the defaults, mapped to claude's
   ``--permission-mode plan``. Writes require explicit opt-in and the sandbox
@@ -72,6 +104,7 @@ import asyncio
 import contextlib
 import json
 import os
+import re
 import shutil
 import signal
 import time
@@ -127,6 +160,40 @@ _GROK_SANDBOX_ARGS = {
     "full_auto": ["--sandbox", "workspace", "--always-approve"],
 }
 
+# sandbox_mode → codex ``-s/--sandbox`` value (design §5.4, codex-cli
+# 0.144.1, verified via facts-codex.md). ``codex exec`` has NO approval
+# flag at all (non-interactive, so there is no prompt to approve/skip), so
+# ``full_auto`` collapses onto the same ``workspace-write`` value as
+# ``edit`` — there is nothing further to "auto" beyond granting writes.
+_CODEX_SANDBOX_ARGS = {
+    "read_only": ["-s", "read-only"],
+    "edit": ["-s", "workspace-write"],
+    "full_auto": ["-s", "workspace-write"],
+}
+
+# sandbox_mode → antigravity ``--mode`` flags (design §5.4, Antigravity CLI
+# 1.1.1, verified via facts-antigravity.md). ``agy --help`` only enumerates
+# two ``--mode`` values (``plan`` / ``accept-edits``), so ``full_auto`` maps
+# onto ``accept-edits`` plus the separate ``--dangerously-skip-permissions``
+# flag (auto-approves all tool executions) rather than a third ``--mode``
+# value. ``--sandbox`` is deliberately never used here: it has a known bypass
+# bug when combined with ``--dangerously-skip-permissions`` (agy issue #36).
+_ANTIGRAVITY_MODE_ARGS = {
+    "read_only": ["--mode", "plan"],
+    "edit": ["--mode", "accept-edits"],
+    "full_auto": ["--mode", "accept-edits", "--dangerously-skip-permissions"],
+}
+
+# Compiled ANSI escape sequence stripper for antigravity's plain-text output
+# (design §5.1.6). Covers CSI sequences (``ESC [ ... final-byte``) plus bare
+# OSC-style ``ESC ]`` sequences terminated by BEL or ``ESC \`` (kept simple —
+# antigravity's TUI chrome is not fully specified, so this is a defensive
+# best-effort strip, not a full ANSI parser).
+_ANSI_RE = re.compile(
+    r"\x1b\[[0-9;?]*[ -/]*[@-~]"  # CSI ... final byte
+    r"|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)"  # OSC ... BEL or ST
+)
+
 
 def _chunk_text(text: str, size: int = _STREAM_CHUNK_CHARS) -> Iterator[str]:
     """Split ``text`` into ``size``-char pieces for the pseudo-stream."""
@@ -135,20 +202,26 @@ def _chunk_text(text: str, size: int = _STREAM_CHUNK_CHARS) -> Iterator[str]:
 
 
 class AgentCliAdapter(BaseAdapter):
-    """Invoke an external coding-agent CLI one-shot (claude + grok).
+    """Invoke an external coding-agent CLI one-shot (claude + codex + grok +
+    antigravity).
 
     The ``agent`` field selects the argv builder / output parser via the
     dispatch tables built in :meth:`__init__`, mirroring how
     ``openai_compat`` fronts many HTTP backends from one class.
     """
 
+    _IMPLEMENTED_AGENTS = ("claude", "codex", "grok", "antigravity")
+
     def __init__(self, config: ProviderConfig) -> None:
         """Bind to a ``ProviderConfig`` and reject unsupported agents.
 
