v0.24.0

Workers

• Antigravity CLI worker (beta): -W antigravity[:model], Google's agy, with the user's Google account sign-in (which Gemini CLI now refuses). Checked against agy 1.3.5 on macOS: a read, a follow-up, an isolated edit and the deny rules were run against the real CLI, and the fixtures are its recorded output. agy has no read-only mode for headless runs (--mode plan is reported to still write), so its read runs read a read-only snapshot of their own, made right before its attempt: never the project, and never the snapshot other read runs share, where a stray file would outlive the run (a new readOnly: 'snapshot' capability). What git sees newly changed there afterwards is a READ-ONLY VIOLATION, and the worker after it in the chain reads where it was meant to, never that snapshot; as a fallback it costs nothing until it runs, pruning keeps these snapshots apart from the shared one, and a follow-up whose snapshot was pruned gets it made again; if the snapshot cannot be made it is skipped, never run in the project; --in-place, reviews and folders outside git warn instead, and doctor --probe runs it in an empty folder. Its answers are cached under where they were read. Write and isolate runs use --mode accept-edits; shell commands run in agy's terminal sandbox (--sandbox: the workspace writable, .git read-only, no network).
  • A home of its own per workspace. agy reads its settings only from ~/.gemini/antigravity-cli/settings.json (ANTIGRAVITY_APP_DATA_DIR is ignored), so a worker runs with HOME set to <pitroom home>/antigravity-home/<id>, one per workspace, so that a follow-up finds its conversation; the sign-in is linked in (the keychain folder on macOS, the token file elsewhere), and homes unused for two weeks are removed. Its settings grant sandboxed commands (command(*): without a grant a headless agy refuses every command and ends the turn without an answer), let agy write its plan into its own folder (plan mode does), keep file tools in the workspace, mount the toolchains of your PATH under your home read-only (an nvm node, so npm test works in the sandbox), and deny: the workspace's secret files and the secrets in your home by absolute path (read_file rules take no patterns, and a relative one breaks the sandbox), the forbidden commands, MCP tools and the web (--web does not apply to these workers).
  • Deny rules in agy's own matching: a rule is a command prefix compared word by word after agy has split the line at &&, ;, | and taken off wrappers such as env -i and timeout 60, and a regex: rule compares word by word too, with backslashes dropped. So each forbidden command is denied as it is, by path (/usr/bin/git), behind git's global options (git -c x=y commit, git --no-pager push), and any recursive rm (rm src -rf, rm -r -f); sh -c, eval, find with -exec, -ok or -delete (agy does not look inside it, so it is refused outright), and xargs running a forbidden command. A line with {} in it is not split, and is matched whole: rules for that find xargs, find, git <subcommand> and rm -r anywhere in it. They are patterns, a layer on top and not a guarantee: other spellings can get past them, so the git guard (and .git, read-only in the sandbox) holds for git, and the snapshot or the isolated copy holds for your files; use -i for changes, not -w.
  • Its stream as agy writes it: {"event": …} with the payload under the event's name (result.response, result.usage, init.model), tool steps that end in state ERROR when refused, and result.denied_actions. --continue resumes by conversation id; agy starts a new conversation for an id it does not know and says so only on stderr, which the run now shows as a warning. A run without an answer is a failure, never an empty answer: a refused command can end agy's turn with SUCCESS, no answer and exit 0. A used-up quota exits 3 with an AGY_ERROR line (rate-limited, so the chain moves on), an unknown model exits 1 (model-unavailable), a missing sign-in is auth. A prompt the model's safety filter blocks (This request was blocked by Gemini's filters…, status SUCCESS) is a failure, not the answer. agy is added to the "other agents" every worker is denied.
• A run's own snapshot no longer blames the worker for every file. A snapshot is a checkout without a commit, so git calls each of its files "added"; the check for what a worker wrote there counted them all, and every Antigravity read run came out a READ-ONLY VIOLATION (exit 5, answer not cached). Only what differs from the snapshot's index counts now.
• A worker can add warnings of its own to a finished run (Antigravity's lost conversation).
• One list of forbidden commands (src/backends/deny.ts) for Claude Code, Qwen Code and Antigravity, now with rm -r, rm -R and rm --recursive (OpenCode already denied them); a test keeps Gemini's rule file and OpenCode's profiles in step. Gemini's private home is now written atomically (retried, then written in place, while Windows holds the file open) and repairs a dangling sign-in link (a shared helper with Antigravity's).