codex-antigravity-auth 2.2.0__tar.gz → 2.3.0__tar.gz

{codex_antigravity_auth-2.2.0/codex_antigravity_auth.egg-info → codex_antigravity_auth-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-antigravity-auth
-Version: 2.2.0
+Version: 2.3.0
 Summary: Google Antigravity OAuth model access for OpenAI Codex
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/Reedtrullz/codex-antigravity-auth
@@ -65,7 +65,7 @@ Use `$anti` only as an optional sidecar reviewer/planner after the gateway is wo
 - **OS-Native Keyring Encryption**: Encrypts Google account tokens and stored BYOK provider config at rest via macOS Keychain, Windows Credential Manager, Linux Secret Service, or a private local fallback key.
 - **Transaction-Safe Cooldown Rotations**: Automatically rotates accounts on backend failures (such as `401`, `403`, or `429` rate limiters) with clean exponential backoff.
 - **High-Fidelity SSE Translation**: Translates stream candidate envelopes, role alignments, reasoning-text deltas, function-call items, and VALIDATED tool parameter modes into Responses API events.
-- **BYOK Provider Routing**: Route model IDs like `deepseek:deepseek-v4-pro`, `bluesminds:grok-4.5`, `bluesminds:z-ai/glm-5.2`, `xai:grok-code-fast-1`, and custom OpenAI-compatible endpoints through encrypted API-key config.
+- **BYOK Provider Routing**: Route model IDs like `deepseek:deepseek-v4-pro`, `xai:grok-code-fast-1`, `kimi:kimi-k2-0711-preview`, `ollama:gpt-oss:20b`, and custom OpenAI-compatible endpoints through encrypted API-key config.
 
 ## Installation
 
@@ -185,32 +185,19 @@ The skill also ships a helper-level panel mode inspired by MoA/Fusion workflows.
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode review --scope staged
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode plan --scope working-tree --prompt "Plan this PR"
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode ask --model sonnet --model openrouter:deepseek/deepseek-chat --judge opus --prompt "Compare these approaches"
-python3 ~/.codex/skills/anti/scripts/anti.py panel --mode ask --collab claude-grok --prompt "Compare these approaches"
-python3 ~/.codex/skills/anti/scripts/anti.py panel --mode ask --collab claude-grok --model sonnet --model opus --model grok-bluesminds --prompt "Compare these approaches"
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode review --scope staged --output findings
-python3 ~/.codex/skills/anti/scripts/anti.py moa --mode review --model deepseek-v4-pro --model glm-5.2 --judge opus --scope staged
-python3 ~/.codex/skills/anti/scripts/anti.py fusion --mode plan --model opus --model glm-5.2 --judge opus --scope working-tree --prompt "Plan this repository change"
+python3 ~/.codex/skills/anti/scripts/anti.py moa --mode review --model deepseek-v4-pro --judge opus --scope staged
+python3 ~/.codex/skills/anti/scripts/anti.py fusion --mode plan --model opus --model deepseek-v4-pro --judge opus --scope working-tree --prompt "Plan this repository change"
 ```
 
-Panel consensus is not proof and should not patch code directly. Structured findings include `id`, `claim`, `severity`, `lanes`, and `verify`; run the `verify` hint locally before acting. Text and JSON outputs include per-lane/judge usage and latency when the gateway/provider returns it. Broad review panels summarize oversized scopes once before fan-out instead of silently truncating raw context for every lane.
+Panel consensus is not proof and should not patch code directly. Structured findings include `id`, `claim`, `severity`, `lanes`, and `verify`; run the `verify` hint locally before acting. Findings remain `unverified` until native/local checks confirm or reject them. Text and JSON outputs include per-lane/judge usage and latency when the gateway/provider returns it. Broad review panels summarize oversized scopes once before fan-out instead of silently truncating raw context for every lane.
 
-Panel JSON keeps requested and actual execution identities separate (`requestedModel`, `actualModel`, `provider`, `fallbackChain`, `primaryError`, and `fallbackReason`). The panel status is `complete_multi_model`, `partial_multi_model`, `degraded_single_model`, or `failed`; distinct actual provider/model identities, rather than repeated logical fallback lanes, satisfy `--min-successes`. `/v1/models` is only a catalog/readiness hint—the bounded generation call is the live model health check.
+Panel JSON keeps requested and actual execution identities separate (`requestedModel`, `actualModel`, `provider`, `fallbackChain`, `primaryError`, and `fallbackReason`). The panel status is `complete_multi_model`, `partial_multi_model`, `same_provider_multi_model`, `degraded_single_model`, or `failed`; distinct actual provider/model identities, rather than repeated logical fallback lanes, satisfy `--min-successes`, and `--min-providers` can require provider diversity. `/v1/models` is only a catalog/readiness hint—the bounded generation call is the live model health check. Every saved run exposes top-level `runStatus`, `scopeStatus`, `panelStatus`, `coverage`, and `resultPath`.
 When the diversity minimum is not met, the panel fails closed before judge synthesis; `--json` and `--output findings` still return the lane evidence and status with a non-zero exit code.
 
-`--collab claude-grok` is an explicit collaboration profile for Claude plus Grok panels. It defaults to Sonnet, Opus, and `grok` (`xai-oauth:grok-build-0.1`), gives Claude and Grok complementary review instructions, and asks the Opus judge to compare Claude-backed and Grok-backed disagreements before recommending verification steps. `grok-oauth` selects that same OAuth route explicitly. To use BluesMinds deliberately, pass `--model sonnet --model opus --model grok-bluesminds`; `grok-bluesminds` and `grok-4.5` resolve to `bluesminds:grok-4.5`. The helper never silently fails over between the routes. If a requested Grok lane is not visible in `/v1/models`, it is recorded as a failed lane unless `--min-successes` makes the whole panel fail.
+Panel lanes are selected explicitly from the native Sonnet/Opus defaults or from models advertised by the running gateway. BYOK examples include `openrouter:...`, `deepseek:...`, `xai:...`, `kimi:...`, `ollama:...`, and `opencode:...`; they require the corresponding API key or a key-optional local provider. When a BYOK lane receives repository, diff, or file context, the helper prints and records a disclosure naming the provider lane. Virtual picker models such as `panel:*`, `moa:*`, or `fusion:*` remain helper aliases rather than gateway-side fan-out.
 
-BYOK panel models such as `openrouter:...` or `xai-oauth:...` only work when the running gateway advertises them in `/v1/models`, which requires usable provider keys, key-optional local provider setup, or a refreshable OAuth login. When a BYOK lane receives repository, diff, or file context, the helper prints and records a disclosure naming the provider lanes. Virtual picker models such as `panel:*`, `moa:*`, or `fusion:*` are not supported; MoA/Fusion remains a helper workflow, not gateway-side orchestration.
-
-### Choosing complementary reviewer lanes
-
-- DeepSeek V4 Flash is for a fast code second opinion, debugging, and an explicitly selected retryable fallback. It is never an automatic cross-provider fallback.
-- DeepSeek V4 Pro is for correctness, security, architecture, and deep code review. Treat it as unproven until the live V4 Pro generation, structured-output, and tool-loop gate passes.
-- xAI OAuth Grok is for adversarial assumptions, runtime surprises, and product/UX blind spots.
-- BluesMinds Grok/GLM aliases exist but remain unavailable/degraded until the requested route is advertised by `/v1/models` and the provider live-health gate passes. Every BluesMinds example is conditional on both checks.
-
-The normal service intentionally omits BluesMinds. The last bounded live checks returned a billing error for Grok 4.5 and an upstream 429 for GLM-5.2, so neither route is operationally enabled.
-
-A future enablement gate must pass first in a temporary process: catalog identity; non-streaming output and exact model identity; SSE completion and `[DONE]`; structured JSON; tool call and continuation; usage accounting; and bounded retries and no billing/capacity error. Only then may a later authorized task add `BLUESMINDS_API_KEY=op://...` to the durable service reference file and reinstall the service.
+The current xAI preset is API-key based and uses `XAI_API_KEY`. Provider availability is determined by the gateway's `/v1/models` catalog; a catalog entry is not proof that a live generation will succeed.
 
 Repository context leaves the Google Antigravity lane only after explicit selection and the existing BYOK disclosure. Opus remains the default judge; native Codex remains the acting agent and must verify advisory output locally.
 
@@ -221,16 +208,13 @@ python3 ~/.codex/skills/anti/scripts/anti.py workflow review-ready --scope stage
 python3 ~/.codex/skills/anti/scripts/anti.py workflow plan-deep --scope working-tree --prompt "Plan this PR" --progress
 python3 ~/.codex/skills/anti/scripts/anti.py workflow ship-gate --scope diff --base origin/main --json
 python3 ~/.codex/skills/anti/scripts/anti.py workflow provider-compare --model sonnet --model openrouter:deepseek/deepseek-chat --prompt "Compare these approaches"
-python3 ~/.codex/skills/anti/scripts/anti.py workflow provider-compare --model deepseek-v4-pro --model glm-5.2 --prompt "Compare long-context planning approaches"
+python3 ~/.codex/skills/anti/scripts/anti.py workflow provider-compare --model deepseek-v4-pro --prompt "Compare this approach with the native review lane"
 python3 ~/.codex/skills/anti/scripts/anti.py workflow security-review --scope staged --output findings
 python3 ~/.codex/skills/anti/scripts/anti.py workflow debug-consensus --prompt "Intermittent 502s after rotation"
-python3 ~/.codex/skills/anti/scripts/anti.py workflow claude-grok --panel-mode review --scope staged --output findings
-python3 ~/.codex/skills/anti/scripts/anti.py workflow claude-grok --panel-mode ask --prompt "Should this UX use route A or B?"
-python3 ~/.codex/skills/anti/scripts/anti.py workflow claude-grok --model sonnet --model opus --model grok-bluesminds --panel-mode ask --prompt "Stress-test this design"
 python3 ~/.codex/skills/anti/scripts/anti.py runs list
 ```
 