-        Constructing an adapter for an agent other than ``claude`` / ``grok``
-        raises a non-retryable :class:`AdapterError` — the other targets are
-        declared in the schema but not implemented until their phase
-        (design §9).
+        ``gemini`` gets its own rejection message (non-retryable): Google
+        discontinued the Gemini CLI's OAuth for individual accounts in June
+        2026, so this adapter points the operator at ``antigravity``
+        instead of a generic "not implemented" message. Any other
+        unimplemented value (future-proofing; currently none, since the
+        schema's ``Literal`` only allows the five known agents) falls back
+        to a generic message listing what IS implemented.
         """
         super().__init__(config)
         if config.agent_cli is None:  # pragma: no cover - schema enforces this
@@ -158,30 +231,50 @@ class AgentCliAdapter(BaseAdapter):
                 retryable=False,
             )
         self.acfg: AgentCliConfig = config.agent_cli
-        if self.acfg.agent not in ("claude", "grok"):
+        if self.acfg.agent not in self._IMPLEMENTED_AGENTS:
+            if self.acfg.agent == "gemini":
+                raise AdapterError(
+                    "agent 'gemini' is not supported: Google discontinued "
+                    "the Gemini CLI for individual accounts (June 2026; "
+                    "IneligibleTierError). Use agent='antigravity' "
+                    "(Antigravity CLI, command 'agy') instead.",
+                    provider=config.name,
+                    retryable=False,
+                )
             raise AdapterError(
-                f"agent {self.acfg.agent!r} is not implemented yet "
-                f"(implemented: claude, grok). Wait for Phase 1b/1c.",
+                f"agent {self.acfg.agent!r} is not implemented "
+                f"(implemented: {', '.join(self._IMPLEMENTED_AGENTS)}).",
                 provider=config.name,
                 retryable=False,
             )
         # agent → argv builder / output parser dispatch tables. claude landed
-        # in Phase 1a, grok in Phase 1d; Phase 1b/1c add codex / gemini.
+        # in Phase 1a, codex in Phase 1b, grok in Phase 1d, antigravity in
+        # Phase 1c — all four (design §9) are now implemented.
         self._builders = {
             "claude": self._build_claude_argv,
+            "codex": self._build_codex_argv,
             "grok": self._build_grok_argv,
+            "antigravity": self._build_antigravity_argv,
         }
         self._parsers = {
             "claude": self._parse_claude,
+            "codex": self._parse_codex,
             "grok": self._parse_grok,
+            "antigravity": self._parse_antigravity,
         }
-        # Prompt delivery is per-agent: claude reads its print-mode prompt
-        # from stdin (10MB cap), which keeps argv free of the (potentially
-        # huge) prompt text. grok's ``-p`` REQUIRES the prompt as its argv
-        # value (piped stdin is only appended as extra context, verified on
-        # v0.2.93), so grok gets the prompt via ``--prompt-file`` instead —
-        # see ``_write_prompt_file`` for the rationale.
-        self._uses_stdin = self.acfg.agent == "claude"
+        # Prompt delivery is per-agent, one of three mechanisms: claude and
+        # codex read their prompt from stdin (10MB cap; codex's argv carries
+        # a trailing "-" sentinel making that explicit), which keeps argv
+        # free of the (potentially huge) prompt text. grok's ``-p``
+        # REQUIRES the prompt as its argv value (piped stdin is only
+        # appended as extra context, verified on v0.2.93), so grok gets the
+        # prompt via ``--prompt-file`` instead — see ``_write_prompt_file``
+        # for the rationale. antigravity has NEITHER a stdin nor a
+        # ``--prompt-file`` channel — piped stdin hangs the CLI outright
+        # (field-verified on agy 1.1.1) — so its prompt rides argv instead;
+        # see ``_build_antigravity_argv`` for the tradeoff this accepts.
+        self._uses_stdin = self.acfg.agent in ("claude", "codex")
+        self._uses_argv = self.acfg.agent == "antigravity"
 
     # ------------------------------------------------------------------
     # BaseAdapter contract
@@ -230,10 +323,16 @@ class AgentCliAdapter(BaseAdapter):
 
         # Agents that cannot take the prompt on stdin (grok) get it through a
         # private temp file inside the workdir; it is ALWAYS removed in the
-        # ``finally`` below, including on timeout / exception paths.
-        prompt_file = None if self._uses_stdin else self._write_prompt_file(prompt, workdir)
+        # ``finally`` below, including on timeout / exception paths. Argv
+        # agents (antigravity) get neither a file nor stdin bytes — the
+        # prompt text is handed straight to the builder instead.
+        prompt_file = (
+            None
+            if self._uses_stdin or self._uses_argv
+            else self._write_prompt_file(prompt, workdir)
+        )
         try:
-            argv = self._builders[self.acfg.agent](workdir, prompt_file)
+            argv = self._builders[self.acfg.agent](workdir, prompt_file, prompt)
             # Resolve the executable to an absolute path so argv[0] is a
             # concrete binary independent of the child's minimal PATH
             # (design §6 allowlist).
@@ -272,6 +371,10 @@ class AgentCliAdapter(BaseAdapter):
                     retryable=False,
                 ) from exc
 
+            # Non-stdin agents (grok's file delivery, antigravity's argv
+            # delivery) get None here, so ``communicate()`` closes stdin
+            # immediately without writing to it — verified required for
+            # antigravity, whose CLI hangs if anything is piped to stdin.
             stdin_bytes = prompt.encode("utf-8") if self._uses_stdin else None
             try:
                 stdout, stderr = await asyncio.wait_for(
@@ -341,7 +444,9 @@ class AgentCliAdapter(BaseAdapter):
     # claude argv builder + output parser
     # ------------------------------------------------------------------
 
-    def _build_claude_argv(self, workdir: str, prompt_file: str | None = None) -> list[str]:
+    def _build_claude_argv(
+        self, workdir: str, prompt_file: str | None = None, prompt: str | None = None
+    ) -> list[str]:
         """Assemble the ``claude -p`` argv (design §5.1.5 / §5.4).
 
