ory-antigravity 0.13.9__tar.gz

ory_antigravity-0.13.9/.gitignore

@@ -0,0 +1,36 @@
+node_modules/
+dist/
+*.tsbuildinfo
+.env
+.env.local
+
+# Python (uv workspace under python/)
+.venv/
+__pycache__/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+build/
+*.pyc
+
+# Debug logs
+*.log
+
+# Harness sandbox dirs
+.sandbox/
+
+# Staged install-surface repo contents (see scripts/sync-install-surfaces.mjs)
+.install-surfaces/
+
+# Local dev environment (local Ory stack + Verdaccio registry)
+.ory-dev/
+
+# Worktrees for changes
+.worktrees/
+.claude/worktrees/
+
+# Gemini CLI extension assets — materialized at install time from
+# @ory/argus templates. The repo source is the canonical templates;
+# these subdirs are generated wherever the install runs.
+packages/gemini-cli/gemini-extension/skills/
+packages/gemini-cli/gemini-extension/commands/

ory_antigravity-0.13.9/PKG-INFO

@@ -0,0 +1,54 @@
+Metadata-Version: 2.4
+Name: ory-antigravity
+Version: 0.13.9
+Summary: Ory Agent Security for the Google Antigravity SDK — per-tool authorization, tracing, and identity propagation via the SDK's hook system. Built on ory-argus.
+Author: Ory
+License-Expression: Apache-2.0
+Keywords: agent,ai,antigravity,authorization,gemini,google,ory,permissions
+Requires-Python: >=3.10
+Requires-Dist: google-antigravity>=0.1
+Requires-Dist: ory-argus<1,>=0.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ory-antigravity
+
+Ory Agent Security for the [Google Antigravity SDK](https://antigravity.google/product/antigravity-sdk).
+
+Authorizes every tool call against Ory Permissions via Antigravity's hook system, traces
+invocations, and propagates user → agent → sub-agent identity — built on
+[`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-antigravity
+```
+
+```python
+from google.antigravity import Agent, LocalAgentConfig
+from ory_antigravity import ory_hooks
+
+config = LocalAgentConfig(hooks=ory_hooks(), ...)
+agent = Agent(config)
+```
+
+`ory_hooks()` returns three hooks ready to drop into `config.hooks`:
+`OnSessionStartHook` (auth gates), `PreToolCallDecideHook` (authorize), and
+`PostToolCallHook` (trace). Building your own `HookRunner`? The same object exposes them by
+name: `ory_hooks().pre_tool_call_decide`, `.post_tool_call`, `.on_session_start`.
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied tool is **aborted** — the decide
+hook returns `HookResult(allow=False)` and Antigravity hands the model the denial instead of
+running the tool. In **observe** mode (default) the tool runs and a `permission.observe_deny`
+span is recorded. The `ask_question` builtin is treated as a user-interaction primitive (never
+gated); when the model delegates via `start_subagent`, a sub-agent identity and
+agent→subagent delegation are recorded.
+
+Antigravity decide hooks fail **closed** (a raising hook aborts the tool), so this integration
+owns fail-open itself: a network or rate-limit error on the permission check resolves to
+*allow*, and an Ory outage never hard-blocks the agent.
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`, so a login from
+any Ory harness or `ory-argus login` is reused automatically. See
+[docs/sdk-integrations.md](https://github.com/ory-corp/ory-agent-plugins/blob/main/docs/sdk-integrations.md).

ory_antigravity-0.13.9/README.md

@@ -0,0 +1,39 @@
+# ory-antigravity
+
+Ory Agent Security for the [Google Antigravity SDK](https://antigravity.google/product/antigravity-sdk).
+
+Authorizes every tool call against Ory Permissions via Antigravity's hook system, traces
+invocations, and propagates user → agent → sub-agent identity — built on
+[`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-antigravity
+```
+
+```python
+from google.antigravity import Agent, LocalAgentConfig
+from ory_antigravity import ory_hooks
+
+config = LocalAgentConfig(hooks=ory_hooks(), ...)
+agent = Agent(config)
+```
+
+`ory_hooks()` returns three hooks ready to drop into `config.hooks`:
+`OnSessionStartHook` (auth gates), `PreToolCallDecideHook` (authorize), and
+`PostToolCallHook` (trace). Building your own `HookRunner`? The same object exposes them by
+name: `ory_hooks().pre_tool_call_decide`, `.post_tool_call`, `.on_session_start`.
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied tool is **aborted** — the decide
+hook returns `HookResult(allow=False)` and Antigravity hands the model the denial instead of
+running the tool. In **observe** mode (default) the tool runs and a `permission.observe_deny`
+span is recorded. The `ask_question` builtin is treated as a user-interaction primitive (never
+gated); when the model delegates via `start_subagent`, a sub-agent identity and
+agent→subagent delegation are recorded.
+
+Antigravity decide hooks fail **closed** (a raising hook aborts the tool), so this integration
+owns fail-open itself: a network or rate-limit error on the permission check resolves to
+*allow*, and an Ory outage never hard-blocks the agent.
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`, so a login from
+any Ory harness or `ory-argus login` is reused automatically. See
+[docs/sdk-integrations.md](https://github.com/ory-corp/ory-agent-plugins/blob/main/docs/sdk-integrations.md).

