Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions GEMINI.md

This file was deleted.

18 changes: 9 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ For cloud environments (RunPod, Hetzner, Lambda Labs, etc):
- [AI Assistants](#ai-assistants)
- [Claude Code](#claude-code-primary-ai-assistant)
- [Codex CLI](#codex-cli-openai)
- [Gemini CLI](#gemini-cli-google)
- [Antigravity CLI + OpenCode](#antigravity-cli-google--opencode)
- [Terminal & Shell](#terminal--shell)
- [Ghostty](#ghostty-terminal-emulator)
- [Powerlevel10k Prompt](#powerlevel10k-prompt)
Expand Down Expand Up @@ -273,22 +273,22 @@ claude-tools context --list # Show active plugins and available prof

The configuration follows the same research discipline as Claude Code but adapted for Codex's execution model.

### Gemini CLI (Google)
### Antigravity CLI (Google) + OpenCode

[Gemini CLI](https://github.com/google-gemini/gemini-cli) can sync with Claude Code configurations:
Gemini CLI was retired by Google on **2026-06-18**; [Antigravity CLI](https://antigravity.google/docs/cli-features) (`agy`) is its official successor. [OpenCode](https://opencode.ai) is installed alongside as a model-agnostic OSS option. Both are installed by the `ai-tools` component.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix the retirement tense/date wording.

As of June 17, 2026, "was retired on 2026-06-18" is premature. Use future-tense phrasing (e.g., "access ends on June 18, 2026") until that date.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 278, The wording in the Gemini CLI retirement statement
uses past tense ("was retired on") for a date in the future, which is
inaccurate. Change the tense from past to future by replacing "was retired on"
with future-tense phrasing such as "will be retired on" or "access ends on"
while keeping the date 2026-06-18 unchanged. This ensures the statement
correctly reflects that the retirement has not yet occurred.


Antigravity CLI can sync with Claude Code skills:

```bash
./scripts/sync_claude_to_gemini.sh # Syncs skills/agents/permissions
./scripts/sync_claude_to_antigravity.sh # Symlinks Claude skills into agy
```

**What it does:**

- Symlinks Claude Code skills to `~/.gemini/skills/`
- Converts Claude agents to Gemini skill format
- Syncs permissions from `.claude/settings.json` to Gemini policies
- Creates `GEMINI.md` pointer to CLAUDE.md
- Symlinks Claude Code skills to `~/.gemini/antigravity-cli/skills/`
- Project instructions come from `AGENTS.md` (Antigravity reads it natively)

**Note:** Gemini CLI uses a different skills format. The sync script adapts Claude's configuration but some features may not translate directly.
**Note:** Antigravity CLI is closed-source and brand-new; its skills/permissions schema differs from Claude's. The skills sync is adapted but untested end-to-end — permission sync is not yet ported (see the script header).

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Documentation contradicts current script behavior on permission sync.

This line says permission sync is not ported, but scripts/sync_claude_to_antigravity.sh now performs permissions mapping + merge. Please align the README note with the actual current behavior and caveats.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 291, The README.md note at line 291 incorrectly states
that permission sync is not yet ported, but the actual script
`scripts/sync_claude_to_antigravity.sh` now includes permissions mapping and
merge functionality. Update the note to accurately reflect that the script
currently performs both skills and permissions sync, replacing the outdated
statement about permission sync not being ported with current details about how
permissions are handled (including what was adapted or any remaining caveats).


## Terminal & Shell

Expand Down
9 changes: 4 additions & 5 deletions claude/hooks/auto_commit_worker.sh
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ fi
: "${AUTO_AGENT_APPROVAL_FILE:=$HOME/.claude/flags/auto-agent-approved-until}"
: "${AUTO_AGENT_STATE_DIR:=$HOME/.claude/state}"
: "${AUTO_AGENT_LOG_DIR:=$HOME/.claude/logs/auto-commit}"
: "${AUTO_COMMIT_BACKEND_ORDER:=codex,gemini}"
: "${AUTO_COMMIT_BACKEND_ORDER:=codex,opencode}"
: "${AUTO_COMMIT_ENABLE_CLAUDE_FALLBACK:=0}"
: "${AUTO_COMMIT_DRY_RUN:=0}"
: "${AUTO_AGENT_EXCLUDE_REGEX:=^\\.claude/worktrees/}"
Expand Down Expand Up @@ -246,10 +246,9 @@ run_backend() {
command -v codex >/dev/null 2>&1 || return 1
run_with_timeout 240 codex -a never -s workspace-write exec --cd "$REPO_ROOT" --skip-git-repo-check "$prompt" >> "$log_file" 2>&1
;;
gemini)
command -v gemini >/dev/null 2>&1 || return 1
run_with_timeout 240 gemini \
-p "$prompt" --approval-mode yolo --output-format text >> "$log_file" 2>&1
opencode)
command -v opencode >/dev/null 2>&1 || return 1
run_with_timeout 240 opencode run "$prompt" >> "$log_file" 2>&1
;;
Comment on lines +249 to 252