         Shape::
@@ -350,12 +455,13 @@ class AgentCliAdapter(BaseAdapter):
                    --permission-mode <plan|acceptEdits> --add-dir <workdir>
 
         The prompt is fed on stdin (not argv), so it never appears here and
-        ``prompt_file`` is ignored (it exists only to keep the builder
-        signature uniform across agents). ``--bare`` is deliberately NOT
-        added — it would skip OAuth/keychain reads and break subscription
-        auth (design §5.3.4).
+        both ``prompt_file`` and ``prompt`` are ignored (they exist only to
+        keep the builder signature uniform across agents — see
+        ``_build_antigravity_argv`` for the one agent that needs ``prompt``).
+        ``--bare`` is deliberately NOT added — it would skip OAuth/keychain
+        reads and break subscription auth (design §5.3.4).
         """
-        del prompt_file  # claude takes the prompt on stdin, not from a file.
+        del prompt_file, prompt  # claude takes the prompt on stdin.
         model = self.acfg.model or self.config.model
         argv = [self.acfg.command, "-p", "--output-format", "json", "--model", model]
         if self.acfg.max_turns is not None:
@@ -465,11 +571,188 @@ class AgentCliAdapter(BaseAdapter):
             usage["duration_ms"] = data["duration_ms"]
         return usage
 