-Workflow runs save sanitized summaries under `~/.codex/anti-runs` by default; primitive `consult`, `plan`, `review`, and `panel` commands default to not writing a ledger unless `--save-output summary` or `--save-output full` is passed. Saved runs include the Anti run id, which is also sent as `metadata.run_id` to the gateway and appears in sanitized request logs for correlation. Raw prompts are not logged unless you explicitly choose full-output ledgers. `plan` and `review` use a conservative Claude safety budget with `--chunked auto`, so broad Opus/Sonnet work is split into bounded chunk calls before synthesis instead of being sent as one giant request; use `--chunked off` to intentionally bypass that safety budget, including when `--max-prompt-chars 0` is set. `--fallback-model sonnet --fallback-policy on-retryable` and `--progress` are available for long-running model calls that may otherwise fail silently or hit transient backend rotation errors.
+Workflow runs save sanitized summaries under `~/.codex/anti-runs` by default; primitive `consult`, `plan`, `review`, and `panel` commands default to not writing a ledger unless `--save-output summary` or `--save-output full` is passed. Saved runs include the Anti run id, which is also sent as `metadata.run_id` to the gateway and appears in sanitized request logs for correlation. Run records never retain raw prompts: full mode keeps sanitized per-call output plus prompt hashes/counts, while summary mode keeps a short index and the complete sanitized answer in `result.json`. `plan` and `review` use a conservative Claude safety budget with `--chunked auto`, so broad Opus/Sonnet work is split into bounded chunk calls before synthesis instead of being sent as one giant request; `--chunked off` preserves exact scope and refuses when the request cannot fit, including when `--max-prompt-chars 0` is set. Partial results retain explicit non-zero exits and coverage; `--allow-partial` only permits the call, it does not make the result complete. Use `--required-file` to fail closed if priority files must be fully covered. `--fallback-model sonnet --fallback-policy on-retryable` and `--progress` are available for long-running model calls that may otherwise fail silently or hit transient backend rotation errors.
 
