{msg}
\".encode(\"utf-8\"))\n+ if handler_cls.ready is not None:\n+ handler_cls.ready.set()\n+\n+\n+class _ReusableHTTPServer(http.server.HTTPServer):\n+ allow_reuse_address = True\n+\n+\n+def resolve_project_id_from_env() -> str:\n+ for key in (\"HERMES_ANTIGRAVITY_PROJECT_ID\", \"GOOGLE_CLOUD_PROJECT\", \"GOOGLE_CLOUD_PROJECT_ID\"):\n+ value = (os.getenv(key) or \"\").strip()\n+ if value:\n+ return value\n+ return \"\"\n+\n+\n+def start_oauth_flow(\n+ *,\n+ force_relogin: bool = False,\n+ open_browser: bool = True,\n+ port: int = DEFAULT_REDIRECT_PORT,\n+ project_id: str = \"\",\n+) -> AntigravityCredentials:\n+ if not force_relogin:\n+ existing = load_credentials()\n+ if existing and not existing.access_token_expired():\n+ return existing\n+\n+ verifier, challenge = _generate_pkce_pair()\n+ state = secrets.token_urlsafe(24)\n+ client_id, _ = _require_client_credentials()\n+\n+ ready = threading.Event()\n+ handler_cls = type(\"AntigravityOAuthCallbackHandler\", (_OAuthCallbackHandler,), {})\n+ handler_cls.expected_state = state\n+ handler_cls.captured_code = None\n+ handler_cls.captured_error = None\n+ handler_cls.ready = ready\n+\n+ try:\n+ server = _ReusableHTTPServer((REDIRECT_HOST, int(port)), handler_cls)\n+ except OSError:\n+ server = _ReusableHTTPServer((REDIRECT_HOST, 0), handler_cls)\n+ actual_port = int(server.server_address[1])\n+ redirect_uri = f\"http://{REDIRECT_HOST}:{actual_port}{CALLBACK_PATH}\"\n+\n+ thread = threading.Thread(target=server.serve_forever, daemon=True)\n+ thread.start()\n+ try:\n+ params = {\n+ \"client_id\": client_id,\n+ \"redirect_uri\": redirect_uri,\n+ \"response_type\": \"code\",\n+ \"scope\": OAUTH_SCOPES,\n+ \"access_type\": \"offline\",\n+ \"prompt\": \"consent\",\n+ \"state\": state,\n+ \"code_challenge\": challenge,\n+ \"code_challenge_method\": \"S256\",\n+ }\n+ auth_url = AUTH_ENDPOINT + \"?\" + urllib.parse.urlencode(params)\n+ print(\"Open this URL to authorize Antigravity OAuth:\")\n+ print(auth_url)\n+ if open_browser:\n+ webbrowser.open(auth_url)\n+ if not ready.wait(timeout=CALLBACK_WAIT_SECONDS):\n+ raise AntigravityOAuthError(\n+ \"Timed out waiting for Antigravity OAuth callback.\",\n+ code=\"antigravity_oauth_callback_timeout\",\n+ )\n+ if handler_cls.captured_error:\n+ raise AntigravityOAuthError(\n+ handler_cls.captured_error,\n+ code=\"antigravity_oauth_callback_error\",\n+ )\n+ code = handler_cls.captured_code or \"\"\n+ token = [redacted:secret-assignment] verifier, redirect_uri)\n+ finally:\n+ server.shutdown()\n+ server.server_close()\n+\n+ access_token = [redacted:secret-assignment]\"access_token\", \"\") or \"\").strip()\n+ refresh_token = [redacted:secret-assignment]\"refresh_token\", \"\") or \"\").strip()\n+ if not access_token or not refresh_token:\n+ raise AntigravityOAuthError(\n+ \"Antigravity OAuth response did not include both access_token and refresh_token.\",\n+ code=\"antigravity_oauth_missing_token\",\n+ )\n+ expires_in = int(token.get(\"expires_in\", 0) or 0)\n+ creds = AntigravityCredentials(\n+ access_token=[redacted:secret-assignment]\n+ refresh_token=[redacted:secret-assignment]\n+ expires_ms=int((time.time() + max(60, expires_in)) * 1000),\n+ email=_fetch_user_email(access_token),\n+ project_id=project_id,\n+ )\n+ save_credentials(creds)\n+ return creds\n+\n+\n+def run_antigravity_oauth_login_pure() -> Dict[str, Any]:\n+ creds = start_oauth_flow(\n+ force_relogin=True,\n+ project_id=resolve_project_id_from_env(),\n+ )\n+ return {\n+ \"access_token\": creds.access_token,\n+ \"refresh_token\": creds.refresh_token,\n+ \"expires_at_ms\": creds.expires_ms,\n+ \"email\": creds.email,\n+ \"project_id\": creds.project_id,\n+ }"]},{"file":"agent/gemini_cloudcode_adapter.py","hunks":["@@ -93,11 +93,14 @@ def _translate_tool_call_to_gemini(tool_call: Dict[str, Any]) -> Dict[str, Any]:\n args = {\"_raw\": args_raw}\n if not isinstance(args, dict):\n args = {\"_value\": args}\n+ function_call = {\n+ \"name\": fn.get(\"name\") or \"\",\n+ \"args\": args,\n+ }\n+ if tool_call.get(\"id\"):\n+ function_call[\"id\"] = str(tool_call[\"id\"])\n return {\n- \"functionCall\": {\n- \"name\": fn.get(\"name\") or \"\",\n- \"args\": args,\n- },\n+ \"functionCall\": function_call,\n # Sentinel signature — matches opencode-gemini-auth's approach.\n # Without this, Code Assist rejects function calls that originated\n # outside its own chain.","@@ -122,12 +125,13 @@ def _translate_tool_result_to_gemini(message: Dict[str, Any]) -> Dict[str, Any]:\n except json.JSONDecodeError:\n parsed = None\n response = parsed if isinstance(parsed, dict) else {\"output\": content}\n- return {\n- \"functionResponse\": {\n- \"name\": name,\n- \"response\": response,\n- },\n+ function_response = {\n+ \"name\": name,\n+ \"response\": response,\n }\n+ if message.get(\"tool_call_id\"):\n+ function_response[\"id\"] = str(message[\"tool_call_id\"])\n+ return {\"functionResponse\": function_response}\n \n \n def _build_gemini_contents(","@@ -358,8 +362,9 @@ def _translate_gemini_response(\n args_str = json.dumps(fc.get(\"args\") or {}, ensure_ascii=False)\n except (TypeError, ValueError):\n args_str = \"{}\"\n+ call_id = str(fc.get(\"id\") or \"\").strip() or f\"call_{uuid.uuid4().hex[:12]}\"\n tool_calls.append(SimpleNamespace(\n- id=f\"call_{uuid.uuid4().hex[:12]}\",\n+ id=call_id,\n type=\"function\",\n index=i,\n function=SimpleNamespace(name=str(fc[\"name\"]), arguments=args_str),","@@ -554,6 +559,7 @@ def _translate_stream_event(\n model=model,\n tool_call_delta={\n \"index\": idx,\n+ \"id\": str(fc.get(\"id\") or \"\").strip(),\n \"name\": name,\n \"arguments\": args_str,\n },"]},{"file":"agent/transports/chat_completions.py","hunks":["@@ -437,7 +437,7 @@ def build_kwargs(\n extra_body[\"extra_body\"] = openai_compat_extra\n elif raw_thinking_config:\n extra_body[\"thinking_config\"] = raw_thinking_config\n- elif provider_name == \"google-gemini-cli\":\n+ elif provider_name in {\"google-gemini-cli\", \"google-antigravity\"}:\n thinking_config = _build_gemini_thinking_config(model, reasoning_config)\n if thinking_config:\n extra_body[\"thinking_config\"] = thinking_config"]},{"file":"hermes_cli/auth.py","hunks":["@@ -142,6 +142,9 @@\n DEFAULT_GEMINI_CLOUDCODE_BASE_URL = \"cloudcode-pa://google\"\n GEMINI_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 60 # refresh 60s before expiry\n \n+# Google Antigravity OAuth (Antigravity Code Assist backend)\n+DEFAULT_ANTIGRAVITY_CLOUDCODE_BASE_URL = \"antigravity-pa://google\"\n+\n # LM Studio's default no-auth mode still requires *some* non-empty bearer for\n # the API-key code paths (auxiliary_client, runtime resolver) to treat the\n # provider as configured. This sentinel is sent only to LM Studio, never to","@@ -212,6 +215,12 @@ class ProviderConfig:\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_GEMINI_CLOUDCODE_BASE_URL,\n ),\n+ \"google-antigravity\": ProviderConfig(\n+ id=\"google-antigravity\",\n+ name=\"Google Antigravity (OAuth)\",\n+ auth_type=\"oauth_external\",\n+ inference_base_url=DEFAULT_ANTIGRAVITY_CLOUDCODE_BASE_URL,\n+ ),\n \"lmstudio\": ProviderConfig(\n id=\"lmstudio\",\n name=\"LM Studio\",","@@ -1530,6 +1539,7 @@ def resolve_provider(\n \"github-copilot-acp\": \"copilot-acp\", \"copilot-acp-agent\": \"copilot-acp\",\n \"opencode\": \"opencode-zen\", \"zen\": \"opencode-zen\",\n \"qwen-portal\": \"qwen-oauth\", \"qwen-cli\": \"qwen-oauth\", \"qwen-oauth\": \"qwen-oauth\", \"google-gemini-cli\": \"google-gemini-cli\", \"gemini-cli\": \"google-gemini-cli\", \"gemini-oauth\": \"google-gemini-cli\",\n+ \"google-antigravity\": \"google-antigravity\", \"google-antigravity-oauth\": \"google-antigravity\", \"antigravity\": \"google-antigravity\", \"antigravity-oauth\": \"google-antigravity\", \"antigravity-cli\": \"google-antigravity\", \"agy\": \"google-antigravity\", \"agy-cli\": \"google-antigravity\",\n \"hf\": \"huggingface\", \"hugging-face\": \"huggingface\", \"huggingface-hub\": \"huggingface\",\n \"mimo\": \"xiaomi\", \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\", \"tokenhub\": \"tencent-tokenhub\",","@@ -2246,6 +2256,72 @@ def get_gemini_oauth_auth_status() -> Dict[str, Any]:\n \"email\": creds.email,\n \"project_id\": creds.project_id,\n }\n+\n+\n+def resolve_antigravity_oauth_runtime_credentials(\n+ *,\n+ force_refresh: bool = False,\n+) -> Dict[str, Any]:\n+ \"\"\"Resolve runtime OAuth creds for google-antigravity.\"\"\"\n+ try:\n+ from agent.antigravity_oauth import (\n+ AntigravityOAuthError,\n+ _credentials_path,\n+ get_valid_access_token,\n+ load_credentials,\n+ )\n+ except ImportError as exc:\n+ raise AuthError(\n+ f\"agent.antigravity_oauth is not importable: {exc}\",\n+ provider=\"google-antigravity\",\n+ code=\"antigravity_oauth_module_missing\",\n+ ) from exc\n+\n+ try:\n+ access_token = [redacted:secret-assignment]\n+ except AntigravityOAuthError as exc:\n+ raise AuthError(\n+ str(exc),\n+ provider=\"google-antigravity\",\n+ code=exc.code,\n+ ) from exc\n+\n+ creds = load_credentials()\n+ return {\n+ \"provider\": \"google-antigravity\",\n+ \"base_url\": DEFAULT_ANTIGRAVITY_CLOUDCODE_BASE_URL,\n+ \"api_key\": access_token,\n+ \"source\": \"antigravity-oauth\",\n+ \"expires_at_ms\": (creds.expires_ms if creds else None),\n+ \"auth_file\": str(_credentials_path()),\n+ \"email\": (creds.email if creds else \"\") or \"\",\n+ \"project_id\": (creds.project_id if creds else \"\") or \"\",\n+ }\n+\n+\n+def get_antigravity_oauth_auth_status() -> Dict[str, Any]:\n+ \"\"\"Return a status dict for `hermes auth list` / `hermes status`.\"\"\"\n+ try:\n+ from agent.antigravity_oauth import _credentials_path, load_credentials\n+ except ImportError:\n+ return {\"logged_in\": False, \"error\": \"agent.antigravity_oauth unavailable\"}\n+ auth_path = _credentials_path()\n+ creds = load_credentials()\n+ if creds is None or not creds.access_token:\n+ return {\n+ \"logged_in\": False,\n+ \"auth_file\": str(auth_path),\n+ \"error\": \"not logged in\",\n+ }\n+ return {\n+ \"logged_in\": True,\n+ \"auth_file\": str(auth_path),\n+ \"source\": \"antigravity-oauth\",\n+ \"api_key\": creds.access_token,\n+ \"expires_at_ms\": creds.expires_ms,\n+ \"email\": creds.email,\n+ \"project_id\": creds.project_id,\n+ }\n # Spotify auth — PKCE tokens stored in ~/.hermes/auth.json\n # =============================================================================\n ","@@ -6191,6 +6267,8 @@ def get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:\n return get_qwen_auth_status()\n if target == \"google-gemini-cli\":\n return get_gemini_oauth_auth_status()\n+ if target == \"google-antigravity\":\n+ return get_antigravity_oauth_auth_status()\n if target == \"minimax-oauth\":\n return get_minimax_oauth_auth_status()\n if target == \"copilot-acp\":"]},{"file":"hermes_cli/auth_commands.py","hunks":["@@ -34,7 +34,7 @@\n \n \n # Providers that support OAuth login in addition to API keys.\n-_OAUTH_CAPABLE_PROVIDERS = {\"anthropic\", \"nous\", \"openai-codex\", \"xai-oauth\", \"qwen-oauth\", \"google-gemini-cli\", \"minimax-oauth\"}\n+_OAUTH_CAPABLE_PROVIDERS = {\"anthropic\", \"nous\", \"openai-codex\", \"xai-oauth\", \"qwen-oauth\", \"google-gemini-cli\", \"google-antigravity\", \"minimax-oauth\"}\n \n \n def _get_custom_provider_names() -> list:","@@ -386,6 +386,27 @@ def auth_add_command(args) -> None:\n print(f'Added {provider} OAuth credential #{len(pool.entries())}: \"{entry.label}\"')\n return\n \n+ if provider == \"google-antigravity\":\n+ from agent.antigravity_oauth import run_antigravity_oauth_login_pure\n+\n+ creds = run_antigravity_oauth_login_pure()\n+ label = (getattr(args, \"label\", None) or \"\").strip() or (\n+ creds.get(\"email\") or _oauth_default_label(provider, len(pool.entries()) + 1)\n+ )\n+ entry = PooledCredential(\n+ provider=provider,\n+ id=uuid.uuid4().hex[:6],\n+ label=label,\n+ auth_type=AUTH_TYPE_OAUTH,\n+ priority=0,\n+ source=f\"{SOURCE_MANUAL}:antigravity_pkce\",\n+ access_token=[redacted:secret-assignment]\"access_token\"],\n+ refresh_token=[redacted:secret-assignment]\"refresh_token\"),\n+ )\n+ pool.add_entry(entry)\n+ print(f'Added {provider} OAuth credential #{len(pool.entries())}: \"{entry.label}\"')\n+ return\n+\n if provider == \"qwen-oauth\":\n creds = auth_mod.resolve_qwen_runtime_credentials(refresh_if_expiring=False)\n auth_mod._mark_qwen_oauth_active(creds)"]},{"file":"hermes_cli/config.py","hunks":["@@ -3100,6 +3100,38 @@ def _ensure_hermes_home_managed(home: Path):\n \"category\": \"provider\",\n \"advanced\": True,\n },\n+ \"HERMES_ANTIGRAVITY_CLIENT_ID\": {\n+ \"description\": \"Google OAuth client ID for google-antigravity (optional; discovered from agy when omitted)\",\n+ \"prompt\": \"Antigravity OAuth client ID (optional — leave empty to discover from agy)\",\n+ \"url\": \"https://console.cloud.google.com/apis/credentials\",\n+ \"password\": False,\n+ \"category\": \"provider\",\n+ \"advanced\": True,\n+ },\n+ \"HERMES_ANTIGRAVITY_CLIENT_SECRET\": {\n+ \"description\": \"Google OAuth client secret for google-antigravity (optional)\",\n+ \"prompt\": \"Antigravity OAuth client secret (optional)\",\n+ \"url\": \"https://console.cloud.google.com/apis/credentials\",\n+ \"password\": True,\n+ \"category\": \"provider\",\n+ \"advanced\": True,\n+ },\n+ \"HERMES_ANTIGRAVITY_CLI_PATH\": {\n+ \"description\": \"Path to agy/Antigravity CLI for OAuth client credential discovery\",\n+ \"prompt\": \"Antigravity CLI path (leave empty to search PATH/default locations)\",\n+ \"url\": None,\n+ \"password\": False,\n+ \"category\": \"provider\",\n+ \"advanced\": True,\n+ },\n+ \"HERMES_ANTIGRAVITY_PROJECT_ID\": {\n+ \"description\": \"GCP project ID for Antigravity OAuth (auto-discovered when omitted)\",\n+ \"prompt\": \"GCP project ID for Antigravity OAuth (leave empty to auto-discover)\",\n+ \"url\": None,\n+ \"password\": False,\n+ \"category\": \"provider\",\n+ \"advanced\": True,\n+ },\n \"OPENCODE_ZEN_API_KEY\": {\n \"description\": \"OpenCode Zen API key (pay-as-you-go access to curated models)\",\n \"prompt\": \"OpenCode Zen API key\","]},{"file":"hermes_cli/main.py","hunks":["@@ -603,6 +603,7 @@ def _resolve_sudo_user_profile_env(name: str) -> str | None:\n _model_flow_qwen_oauth,\n _model_flow_minimax_oauth,\n _model_flow_google_gemini_cli,\n+ _model_flow_google_antigravity,\n _model_flow_custom,\n _model_flow_azure_foundry,\n _model_flow_named_custom,","@@ -3074,6 +3075,8 @@ def _active_custom_key_from_base_url() -> str:\n _model_flow_minimax_oauth(config, current_model, args=args)\n elif selected_provider == \"google-gemini-cli\":\n _model_flow_google_gemini_cli(config, current_model)\n+ elif selected_provider == \"google-antigravity\":\n+ _model_flow_google_antigravity(config, current_model)\n elif selected_provider == \"copilot-acp\":\n _model_flow_copilot_acp(config, current_model)\n elif selected_provider == \"copilot\":","@@ -3603,14 +3606,6 @@ def _prompt_provider_choice(choices, *, default=0, title=\"Select provider:\"):\n ]\n \n \n-\n-\n-\n-\n-\n-\n-\n-\n def _prompt_custom_api_mode_selection(base_url: str, current_api_mode: str = \"\") -> Optional[str]:\n \"\"\"Prompt for a custom provider API mode.\n ","@@ -11248,6 +11243,24 @@ def cmd_logs(args):\n since=getattr(args, \"since\", None),\n component=getattr(args, \"component\", None),\n )\n+\n+\n+def _build_provider_choices() -> list[str]:\n+ \"\"\"Build the --provider choices list from CANONICAL_PROVIDERS + 'auto'.\"\"\"\n+ try:\n+ from hermes_cli.models import CANONICAL_PROVIDERS as _cp\n+ return [\"auto\"] + [p.slug for p in _cp]\n+ except Exception:\n+ # Fallback: static list guarantees the CLI always works\n+ return [\n+ \"auto\", \"openrouter\", \"nous\", \"openai-codex\", \"xai-oauth\", \"copilot-acp\", \"copilot\",\n+ \"anthropic\", \"gemini\", \"google-gemini-cli\", \"google-antigravity\", \"xai\", \"bedrock\", \"azure-foundry\",\n+ \"ollama-cloud\", \"huggingface\", \"zai\", \"kimi-coding\", \"kimi-coding-cn\",\n+ \"stepfun\", \"minimax\", \"minimax-cn\", \"kilocode\", \"novita\", \"xiaomi\", \"arcee\",\n+ \"nvidia\", \"deepseek\", \"alibaba\", \"qwen-oauth\", \"opencode-zen\", \"opencode-go\",\n+ ]\n+\n+\n # Top-level subcommands that argparse knows about WITHOUT running plugin\n # discovery. Used to short-circuit eager plugin imports (which can take\n # 500ms+ pulling in google.cloud.pubsub_v1, aiohttp, grpc, etc.) when the"]},{"file":"hermes_cli/model_setup_flows.py","hunks":["@@ -712,6 +712,64 @@ def _model_flow_google_gemini_cli(_config, current_model=\"\"):\n else:\n print(\"No change.\")\n \n+\n+def _model_flow_google_antigravity(_config, current_model=\"\"):\n+ \"\"\"Google Antigravity OAuth via Antigravity Code Assist.\n+\n+ Antigravity is Google's consumer successor to the Gemini CLI. It reuses the\n+ Code Assist backend with a distinct OAuth client + scopes. Leaves the\n+ `google-gemini-cli` provider (Enterprise Code Assist) untouched.\n+ \"\"\"\n+ from hermes_cli.auth import (\n+ DEFAULT_ANTIGRAVITY_CLOUDCODE_BASE_URL,\n+ get_antigravity_oauth_auth_status,\n+ resolve_antigravity_oauth_runtime_credentials,\n+ _prompt_model_selection,\n+ _save_model_choice,\n+ _update_config_for_provider,\n+ )\n+ from hermes_cli.models import provider_model_ids\n+\n+ status = get_antigravity_oauth_auth_status()\n+ if not status.get(\"logged_in\"):\n+ try:\n+ from agent.antigravity_oauth import resolve_project_id_from_env, start_oauth_flow\n+\n+ env_project = resolve_project_id_from_env()\n+ start_oauth_flow(force_relogin=True, project_id=env_project)\n+ except Exception as exc:\n+ print(f\"OAuth login failed: {exc}\")\n+ return\n+\n+ try:\n+ creds = resolve_antigravity_oauth_runtime_credentials(force_refresh=False)\n+ project_id = creds.get(\"project_id\", \"\")\n+ if project_id:\n+ print(f\" Using Antigravity project: {project_id}\")\n+ except Exception as exc:\n+ print(f\"Failed to resolve Antigravity credentials: {exc}\")\n+ return\n+\n+ models = provider_model_ids(\"google-antigravity\")\n+ default = current_model or (models[0] if models else \"gemini-3-flash-agent\")\n+ selected = _prompt_model_selection(\n+ models,\n+ current_model=default,\n+ confirm_provider=\"google-antigravity\",\n+ confirm_base_url=DEFAULT_ANTIGRAVITY_CLOUDCODE_BASE_URL,\n+ )\n+ if selected:\n+ _save_model_choice(selected)\n+ _update_config_for_provider(\n+ \"google-antigravity\", DEFAULT_ANTIGRAVITY_CLOUDCODE_BASE_URL\n+ )\n+ print(\n+ f\"Default model set to: {selected} (via Google Antigravity OAuth / Code Assist)\"\n+ )\n+ else:\n+ print(\"No change.\")\n+\n+\n def _model_flow_custom(config):\n \"\"\"Custom endpoint: collect URL, API key, and model name.\n "]},{"file":"hermes_cli/models.py","hunks":["@@ -276,6 +276,15 @@ def _xai_curated_models() -> list[str]:\n \"gemini-3-flash-preview\",\n \"gemini-3.5-flash\",\n ],\n+ \"google-antigravity\": [\n+ \"gemini-3-flash-agent\",\n+ \"gemini-3.5-flash-low\",\n+ \"gemini-pro-agent\",\n+ \"gemini-3.1-pro-low\",\n+ \"claude-sonnet-4-6\",\n+ \"claude-opus-4-6-thinking\",\n+ \"gpt-oss-120b-medium\",\n+ ],\n \"zai\": [\n \"glm-5.2\",\n \"glm-5.1\",","@@ -1029,6 +1038,7 @@ class ProviderEntry(NamedTuple):\n ProviderEntry(\"huggingface\", \"Hugging Face\", \"Hugging Face Inference Providers\"),\n ProviderEntry(\"gemini\", \"Google AI Studio\", \"Google AI Studio (Native Gemini API)\"),\n ProviderEntry(\"google-gemini-cli\", \"Google Gemini (OAuth)\", \"Google Gemini via OAuth + Code Assist (Code Assist OAuth flow)\"),\n+ ProviderEntry(\"google-antigravity\", \"Google Antigravity (OAuth)\", \"Google Antigravity via OAuth + Code Assist (Gemini 3.5/3.1, Claude, GPT-OSS where entitled)\"),\n ProviderEntry(\"deepseek\", \"DeepSeek\", \"DeepSeek (V3, R1, coder, direct API)\"),\n ProviderEntry(\"xai\", \"xAI\", \"xAI Grok (Direct API)\"),\n ProviderEntry(\"zai\", \"Z.AI / GLM\", \"Z.AI / GLM (Zhipu direct API)\"),","@@ -1222,6 +1232,12 @@ def group_providers(slugs):\n \"qwen-portal\": \"qwen-oauth\",\n \"gemini-cli\": \"google-gemini-cli\",\n \"gemini-oauth\": \"google-gemini-cli\",\n+ \"antigravity\": \"google-antigravity\",\n+ \"antigravity-oauth\": \"google-antigravity\",\n+ \"antigravity-cli\": \"google-antigravity\",\n+ \"google-antigravity-oauth\": \"google-antigravity\",\n+ \"agy\": \"google-antigravity\",\n+ \"agy-cli\": \"google-antigravity\",\n \"hf\": \"huggingface\",\n \"hugging-face\": \"huggingface\",\n \"huggingface-hub\": \"huggingface\",","@@ -1788,6 +1804,15 @@ def _model_in_provider_catalog(name_lower: str, providers: set[str]) -> bool:\n {\"nous\", \"openrouter\", \"copilot\", \"kilocode\"}\n )\n \n+# Subscription/OAuth providers whose catalogs RE-EXPOSE other vendors' models\n+# (e.g. google-antigravity serves Claude / Gemini / GPT-OSS where the account\n+# is entitled). For bare short-alias resolution (`sonnet`, `opus`, ...) these\n+# must NOT hijack the alias away from the model's native vendor provider\n+# (`anthropic`, `gemini`, ...). They're tried only as a last resort, after\n+# every native-vendor catalog. They are NOT aggregators (an explicit switch TO\n+# them is still valid), so they stay out of _AGGREGATOR_PROVIDERS.