feat: Add Antigravity CLI as a supported tool profile

docs/configuration.md

@@ -293,6 +293,7 @@ Common settings paths:
 
 | Tool | Native config path |
 |------|--------------------|
+| antigravity | `antigravity-cli/settings.json` |
 | claude | `settings.json` |
 | codex | `config.toml` |
 | mistral-vibe | `config.toml` |

docs/tools.md

@@ -11,6 +11,7 @@ Built-in tool profiles:
 
 | Tool | Description |
 |------|-------------|
+| `antigravity` | [Antigravity CLI](https://github.com/google-antigravity/antigravity-cli) (Google) |
 | `claude` | [Claude Code](https://www.anthropic.com/claude-code) (Anthropic) |
 | `codex` | [Codex CLI](https://github.com/openai/codex) (OpenAI) |
 | `mistral-vibe` | [Mistral Vibe CLI](https://github.com/mistralai/mistral-vibe) (opt-in/experimental) |

extensions/tools/antigravity/README.md

@@ -0,0 +1,117 @@
+# Antigravity CLI
+
+Google's Antigravity CLI (`agy`) is a terminal coding agent that runs on the
+shared Antigravity agent engine. See the
+[official docs](https://antigravity.google/docs/overview?tab=cli) and the
+[`antigravity-cli`](https://github.com/google-antigravity/antigravity-cli)
+repository.
+
+## Configuration
+
+- **Command**: `agy`
+- **YOLO flag**: `--dangerously-skip-permissions` (enabled by default)
+- **Continue**: `enclave continue` runs `agy --continue`. `agy` has no
+  session-picker flag, so `enclave resume` falls back to `--continue`; use
+  `/resume` inside the session to pick an older conversation.
+- **Config directory**: `~/.gemini`
+- **Settings file**: `~/.gemini/antigravity-cli/settings.json`
+- **Skills directory**: `~/.gemini/config/skills`
+
+`agy` splits its data across two directories under `~/.gemini`:
+
+| Path | Content |
+|------|---------|
+| `config/` | Shared customization: `mcp_config.json`, `skills/`, `rules/`, `hooks.json`, `AGENTS.md`, `GEMINI.md`, `projects/` |
+| `antigravity-cli/` | CLI data: `settings.json`, `keybindings.json`, OAuth token, conversations, logs, cache |
+
+The whole `~/.gemini` directory is the tool's config store, so conversations
+and settings persist per project. The extension passes through selected host
+configuration: `antigravity-cli/settings.json`, `antigravity-cli/keybindings.json`,
+and `config/` entries for `AGENTS.md`, `GEMINI.md`, `agents.json`, `agents/`,
+`hooks.json`, `mcp_config.json`, `plugins.json`, `rules.json`, `rules/`,
+`skills.json`, and `skills/`. Conversations, logs, caches, MCP OAuth tokens, and
+the sign-in token are never passed through.
+
+## Authentication
+
+The default method is the Google sign-in. Because the container has no browser
+or D-Bus keyring, `agy` prints an authorization URL, stores the token as a file
+and asks you to paste the authorization code after signing in on the host.
+
+- Declared auth file: `~/.gemini/antigravity-cli/antigravity-oauth-token`.
+  Enclave uses its presence to detect an existing auth session and includes it
+  in auth import/export. See [Authentication & Secrets](../../../docs/auth.md).
+- The token is stored in plaintext in the auth store, like other file-based
+  OAuth logins. Anyone who can read it can act with your Google account's
+  Antigravity entitlement.
+- `agy` selects file storage by detecting the container. Upstream tracks cases
+  where a stored token is not picked up by a fresh process
+  ([antigravity-cli#479](https://github.com/google-antigravity/antigravity-cli/issues/479));
+  if you are asked to sign in every session, that is the cause.
+
+### Gemini API key
+
+| Variable | Purpose |
+|----------|---------|
+| `GEMINI_API_KEY` | Gemini API key injected by the network gateway into `x-goog-api-key` for `generativelanguage.googleapis.com` |
+
+When `GEMINI_API_KEY` is set, `setup.sh` sets `"modelProvider": "gemini"` in
+`settings.json`, which is what makes `agy` use the key instead of the Google
+sign-in. Remove the key (or pass `--no-api-key`) to go back to the sign-in.
+
+### Not covered
+
+Application Default Credentials (`AGY_ADC_AUTH`), Workforce Identity
+Federation, and custom endpoints (`GOOGLE_GEMINI_BASE_URL`) are not wired up by
+this extension. Business sign-in reaches `aiplatform.googleapis.com`; regional
+Vertex AI hosts need `--allow-domain`.
+
+## Settings and Privacy
+
+The default settings template sets `enableTelemetry` and `showFeedbackSurvey`
+to `false`. The environment sets `AGY_CLI_DISABLE_AUTO_UPDATE=true`, since the
+binary is installed into the image and is updated by rebuilding it.
+
+In yolo mode, `setup.sh` also adds the project directory to `trustedWorkspaces`
+in `settings.json` so `agy` does not show its workspace trust dialog for the
+already-sandboxed project.
+
+## Memory and Skills
+
+The extension does not declare a native memory directory or memory-disable
+arguments, so Enclave does not provide Antigravity-specific memory handling.
+The extension's `enclave-help` skill is installed alongside managed skills in
+`~/.gemini/config/skills`.
+
+## Network Access
+
+Allowlisted Antigravity and Google domains:
+
+| Purpose | Domains |
+|---------|---------|
+| Product site and docs | `antigravity.google` |
+| Sign-in | `accounts.google.com`, `oauth2.googleapis.com`, `www.googleapis.com` |
+| Model and agent backends | `cloudcode-pa.googleapis.com`, `aicode.googleapis.com`, `businessaicode.googleapis.com` |
+| Gemini API key | `generativelanguage.googleapis.com` (credential injected) |
+| Google Cloud sign-in | `aiplatform.googleapis.com`, `sts.googleapis.com`, `iamcredentials.googleapis.com` |
+
+The DNS allowlist also includes the common GitHub, npm, PyPI, Go, CDN, and
+TLS/OCSP infrastructure fragments used by Enclave. The `agy` self-updater and
+its download hosts are intentionally not allowlisted.
+
+The terminal sandbox (`enableTerminalSandbox`, `--sandbox`) needs unprivileged
+user namespaces, which are generally unavailable inside the container; Enclave's
+own isolation applies instead.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `spec.yaml` | Extension manifest (launch behavior, state paths, credentials, network, and provider auth) |
+| `install.sh` | Installs `agy` with the official native installer into `~/.local/bin` |
+| `check-update.sh` | Returns the latest `antigravity-cli` release tag for update probes |
+| `gateway-allowlist.conf` | DNS allowlist for network isolation |
+| `templates/settings.json` | Default Antigravity CLI settings template |
+| `entrypoint.d/setup.sh` | Creates `~/.gemini`, enables the Gemini API provider, and pre-trusts the project in yolo mode |
+| `skills/enclave-help/SKILL.md` | Bundled skill for answering questions from Enclave's documentation |
+| `go/handler.go` | Registers the Antigravity tool handler |

