paseo/plugins/antigravity-provider/test/fixtures

agy 1.2.13 stream-json captures

denial-replay.stdout.ndjson replays two turns from one real 1.2.13 process: a denied shell command, then a text-only answer whose result retains the first denial. The replay clock is synthetic; frames retain the native cumulative denial payload.

Captured on Linux x86_64 on 2026-09-29. These are observations from the supplied binary, not guarantees for the Google sign-in route. No product code or capture drivers are included.

Each row names a capture prefix. Its .stdin.ndjson, .stdout.ndjson, .stderr.ndjson, and .capture.ndjson companions keep the streams separate; empty streams are empty files. Every line wraps the exact decoded JSON frame or text line in {t_ms, stream, data}. t_ms is milliseconds since construction immediately before spawn. Capture annotations record launch arguments, configuration, signals, EOF, timeouts, and exit code; they are not CLI output. Line references refer to the indicated file, starting at 1.

Commands below run from <WORKSPACE>. <AGY> expands to <HOME>/.local/opt/agy/1.2.13/agy in the real installation home; the child uses a separate isolated <HOME> for state. All captures remove inherited credential/provider environment variables, set HOME, XDG_CONFIG_HOME=<HOME>/.config, XDG_CACHE_HOME=<HOME>/.cache, XDG_DATA_HOME=<HOME>/.local/share, BROWSER=/bin/true, and loopback-only NO_PROXY/no_proxy. Neither PATH nor shell rc files changed. Resume rows reuse the original isolated HOME.

For rows marked API, the environment also contains GEMINI_API_KEY=<DUMMY_KEY> and GOOGLE_GEMINI_BASE_URL=http://127.0.0.1:<PORT>, and <HOME>/.gemini/antigravity-cli/settings.json contains {"modelProvider":"gemini"}. Env only sets those two variables without the setting; None has neither. The loopback translator reused the prior QA route and forwarded real requests to a paid upstream model. Its credential was read programmatically inside the temporary proxy, with later captures passing it through the proxy environment. It was never passed to agy or recorded. The translator maps all requested Gemini models to one upstream Gemini model: request routing and CLI selection are verified, native model identity/quality is not.

The translator emits text, function calls, thought parts and usage. Its usage mapping does not populate Gemini thinking/cache counts, so observed zero thinking_tokens/cache_read_tokens does not prove native zeros. No dedicated reasoning frames appeared, including the matched high-effort probe.

<HOME>, <WORKSPACE>, <CAPTURE>, <PORT>, <DUMMY_KEY>, and <REDACTED_REFERENCE> are redactions. Unrelated project/model names and help examples are redacted without removing frames. Delta chunk boundaries remain; a path split across deltas can have a different placeholder spelling than the complete result. UUIDs are retained for conversation correlation.