+    # ------------------------------------------------------------------
+    # codex argv builder + output parser (Phase 1b)
+    # ------------------------------------------------------------------
+
+    def _build_codex_argv(
+        self, workdir: str, prompt_file: str | None = None, prompt: str | None = None
+    ) -> list[str]:
+        """Assemble the ``codex exec`` argv (design §5.1.5 / §5.4, verified
+        against codex-cli 0.144.1 — see ``_codex/facts-codex.md``).
+
+        Shape::
+
+            codex exec --json --skip-git-repo-check --ephemeral
+                       -m <model> -C <workdir> -s <read-only|workspace-write> -
+
+        The prompt is fed on stdin (not argv), so it never appears here and
+        both ``prompt_file`` and ``prompt`` are ignored (they exist only to
+        keep the builder signature uniform across agents) — the trailing
+        ``-`` makes the stdin intent explicit to ``codex exec``, which
+        otherwise treats a bare invocation with no PROMPT arg the same way
+        but reads more ambiguously in a fixed argv list. ``--skip-git-repo-
+        check`` is ALWAYS passed because the isolated workdir is not a git
+        repository (without it the CLI exits 1). ``--ephemeral`` is ALWAYS
+        passed so no session state persists to disk, matching the adapter's
+        stateless one-shot ethos (the same rationale as grok's
+        ``--no-memory``). codex has no ``--max-turns`` equivalent, so
+        ``AgentCliConfig.max_turns`` is silently ignored here (documented in
+        the schema).
+        """
+        del prompt_file, prompt  # codex takes the prompt on stdin.
+        model = self.acfg.model or self.config.model
+        argv = [
+            self.acfg.command,
+            "exec",
+            "--json",
+            "--skip-git-repo-check",
+            "--ephemeral",
+            "-m",
+            model,
+            "-C",
+            workdir,
+        ]
+        argv += self._codex_sandbox_args()
+        argv += ["-"]
+        return argv
+
+    def _codex_sandbox_args(self) -> list[str]:
+        """Map ``sandbox_mode`` → codex ``-s/--sandbox`` flags, clamped.
+
+        Same clamp as claude/grok (design §5.4): when ``allow_file_writes``
+        is False the effective mode is forced to ``read_only`` regardless of
+        ``sandbox_mode``, so writes always require the explicit opt-in.
+        ``codex exec`` has no approval flag in 0.144.1 (non-interactive, so
+        there is nothing to approve), so ``full_auto`` maps onto the same
+        ``workspace-write`` value as ``edit`` —
+        ``--dangerously-bypass-approvals-and-sandbox`` is never used.
+        """
+        mode = self.acfg.sandbox_mode if self.acfg.allow_file_writes else "read_only"
+        return list(_CODEX_SANDBOX_ARGS[mode])
+
+    def _parse_codex(
+        self, stdout: bytes, stderr: bytes
+    ) -> tuple[str, dict[str, Any], dict[str, Any]]:
+        """Parse codex ``exec --json`` JSONL output (verified codex-cli
+        0.144.1, ``_codex/facts-codex.md``).
+
+        Real-run shape (one JSON object per line, newline-delimited)::
+
+            {"type":"thread.started","thread_id":"<uuid>"}
+            {"type":"turn.started"}
+            {"type":"item.completed","item":{"id":"item_0","type":"agent_message","text":"2"}}
+            {"type":"turn.completed","usage":{"input_tokens":13810,"cached_input_tokens":9984,"output_tokens":5,"reasoning_output_tokens":0}}
+
+        The CLI is pre-1.0 and its JSON schema is not frozen, so parsing is
+        deliberately defensive at every level: individual lines that fail to
+        parse (or parse to something other than a JSON object) are SKIPPED
+        rather than aborting the whole parse — stray non-JSON noise on
+        stdout should not sink an otherwise-valid answer. The final answer
+        is the LAST ``item.completed`` event whose ``item`` is an
+        ``agent_message`` with a string ``text``. If a completed answer was
+        found, it is returned even when a later ``error`` / ``turn.failed``
+        event also appears (a completed answer beats a trailing error); if
+        no answer was found, an ``error`` / ``turn.failed`` event (or the
+        total absence of any agent_message) raises a retryable
+        :class:`AdapterError`.
+        """
+        text = stdout.decode("utf-8", "replace")
+        if not text.strip():
+            raise AdapterError(
+                "codex produced no stdout to parse",
+                provider=self.name,
+                retryable=True,
+            )
+
+        final_text: str | None = None
+        thread_id: str | None = None
+        failure_event: dict[str, Any] | None = None
+        prompt_tokens = 0
+        completion_tokens = 0
+        cached_tokens = 0
+        reasoning_tokens = 0
+
+        for line in text.splitlines():
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                event = json.loads(line)
+            except json.JSONDecodeError:
+                # Defensive against stray non-JSON noise (progress text that
+                # leaked onto stdout, partial writes, etc.) — skip the line.
+                continue
+            if not isinstance(event, dict):
+                continue
+
+            etype = event.get("type")
+            if etype == "thread.started":
+                tid = event.get("thread_id")
+                if isinstance(tid, str):
+                    thread_id = tid
+            elif etype == "item.completed":
+                item = event.get("item")
+                if (
+                    isinstance(item, dict)
+                    and item.get("type") == "agent_message"
+                    and isinstance(item.get("text"), str)
+                ):
+                    final_text = item["text"]
+            elif etype == "turn.completed":
+                usage = event.get("usage")
+                usage = usage if isinstance(usage, dict) else {}
+
+                def _int(key: str, _usage: dict[str, Any] = usage) -> int:
+                    value = _usage.get(key)
+                    return int(value) if isinstance(value, (int, float)) else 0
+
+                prompt_tokens += _int("input_tokens")
+                completion_tokens += _int("output_tokens")
+                cached_tokens += _int("cached_input_tokens")
+                reasoning_tokens += _int("reasoning_output_tokens")
+            elif etype in ("error", "turn.failed"):
+                failure_event = event
+
+        if final_text is None:
+            if failure_event is not None:
+                raise AdapterError(
+                    f"codex reported {failure_event.get('type')}: {failure_event!r}"[:500],
+                    provider=self.name,
+                    retryable=True,
+                )
+            raise AdapterError(
+                "codex JSONL output contained no agent_message",
+                provider=self.name,
+                retryable=True,
+            )
+
+        # cached_input_tokens is a SUBSET of input_tokens (not additive) —
+        # verified sample: input 13810 ⊇ cached 9984 — so it is preserved
+        # under prompt_tokens_details rather than folded into prompt_tokens
+        # (this differs from claude's normalization, design §5.1.6).
+        usage_out: dict[str, Any] = {
+            "prompt_tokens": prompt_tokens,
+            "completion_tokens": completion_tokens,
+            "total_tokens": prompt_tokens + completion_tokens,
+        }
+        if cached_tokens > 0:
+            usage_out["prompt_tokens_details"] = {"cached_tokens": cached_tokens}
+        if reasoning_tokens > 0:
+            usage_out["completion_tokens_details"] = {"reasoning_tokens": reasoning_tokens}
+
+        meta: dict[str, Any] = {}
+        if thread_id is not None:
+            meta["coderouter_session_id"] = thread_id
+        return final_text, usage_out, meta
+
     # ------------------------------------------------------------------
     # grok argv builder + output parser (Phase 1d)
     # ------------------------------------------------------------------
 
