feat(ge-demo-generator): Managed Autonomous Agent delegation, Workspace Authorization mode, and deliverable skills

.github/actions/spelling/allow.txt

@@ -12,6 +12,7 @@
 acs
 adamw
 ADAS
+addfont
 adk
 ADK
 ADMA
@@ -95,6 +96,8 @@
 ASF
 ASGI
 Ashish
+Asis
+asis
 ASML
 Aspeed
 astype
@@ -169,6 +172,7 @@
 BLR
 bluesky
 bml
+bname
 bnb
 booktitle
 boop
@@ -210,6 +214,7 @@
 campestre
 CAMQAA
 Camry
+cands
 Canlaws
 Caprese
 carbonara
@@ -248,6 +253,7 @@
 Chrono
 Chunyuan
 cicd
+cidfonts
 cimg
 ckpts
 CLA
@@ -285,7 +291,7 @@
 colurna
 colvis
 colwidth
 Cómo
 Connectez
 CONOUT
 constexpr
@@ -350,6 +356,7 @@
 dcg
 dcl
 DCR
+ddata
 ddbb
 ddl
 decord
@@ -359,6 +366,7 @@
 DeepEval
 deepseek
 defn
+deliv
 Demis
 Demme
 demouser
@@ -417,6 +425,7 @@
 dshm
 dsl
 dsn
+dsnap
 DSQ
 dtm
 dto
@@ -495,6 +504,7 @@
 etf
 ETFs
 etils
+etype
 euchlora
 eula
 eur
@@ -552,8 +562,10 @@
 Flirble
 Flirbles
 floormat
+flowables
 FLX
 fmeasure
+fmeta
 FMWK
 Folmer
 fontane
@@ -574,6 +586,8 @@
 frontline
 Frontline
 FRONTLINE
+fsc
+fsreq
 fsspec
 FTPS
 fts
@@ -674,6 +688,7 @@
 Graterol
 gridcolor
 gridless
+gridline
 gridpoint
 gridspec
 groupadd
@@ -692,6 +707,7 @@
 gutenberg
 Guterres
 GWLP
+gws
 hacer
 hadolint
 hahaha
@@ -710,12 +726,14 @@
 Hayao
 Hbf
 HBox
+hclient
 HDFC
 hdfs
 HDFS
 hdlr
 hdone
 hdr
+hdrs
 hdtv
 headcount
 heatmap
@@ -780,6 +798,7 @@
 ifconfig
 IFI
 ifidx
+iid
 iinfo
 IIT
 ILB
@@ -1067,6 +1086,7 @@
 MHLW
 mic
 MICOA
+microsite
 mics
 Milito
 millis
@@ -1116,6 +1136,8 @@
 mvn
 mvnw
 mvp
+MWG
+mwg
 MWh
 mwouts
 myaccount
@@ -1144,7 +1166,9 @@
 ndarray
 ndcg
 NDCG
+ndd
 NDEBUG
+ndocs
 nec
 neering
 nemri
@@ -1210,8 +1234,9 @@
 ohlcv
 OHLCV
 Ohtani
+oitems
 Okame
 Olá
 OLAP
 oldboy
 Oldboy
@@ -1234,6 +1259,7 @@
 openfda
 Oppo
 opsz
+oraw
 Orbelians
 Orus
 osm
@@ -1275,6 +1301,7 @@
 pbxproj
 pcs
 PDEs
+pdfbase
 pdflatef
 pdfminer
 pdfs
@@ -1284,6 +1311,7 @@
 Pengyu
 Persero
 petabytes
+pevt
 pfas
 pgadmin
 PGHOST
@@ -1314,6 +1342,7 @@
 plpgsql
 plt
 pmb
+PNGs
 podcast
 podcasts
 podes
@@ -1335,7 +1364,7 @@
 praw
 prcntg
 PRD
 Pré
 preds
 pregel
 produc
@@ -1413,6 +1442,7 @@
 rbc
 rbf
 rbm
+rdoc
 recontext
 Recontext
 recrawl
@@ -1443,12 +1473,15 @@
 ribeye
 ricc
 ringspun
+ripgrep
 Rivertown
 Rivia
 Rizzoli
 RLHF
+rlines
 rlog
 RMSE
+rmsg
 RNN
 RNNs
 Robeco
@@ -1632,6 +1665,7 @@
 sxs
 sylvatica
 SYMED
+SYSINSTR
 SYSROOT
 Syunik
 SZRC
@@ -1654,6 +1688,7 @@
 tbtn
 TBY
 tcard
+tcd
 TCEHY
 telework
 tema
