---
name: sdk-test-reverse-engineering
type: analysis
title: "Reverse Engineering Findings — Antigravity Language Server Hub"
description: "Complete RE analysis of the agy Go binary: 3305 decompiled functions across 100+ subsystems, protobuf schemas, credentials, and enums extracted via Ghidra MCP"
tags: [reverse-engineering, antigravity, jetsky, ghidra, golang, protobuf, cli]
timestamp: 2026-07-21
---

# Reverse Engineering Findings — Antigravity Language Server Hub

## Binary Under Analysis

| Property | Value |
|----------|-------|
| **Binary** | `agy` — Antigravity CLI |
| **Path** | `/Users/alefita/.local/bin/agy` |
| **Size** | ~99 MB |
| **Architecture** | ARM64 (Apple Silicon) |
| **Language** | Go (gc compiler) |
| **Internal Package Root** | `github.com/anthropics/jetsky/internal/...` |
| **Decompilation Tool** | Ghidra MCP (automated analysis) |
| **Total Decompiled Files** | 3,305 `.c` files |
| **Unique Package Prefixes** | 130+ |

The binary was imported into Ghidra, auto-analyzed, and then systematically decompiled. A custom Python pclntab parser (`scratch/go_pclntab_parser.py`) extracted function names, source file paths, and line number mappings from the Go binary's Plan 9 Line Number Table. This produced an index of all Go functions (`scratch/go_functions.json`) that guided the decompilation campaign.

## Subsystem Inventory

The 3,305 decompiled functions cluster into distinct subsystems. Below is the full inventory grouped by architectural function.

### Language Server Subsystem

The core LSP (Language Server Protocol) implementation that powers code intelligence.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `lsp` | Multiple | LSP server initialization, document sync, diagnostics |
| `language` | Multiple | Language detection, file type resolution |
| `completion` | Multiple | Code completion engine |
| `codesearch` | Multiple | Codebase search and indexing |
| `opensearch` | Multiple | Open search protocol integration |
| `diff` | Multiple | Diff computation and application |
| `applyedit` | 5 | `HandleFastApply`, `applyReplacementsToContent`, `filterFastApplyDiffToRange`, `handleFastApplyFallback`, `handleRepairFallback` |

### API Server Subsystem

The gRPC-based API server that proxies requests to Google's backend.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `api_server_go_proto` | 30+ | `ApiServerService` with 15+ RPC handlers |
| `v1internal_go_proto` | 25+ | `CloudCode` service with 15+ RPC methods |
| `analytics_go_proto` | 6 | `AnalyticsService` — telemetry recording |

#### ApiServerService RPC Methods (Extracted)

| Method | Purpose |
|--------|---------|
| `ApplyTrajectoryHeuristics` | Trajectory optimization |
| `CreateTrajectoryShareStream` | Share trajectories across sessions |
| `GetCascadeModelConfigs` | Cascade model configuration retrieval |
| `GetCommandModelConfigs` | Command model configuration |
| `GetCompletionExamples` | Few-shot completion examples |
| `GetDeploymentConfig` | Deployment configuration |
| `GetEmbeddings` | Vector embedding generation |
| `GetImageGeneration` | Image generation endpoints |
| `GetMQuery` | Multi-query search |
| `GetMcpServerTemplates` | MCP server template registry |
| `GetModelInfos` | Model metadata retrieval |
| `GetModelStatuses` | Model health/status checks |
| `GetTeamOrganizationalControls` | Team-level access controls |
| `GetTranscription` | Audio transcription |
| `GetUnleashContextFields` | Feature flag context |
| `GetWebDocsOptions` | Documentation options |
| `GetWebSearchRedirect` | Web search redirect |
| `GetWebSearchResults` | Web search results |
| `ProvideFeedback` | User feedback collection |
| `RecordAsyncTelemetry` | Async telemetry recording |

#### CloudCode Service Methods (v1internal)

| Method | Purpose |
|--------|---------|
| `CompleteCode` | Code completion |
| `FetchAdminControls` | Admin control panel |
| `FetchCodeCustomizationState` | Customization state |
| `GenerateChat` | Chat generation |
| `GetCodeAssistGlobalUserSetting` | Global user settings |
| `InternalAtomicAgenticChat` | Atomic agentic chat (internal) |
| `ListAgents` | Agent enumeration |
| `ListCloudAICompanionProjects` | Companion project listing |
| `ListExperiments` | A/B experiment listing |
| `ListModelConfigs` | Model configuration listing |
| `ListRemoteRepositories` | Remote repo listing |
| `LoadCodeAssist` | Code assist initialization |
| `MigrateDatabaseCode` | Database migration |
| `OnboardUser` | User onboarding flow |
| `RecordClientEvent` | Client event telemetry |
| `RecordCodeAssistMetrics` | Code assist metrics |
| `RecordSmartchoicesFeedback` | Smart choices feedback |
| `SearchSnippets` | Snippet search |
| `SetCodeAssistGlobalUserSetting` | Setting update |
| `TransformCode` | Code transformation |