 Before running `codex-antigravity login`, create a Google OAuth desktop client. The local callback listener uses:
 
@@ -324,23 +308,19 @@ Overlay ids must be simple printable model ids, cannot shadow built-in ids, back
 
 ### BYOK providers
 
-Built-in presets are available for OpenRouter, BluesMinds, DeepSeek, xAI, Kimi/Moonshot, Ollama, OpenCode-compatible local servers, and custom OpenAI-compatible APIs:
+Built-in presets are available for OpenRouter, DeepSeek, xAI, Kimi/Moonshot, Ollama, OpenCode-compatible local servers, and custom OpenAI-compatible APIs:
 
 ```bash
 codex-antigravity provider presets
-codex-antigravity provider set bluesminds --api-key-env BLUESMINDS_API_KEY --model grok-4.5 --model z-ai/glm-5.2
+codex-antigravity provider set openrouter --api-key-env OPENROUTER_API_KEY --model openrouter/auto
 codex-antigravity provider set deepseek --api-key-env DEEPSEEK_API_KEY --model deepseek-v4-pro --model deepseek-v4-flash
-codex-antigravity provider set openrouter --api-key-env OPENROUTER_API_KEY --model deepseek/deepseek-chat
-codex-antigravity provider set xai --api-key-env XAI_API_KEY --model grok-build-0.1
-codex-antigravity provider login xai-oauth
+codex-antigravity provider set xai --api-key-env XAI_API_KEY --model grok-code-fast-1
 codex-antigravity provider set kimi --api-key-env KIMI_API_KEY --model kimi-k2-0711-preview
 codex-antigravity provider set ollama --base-url http://localhost:11434/v1 --model gpt-oss:20b
 codex-antigravity provider list
 ```
 
-Provider presets show their supported auth modes. Grok has two explicit subscription/provider routes: `xai-oauth:grok-build-0.1` and `xai-oauth:grok-4.3` use the SuperGrok/X Premium OAuth store, while `bluesminds:grok-4.5` uses a BluesMinds API key. The existing `grok` and `supergrok` Anti aliases remain OAuth-backed; no automatic cross-provider failover occurs. Use `codex-antigravity provider login xai-oauth` for the browser callback flow, or `codex-antigravity provider login xai-oauth --device` for a headless/device-code flow.
-
-BluesMinds uses the gateway's mature OpenAI Chat Completions adapter, not the native Responses transport. Its authenticated model catalog advertised `grok-4.5` and `z-ai/glm-5.2`, but successful Responses streaming, structured output, tool calls, usage, and identity fidelity have not been proven. GLM-5.2 is therefore documented as an advisory long-context planning/repository-review lane, with Opus remaining the default Anti judge. DeepSeek V4 uses the official DeepSeek Chat Completions API as `deepseek:deepseek-v4-pro` and `deepseek:deepseek-v4-flash`.
+Provider presets show their supported API-key modes and model defaults. The xAI preset uses `XAI_API_KEY` and exposes `xai:grok-build-0.1`, `xai:grok-4.3`, and `xai:grok-code-fast-1`; no provider-specific OAuth flow is part of the current preset catalog. DeepSeek exposes `deepseek-v4-flash`, `deepseek-v4-pro`, `deepseek-chat`, and `deepseek-reasoner`.
 
 For BYOK-only use, point Codex at a BYOK model when writing the provider block:
 
@@ -350,8 +330,8 @@ codex-antigravity configure-codex --write --model deepseek:deepseek-chat
 codex-antigravity doctor --byok-only
 ```
 
-`--api-key-env` avoids persisting provider keys and reads them from the gateway process environment. It may name an existing environment variable instead of the preset default, for example `codex-antigravity provider set bluesminds --api-key-env api_bluesminds_com`. If you intentionally want a provider key stored locally, pass `--api-key`; stored provider keys are encrypted in `~/.codex/antigravity-providers.json`. Use `--auth-mode api-key` explicitly only when you want an API-key provider config to record that mode. Built-in provider env vars include `OPENROUTER_API_KEY`, `BLUESMINDS_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `KIMI_API_KEY`, `MOONSHOT_API_KEY`, `OLLAMA_API_KEY`, and `OPENCODE_API_KEY`.
-The `/v1/models` catalog only advertises BYOK models when the provider has a usable stored/env key, a refreshable OAuth login, or explicitly supports key-optional loopback/local use. The generic `custom` preset is not auto-enabled; run `codex-antigravity provider set custom --base-url ... --model ...` before routing `custom:model`.
+`--api-key-env` avoids persisting provider keys and reads them from the gateway process environment. It may name an existing environment variable instead of the preset default, for example `codex-antigravity provider set deepseek --api-key-env DEV_DEEPSEEK_KEY`. If you intentionally want a provider key stored locally, pass `--api-key`; stored provider keys are encrypted in `~/.codex/antigravity-providers.json`. Use `--auth-mode api-key` explicitly only when you want an API-key provider config to record that mode. Built-in provider env vars include `OPENROUTER_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `KIMI_API_KEY`, `MOONSHOT_API_KEY`, `OLLAMA_API_KEY`, and `OPENCODE_API_KEY`.
+The `/v1/models` catalog only advertises BYOK models when the provider has a usable stored/env key or explicitly supports key-optional loopback/local use. The generic `custom` preset is not auto-enabled; run `codex-antigravity provider set custom --base-url ... --model ...` before routing `custom:model`.
 When `provider set` is given `--api-key-env`, models are configured but remain hidden from `/v1/models` until that environment variable is available to the running gateway.
 Provider ids reserve model-name separators and may only contain letters, numbers, underscores, and hyphens; model ids themselves may still contain `/` or `:`, but not whitespace or control characters. Unknown `provider:model` prefixes are rejected as BYOK routing errors before any Google account selection.
 Custom provider and Codex gateway base URLs must be absolute `http` or `https` URLs without embedded credentials, whitespace/control characters, query strings, fragments, invalid ports, or malformed bracketed hosts. Plain `http` base URLs are accepted only for loopback/local hosts; remote BYOK providers and remote gateway URLs must use `https`. Non-preset custom BYOK providers must provide a base URL before models are exposed. Stored/env BYOK API keys and extra BYOK provider header values must be printable ASCII without control characters; model-picker display names must not contain control characters. Provider API-key env var names must contain only letters, numbers, and underscores and must not start with a number. Extra headers may not override gateway-managed auth, content, host, or transport headers. Invalid BYOK provider URLs, API keys, env vars, model ids, display names, and headers are rejected before config writes; invalid BYOK provider URLs, timeouts, headers, API keys, and missing API keys are also rejected before streaming starts so Codex gets a normal HTTP error instead of a partial SSE response. Key-optional BYOK providers are only treated as keyless on loopback/local base URLs; remote custom or cloud URLs need a usable stored or env API key before they appear in Codex's picker or route requests. Function/tool names and forced `tool_choice` function names must contain only letters, numbers, underscores, and hyphens, and be 1-64 characters; malformed names are rejected or dropped before routing. Non-streaming Google failure responses use a structured `detail` object with `message` and sanitized `diagnostics`; clients should handle both this shape and older string details. BYOK streams surface provider error frames as failed Responses API streams instead of successful empty completions, ignore never-named tool-call deltas, and wait for complete valid streamed function names instead of emitting empty, partial, or malformed function names. BYOK structured tool outputs are serialized to JSON text before being sent as Chat Completions tool messages.
@@ -397,6 +377,64 @@ model_provider = "antigravity"
 wire_api = "responses"
 ```
 