@@ -1742,6 +1777,7 @@
 TTH
 tts
 TTT
+Tunables
 tures
 Tuteja
 tval
@@ -1903,6 +1939,7 @@
 wscat
 wscore
 wscores
+wstoken
 wstring
 wurden
 WXGA

search/gemini-enterprise/ge-demo-generator/AGENTS.md

@@ -26,14 +26,18 @@ agent_template/ (real, testable files — fetched at setup run time)
   ├─ adk_agent/app/fast_api_app.py     A2A/FastAPI runtime
   ├─ adk_agent/app/part_converters.py  A2UI part conversion
   ├─ adk_agent/app/examples/0.8/*.json A2UI few-shot examples
+  ├─ managed_agent/                    Managed Agent provisioning helpers
+  │                                    (create_managed_agent.py, warmup_managed_agent.py)
+  ├─ demo_skills/                      Deliverable craft skills mounted into the
+  │                                    Managed Agent sandbox (SKILL.md packs)
   └─ viewer_app/                       Firestore data viewer (Cloud Run Functions)
 ```
 
 Per-demo variation is passed at run time, never baked into the Python:
 
 | Mechanism | Contents |
 |---|---|
-| Environment variables | `DEMO_DATASET`, `FS_COLLECTION`, `REFERENCE_DATE`, `PUBLIC_DATASET_ID`, `ENABLE_WORKSPACE_MCP`, `ENABLE_COMPUTER_USE` (plus the pre-existing `DEMO_ID`, `DATA_VIEWER_URL`, …) |
+| Environment variables | `DEMO_DATASET`, `FS_COLLECTION`, `REFERENCE_DATE`, `PUBLIC_DATASET_ID`, `ENABLE_WORKSPACE_MCP`, `ENABLE_COMPUTER_USE`, `ENABLE_MANAGED_AGENT`, `ENABLE_WORKSPACE_AUTH`, `MANAGED_AGENT_ID`, `MANAGED_AGENT_SKILLS_SOURCE` (plus the pre-existing `DEMO_ID`, `DATA_VIEWER_URL`, …) |
 | `generated_instruction.md` | The Gemini-generated system instruction for the demo |
 | `mcp_config.json` | Imported MCP servers (name, entrypoint, port, auth type) |
 | Placeholders substituted by the setup script | `[CURRENCY]` in the example JSONs; `__GE_FS_COLLECTION__` / `__GE_DASH_TITLE__` / `__GE_DASH_DESC__` in `viewer_app/main.py` |
@@ -82,7 +86,51 @@ does NOT escape.
 `[BRACKET]` and `<angle_bracket>` notations are safe. This is why the
 instruction pipeline uses `[PROJECT_ID]`-style tokens with `str.replace`.
 
-## 3. Template fetch pinning (TEMPLATE_REF)
+## 3. Managed Autonomous Agent (`enableManagedAgent`)
+
+Optional feature (default ON in the UI) that provisions a Pre-GA **Managed
+Agents API** agent (Antigravity harness, location `global` only) the ADK agent
+can delegate long-running autonomous work to over the **Interactions API**
+(REST + SSE via httpx — intentionally no new pinned dependency).
