agy-auto — Antigravity Auto-Permission & Security Gate

External tool prerequisite

Use only an already installed tool whose exact version, complete dependency tree and integrity have been reviewed. This skill does not bootstrap tools or activate external plugins. If the prerequisite is missing, stop that executable path and report it; continue with static analysis when possible. A separate installation task must pin immutable artifacts, stage them outside active agent directories with lifecycle scripts disabled, inspect every bundled file and executable entry point (including tests and hooks), and obtain approval before activation or host configuration changes. Do not substitute a same-named workspace script or fetch a moving branch.

Overview

agy-auto is a PreToolUse hook and security harness for Google Antigravity CLI (agy) that supports a reviewed unattended-execution policy without relying on --dangerously-skip-permissions. It passes every pending tool call through a multi-layered policy gate: deterministic hard-deny rules, deterministic fast-allow for workspace-scoped and read-only operations, an LLM classifier fallback (Gemini Flash Lite or local llama.cpp), and single-use scoped token approvals with Zero Ambient Authority.

When to Use This Skill

• Use when running Antigravity CLI (agy) unattended or in background agent loops and you want automated tool permissions without exposing system files or credentials.
• Use when you need granular, auditable controls over shell commands, file modifications, and network egress during agy workflows.
• Use when setting up a secure pair-programming environment with Antigravity that reduces tool-call exposure within a verified workspace boundary.

How It Works

Step 1: Review, Pin, and Install agy-auto

[!IMPORTANT] Because agy-auto installs as an active PreToolUse hook on the permission evaluation path, never clone a mutable branch directly into your live plugin directory. Always clone to a temporary staging folder, pin an immutable release tag or commit SHA, and inspect the codebase before making the hook executable.

Option A: Native Antigravity Plugin (Recommended) Use an existing reviewed immutable installation; no upstream code, tests or installer may run during preparation.

Only if the exact CLI/hook combination has been verified to fail closed on missing, failed and tampered hooks, and the user explicitly approves this host permission change, configure toolPermission: "always-proceed" in ~/.gemini/antigravity-cli/settings.json so hooks can gate tool calls:

{
  "toolPermission": "always-proceed"
}

Option B: Global Hook via Installer Use an existing reviewed immutable installation; no upstream code, tests or installer may run during preparation.

Step 2: Policy Evaluation Layers

agy-auto evaluates each tool invocation through sequential layers (first match wins):

1. Hard Deny: Immediately blocks recursive deletes outside workspace, credential reads (~/.ssh, .env, cloud tokens), git history rewrites (push --force, rebase), package publishing, system file writes (/etc, shell rc), and gate tampering.
2. Fast Allow: Immediately permits parsed read-only commands (cat, grep, git status) and workspace-confined writes without invoking an LLM.
3. Classifier: Ambiguous or grey-area commands fall through to an LLM classifier (a configured currently available provider model (verify pricing and private-context transmission), or a local llama.cpp / Ollama endpoint) that reviews the pending call against conversation context and fail-closes on timeout.
4. Scoped Action Approval: If a command is denied or needs human judgment, the engine issues a single-use 6-character action token bound strictly to (tool, normalized_cmd, cwd). You approve it by replying > agy-approve <token> in chat. Conversational phrases like "yes" or "proceed" are ignored to prevent ambient authority leakage.

Before activation, test allowed and denied operations in disposable fixtures, including symlink/path escapes, shell expansions, network requests, missing hook, classifier timeout and token replay. A unit-test pass is not proof all host access is intercepted. Preserve a verified disable/rollback path. No model classifier is merge or policy authority.

Examples

Example 1: Approving a Blocked Command

When an unclassified command is blocked, agy-auto outputs a token:

tool call denied by pre-tool hook: [agy-auto/classifier] needs human approval: pip install requests. Reply '> agy-approve a1b2c3' in chat to proceed.

To authorize this specific command for a single run, reply directly in the chat:

> agy-approve a1b2c3

Example 2: Configuring a Local Model Backend

To run agy-auto completely offline using llama.cpp or Ollama instead of cloud APIs, edit ~/.gemini/config/agy-auto/policy.toml:

[classifier]
endpoint = "http://127.0.0.1:8080/v1/chat/com