+## Unified Codex model picker
+
+Allows Codex to display and use OpenAI, Claude and Gemini models from a
+single configured provider by routing requests through the local gateway.
+
+This is opt-in and does not change classic behaviour unless you enable it:
+
+```bash
+export OPENAI_API_KEY="sk-..."
+codex-antigravity configure-codex --write --unified-model-picker --model gpt-5.6
+codex-antigravity start --unified-model-picker
+# Or durably:
+codex-antigravity service install --port 51122 --host 127.0.0.1 --unified-model-picker
+```
+
+Unified mode writes a separate provider block so classic configs are preserved:
+
+```toml
+[model_providers.antigravity-unified]
+name = "Antigravity Unified"
+base_url = "http://localhost:51122/v1"
+wire_api = "responses"
+```
+
+```toml
+model = "gpt-5.6"
+model_provider = "antigravity-unified"
+wire_api = "responses"
+```
+
+When enabled, `GET /v1/models` advertises Antigravity native models, OpenAI/Codex
+ids (`gpt-5.6`, `gpt-5.6-codex`, …), and configured BYOK `provider:model` ids in
+one picker. The gateway routes per model (BYOK → existing provider, OpenAI →
+OpenAI upstream, Claude/Gemini → Antigravity) and returns provider-qualified
+errors for unknown models, missing OpenAI auth, or unreachable upstreams. OpenAI
+requests never fall through to Antigravity and vice versa.
+
+OpenAI authentication, in order of preference:
+
+1. Explicit `OPENAI_API_KEY` (env) proxied to `https://api.openai.com/v1/responses`
+   (override base with `OPENAI_BASE_URL`; file alternative
+   `~/.codex/antigravity-openai.json` with `{"api_key": ...}`).
+2. Optional ChatGPT-subscription reuse: `ANTIGRAVITY_OPENAI_USE_CODEX_AUTH=1`
+   reads `~/.codex/auth.json` (or `$CODEX_HOME/auth.json`) read-only after
+   `codex login` and proxies to `https://chatgpt.com/backend-api/codex/responses`.
+   No token refresh is attempted; an expired token returns a clear 401 telling
+   you to run `codex login` again. This path is explicit because the auth file
+   format is owned by Codex and may change.
+
+Extend the OpenAI registry without code changes:
+
+```bash
+export ANTIGRAVITY_OPENAI_MODELS="gpt-5.6,gpt-5.6-codex,my-codex-model"
+```
+
+Disable unified mode at any time to restore historical behaviour
+(`ANTIGRAVITY_UNIFIED_MODEL_PICKER` unset, classic `antigravity` provider).
+
 ## Verification
 
 To run connection check diagnostics and verify token security:
@@ -462,6 +500,22 @@ codex-antigravity doctor --codex-ready
 codex-antigravity start --port 51122
 ```
 
+### Unified picker: OpenAI 401 / unknown model
+
+If `gpt-5.6` returns 401, the OpenAI upstream has no credentials:
+
+```bash
+export OPENAI_API_KEY="sk-..."
+codex-antigravity start --unified-model-picker
+curl http://127.0.0.1:51122/health
+```
+
+If it returns 404 `Unknown model`, the id is not in the OpenAI registry,
+native catalog, or BYOK config. Check `/v1/models`, extend
+`ANTIGRAVITY_OPENAI_MODELS` if needed, and ensure the gateway was restarted
+with `--unified-model-picker`. Classic mode never advertises OpenAI ids; use
+the `antigravity-unified` provider block for unified pickers.
+
 ## Release Automation
 
 Tagged releases are prepared for PyPI Trusted Publishing. The `.github/workflows/publish.yml` workflow runs on `v*` tags, requires the full Ubuntu Python 3.10/3.11/3.12/3.14 plus Windows Python 3.12 test matrix and a checked sdist/wheel build, then publishes with `pypa/gh-action-pypi-publish@release/v1` using OIDC (`id-token: write`) in the `pypi` environment. The tag must exactly match the package version.

{codex_antigravity_auth-2.2.0 → codex_antigravity_auth-2.3.0}/README.md

@@ -32,7 +32,7 @@ Use `$anti` only as an optional sidecar reviewer/planner after the gateway is wo
 - **OS-Native Keyring Encryption**: Encrypts Google account tokens and stored BYOK provider config at rest via macOS Keychain, Windows Credential Manager, Linux Secret Service, or a private local fallback key.
 - **Transaction-Safe Cooldown Rotations**: Automatically rotates accounts on backend failures (such as `401`, `403`, or `429` rate limiters) with clean exponential backoff.
 - **High-Fidelity SSE Translation**: Translates stream candidate envelopes, role alignments, reasoning-text deltas, function-call items, and VALIDATED tool parameter modes into Responses API events.
-- **BYOK Provider Routing**: Route model IDs like `deepseek:deepseek-v4-pro`, `bluesminds:grok-4.5`, `bluesminds:z-ai/glm-5.2`, `xai:grok-code-fast-1`, and custom OpenAI-compatible endpoints through encrypted API-key config.
+- **BYOK Provider Routing**: Route model IDs like `deepseek:deepseek-v4-pro`, `xai:grok-code-fast-1`, `kimi:kimi-k2-0711-preview`, `ollama:gpt-oss:20b`, and custom OpenAI-compatible endpoints through encrypted API-key config.
 
 ## Installation
 
@@ -152,32 +152,19 @@ The skill also ships a helper-level panel mode inspired by MoA/Fusion workflows.
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode review --scope staged
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode plan --scope working-tree --prompt "Plan this PR"
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode ask --model sonnet --model openrouter:deepseek/deepseek-chat --judge opus --prompt "Compare these approaches"
-python3 ~/.codex/skills/anti/scripts/anti.py panel --mode ask --collab claude-grok --prompt "Compare these approaches"
-python3 ~/.codex/skills/anti/scripts/anti.py panel --mode ask --collab claude-grok --model sonnet --model opus --model grok-bluesminds --prompt "Compare these approaches"
 python3 ~/.codex/skills/anti/scripts/anti.py panel --mode review --scope staged --output findings
-python3 ~/.codex/skills/anti/scripts/anti.py moa --mode review --model deepseek-v4-pro --model glm-5.2 --judge opus --scope staged
-python3 ~/.codex/skills/anti/scripts/anti.py fusion --mode plan --model opus --model glm-5.2 --judge opus --scope working-tree --prompt "Plan this repository change"
+python3 ~/.codex/skills/anti/scripts/anti.py moa --mode review --model deepseek-v4-pro --judge opus --scope staged
+python3 ~/.codex/skills/anti/scripts/anti.py fusion --mode plan --model opus --model deepseek-v4-pro --judge opus --scope working-tree --prompt "Plan this repository change"
 ```
 