\n+_BORROWED_MODEL_PROVIDERS = frozenset({\"google-antigravity\"})\n+\n \n def _resolve_static_model_alias(\n name_lower: str,","@@ -1825,7 +1850,11 @@ def _match(provider: str) -> Optional[str]:\n return provider, matched\n \n for provider in _PROVIDER_MODELS:\n- if provider in current_keys or provider in _AGGREGATOR_PROVIDERS:\n+ if (\n+ provider in current_keys\n+ or provider in _AGGREGATOR_PROVIDERS\n+ or provider in _BORROWED_MODEL_PROVIDERS\n+ ):\n continue\n if matched := _match(provider):\n return provider, matched","@@ -1834,6 +1863,13 @@ def _match(provider: str) -> Optional[str]:\n if provider in current_keys and (matched := _match(provider)):\n return provider, matched\n \n+ # Last resort: providers that re-expose other vendors' models (e.g.\n+ # google-antigravity serving Claude). Only reached when no native-vendor\n+ # catalog matched — so `sonnet` resolves to anthropic, not antigravity.\n+ for provider in _BORROWED_MODEL_PROVIDERS:\n+ if provider in current_keys and (matched := _match(provider)):\n+ return provider, matched\n+\n return None\n \n ","@@ -1880,11 +1916,23 @@ def detect_static_provider_for_model(\n \n # --- Step 1: check static provider catalogs for a direct match ---\n for pid, models in _PROVIDER_MODELS.items():\n- if pid in current_keys or pid in _AGGREGATOR_PROVIDERS:\n+ if (\n+ pid in current_keys\n+ or pid in _AGGREGATOR_PROVIDERS\n+ or pid in _BORROWED_MODEL_PROVIDERS\n+ ):\n continue\n if any(name_lower == m.lower() for m in models):\n return (pid, name)\n \n+ # Borrow-list providers (re-expose other vendors' models) only after every\n+ # native-vendor catalog, and only when one is the current provider.\n+ for pid in _BORROWED_MODEL_PROVIDERS:\n+ if pid in current_keys:\n+ continue\n+ if any(name_lower == m.lower() for m in _PROVIDER_MODELS.get(pid, [])):\n+ return (pid, name)\n+\n return None\n \n ","@@ -2192,6 +2240,32 @@ def _merge_with_models_dev(provider: str, curated: list[str]) -> list[str]:\n return merged\n \n \n+def _fetch_antigravity_models(*, force_refresh: bool = False) -> list[str]:\n+ try:\n+ from agent import antigravity_oauth\n+ from agent.antigravity_code_assist import (\n+ fetch_available_models_with_fallbacks,\n+ load_code_assist,\n+ parse_agent_model_ids,\n+ )\n+ from hermes_cli.auth import resolve_antigravity_oauth_runtime_credentials\n+\n+ creds = resolve_antigravity_oauth_runtime_credentials(force_refresh=force_refresh)\n+ access_token = [redacted:secret-assignment]\"api_key\") or \"\").strip()\n+ project_id = str(creds.get(\"project_id\") or \"\").strip()\n+ if not access_token:\n+ return []\n+ if not project_id:\n+ info = load_code_assist(access_token)\n+ project_id = info.project_id\n+ if project_id:\n+ antigravity_oauth.update_project_ids(project_id=project_id, managed_project_id=project_id)\n+ payload = fetch_available_models_with_fallbacks(access_token, project_id=project_id)\n+ return parse_agent_model_ids(payload)\n+ except Exception:\n+ return []\n+\n+\n def provider_model_ids(provider: Optional[str], *, force_refresh: bool = False) -> list[str]:\n \"\"\"Return the best known model catalog for a provider.\n ","@@ -2222,6 +2296,10 @@ def provider_model_ids(provider: Optional[str], *, force_refresh: bool = False)\n return get_codex_model_ids(access_token=[redacted:secret-assignment]\n if normalized == \"xai-oauth\":\n return list(_PROVIDER_MODELS.get(\"xai-oauth\", _PROVIDER_MODELS.get(\"xai\", [])))\n+ if normalized == \"google-antigravity\":\n+ live = _fetch_antigravity_models(force_refresh=force_refresh)\n+ if live:\n+ return live\n if normalized in {\"copilot\", \"copilot-acp\"}:\n try:\n live = _fetch_github_models(_resolve_copilot_catalog_api_key())"]},{"file":"hermes_cli/providers.py","hunks":["@@ -81,6 +81,11 @@ class HermesOverlay:\n auth_type=\"oauth_external\",\n base_url_override=\"cloudcode-pa://google\",\n ),\n+ \"google-antigravity\": HermesOverlay(\n+ transport=\"openai_chat\",\n+ auth_type=\"oauth_external\",\n+ base_url_override=\"antigravity-pa://google\",\n+ ),\n \"lmstudio\": HermesOverlay(\n transport=\"openai_chat\",\n auth_type=\"api_key\",","@@ -314,6 +319,13 @@ class ProviderDef:\n \"gemini-cli\": \"google-gemini-cli\",\n \"gemini-oauth\": \"google-gemini-cli\",\n \n+ # google-antigravity (OAuth + Antigravity Code Assist)\n+ \"antigravity\": \"google-antigravity\",\n+ \"antigravity-oauth\": \"google-antigravity\",\n+ \"antigravity-cli\": \"google-antigravity\",\n+ \"google-antigravity-oauth\": \"google-antigravity\",\n+ \"agy\": \"google-antigravity\",\n+ \"agy-cli\": \"google-antigravity\",\n \n # huggingface\n \"hf\": \"huggingface\","]},{"file":"hermes_cli/runtime_provider.py","hunks":["@@ -27,6 +27,7 @@\n resolve_xai_oauth_runtime_credentials,\n resolve_qwen_runtime_credentials,\n resolve_gemini_oauth_runtime_credentials,\n+ resolve_antigravity_oauth_runtime_credentials,\n resolve_api_key_provider_credentials,\n resolve_external_process_provider_credentials,\n has_usable_secret,","@@ -334,6 +335,9 @@ def _resolve_runtime_from_pool_entry(\n elif provider == \"google-gemini-cli\":\n api_mode = \"chat_completions\"\n base_url = base_url or \"cloudcode-pa://google\"\n+ elif provider == \"google-antigravity\":\n+ api_mode = \"chat_completions\"\n+ base_url = base_url or \"antigravity-pa://google\"\n elif provider == \"minimax-oauth\":\n # MiniMax OAuth tokens are valid only against the Anthropic Messages\n # compatible endpoint. Do not honor stale model.api_mode values from a","@@ -1634,6 +1638,26 @@ def resolve_runtime_provider(\n logger.info(\"Google Gemini OAuth credentials failed; \"\n \"falling through to next provider.\")\n \n+ if provider == \"google-antigravity\":\n+ try:\n+ creds = resolve_antigravity_oauth_runtime_credentials()\n+ return {\n+ \"provider\": \"google-antigravity\",\n+ \"api_mode\": \"chat_completions\",\n+ \"base_url\": creds.get(\"base_url\", \"\"),\n+ \"api_key\": creds.get(\"api_key\", \"\"),\n+ \"source\": creds.get(\"source\", \"antigravity-oauth\"),\n+ \"expires_at_ms\": creds.get(\"expires_at_ms\"),\n+ \"email\": creds.get(\"email\", \"\"),\n+ \"project_id\": creds.get(\"project_id\", \"\"),\n+ \"requested_provider\": requested_provider,\n+ }\n+ except AuthError:\n+ if requested_provider != \"auto\":\n+ raise\n+ logger.info(\"Google Antigravity OAuth credentials failed; \"\n+ \"falling through to next provider.