Fixture prefix	Exact argv (redacted)	Auth	Demonstrates	agy
agents	<AGY> agents	API	Available agents listing is plain text.	1.2.13
api-key-env-only	<AGY> --input-format stream-json --output-format stream-json	Env only	Dummy key and custom endpoint alone do not select API-key auth.	1.2.13
api-key-settings	<AGY> --input-format stream-json --output-format stream-json	API	modelProvider=gemini yields init; missing event input is rejected.	1.2.13
cwd-without-add-dir	<AGY> --input-format stream-json --output-format stream-json --dangerously-skip-permissions	API	Without add-dir, model-issued pwd returned launch cwd; required tool Cwd is not exposed by this wire frame.	1.2.13
effort-unsupported-family	<AGY> --input-format stream-json --output-format stream-json --model '<REDACTED_REFERENCE>' --effort high	API	Unsupported non-Gemini family rejects effort; model reference redacted.	1.2.13
effort-encoded-match	<AGY> --input-format stream-json --output-format stream-json --model gemini-3.8-flash-high --effort high	API	Matching high effort accepted; arithmetic turn; no thought delta observed.	1.2.13
effort-encoded-mismatch	<AGY> --input-format stream-json --output-format stream-json --model gemini-3.8-flash-high --effort low	API	High-suffixed model conflicts with effort=low; no init.	1.2.13
effort-mismatch	<AGY> --input-format stream-json --output-format stream-json --model gemini-3.1-pro-preview --effort low	API	Unlisted preview ID does not support effort; startup ERROR.	1.2.13
help	<AGY> --help	None	Launch flags and subcommands; help is on stderr.	1.2.13
image-content	<AGY> --input-format stream-json --output-format stream-json --disable-slash-commands	API	Image source block rejected: only text blocks supported.	1.2.13
mcp-add-http	<AGY> mcp add phase0 'http://127.0.0.1:<PORT>/mcp'	None	Writes .gemini/config/mcp_config.json; file content recorded in capture annotations.	1.2.13
mcp-add	<AGY> mcp add phase0 --url 'http://127.0.0.1:<PORT>/mcp'	None	Invalid --url syntax rejected; no configuration written.	1.2.13
mcp-global	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	Global HTTP server discovered; strict tool call fails because arguments is a string.	1.2.13
mcp-help	<AGY> mcp add --help	None	MCP add syntax, HTTP transport, headers/env; flags precede name.	1.2.13
mcp-list	<AGY> mcp list	None	Model-free empty server list, exit 0.	1.2.13
mcp-project-config	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	Workspace .gemini/config.json mcpServers not discovered in this probe.	1.2.13
mcp-project-isolated	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --dangerously-skip-permissions	API	Project MCP discovery; no global MCP config before/after; strict arguments error.	1.2.13
mcp-project	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	Project .agents/mcp_config.json discovers HTTP server; strict call rejects string arguments; later translator 502 retained.	1.2.13
mcp-second-add-dir	<AGY> --input-format stream-json --output-format stream-json --disable-slash-commands --dangerously-skip-permissions --add-dir '<WORKSPACE>' --add-dir '<CAPTURE>/owned'	API	Discovers project MCP from the owned directory; strict arguments fail. Shell uses owned directory and writes occur in both directories.	1.2.13
mcp-owned-first-add-dir	<AGY> --input-format stream-json --output-format stream-json --disable-slash-commands --dangerously-skip-permissions --add-dir '<CAPTURE>/owned' --add-dir '<WORKSPACE>'	API	Reversing argv does not restore command working directory; owned directory remains the shell default.	1.2.13
mcp-owned-cwd	<AGY> --input-format stream-json --output-format stream-json --disable-slash-commands --dangerously-skip-permissions --add-dir '<WORKSPACE>', launched in <CAPTURE>/owned through a symlink	API	Discovers owned project MCP, but shell and initial read resolve against owned cwd; writes occur in both directories.	1.2.13
mcp-agent-file	<AGY> --input-format stream-json --output-format stream-json --disable-slash-commands --dangerously-skip-permissions --add-dir '<WORKSPACE>' --agent '<CAPTURE>/owned/agent.md'	API	Direct external agent filename falls back to default; no MCP discovery. Shell/read/write use workspace.	1.2.13
mcp-agent-definition	<AGY> --input-format stream-json --output-format stream-json --add-dir '<CAPTURE>/owned' --add-dir '<WORKSPACE>' --agent phase2 --dangerously-skip-permissions	API	Nested Markdown definition with inline mcpServers is not found; default agent, no MCP server.	1.2.13
mcp-agent-discovered	<AGY> --input-format stream-json --output-format stream-json --add-dir '<CAPTURE>/owned' --add-dir '<WORKSPACE>' --agent phase2 --dangerously-skip-permissions	API	Flat Markdown definition plus agents.json manifest is also not found; default agent, no MCP server.	1.2.13
image-file-external	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands	API	Default mode reads an external image path with view_file and correctly describes its pixels, without an extra add-dir.	1.2.13
model-switch-invalid	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --conversation b966b16a-caf4-448a-bb24-0e34956022b0 --model gemini-3.1-flash-lite-preview	API	Unlisted model ID rejected before init.	1.2.13
model-switch-network	<AGY> --input-format stream-json --output-format stream-json --conversation b966b16a-caf4-448a-bb24-0e34956022b0 --model gemini-3.8-flash-low	API	Listed model respawn plus actual Gemini request path in capture annotations; COBALT preserved.	1.2.13