-Panel consensus is not proof and should not patch code directly. Structured findings include `id`, `claim`, `severity`, `lanes`, and `verify`; run the `verify` hint locally before acting. Text and JSON outputs include per-lane/judge usage and latency when the gateway/provider returns it. Broad review panels summarize oversized scopes once before fan-out instead of silently truncating raw context for every lane.
+Panel consensus is not proof and should not patch code directly. Structured findings include `id`, `claim`, `severity`, `lanes`, and `verify`; run the `verify` hint locally before acting. Findings remain `unverified` until native/local checks confirm or reject them. Text and JSON outputs include per-lane/judge usage and latency when the gateway/provider returns it. Broad review panels summarize oversized scopes once before fan-out instead of silently truncating raw context for every lane.
 
-Panel JSON keeps requested and actual execution identities separate (`requestedModel`, `actualModel`, `provider`, `fallbackChain`, `primaryError`, and `fallbackReason`). The panel status is `complete_multi_model`, `partial_multi_model`, `degraded_single_model`, or `failed`; distinct actual provider/model identities, rather than repeated logical fallback lanes, satisfy `--min-successes`. `/v1/models` is only a catalog/readiness hint—the bounded generation call is the live model health check.
+Panel JSON keeps requested and actual execution identities separate (`requestedModel`, `actualModel`, `provider`, `fallbackChain`, `primaryError`, and `fallbackReason`). The panel status is `complete_multi_model`, `partial_multi_model`, `same_provider_multi_model`, `degraded_single_model`, or `failed`; distinct actual provider/model identities, rather than repeated logical fallback lanes, satisfy `--min-successes`, and `--min-providers` can require provider diversity. `/v1/models` is only a catalog/readiness hint—the bounded generation call is the live model health check. Every saved run exposes top-level `runStatus`, `scopeStatus`, `panelStatus`, `coverage`, and `resultPath`.
 When the diversity minimum is not met, the panel fails closed before judge synthesis; `--json` and `--output findings` still return the lane evidence and status with a non-zero exit code.
 
-`--collab claude-grok` is an explicit collaboration profile for Claude plus Grok panels. It defaults to Sonnet, Opus, and `grok` (`xai-oauth:grok-build-0.1`), gives Claude and Grok complementary review instructions, and asks the Opus judge to compare Claude-backed and Grok-backed disagreements before recommending verification steps. `grok-oauth` selects that same OAuth route explicitly. To use BluesMinds deliberately, pass `--model sonnet --model opus --model grok-bluesminds`; `grok-bluesminds` and `grok-4.5` resolve to `bluesminds:grok-4.5`. The helper never silently fails over between the routes. If a requested Grok lane is not visible in `/v1/models`, it is recorded as a failed lane unless `--min-successes` makes the whole panel fail.
+Panel lanes are selected explicitly from the native Sonnet/Opus defaults or from models advertised by the running gateway. BYOK examples include `openrouter:...`, `deepseek:...`, `xai:...`, `kimi:...`, `ollama:...`, and `opencode:...`; they require the corresponding API key or a key-optional local provider. When a BYOK lane receives repository, diff, or file context, the helper prints and records a disclosure naming the provider lane. Virtual picker models such as `panel:*`, `moa:*`, or `fusion:*` remain helper aliases rather than gateway-side fan-out.
 