\")\n+\n if provider == \"copilot-acp\":\n creds = resolve_external_process_provider_credentials(provider)\n return {"]},{"file":"plugins/model-providers/gemini/__init__.py","hunks":["@@ -2,6 +2,7 @@\n \n gemini: Google AI Studio (API key) — uses GeminiNativeClient\n google-gemini-cli: Google Cloud Code Assist (OAuth) — uses GeminiCloudCodeClient\n+google-antigravity: Google Antigravity Code Assist (OAuth) — uses AntigravityCloudCodeClient\n \n Both report api_mode=\"chat_completions\" but use custom native clients\n that bypass the standard OpenAI transport. The profile captures auth","@@ -68,5 +69,22 @@ def build_extra_body(\n auth_type=\"oauth_external\",\n )\n \n+google_antigravity = GeminiProfile(\n+ name=\"google-antigravity\",\n+ aliases=(\n+ \"antigravity\",\n+ \"antigravity-oauth\",\n+ \"antigravity-cli\",\n+ \"google-antigravity-oauth\",\n+ \"agy\",\n+ \"agy-cli\",\n+ ),\n+ api_mode=\"chat_completions\",\n+ env_vars=(), # OAuth — no API key\n+ base_url=\"antigravity-pa://google\", # Antigravity Code Assist internal scheme\n+ auth_type=\"oauth_external\",\n+)\n+\n register_provider(gemini)\n register_provider(google_gemini_cli)\n+register_provider(google_antigravity)"]},{"file":"scripts/release.py","hunks":["@@ -45,6 +45,7 @@\n \n # Auto-extracted from noreply emails + manual overrides\n AUTHOR_MAP = {\n+ \"[redacted:email]\": \"pmos69\", # PR #29474 salvage (native Antigravity OAuth provider; Gemini CLI sunset #29294/#49701)\n \"[redacted:email]\": \"orbisai0security\", # PR #9560 salvage (session.py path-traversal guard, V-009)\n \"[redacted:email]\": \"panghuer023\", # PR #37994 salvage (interrupt unblocks pending gateway approval; #8697)\n \"[redacted:email]\": \"natehale\", # PR #48678 salvage (typing indicator lingers after final reply)"]},{"file":"tests/agent/test_antigravity_cloudcode.py","hunks":["@@ -0,0 +1,405 @@\n+\"\"\"Tests for the google-antigravity OAuth + Antigravity Code Assist provider.\"\"\"\n+\n+from __future__ import annotations\n+\n+import json\n+import os\n+import stat\n+import time\n+import threading\n+import urllib.parse\n+from io import BytesIO\n+from pathlib import Path\n+\n+import pytest\n+\n+\n[redacted:email](autouse=True)\n+def _isolate_env(monkeypatch, tmp_path):\n+ home = tmp_path / \".hermes\"\n+ home.mkdir(parents=True)\n+ monkeypatch.setattr(Path, \"home\", lambda: tmp_path)\n+ monkeypatch.setenv(\"HERMES_HOME\", str(home))\n+ for key in (\n+ \"HERMES_ANTIGRAVITY_CLIENT_ID\",\n+ \"HERMES_ANTIGRAVITY_CLIENT_SECRET\",\n+ \"HERMES_ANTIGRAVITY_CLI_PATH\",\n+ \"HERMES_ANTIGRAVITY_PROJECT_ID\",\n+ \"GOOGLE_CLOUD_PROJECT\",\n+ \"GOOGLE_CLOUD_PROJECT_ID\",\n+ \"LOCALAPPDATA\",\n+ \"APPDATA\",\n+ \"ProgramFiles\",\n+ \"ProgramFiles(x86)\",\n+ ):\n+ monkeypatch.delenv(key, raising=False)\n+ monkeypatch.setattr(\"shutil.which\", lambda _: None)\n+ try:\n+ from agent import antigravity_oauth\n+\n+ antigravity_oauth._discovered_creds_cache.clear()\n+ except Exception:\n+ pass\n+ return home\n+\n+\n+class TestAntigravityCredentials:\n+ def test_save_load_uses_separate_file_and_0600_permissions(self):\n+ from agent.antigravity_oauth import (\n+ AntigravityCredentials,\n+ _credentials_path,\n+ load_credentials,\n+ save_credentials,\n+ )\n+\n+ save_credentials(AntigravityCredentials(\n+ access_token=\"at\",\n+ refresh_token=\"rt\",\n+ expires_ms=int((time.time() + 3600) * 1000),\n+ email=\"[redacted:email]\",\n+ project_id=\"proj-123\",\n+ ))\n+\n+ assert _credentials_path().name == \"antigravity_oauth.json\"\n+ loaded = load_credentials()\n+ assert loaded is not None\n+ assert loaded.refresh_token == \"rt\"\n+ assert loaded.project_id == \"proj-123\"\n+ if os.name != \"nt\":\n+ assert stat.S_IMODE(_credentials_path().stat().st_mode) == 0o600\n+\n+ def test_env_override_client_id(self, monkeypatch):\n+ from agent.antigravity_oauth import _get_client_id\n+\n+ monkeypatch.setenv(\"HERMES_ANTIGRAVITY_CLIENT_ID\", \"custom.apps.googleusercontent.com\")\n+ assert _get_client_id() == \"custom.apps.googleusercontent.com\"\n+\n+ def test_env_override_client_secret(self, monkeypatch):\n+ from agent.antigravity_oauth import _get_client_secret\n+\n+ monkeypatch.setenv(\"HERMES_ANTIGRAVITY_CLIENT_SECRET\", \"custom-secret\")\n+ assert _get_client_secret() == \"custom-secret\"\n+\n+ def test_discovers_client_credentials_from_configured_agy_path(self, tmp_path, monkeypatch):\n+ from agent import antigravity_oauth\n+\n+ fake_client_id = (\n+ \"1071006060591-\"\n+ + \"fakefakefakefakefakefakefake\"\n+ + \".apps.google\"\n+ + \"usercontent.com\"\n+ )\n+ fake_client_secret = \"GOC\" + \"SPX-\" + \"fake-secret-value-placeholde\"\n+ fake_agy = tmp_path / \"agy.exe\"\n+ fake_agy.write_text(\n+ f'oauthClientId=\"{fake_client_id}\";\\n'\n+ f'oauthClientSecret=\"[redacted:secret-assignment]\";\\n',\n+ encoding=\"utf-8\",\n+ )\n+ monkeypatch.setenv(\"HERMES_ANTIGRAVITY_CLI_PATH\", str(fake_agy))\n+ antigravity_oauth._discovered_creds_cache.clear()\n+\n+ assert antigravity_oauth._get_client_id().startswith(\"1071006060591-\")\n+ assert antigravity_oauth._get_client_secret() == fake_client_secret\n+\n+ def test_missing_discovery_falls_back_to_public_default(self, monkeypatch):\n+ # With no env override and no discoverable agy install, the public\n+ # baked-in Antigravity desktop OAuth client is used as the floor so\n+ # users without `agy` installed can still authenticate (PKCE makes the\n+ # installed-app \"secret\" non-confidential, same as gemini-cli).\n+ from agent import antigravity_oauth\n+ from agent.antigravity_oauth import (\n+ _DEFAULT_CLIENT_ID,\n+ _DEFAULT_CLIENT_SECRET,\n+ _require_client_id,\n+ )\n+\n+ monkeypatch.delenv(\"HERMES_ANTIGRAVITY_CLIENT_ID\", raising=False)\n+ monkeypatch.delenv(\"HERMES_ANTIGRAVITY_CLIENT_SECRET\", raising=False)\n+ monkeypatch.delenv(\"HERMES_ANTIGRAVITY_CLI_PATH\", raising=False)\n+ antigravity_oauth._discovered_creds_cache.clear()\n+\n+ assert _require_client_id() == _DEFAULT_CLIENT_ID\n+ assert antigravity_oauth._get_client_secret() == _DEFAULT_CLIENT_SECRET\n+ assert _DEFAULT_CLIENT_ID.startswith(\"1071006060591-\")\n+\n+ def test_pkce_challenge_is_s256(self):\n+ import base64\n+ import hashlib\n+\n+ from agent.antigravity_oauth import _generate_pkce_pair\n+\n+ verifier, challenge = _generate_pkce_pair()\n+ expected = base64.urlsafe_b64encode(\n+ hashlib.sha256(verifier.encode(\"ascii\")).digest()\n+ ).rstrip(b\"=\").decode(\"ascii\")\n+ assert challenge == expected\n+ assert 43 <= len(verifier) <= 128\n+\n+ def test_exchange_code_posts_pkce_payload(self, monkeypatch):\n+ from agent import antigravity_oauth\n+\n+ captured = {}\n+\n+ def fake_post(url, data, timeout):\n+ captured.update({\"url\": url, \"data\": data, \"timeout\": timeout})\n+ return {\"access_token\": \"at\"}\n+\n+ monkeypatch.setattr(antigravity_oauth, \"_post_form\", fake_post)\n+ monkeypatch.setenv(\"HERMES_ANTIGRAVITY_CLIENT_ID\", \"client.apps.googleusercontent.com\")\n+ monkeypatch.setenv(\"HERMES_ANTIGRAVITY_CLIENT_SECRET\", \"secret\")\n+\n+ assert antigravity_oauth.exchange_code(\"code\", \"verifier\", \"http://localhost/cb\") == {\n+ \"access_token\": \"at\"\n+ }\n+ assert captured[\"url\"] == antigravity_oauth.TOKEN_ENDPOINT\n+ assert captured[\"data\"][\"grant_type\"] == \"authorization_code\"\n+ assert captured[\"data\"][\"code_verifier\"] == \"verifier\"\n+ assert captured[\"data\"][\"redirect_uri\"] == \"http://localhost/cb\"\n+ assert captured[\"data\"][\"client_id\"] == \"client.apps.googleusercontent.com\"\n+ assert captured[\"data\"][\"client_secret\"] == \"secret\"\n+\n+ def test_refresh_tries_discovered_client_secret_candidates(self, monkeypatch):\n+ from agent import antigravity_oauth\n+ from agent.antigravity_oauth import AntigravityOAuthError\n+\n+ calls = []\n+ monkeypatch.setattr(\n+ antigravity_oauth,\n+ \"_iter_client_credential_candidates\",\n+ lambda: [\n+ (\"client.apps.googleusercontent.com\", \"wrong-secret\"),\n+ (\"client.apps.googleusercontent.com\", \"right-secret\"),\n+ ],\n+ )\n+\n+ def fake_post(url, data, timeout):\n+ calls.append(data[\"client_secret\"])\n+ if data[\"client_secret\"] == \"wrong-secret\":\n+ raise AntigravityOAuthError(\n+ \"invalid client\",\n+ code=\"antigravity_oauth_invalid_client\",\n+ )\n+ return {\"access_token\": \"new-token\", \"expires_in\": 3600}\n+\n+ monkeypatch.setattr(antigravity_oauth, \"_post_form\", fake_post)\n+\n+ assert antigravity_oauth.refresh_access_token(\"refresh-token\")[\"access_token\"] == \"new-token\"\n+ assert calls == [\"wrong-secret\", \"right-secret\"]\n+\n+ def test_invalid_grant_refresh_clears_credentials(self, monkeypatch):\n+ from agent import antigravity_oauth\n+ from agent.antigravity_oauth import (\n+ AntigravityCredentials,\n+ AntigravityOAuthError,\n+ load_credentials,\n+ save_credentials,\n+ )\n+\n+ save_credentials(AntigravityCredentials(\n+ access_token=\"[redacted:secret-assignment]\",\n+ refresh_token=\"rt\",\n+ expires_ms=int((time.time() - 3600) * 1000),\n+ ))\n+\n+ def invalid_grant(_refresh_token):\n+ raise AntigravityOAuthError(\"revoked\", code=\"antigravity_oauth_invalid_grant\")\n+\n+ monkeypatch.setattr(antigravity_oauth, \"refresh_access_token\", invalid_grant)\n+ with pytest.raises(AntigravityOAuthError, match=\"revoked\"):\n+ antigravity_oauth.get_valid_access_token()\n+ assert load_credentials() is None\n+\n+ def test_callback_handler_captures_code_on_handler_class(self):\n+ from agent.antigravity_oauth import CALLBACK_PATH, _OAuthCallbackHandler\n+\n+ handler_cls = type(\"TestAntigravityOAuthCallbackHandler\", (_OAuthCallbackHandler,), {})\n+ handler_cls.expected_state = \"state-123\"\n+ handler_cls.captured_code = None\n+ handler_cls.captured_error = None\n+ handler_cls.ready = threading.Event()\n+\n+ handler = handler_cls.__new__(handler_cls)\n+ handler.path = CALLBACK_PATH + \"?\" + urllib.parse.urlencode({\n+ \"state\": \"state-123\",\n+ \"code\": \"auth-code\",\n+ })\n+ handler.wfile = BytesIO()\n+ responses = []\n+ headers = []\n+ handler.send_response = lambda code: responses.append(code)\n+ handler.send_header = lambda key, value: headers.append((key, value))\n+ handler.end_headers = lambda: None\n+\n+ handler.do_GET()\n+\n+ assert responses == [200]\n+ assert handler_cls.captured_code == \"auth-code\"\n+ assert handler_cls.captured_error is None\n+ assert handler_cls.ready.is_set()\n+ assert \"captured_code\" not in handler.__dict__\n+\n+\n+class TestAntigravityModelCatalog:\n+ def test_parse_agent_model_ids_prefers_recommended_group(self):\n+ from agent.antigravity_code_assist import parse_agent_model_ids\n+\n+ payload = {\n+ \"defaultAgentModelId\": \"gemini-3-flash-agent\",\n+ \"agentModelSorts\": [\n+ {\n+ \"displayName\": \"Experimental\",\n+ \"modelIds\": [\"tab_flash_lite_preview\", \"chat_23310\"],\n+ },\n+ {\n+ \"displayName\": \"Recommended\",\n+ \"modelIds\": [\n+ \"gemini-3-flash-agent\",\n+ \"gemini-3.5-flash-low\",\n+ \"gemini-3.1-pro-high\",\n+ \"gemini-pro-agent\",\n+ \"claude-sonnet-4-6\",\n+ ],\n+ },\n+ ],\n+ \"models\": [{\"id\": \"gpt-oss-120b-medium\"}],\n+ }\n+\n+ assert parse_agent_model_ids(payload) == [\n+ \"gemini-3-flash-agent\",\n+ \"gemini-3.5-flash-low\",\n+ \"gemini-pro-agent\",\n+ \"claude-sonnet-4-6\",\n+ ]\n+\n+ def test_headers_include_antigravity_metadata(self):\n+ from agent.antigravity_code_assist import build_headers\n+\n+ headers = build_headers(\"tok\")\n+ assert headers[\"Authorization\"] == \"Bearer tok\"\n+ assert headers[\"User-Agent\"].startswith(\"antigravity/\")\n+ assert headers[\"X-Goog-Api-Client\"] == \"google-cloud-sdk vscode_cloudshelleditor/0.1\"\n+ metadata = json.loads(headers[\"Client-Metadata\"])\n+ assert metadata[\"ideType\"] == \"ANTIGRAVITY\"\n+ assert metadata[\"platform\"] == \"PLATFORM_UNSPECIFIED\"\n+\n+\n+class TestAntigravityClient:\n+ def test_client_exposes_openai_interface(self):\n+ from agent.antigravity_cloudcode_adapter import AntigravityCloudCodeClient\n+\n+ client = AntigravityCloudCodeClient(api_key=\"dummy\")\n+ try:\n+ assert hasattr(client, \"chat\")\n+ assert hasattr(client.chat, \"completions\")\n+ assert callable(client.chat.completions.create)\n+ finally:\n+ client.close()\n+\n+ def test_create_uses_antigravity_endpoint_and_headers(self, monkeypatch):\n+ from agent import antigravity_oauth\n+ from agent.antigravity_cloudcode_adapter import AntigravityCloudCodeClient\n+ from agent.antigravity_code_assist import ANTIGRAVITY_CODE_ASSIST_ENDPOINT\n+\n+ monkeypatch.setattr(antigravity_oauth, \"get_valid_access_token\", lambda: \"live-token\")\n+\n+ class _Response:\n+ status_code = 200\n+\n+ def json(self):\n+ return {\n+ \"response\": {\n+ \"candidates\": [{\n+ \"content\": {\"parts\": [{\"text\": \"ok\"}]},\n+ \"finishReason\": \"STOP\",\n+ }]\n+ }\n+ }\n+\n+ class _Http:\n+ def __init__(self):\n+ self.calls = []\n+\n+ def post(self, url, json=None, headers=None):\n+ self.calls.append((url, json, headers))\n+ return _Response()\n+\n+ def close(self):\n+ pass\n+\n+ client = AntigravityCloudCodeClient(project_id=\"proj-123\")\n+ client._http = _Http()\n+ try:\n+ result = client.chat.completions.create(\n+ model=\"gemini-3-flash-agent\",\n+ messages=[{\"role\": \"user\", \"content\": \"hi\"}],\n+ )\n+ finally:\n+ client.close()\n+\n+ assert result.choices[0].message.content == \"ok\"\n+ url, body, headers = client._http.calls[0]\n+ assert url == f\"{ANTIGRAVITY_CODE_ASSIST_ENDPOINT}/v1internal:generateContent\"\n+ assert body[\"project\"] == \"proj-123\"\n+ assert body[\"model\"] == \"gemini-3-flash-agent\"\n+ assert headers[\"Authorization\"] == \"Bearer live-token\"\n+ assert json.loads(headers[\"Client-Metadata\"])[\"ideType\"] == \"ANTIGRAVITY\"\n+\n+\n+class TestAntigravityRegistration:\n+ def test_registry_entry_and_aliases(self):\n+ from hermes_cli.auth import PROVIDER_REGISTRY, resolve_provider\n+\n+ assert \"google-antigravity\" in PROVIDER_REGISTRY\n+ assert PROVIDER_REGISTRY[\"google-antigravity\"].auth_type == \"oauth_external\"\n+ assert