### Extension Server Subsystem

The plugin/extension management layer.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `extension` | Multiple | Extension lifecycle management |
| `exte` / `exten` | Multiple | Extension loading and initialization |
| `sidecars` | Multiple | Sidecar process management |
| `mcp` / `mcpcore` | Multiple | Model Context Protocol server integration |
| `launchmanager` | Multiple | Extension launch orchestration |
| `sdk` / `sdkprocess` | Multiple | SDK process management |

### Decorators Subsystem

Prompt decoration and template management.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `decorators` | Multiple | Prompt decorator chain |
| `templateprovider` | 3 | `TemplateProvider`, `loadHelpersFromDir` |
| `prompt` | Multiple | Prompt construction and formatting |
| `ephemeral` | Multiple | Ephemeral message handling |

### Knowledge Subsystem

Document and knowledge base management.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `knowledge` | Multiple | Knowledge item management |
| `document` / `documentmanager` | Multiple | Document lifecycle |
| `doc` | Multiple | Document parsing |
| `notebook` | Multiple | Notebook support |
| `web_scraping` | Multiple | Web content extraction |

### Tool Subsystem

Tool definitions, execution, and conversion.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `tools` | 7+ | `RunCommandToolConverter`, `GrepSearchToolConverter`, `ViewFileToolConverter`, `WaitToolConverter`, `ListPermissionsToolConverter`, `CommandStatusToolConverter`, `SplitCompletionProvider` |
| `toolconverters` | Multiple | `ReadURLContentToolConverter` |
| `tooloverrides` | 1 | `ToolOverrideMapper` |
| `tool_parsers` | 1 | `ChatTranscriptToolFormatter` |
| `tool` | Multiple | Base tool infrastructure |
| `slashcommands` | Multiple | Slash command processing |

### Browser Subsystem

Full browser automation with CDP (Chrome DevTools Protocol).

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `browser` | 30+ | Screenshot capture, DOM reading, JavaScript execution, mouse/keyboard events, page management, scroll/wheel handlers |
| `browserabstractions` | Multiple | Browser abstraction layer |
| `cdpclient` | Multiple | Chrome DevTools Protocol client |
| `chrome` | Multiple | Chrome integration |
| `webm` | Multiple | WebM media handling |

#### Browser Functions (Partial List)

| Function | Purpose |
|----------|---------|
| `NewCaptureBrowserScreenshotHandler` | Screenshot capture |
| `NewCaptureBrowserConsoleLogsHandler` | Console log capture |
| `NewListBrowserPagesHandler` | Page enumeration |
| `NewReadBrowserPageHandler` | Page content reading |
| `NewBrowserScrollHandler` / `ScrollDown` / `ScrollUp` | Scroll control |
| `NewBrowserMouseWheelHandler` | Mouse wheel simulation |
| `executeJavaScriptAction` | JS execution in page context |
| `mouseWheelAction` / `pressKeyAction` | Input simulation |
| `imageToPNGImageProto` | Image format conversion |
| `makeClickFeedbackPNG` / `makeDragFeedbackPNGs` | Visual feedback generation |
| `buildMarkdownTrajectorySummary` | Trajectory summarization |
| `createScratchpadFile` | Scratchpad file creation |

### Agent & Executor Subsystem

Agent lifecycle, execution, and state management.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `agent_state_component` | 35+ | `AgentState`, `SubagentUpdateForwarder`, trajectory merging, pub/sub |
| `agentexecutor` | 12+ | `AgentExecutor` (Run, cancel, state transitions), `CascadeExecutor` |
| `subagent` | Multiple | `ConversationSubagentManager` |
| `agent` | 15+ | Step handling, payload cases (set operations), model request cloning |
| `agentapi` | 2 | `sendMessageHandler` (Execute, Metadata) |
| `executor` / `executors` | Multiple | Execution infrastructure |
| `cascade` | Multiple | Cascade execution model |