-BYOK panel models such as `openrouter:...` or `xai-oauth:...` only work when the running gateway advertises them in `/v1/models`, which requires usable provider keys, key-optional local provider setup, or a refreshable OAuth login. When a BYOK lane receives repository, diff, or file context, the helper prints and records a disclosure naming the provider lanes. Virtual picker models such as `panel:*`, `moa:*`, or `fusion:*` are not supported; MoA/Fusion remains a helper workflow, not gateway-side orchestration.
-
-### Choosing complementary reviewer lanes
-
-- DeepSeek V4 Flash is for a fast code second opinion, debugging, and an explicitly selected retryable fallback. It is never an automatic cross-provider fallback.
-- DeepSeek V4 Pro is for correctness, security, architecture, and deep code review. Treat it as unproven until the live V4 Pro generation, structured-output, and tool-loop gate passes.
-- xAI OAuth Grok is for adversarial assumptions, runtime surprises, and product/UX blind spots.
-- BluesMinds Grok/GLM aliases exist but remain unavailable/degraded until the requested route is advertised by `/v1/models` and the provider live-health gate passes. Every BluesMinds example is conditional on both checks.
-
-The normal service intentionally omits BluesMinds. The last bounded live checks returned a billing error for Grok 4.5 and an upstream 429 for GLM-5.2, so neither route is operationally enabled.
-
-A future enablement gate must pass first in a temporary process: catalog identity; non-streaming output and exact model identity; SSE completion and `[DONE]`; structured JSON; tool call and continuation; usage accounting; and bounded retries and no billing/capacity error. Only then may a later authorized task add `BLUESMINDS_API_KEY=op://...` to the durable service reference file and reinstall the service.
+The current xAI preset is API-key based and uses `XAI_API_KEY`. Provider availability is determined by the gateway's `/v1/models` catalog; a catalog entry is not proof that a live generation will succeed.
 
 Repository context leaves the Google Antigravity lane only after explicit selection and the existing BYOK disclosure. Opus remains the default judge; native Codex remains the acting agent and must verify advisory output locally.
 
@@ -188,16 +175,13 @@ python3 ~/.codex/skills/anti/scripts/anti.py workflow review-ready --scope stage
 python3 ~/.codex/skills/anti/scripts/anti.py workflow plan-deep --scope working-tree --prompt "Plan this PR" --progress
 python3 ~/.codex/skills/anti/scripts/anti.py workflow ship-gate --scope diff --base origin/main --json
 python3 ~/.codex/skills/anti/scripts/anti.py workflow provider-compare --model sonnet --model openrouter:deepseek/deepseek-chat --prompt "Compare these approaches"
-python3 ~/.codex/skills/anti/scripts/anti.py workflow provider-compare --model deepseek-v4-pro --model glm-5.2 --prompt "Compare long-context planning approaches"
+python3 ~/.codex/skills/anti/scripts/anti.py workflow provider-compare --model deepseek-v4-pro --prompt "Compare this approach with the native review lane"
 python3 ~/.codex/skills/anti/scripts/anti.py workflow security-review --scope staged --output findings
 python3 ~/.codex/skills/anti/scripts/anti.py workflow debug-consensus --prompt "Intermittent 502s after rotation"
-python3 ~/.codex/skills/anti/scripts/anti.py workflow claude-grok --panel-mode review --scope staged --output findings
-python3 ~/.codex/skills/anti/scripts/anti.py workflow claude-grok --panel-mode ask --prompt "Should this UX use route A or B?"
-python3 ~/.codex/skills/anti/scripts/anti.py workflow claude-grok --model sonnet --model opus --model grok-bluesminds --panel-mode ask --prompt "Stress-test this design"
 python3 ~/.codex/skills/anti/scripts/anti.py runs list
 ```
 
-Workflow runs save sanitized summaries under `~/.codex/anti-runs` by default; primitive `consult`, `plan`, `review`, and `panel` commands default to not writing a ledger unless `--save-output summary` or `--save-output full` is passed. Saved runs include the Anti run id, which is also sent as `metadata.run_id` to the gateway and appears in sanitized request logs for correlation. Raw prompts are not logged unless you explicitly choose full-output ledgers. `plan` and `review` use a conservative Claude safety budget with `--chunked auto`, so broad Opus/Sonnet work is split into bounded chunk calls before synthesis instead of being sent as one giant request; use `--chunked off` to intentionally bypass that safety budget, including when `--max-prompt-chars 0` is set. `--fallback-model sonnet --fallback-policy on-retryable` and `--progress` are available for long-running model calls that may otherwise fail silently or hit transient backend rotation errors.
+Workflow runs save sanitized summaries under `~/.codex/anti-runs` by default; primitive `consult`, `plan`, `review`, and `panel` commands default to not writing a ledger unless `--save-output summary` or `--save-output full` is passed. Saved runs include the Anti run id, which is also sent as `metadata.run_id` to the gateway and appears in sanitized request logs for correlation. Run records never retain raw prompts: full mode keeps sanitized per-call output plus prompt hashes/counts, while summary mode keeps a short index and the complete sanitized answer in `result.json`. `plan` and `review` use a conservative Claude safety budget with `--chunked auto`, so broad Opus/Sonnet work is split into bounded chunk calls before synthesis instead of being sent as one giant request; `--chunked off` preserves exact scope and refuses when the request cannot fit, including when `--max-prompt-chars 0` is set. Partial results retain explicit non-zero exits and coverage; `--allow-partial` only permits the call, it does not make the result complete. Use `--required-file` to fail closed if priority files must be fully covered. `--fallback-model sonnet --fallback-policy on-retryable` and `--progress` are available for long-running model calls that may otherwise fail silently or hit transient backend rotation errors.
 
 Before running `codex-antigravity login`, create a Google OAuth desktop client. The local callback listener uses:
 
@@ -291,23 +275,19 @@ Overlay ids must be simple printable model ids, cannot shadow built-in ids, back
 
 ### BYOK providers
 
-Built-in presets are available for OpenRouter, BluesMinds, DeepSeek, xAI, Kimi/Moonshot, Ollama, OpenCode-compatible local servers, and custom OpenAI-compatible APIs:
+Built-in presets are available for OpenRouter, DeepSeek, xAI, Kimi/Moonshot, Ollama, OpenCode-compatible local servers, and custom OpenAI-compatible APIs:
 
