SpecBridge v0.6.1: Gemini CLI, OpenAI-compatible, and Antigravity adapters

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "specbridge",
       "source": "./integrations/claude-code-plugin/specbridge",
       "description": "Kiro-compatible spec workflows, verified interactive task execution, and deterministic drift checks.",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "license": "MIT",
       "keywords": [
         "spec-driven-development",

CHANGELOG.md

@@ -1,5 +1,92 @@
 # Changelog
 
+## 0.6.1
+
+Added:
+
+- Gemini CLI adapter (`gemini-cli`, built-in profile `gemini-default`):
+  headless invocation through the frozen v0.6.0 runner contract with
+  bounded read-only capability detection (`--version`/`--help` token
+  probes; never a model request, login, or trusted-folder change).
+- Capability-gated Gemini authoring, task execution, and resume: authoring
+  through the plan approval mode or a read-only tool allowlist; task
+  execution only when the installed CLI proves a bounded edit policy
+  (auto_edit plus tool allowlist or sandbox) without arbitrary shell
+  access; resume only by explicit session UUID with session-identity
+  verification.
+- OpenAI-compatible authoring adapter (`openai-compatible`, built-in
+  profile `openai-compatible-local`): production stage generation and
+  refinement against chat-completions and responses API styles.
+- Configurable structured-output modes (`json-schema`, `json-object`,
+  `strict-json-prompt`) with complete-response Zod validation in every
+  mode and an explicit, warned, opt-in-only downgrade
+  (`allowStructuredOutputFallback`).
+- Experimental Antigravity CLI capability adapter (`antigravity-cli`,
+  built-in profile `antigravity`): executable/version/documented-capability
+  detection and transparent diagnostics only — no automation of any kind.
+- Read-only MCP runner diagnostic tools: `runner_list` (paginated),
+  `runner_show`, `runner_doctor`, `runner_matrix` — thin adapters over the
+  same shared runner services the CLI uses.
+- Claude Code `/specbridge:runners` Skill: list profiles, explain
+  categories and boundaries, diagnose one profile, and recommend
+  compatible profiles — driven exclusively by the MCP diagnostic tools.
+- Additional provider conformance fixtures: process-level fake Gemini and
+  Antigravity executables and a fake OpenAI-compatible loopback server
+  covering authentication, quota, rate-limit, timeout, cancellation,
+  oversized output, malformed/prose/fenced output, protected-path writes,
+  resume identity, and redirect scenarios — CI needs no real provider and
+  no network.
+- Explicit remote endpoint and redirect protections in the shared HTTP
+  client: opt-in bounded redirect following with cross-origin
+  authorization stripping, HTTPS-downgrade rejection, scheme validation,
+  and recorded safe redirect metadata (default behavior unchanged:
+  redirects rejected).
+
+Changed:
+
+- The runner capability matrix (CLI `runner matrix`, MCP `runner_matrix`,
+  README, docs) includes Gemini, OpenAI-compatible, and Antigravity and is
+  generated from one shared implementation in @specbridge/runners.
+- Provider diagnostics are available through both the CLI and MCP.
+- The plugin bundle includes the runner inspection workflow (nine skills).
+- Network-backed authoring reports exact data boundaries (endpoint, API
+  style, model, structured-output mode, documents, input size, whether a
+  network request will occur) before execution; dry-run performs no
+  request.
+- Additive contract extensions (no existing field, value, or code
+  changed): optional `AgentRunner.declaredSupportLevel` (absent =
+  production, the v0.6.0 behavior) and new `AgentRunnerKind` values
+  (`gemini-cli`, `openai-compatible`, `antigravity-cli`). All v0.6.0
+  contract snapshot tests pass unchanged.
+
+Security:
+
+- Gemini YOLO mode is forbidden at three layers (config schema enum plus
+  config-wide fragment rejection, argv assembly, pre-spawn assertion).
+- Gemini task execution requires a bounded safe edit policy; shell tools
+  are excluded from every allowlist and the policy is never relaxed.
+- Antigravity TUI and PTY automation are forbidden (no PTY library, no
+  keystroke injection, no ANSI parsing — enforced by tests).
+- API-key values are never stored: profiles hold an environment-variable
+  NAME only; the value is read at request time, redacted from every
+  retained byte, and never logged or passed to verification commands.
+- Authorization is never forwarded across origins on redirects, and
+  HTTPS-to-HTTP downgrades are rejected.
+- Generic API runners cannot modify source (authoring-only by capability;
+  task execution is rejected before any request).
+- No new provider is selected implicitly: all new profiles default
+  disabled, network profiles require explicit selection, experimental
+  profiles require explicit opt-in.
+- Provider claims remain non-authoritative: Git evidence and trusted
+  verification decide task completion, whatever runner executed.
+
+Deferred to v0.7:
+
+- templates and the template registry
+- plugin SDK and runner extension SDK distribution
+- analyzer SDK and verifier SDK
+- extension registry and community ecosystem
+
 ## 0.6.0
 
 Added:

README.md

@@ -14,44 +14,54 @@ Codex, local models, or any supported coding agent.
 
