From 52dfafa35740413203777e52a4c3948009b88293 Mon Sep 17 00:00:00 2001 From: zk <> Date: Wed, 26 Aug 2026 02:08:04 +0800 Subject: [PATCH] chore(cli-version): verify agy against 1.1.20 Gate B (live e2e): 7/7, 171.02s, against a manifest-downloaded 1.1.20 whose sha512 was checked before it ran. The suite log reports only version=1.1.20. Gate C (release notes): CLEAR, read from 'agy changelog' on the candidate binary rather than the web page, which has been frozen at 1.1.17 since 08-22. A retracted A/B. 1.1.20's notes say print mode stopped treating benign tool errors and permission denials as fatal, so a comparison was run against what was believed to be a retained 1.1.19 binary. The two runs did differ -- result.status ERROR vs SUCCESS -- but the attribution does not hold: that binary rewrote itself mid-probe (mtime 02:02:48, probe at 02:02, size now byte-for-byte 1.1.20's). agy self-updates ANY copy of itself that is executed, including one in a temp directory under a version-named path. The path name is not a pin. The ERROR may be 1.1.19's behaviour or an artifact of a binary rewritten under a running process, and nothing separates them; it is not repeatable either, since the manifest now serves 1.1.20. Both captures are kept in the record under neutral names rather than the misleading version-labelled ones. What is verified by reading rather than by probe: translate.rs:80-86 maps any result.status other than SUCCESS to TurnOutcome::Failed, so that field -- not the exit code the note describes -- is our channel. conn.rs:805 consults the exit code only when no terminal frame arrived, and result was emitted in both runs. The other permission note is scoped to agy's default review mode, which we never run in: build_argv always passes --dangerously-skip-permissions (argv.rs:76) and gates each call in the PreToolUse hook bridge instead. Stated with its limit -- gate B does not exercise that bridge at all. No flag was removed: --help adds mic-serve and drops nothing, models --help is unchanged, and all nine flags build_argv emits are still present. Record: ~/aion/protocols/samples/antigravity-cli/1.1.20/ --- crates/aionui-session/src/backend/cli_version.rs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/crates/aionui-session/src/backend/cli_version.rs b/crates/aionui-session/src/backend/cli_version.rs index f1e05ddd9..1126876cf 100644 --- a/crates/aionui-session/src/backend/cli_version.rs +++ b/crates/aionui-session/src/backend/cli_version.rs @@ -38,7 +38,7 @@ use crate::event::{LocalizedText, NoticeLevel}; /// 0.147.0 and leaves it unverified rather than a floor anyone can install into. pub const VERIFIED_CLAUDE_VERSION: &str = "2.1.235"; pub const VERIFIED_CODEX_VERSION: &str = "0.149.1"; -pub const VERIFIED_AGY_VERSION: &str = "1.1.19"; +pub const VERIFIED_AGY_VERSION: &str = "1.1.20"; /// The verified release for a direct-CLI backend, keyed by the program name the /// backend spawns. `None` for anything not version-gated here. @@ -475,13 +475,13 @@ mod tests { // The literal the other two CLIs already pin, which agy was missing: a // user on exactly the verified release is told nothing, and a bump that // lands without re-verifying against that exact binary breaks here. - assert_eq!(classify("1.1.19", VERIFIED_AGY_VERSION), VersionVerdict::Verified); - assert!(drift_notice("agy", "1.1.19", VERIFIED_AGY_VERSION).is_none()); + assert_eq!(classify("1.1.20", VERIFIED_AGY_VERSION), VersionVerdict::Verified); + assert!(drift_notice("agy", "1.1.20", VERIFIED_AGY_VERSION).is_none()); // agy prints a bare version, so the older/newer paths are worth pinning // on that exact shape rather than only on a decorated one. - assert_eq!(classify("1.1.18", VERIFIED_AGY_VERSION), VersionVerdict::Older); - assert_eq!(classify("1.1.20", VERIFIED_AGY_VERSION), VersionVerdict::Newer); + assert_eq!(classify("1.1.19", VERIFIED_AGY_VERSION), VersionVerdict::Older); + assert_eq!(classify("1.1.21", VERIFIED_AGY_VERSION), VersionVerdict::Newer); } /// Both drift directions are `Info` — the tier the frontend draws as a quiet