Antigravity: sign in without a browser (credentials)

What it asks for

Antigravity OAuth token JSONrequired

The full contents of /home/dev/.gemini/antigravity-cli/antigravity-oauth-token from a machine where you're signed in (`cat ~/.gemini/antigravity-cli/antigravity-oauth-token`) — or a secret backed by that file in a workspace that is already signed in, which stays current without re-pasting. Redacted from run logs and never persisted into the container's env profile.

Overwrite existing login

Choose 'no' to keep a token file already present in the container and only do the rest of the setup.

What it runs

The whole script, exactly as it will execute in your workspace. Nothing is hidden — read it before you run it.

#!/usr/bin/env sh
set -eu
umask 077   # anything this script creates is owner-only by default

log()  { printf '[antigravity-setup] %s\n' "$*"; }
warn() { printf '[antigravity-setup] WARNING: %s\n' "$*" >&2; }
die()  { printf '[antigravity-setup] ERROR: %s\n' "$*" >&2; exit 1; }

PATH="$HOME/.local/bin:${HOME:-/home/dev}/.local/bin:$PATH"
export PATH

TOKEN_JSON="${ANTIGRAVITY_OAUTH_TOKEN_JSON:-}"
OVERWRITE="${OVERWRITE_EXISTING_CREDENTIALS:-yes}"
TOKEN_FILE="${ANTIGRAVITY_TOKEN_PATH:-${HOME:-/home/dev}/.gemini/antigravity-cli/antigravity-oauth-token}"
AGY_DIR="$(dirname "$TOKEN_FILE")"

[ -n "$TOKEN_JSON" ] || die "no Antigravity OAuth token JSON was supplied"
command -v agy >/dev/null 2>&1 || command -v antigravity >/dev/null 2>&1 \
    || die "the 'agy' CLI is not on PATH — run this in a workspace that has Antigravity installed"

if [ "$(id -u)" -eq 0 ]; then SUDO=""
elif command -v sudo >/dev/null 2>&1; then SUDO="sudo -n"
else SUDO=""
fi

# jq is optional: it validates the pasted token JSON.
# Never fail merely because jq cannot be installed; the token file write still proceeds.
# Note: this script body is piped to `sh -s` on stdin, so stdin IS the remaining
# script. Every installer gets </dev/null or a prompt would eat the script.
if ! command -v jq >/dev/null 2>&1; then
    log "jq not found; attempting install (optional)"
    export DEBIAN_FRONTEND=noninteractive
    if   command -v apt-get >/dev/null 2>&1; then $SUDO apt-get update -qq </dev/null && $SUDO apt-get install -y -qq jq </dev/null || true
    elif command -v dnf     >/dev/null 2>&1; then $SUDO dnf install -y jq </dev/null || true
    elif command -v yum     >/dev/null 2>&1; then $SUDO yum install -y jq </dev/null || true
    elif command -v apk     >/dev/null 2>&1; then $SUDO apk add --no-cache jq </dev/null || true
    elif command -v pacman  >/dev/null 2>&1; then $SUDO pacman -Sy --noconfirm jq </dev/null || true
    elif command -v zypper  >/dev/null 2>&1; then $SUDO zypper install -y jq </dev/null || true
    elif command -v brew    >/dev/null 2>&1; then brew install jq </dev/null || true
    fi
    command -v jq >/dev/null 2>&1 || warn "continuing without jq"
fi

mkdir -p "$AGY_DIR"

if command -v jq >/dev/null 2>&1; then
    printf '%s' "$TOKEN_JSON" | jq empty >/dev/null 2>&1 \
        || die "the supplied value is not valid JSON — paste the whole antigravity-oauth-token contents, from '{' to '}'"
fi

if [ -f "$TOKEN_FILE" ] && [ "$OVERWRITE" != "yes" ]; then
    log "$TOKEN_FILE already exists and overwrite is off — leaving it alone"
else
    if [ -f "$TOKEN_FILE" ]; then
        cp -p "$TOKEN_FILE" "$TOKEN_FILE.bak"
        log "backed up previous token file to $TOKEN_FILE.bak"
    fi
    # printf, not a heredoc: the value must land verbatim, with no shell expansion.
    printf '%s\n' "$TOKEN_JSON" > "$TOKEN_FILE"
    chmod 600 "$TOKEN_FILE"
    log "wrote $TOKEN_FILE (mode 600)"
fi

log "done. Run 'agy' — it should start without asking you to log in."