 > Your `.kiro` specs remain the source of truth.
 
-New in v0.6 — keep your existing `.kiro` specs and **choose a compatible
+New in v0.6.1 — keep your existing `.kiro` specs and **choose a compatible
 coding agent or authoring model per operation**:
 
 ```text
-                  Spec authoring     Task execution
-Claude Code             ✓                  ✓
-Codex CLI               ✓                  ✓
-Ollama                  ✓                  —
+                  Spec authoring   Task execution
+Claude Code             yes             yes
+Codex CLI               yes             yes
+Gemini CLI              yes             capability-gated
+Ollama                  yes             no
+OpenAI-compatible       yes             no
+Antigravity CLI         experimental
 ```
 
 ```bash
 specbridge runner matrix
 
+specbridge runner doctor gemini-default
+
 specbridge spec generate notification-preferences \
   --stage requirements \
-  --runner ollama-local
+  --runner gemini-default
 
-specbridge spec generate notification-preferences \
+specbridge spec refine notification-preferences \
   --stage design \
-  --runner codex-default
+  --runner openai-compatible-local
 
 specbridge spec run notification-preferences \
   --task 2.3 \
   --runner codex-default
 ```
 
-Runner behavior is capability-driven: authoring-only model APIs (Ollama)
-can never execute tasks, task execution needs a safe sandbox or tool
-restriction, network-backed endpoints are never selected implicitly, and
+Runner behavior is capability-driven: authoring-only model APIs (Ollama,
+OpenAI-compatible endpoints) can never execute tasks, task execution needs
+a proven safe boundary (Gemini task execution is enabled only when the
+installed CLI proves a bounded edit policy without arbitrary shell access —
+YOLO is never used), network-backed endpoints are never selected
+implicitly, the Antigravity adapter is experimental detection only, and
 whatever runs, task completion still requires actual Git evidence plus
 trusted verification — never a provider claim. The live matrix above is
 generated from registered runner metadata (`specbridge runner matrix`); not
-every installed Codex version is compatible (`specbridge runner doctor
-codex-default` reports the exact capabilities).
+every installed provider version is compatible (`specbridge runner doctor
+<profile>` reports the exact capabilities).
 
-SpecBridge does not include provider subscriptions, hosted models, API
-usage, or authentication — you install and authenticate Claude Code, the
-Codex CLI, or Ollama yourself. See [docs/runners.md](docs/runners.md).
+SpecBridge does not include provider subscriptions, hosted model usage,
+credentials, or authentication — you install and authenticate Claude Code,
+the Codex CLI, the Gemini CLI, Ollama, or your API endpoint yourself. API
+keys are referenced by environment-variable NAME only and never stored.
+See [docs/runners.md](docs/runners.md).
 
 From v0.5 — a self-contained **Claude Code plugin** with a local MCP
 server and verified interactive task execution:
@@ -251,11 +261,12 @@ Working today (fully offline, no model, no API key):
 | `specbridge spec affected` | **v0.4** — which specs does this change set touch (read-only) |
 | `specbridge spec policy init / show / validate` | **v0.4** — per-spec verification policies (impact areas, required commands, rule overrides) |
 | `specbridge verify rules / explain <id>` | **v0.4** — inspect the stable rule registry SBV001–SBV025 |
-| `specbridge mcp serve / doctor / manifest / tools` | **v0.5** — local stdio MCP server (21 tools, 7 resources, 4 prompts) |
+| `specbridge mcp serve / doctor / manifest / tools` | **v0.5** — local stdio MCP server (25 tools since v0.6.1, 7 resources, 4 prompts) |
 | `specbridge run recover-lock` | **v0.5** — diagnose and explicitly recover the interactive execution lock |
 | `specbridge runner list / matrix / show / doctor` | **v0.6** — profile-based runner diagnostics and the generated capability matrix (read-only) |
 | `specbridge runner test / conformance / models <profile>` | **v0.6** — bounded structured-output probe (`--network`), conformance suite, provider-supported model listing |
 | `specbridge config doctor / migrate` | **v0.6** — configuration validation and the explicit v1 → v2 migration (dry-run by default, atomic apply with backup) |
+| `specbridge runner doctor gemini-default / openai-compatible-local / antigravity` | **v0.6.1** — diagnostics for the new adapters; MCP `runner_list` / `runner_show` / `runner_doctor` / `runner_matrix` expose the same read-only services |
 
