/setup

name: aka-setup
description: Set up AKA Security — calibrate notifications and detection posture from Antigravity's real activity.

AKA setup wizard

You are onboarding the AKA Security plugin for this machine. AKA works fully locally with **zero backend and zero Docker**: detection runs in-process and findings persist to a local SQLite store at `~/.aka/data/aka.db`.

This wizard tells a **calibration story**: introduce AKA → show what it does → offer one retroactive scan → report the real numbers it found and the posture it recommends → apply on confirmation → show the installed summary → hand off to the dashboard. Everything the user sees is derived from their _actual_ history — never a fabricated or demo number. When there isn't enough history to judge, the wizard falls back to a conservative severity-derived floor instead of guessing.

The false-positive/severity judgment needs the raw (unmasked) findings to rate them accurately, so it **sends them to the model API** through separate `agy` subprocesses (a large history is judged in several batches). Two things cross for each finding: its **raw value**, and about **120 characters of the surrounding transcript text** on either side of it — re-masked first, so any _other_ detectable secret in that window never leaves raw. The transcript file's path, the value's fingerprint, and the fingerprint key version are **dropped before egress**. A copy of the raw value **leaves the machine**, sent to the model provider like any other Antigravity prompt. You act only on the raw-free plan the subprocesses print back.

Two limits of this host are worth knowing before you consent, because they are weaker than the Claude Code and Codex plugins' equivalents:

• **The `agy` CLI documents no ephemeral mode.** Every run is written to your

conversation store under `~/.gemini/antigravity/brain/`, raw values and all — the same store this backfill scans. AKA therefore **deletes the judge's own conversation itself** as soon as the run ends. That deletion is best effort: if the process is killed between the write and the cleanup, the conversation stays on disk until you remove it.

• **Deleting the conversation is not network isolation.** It is a local-write

cleanup only; it cannot recall what was already sent.

Reading history is granted in step 1; **sending findings to the model is a distinct consent, collected in step 3 before the judgment pipe runs** — the judge refuses to run without it.

Follow the steps below **in order**. Nothing is written to the policy store until step 5 (or a floor fallback in step 3 if the calibration can't complete).

Execution contract (read before step 0)

Every script prints output in three region kinds. Your job for each is fixed:

• **`<<<AKA_SHOW … AKA_SHOW>>>`** — relay every AKA_SHOW region verbatim as your

next message: paste the content _between_ the markers exactly — a card region carries its own code fence, a plain confirmation line does not, but either way you paste exactly what's between the markers — never the marker lines, never a paraphrase or summary.

• **`<<<AKA_FRAME_JSON … AKA_FRAME_JSON>>>`** — machine-only. Parse it if a step

tells you to read a value from it; never display it.

• **Anything else on stdout** — status for you (paths like `Plan saved to:`,

errors, exit signals). Act on it; never relay it.

**Collecting a decision.** Wherever a step asks the user a question, ask it as a normal conversational turn with numbered options for the user to pick from. This wizard depends on no specific interactive-picker tool being available — present each option clearly and wait for the user's reply before moving on. If Antigravity exposes a native multi-choice picker in your environment, prefer that over plain text; otherwise the numbered-list form is the fallback. Never answer a question on the user's behalf.

Invariants:

• **Never write a confirmation or acknowledgement the wizard did not emit** — the

script's AKA_SHOW line is the confirmation.

• **Each step's AKA_SHOW regions must be relayed before you advance.**
• **One question per decision; never re-ask a decision already collected.**

0. Show the intro card

Run the intro script and relay its AKA_SHOW region per the execution contract: paste the content between the markers verbatim, never the marker lines. It prints a single space-aligned monospace card — name, repository, version, and what AKA adds — inside a Markdown code fence that is part of that pasted content. Keep the fence as printed and do **not** add another code fence, strip the fence, or reformat it (unfenced, Markdown collapses the indentation and mangles the `●` lines).

node "${PLUGIN_ROOT}/scripts/intro.js" "${PLUGIN_ROOT}/.antigravity-plugin/plugin.json"

0b. Repo-aware posture check — tighten-only, working-tree only

Before showing any recommended posture — the start-light default table in step 2 or the calibrated posture in step 4 — look at the **current project's** working tree yourself, with your own file-reading tools. There is no script for this: it is your own reasoning over facts you read directly, not the triage subprocess's raw-free plan, and it needs no user interaction.

**In scope:** the manifest's declared frameworks/dependencies (`package.json` or equivalent), payment or other third-party API SDKs among them, CI config (`.github/workflows/`, etc.), and the **presence and names** of `.env*`/config files as a signal that secrets live on disk here — never their contents; a secret-bearing file's contents are exactly the kind of raw value this wizard never reads. **Out of scope:** Antigravity's own history and the local AKA store (that is the separate, consent-gated scan in steps 1/3) — no historical read, and no question or other consent interaction of any kind.

The severity-floor default map (secret/pii/financial/phi/code_flaw/custom at `warn`, code_context/config at `monitor` — the table step 2's start-light card prints) is