ory_antigravity-0.13.9/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "ory-antigravity"
+version = "0.13.9"
+description = "Ory Agent Security for the Google Antigravity SDK — per-tool authorization, tracing, and identity propagation via the SDK's hook system. Built on ory-argus."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "Apache-2.0"
+authors = [{ name = "Ory" }]
+keywords = ["ory", "google", "antigravity", "gemini", "authorization", "agent", "ai", "permissions"]
+dependencies = [
+    "ory-argus>=0.8,<1",
+    "google-antigravity>=0.1",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "ruff>=0.6"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ory_antigravity"]

ory_antigravity-0.13.9/src/ory_antigravity/__init__.py

@@ -0,0 +1,16 @@
+"""Ory Agent Security for the Google Antigravity SDK.
+
+    from google.antigravity import Agent, LocalAgentConfig
+    from ory_antigravity import ory_hooks
+
+    config = LocalAgentConfig(hooks=ory_hooks(), ...)
+    agent = Agent(config)
+"""
+
+from __future__ import annotations
+
+from .hooks import OryHookSet, apply_complete, evaluate, ory_hooks
+
+__version__ = "0.13.9"
+
+__all__ = ["ory_hooks", "OryHookSet", "evaluate", "apply_complete", "__version__"]

ory_antigravity-0.13.9/src/ory_antigravity/hooks.py

@@ -0,0 +1,179 @@
+"""Ory Agent Security for the Google Antigravity SDK.
+
+Antigravity exposes a first-class hook system over its agentic loop. The hooks relevant to
+authorization, tracing, and identity are:
+
+  - ``OnSessionStartHook`` — fires once when the session starts.
+  - ``PreToolCallDecideHook`` — a *decide* hook that runs before every tool call and returns
+    a ``HookResult(allow=…)``; ``allow=False`` aborts the tool.
+  - ``PostToolCallHook`` — an *inspect* hook that fires after a tool completes.
+
+:func:`ory_hooks` returns the three hook instances ready to drop into an agent config; they
+authorize each call against Ory Permissions:
+
+  - allow / observe / fail-open / interactive → ``HookResult(allow=True)`` (the tool runs).
+  - deny (enforce) → ``HookResult(allow=False, message=…)`` so Antigravity skips the tool and
+    hands the model the denial.
+
+    from google.antigravity import Agent, LocalAgentConfig
+    from ory_antigravity import ory_hooks
+
+    config = LocalAgentConfig(hooks=ory_hooks(), ...)
+    agent = Agent(config)
+
+**Fail-open is this integration's responsibility.** Antigravity decide hooks fail *closed* —
+a hook that raises aborts the tool. All gate logic therefore lives behind a top-level catch
+in :func:`evaluate`/:func:`ory_argus.gate` (network / rate-limit errors resolve to ``allow``),
+so an Ory outage never hard-blocks the agent.
+
+The gate logic itself lives in ``ory_argus``; the SDK is imported **lazily** inside
+:func:`ory_hooks` (the hook classes must subclass the SDK's abstract bases for the runner's
+``isinstance`` dispatch), so this module imports fine without ``google-antigravity`` present
+and the decision matrix is unit-testable against the SDK-free helpers below.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any
+
+from ory_argus import GateResult, OryAgentClient, complete, gate, register_subagent, session_start
+
+HARNESS = "antigravity"
+# Antigravity emits this builtin tool call when the model delegates to a sub-agent.
+_SUBAGENT_TOOL = "start_subagent"
+
+
+# ─── SDK-free core (unit-tested with duck-typed fakes) ────────────────
+
+
+def _tool_name(data: Any) -> str:
+    """Tool name as a plain string (``BuiltinTools`` is a str-enum → take ``.value``)."""
+    name = getattr(data, "name", None)
+    return getattr(name, "value", name) or "unknown"
+
+
+def _tool_args(data: Any) -> Any:
+    return getattr(data, "args", None)
+
+
+def _ensure_session(client: OryAgentClient, project_url: str | None, state: dict) -> None:
+    """Run the session-start gates exactly once. Never raises."""
+    if state.get("started"):
+        return
+    state["started"] = True
+    try:
+        session_start(client, harness=HARNESS, project_url=project_url)
+    except Exception as err:  # noqa: BLE001 — session gate must never break the agent
+        client.logger.warn("session_start.failed", {"message": str(err)})
+
+
+def evaluate(
+    client: OryAgentClient,
+    *,
+    tool_name: str,
+    tool_args: Any = None,
+    can_block: bool = True,
+    project_url: str | None = None,
