# Antigravity CLI (agy) Configuration

Assistant-specific config for the Antigravity CLI — Google's successor to the
retired Gemini CLI (EOL 2026-06-18). Everything here is provisioned into the
home directory by `opt/scripts/system/install_antigravity_skills.sh`; shared
skills are linked separately by `sync-skills.sh`.

**Startup parity with Claude Code** (design: `docs/mbo/designs/agy-parity.md`):
agy is provisioned with the same startup contract as Claude — an opt-in launch
config (`agy-config`), a seeded settings baseline, the repo's deny/ask permission
policy re-applied on every install, merged hook wiring, and the repo's slash
commands + account memories delivered as a local agy plugin. Each file below has
a Claude twin under [`../claude/`](../claude/).

## Layout

| File | Purpose | Claude twin |
| ---- | ------- | ----------- |
| `aliases.sh` | `agy()` wrapper (tmux auto-anchor + sentinel-driven flag injection) and `agy-config status\|yolo on\|off\|doctor`. **Copied** to `~/.config/antigravity/aliases.sh`. YOLO sentinel: `~/.config/antigravity/yolo.enabled` (present = ON, default OFF, per machine). No remote-control sentinel — agy has no such flag. Test: `aliases_test.sh`. | `claude/aliases.sh` (`claude-config`) |
| `settings.json.template` | New-host baseline, seeded **once** into `~/.gemini/antigravity-cli/settings.json` when absent (`_comment` dropped): `toolPermission: request-review`, `editorMode: vim`, `colorScheme: terminal`, `notifications`, `enableTerminalSandbox: false`, `allowNonWorkspaceAccess: true`, the translated `command(...)` allow list. Host-owned afterwards; never add `trustedWorkspaces`. | `claude/settings.json.template` |
| `settings.forced.json` | Immutable subset deep-merged on **every** run by `apply-forced-settings.sh`: `statusLine` + `permissions.deny`/`ask` replaced, `permissions.allow` unioned, everything else preserved. Targets use agy's `action(target)` form (`command(rm -rf /)`, `command(sudo)`). | `claude/settings.forced.json` |
| `hooks.json.template` | The repo's `guards` named hook (one entry runs both shared guards through `ai/hooks/antigravity_adapter.sh`). Rendered with `__HOME__` substituted and **merged** into `~/.gemini/config/hooks.json` — other tools' named hooks (herdr's) survive; an unparseable host file is set aside as `.invalid`. | `hooks` block of `claude/settings.forced.json` |
| `scripts/sanity_check.sh` | Container/CI sanity check: PATH discovery, binaries, profile files, live hook wiring (via `ai/claude/scripts/validate_hooks.sh`), forced policy present, dotfiles plugin rendered. | `claude/scripts/sanity_check.sh` |
| _(rendered, not tracked)_ `~/.gemini/config/plugins/dotfiles/` | Local plugin generated by `opt/scripts/system/render-agy-plugin.sh` from `ai/claude/commands/*.md` (→ `commands/*.toml`) and the `scope: account` memories in `ai/claude/memory/` (→ `rules/AGENTS.md`); enabled in `~/.gemini/config/config.json`. Edit the Markdown, re-run the installer. | `~/.claude/commands` links + `provision-claude-memory.sh` |

## Where agy reads config (verified against agy 1.1.25)

- CLI settings: `~/.gemini/antigravity-cli/settings.json` — seeded from the template above,
  forced subset re-applied every run. Keys used: `toolPermission`, `permissions.{allow,deny,ask}`
  (`command(...)` is prefix-matched, precedence deny > ask > allow), `editorMode`, `colorScheme`,
  `notifications`, `enableTerminalSandbox`, `allowNonWorkspaceAccess`, `trustedWorkspaces`
  (host-local), `statusLine`.
- Global customization root: `~/.gemini/config/` — `skills/` (from sync-skills),
  `hooks/` + `hooks.json` (named hooks, merged), `plugins/<name>/` (`plugin.json`,
  `commands/*.toml`, `rules/AGENTS.md`), `config.json` (`plugins` enable map, `userSettings`),
  `mcp_config.json`.
- Workspace customization root: `.agents/` (`skills/`, `plugins/`, `rules/*.md`).
- Context files: `AGENTS.md` (this repo's convention) and legacy `GEMINI.md`.
- CLI flags that matter here: `--dangerously-skip-permissions` (injected by `agy-config yolo on`),
  `-p`/`--print`, `--mode accept-edits|plan`, `--sandbox`. No `--remote-control` equivalent.

## Safety model

The shared guards in [`../hooks/`](../hooks/) are the single rule set for both
assistants. For agy, `antigravity_adapter.sh` maps guard verdicts to hook
decisions: exit 0 → `allow` (auto-approve — mirrors the retired
trusted-tools.toml tier), exit 2 → `deny`, exit 3 → `ask` (confirmation tier:
power-state commands, force pushes). After the guards, a file tool whose target
is under `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.config/gss`, `~/.kube` or `~/.docker`
is answered `ask` — the PreToolUse stand-in for Claude's `DirectoryAdded`
`dir_added_guard.sh` (agy has no directory event). Misconfiguration degrades to
`ask`, never to silent allow. Test: `../hooks/antigravity_adapter_test.sh`.

The deny/ask lists in `settings.forced.json` are a second, agy-native layer under
the hook: a missing `hooks.json` degrades to the repo policy, not to agy's defaults.

## Launch config quick reference

```sh
agy-config              # yolo ON|OFF
agy-config yolo on      # every `agy` gets --dangerously-skip-permissions (this machine only)
agy-config yolo off
agy-config doctor       # which agy binary runs; warns if two are on PATH
```

`agy-yolo` was retired in favour of the sentinel (one canonical alias per workflow).