-    def _build_grok_argv(self, workdir: str, prompt_file: str | None = None) -> list[str]:
+    def _build_grok_argv(
+        self, workdir: str, prompt_file: str | None = None, prompt: str | None = None
+    ) -> list[str]:
         """Assemble the grok headless argv (design §5, grok CLI v0.2.93).
 
         Shape::
@@ -483,8 +766,11 @@ class AgentCliAdapter(BaseAdapter):
         would hit Linux's ~128KiB ``MAX_ARG_STRLEN`` on large prompts and
         leak the text into ``ps`` output. ``--no-memory`` is deliberate: it
         enforces the one-request-one-transformation statelessness even if
-        the user's grok config enables cross-session memory.
+        the user's grok config enables cross-session memory. ``prompt`` is
+        ignored (it exists only to keep the builder signature uniform across
+        agents — grok never takes it on argv).
         """
+        del prompt
         if prompt_file is None:  # pragma: no cover - generate() always supplies it
             raise AdapterError(
                 "grok argv requires a prompt file",
@@ -577,6 +863,108 @@ class AgentCliAdapter(BaseAdapter):
             meta["coderouter_session_id"] = session_id
         return result, usage, meta
 
+    # ------------------------------------------------------------------
+    # antigravity argv builder + output parser (Phase 1c, in lieu of gemini)
+    # ------------------------------------------------------------------
+
+    def _build_antigravity_argv(
+        self, workdir: str, prompt_file: str | None = None, prompt: str | None = None
+    ) -> list[str]:
+        """Assemble the ``agy -p`` argv (design §5.1.5 / §5.4, verified
+        against Antigravity CLI 1.1.1 — see ``_codex/facts-antigravity.md``).
+
+        Shape::
+
+            agy -p <prompt> --model <m> --mode <plan|accept-edits>
+                [--dangerously-skip-permissions] --print-timeout <n>s
+
+        ``workdir`` is unused here — antigravity picks up its working
+        directory from the child process's ``cwd`` (set by ``generate()``),
+        and this adapter deliberately never passes ``--add-dir`` (design
+        keeps the argv minimal; only claude's multi-root model needs it).
+        ``prompt_file`` is unused (antigravity has no such flag).
+
+        Prompt-delivery tradeoff (read this before touching the ``-p``
+        line): agy has no stdin channel — piping content to stdin makes the
+        real CLI hang waiting for a response that never comes (field-
+        verified on 1.1.1) — and no ``--prompt-file`` equivalent either. The
+        prompt therefore rides argv as the ``-p`` value, which is the *only*
+        delivery mechanism the CLI offers. This caps practical prompt size
+        at Linux's ~128KiB ``MAX_ARG_STRLEN`` and exposes the prompt text to
+        ``ps`` on the local host — exactly the two costs grok's
+        ``--prompt-file`` delivery was built to avoid (see the module
+        docstring's security section). No shell is involved (list argv, not
+        shell text), and the adapter's threat model — an isolated,
+        single-operator workstation — accepts local ``ps`` visibility as a
+        documented limitation rather than a defect; there is no safer
+        channel to fall back to.
+
+        ``--print-timeout`` is antigravity's own self-termination clock,
+        derived from ``exec_timeout_s`` — it is the CLI's *first* wall
+        against a hung call; the adapter's outer ``asyncio.wait_for`` +
+        process-group ``SIGKILL`` remains the second, unconditional wall
+        (design §6). ``max_turns`` is never emitted: agy has no ``--max-
+        turns``-equivalent flag (like codex), so ``AgentCliConfig.max_turns``
+        is silently ignored here (documented in the schema). No ``--sandbox``
+        (known bypass bug alongside ``--dangerously-skip-permissions``,
+        agy issue #36) and no ``--add-dir`` are ever passed.
+        """
+        del prompt_file  # antigravity has no prompt-file flag.
+        if prompt is None:  # pragma: no cover - generate() always supplies it
+            raise AdapterError(
+                "antigravity argv requires the prompt text",
+                provider=self.name,
+                retryable=False,
+            )
+        model = self.acfg.model or self.config.model
+        argv = [self.acfg.command, "-p", prompt, "--model", model]
+        argv += self._antigravity_mode_args()
+        argv += ["--print-timeout", f"{int(self.acfg.exec_timeout_s)}s"]
+        return argv
+
+    def _antigravity_mode_args(self) -> list[str]:
+        """Map ``sandbox_mode`` → antigravity ``--mode`` flags, clamped.
+
+        Same clamp as claude/codex/grok (design §5.4): when
+        ``allow_file_writes`` is False the effective mode is forced to
+        ``read_only`` regardless of ``sandbox_mode``, so writes always
+        require the explicit opt-in.
+        """
+        mode = self.acfg.sandbox_mode if self.acfg.allow_file_writes else "read_only"
+        return list(_ANTIGRAVITY_MODE_ARGS[mode])
+
+    def _parse_antigravity(
+        self, stdout: bytes, stderr: bytes
+    ) -> tuple[str, dict[str, Any], dict[str, Any]]:
+        """Parse antigravity's plain-text ``-p`` output (verified agy 1.1.1).
+
+        There is no ``--output-format`` flag at all (agy's ``--help`` does
+        not list one) — output is whatever the model printed, decorated
+        with whatever terminal styling the CLI applied even in non-TTY runs.
+        Parsing is therefore: UTF-8 decode (defensively, replacing invalid
+        bytes) → strip ANSI escape sequences (``_ANSI_RE``, best-effort, see
+        its definition) → ``.strip()`` surrounding whitespace. Empty output
+        raises a retryable :class:`AdapterError` so the chain can fall
+        through. There is no token/cost figure and no session id anywhere
+        in agy's output, so ``usage`` is all-zeros (cost stays 0 unless the
+        operator sets ``ProviderConfig.cost``, same rationale as grok,
+        design §5.1.6) and ``meta`` is empty.
+        """
+        text = _ANSI_RE.sub("", stdout.decode("utf-8", "replace")).strip()
+        if not text:
+            raise AdapterError(
+                "antigravity produced no stdout",
+                provider=self.name,
+                retryable=True,
+            )
+        usage: dict[str, Any] = {
+            "prompt_tokens": 0,
+            "completion_tokens": 0,
+            "total_tokens": 0,
+        }
+        meta: dict[str, Any] = {}
+        return text, usage, meta
+
     # ------------------------------------------------------------------
     # helpers: prompt rendering, response shaping, env, workdir, kill
     # ------------------------------------------------------------------

