Metadata-Version: 2.4
Name: ory-antigravity
Version: 0.11.1
Summary: Ory Agent Security for the Google Antigravity SDK — per-tool authorization, tracing, and identity propagation via the SDK's hook system. Built on ory-argus.
Author: Ory
License-Expression: Apache-2.0
Keywords: agent,ai,antigravity,authorization,gemini,google,ory,permissions
Requires-Python: >=3.10
Requires-Dist: google-antigravity>=0.1
Requires-Dist: ory-argus<1,>=0.8
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# ory-antigravity

Ory Agent Security for the [Google Antigravity SDK](https://antigravity.google/product/antigravity-sdk).

Authorizes every tool call against Ory Permissions via Antigravity's hook system, traces
invocations, and propagates user → agent → sub-agent identity — built on
[`ory-argus`](https://pypi.org/project/ory-argus/).

```bash
pip install ory-antigravity
```

```python
from google.antigravity import Agent, LocalAgentConfig
from ory_antigravity import ory_hooks

config = LocalAgentConfig(hooks=ory_hooks(), ...)
agent = Agent(config)
```

`ory_hooks()` returns three hooks ready to drop into `config.hooks`:
`OnSessionStartHook` (auth gates), `PreToolCallDecideHook` (authorize), and
`PostToolCallHook` (trace). Building your own `HookRunner`? The same object exposes them by
name: `ory_hooks().pre_tool_call_decide`, `.post_tool_call`, `.on_session_start`.

In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied tool is **aborted** — the decide
hook returns `HookResult(allow=False)` and Antigravity hands the model the denial instead of
running the tool. In **observe** mode (default) the tool runs and a `permission.observe_deny`
span is recorded. The `ask_question` builtin is treated as a user-interaction primitive (never
gated); when the model delegates via `start_subagent`, a sub-agent identity and
agent→subagent delegation are recorded.

Antigravity decide hooks fail **closed** (a raising hook aborts the tool), so this integration
owns fail-open itself: a network or rate-limit error on the permission check resolves to
*allow*, and an Ory outage never hard-blocks the agent.

Credentials come from the shared `~/.config/ory-agent-plugins/config.json`, so a login from
any Ory harness or `ory-argus login` is reused automatically. See
[docs/sdk-integrations.md](https://github.com/ory-corp/ory-agent-plugins/blob/main/docs/sdk-integrations.md).
