GeezerVison

&& apt-get clean \

&& rm -rf /var/lib/apt/lists/**

# Install the Gemini CLI CLI: the agent shells out to `gemini` on every turn,

# Install the Gemini CLI: the agent shells out to `gemini` on every turn,

# so the binary must be present in the runtime image.

RUN npm install -g @google/gemini-cli

COPY {{ project_path_from_build_root }}/pyproject.toml ./

# Install dependencies (without project itself, for layer caching)

# Optional private index for Scale-internal packages such as sgp-obs, injected by the

# control-plane broker. Inert unless the secret is present, so local

# builds, CI builds, and agents that never opt in are unaffected.

#

# To opt in, and for why UV_INDEX is pinned to the broker's URL rather than trusting

# the project's, see PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.

RUN --mount=type=cache,target=/root/.cache/uv \

--mount=type=secret,id=codeartifact-pip-conf,required=false \

if [ -s /run/secrets/codeartifact-pip-conf ]; then \

export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \

export UV_INDEX_SCALE_PYPI_USERNAME=aws; \

export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \

| python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \

fi; \

uv sync --no-install-project --no-dev

# Copy the project code

COPY {{ project_path_from_build_root }}/project ./project

# Install the project

RUN --mount=type=cache,target=/root/.cache/uv \

--mount=type=secret,id=codeartifact-pip-conf,required=false \

if [ -s /run/secrets/codeartifact-pip-conf ]; then \

export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \

export UV_INDEX_SCALE_PYPI_USERNAME=aws; \

export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \

| python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \

fi; \

uv sync --no-dev

ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"

&& apt-get clean \

&& rm -rf /var/lib/apt/lists/*

# Install the Gemini CLI CLI: the agent shells out to `gemini` on every turn,

# Install the Gemini CLI: the agent shells out to `gemini` on every turn,

# so the binary must be present in the runtime image.

RUN npm install -g @google/gemini-cli

WORKDIR /app/{{ project_path_from_build_root }}

# Optional private index for Scale-internal packages such as sgp-obs, injected by the

# control-plane broker. Inert unless the secret is present.

#

# This variant installs from requirements.txt, so there is no pyproject.toml for uv to

# read a named index out of; the credentialed URL is used directly and is deliberately

# NOT decoded. See PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.

#

# Install the required Python packages

RUN uv pip install --system -r requirements.txt

RUN --mount=type=secret,id=codeartifact-pip-conf,required=false \

if [ -s /run/secrets/codeartifact-pip-conf ]; then \

export UV_DEFAULT_INDEX="$(sed -n 's#^[[:space:]]*index-url[[:space:]]*=[[:space:]]*##p' /run/secrets/codeartifact-pip-conf | head -1)"; \

fi; \

uv pip install --system -r requirements.txt

# Copy the project code

COPY {{ project_path_from_build_root }}/project /app/{{ project_path_from_build_root }}/project

# {{ agent_name }} - AgentEx Async Gemini CLI Agent

This template builds an **asynchronous** (non-Temporal) agent that drives the

**Gemini CLI CLI** through the unified harness surface on AgentEx:

**Gemini CLI** through the unified harness surface on AgentEx:

- Spawns `gemini -p "<prompt>" --output-format stream-json` as a local subprocess

- Wraps the CLI's stdout stream in a `GeminiCliTurn`

- Delivers canonical `StreamTaskMessage*` events via `UnifiedEmitter.auto_send_turn`

### Async ACP with the harness

The async ACP model streams events over Redis instead of an HTTP response. The

`@acp.on_task_event_send` handler spawns the Gemini CLI CLI and pushes the

`@acp.on_task_event_send` handler spawns the Gemini CLI and pushes the

harness events to the task stream.

