Antigravity CLI provider: a Google subscription for every LLM feature

[volkotyk]

Adds Antigravity CLI as a fifth LLM provider, beside Claude API, Claude Code, Codex CLI, OpenAI, OpenRouter and Ollama. A Google Antigravity subscription now drives scoring, tailoring, cover letters, autofill and email classification. Cost counts as $0; token usage is still logged.

One extra: the catalog this subscription grants is not only Google. agy models serves Gemini, claude-sonnet-4-6, claude-opus-4-6-thinking and gpt-oss-120b-medium through the same login.

Setup

docker compose exec -it backend agy

The container has no browser, so the CLI prints a URL and asks for the code the browser shows. Then pick Antigravity CLI (Google Subscription) in Settings › AI. No API key.

Three decisions worth reviewing

The prompt travels on stdin, not argv. -p reads argv, and argv caps near 128 KB — a résumé plus a job description can reach that. The adapter sends one NDJSON line to --input-format stream-json. -p also swallows the next token, so it goes last as -p=.

A deny list holds the agent to text. agy carries 57 tools, among them run_command and write_file, and it reads files without asking. Its --sandbox flag restricts the terminal only, never the file tools. The image ships backend/antigravity-settings.json, and compose binds the same file read-only over the volume — the volume would otherwise hide the image's copy, and a stale deny list is a silent hole.

The per-call transcript is deleted. agy writes the whole prompt to brain/<id>/transcript_full.jsonl. That is a copy of the user's résumé on disk that nothing ever reads back.

Auth

The CLI skips the OS keyring when no D-Bus session bus is present and writes an OAuth token to a file instead. So the container needs one volume, exactly like codex_auth, and no keyring daemon. No login pre-check is needed either: unlike codex, agy answers an unauthenticated call in about a second, with a readable error field. A missing login or a plan limit raises NonRetryableLLMError, so call_llm goes to the fallback instead of retrying four times.

Known cost

Every call carries about 13 200 input tokens of the agent's own preamble — its 57 tool definitions. That is free in money and not free in subscription quota. A CLI agent is a heavyweight way to run one completion, and I found no lever to shrink the tool set.

The spike

The first commit adds spike/antigravity/ — the isolated rig that answered these questions. It touches no application file and can be dropped if you would rather not carry it. probe.sh runs eight probes; models.sh prints the live catalog as a ready block for llm_models_list.

Verification

Against a live subscription, from inside the backend container:

plain call : 'OK'  {'input_tokens': 13239, 'output_tokens': 27, ...}
file call  : I cannot read /app/backend/seed.py because access is denied by a user-configured deny rule
conversations before/after: 0 / 0

Backend suite: 1037 passed. (test_r4_live_contract.py::test_protected_routes_require_a_key fails on my machine before and after this branch — it needs an API key configured on the running instance.)

🤖 Generated with Claude Code

[vesaias]

Review from Claude Code

Verified hands-on: PR built into the backend image, agy 1.2.3 installed, adapter flags checked, unauthenticated call exercised, deny list inspected, full suite on the merged tree 2705 passed. The code is clean and the tests cover the contract. Two things to fix before merge:

1. The :ro bind of the deny list rides an error path. agy rewrites settings.json on every start; over the read-only bind that fails (failed to write validated settings: atomic rename … device or resource busy) and it logs failed to load cli settings, using defaults. Today the defaults still carry the deny list you shipped, but that is a closed binary's fallback behaviour — a version bump that really falls back to defaults would silently hand the agent run_command and write_file back. Suggest copying the file into the volume from an entrypoint (or the adapter) before each call instead of binding it read-only, and/or asserting after startup that the loaded permissions contain the deny list (the log line CLI settings initialized: permissions=&{… Deny:[command(*) …]} is greppable).

2. A timeout keeps the transcript. _run_cli raises on the 300 s wall clock before _agy_discard runs, so the brain/<id> transcript holding the résumé survives exactly in the case where the call hung. A try/finally around the discard (with the conversation id read from whatever stdout arrived) closes it.

Smaller, not blocking: the cli log under log/ grows ~16 KB per call and conversation_summaries.db is not in the discard list, so the volume grows without bound; and spike/antigravity/README.md is Ukrainian in an English repo — happy to keep the spike, but an English README or dropping the directory would be better.

Verified for the record: installer resolves to /root/.local/bin/agy 1.2.3 (+270 MB image); --input-format/--output-format stream-json, --print-timeout, --model, -p= all accepted; unauthenticated result event is status: ERROR, error: "authentication failed or timed out" in 0.6 s and matches your auth regex; the PR's "1037 passed" is a partial run, the merged tree gives 2705.

[volkotyk]

Rebased onto main and pushed. Both blocking points are fixed, and the two smaller ones with them.

1. The read-only bind is gone. You were right about the mechanism: agy rewrites settings.json as it starts, the :ro copy made that write fail, and the CLI went down the failed to load cli settings, using defaults path. The shipped copy now lives at /opt/antigravity-settings.json, outside the volume, and the adapter installs it into the state directory before each call where agy can rewrite it freely. The two error lines are gone from the log; CLI settings initialized: permissions=&{Allow:[] Deny:[command(*) read_file(/) write_file(/) read_url(*) execute_url(*)] Ask:[]} is now reached the ordinary way.

I took the assertion as well, since a closed binary deciding its own defaults is not something to rely on. After each call the adapter reads that line out of agy's log and refuses the call unless every shipped deny rule appears in it. A missing line, a missing rule, or a missing settings file all raise NonRetryableLLMError, so a degraded state fails over to the fallback provider instead of quietly running an unconstrained agent.

2. The timeout keeps nothing now. _run_cli shields the read task, so after the kill it still hands back what the process printed. The adapter reads the conversation id from the init event and discards in a finally. The hung call was exactly the case where the résumé stayed on disk.

3. The log. --log-file points at the per-call temp directory, so the ~16 KB you measured dies with it. That is also the file the permissions check reads, so it pays for itself twice. conversation_summaries.db I left alone deliberately — deleting it mid-flight can pull a sqlite file out from under a concurrent call, and it grows slowly (28 KB after 49 conversations). Happy to prune it inside the semaphore if you would rather have the bound.

4. The spike README is English now.

Verified live from inside the backend container: a plain call answers, a file read is refused by the deny rule, and neither log/ nor conversations/ in the volume grows across calls.

On the test count — you are right, mine was a -k filtered run and I should have said so. The merged tree here gives 2775 passed, 1 failed: test_r4_live_contract.py::test_protected_routes_require_a_key, which fails on main on this machine too (it wants an API key configured on the running instance).

One number worth putting on the record, since it is a cost you inherit: every call carries about 13 200 input tokens of agy's own preamble, its 57 tool definitions. Free in money, not free in subscription quota, and I found no lever to shrink the tool set.

🤖 Generated with Claude Code

[vesaias]

Generated by Claude Code

Thanks, all four points check out. I built the PR's backend image and ran the adapter against agy 1.2.3: the deny list installs to the state dir, --log-file lands in the per-call temp dir, the log carries CLI settings initialized: permissions=&{Allow:[] Deny:[command(*) read_file(/) write_file(/) read_url(*) execute_url(*)] Ask:[]} and _agy_assert_denied passes on it. Full suite on the PR tree: 2711 passed. The head already sits on current main, so it merges clean.

One last ask before merge: please drop spike/antigravity/. The app never touches it, and the findings that matter (flags, auth shape, deny list) are already in the provider's comments and in this PR's description, which stays as the record. Once that commit is up I'll merge.

The 13k-token preamble is good to know; I'll note it in the changelog line so people on a quota are not surprised.