setup-antigravity-devcontainer

Files (7)

• SKILL.md
• install-block.sh · templates/
• network-manifest-entries.json · templates/
• post-start-block.sh · templates/
• readme-bullet.md · templates/
• skills-link-block.sh · templates/
• yolo-alias-block.sh · templates/

SKILL.md (first lines)

# Setup Antigravity Devcontainer

Adds Antigravity to a devcontainer already generated by the
[setup-devcontainer](../setup-devcontainer/SKILL.md) skill. This skill never
touches `devcontainer.json` or the `Dockerfile` — it appends its own
marker-keyed content to `post-create.sh`, `post-start.sh` (if the skills link
or skill sync is opted into), and `README.md`, and idempotently ensures its
own Network Manifest entry exists in `.devcontainer/network-manifest.json`.

## 0. Security & Trust

This skill's generated automation touches three areas an external audit may flag. Each is
opt-in, scoped to this container, and exists for a specific reason — none of it runs on the
host, only inside the generated devcontainer.

- **Installer Provenance**: installs Antigravity CLI via Google's own official installer
  (`https://antigravity.google/cli/install.sh`). Runs once, at container creation
  (`postCreateCommand`), not on every start — and only if `~/.local/bin/agy` doesn't already
  exist.
- **Agent Authority**: the optional `agy-yolo` alias uses `agy --mode accept-edits`,
  deliberately not `--dangerously-skip-permissions --sandbox` — a filed upstream bug
  (`antigravity-cli#36`) makes that combination a no-op sandbox, so it would grant no real
  containment while looking like it did. Stated plainly: `accept-edits` alone isn't a strong
  safety boundary either — this skill's own reported next steps also walk through setting up
  a curated `permissions.allow` list (`~/.gemini/antigravity-cli/settings.json`,
  starting from `git`/`gh`/`ls`/`cat`, never `rm`/`curl`/raw `bash -c`/a wildcard) as a
  manual, once-per-machine step, since that's the mechanism actually doing the restricting.
  Off by default; only added if accepted during setup.
- **Skill Source Trust**: if skill sync is accepted, the source(s) you name are re-synced into
  the Shared Skills Directory (`~/.agents/skills`) on every container start. Nothing is wiped —
  a skill removed upstream stays until deleted by hand. The real trust decision is the source
  itself: naming one means trusting its skills unattended, with no per-skill review step, every
  time the container starts. Off by default. The optional skills link (`~/.gemini/skills` →
  `~/.agents/skills`) adds no download and no wipe; it only lets `agy` see the same shared
  directory that Codex and Copilot already read natively. It never removes a non-empty
  directory or overrides a link that points elsewhere.

See [ADR-0007](../setup-devcontainer/docs/adr/0007-agent-trust-hub-audit-response.md) for the
full reasoning and the alternatives rejected.

## 1. Detect the base devcontainer

```bash
test -f .devcontainer/devcontainer.json && test -f .devcontainer/post-create.sh && echo ok
```

If either file is missing, **refuse** — tell the user to run
`setup-devcontainer` first, and stop. Do not generate or patch anything.

## 2. Ask this tool's options

- **YOLO alias**: add `agy-yolo` for fast, unattended iteration? Does
  **not** use `--dangerously-skip-permissions --sandbox` — a filed upstream
  bug (`antigravity-cli#36`) makes that combination a no-op sandbox. If
  accepted, this skill's reported next steps still include the curated
  `permissions.allow`-list guidance as a manual, once-per-machine step.
- **Skills link** (default **yes**, asked whether or not skill sync is
  accepted): make `agy` see the Shared Skills Directory (`~/.agents/skills`,
  where the `skills` CLI writes every global install for this CLI) by linking
  `~/.gemini/skills` to it on every container start? Without the link `agy`
  does not list those skills. It also makes skills you install by hand later
  with `npx skills add -g` visible immediately. No download, no wipe.
- **Automatic skill sync**: sync AI-agent skills into the Shared Skills
  Directory (`~/.agents/skills`) automatically on every container start?
  Same mechanism as the other CLI skills — two ready-made suites
  (`mattpocock/skills`, `ken-guru/skills`) plus any individually named
  skill, validated live via `npx -y skills add <source> --list` before
  rendering anything.

## 3. Patch `post-create.sh`

Append [templates/install-block.sh](templates/install-block.sh) verbatim:

```bash
scripts/patch-if-absent.sh append .devcontainer/post-create.sh "# --- Antigravity ---" templates/install-block.sh
```

If YOLO alias was accepted, also append
[templates/yolo-alias-block.sh](templates/yolo-alias-block.sh), under its
own independent marker:

```bash
scripts/patch-if-absent.sh append .devcontainer/post-create.sh "# --- Antigravity yolo-alias ---" templates/yolo-alias-block.sh
```

## 4. Patch the Network Manifest — unconditional, every run

Ensure Antigravity's own `.antigravity.networkAllowlist` entry exists in
`.devcontainer/network-manifest.json`, regardless of any answer above — this
is what lets an opted-in network firewall (a separate, base-owned layer)
allow the hosts Antigravity itself needs:

```bash
scripts/patch-json-array-if-absent.sh .devcontainer/network-manifest.json .antigravity.networkAllowlist templates/network-manifest-entries.json
```

## 5. Patch `post-start.sh` (skills link and/or skill sync)

Each part is independent, under its own marker, and only applied if its
option in step 2 was accepted.

**Skills link.** Append [templates/skills-link-block.sh](templates/skills-link-block.sh)
verbatim:

```bash
scripts/patch-if-absent.sh append .devcontainer/post-start.sh "# --- Antigravity skills-link ---" templates/skills-link-block.sh
```

`agy` does not read `~/.agents/skills`, but does read `~/.gemini/skills`, which
this link points there. That location is **not documented by Google for the
CLI** (its skills page lists `~/.gemini/antigravity-cli/skills`); it has worked
reliably, but if `/skills` in `agy` ever stops listing synced skills, look
here first. Fallbacks, in order: the same link at
`~/.gemini/antigravity-cli/skills`, then a copy into
`~/.gemini/config/skills` (measured to load with no permission prompt).

**Skill sync.** Render [templates/post-start-block.sh](templates/post-start-block.sh) with
`{{SKILLS_SOURCES_COMMANDS}}` substituted to one `npx -y skills add <source>
--skill '*' -a antigravity-cli -y --copy -g` line per whole-suite source (or

From ken-guru/skills, MIT.

More from ken-guru/skills