resolve_provider(\"antigravity\") == \"google-antigravity\"\n+ assert resolve_provider(\"antigravity-oauth\") == \"google-antigravity\"\n+ assert resolve_provider(\"google-antigravity-oauth\") == \"google-antigravity\"\n+ assert resolve_provider(\"agy\") == \"google-antigravity\"\n+\n+ def test_runtime_provider_raises_when_not_logged_in(self):\n+ from hermes_cli.auth import AuthError\n+ from hermes_cli.runtime_provider import resolve_runtime_provider\n+\n+ with pytest.raises(AuthError) as exc_info:\n+ resolve_runtime_provider(requested=\"google-antigravity\")\n+ assert exc_info.value.code == \"antigravity_oauth_not_logged_in\"\n+\n+ def test_runtime_provider_returns_correct_shape_when_logged_in(self):\n+ from agent.antigravity_oauth import AntigravityCredentials, save_credentials\n+ from hermes_cli.runtime_provider import resolve_runtime_provider\n+\n+ save_credentials(AntigravityCredentials(\n+ access_token=\"[redacted:secret-assignment]\",\n+ refresh_token=\"rt\",\n+ expires_ms=int((time.time() + 3600) * 1000),\n+ project_id=\"my-proj\",\n+ email=\"[redacted:email]\",\n+ ))\n+\n+ result = resolve_runtime_provider(requested=\"google-antigravity\")\n+ assert result[\"provider\"] == \"google-antigravity\"\n+ assert result[\"api_mode\"] == \"chat_completions\"\n+ assert result[\"api_key\"] == \"live-tok\"\n+ assert result[\"base_url\"] == \"antigravity-pa://google\"\n+ assert result[\"project_id\"] == \"my-proj\"\n+ assert result[\"email\"] == \"[redacted:email]\"\n+\n+ def test_provider_model_ids_uses_live_antigravity_catalog(self, monkeypatch):\n+ from hermes_cli import models\n+\n+ monkeypatch.setattr(\n+ models,\n+ \"_fetch_antigravity_models\",\n+ lambda force_refresh=False: [\"gemini-3-flash-agent\", \"claude-sonnet-4-6\"],\n+ )\n+\n+ assert models.provider_model_ids(\"agy\") == [\n+ \"gemini-3-flash-agent\",\n+ \"claude-sonnet-4-6\",\n+ ]\n+\n+ def test_oauth_capable_set_includes_antigravity(self):\n+ from hermes_cli.auth_commands import _OAUTH_CAPABLE_PROVIDERS\n+\n+ assert \"google-antigravity\" in _OAUTH_CAPABLE_PROVIDERS"]},{"file":"tests/agent/test_gemini_cloudcode.py","hunks":["@@ -610,6 +610,7 @@ def test_tool_call_translation(self):\n fc_part = next(p for p in model_turn[\"parts\"] if \"functionCall\" in p)\n assert fc_part[\"functionCall\"][\"name\"] == \"get_weather\"\n assert fc_part[\"functionCall\"][\"args\"] == {\"city\": \"SF\"}\n+ assert fc_part[\"functionCall\"][\"id\"] == \"call_1\"\n \n def test_tool_result_translation(self):\n from agent.gemini_cloudcode_adapter import build_gemini_request","@@ -632,6 +633,7 @@ def test_tool_result_translation(self):\n fr_part = next(p for p in last[\"parts\"] if \"functionResponse\" in p)\n assert fr_part[\"functionResponse\"][\"name\"] == \"get_weather\"\n assert fr_part[\"functionResponse\"][\"response\"] == {\"temp\": 72}\n+ assert fr_part[\"functionResponse\"][\"id\"] == \"c1\"\n \n def test_tools_translated_to_function_declarations(self):\n from agent.gemini_cloudcode_adapter import build_gemini_request","@@ -790,7 +792,7 @@ def test_function_call_response(self):\n \"response\": {\n \"candidates\": [{\n \"content\": {\"parts\": [{\n- \"functionCall\": {\"name\": \"lookup\", \"args\": {\"q\": \"weather\"}},\n+ \"functionCall\": {\"name\": \"lookup\", \"args\": {\"q\": \"weather\"}, \"id\": \"provider-call-1\"},\n }]},\n \"finishReason\": \"STOP\",\n }],","@@ -798,6 +800,7 @@ def test_function_call_response(self):\n }\n result = _translate_gemini_response(resp, model=\"gemini-2.5-flash\")\n tc = result.choices[0].message.tool_calls[0]\n+ assert tc.id == \"provider-call-1\"\n assert tc.function.name == \"lookup\"\n assert json.loads(tc.function.arguments) == {\"q\": \"weather\"}\n assert result.choices[0].finish_reason == \"tool_calls\""]},{"file":"tests/agent/transports/test_chat_completions.py","hunks":["@@ -418,6 +418,20 @@ def test_google_gemini_cli_keeps_top_level_thinking_config(self, transport):\n }\n assert \"google\" not in kw[\"extra_body\"]\n \n+ def test_google_antigravity_keeps_top_level_thinking_config(self, transport):\n+ msgs = [{\"role\": \"user\", \"content\": \"Hi\"}]\n+ kw = transport.build_kwargs(\n+ model=\"gemini-3-flash-agent\",\n+ messages=msgs,\n+ provider_name=\"google-antigravity\",\n+ reasoning_config={\"enabled\": True, \"effort\": \"high\"},\n+ )\n+ assert kw[\"extra_body\"][\"thinking_config\"] == {\n+ \"includeThoughts\": True,\n+ \"thinkingLevel\": \"high\",\n+ }\n+ assert \"google\" not in kw[\"extra_body\"]\n+\n def test_gemini_flash_minimal_clamps_to_low(self, transport):\n # Gemini 3 Flash documents low/medium/high; \"minimal\" isn't accepted,\n # so clamp it down to \"low\" rather than forwarding it verbatim."]},{"file":"tests/hermes_cli/test_model_provider_persistence.py","hunks":["@@ -316,6 +316,41 @@ def test_opencode_go_same_provider_switch_recomputes_api_mode(self, config_home,\n assert model.get(\"default\") == \"minimax-m2.5\"\n assert model.get(\"api_mode\") == \"anthropic_messages\"\n \n+ def test_antigravity_oauth_provider_saved_when_selected(self, config_home):\n+ \"\"\"_model_flow_google_antigravity should persist provider/base_url/model together.\"\"\"\n+ from hermes_cli.main import _model_flow_google_antigravity\n+ from hermes_cli.config import load_config\n+\n+ with patch(\n+ \"hermes_cli.auth.get_antigravity_oauth_auth_status\",\n+ return_value={\"logged_in\": True, \"email\": \"[redacted:email]\"},\n+ ), patch(\n+ \"hermes_cli.auth.resolve_antigravity_oauth_runtime_credentials\",\n+ return_value={\n+ \"provider\": \"google-antigravity\",\n+ \"api_key\": \"tok\",\n+ \"base_url\": \"antigravity-pa://google\",\n+ \"project_id\": \"proj-123\",\n+ },\n+ ), patch(\n+ \"hermes_cli.models.provider_model_ids\",\n+ return_value=[\"gemini-3-flash-agent\", \"claude-sonnet-4-6\"],\n+ ), patch(\n+ \"hermes_cli.auth._prompt_model_selection\",\n+ return_value=\"claude-sonnet-4-6\",\n+ ):\n+ _model_flow_google_antigravity(load_config(), \"old-model\")\n+\n+ import yaml\n+\n+ config = yaml.safe_load((config_home / \"config.yaml\").read_text()) or {}\n+ model = config.get(\"model\")\n+ assert isinstance(model, dict), f\"model should be dict, got {type(model)}\"\n+ assert model.get(\"provider\") == \"google-antigravity\"\n+ assert model.get(\"base_url\") == \"antigravity-pa://google\"\n+ assert model.get(\"default\") == \"claude-sonnet-4-6\"\n+ assert \"api_mode\" not in model\n+\n \n \n class TestBaseUrlValidation:"]},{"file":"website/docs/developer-guide/provider-runtime.md","hunks":["@@ -47,7 +47,7 @@ Current provider families include (see `plugins/model-providers/` for the comple\n - OpenAI Codex\n - Copilot / Copilot ACP\n - Anthropic (native)\n-- Google / Gemini (`gemini`, `google-gemini-cli`)\n+- Google / Gemini (`gemini`, `google-gemini-cli`, `google-antigravity`)\n - Alibaba / DashScope (`alibaba`, `alibaba-coding-plan`)\n - DeepSeek\n - Z.AI"]},{"file":"website/docs/guides/google-gemini.md","hunks":["@@ -111,6 +111,19 @@ hermes model\n \n This uses browser PKCE login and the Cloud Code Assist backend. It can be useful for users who want Gemini CLI-style OAuth, but Hermes shows an explicit warning because Google may treat use of the Gemini CLI OAuth client from third-party software as a policy violation. For production or lowest-risk usage, prefer the API-key provider above.