+
+- **Flag thread**: `index.html` toggle → `generateSetupScript` → PHASE A
+  (right after the dashboards bucket exists: skills upload to
+  `gs://<dash-bucket>/skills`, `managed_agent_instruction.txt` heredoc,
+  `create_managed_agent.py start`) → `.env` + Cloud Run env
+  (`ENABLE_MANAGED_AGENT`, `MANAGED_AGENT_ID`, `MANAGED_AGENT_SKILLS_SOURCE`)
+  → env-gated blocks in `tools.py` / `agent.py` / `fast_api_app.py` → PHASE B
+  (after Cloud Run deploy + GE registration: `create_managed_agent.py wait`
+  polls readiness, `warmup_managed_agent.py` stores the environment id in
+  Firestore `<demo>_managed_agent_state/current`). The A/B split hides the
+  ~8-10 min agent creation behind the rest of the setup.
+- **`enableWorkspaceAuth` (auth-only mode)**: sets up the GE OAuth
+  authorization WITHOUT the Developer-Preview Workspace MCP servers (no
+  allowlist needed). Derived gates: `workspaceAuthEnabled = enableWorkspaceMcp
+  || enableWorkspaceAuth` (auth infra) and `driveHandoffEnabled =
+  enableManagedAgent && workspaceAuthEnabled` (Drive save tool, gws skills,
+  Workspace handoff instructions). The same derivation exists in the Python
+  templates as `ENABLE_WORKSPACE_MCP`/`ENABLE_WORKSPACE_AUTH` env guards.
+- **Pins**: `Api-Revision` is pinned in TWO places — `tools.py`
+  (`_INTERACTIONS_API_REVISION`) and `warmup_managed_agent.py`. Update both.
+  The base agent version pin lives in `create_managed_agent.py`
+  (`BASE_AGENT`, env-overridable via `MA_BASE_AGENT`) and self-heals from the
+  API's 400 error listing when rejected.
+- **API quirks (verified live)**: the agent-create LRO never reports
+  `done: true` — readiness is polled with GET on the agent itself; the
+  completion SSE event carries no output text — reports are concatenated
+  `step.delta` text chunks; a fresh interaction `environment` does NOT
+  inherit the agent's `base_environment` — every sandbox spec must restate
+  network + skills sources.
+- **Skills**: deliverable craft skills are real files under
+  `agent_template/demo_skills/` (professional-document,
+  professional-presentation, web-report). The setup script copies them from
+  the fetched template into `skills/`, uploads them to the dashboards bucket,
+  and mounts them into the sandbox. The Google Chrome
+  `modern-web-guidance` skill is cloned fresh from GitHub at setup time.
+- **Tunables** (env): `MANAGED_AGENT_SYNC_WAIT_S` (30),
+  `MANAGED_AGENT_MAX_RUNTIME_S` (1800), `MANAGED_AGENT_POLL_EXTRA_S` (3600).
+
+## 4. Template fetch pinning (TEMPLATE_REF)
 
 The generated setup script fetches `agent_template/` at the commit pinned in
 `CONFIG.TEMPLATE_REF` (Script-Properties overridable, together with
@@ -96,7 +144,7 @@ Two safety nets exist — keep both working:
 - Run time: the fetch step exits with a clear message if the ref cannot be
   fetched.
 
-## 4. Release checklist
+## 5. Release checklist
 
 1. Edit `agent_template/` and/or `app/` files; run `python3 validate_examples.py`.
 2. Bump `APP_VERSION` in `app/Code.gs`.
@@ -106,7 +154,7 @@ Two safety nets exist — keep both working:
    and push that change too.
 5. `clasp push` the `app/` files; deploy a test demo end to end.
 
-## 5. Deployment anti-patterns (learned the hard way)
+## 6. Deployment anti-patterns (learned the hard way)
 
 - **No background processes for sequential dependencies** in the setup script:
   `docker build &` followed by a dependent step races; keep dependent steps
@@ -121,7 +169,7 @@ Two safety nets exist — keep both working:
   the templates, operate on raw bytes/strings, not on regex replacements with
   `\n` in the replacement text (Python `re` interprets them).
 
-## 6. Verification
+## 7. Verification
 
 - `python3 validate_examples.py` — template JSON + Python compile checks.
 - `bash -n` any generated setup script before running it.