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check opencode CLI for working directory flags
if command -v opencode &>/dev/null; then
  echo "=== opencode help output ==="
  opencode --help 2>&1 | head -50
  echo ""
  echo "=== opencode run help ==="
  opencode run --help 2>&1 | head -30
else
  echo "opencode not installed"
fi

Repository: yulonglin/dotfiles

Length of output: 85


🌐 Web query:

opencode CLI working directory --cd flag documentation

💡 Result:

The OpenCode CLI does not use a --cd flag to specify the working directory. Instead, it provides the following flags to set the working directory [1][2]: --cwd: Sets the current working directory (often with the short alias -c) [1][2]. --dir: Specifies the working directory to start the TUI in [3][4]. In some versions or documentation, the flag --cwd is explicitly listed with the short alias -c (e.g., opencode -c /path/to/project) [1][2][5]. Additionally, you can often simply pass the path as an argument directly when starting the command, such as opencode /path/to/project [6]. Please check your specific version's help documentation by running opencode --help to confirm which flag is available in your installation [1][2].

Citations:


🏁 Script executed:

#!/bin/bash
# Check the context around lines 249-252 and the function signature
cat -n claude/hooks/auto_commit_worker.sh | sed -n '240,260p'

Repository: yulonglin/dotfiles

Length of output: 1085


🏁 Script executed:

#!/bin/bash
# Look at the run_backend function signature and how REPO_ROOT is used
cat -n claude/hooks/auto_commit_worker.sh | sed -n '35,70p'

Repository: yulonglin/dotfiles

Length of output: 1522


🏁 Script executed:

#!/bin/bash
# Check how codex backend uses --cd and the full context
cat -n claude/hooks/auto_commit_worker.sh | sed -n '240,260p'

Repository: yulonglin/dotfiles

Length of output: 1085


🌐 Web query:

opencode run command syntax working directory --cwd flag example

💡 Result:

In the OpenCode CLI, the --cwd flag is primarily used for configuring the working directory when starting a server process (e.g., listening on a host/port) [1][2][3]. To specify the working directory for a standard opencode run command, you should use the --dir flag [1][2][3]. Example usage: opencode run "list the files" --dir /path/to/your/project Key details: - --dir: Specifies the directory to run in or the path on a remote server when attaching [1][2]. - --cwd: Used in the context of server startup configurations, such as setting the working directory for the server process, defining the hostname, or enabling mDNS [1][2][3]. Note that when running opencode run programmatically (e.g., from a Python subprocess), there is a known issue where the tool may prefer the environment's PWD variable over the process's actual working directory [4]. If you experience unexpected path behavior in scripts, explicitly providing the --dir flag is the recommended workaround [4].

Citations:


Pass working directory to the opencode run command using the --dir flag.

The opencode backend at line 251 invokes opencode run "$prompt" without specifying a working directory, while the codex backend explicitly uses --cd "$REPO_ROOT". The OpenCode CLI uses the --dir flag (not --cd) to set the working directory for the run command. Without this flag, opencode may execute in an incorrect directory, causing auto-commit operations to fail or run against the wrong repository.

Additionally, OpenCode has a known issue where it may prefer the environment's PWD variable over the process's actual working directory when run from scripts, making explicit --dir specification the recommended workaround.

Update line 251 to:

run_with_timeout 240 opencode run "$prompt" --dir "$REPO_ROOT" >> "$log_file" 2>&1
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@claude/hooks/auto_commit_worker.sh` around lines 249 - 252, In the opencode
case block, update the run_with_timeout command to include the --dir flag that
specifies the working directory for the opencode run command. Modify the line
containing run_with_timeout 240 opencode run "$prompt" to add --dir "$REPO_ROOT"
before the output redirection, so the opencode command executes in the correct
repository directory and avoids relying on the PWD environment variable which
may not be set correctly in script execution contexts.

claude)
[[ "${AUTO_COMMIT_ENABLE_CLAUDE_FALLBACK:-0}" == "1" ]] || return 1
Expand Down
18 changes: 18 additions & 0 deletions claude/rules/supply-chain-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,24 @@ All package managers are configured with a **7-day quarantine** (`min-release-ag
- Skip hash verification for production Python dependencies
- Bypass min-release-age quarantine without explicit user approval

## Tool Selection: Security Floor, then Adoption (two-gate)

When choosing between tools, apply two gates in order:

1. **Hard security floor (non-negotiable):** official core formula / cask / Mac App Store
only; **no third-party taps** without approval; notarization + quarantine on for casks;
`min-release-age` for language packages. A tool that fails the floor is out regardless
of popularity.
2. **Among options that clear the floor, prefer the more *modern / adopted* one** — GitHub
stars, monthly actives, release cadence, and HN/Reddit consensus. Higher adoption is
*also* a security positive (more eyes → faster CVE discovery), so this complements the
floor rather than fighting it. Don't default to a stale "boring" tool when a
well-adopted modern one clears the same floor.