### The unified harness surface

# Maps Kubernetes secrets to environment variables

# Common credentials include:

credentials:

# The Gemini CLI CLI authenticates with GEMINI_API_KEY (LITELLM_API_KEY

# The Gemini CLI authenticates with GEMINI_API_KEY (LITELLM_API_KEY

# is not read by the `gemini` subprocess this agent spawns).

- env_var_name: GEMINI_API_KEY

secret_name: gemini-api-key

logger = make_logger(__name__)

STDOUT_LINE_LIMIT = 8 * 1024 * 1024

TERMINATE_TIMEOUT_SECONDS = 5.0

add_tracing_processor_config(

SGPTracingProcessorConfig(

sgp_api_key=os.environ.get("SGP_API_KEY", ""),

Injectable seam: tests can monkeypatch this with a fake async iterator of

pre-recorded lines so no real CLI invocation is needed offline.

Lines up to ``STDOUT_LINE_LIMIT`` are read whole: a ``tool_result`` that

echoes a file is a single stream-json line, often past asyncio's 64 KiB

default. If the consumer stops early, the CLI gets SIGTERM and, after

``TERMINATE_TIMEOUT_SECONDS``, SIGKILL, so cancellation cannot hang.

"""

# The prompt goes in via ``-p`` (argv). Stdin is closed on purpose: in

# non-interactive mode the CLI reads stdin to EOF and appends it to the

stdin=asyncio.subprocess.DEVNULL,

stdout=asyncio.subprocess.PIPE,

stderr=asyncio.subprocess.PIPE,

limit=STDOUT_LINE_LIMIT,

)

assert proc.stdout is not None

proc.terminate()

except ProcessLookupError:

pass

await proc.wait()

try:

await asyncio.wait_for(proc.wait(), timeout=TERMINATE_TIMEOUT_SECONDS)

except TimeoutError:

try:

proc.kill()

except ProcessLookupError:

pass

await proc.wait()

@acp.on_task_create

&& apt-get clean \

&& rm -rf /var/lib/apt/lists/**

# Install the Gemini CLI CLI: the agent shells out to `gemini` on every turn,

# Install the Gemini CLI: the agent shells out to `gemini` on every turn,

# so the binary must be present in the runtime image.

RUN npm install -g @google/gemini-cli

COPY {{ project_path_from_build_root }}/pyproject.toml ./

# Install dependencies (without project itself, for layer caching)

# Optional private index for Scale-internal packages such as sgp-obs, injected by the

# control-plane broker. Inert unless the secret is present, so local

# builds, CI builds, and agents that never opt in are unaffected.

#

# To opt in, and for why UV_INDEX is pinned to the broker's URL rather than trusting

# the project's, see PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.

RUN --mount=type=cache,target=/root/.cache/uv \

--mount=type=secret,id=codeartifact-pip-conf,required=false \

if [ -s /run/secrets/codeartifact-pip-conf ]; then \

export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \

export UV_INDEX_SCALE_PYPI_USERNAME=aws; \

export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \

| python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \

fi; \

uv sync --no-install-project --no-dev

# Copy the project code

COPY {{ project_path_from_build_root }}/project ./project

# Install the project

RUN --mount=type=cache,target=/root/.cache/uv \

--mount=type=secret,id=codeartifact-pip-conf,required=false \

if [ -s /run/secrets/codeartifact-pip-conf ]; then \

export UV_INDEX="scale-pypi=$(sed -n 's#.*index-url = https://aws:[^@]*@\(.*\)#https://\1#p' /run/secrets/codeartifact-pip-conf | head -1)"; \

export UV_INDEX_SCALE_PYPI_USERNAME=aws; \

export UV_INDEX_SCALE_PYPI_PASSWORD="$(sed -n 's#.*index-url = https://aws:\([^@]*\)@.*#\1#p' /run/secrets/codeartifact-pip-conf \

| python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))')"; \

fi; \

uv sync --no-dev

ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"