extensions/tools/antigravity/check-update.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 Dirk Fauth and others.
+#
+# This program and the accompanying materials are made available under the
+# terms of the MIT License, which is available in the project root.
+#
+# SPDX-License-Identifier: MIT
+
+set -euo pipefail
+
+curl -fsS https://api.github.com/repos/google-antigravity/antigravity-cli/releases/latest | jq -r '.tag_name'

extensions/tools/antigravity/entrypoint.d/setup.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# Copyright (C) 2026 Dirk Fauth and others.
+#
+# This program and the accompanying materials are made available under the
+# terms of the MIT License, which is available in the project root.
+#
+# SPDX-License-Identifier: MIT
+# shellcheck shell=bash
+
+# Antigravity CLI extension setup
+mkdir -p "$HOME/.gemini/config" "$HOME/.gemini/antigravity-cli"
+
+_agy_settings="${ENCLAVE_TOOL_SETTINGS_TARGET:-$HOME/.gemini/antigravity-cli/settings.json}"
+
+# Apply a jq filter to agy's settings.json (created if missing). Writes through
+# the path so a symlink into the config store is preserved. A settings file jq
+# cannot parse is left untouched; agy refuses to overwrite it either.
+# Usage: _agy_update_settings <filter> [jq args...]
+_agy_update_settings() {
+	local filter="$1" updated
+	shift
+	if [ -f "$_agy_settings" ]; then
+		updated="$(jq "$@" "$filter" "$_agy_settings" 2>/dev/null)" || return 0
+	else
+		updated="$(jq -n "$@" "$filter" 2>/dev/null)" || return 0
+	fi
+	printf '%s\n' "$updated" > "$_agy_settings"
+}
+
+if command -v jq >/dev/null 2>&1; then
+	# Keep the feedback survey off on every start, including for persisted or
+	# passed-through settings.json files that do not carry the template value.
+	_agy_update_settings '.showFeedbackSurvey = false'
+
+	# agy only talks to the Gemini API directly when modelProvider is "gemini";
+	# otherwise it ignores GEMINI_API_KEY and uses the Google sign-in.
+	if [ -n "${GEMINI_API_KEY:-}" ]; then
+		_agy_update_settings '.modelProvider = "gemini"'
+	fi
+
+	# In yolo mode, remember the project workspace as trusted so agy skips its
+	# workspace trust dialog. Only extend a list; leave other shapes alone.
+	if [ "${ENCLAVE_YOLO:-}" = "1" ] && [ -n "${PROJECT_DIR:-}" ]; then
+		_agy_update_settings \
+			'if (.trustedWorkspaces // []) | type == "array"
+			 then .trustedWorkspaces = (((.trustedWorkspaces // []) + [$dir]) | unique)
+			 else . end' \
+			--arg dir "$PROJECT_DIR"
+	fi
+fi
+unset -f _agy_update_settings
+unset _agy_settings

