legal: inspect the official Antigravity CLI installer - #73
Conversation
Summary by CodeRabbit
WalkthroughThis change adds an isolated Antigravity CLI inspection script, a local installer fixture, regression tests, committed inspection evidence, documentation, and CI checks for bounded reports and stable installation behavior. ChangesAntigravity CLI inspection
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant CI as Inspect Antigravity CLI workflow
participant Inspector as inspect-antigravity-cli.py
participant Installer as Antigravity installer
participant Home as isolated temporary home
participant Evidence as committed inspection JSON
CI->>Inspector: compile and execute inspection
Inspector->>Installer: download or load and validate installer
Inspector->>Home: install twice and capture metadata
Inspector-->>CI: return report and status
CI->>Evidence: compare live metadata and stability indicators
CI-->>CI: validate bounded report and blocking findings
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@codex review Please review the final inspection/evidence workflow, especially execution of the mutable vendor installer, metadata-only artifact guarantees, evidence freshness comparisons, and the no-redistribution boundary. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cca77fdffd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/inspect-antigravity-cli.yml:
- Around line 3-13: Add a concurrency configuration alongside the workflow
triggers, using a group key derived from the workflow identity and Git ref and
enabling cancel-in-progress. Ensure newer runs for the same workflow/ref cancel
older runs to prevent overlapping live installer executions.
In `@scripts/fixtures/antigravity-install.sh`:
- Line 4: Update the argument check in the script’s help-option handling to
accept both “--help” and “-h”. Preserve the existing help output and successful
exit behavior for either option.
In `@scripts/inspect-antigravity-cli.py`:
- Around line 51-75: Update file_record() and inspect_binary() to hash files
incrementally in bounded-size chunks while accumulating size, instead of calling
read_bytes() and retaining the full binary in memory. Reuse the computed digest
between snapshot() and inspect_binary() where practical, including the
binary_after_first and binary_after_second flows, so each binary is not
repeatedly read and hashed.
- Around line 97-118: Update the subprocess.run call in run to pass
encoding="utf-8" and errors="replace" alongside text=True, ensuring captured
vendor output is decoded reliably and replacement characters are used instead of
raising UnicodeDecodeError. Preserve the existing timeout and CompletedProcess
handling.
- Around line 364-392: Update validate_report() to add a blocking finding when
report["binary_stable_across_second_install"] is false, but only when the binary
is present. Preserve the existing expected_binary_present and
binary_after_second checks, and use the report’s stability field to detect
changes between installations.
- Around line 314-321: Update the inspected_at_utc timestamp construction in the
returned inspection payload to use the broadly compatible dt.timezone.utc
constant instead of dt.UTC. Preserve the existing UTC timestamp format and
microsecond removal.
- Around line 134-151: Update download_installer to parse the host from
OFFICIAL_INSTALLER_URL and require the redirected final_url to use HTTPS and the
same expected host before reading or saving the response. Reject mismatched
hosts with a RuntimeError, preserving the existing download and size-limit
behavior for valid redirects.
In `@scripts/test_inspect_antigravity_cli.py`:
- Around line 27-40: Update the subprocess.run invocation in the fixture
inspection test to include a local timeout, and handle subprocess.TimeoutExpired
so the test raises a clear assertion failure when inspection exceeds that
deadline. Preserve the existing command arguments and output capture behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 187cf79f-494e-4662-8037-6d228f93ec64
📒 Files selected for processing (10)
.github/workflows/build-amd64.yml.github/workflows/inspect-antigravity-cli.ymlMakefilescripts/fixtures/antigravity-install.shscripts/inspect-antigravity-cli.pyscripts/test_inspect_antigravity_cli.pythird_party/README.mdthird_party/antigravity-cli-inspection.jsonthird_party/antigravity-cli-inspection.mdthird_party/optional-agents.md
📜 Review details
🧰 Additional context used
📓 Path-based instructions (8)
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/inspect-antigravity-cli.yml.github/workflows/build-amd64.yml
**/*.{yml,yaml,Dockerfile,sh,bash,js,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{yml,yaml,Dockerfile,sh,bash,js,ts,tsx}: Never use privileged containers, Docker or Podman sockets, SYS_ADMIN, host-root mounts, or broad persistence mounts such as /root, /home, /opt, /usr/local, or a parent data root.