 Planned commands (`spec sync/export`) are registered, marked "(planned)" in
 `--help`, and exit with an honest error — see the [roadmap](docs/roadmap.md).
@@ -502,13 +513,21 @@ PROFILES; the live matrix comes from `specbridge runner matrix`:
 |---------|---------|--------|--------|---------|--------|-------|
 | claude-code | production | yes | yes | yes | yes | no |
 | codex-default | production | yes | yes | yes | yes | no |
+| gemini-default | production | yes | yes | yes | yes | no |
 | ollama-local | production | yes | yes | no | no | yes |
+| openai-compatible-local | production | yes | yes | no | no | yes |
+| antigravity | experimental | no | no | no | no | no |
 | mock | production | yes | yes | yes | yes | yes |
 
-`codex-default` and `ollama-local` ship DISABLED until you enable them
-explicitly. Ollama is authoring-only by capability — it can never execute
-tasks or modify files. Gemini CLI, an OpenAI-compatible authoring runner,
-and Antigravity are planned for v0.6.1 (no placeholders are registered).
+Every non-Claude profile ships DISABLED until you enable it explicitly.
+Ollama and OpenAI-compatible endpoints are authoring-only by capability —
+they can never execute tasks or modify files. Gemini task execution and
+resume are capability-gated: they work only when the installed Gemini CLI
+proves a bounded edit policy (auto_edit plus tool allowlist or sandbox)
+without arbitrary shell access — YOLO is never used, and an unsafe
+installation keeps safe authoring while task execution is refused with the
+exact gap. The Antigravity adapter is experimental capability detection
+only; it is not a production runner and executes nothing.
 
 Configuration lives in `.specbridge/config.json` (schema 2.0.0; v1 files
 stay readable, migration is explicit — see
@@ -530,7 +549,7 @@ stores no credentials of any kind.
   secrets or environment variables.
 - Full model: [docs/security.md](docs/security.md).
 
-## Limitations (v0.6)
+## Limitations (v0.6.1)
 
 - The MCP server is stdio-only and local-only: no HTTP/SSE/WebSocket
   transport, no OAuth, no cloud hosting. One server process serves one
@@ -551,15 +570,21 @@ stores no credentials of any kind.
   references, chore-task exclusion) are labelled and never default to error.
 - `spec sync` and `spec export` are not implemented yet (they fail
   honestly). SARIF output is deferred.
-- Production runners are claude-code, codex-cli, ollama (authoring-only),
-  and mock. Gemini CLI, OpenAI-compatible, and Antigravity are deferred to
-  v0.6.1 and are not registered as placeholders. Provider usage happens
-  under your own accounts and plans; not every installed Codex version is
-  compatible (the doctor reports the exact missing capabilities).
-- Ollama cannot execute tasks or modify files — by capability, not by
-  configuration. Models are never pulled or selected automatically.
-- Codex resume needs an installed version with explicit session resume;
-  without it, resume is reported unsupported instead of guessed.
+- Production runners are claude-code, codex-cli, gemini-cli, ollama
+  (authoring-only), openai-compatible (authoring-only), and mock; the
+  antigravity-cli adapter is experimental detection only. Provider usage
+  happens under your own accounts and plans; not every installed provider
+  version is compatible (the doctor reports the exact missing
+  capabilities). Not every Gemini CLI version supports safe task
+  execution, and not every OpenAI-compatible endpoint implements JSON
+  Schema or the Responses API — the profile declares what its endpoint
+  supports.
+- Ollama and OpenAI-compatible endpoints cannot execute tasks or modify
+  files — by capability, not by configuration. Models are never pulled or
+  selected automatically, and model output never proves implementation
+  correctness.
+- Codex and Gemini resume need an installed version with explicit session
+  resume; without it, resume is reported unsupported instead of guessed.
 - Authoring fallback exists only for explicitly configured chains, only for
   stage generation/refinement, with bounded retries; there is no automatic
   provider switching anywhere else.

docs/agent-runners.md

@@ -30,10 +30,12 @@ orchestration lives in `@specbridge/execution` and evidence evaluation in
 ### Runner kinds and statuses
 
 Kinds: `mock` (offline, deterministic), `claude-code` (local Claude Code
-CLI), `codex-cli` (local Codex CLI, v0.6), and `ollama` (local model API,
-authoring-only, v0.6). The v0.3-era `unsupported` stubs are gone — deferred
-providers (Gemini CLI, OpenAI-compatible, Antigravity) exist only on the
-[roadmap](roadmap.md) and are not registered as placeholders.
+CLI), `codex-cli` (local Codex CLI, v0.6), `gemini-cli` (local Gemini CLI,
+v0.6.1), `ollama` (local model API, authoring-only, v0.6),
+`openai-compatible` (model API, authoring-only, v0.6.1), and
+`antigravity-cli` (experimental detection only, v0.6.1). The v0.3-era
+`unsupported` stubs are gone; the value remains in the vocabulary so
+stored data stays readable.
 
