Add Antigravity CLI (agy) transition awareness to the Gemini adapter#2
Open
luisalima wants to merge 3 commits into
Open
Add Antigravity CLI (agy) transition awareness to the Gemini adapter#2luisalima wants to merge 3 commits into
luisalima wants to merge 3 commits into
Conversation
Google sunsets Gemini CLI for consumer tiers on 2026-06-18 in favor of the closed-source Antigravity CLI (agy), which reuses ~/.gemini/ but reads its own config under ~/.gemini/antigravity-cli/ and whose security settings are not yet documented. - New gemini.agy_transition audit finding: info when agy coexists with Gemini CLI, high when only agy is present (so a passing Gemini audit isn't mistaken for agy coverage) - Skip legacy Gemini checks on agy-only hosts with no Gemini CLI config (~/.gemini existing no longer implies Gemini CLI) - detect.sh reports agent_antigravity and a transition hint - Host alias/function bypass checks cover agy (--dangerously-skip-permissions) - apply gemini warns when agy is present; usage notes the sunset - KNOWN_ISSUES.md tracks the blocked agy adapter (schema undocumented; closed source rules out the gemini-cli source-reading approach) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ries CI has been red on main since 2026-05-08: cases 4/5 used PATH=/usr/bin:/bin as a stand-in for "no container runtime installed", but GitHub's ubuntu runners ship docker at /usr/bin/docker, so linux_runtime_missing (correctly) never fired. Replace system-dir PATHs with a restricted bin dir that symlinks only the tools the adapter needs, so docker/podman/lxc/ gemini/agy presence is controlled entirely by the test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Second front of the same pre-existing breakage: cases 7/8/9 used PATH=/usr/bin:/bin (or kept it in the search path) as a stand-in for "no container runtime", but GitHub's ubuntu runners ship docker at /usr/bin/docker, so setup-gemini.sh picked it up and wrote tools.sandbox=docker where the tests expected it omitted/podman. Mirror the real PATH into a scratch dir, symlinking everything except docker/podman/lxc/runsc, so runtime presence is controlled entirely by the test while every other tool the script needs stays reachable. Case 7 (podman) now asserts unconditionally instead of skipping when the host has docker. Verified by running the full suite and release-check with a fake docker (and podman) prepended to PATH — all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Google announced on 2026-05-19 that Gemini CLI stops serving consumer tiers (AI Pro, Ultra, free Code Assist) on 2026-06-18 in favor of the closed-source, Go-based Antigravity CLI (binary
agy). Enterprise Gemini Code Assist licenses keep Gemini CLI access, so thegeminiadapter stays.The tricky part for sandshell:
agyreuses~/.gemini/but reads its own config nested under~/.gemini/antigravity-cli/, and its security settings (sandbox, approval modes) are not yet documented. That creates two failure modes this PR addresses:~/.geminiexisting no longer implies Gemini CLI, so agy-only hosts would get "sandbox not configured" findings for a tool they don't have.Changes
agents/gemini/audit.sh— newgemini.agy_transitionfinding: info when agy coexists with Gemini CLI, high when only agy is present. On agy-only hosts with no Gemini CLI config, the legacy checks are skipped instead of emitting criticals about settings no installed tool reads.agents/host/audit.sh— alias/function bypass scans now coveragy(its documented bypass flag is--dangerously-skip-permissions, already in the flag list).scripts/detect.sh— reportsagent_antigravity(keyed on~/.gemini/antigravity-cli, not~/.gemini) plus a sunset hint.scripts/setup-gemini.sh— usage and post-apply output note the sunset and warn when agy is detected.KNOWN_ISSUES.md— tracks the blocked agy adapter: a realsetup-agy.sh/agents/agy/audit.shneeds Google to document agy's settings schema; closed source rules out the source-reading verification used for gemini-cli, so empirical probing insideagy --sandboxis the likely path.Testing
bash tests/run.sh— all pass, including 4 new agy cases intest_audit_gemini.sh(agy-only → high + legacy checks still run against existing config; coexistence → info; agy-only with no Gemini config → only the transition finding; no agy → silent) andagent_antigravitycoverage intest_detect.sh. New cases pin PATH to system dirs + a fakebin so host-installed binaries can't leak in.bash scripts/release-check.sh— passes (includes shellcheck).detect.shand the gemini audit run clean on a real host with gemini installed and no agy (transition finding correctly silent).🤖 Generated with Claude Code