model-switch-resume	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --conversation b966b16a-caf4-448a-bb24-0e34956022b0 --model gemini-3.1-flash-high	API	Another unlisted model ID rejected before init.	1.2.13
model-switch-valid	<AGY> --input-format stream-json --output-format stream-json --conversation b966b16a-caf4-448a-bb24-0e34956022b0 --model gemini-3.8-flash-low	API	Listed low-effort model accepted on same conversation; COBALT preserved.	1.2.13
models-api-key	<AGY> models	API	Authenticated catalog is tab-separated model ID and display label.	1.2.13
models-unauthenticated	<AGY> models	None	Models requires auth; no catalog on stdout.	1.2.13
multi-turn-reasoning	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands	API	Two text turns with arithmetic; per-generation and cumulative usage. No thought delta observed.	1.2.13
not-signed-in	<AGY> --input-format stream-json --output-format stream-json	None	No credentials: result ERROR, no init, exit 1.	1.2.13
project-skill	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands	API	Project skill read via view_file; marker reply. No distinct skill event.	1.2.13
question-auto-denial	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>'	API	Requested ask_question becomes unknown DONE step, auto-skipped; no question payload on wire.	1.2.13
resume-after-interrupt	<AGY> --input-format stream-json --output-format stream-json --conversation a2c2132f-0f10-400b-a142-74f82230f449	API	Same interrupted conversation resumes and accepts another turn.	1.2.13
resume	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --conversation b966b16a-caf4-448a-bb24-0e34956022b0	API	Remembered COBALT after respawn; no old steps replayed.	1.2.13
schema-prompt	<AGY> --input-format stream-json --output-format stream-json	API	Unknown prompt event ignored with stderr warning; no turn.	1.2.13
schema-user-message	<AGY> --input-format stream-json --output-format stream-json	API	Decoding a string message fails before event dispatch.	1.2.13
schema-user	<AGY> --input-format stream-json --output-format stream-json	API	String message rejected; message must be an object.	1.2.13
sigint-mid-text	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	SIGINT after first text delta: interrupted result and exit 1.	1.2.13
sigint-mid-tool	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --dangerously-skip-permissions	API	SIGINT while run_command ACTIVE: interrupted result and exit 1.	1.2.13
sigterm	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	SIGTERM after user_input: interrupted result and exit 1.	1.2.13
slash-disabled	<AGY> --input-format stream-json --output-format stream-json --disable-slash-commands	API	/help sent literally to model; normal turn with built-in skill reads.	1.2.13
slash-enabled	<AGY> --input-format stream-json --output-format stream-json	API	/help rejected in driver mode; result ERROR and exit 2.	1.2.13
stdin-close-mid-turn	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	EOF after user_input: active turn finishes successfully, exit 0.	1.2.13
stdin-mid-turn	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	Second prompt after first user_input queues a separate turn; two results.	1.2.13
subagent	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --dangerously-skip-permissions	API	Define/invoke child; subagent_info contains child ID/log URI/workspaces; child reply reaches parent.	1.2.13
text-block	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>'	API	Array of text content blocks accepted.	1.2.13
text-turn	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>'	API	event=user, message.content string; streaming text and final usage.	1.2.13
tools-accept-edits	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --mode accept-edits	API	Read, create, edit allowed; shell auto-denied. Result SUCCESS includes denied_actions. No permission request.	1.2.13
tools-default	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands	API	Read, create, edit allowed; shell auto-denied. Result SUCCESS includes denied_actions. No permission request.	1.2.13
tools-plan	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --mode plan	API	Read, create, edit allowed; shell auto-denied. Result SUCCESS includes denied_actions. No permission request.	1.2.13
tools-sandbox	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --sandbox	API	Read, create, edit allowed; shell auto-denied. Result SUCCESS includes denied_actions. No permission request.	1.2.13
tools-skip-permissions	<AGY> --input-format stream-json --output-format stream-json --add-dir '<WORKSPACE>' --disable-slash-commands --dangerously-skip-permissions	API	Read, create, edit and shell succeed; permission_mode=always-proceed.	1.2.13
version	<AGY> --version	None	Installed binary reports 1.2.13.	1.2.13
mcp-http.requests.ndjson	node <CAPTURE>/mcp-server.mjs alongside the MCP argv above	None	Actual HTTP JSON-RPC requests to a strict SDK server; params.arguments is a string. Server implements initialize, tools/list, and echo.	1.2.13 client
state-inspection.ndjson	HOME=<HOME> strace -f -e trace=file -o <CAPTURE>/files.trace <AGY> --input-format stream-json --output-format stream-json; python3 <CAPTURE>/finalize.py; firecrawl scrape <OFFICIAL_MANIFEST_URL> --format markdown	None	Binary checksum, isolated state accesses, read-only SQLite listings, written file contents, and manifest retrieval caveat. Inspection data, not agy stdout.	1.2.13