**Residual-risk case:** a tool that is *young AND single-maintainer AND not-yet-widely-
adopted* (e.g. FineTune). High stars only partially offset bus-factor risk — such tools may
be *added* but ship **default-OFF** (conscious opt-in), never auto-on.

## Secrets Awareness

- API keys are scoped per-project via direnv `.envrc`, NOT globally exported
Expand Down
4 changes: 2 additions & 2 deletions config.sh
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ INSTALL_REGISTRY=(
"core|Core packages, CLI tools, gh, SOPS/age, uv|all|true"
"zsh|ZSH + oh-my-zsh + powerlevel10k theme|all|true"
"tmux|Terminal multiplexer|all|true"
"ai-tools|Claude Code, Gemini CLI, Codex CLI|all|true"
"ai-tools|Claude Code, Codex CLI, OpenCode, Antigravity CLI|all|true"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Inconsistent tool list between install and update component descriptions.

Line 36 (ai-tools install description) includes "Antigravity CLI", but line 67 (ai-update deploy description) omits it, listing only "Claude, Codex, OpenCode". According to the update script header (context snippet), the actual update functionality does include Antigravity CLI. The description should match.

📝 Suggested fix to align descriptions
-    "ai-update|Daily auto-update: Claude, Codex, OpenCode|all|true"
+    "ai-update|Daily auto-update: Claude, Codex, OpenCode, Antigravity|all|true"

Also applies to: 67-67

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config.sh` at line 36, The ai-tools install component description on line 36
includes "Antigravity CLI" in its tool list, but the ai-update deploy component
description on line 67 omits "Antigravity CLI", creating an inconsistency.
Update the ai-update component description on line 67 to include "Antigravity
CLI" in the tool list so that both the ai-tools and ai-update descriptions
reference the same set of tools.

"extras|hyperfine, gitui, code2prompt, terminal-notifier|all|true"
"cleanup|Automatic cleanup (macOS only)|all|true"
"experimental|ty type checker, zerobrew|all|true"
Expand Down Expand Up @@ -64,7 +64,7 @@ DEPLOY_REGISTRY=(
"dep-audit|Weekly dependency audit (supply chain defense)|all|true"
"cleanup|Auto-cleanup Downloads/Screenshots (macOS)|all|true"
"claude-cleanup|Remove idle Claude sessions after 24h|all|true"
"ai-update|Daily auto-update: Claude, Gemini, Codex|all|true"
"ai-update|Daily auto-update: Claude, Codex, OpenCode|all|true"
"mcp-sync|Daily shared MCP sync for Claude and Codex|all|true"
"brew-update|Weekly package upgrade + cleanup|all|true"
"claude-tools|Build claude-tools Rust binary|all|true"
Expand Down
2 changes: 1 addition & 1 deletion config/ai_automation.sh
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@

# Auto-commit policy
# Keep Claude fallback opt-in because it is usually the most expensive backend.
: "${AUTO_COMMIT_BACKEND_ORDER:=codex,gemini}"
: "${AUTO_COMMIT_BACKEND_ORDER:=codex,opencode}"
: "${AUTO_COMMIT_ENABLE_CLAUDE_FALLBACK:=0}"
: "${AUTO_COMMIT_DRY_RUN:=0}"
: "${AUTO_COMMIT_USE_ASYNC:=1}"
Expand Down
2 changes: 1 addition & 1 deletion config/aliases.sh
Original file line number Diff line number Diff line change
Expand Up @@ -1215,7 +1215,7 @@ fi
# AI CLI Tools
# -------------------------------------------------------------------
# Health check for all AI CLI tools
alias ai-check='echo "Checking AI CLI tools..." && claude --version 2>/dev/null && gemini --version 2>/dev/null && codex --version 2>/dev/null'
alias ai-check='echo "Checking AI CLI tools..." && claude --version 2>/dev/null && codex --version 2>/dev/null && opencode --version 2>/dev/null'