\n \n+Hermes also supports `google-antigravity` for Antigravity Code Assist:\n+\n+```bash\n+hermes model\n+# → Choose \"Google Antigravity (OAuth)\"\n+```\n+\n+That provider uses a separate Antigravity OAuth login and stores separate\n+credentials at `~/.hermes/auth/antigravity_oauth.json`. Its model picker uses\n+live Antigravity model discovery, so the list reflects the signed-in account's\n+subscription and can include Antigravity-only Gemini agent models plus other\n+entitled model families.\n+\n ## Available Models\n \n The `hermes model` picker shows Gemini models maintained in Hermes' provider registry. Common choices include:","@@ -193,6 +206,7 @@ The doctor checks:\n \n - Whether `GOOGLE_API_KEY` or `GEMINI_API_KEY` is available\n - Whether Gemini OAuth credentials exist for `google-gemini-cli`\n+- Whether Antigravity OAuth credentials exist for `google-antigravity`\n - Whether configured provider credentials can be resolved\n \n For OAuth quota usage, run this inside a Hermes session:"]},{"file":"website/docs/integrations/providers.md","hunks":["@@ -49,6 +49,7 @@ You need at least one way to connect to an LLM. Use `hermes model` to switch pro\n | **Qwen OAuth** | `hermes model` → \"Qwen OAuth\" (provider: `qwen-oauth`; browser PKCE login) |\n | **MiniMax OAuth** | `hermes model` → \"MiniMax (OAuth)\" (provider: `minimax-oauth`; browser PKCE login) |\n | **StepFun** | `STEPFUN_API_KEY` in `~/.hermes/.env` (provider: `stepfun`) |\n+| **Google Antigravity (OAuth)** | `hermes model` → \"Google Antigravity (OAuth)\" (provider: `google-antigravity`, aliases: `antigravity`, `antigravity-oauth`, `agy`) |\n | **LM Studio** | `hermes model` → \"LM Studio\" (provider: `lmstudio`, optional `LM_API_KEY`) |\n | **Custom Endpoint** | `hermes model` → choose \"Custom endpoint\" (saved in `config.yaml`) |\n ","@@ -78,6 +79,64 @@ Don't have a subscription yet? Get one at [portal.nousresearch.com/manage-subscr\n **JWT auth (automatic).** Hermes prefers scoped `inference:invoke` JWTs for Portal requests with the legacy opaque session-key path as a fallback. No configuration is required — credentials are managed by the OAuth flow and rotate transparently. Revoked refresh tokens are quarantined to avoid replay loops.\n \n \n+### Google Antigravity via OAuth (`google-antigravity`)\n+\n+The `google-antigravity` provider uses Antigravity's Code Assist backend and\n+Antigravity OAuth scopes. It is a native Hermes integration: Hermes runs its\n+own browser PKCE login, stores credentials under\n+`~/.hermes/auth/antigravity_oauth.json`, and talks directly to the Antigravity\n+Code Assist endpoints. It does not shell out to `agy` for inference, and it\n+does not depend on the Antigravity CLI's local token storage.\n+\n+**Quick start:**\n+\n+```bash\n+hermes model\n+# -> pick \"Google Antigravity (OAuth)\"\n+# -> browser opens to accounts.google.com, sign in\n+# -> pick one of the models available to your Antigravity account\n+```\n+\n+Hermes discovers Antigravity models from `fetchAvailableModels` after login.\n+The visible list depends on the authenticated account and subscription, and can\n+include Antigravity-only Gemini agent models plus Claude and GPT-OSS entries\n+when the account is entitled. If live discovery fails, Hermes falls back to a\n+small curated list so the provider remains selectable.\n+\n+Supported aliases:\n+\n+```text\n+google-antigravity\n+google-antigravity-oauth\n+antigravity\n+antigravity-oauth\n+antigravity-cli\n+agy\n+agy-cli\n+```\n+\n+Optional overrides:\n+\n+```bash\n+HERMES_ANTIGRAVITY_CLIENT_ID=your-client.apps.googleusercontent.com\n+HERMES_ANTIGRAVITY_CLIENT_SECRET=...\n+HERMES_ANTIGRAVITY_CLI_PATH=/path/to/agy\n+HERMES_ANTIGRAVITY_PROJECT_ID=your-project\n+```\n+\n+If the client ID/secret are not set explicitly, Hermes tries to discover the\n+desktop OAuth client credentials from the installed Antigravity CLI (`agy`) on\n+`PATH`, `HERMES_ANTIGRAVITY_CLI_PATH`, or common Antigravity install/cache\n+locations. Those client credentials are used only to start and refresh Hermes'\n+own OAuth session; Hermes still keeps its access/refresh tokens in `~/.hermes`.\n+\n+:::note Windows credential storage\n+The Antigravity CLI may keep its own login in platform-specific storage such as\n+Windows Credential Manager. Hermes intentionally keeps separate credentials in\n+`~/.hermes` so development profiles and production Hermes profiles do not share\n+tokens accidentally.\n+:::\n+\n :::info Codex Note\n The OpenAI Codex provider authenticates via device code (open a URL, enter a code). Hermes stores the resulting credentials in its own auth store under `~/.hermes/auth.json` and can import existing Codex CLI credentials from `~/.codex/auth.json` when present. No Codex CLI installation is required.\n ","@@ -1532,7 +1591,7 @@ fallback_model:\n \n When activated, the fallback swaps the model and provider mid-session without losing your conversation. The chain is tried entry-by-entry; activation is one-shot per session.\n \n-Supported providers: `openrouter`, `nous`, `novita`, `openai-codex`, `copilot`, `copilot-acp`, `anthropic`, `gemini`, `google-gemini-cli`, `qwen-oauth`, `huggingface`, `zai`, `kimi-coding`, `kimi-coding-cn`, `minimax`, `minimax-cn`, `minimax-oauth`, `deepseek`, `nvidia`, `xai`, `xai-oauth`, `ollama-cloud`, `bedrock`, `azure-foundry`, `opencode-zen`, `opencode-go`, `kilocode`, `xiaomi`, `arcee`, `gmi`, `stepfun`, `lmstudio`, `alibaba`, `alibaba-coding-plan`, `tencent-tokenhub`, `custom`.\n+Supported providers: `openrouter`, `nous`, `novita`, `openai-codex`, `copilot`, `copilot-acp`, `anthropic`, `gemini`, `google-gemini-cli`, `google-antigravity`, `qwen-oauth`, `huggingface`, `zai`, `kimi-coding`, `kimi-coding-cn`, `minimax`, `minimax-cn`, `minimax-oauth`, `deepseek`, `nvidia`, `xai`, `xai-oauth`, `ollama-cloud`, `bedrock`, `azure-foundry`, `opencode-zen`, `opencode-go`, `kilocode`, `xiaomi`, `arcee`, `gmi`, `stepfun`, `lmstudio`, `alibaba`, `alibaba-coding-plan`, `tencent-tokenhub`, `custom`.\n \n :::tip\n Fallback is configured exclusively through `config.yaml` — or interactively via `hermes fallback`. For full details on when it triggers, how the chain advances, and how it interacts with auxiliary tasks and delegation, see [Fallback Providers](/user-guide/features/fallback-providers)."]},{"file":"website/docs/reference/cli-commands.md","hunks":["@@ -100,7 +100,7 @@ Common options:\n | `-q`, `--query \"...\"` | One-shot, non-interactive prompt. |\n | `-m`, `--model