project-skill used <WORKSPACE>/.agents/skills/phase0-marker/SKILL.md with name phase0-marker, description “Return the Phase 0 marker when requested,” and instructions “Respond with PHASE0_SKILL_MARKER. No tools are needed after reading this skill.”

Each tools capture begins with input.txt containing PHASE0_READ_MARKER, then requests create→replace from PHASE0_WRITE to PHASE0_EDIT, then printf PHASE0_SHELL. state-inspection.ndjson records the resulting files. These successful writes disprove an enforced read-only boundary for default/plan on this credential route. --sandbox alone still denies the shell at permission policy, so OS sandbox enforcement is unverified.

MCP discovery

Phase 0 project setup (mcp-project and mcp-project-isolated) places {"mcpServers":{"phase0":{"serverUrl":"http://127.0.0.1:<PORT>/mcp"}}} in <WORKSPACE>/.agents/mcp_config.json. mcp-project-config instead uses <WORKSPACE>/.gemini/config.json; that file did not expose the server. HTTP calls send string arguments and fail strict validation.

Phase 2 places the same HTTP configuration, named phase2, in a plugin-owned <CAPTURE>/owned/.agents/mcp_config.json. Both add-dir orders discover it, as does launching in the owned directory and adding the real workspace. All three turns execute shell pwd in the owned directory. The file turns read the workspace marker but also write output.txt into the owned directory. These routes fail the requirement that tools resolve against the user's workspace. Reordering arguments did not change the observed shell cwd; the precise directory selection rule is unverified.

The external --agent file, nested agent definition, and flat definition with an agents.json manifest contain inline mcpServers. Native logs record “not found, falling back to default” for each. These experiments do not establish that every agent definition format is unsupported. parity-inspection.ndjson records their definitions and log evidence. Searching the tested binary's strings found no AGY_MCP, MCP_CONFIG, AGY_CONFIG, or ANTIGRAVITY_CONFIG override; no environment discovery route was verified.

No tested MCP route satisfies both discovery and workspace ownership. MCP implementation stopped at this gate: no relay or MCP capability change was added. Images and the daemon e2e continued independently. No global MCP configuration exists in the isolated homes, and no configuration was written into the user repository.

Image file fallback

image-file-external.png contains a red triangle on the left and a blue circle on the lower right, against white. The prompt supplies only its path and asks for visible shapes and colors. image-file-external.stdout.ndjson:4–5 records a successful view_file; the result describes the pixels correctly. The native function response supplies bytes at functionResponse.parts[].inlineData. The temporary translator was corrected to forward these nested parts to the model; forwarding top-level parts alone dropped the image. parity-inspection.ndjson records the image hash and response-part location.

This verifies one default-mode CLI turn reading a file outside the workspace without an extra add-dir. A later isolated-daemon run attached the same image through the provider and returned the same shapes and colors after a successful view_file. The provider advertises prompt.image; MCP remains outside the parity implementation.

Unverified: Google login behaviour; native reasoning/cached-token accounting; filesystem/network isolation under sandbox plus approved commands; exhaustive tool policy; other agent definition formats or environment MCP overrides; child transcript streaming beyond parent metadata; a stable public conversation-list command. No fresh login was created. The fetched official manifest returned 1.2.12 while this binary reports 1.2.13; the checksum identifies the tested binary, but that response does not establish its release provenance.