Preserve mandatory ttyd authentication for agent terminals, origin checking for all web endpoints, tmux reconnect behavior, image identity checks, and existing Codex login, start, and resume behavior.
Files:
scripts/fixtures/antigravity-install.sh
**/*.{sh,bash,js,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Never use eval, sourced editable state, or user-controlled shell fragments for role, mode, installer, routing, or command dispatch.
Files:
scripts/fixtures/antigravity-install.sh
**/*.{sh,bash}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{sh,bash}: Use fixed, validated enums for roles and start modes; reject unknown values with a deterministic non-zero exit status and a clear message.
Build command invocations with Bash arrays, preserve arguments without re-evaluating them, preserve command exit status, and run persistent-state hardening after supported interactive sessions.
Files:
scripts/fixtures/antigravity-install.sh
**/*.{yml,yaml,sh,bash}
📄 CodeRabbit inference engine (AGENTS.md)
Implement issue
#25in separately reviewed slices: role-neutral commands and validation, configurable Codex approval modes, canonical image and variable naming with time-bounded aliases, shared image digest, Compose and state migration, and outer hardening with cross-service canaries.
Files:
scripts/fixtures/antigravity-install.sh
**/*.{sh,bash,js,ts,tsx,yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Run the narrowest relevant tests during development and complete required CI before merge; preserve or extend coverage for role/start-mode validation, wrappers, launcher security, mounts, image identity, health checks, Codex flows, credential hardening, ttyd, tmux, provenance, notices, SBOM, Trivy, and the critical-vulnerability gate.
Files:
scripts/fixtures/antigravity-install.sh
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/fixtures/antigravity-install.sh
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
third_party/optional-agents.mdthird_party/README.mdthird_party/antigravity-cli-inspection.md
🪛 ast-grep (0.45.0)
scripts/test_inspect_antigravity_cli.py
[error] 26-39: Command coming from incoming request
Context: subprocess.run(
[
sys.executable,
str(SCRIPT),
"--output",
str(report_path),
"--installer-fixture",
str(FIXTURE),
],
cwd=ROOT,
text=True,
capture_output=True,
check=False,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(subprocess-from-request)
scripts/inspect-antigravity-cli.py
[error] 105-113: Use of unsanitized data to create processes
Context: subprocess.run(
command,
cwd=cwd,
env=env,
text=True,
capture_output=True,
check=False,
timeout=timeout,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(os-system-unsanitized-data)
[info] 418-418: use jsonify instead of json.dumps for JSON output
Context: json.dumps(report, indent=2, sort_keys=True)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[info] 419-419: use jsonify instead of json.dumps for JSON output
Context: json.dumps(report, indent=2, sort_keys=True)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[warning] 140-140: Request-controlled URL passed to urlopen; validate against an allowlist to prevent SSRF.
Context: urllib.request.urlopen(request, timeout=60)
Note: [CWE-918] Server-Side Request Forgery (SSRF).
(urlopen-unsanitized-data)
[warning] 211-211: XPath query is request-/variable-derived; use parameterized XPath to prevent injection.
Context: URL_RE.findall(installer_text)
Note: [CWE-643] Improper Neutralization of Data within XPath Expressions ('XPath Injection').