### Trajectory Subsystem

Conversation trajectory management and persistence.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `trajectory` | 15+ | `protoTrajectory`, `StepHeaderMetadata`, `StepHeaderTaskDetails`, `ChatModelHeader`, `GeneratorMetadataHeader`, `PlannerResponseStepView` |
| `traj` | 2 | `processPendingUpdates`, `startCommitWorker` |
| `trajectorystore` | 2 | `Manager`, `ProtoStore` |
| `dbtrajectory` | Multiple | Database-backed trajectory storage |
| `recording` | Multiple | Session recording |
| `battlemode` | 10+ | `trajectoryWithReplacer` — step replacement, cloning, status indexing |

### Authentication Subsystem

OAuth2 authentication and keychain management.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `authclient` | 12 | `AuthClient` — `LoginWithBrowser`, `refreshAndSaveToken`, `GetAuthStatus`, `GetGrantedScopes`, `ValidateProject`, `performTerminalAuthFlow`, `validateLoginAndUpdateStatus`, `generateState`, `openBrowser` |

### Streaming Subsystem

Real-time streaming of model responses.

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `streaming` | 4 | `BaseStreamReceiver`, `CompletionLatencyInfo`, `CompletionWithLatencyInfo` |

### Configuration & Experiments

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `config` | Multiple | Configuration management |
| `experiments` | Multiple | A/B experiment framework |
| `unleash` | 4 | `UnleashWrapper`, `UnleashWrapperFactory`, `contextFieldState`, `InitializeFactory` |
| `customizations` | Multiple | User/team customizations |
| `credits` | Multiple | Credit/quota management |

### Workspace & VCS

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `workspace_manager` | 15+ | `WorkspaceInfoManager`, `WorkspaceFiles`, `WorkspaceInfo`, file tree traversal |
| `vcs` | 8 | `Repository`, `GitRepoInfo`, `VcsCache`, `IsRepoPubliclyAccessible` |
| `git` | Multiple | Git operations |
| `commit` | Multiple | Commit handling |
| `scm` | Multiple | Source code management |

### Other Subsystems

| Package | Functions | Key Components |
|---------|-----------|----------------|
| `model` / `modelapiinterface` / `modelapiccpa` | Multiple | Model API abstraction layer |
| `chat` / `chatconverters` | Multiple | Chat message handling |
| `command` | Multiple | Command execution |
| `terminal` | 2 | `ShellCommandTracker`, `StaticTerminalShellCommand` |
| `imagegen` | Multiple | Image generation |
| `hooks` / `prehooks` / `posthooks` / `pretoolhooks` / `stophooks` | Multiple | Hook system (lifecycle events) |
| `permissions` | Multiple | Permission management |
| `profiling` | Multiple | Performance profiling |
| `telemetry` / `telemetryclient` / `telemetryinterface` | 5+ | `AntigravityClient`, `clearcutLogger`, `DummyTelemetryClient` |
| `statesync` | 3 | `UnifiedStateSyncClient`, subscription management |
| `stepmanager` | 1 | `StepManager` |
| `tokenizer` | 1 | `EstimateTokenCounter` |
| `sandboxproxy` / `sbox` | Multiple | Sandbox execution |
| `netbox` | Multiple | Network box/proxy |
| `eval` | Multiple | Evaluation framework |
| `datasets` | Multiple | Dataset management |
| `trainer` / `trainer_go_proto` | 3 | `TrainerConfig`, `BaseModelConfig`, `RoPEEmbeddingConfig` |
| `gemini` | Multiple | Gemini-specific integration |
| `codeium` | Multiple | Codeium legacy integration |
| `interceptor` | Multiple | Request/response interception |
| `platform` | Multiple | Platform abstraction |
| `jsonhook` | Multiple | JSON hook processing |
| `multicall` | Multiple | Batched RPC calls |
| `reactive` | Multiple | Reactive state management |
| `ssh` / `remoting` / `reversetunnel` | Multiple | Remote connection infrastructure |
| `checkpoint` | Multiple | State checkpointing |
| `pipe` | Multiple | Pipe-based communication |
| `integration` | Multiple | Integration layer |

## Protobuf Schemas (Reconstructed)

### ModelInfo (25 Fields)

```protobuf
syntax = "proto3";
package jetsky.model;

message ModelInfo {
  string model_id = 1;
  string display_name = 2;
  string description = 3;
  ModelProvider provider = 4;
  ModelType model_type = 5;
  BackendType backend_type = 6;
  HybridDeployment hybrid_deployment = 7;
  int32 max_input_tokens = 8;
  int32 max_output_tokens = 9;
  float temperature_default = 10;
  float temperature_min = 11;
  float temperature_max = 12;
  bool supports_tools = 13;
  bool supports_streaming = 14;
  bool supports_system_prompt = 15;
  bool supports_images = 16;
  string api_endpoint = 17;
  string api_key_env = 18;
  PromptTemplaterType prompt_templater = 19;
  ToolFormatterType tool_formatter = 20;
  // Fields 21-25: pricing, capabilities, metadata (not fully reconstructed)
}
```