# Log sandbox denials for a command (macOS/Linux)
codex-denials() {
Expand Down
37 changes: 33 additions & 4 deletions custom_bins/update-ai-tools
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# ═══════════════════════════════════════════════════════════════════════════════
# AI CLI Tools Auto-Update
# ═══════════════════════════════════════════════════════════════════════════════
# Updates Claude Code, Gemini CLI, and Codex CLI using the correct method
# Updates Claude Code, Codex CLI, and OpenCode using the correct method
# per tool (brew on macOS, bun on Linux). Designed to run from launchd/cron.
#
# Usage:
Expand Down Expand Up @@ -37,7 +37,7 @@ while [[ $# -gt 0 ]]; do
-h|--help)
echo "Usage: update-ai-tools [--dry-run]"
echo ""
echo "Updates Claude Code, Gemini CLI, and Codex CLI."
echo "Updates Claude Code, Antigravity CLI, Codex CLI, and OpenCode."
echo "Uses brew on macOS and bun on Linux."
echo ""
echo "Options:"
Expand Down Expand Up @@ -147,6 +147,34 @@ update_claude() {
claude update 2>&1 || log_err "Claude Code update failed"
}

# ─── Update Antigravity CLI ─────────────────────────────────────────────────

# Antigravity CLI (`agy`, Google's Gemini CLI successor) is a macOS cask and a
# manual install on Linux (no bun/npm package) — so it can't use update_tool.
update_antigravity() {
if ! command -v agy &>/dev/null; then
log_skip "agy not installed, skipping"
return 0
fi

# No brew (i.e. Linux manual install) → nothing to auto-update.
if ! is_macos || ! command -v brew &>/dev/null; then
log_skip "agy: no brew (Linux manual install) — update manually, skipping"
return 0
fi

if [[ "$DRY_RUN" == "true" ]]; then
log "[DRY RUN] Would run: brew upgrade --cask antigravity-cli"
return 0
fi

log "Updating Antigravity CLI..."
# NOTE: if the cask declares `auto_updates true`, brew skips it unless --greedy.
# Verify on a real Mac whether --greedy is needed for `agy` to actually move.
NONINTERACTIVE=1 HOMEBREW_NO_AUTO_UPDATE=1 brew upgrade --cask antigravity-cli 2>&1 \
Comment on lines +172 to +174

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check antigravity-cli cask auto_updates setting

if ! command -v brew &>/dev/null; then
  echo "brew not available - check requires macOS"
  exit 0
fi

echo "Fetching antigravity-cli cask metadata..."
brew info --cask antigravity-cli

echo ""
echo "Look for 'auto_updates' in the output above."
echo "If set to 'true', line 174 should use:"
echo "  brew upgrade --cask --greedy antigravity-cli"

Repository: yulonglin/dotfiles

Length of output: 104


🏁 Script executed:

cat -n custom_bins/update-ai-tools | sed -n '160,180p'

Repository: yulonglin/dotfiles

Length of output: 1027


🌐 Web query:

antigravity-cli brew cask auto_updates

💡 Result:

The Homebrew cask for antigravity-cli explicitly includes the auto_updates true directive in its configuration [1]. This enables automatic updates for the application when managing it via Homebrew, allowing it to integrate with standard Homebrew Cask update workflows [1][2]. The official Homebrew Cask definition for antigravity-cli is maintained in the Homebrew/homebrew-cask repository [1]. Because it is defined as a cask, users can install it using the command brew install --cask antigravity-cli [3][4][5]. The inclusion of auto_updates true is standard practice for casks that provide their own internal update mechanisms, which in this case leverages a JSON-based manifest to track and apply updates [1].

Citations:


Add --greedy flag to brew upgrade command for antigravity-cli.

The antigravity-cli cask declares auto_updates: true, which means Homebrew will skip updates unless --greedy is specified. Without this flag, line 174's upgrade command will silently fail to update the tool.

Update to:

NONINTERACTIVE=1 HOMEBREW_NO_AUTO_UPDATE=1 brew upgrade --cask --greedy antigravity-cli 2>&1 \
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@custom_bins/update-ai-tools` around lines 172 - 174, The brew upgrade command
for the antigravity-cli cask is missing the --greedy flag, which causes Homebrew
to skip updates since this cask declares auto_updates: true. Add the --greedy
flag to the brew upgrade command line between --cask and the cask name
antigravity-cli to ensure the upgrade actually proceeds rather than being
silently skipped.

|| log_err "Antigravity CLI brew upgrade failed"
}

# ─── Main ────────────────────────────────────────────────────────────────────

acquire_lock
Expand All @@ -159,8 +187,9 @@ log "PATH: $PATH"
set +e

update_claude
update_tool "gemini" "gemini-cli" "@google/gemini-cli"
update_tool "codex" "codex" "@openai/codex"
update_antigravity
update_tool "codex" "codex" "@openai/codex"
update_tool "opencode" "opencode" "opencode-ai"

set -e

Expand Down
Loading
Loading