(xpath-injection-python)
[error] 105-113: Command coming from incoming request
Context: subprocess.run(
command,
cwd=cwd,
env=env,
text=True,
capture_output=True,
check=False,
timeout=timeout,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(subprocess-from-request)
🪛 Ruff (0.16.0)
scripts/test_inspect_antigravity_cli.py
[warning] 17-17: Boolean-typed positional argument in function definition
(FBT001)
[error] 27-27: subprocess call: check for execution of untrusted input
(S603)
scripts/inspect-antigravity-cli.py
[error] 106-106: subprocess call: check for execution of untrusted input
(S603)
[error] 141-141: Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
(S310)
[warning] 144-144: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 147-147: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 151-151: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 158-158: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 205-205: Use a list comprehension to create a transformed list
(PERF401)
[warning] 262-265: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 289-289: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 295-295: Avoid specifying long messages outside the exception class
(TRY003)
🪛 zizmor (1.28.0)
.github/workflows/inspect-antigravity-cli.yml
[info] 19-19: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-13: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🔇 Additional comments (8)
scripts/inspect-antigravity-cli.py (1)
268-313: 🔒 Security & PrivacyNo change needed. The workflow runs
inspect-antigravity-cli.pyon an isolated GitHub Actions runner withpermissions: contents: read,persist-credentials: false, no repository environment/secrets exposure shown, and outputs written to the runner’s temporary directory.third_party/antigravity-cli-inspection.md (1)
1-140: LGTM!third_party/README.md (1)
30-31: LGTM!third_party/optional-agents.md (1)
18-48: LGTM!.github/workflows/inspect-antigravity-cli.yml (2)
15-16: LGTM!Also applies to: 20-22, 37-93, 94-133, 138-158
134-137: 🗄️ Data Integrity & IntegrationNo change needed. The committed binary version matches the installed binary’s
--versionstdout shape.Makefile (1)
17-28: LGTM!.github/workflows/build-amd64.yml (1)
34-38: LGTM!Also applies to: 54-54, 70-71
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a18a21507a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current head after all prior security findings were addressed. Focus on pre-execution digest verification, redirect rejection, vendor-output normalization, help-side-effect aborts, metadata upload gating, path redaction and the committed/live evidence comparison. |
|
@codex review Final pass on current head: both the installer and downloaded |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8e1bd22bfd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for stage in ("after_first", "after_second"): | ||
| if not report["profiles"][f"unchanged_{stage}"]: | ||
| errors.append(f"shell profiles changed {stage.replace('_', ' ')}") | ||
| binary = report["binary_after_second"] |
There was a problem hiding this comment.
When a freshly installed agy returns a failing --version or --help result but a later invocation succeeds—for example after transient initialization—this validator examines only binary_after_second; the workflow similarly selects only that result at .github/workflows/inspect-antigravity-cli.yml:168. The fresh evidence on the current head is that binary_after_first is recorded but only its SHA-256 participates in validation, so the report can have no blocking findings despite the first executable checks failing; validate both inspection results.
Useful? React with 👍 / 👎.
| text=True, | ||
| encoding="utf-8", | ||
| errors="replace", | ||
| capture_output=True, |
There was a problem hiding this comment.
When the installer or CLI emits output rapidly, capture_output=True accumulates all stdout and stderr in memory; the 30–300 second timeout limits elapsed time but not output size, so a vendor-process error or runaway output can exhaust the runner before a status or report is produced. Stream into size-capped buffers or terminate the process once a fixed output limit is reached.
AGENTS.md reference: AGENTS.md:L24-L24
Useful? React with 👍 / 👎.
1 participant
Closes #26 and unblocks implementation in #27.
Summary
agySHA-256 before invoking the installed executable--dir ~/.local/binoptionInspection result
The installer currently served at the official URL no longer accepts the
--skip-aliasesand--skip-pathoptions described by older documentation. Its live help advertises only--dirand--help, so the reviewed flow uses an explicit isolated install directory.The inspected CLI reports background self-updates during regular runs. The runtime integration in #27 must set
AGY_CLI_DISABLE_AUTO_UPDATE=trueand expose updates as a separate explicit action.Security boundary
The workflow has
contents: read, checkout credentials are not persisted, the inspected process receives a minimal environment with no GitHub token, and only a schema-validated metadata artifact can be uploaded. It never authenticates to Google and never uploads or redistributes the installer or installed executable.If either the installer hash or resulting binary hash changes, the workflow fails before executing the changed component and requires a deliberate evidence review.
Validation