coderouter/config/schemas.py

@@ -168,13 +168,18 @@ class AgentCliConfig(BaseModel):
 
     Introduced by the external-agents-adapter design (Phase 1). One
     ``agent_cli`` sub-config drives the :class:`AgentCliAdapter`, which
-    invokes an external coding-agent CLI (codex / gemini / grok / claude)
-    in a single one-shot ``exec`` and returns the final answer as one
-    ``prompt in → text out`` transformation. ``claude`` (Claude Code CLI,
-    Phase 1a) and ``grok`` (grok CLI, Phase 1d) are implemented;
-    codex / gemini are declared at the schema level so configs are
-    forward-compatible, but the adapter rejects them until their phase
-    lands.
+    invokes an external coding-agent CLI (codex / gemini / grok / claude /
+    antigravity) in a single one-shot ``exec`` and returns the final answer
+    as one ``prompt in → text out`` transformation. ``claude`` (Claude Code
+    CLI, Phase 1a), ``codex`` (codex CLI, Phase 1b), ``grok`` (grok CLI,
+    Phase 1d) and ``antigravity`` (Antigravity CLI, Phase 1c, in lieu of
+    ``gemini``) are implemented. ``gemini`` is declared at the schema level
+    for backward-compatible config parsing, but the adapter rejects it with
+    a migration pointer: Google discontinued the (legacy) Gemini CLI's
+    OAuth for individual accounts in June 2026 (``IneligibleTierError`` /
+    ``UNSUPPORTED_CLIENT`` on the real client) and its successor is the
+    Antigravity CLI (command ``agy``, a separate Go implementation, not a
+    gemini-cli fork) — set ``agent: "antigravity"`` instead.
 
     Auth note (grok): the grok CLI uses OAuth credentials stored under
     ``~/.grok`` (``grok login``), which the adapter's HOME inheritance
@@ -182,24 +187,49 @@ class AgentCliConfig(BaseModel):
     ``GROK_CODE_XAI_API_KEY`` in ``passthrough_env`` (this is grok's key
     env var — NOT ``XAI_API_KEY``).
 