+    subagent_tool: str | None = _SUBAGENT_TOOL,
+    _state: dict | None = None,
+) -> GateResult:
+    """Authorize one tool call. Bootstraps the session, registers sub-agents, runs the gate.
+
+    Returns a :class:`ory_argus.GateResult`; ``result.blocked`` is True only on a hard deny in
+    enforce mode. SDK-free — the Antigravity hook wrapper translates the result into a
+    ``HookResult``.
+    """
+    state = _state if _state is not None else {}
+    _ensure_session(client, project_url, state)
+
+    # Sub-agent delegation: Antigravity signals a handoff via a `start_subagent` tool call.
+    if subagent_tool and tool_name == subagent_tool:
+        args = tool_args or {}
+        target = args.get("name") or args.get("subagent_name")
+        if target:
+            try:
+                register_subagent(client, harness=HARNESS, sub_agent_type=target, project_url=project_url)
+            except Exception as err:  # noqa: BLE001 — delegation is audit-only, never blocks
+                client.logger.warn("subagent.register.failed", {"target": target, "message": str(err)})
+
+    return gate(client, harness=HARNESS, tool_name=tool_name, tool_args=tool_args, can_block=can_block)
+
+
+def apply_complete(client: OryAgentClient, *, tool_name: str, result: Any = None) -> None:
+    """Record a ``tool.complete`` span for a finished tool call. Never blocks."""
+    complete(client, tool_name=tool_name, output=result)
+
+
+# ─── Public API: SDK hook instances ──────────────────────────────────
+
+
+class OryHookSet(list):
+    """The Ory hook instances, also usable directly as the ``config.hooks`` list.
+
+    Subclasses ``list`` so it can be passed straight to ``LocalAgentConfig(hooks=…)`` while
+    still exposing the individual hooks by name (``.pre_tool_call_decide`` etc.) for callers
+    building their own ``HookRunner``.
+    """
+
+    def __init__(self, on_session_start: Any, pre_tool_call_decide: Any, post_tool_call: Any) -> None:
+        self.on_session_start = on_session_start
+        self.pre_tool_call_decide = pre_tool_call_decide
+        self.post_tool_call = post_tool_call
+        super().__init__([on_session_start, pre_tool_call_decide, post_tool_call])
+
+
+def ory_hooks(
+    *,
+    client: OryAgentClient | None = None,
+    can_block: bool = True,
+    project_url: str | None = None,
+    subagent_tool: str | None = _SUBAGENT_TOOL,
+) -> OryHookSet:
+    """Build the Ory Antigravity hooks. Drop the result into ``config.hooks``.
+
+    Args:
+        client: An ``OryAgentClient``. Defaults to ``OryAgentClient.from_env("antigravity")``.
+        can_block: Whether a denied tool is hard-aborted (sets the alert attribute). Default ``True``.
+        project_url: Override the Ory project URL for the session gates.
+        subagent_tool: Builtin tool name that signals a sub-agent handoff. ``None`` disables
+            sub-agent registration. Default ``"start_subagent"``.
+    """
+    from google.antigravity.hooks import OnSessionStartHook, PostToolCallHook, PreToolCallDecideHook
+    from google.antigravity.types import HookResult
+
+    c = client or OryAgentClient.from_env(HARNESS)
+    state: dict = {}
+
+    class _OnSessionStart(OnSessionStartHook):
+        async def run(self, context: Any, data: Any = None) -> None:
+            await asyncio.to_thread(_ensure_session, c, project_url, state)
+
+    class _PreToolCallDecide(PreToolCallDecideHook):
+        async def run(self, context: Any, data: Any) -> HookResult:
+            result = await asyncio.to_thread(
+                evaluate,
+                c,
+                tool_name=_tool_name(data),
+                tool_args=_tool_args(data),
+                can_block=can_block,
+                project_url=project_url,
+                subagent_tool=subagent_tool,
+                _state=state,
+            )
+            return HookResult(allow=not result.blocked, message=result.denial_message or "")
+
+    class _PostToolCall(PostToolCallHook):
+        async def run(self, context: Any, data: Any) -> None:
+            apply_complete(c, tool_name=_tool_name(data), result=getattr(data, "result", None))
+
+    return OryHookSet(_OnSessionStart(), _PreToolCallDecide(), _PostToolCall())
+
+
+__all__ = [
+    "HARNESS",
+    "OryHookSet",
+    "ory_hooks",
+    "evaluate",
+    "apply_complete",
+]