 Detection statuses: `available`, `unavailable`, `unauthenticated`,
 `incompatible`, `misconfigured`, `error`. Only `available` permits

docs/antigravity-cli-runner.md

@@ -0,0 +1,80 @@
+# Antigravity CLI adapter (experimental)
+
+The `antigravity-cli` adapter (v0.6.1) is EXPERIMENTAL: it detects the
+executable (default `agy`, configurable), its version, and any DOCUMENTED
+headless or machine-readable capabilities, and reports them transparently.
+It is not a production automation adapter, and it cannot be marked
+production in v0.6.1.
+
+## What it never does
+
+- start the interactive TUI (during doctor or ever)
+- allocate a pseudo-terminal, inject keystrokes, or parse ANSI screen
+  output (no PTY/TUI library exists anywhere in the implementation —
+  enforced by tests)
+- automate login or workspace trust
+- inspect private session files
+- assume Gemini CLI flags, output formats, or session storage —
+  Antigravity is a different product
+- claim task execution, resume, or structured output without detection
+- get selected automatically (experimental profiles require explicit
+  opt-in, and the profile is disabled by default)
+
+## Profile
+
+```json
+{
+  "runnerProfiles": {
+    "antigravity": {
+      "runner": "antigravity-cli",
+      "enabled": false,
+      "command": { "executable": "agy", "args": [] },
+      "experimental": true
+    }
+  }
+}
+```
+
+`experimental` is locked to `true` by the schema.
+
+## Detection
+
+`specbridge runner doctor antigravity` runs bounded `--version` and
+`--help` probes with no stdin connected. A build that hijacks these into an
+interactive session simply hits the bounded timeout and is classified as
+interactive-only. Where the help output documents them, these observations
+are reported (never acted on): headless invocation, machine-readable
+output, structured final output, sandbox/permission controls,
+workspace-write controls, session identity, resume.
+
+Typical output:
+
+```
+Runner: antigravity
+Support: experimental
+
+Detected:
+  executable
+  version
+  interactive workspace support
+
+Not proven:
+  stable headless mode
+  structured final output
+  bounded edit permissions
+  session resume contract
+
+Automation is disabled.
+```
+
+## Support rules
+
+- category: `experimental`; support level: `experimental`
+- every capability is declared false: stage generation, refinement, task
+  execution, and resume are all refused by selection before any process
+  could start (and again defensively by the adapter)
+- even when headless/structured tokens are positively detected, support
+  stays experimental in v0.6.1: a documented, headless, structured-output
+  contract must pass the applicable conformance suite before any operation
+  can be considered, and conformance can never confirm production for an
+  experimental-declared adapter

docs/claude-code-plugin.md

@@ -79,6 +79,14 @@ and controlled lifecycle operations and never duplicate core logic:
 - `continue` finishes an interrupted interactive run honestly (never
   presenting a fresh run as a resumption).
 - `verify` runs `spec_check_drift` and asks before `spec_run_verification`.
+- `runners` (v0.6.1) is read-only runner inspection: it calls
+  `runner_list` and `runner_matrix` (and `runner_show`/`runner_doctor`
+  for a named profile), explains categories and local-versus-network
+  boundaries, and recommends compatible profiles for an operation. It
+  never edits configuration, never invokes any provider or nested agent,
+  never sends a network request itself, and never starts a login. The
+  existing implementation workflow is unchanged: `task_begin` → the
+  current Claude Code session edits → `task_complete`.
 
 No skill uses `bypassPermissions`, `dangerously-skip-permissions`,
 unrestricted `Bash(*)`, or unrestricted `Write`, and no skill instructs

docs/configuration-migration.md

@@ -34,8 +34,9 @@ Guarantees (tested):
 - Codex and Ollama are NOT enabled;
 - no credential value is created;
 - automatic fallback stays disabled;
-- unmappable v1 runner entries (e.g. `openai-compatible`) are reported and
-  remain in the backup (that provider is planned for v0.6.1).
+- new-provider profiles (Codex, Ollama, Gemini, OpenAI-compatible,
+  Antigravity) are added DISABLED; unmappable custom v1 runner entries are
+  reported and remain in the backup.
 
 ## Safety mechanics