+    Auth note (codex): the codex CLI uses a ChatGPT-plan OAuth login stored
+    under ``~/.codex`` (``codex login``), which the adapter's HOME
+    inheritance already covers — the credentials go stale after roughly 8
+    days and are auto-refreshed on use, so no extra config is needed for
+    interactive/subscription setups. For CI / API-key setups, list
+    ``CODEX_API_KEY`` (exec-only) or ``OPENAI_API_KEY`` (general) in
+    ``passthrough_env``.
+
+    Auth note (antigravity): the Antigravity CLI uses a Google-account OAuth
+    login (free tier included), with credentials preferentially stored in
+    the OS keyring and mirrored under ``~/.gemini/antigravity-cli/``
+    (``credentials.enc`` / ``settings.json``) — the adapter's HOME (and, on
+    macOS, USER) inheritance already covers this, no extra config needed.
+    Any API-key environment variable for CI / non-interactive setups is
+    UNCONFIRMED (field reports disagree on the variable name) — this
+    docstring deliberately does not name one as authoritative; if you find
+    one that works, list it in ``passthrough_env``.
+
     Follows the ``extra="forbid"`` convention used across this module so a
     typo'd key fails at config-load rather than being silently ignored.
     """
 
     model_config = ConfigDict(extra="forbid")
 
-    agent: Literal["codex", "gemini", "grok", "claude"] = Field(
+    agent: Literal["codex", "gemini", "grok", "claude", "antigravity"] = Field(
         ...,
         description=(
-            "External coding-agent CLI to invoke. 'claude' (Phase 1a) and "
-            "'grok' (Phase 1d) are implemented; 'codex' / 'gemini' pending."
+            "External coding-agent CLI to invoke. 'claude' (Phase 1a), "
+            "'codex' (Phase 1b), 'grok' (Phase 1d) and 'antigravity' "
+            "(Phase 1c, Google's Antigravity CLI, command 'agy') are "
+            "implemented. 'gemini' is rejected by the adapter — Google "
+            "discontinued the Gemini CLI for individual accounts in June "
+            "2026; use 'antigravity' instead."
         ),
     )
     command: str | None = Field(
         default=None,
         description=(
             "CLI executable name or absolute path (resolved via PATH). "
-            "When unset, defaults to the ``agent`` name."
+            "When unset, defaults to the ``agent`` name — EXCEPT "
+            "'antigravity', whose binary is named ``agy`` (the product is "
+            "'Antigravity CLI' but the executable keeps the short, "
+            "pre-rename command name)."
         ),
     )
     workdir: str | None = Field(
@@ -282,9 +312,14 @@ class AgentCliConfig(BaseModel):
         ``sandbox_mode="read_only"`` is contradictory — the operator asked
         for writes while pinning a read-only sandbox. Fail fast at load,
         matching the module's other cross-field validators.
+
+        ``command`` defaults to the ``agent`` name for every agent EXCEPT
+        ``antigravity``, whose binary is ``agy`` — the product renamed from
+        Gemini CLI to Antigravity CLI, but the executable kept its short
+        pre-rename name.
         """
         if self.command is None:
-            self.command = self.agent
+            self.command = "agy" if self.agent == "antigravity" else self.agent
         if self.allow_file_writes and self.sandbox_mode == "read_only":
             raise ValueError(
                 "agent_cli: allow_file_writes=True conflicts with "

{coderouter_cli-2.7.8.dist-info → coderouter_cli-2.7.10.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coderouter-cli
-Version: 2.7.8
+Version: 2.7.10
 Summary: Local-first, free-first, fallback-built-in LLM router. Claude Code / OpenAI compatible.
 Project-URL: Homepage, https://github.com/zephel01/CodeRouter
 Project-URL: Repository, https://github.com/zephel01/CodeRouter