ory_antigravity-0.13.9/tests/test_hooks.py

@@ -0,0 +1,116 @@
+"""Hermetic tests for the Antigravity gate logic (mocked Ory, duck-typed ToolCall/ToolResult).
+
+These exercise the SDK-free core (:func:`evaluate` / :func:`apply_complete`) without
+importing ``google-antigravity``: the blocked/denial-message veto surface that the async
+hooks translate into a ``HookResult`` (covered by ``test_realsdk.py``), plus the
+package-specific paths — the ``ask_question`` interactive built-in, str-enum tool-name
+normalization, ``start_subagent`` delegation, and session-once. The full permission decision
+matrix is core-owned (``ory-argus/tests/test_adapters.py``).
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from ory_antigravity import apply_complete, evaluate
+from ory_antigravity import hooks as hooks_mod
+from ory_argus.client import PrincipalIdentity
+from ory_argus.testing import (
+    create_mock_client,
+    get_trace_spans,
+    stub_permission_allowed,
+    stub_permission_denied,
+)
+
+
+@pytest.fixture(autouse=True)
+def _isolate(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("ORY_PERMISSION_MODE", raising=False)
+    monkeypatch.delenv("ORY_INTERACTIVE_TOOLS", raising=False)
+    monkeypatch.setattr(hooks_mod, "session_start", lambda *a, **k: None)
+
+
+def client_with_user():
+    c = create_mock_client(harness="antigravity")
+    c.set_user_principal(PrincipalIdentity(subject="user:alice"))
+    return c
+
+
+def _tool_call(name="search_web", args=None):
+    return SimpleNamespace(name=name, args=args if args is not None else {"q": 1})
+
+
+def test_allow_proceeds():
+    c = client_with_user()
+    stub_permission_allowed(c)
+    result = evaluate(c, tool_name="search_web", tool_args={"q": 1})
+    assert result.blocked is False
+    invoke = get_trace_spans(c, "tool.invoke")[0]
+    assert invoke.attributes["allowed"] is True
+    assert invoke.attributes["toolName"] == "search_web"
+
+
+def test_enforce_blocks(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    c = client_with_user()
+    stub_permission_denied(c)
+    result = evaluate(c, tool_name="run_command", tool_args={"cmd": "rm -rf /"})
+    # Native veto shape: blocked + denial_message, which the async hook translates to
+    # Antigravity's ``{allow_tool: False, deny_reason}`` HookResult (see test_realsdk.py).
+    assert result.blocked is True
+    assert "permission denied" in (result.denial_message or "").lower()
+    assert get_trace_spans(c, "tool.block")[0].attributes["blocked"] is True
+
+
+def test_ask_question_is_interactive():
+    c = client_with_user()
+    stub_permission_denied(c)  # even a deny must not gate the user-interaction primitive
+    result = evaluate(c, tool_name="ask_question", tool_args={"prompt": "which file?"})
+    assert result.blocked is False
+    assert result.kind == "interactive"
+    assert get_trace_spans(c, "user.interaction")[0].attributes["toolName"] == "ask_question"
+
+
+def test_builtin_tools_enum_name_resolves(monkeypatch):
+    """A str-enum tool name (BuiltinTools) is normalized to its ``.value``."""
+    c = client_with_user()
+    stub_permission_allowed(c)
+    enum_name = SimpleNamespace(value="search_web")
+    result = evaluate(c, tool_name=hooks_mod._tool_name(_tool_call(name=enum_name)))
+    assert result.blocked is False
+    assert get_trace_spans(c, "tool.invoke")[0].attributes["toolName"] == "search_web"
+
+
+def test_start_subagent_registers_delegation(monkeypatch):
+    c = client_with_user()
+    stub_permission_allowed(c)
+    seen = {}
+    monkeypatch.setattr(
+        hooks_mod, "register_subagent",
+        lambda client, **kw: seen.update(kw),
+    )
+    result = evaluate(c, tool_name="start_subagent", tool_args={"name": "researcher"})
+    assert seen["sub_agent_type"] == "researcher"
+    assert seen["harness"] == "antigravity"
+    assert result.blocked is False  # the start_subagent call itself is still gated + allowed
+
+
+def test_session_start_runs_once(monkeypatch):
+    c = client_with_user()
+    stub_permission_allowed(c)
+    calls = []
+    monkeypatch.setattr(hooks_mod, "session_start", lambda *a, **k: calls.append(1))
+    state: dict = {}
+    evaluate(c, tool_name="search_web", _state=state)
+    evaluate(c, tool_name="view_file", _state=state)
+    assert calls == [1]  # session_start fired exactly once across both tool calls
+
+
+def test_after_records_complete():
+    c = client_with_user()
+    apply_complete(c, tool_name="search_web", result=SimpleNamespace(result="ok"))
+    spans = get_trace_spans(c, "tool.complete")
+    assert spans[0].attributes["toolName"] == "search_web"