&& apt-get clean \

&& rm -rf /var/lib/apt/lists/*

# Install the Gemini CLI CLI: the agent shells out to `gemini` on every turn,

# Install the Gemini CLI: the agent shells out to `gemini` on every turn,

# so the binary must be present in the runtime image.

RUN npm install -g @google/gemini-cli

WORKDIR /app/{{ project_path_from_build_root }}

# Optional private index for Scale-internal packages such as sgp-obs, injected by the

# control-plane broker. Inert unless the secret is present.

#

# This variant installs from requirements.txt, so there is no pyproject.toml for uv to

# read a named index out of; the credentialed URL is used directly and is deliberately

# NOT decoded. See PRIVATE_INDEX.md in the agentex-sdk CLI templates directory.

#

# Install the required Python packages

RUN uv pip install --system -r requirements.txt

RUN --mount=type=secret,id=codeartifact-pip-conf,required=false \

if [ -s /run/secrets/codeartifact-pip-conf ]; then \

export UV_DEFAULT_INDEX="$(sed -n 's#^[[:space:]]*index-url[[:space:]]*=[[:space:]]*##p' /run/secrets/codeartifact-pip-conf | head -1)"; \

fi; \

uv pip install --system -r requirements.txt

# Copy the project code

COPY {{ project_path_from_build_root }}/project /app/{{ project_path_from_build_root }}/project

# {{ agent_name }} - AgentEx Sync Gemini CLI Agent

This template builds a **synchronous** agent that drives the **Gemini CLI CLI**

This template builds a **synchronous** agent that drives the **Gemini CLI**

through the unified harness surface on AgentEx:

- Spawns `gemini -p "<prompt>" --output-format stream-json` as a local subprocess

- Wraps the CLI's stdout stream in a `GeminiCliTurn`

### Sync ACP with the harness

The sync ACP model uses HTTP request/response. The `@acp.on_message_send`

handler spawns the Gemini CLI CLI and yields the harness events back to the

handler spawns the Gemini CLI and yields the harness events back to the

client as they arrive.

### The unified harness surface

# Maps Kubernetes secrets to environment variables

# Common credentials include:

credentials:

# The Gemini CLI CLI authenticates with GEMINI_API_KEY (LITELLM_API_KEY

# The Gemini CLI authenticates with GEMINI_API_KEY (LITELLM_API_KEY

# is not read by the `gemini` subprocess this agent spawns).

- env_var_name: GEMINI_API_KEY

secret_name: gemini-api-key

logger = make_logger(__name__)

STDOUT_LINE_LIMIT = 8 * 1024 * 1024

TERMINATE_TIMEOUT_SECONDS = 5.0

add_tracing_processor_config(

SGPTracingProcessorConfig(

sgp_api_key=os.environ.get("SGP_API_KEY", ""),

This is a seam: tests can replace it with a fake async iterator of

pre-recorded lines so no real CLI invocation is needed offline.

Lines up to ``STDOUT_LINE_LIMIT`` are read whole: a ``tool_result`` that

echoes a file is a single stream-json line, often past asyncio's 64 KiB

default. If the consumer stops early, the CLI gets SIGTERM and, after

``TERMINATE_TIMEOUT_SECONDS``, SIGKILL, so cancellation cannot hang.

"""

# The prompt goes in via ``-p`` (argv). Stdin is closed on purpose: in

# non-interactive mode the CLI reads stdin to EOF and appends it to the

stdin=asyncio.subprocess.DEVNULL,

stdout=asyncio.subprocess.PIPE,

stderr=asyncio.subprocess.PIPE,

limit=STDOUT_LINE_LIMIT,

)

assert proc.stdout is not None

proc.terminate()

except ProcessLookupError:

pass

await proc.wait()

try:

await asyncio.wait_for(proc.wait(), timeout=TERMINATE_TIMEOUT_SECONDS)

except TimeoutError:

try:

proc.kill()

except ProcessLookupError:

pass

await proc.wait()

@acp.on_message_send