{coderouter_cli-2.7.8.dist-info → coderouter_cli-2.7.10.dist-info}/RECORD

@@ -16,7 +16,7 @@ coderouter/output_filters.py,sha256=0ry_rPiS_kC-FnHgaNVP6v7e6Al2djxzu9vBzZ8kEkE,
 coderouter/token_estimation.py,sha256=iz22vZEEW2P7uKLB2pYvPNpIbZGbgXRO5MtfkS_-9Sk,7531
 coderouter/token_estimation_accurate.py,sha256=GTfzrBVnvAGjeVzmzAeUdOYZvWZKLAxcxPpFiJGlzjk,4609
 coderouter/adapters/__init__.py,sha256=7dIDSZ-FE_0iSqLSDc_lK1idRdLTKcM2hP9tCJipgPI,463
-coderouter/adapters/agent_cli.py,sha256=_-9DsSO-zQJI-bEldBhFgIBbAQd6kqMCqX7xNy8WqtQ,32992
+coderouter/adapters/agent_cli.py,sha256=0g0V92drEQLJACXq-Dn0hE-J6e3vmsuBr5UdnAkXJyk,52430
 coderouter/adapters/anthropic_native.py,sha256=CT9Hitun-c3z83YHT2zZXgwZpY3_t6eRnOfAmNud2aw,23610
 coderouter/adapters/base.py,sha256=ykKMaiIVVGr23oFFXilK2iP_YhI8-CtsEiJyFXaC9bE,10396
 coderouter/adapters/openai_compat.py,sha256=wcrd_UpV7N6ISpUyKvdFPGU-YjCrX5oMqGpjAFEeWfg,20356
@@ -25,7 +25,7 @@ coderouter/config/__init__.py,sha256=FODEn74fN-qZnt4INPSHswqhOlEgpL6-_onxsitSx8g
 coderouter/config/capability_registry.py,sha256=RZgzHF54dXy0CCDocRCz2ee21qXGbbgTSKTkRI9iLL4,16936
 coderouter/config/env_file.py,sha256=CoMK27fuAXm-NtoLzXb8yN2E-wDFjHQuFwiIlmgTBQw,10356
 coderouter/config/loader.py,sha256=FUEe8m4Tnmj_aul0vSctD8vKvNW-oLRoMRbTpSKqSmc,4077
-coderouter/config/schemas.py,sha256=c5VJkcsuPHIKgTtcRQnXL-q52ollsWOISnDC8RuOX70,86528
+coderouter/config/schemas.py,sha256=sizuuxBgavGWaxBi7MtbLi0al-Ba72H7iVgI7CRYgMY,88835
 coderouter/data/__init__.py,sha256=uNyfD9jaCvTWsBAWtaw1Fr25OSxzv3psGMfBjT1z0Cc,328
 coderouter/data/model-capabilities.yaml,sha256=S9jt6SC6-3s2-icZ_n-a14iEMnc2yB1C2R6q-N_tZWQ,19309
 coderouter/guards/__init__.py,sha256=5qliYBqygvVPneej7nx0uSjxDKsz7t8VzvrDgVBJlvU,1170
@@ -69,8 +69,8 @@ coderouter/translation/__init__.py,sha256=PYXN7XVEwpG1uC8RLy6fvnGbzEZhhrEuUapH8I
 coderouter/translation/anthropic.py,sha256=aZkcYH4x82b0x7efJgJb9RWn9Hbyc9pEOthXe4vjUdU,11113
 coderouter/translation/convert.py,sha256=VV4kpu4dvLmGBmJfQnCLY5ryy_AnQcV2NuwjqRtaR8Q,52633
 coderouter/translation/tool_repair.py,sha256=DGOKArM53yfVbIfiAveoul1vGq9NEKmjagf43Qh4IkM,57630
-coderouter_cli-2.7.8.dist-info/METADATA,sha256=S3XO80V0pWn7ifsjuoMOEYcU0Cnru5WIADYIq9-PQb4,15546
-coderouter_cli-2.7.8.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-coderouter_cli-2.7.8.dist-info/entry_points.txt,sha256=-dnLfD1YZ2WjH2zSdNCvlO65wYltM9bsHt9Fhg3yGss,51
-coderouter_cli-2.7.8.dist-info/licenses/LICENSE,sha256=wkEzoR86jFw33jvfOHjULqmkGEfxTFMgMaJnpR8mPRw,1065
-coderouter_cli-2.7.8.dist-info/RECORD,,
+coderouter_cli-2.7.10.dist-info/METADATA,sha256=4AzX8XCERv5Hd1iywyybjR1gjsyfBh72bFF24YLH85U,15547
+coderouter_cli-2.7.10.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+coderouter_cli-2.7.10.dist-info/entry_points.txt,sha256=-dnLfD1YZ2WjH2zSdNCvlO65wYltM9bsHt9Fhg3yGss,51
+coderouter_cli-2.7.10.dist-info/licenses/LICENSE,sha256=wkEzoR86jFw33jvfOHjULqmkGEfxTFMgMaJnpR8mPRw,1065
+coderouter_cli-2.7.10.dist-info/RECORD,,