fix(antigravity): normalize Gemini bridge payloads

[uwuclxdy]

Summary

• Fixes antigravity Gemini payload shaping for Claude-family bridge requests by emitting Gemini-compatible systemInstruction.role = "system", clamping maxOutputTokens through model capabilities, and keeping reasoning/thinking budgets in generationConfig.thinkingConfig instead of conflating them with output token limits.
• Normalizes Gemini-facing tool names to the allowed [a-zA-Z0-9_]+ shape, updates the antigravity decoy sequential-thinking tool name to avoid hyphenated identifiers, and preserves restore maps for original MCP/tool names through function calls and responses.
• Serializes antigravity request bodies from a cloned payload so fingerprinting and request shaping do not mutate the caller-owned body, which keeps retry/request reuse behavior safer.
• Includes two pre-push stability fixes uncovered while creating this PR: unsafe known CLI paths now stop fallback discovery instead of falling through to PATH, and the memory route test no longer relies on nondeterministic database ordering.

Related Issues

• Closes fix(antigravity): stabilize streaming and usage refresh #1748
• Related to fix(antigravity): stabilize streaming and usage refresh #1748

Validation

• npm run lint
• npm run test:unit
• npm run test:coverage
• Coverage is still >= 60% for statements, lines, functions, and branches
• SonarQube PR analysis is green or any remaining issues are explicitly documented below

Additional targeted validation run locally:

• node --import tsx/esm --test tests/unit/translator-openai-to-gemini.test.ts tests/unit/translator-claude-to-gemini.test.ts tests/unit/antigravity-tool-cloaking.test.ts tests/unit/cli-runtime-extended.test.ts
• node --import tsx/esm --test tests/unit/memory-route.test.ts

Notes:

• npm run lint exits successfully with existing repo-wide warnings only (0 errors, 1904 warnings).
• npm run test:unit passes locally (3863 pass, 0 fail).
• Coverage and SonarQube were not run locally for this branch.

Tests Added Or Updated

• tests/unit/translator-openai-to-gemini.test.ts
  • Adds antigravity Claude bridge coverage for system role, output-token clamping, thinking budget separation, regex-safe sanitized tool names, and restore-map preservation.
• tests/unit/translator-claude-to-gemini.test.ts
  • Updates direct Claude -> Gemini expectations for system roles and adds model-cap clamping coverage.
• tests/unit/antigravity-tool-cloaking.test.ts
  • Asserts antigravity decoy/custom tool names remain Gemini-safe after cloaking.
• tests/unit/memory-route.test.ts
  • Makes the filtered memory-key assertion order-insensitive to avoid flaky full-suite/pre-push runs.

Coverage Notes

• open-sse/translator/request/openai-to-gemini.ts is covered by the updated OpenAI -> Gemini and OpenAI -> Antigravity translator unit tests.
• open-sse/translator/request/claude-to-gemini.ts is covered by the updated Claude -> Gemini translator unit tests.
• open-sse/translator/helpers/geminiToolsSanitizer.ts and open-sse/config/toolCloaking.ts are covered by translator and antigravity tool-cloaking tests.
• open-sse/executors/antigravity.ts clone-safe serialization is covered indirectly by existing antigravity request paths; no standalone executor serialization test was added.
• src/shared/services/cliRuntime.ts is covered by tests/unit/cli-runtime-extended.test.ts, including the unsafe known-path and symlink-escape behavior that blocked pre-push.
• Coverage command was not run locally, so no coverage delta is reported here.

Reviewer Notes

• Main reviewer focus: verify the Gemini Cloud Code payload contract expectations for systemInstruction.role, maxOutputTokens, and thinkingConfig match current antigravity/Gemini behavior.
• Tool-name normalization intentionally replaces non-alphanumeric/underscore characters with _, collapses duplicate underscores, and continues to store restore maps so upstream/original tool names can be recovered.
• The CLI runtime change is a security-hardening/stability fix discovered by the full pre-push suite: once a known install path is present but unsafe, suspicious, escaping, or non-executable, detection stops instead of falling back to a different PATH binary.
• The memory-route test change is test-only and avoids assuming query result ordering when the route contract being tested is filtering/stats, not ordering.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request implements several updates to the Gemini translation logic, including changing the system instruction role to "system", adding token capping for output and thinking budgets, and refining tool name sanitization to ensure alphanumeric compatibility. It also fixes a typo in the sequential thinking tool name and updates the CLI command location logic to handle non-executable files. Feedback was provided regarding the potential for structuredClone to throw errors on non-cloneable objects and the risk of masking specific error states in the cliRuntime service by defaulting to a "not_found" reason.