### ProductEvent (Telemetry)

```protobuf
message ProductEvent {
  string event_name = 1;
  string api_key = 2;
  string installation_id = 3;
  string ide_name = 4;
  string os = 5;
  string codeium_version = 6;
  int64 timestamp = 7;
  map<string, string> properties = 8;
}
```

### gRPC Service Definition

```protobuf
service LanguageServerService {
  rpc ValidateProject (ValidateProjectRequest) returns (ValidateProjectResponse);
  rpc GetCompletions (GetCompletionsRequest) returns (GetCompletionsResponse);
  rpc Chat (ChatRequest) returns (stream ChatResponse);
}
```

## Credentials Map

Three distinct OAuth2 Client ID/Secret pairs were found in the binary:

### Consumer (ACTIVE)

| Field | Value |
|-------|-------|
| Client ID | `1071006060591-tmhssin2h21lcre235vtolojh4g403ep` |
| Client Secret | `GOCSPX-REDACTED-1` |
| Usage | Google One / Consumer OAuth2 |
| Status | Active — used by agy CLI + IDE + Master |

### Enterprise

| Field | Value |
|-------|-------|
| Client ID | `884354919052-36trc1jjb3tguiac32ov6cod268c5blh` |
| Client Secret | `GOCSPX-REDACTED-2` |
| Usage | GCP / Code Assist enterprise flows |
| Status | Available in binary, not active |

### Legacy (DISCONTINUED)

| Field | Value |
|-------|-------|
| Client ID | `681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j` |
| Client Secret | `GOCSPX-REDACTED-3` |
| Usage | `opencode-gemini-auth` (legacy Antigravity) |
| Status | Discontinued — credential file deleted |

### Installation IDs

| Component | Installation ID | Shared With |
|-----------|-----------------|-------------|
| Antigravity Master | `aba9d234-1284-4a20-98e6-0fa3cf57de66` | IDE |
| Antigravity IDE | `aba9d234-1284-4a20-98e6-0fa3cf57de66` | Master |
| Antigravity CLI | `17ac69b8-1279-4ce5-9201-10ee019953cd` | None |

## Enums and Constants

### PromptTemplaterType

| Value | Name | Purpose |
|-------|------|---------|
| 0 | `UNSPECIFIED` | Default |
| 1 | `NONE` | Raw prompt, no template |
| 2 | `GENERAL` | General-purpose template |
| 3 | `GEMINI_LEGACY` | Legacy Gemini format |
| 4 | `DEEPSEEK_REASONER` | DeepSeek reasoning format |
| 5 | `GEMINI_2_0` | Gemini 2.0 format |

The presence of `DEEPSEEK_REASONER` confirms internal testing/support for DeepSeek models within the JETSKY ecosystem.

### ToolFormatterType

| Value | Name | Purpose |
|-------|------|---------|
| 0 | `UNSPECIFIED` | Default |
| 1 | `NATIVE` | Model-native tool format (OpenAI, Anthropic) |
| 2 | `XML` | XML-style tool definitions |
| 3 | `MARKDOWN` | Markdown-style tool descriptions |

### APIProvider

| Value | Name | Purpose |
|-------|------|---------|
| 0 | `UNSPECIFIED` | Default |
| 1 | `CODEIUM` | Legacy Codeium API |
| 2 | `CLOUD_CODE` | GCP Cloud Code API |
| 3 | `FIRST_PARTY` | Google 1st party API |

### ModelProvider

| Value | Name | Purpose |
|-------|------|---------|
| 0 | `UNSPECIFIED` | Default |
| 1 | `OPENAI` | OpenAI models |
| 2 | `ANTHROPIC` | Claude models |
| 3 | `GOOGLE` | Gemini models |
| 4 | `CUSTOM` | Custom/local models |

### BackendType

| Value | Name | Purpose |
|-------|------|---------|
| 0 | `UNSPECIFIED` | Default |
| 1 | `CLOUD` | Cloud-hosted model |
| 2 | `LOCAL` | Locally-running model |
| 3 | `HYBRID` | Hybrid deployment |

