docker/sbx-kit-antigravity-mixin:latest

schemaVersion: "3"
displayName: Google Antigravity (mixin)
description: Google's agy terminal coding agent as a mixin -- the CLI in an overlay, with the proxy-managed Gemini credential, Google's egress, and the settings and MCP seeds the agent needs. Layer it onto a shell base and run `agy`.
version: 1.0.0
kind: mixin
provides:
    - antigravity
requires:
    - deb/jq
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - accounts.google.com
                - oauth2.googleapis.com
                - www.googleapis.com
                - lh3.googleusercontent.com
                - aicode.googleapis.com
                - cloudcode-pa.googleapis.com
                - daily-cloudcode-pa.googleapis.com
                - generativelanguage.googleapis.com
                - antigravity.google
                - antigravity.google.com
                - antigravity-unleash.goog
                - play.googleapis.com
                - safebrowsing.googleapis.com
                - www.gstatic.com
                - antigravity-cli-auto-updater-974169037036.us-central1.run.app
                - storage.googleapis.com
                - raw.githubusercontent.com
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: generativelanguage.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
            name: GEMINI_API_KEY
            proxyManaged: true
        phase: runtime
        service: google
      description: Gemini API key for Antigravity's headless API-key mode
    - type: com.docker.sandbox/lifecycle@1
      config:
        startup:
            - command: |
                set -e
                cfg="$HOME/.gemini/antigravity-cli/settings.json"
                mkdir -p "$(dirname "$cfg")"
                [ -s "$cfg" ] || echo '{}' > "$cfg"
                if [ "${SBX_CRED_GOOGLE_MODE:-none}" = apikey ]; then
                  jq '.modelProvider = "gemini"' "$cfg" > "$cfg.tmp"
                else
                  jq 'del(.modelProvider)' "$cfg" > "$cfg.tmp"
                fi
                mv "$cfg.tmp" "$cfg"
              description: Select Gemini API-key mode only when a Google credential is available
              env:
                - SBX_CRED_GOOGLE_MODE
              user: "1000"
            - command: |
                set -e
                [ -n "$MCP_GATEWAY_URL" ] || exit 0
                cfg="$HOME/.gemini/config/mcp_config.json"
                mkdir -p "$(dirname "$cfg")"
                [ -s "$cfg" ] || echo '{}' > "$cfg"
                frag=/tmp/antigravity-mcp-gateway.json
                cat > "$frag" <<EOF
                {
                  "mcpServers": {
                    "mcp-gateway": {
                      "serverUrl": "$MCP_GATEWAY_URL",
                      "headers": {
                        "Authorization": "Bearer $MCP_SENTINEL_TOKEN_NAME"
                      }
                    }
                  }
                }
                EOF
                jq -s '.[0] * .[1]' "$cfg" "$frag" > "$cfg.tmp"
                mv "$cfg.tmp" "$cfg"
                rm -f "$frag"
              description: Register the sandbox MCP gateway in Antigravity's user configuration
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: "1000"
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/antigravity-mixin/antigravity-mixin-context.md