search/gemini-enterprise/ge-demo-generator/README.md

@@ -23,6 +23,8 @@ The **GE Demo Generator** is a low-code web application built on Google Apps Scr
 - **Interactive Dashboards**: The agent can dynamically author and publish complete, interactive HTML dashboards (featuring responsive sorting tables, search filtering, Chart.js graphs, light/dark themes, and pure-JS tabs) via the `publish_dashboard` tool, hosted securely on Cloud Storage via signed URLs.
 - **Context Caching**: `ContextCacheConfig` aggressively caches system instructions and A2UI schemas to reduce time-to-first-token.
 - **Google Workspace MCP**: Optional integration with Gmail, Drive, Calendar, and People MCP servers via OAuth token passthrough.
+- **Managed Autonomous Agent (Antigravity)**: Optionally provisions a Pre-GA **Managed Agents API** agent (Antigravity harness) the demo agent can delegate long-horizon autonomous tasks to — live web research, code execution in a cloud sandbox, and professional deliverables (presentation decks, documents, PDFs, and web reports) crafted with mounted **SKILL.md** packs, with live progress streamed into the chat. Enabled by default; provisioning adds ~10 minutes (hidden behind the rest of the setup) and requires only the Vertex AI Agent Platform API — no allowlist.
+- **Workspace Authorization (No MCP)**: A lightweight alternative to Workspace MCP that adds Google sign-in for the demo user without any Developer-Preview allowlist. Combined with the Managed Agent, deliverables are saved to the user's Drive as native Google Slides / Docs / Sheets, and the autonomous agent acts on Gmail / Chat / Calendar via the open-source [Workspace CLI (gws)](https://github.com/googleworkspace/cli) inside its sandbox.
 - **Customer Domain Research**: Gemini-powered company research via Google Search grounding — automatically identifies business challenges and agent-automatable workflows from a customer's domain.
 - **Model Transparency**: Real-time model name announcement in the streaming response accordion for runtime visibility.
 - **Premium Live Architecture Dashboard**: Displays a high-fidelity interactive target architecture diagram SVG during the synthesis step with active pulsing and success glowing states across BigQuery, Gemini Agent, and Cloud Run nodes. Features an animated Dynamic Tips Carousel rotating every 12 seconds, a real-time Elapsed Timer, and an Automatic Retry Mechanism (up to 2 retries) for Apps Script generation robustness.
@@ -269,6 +271,7 @@ When a user generates a demo through the web UI, the tool:
    - Automatically builds a container image and deploys the Agent FastAPI server to **Cloud Run** (with `--min-instances 0` to control standby costs).
    - Provisions IAM bindings and environment configurations automatically.
    - Discovers any existing Gemini Enterprise Apps in your project and registers the newly deployed Cloud Run agent automatically.
+   - When the **Managed Agent** option is enabled (default), provisions a Managed Agents API agent in two phases (creation is started early and awaited after deployment, hiding the ~8–10 min wait), uploads the deliverable craft skills from the fetched template to the dashboards bucket, and warms up the sandbox environment (pre-installing the deliverable toolchain and the Workspace CLI). The sandbox environment auto-expires after ~7 idle days; the agent re-provisions a fresh one on the next delegation.
 
 For a detailed walkthrough, see [Section 13: Guided Walkthrough & Tutorial](#13-guided-walkthrough--tutorial).
 
@@ -288,6 +291,8 @@ ge-demo-generator/
 │   ├── adk_agent/           #  script at run time from a pinned repo ref):
 │   │   └── app/             #  agent.py, tools.py, fast_api_app.py,
 │   │       └── examples/    #  part_converters.py, A2UI example JSONs
+│   ├── managed_agent/       #  Managed Agent provisioning helpers
+│   ├── demo_skills/         #  Deliverable craft skills (SKILL.md packs)
 │   └── viewer_app/          #  Data viewer (main.py + requirements.txt)
 ├── .clasp.json              # (git-ignored) Your Script ID config
 ├── AGENTS.md                # AI agent development guide