ory_antigravity-0.13.9/tests/test_realsdk.py

@@ -0,0 +1,75 @@
+"""Real-SDK test: the Ory hooks subclass the real Antigravity bases and translate decisions.
+
+Runs only when ``google-antigravity`` is importable; the default workspace venv skips it.
+Validates what a duck-typed fake can't: (1) the hooks are real ``OnSessionStartHook`` /
+``PreToolCallDecideHook`` / ``PostToolCallHook`` subclasses, so the SDK's ``HookRunner``
+``isinstance`` dispatch accepts them, and (2) the decide hook returns a real
+``HookResult`` whose ``allow`` flips with the gate decision. The permission check is stubbed,
+so no model/backend is needed.
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+import pytest
+
+pytest.importorskip("google.antigravity")
+
+from google.antigravity.hooks import (  # noqa: E402
+    OnSessionStartHook,
+    PostToolCallHook,
+    PreToolCallDecideHook,
+)
+from google.antigravity.hooks.hook_runner import HookRunner  # noqa: E402
+from google.antigravity.types import HookResult, ToolCall  # noqa: E402
+
+from ory_antigravity import hooks as hooks_mod  # noqa: E402
+from ory_antigravity import ory_hooks  # noqa: E402
+from ory_argus.client import PrincipalIdentity  # noqa: E402
+from ory_argus.testing import (  # noqa: E402
+    create_mock_client,
+    stub_permission_allowed,
+    stub_permission_denied,
+)
+
+
+def _client(monkeypatch):
+    monkeypatch.setattr(hooks_mod, "session_start", lambda *a, **k: None)
+    c = create_mock_client(harness="antigravity")
+    c.set_user_principal(PrincipalIdentity(subject="user:alice"))
+    return c
+
+
+def test_hooks_subclass_real_bases_and_register(monkeypatch):
+    hs = ory_hooks(client=_client(monkeypatch))
+    assert isinstance(hs.on_session_start, OnSessionStartHook)
+    assert isinstance(hs.pre_tool_call_decide, PreToolCallDecideHook)
+    assert isinstance(hs.post_tool_call, PostToolCallHook)
+    # The runner's isinstance dispatch must accept all three without raising.
+    runner = HookRunner()
+    for hook in hs:
+        runner.register_hook(hook)
+    assert hs.pre_tool_call_decide in runner.pre_tool_call_decide_hooks
+    assert hs.post_tool_call in runner.post_tool_call_hooks
+    assert hs.on_session_start in runner.on_session_start_hooks
+
+
+def test_decide_allows_returns_hookresult(monkeypatch):
+    c = _client(monkeypatch)
+    stub_permission_allowed(c)
+    hs = ory_hooks(client=c)
+    result = asyncio.run(hs.pre_tool_call_decide.run(None, ToolCall(name="search_web", args={"q": 1})))
+    assert isinstance(result, HookResult)
+    assert result.allow is True
+
+
+def test_decide_denies_in_enforce(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    c = _client(monkeypatch)
+    stub_permission_denied(c)
+    hs = ory_hooks(client=c)
+    result = asyncio.run(hs.pre_tool_call_decide.run(None, ToolCall(name="run_command", args={"cmd": "rm"})))
+    assert isinstance(result, HookResult)
+    assert result.allow is False
+    assert "permission denied" in result.message.lower()