extensions/tools/antigravity/gateway-allowlist.conf

@@ -0,0 +1,41 @@
+# Copyright (C) 2026 Dirk Fauth and others.
+#
+# This program and the accompanying materials are made available under the
+# terms of the MIT License, which is available in the project root.
+#
+# SPDX-License-Identifier: MIT
+
+# Enclave DNS Allowlist Configuration - Antigravity CLI
+no-resolv
+no-poll
+address=/#/
+
+# Antigravity product site and docs
+server=/antigravity.google/8.8.8.8
+
+# Google sign-in: OAuth authorization, token exchange/refresh, user info
+server=/accounts.google.com/8.8.8.8
+server=/oauth2.googleapis.com/8.8.8.8
+server=/www.googleapis.com/8.8.8.8
+
+# Model and agent backends (Cloud Code / AI Code endpoints used by agy)
+server=/cloudcode-pa.googleapis.com/8.8.8.8
+server=/aicode.googleapis.com/8.8.8.8
+server=/businessaicode.googleapis.com/8.8.8.8
+
+# Gemini API (GEMINI_API_KEY with modelProvider "gemini")
+server=/generativelanguage.googleapis.com/8.8.8.8
+
+# Google Cloud / Gemini Enterprise sign-in (Business accounts, ADC, WIF).
+# Regional Vertex AI endpoints are not covered; add them with --allow-domain.
+server=/aiplatform.googleapis.com/8.8.8.8
+server=/sts.googleapis.com/8.8.8.8
+server=/iamcredentials.googleapis.com/8.8.8.8
+
+# Common Infrastructure (plugin marketplace, MCP servers, package registries)
+conf-file=/etc/dnsmasq.allowlists/fragments/github.conf
+conf-file=/etc/dnsmasq.allowlists/fragments/npm.conf
+conf-file=/etc/dnsmasq.allowlists/fragments/pypi.conf
+conf-file=/etc/dnsmasq.allowlists/fragments/go.conf
+conf-file=/etc/dnsmasq.allowlists/fragments/cdn.conf
+conf-file=/etc/dnsmasq.allowlists/fragments/tls.conf

extensions/tools/antigravity/go/handler.go

@@ -0,0 +1,18 @@
+// Copyright (C) 2026 Dirk Fauth and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the MIT License, which is available in the project root.
+//
+// SPDX-License-Identifier: MIT
+
+package antigravity
+
+import "enclave/internal/tools"
+
+func init() {
+	tools.RegisterHandler("antigravity", Handler{})
+}
+
+type Handler struct {
+	tools.BaseHandler
+}

extensions/tools/antigravity/install.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Copyright (C) 2026 Dirk Fauth and others.
+#
+# This program and the accompanying materials are made available under the
+# terms of the MIT License, which is available in the project root.
+#
+# SPDX-License-Identifier: MIT
+
+# Install Antigravity CLI via native installer
+set -e
+
+curl -fsSL https://antigravity.google/cli/install.sh | bash
+
+if ! command -v agy >/dev/null 2>&1; then
+    echo "Antigravity CLI install failed: agy binary not found" >&2
+    exit 1
+fi
+
+echo "Antigravity CLI installed at: $(which agy)"
+agy --version

extensions/tools/antigravity/skills/enclave-help/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: enclave-help
+description: Answer questions about Enclave by reading the bundled documentation
+---
+
+# Enclave Help
+
+Answer the user's question about Enclave by reading the relevant documentation
+files bundled at `/usr/share/doc/enclave/`.
+
+## Important context
+
+You are running inside an Enclave container. Host-global configuration
+(e.g. `~/.config/enclave/config.json`, network policies, secrets) lives on the
+host filesystem and is not directly editable from inside the container.
+When a question involves host-side configuration changes, explain what the
+user needs to do on the host or via the `enclave` CLI rather than
+attempting in-container file edits.
+
+## Documentation index
+
+| Path | Topic |
+|------|-------|
+| `docs/README.md` | Documentation index |
+| `docs/ARCHITECTURE.md` | Detailed architecture with diagrams |
+| `docs/cli-reference.md` | CLI flags and options |
+| `docs/configuration.md` | Config files and settings |
+| `docs/networking.md` | Network isolation and gateway |
+| `docs/auth.md` | Authentication and API keys |
+| `docs/persistence.md` | Persistent stores and session data |
+| `docs/tools.md` | Supported agent tools |
+| `docs/extensions/` | Extension system (adding tools, features) |
+| `docs/runtime/` | Runtime behavior (stores, auth sync, network flow) |
+| `docs/security/` | Security model and host hardening |
+| `extensions/tools/<tool>/README.md` | Per-tool documentation |
+| `extensions/features/<feature>/README.md` | Per-feature documentation |
+
+All paths are relative to `/usr/share/doc/enclave/`.
+
+## Steps
+
+1. Read the doc(s) most relevant to the user's question.
+2. Synthesize a clear, concise answer from what you find.
+3. If the docs don't cover the topic, say so explicitly.