 ```bash
 codex-antigravity provider presets
-codex-antigravity provider set bluesminds --api-key-env BLUESMINDS_API_KEY --model grok-4.5 --model z-ai/glm-5.2
+codex-antigravity provider set openrouter --api-key-env OPENROUTER_API_KEY --model openrouter/auto
 codex-antigravity provider set deepseek --api-key-env DEEPSEEK_API_KEY --model deepseek-v4-pro --model deepseek-v4-flash
-codex-antigravity provider set openrouter --api-key-env OPENROUTER_API_KEY --model deepseek/deepseek-chat
-codex-antigravity provider set xai --api-key-env XAI_API_KEY --model grok-build-0.1
-codex-antigravity provider login xai-oauth
+codex-antigravity provider set xai --api-key-env XAI_API_KEY --model grok-code-fast-1
 codex-antigravity provider set kimi --api-key-env KIMI_API_KEY --model kimi-k2-0711-preview
 codex-antigravity provider set ollama --base-url http://localhost:11434/v1 --model gpt-oss:20b
 codex-antigravity provider list
 ```
 
-Provider presets show their supported auth modes. Grok has two explicit subscription/provider routes: `xai-oauth:grok-build-0.1` and `xai-oauth:grok-4.3` use the SuperGrok/X Premium OAuth store, while `bluesminds:grok-4.5` uses a BluesMinds API key. The existing `grok` and `supergrok` Anti aliases remain OAuth-backed; no automatic cross-provider failover occurs. Use `codex-antigravity provider login xai-oauth` for the browser callback flow, or `codex-antigravity provider login xai-oauth --device` for a headless/device-code flow.
-
-BluesMinds uses the gateway's mature OpenAI Chat Completions adapter, not the native Responses transport. Its authenticated model catalog advertised `grok-4.5` and `z-ai/glm-5.2`, but successful Responses streaming, structured output, tool calls, usage, and identity fidelity have not been proven. GLM-5.2 is therefore documented as an advisory long-context planning/repository-review lane, with Opus remaining the default Anti judge. DeepSeek V4 uses the official DeepSeek Chat Completions API as `deepseek:deepseek-v4-pro` and `deepseek:deepseek-v4-flash`.
+Provider presets show their supported API-key modes and model defaults. The xAI preset uses `XAI_API_KEY` and exposes `xai:grok-build-0.1`, `xai:grok-4.3`, and `xai:grok-code-fast-1`; no provider-specific OAuth flow is part of the current preset catalog. DeepSeek exposes `deepseek-v4-flash`, `deepseek-v4-pro`, `deepseek-chat`, and `deepseek-reasoner`.
 
 For BYOK-only use, point Codex at a BYOK model when writing the provider block:
 
@@ -317,8 +297,8 @@ codex-antigravity configure-codex --write --model deepseek:deepseek-chat
 codex-antigravity doctor --byok-only
 ```
 
-`--api-key-env` avoids persisting provider keys and reads them from the gateway process environment. It may name an existing environment variable instead of the preset default, for example `codex-antigravity provider set bluesminds --api-key-env api_bluesminds_com`. If you intentionally want a provider key stored locally, pass `--api-key`; stored provider keys are encrypted in `~/.codex/antigravity-providers.json`. Use `--auth-mode api-key` explicitly only when you want an API-key provider config to record that mode. Built-in provider env vars include `OPENROUTER_API_KEY`, `BLUESMINDS_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `KIMI_API_KEY`, `MOONSHOT_API_KEY`, `OLLAMA_API_KEY`, and `OPENCODE_API_KEY`.
-The `/v1/models` catalog only advertises BYOK models when the provider has a usable stored/env key, a refreshable OAuth login, or explicitly supports key-optional loopback/local use. The generic `custom` preset is not auto-enabled; run `codex-antigravity provider set custom --base-url ... --model ...` before routing `custom:model`.
+`--api-key-env` avoids persisting provider keys and reads them from the gateway process environment. It may name an existing environment variable instead of the preset default, for example `codex-antigravity provider set deepseek --api-key-env DEV_DEEPSEEK_KEY`. If you intentionally want a provider key stored locally, pass `--api-key`; stored provider keys are encrypted in `~/.codex/antigravity-providers.json`. Use `--auth-mode api-key` explicitly only when you want an API-key provider config to record that mode. Built-in provider env vars include `OPENROUTER_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `KIMI_API_KEY`, `MOONSHOT_API_KEY`, `OLLAMA_API_KEY`, and `OPENCODE_API_KEY`.
+The `/v1/models` catalog only advertises BYOK models when the provider has a usable stored/env key or explicitly supports key-optional loopback/local use. The generic `custom` preset is not auto-enabled; run `codex-antigravity provider set custom --base-url ... --model ...` before routing `custom:model`.
 When `provider set` is given `--api-key-env`, models are configured but remain hidden from `/v1/models` until that environment variable is available to the running gateway.
 Provider ids reserve model-name separators and may only contain letters, numbers, underscores, and hyphens; model ids themselves may still contain `/` or `:`, but not whitespace or control characters. Unknown `provider:model` prefixes are rejected as BYOK routing errors before any Google account selection.
 Custom provider and Codex gateway base URLs must be absolute `http` or `https` URLs without embedded credentials, whitespace/control characters, query strings, fragments, invalid ports, or malformed bracketed hosts. Plain `http` base URLs are accepted only for loopback/local hosts; remote BYOK providers and remote gateway URLs must use `https`. Non-preset custom BYOK providers must provide a base URL before models are exposed. Stored/env BYOK API keys and extra BYOK provider header values must be printable ASCII without control characters; model-picker display names must not contain control characters. Provider API-key env var names must contain only letters, numbers, and underscores and must not start with a number. Extra headers may not override gateway-managed auth, content, host, or transport headers. Invalid BYOK provider URLs, API keys, env vars, model ids, display names, and headers are rejected before config writes; invalid BYOK provider URLs, timeouts, headers, API keys, and missing API keys are also rejected before streaming starts so Codex gets a normal HTTP error instead of a partial SSE response. Key-optional BYOK providers are only treated as keyless on loopback/local base URLs; remote custom or cloud URLs need a usable stored or env API key before they appear in Codex's picker or route requests. Function/tool names and forced `tool_choice` function names must contain only letters, numbers, underscores, and hyphens, and be 1-64 characters; malformed names are rejected or dropped before routing. Non-streaming Google failure responses use a structured `detail` object with `message` and sanitized `diagnostics`; clients should handle both this shape and older string details. BYOK streams surface provider error frames as failed Responses API streams instead of successful empty completions, ignore never-named tool-call deltas, and wait for complete valid streamed function names instead of emitting empty, partial, or malformed function names. BYOK structured tool outputs are serialized to JSON text before being sent as Chat Completions tool messages.
@@ -364,6 +344,64 @@ model_provider = "antigravity"
 wire_api = "responses"
 ```
 
+## Unified Codex model picker
+
+Allows Codex to display and use OpenAI, Claude and Gemini models from a
+single configured provider by routing requests through the local gateway.
+
+This is opt-in and does not change classic behaviour unless you enable it:
+
+```bash
+export OPENAI_API_KEY="sk-..."
+codex-antigravity configure-codex --write --unified-model-picker --model gpt-5.6
+codex-antigravity start --unified-model-picker
+# Or durably:
+codex-antigravity service install --port 51122 --host 127.0.0.1 --unified-model-picker
+```
+
+Unified mode writes a separate provider block so classic configs are preserved:
+
+```toml
+[model_providers.antigravity-unified]
+name = "Antigravity Unified"
+base_url = "http://localhost:51122/v1"
+wire_api = "responses"
+```
+
+```toml
+model = "gpt-5.6"
+model_provider = "antigravity-unified"
+wire_api = "responses"
+```
+
+When enabled, `GET /v1/models` advertises Antigravity native models, OpenAI/Codex
+ids (`gpt-5.6`, `gpt-5.6-codex`, …), and configured BYOK `provider:model` ids in
+one picker. The gateway routes per model (BYOK → existing provider, OpenAI →
+OpenAI upstream, Claude/Gemini → Antigravity) and returns provider-qualified
+errors for unknown models, missing OpenAI auth, or unreachable upstreams. OpenAI
+requests never fall through to Antigravity and vice versa.
+
+OpenAI authentication, in order of preference:
+
+1. Explicit `OPENAI_API_KEY` (env) proxied to `https://api.openai.com/v1/responses`
+   (override base with `OPENAI_BASE_URL`; file alternative
+   `~/.codex/antigravity-openai.json` with `{"api_key": ...}`).
+2. Optional ChatGPT-subscription reuse: `ANTIGRAVITY_OPENAI_USE_CODEX_AUTH=1`
+   reads `~/.codex/auth.json` (or `$CODEX_HOME/auth.json`) read-only after
+   `codex login` and proxies to `https://chatgpt.com/backend-api/codex/responses`.
+   No token refresh is attempted; an expired token returns a clear 401 telling
+   you to run `codex login` again. This path is explicit because the auth file
+   format is owned by Codex and may change.
+
+Extend the OpenAI registry without code changes:
+
+```bash
+export ANTIGRAVITY_OPENAI_MODELS="gpt-5.6,gpt-5.6-codex,my-codex-model"
+```
+
+Disable unified mode at any time to restore historical behaviour
+(`ANTIGRAVITY_UNIFIED_MODEL_PICKER` unset, classic `antigravity` provider).
+
 ## Verification
 
 To run connection check diagnostics and verify token security:
@@ -429,6 +467,22 @@ codex-antigravity doctor --codex-ready
 codex-antigravity start --port 51122
 ```
 