### ModelType

| Value | Name | Purpose |
|-------|------|---------|
| 0 | `UNSPECIFIED` | Default |
| 1 | `CHAT` | Chat/conversational |
| 2 | `COMPLETION` | Completion |
| 3 | `EMBEDDING` | Embedding |
| 4 | `MULTIMODAL` | Multi-modal |

### HybridDeployment

| Value | Name | Purpose |
|-------|------|---------|
| 0 | `UNSPECIFIED` | Default |
| 1 | `CLOUD_ONLY` | Cloud-only |
| 2 | `LOCAL_ONLY` | Local-only |
| 3 | `CLOUD_WITH_LOCAL_FALLBACK` | Cloud primary, local fallback |
| 4 | `LOCAL_WITH_CLOUD_FALLBACK` | Local primary, cloud fallback |

### Auth Method

| Value | Purpose |
|-------|---------|
| `consumer` | Google One / personal OAuth |
| `enterprise` | GCP / Code Assist OAuth |
| `api_key` | API key authentication |

## Key String Extraction Highlights

| String | Context |
|--------|---------|
| `"gemini"` | Keychain service name |
| `"antigravity"` | Keychain account name |
| `"go-keyring-base64:"` | Keychain value prefix |
| `"consumer"` | Auth method identifier |
| `"https://oauth2.googleapis.com/token"` | Token refresh endpoint |
| `"https://cloudcode-pa.googleapis.com"` | gRPC proxy endpoint |
| `"Bearer "` | HTTP authorization token prefix |

## HTTP Headers (Binary Strings)

### API Call Headers

| Header | Purpose |
|--------|---------|
| `Authorization` | `Bearer <access_token>` |
| `x-api-key` | API key (non-OAuth flows) |
| `x-goog-api-client` | Client identification |
| `x-goog-user-project` | Billing project |
| `x-goog-sherlog-Link` | Internal logging/tracing |
| `x-goog-cloud-target-resource` | Target resource routing |
| `X-Goog-Ext-525006001-bin` | Binary extension data |
| `X-Goog-Drive-Resource-Keys` | Drive resource keys |
| `X-Goog-Request-Reason` | Audit trail |
| `x-codeium-csrf-token` | CSRF protection |
| `X-Http-Session-Id` | Session tracking |

## .pb File Analysis

### implicit/ Directory
Files in `~/.gemini/antigravity-ide/data/implicit/` are **encrypted** — not raw protobuf. Multiple decoding attempts failed. Likely trajectory files from the pre-upgrade version of Antigravity IDE.

### agyhub_summaries/
Files in the agyhub summaries directory are **raw protobuf** — successfully decoded. They contain session summaries and metadata.

## Validation Endpoints

| Endpoint | Purpose |
|----------|---------|
| `https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=<token>` | Validate token, check scopes, get metadata |
| `https://www.googleapis.com/oauth2/v1/userinfo` | Get user profile data |

## Deep-Dive Pages

For detailed analysis of the patterns and systems revealed by this RE work:

| Topic | Deep-Dive Page | Key Content |
|-------|---------------|-------------|
| Decompiled patterns | [[sdk-test-decompiled-patterns]] | 10 architectural patterns (Cascade, Battle Mode, Subagents, MCP, Browser, Knowledge, CEL, Feature Flags) |
| Localharness architecture | [[sdk-test-localharness]] | Go binary subprocess model, WebSocket protocol, connection lifecycle |
| Protobuf wire format | [[sdk-test-protobuf]] | Every message type extracted from `localharness_pb2.py` |
| Authentication chain | [[sdk-test-auth-chain]] | Auth functions decompiled from `authclient.*` and `auth.*` |
| gRPC protocol | [[sdk-test-grpc-protocol]] | Service descriptors from `language_server_go_grpc.*` |
| DeepSeek + Heartbeat | [[sdk-test-deepseek-heartbeat]] | PromptTemplaterType enum, DeepSeek integration |

## Cross-References

- [[sdk-test-antigravity-sdk]] — Full SDK reference (Agent, Conversation, types, tools, hooks, triggers)
- [[sdk-test-architecture]] — Architecture synthesis including auth chain, token lifecycle, gRPC protocol
- [[sdk-test-integrations]] — Integration points: DeepSeek, heartbeat, Gemma 4, SDK
- [[sdk-test-synthesis]] — Epiphany synthesis and RFC-001 proposal
- antigravity-2.0 — The broader Antigravity ecosystem
- [[claude-desktop-bundles]] — Related reverse engineering work