+### Unified picker: OpenAI 401 / unknown model
+
+If `gpt-5.6` returns 401, the OpenAI upstream has no credentials:
+
+```bash
+export OPENAI_API_KEY="sk-..."
+codex-antigravity start --unified-model-picker
+curl http://127.0.0.1:51122/health
+```
+
+If it returns 404 `Unknown model`, the id is not in the OpenAI registry,
+native catalog, or BYOK config. Check `/v1/models`, extend
+`ANTIGRAVITY_OPENAI_MODELS` if needed, and ensure the gateway was restarted
+with `--unified-model-picker`. Classic mode never advertises OpenAI ids; use
+the `antigravity-unified` provider block for unified pickers.
+
 ## Release Automation
 
 Tagged releases are prepared for PyPI Trusted Publishing. The `.github/workflows/publish.yml` workflow runs on `v*` tags, requires the full Ubuntu Python 3.10/3.11/3.12/3.14 plus Windows Python 3.12 test matrix and a checked sdist/wheel build, then publishes with `pypa/gh-action-pypi-publish@release/v1` using OIDC (`id-token: write`) in the `pypi` environment. The tag must exactly match the package version.

{codex_antigravity_auth-2.2.0 → codex_antigravity_auth-2.3.0}/codex_antigravity_auth/account_state.py

@@ -151,7 +151,13 @@ class AccountState:
     def state(self) -> dict[str, Any]:
         return self.data["accountState"]
 
-    def _select(self, family: str, *, acquire: bool) -> Lease | None:
+    def _select(
+        self,
+        family: str,
+        *,
+        acquire: bool,
+        exclude_emails: set[str] | None = None,
+    ) -> Lease | None:
         if family not in FAMILIES:
             raise ValueError(f"unsupported model family: {family}")
         with self._lock:
@@ -170,6 +176,8 @@ class AccountState:
                 if not isinstance(account, dict) or not account.get("email"):
                     continue
                 email = str(account["email"])
+                if exclude_emails and email in exclude_emails:
+                    continue
                 scoped = self.state["cooldowns"].get(email, {})
                 if scoped.get("account", 0) > now or scoped.get(family, 0) > now:
                     continue
@@ -187,11 +195,11 @@ class AccountState:
                 self._in_flight[email] = self._in_flight.get(email, 0) + 1
             return Lease(account=account, family=family)
 
-    def select(self, family: str) -> Lease | None:
-        return self._select(family, acquire=False)
+    def select(self, family: str, *, exclude_emails: set[str] | None = None) -> Lease | None:
+        return self._select(family, acquire=False, exclude_emails=exclude_emails)
 
-    def acquire(self, family: str) -> Lease | None:
-        return self._select(family, acquire=True)
+    def acquire(self, family: str, *, exclude_emails: set[str] | None = None) -> Lease | None:
+        return self._select(family, acquire=True, exclude_emails=exclude_emails)
 
     def release(self, lease: Lease | None) -> None:
         if lease is not None: