v3.0.1

• Restore loading of all nine native commands in agy.
• Fix smoke checks for current agy validation output.
• Verify the documented workflows with agy-cli 1.4.0.
• Shorten the README and release notes. Keep Linux CI on Ubuntu 24.04.

agy users: reinstall from a prepared copy. Follow the installation guide.

Changelog

3.0.0

Compatibility measurements now cover agy 1.3.1. The README explains the plugin in eight short points.

Breaking change

The default model for vision is now gemini-3.8-flash-high. Repeated probes showed capacity failures with the previous default. To keep it, pass --model gemini-3.6-flash-high.

This change was not announced in a prior 2.x minor release. The compatibility guide explains the exception and the measured difference in token use.

Security and reliability

• Image paths are checked before filesystem access.
• Updates verify the npm tarball's integrity, package name and version before installation.
• Host wrappers grant narrower command permissions and identify relayed output as untrusted.
• Google OAuth URLs are filtered from output, including nested JSON keys. Failure reasons use a bounded filter with documented limits.
• POSIX shared temporary state is checked on reads. Recorded process start times are compared before cancellation or cleanup signals. The one-second tolerance and the interval between checking and signalling remain documented limits.
• The updater leaves its installation directory before replacing the installed copy.
• Test cleanup handles temporary directory aliases on Windows and macOS.

The release includes fixes for all eight findings from the medium security scan. See CHANGELOG and COMPATIBILITY for details and limits.

v2.0.2

Patch release 2.0.2: task and rescue with --model and no --effort work on agy 1.2.11 (no --effort flag is sent), documentation measured to agy 1.2.11. Code by review, docs by review, whole-branch verification passed.

Fixed

• Model-only task and rescue runs work with agy 1.2.11. Plugin 2.0.1
  supplied its default --effort medium next to --model. agy reported
  --model gemini-3.1-pro-high conflicts with --effort=medium
  (probe-task-pro-default-effort.txt) or --effort is not supported for model "claude-sonnet-4-6" (probe-task-claude-default-effort.txt). Model-only
  foreground and background runs failed (probe-rescue-pro-default-effort.txt,
  probe-task-background-pro-default-effort.txt). These runs pass on 2.0.2
  with exit 0 (probe-fixed-task-pro.txt, probe-fixed-task-claude.txt,
  probe-fixed-rescue-pro.txt, probe-fixed-task-background-pro.txt). With
  --model and no explicit --effort, the plugin now sends no --effort flag
  and stores request.effort as agy-default (scripts/lib/job-helpers.mjs,
  resolveRequestEffort; tests/passthrough-argv.test.mjs, task --foreground --model with no --effort sends --model and no --effort flag, rescue --model with no --effort sends --model and no --effort flag, and task (background worker): --model with no --effort stores agy-default and reaches argv with no --effort flag). agy applies the level carried by a variant id
  such as gemini-3.1-pro-high, and rejects a base id that needs one
  (raw-base-gemini-3.1-pro-no-effort.txt). With
  neither flag, the default remains medium, unchanged since 2.0.0. This
  narrow change uses the documented upstream-break exception and marks the
  compatibility boundary.

Changed

• Tested agy range extends to 1.2.11. Live runs covered task, rescue,
  review, vision, status, result, and cancel
  (probe-task-foreground-json.txt, probe-rescue-json.txt,
  probe-review-json.txt, probe-vision-json.txt,
  probe-background-lifecycle.txt).
• The plugin still rejects --effort max. agy 1.2.11 accepts max as
  flag syntax, but no model on this account supports it
  (agy-help-1.2.11.txt, raw-effort-max-default-model.txt,
  raw-base-gemini-3.1-pro-effort-max.txt).

v2.0.1

Patch release 2.0.1: agy 1.2.7 currency and the AGY_ERROR marker. Code by review, docs by review, whole-branch verification passed.

Added

• AGY_ERROR: as a second errorMessage source. Per the agy 1.2.6
  changelog, a turn that ends on an agent or model API failure prints one
  AGY_ERROR: {...} line on stderr and exits 3 instead of 1
  (agy-changelog-1.2.7.txt). This shape and exit 3 are not yet measured
  live; raw-api-failure-bogus-key.txt did not provoke the failure. The
  plugin takes the line, sanitized and capped at 300 characters, when no
  error: line is present. error: wins when both are present, and a
  plugin-authored termination reason still takes priority. agy's exit
  status is stored as exitCode, never propagated. A failed foreground
  verb still exits 1.

Changed

• Tested agy range extends to 1.2.7. Live runs covered task, rescue,
  review, vision, status, result, and cancel
  (probe-task-foreground-json.txt, probe-task-effort-default.txt,
  probe-task-effort-agy-default.txt, probe-task-denied-url.txt,
  probe-rescue-json.txt, probe-review-json.txt, probe-vision-json.txt,
  probe-background-lifecycle.txt).
• update host instructions for agy explain the version boundary.
  The printed instruction now says that on agy before 1.1.28 a reinstall
  without the uninstall merged into the old copy. This explains the
  uninstall-then-install advice.

Fixed

• Print-timeout documentation states the 1.2.6 boundary. agy changed
  the default to unlimited and 0 now waits until the turn completes
  (agy-changelog-1.2.7.txt, agy-help-1.2.7.txt,
  raw-print-timeout-zero.txt). The plugin still forwards the job budget
  plus 60 seconds, or 24h for a 0 budget, as the agy-side backstop.
• Reinstall documentation states the 1.1.28 boundary. README and
  INSTALL now distinguish the old merge behaviour from exact replacement
  (agy-changelog-1.2.7.txt).
• Internal identifiers removed from the command and compatibility
  references. Public behaviour is unchanged.

antigravity-plugin 2.0.0

2.0.0 is a major release. task and rescue with no --effort flag now
send medium to agy. Through 1.3.0 they sent no flag, and agy used whatever
that machine had saved. Pass --effort agy-default if you want the plugin
to send no flag, so your own agy configuration decides. Pass --effort low,
medium, or high to send that value. medium runs longer than low, so
a flag-less job is more likely to reach the plugin execution budget and be
stored as failed with no answer. Raise ANTIGRAVITY_AGY_TIMEOUT_MS if you
need more time.

A SUCCESS run that returns an empty answer is now failed (exit 1 on the
foreground path). That includes a denial carried only in agy's JSON, and an
empty answer with no denial and no print-timeout marker. Through 1.3.0 those
runs were reported as completed with nothing in them. A non-empty answer
with a denial stays completed, and the denial is a warning.

The 2.x contract is in docs/COMPATIBILITY.md. The
full list is in CHANGELOG.md.

Also in this release

• Denied-action reporting now includes the target agy refused, joined by
  action name from the step_update error message.
• A denied run now reports agy's own conversation id, so a caller can resume
  the same conversation with --conversation <id> after doing the step
  themselves.
• The plugin no longer repeats agy's --dangerously-skip-permissions
  bypass advice on its own stderr. The stored result still keeps the
  complete upstream line.
• Print-timeout truncation and agy's error: fatal marker are reported
  instead of passing silently.
• The vision MCP view_image schema sets additionalProperties: false.
• The README How-it-works figure is an authored SVG, and the pack check
  requires that image in the tarball.
• The tested agy range is 1.1.15 to 1.2.1. Newest measured: 1.2.1.

antigravity-plugin 1.3.0

antigravity-plugin 1.3.0

Highlights

• Structured headless denial reporting from agy 1.1.27 denied_actions, with a computed remedy on --json, status, and result.
• --effort <low|medium|high> on task and rescue, forwarded to agy as --effort <value> with no plugin default.
• Every print-mode agy run forwards --print-timeout from the job budget plus 60 seconds, and forwards --disable-slash-commands.
• The CI matrix now includes macos-latest with Node 22.3.x and Node 24.
• Job state is keyed by the workspace realpath. An older logical-path leaf stays readable until the realpath leaf exists.

Changes

Added

• Structured denial reporting. Since agy 1.1.27, a headless run's denied_actions JSON list is parsed. The plugin validates each member, drops exact repeats, and caps the list at 32 members and 200 characters per string. It merges that list with the existing stderr sentinel. The JSON list wins when it is present. Older agy without the field still gets one denial from the stderr sentinel. Each member gets a computed remedy: --add-dir <dir> for read-type actions, --mode accept-edits for edit-type actions, or Headless runs cannot grant "<action>"; the host must run this step itself. for every other action. --json sets details.deniedActions on a completed foreground envelope and on result <id> --json. --json sets details.job.deniedActions on status <id> --json. Job lists carry deniedActionsCount. Markdown status <id> and result add a ## Denied Actions section. The status tables add a Denied column. A live 1.1.27 denial of read_url (displayName ReadUrlContent) printed Headless runs cannot grant "read_url"; the host must run this step itself. A failed foreground --json run still writes no stdout envelope. The fail-vs-warn decision and every exit code stay unchanged.
• --effort <low|medium|high> on task and rescue. Both verbs accept --effort. They forward it to agy as --effort <value>. This applies in the foreground and in the background. The flag sits right after --model, or in its place when there is no model. The plugin has no default. When the flag is absent, nothing is forwarded. Live 1.1.27 runs with --effort low and --effort high completed. The plugin does not probe what agy does with the value beyond forwarding it.

Changed

• CI matrix. macos-latest joins ubuntu-latest and windows-latest. The test matrix uses Node 22.3.x and Node 24. The lint gate still runs on the Node 24 jobs only. It now runs on all three operating systems. Release-tree CI run 34289858536 on commit 4f9b317 was green on all six cells.

Fixed

• Long runs no longer end at agy's 5-minute default. Every print-mode agy invocation (review, rescue, task, vision; foreground, background, plain, --continue, and --conversation) now forwards --print-timeout as the plugin execution budget plus 60 seconds of headroom (1860s for the 30-minute default). The plugin deadline fires first. agy's default --print-timeout 5m0s no longer ends the run early with status: ERROR / "timeout waiting for response". A 0 budget forwards a fixed 24h ceiling. agy treats a literal 0 as an immediate timeout.
• Vision allowlist on macOS. The vision MCP server refused every image on macOS. os.tmpdir() sits under /var, a symlink to /private/var, so the resolved path never matched the request's own logical spelling. vision now records the allowlist in its resolved (realpath) form. The server accepts a request whose own realpath is itself an authorized entry. The requested file's own final component being a symlink is still refused. The identity checks made while reading an image are unchanged.
• Workspace-root canonicalization. The job state directory is keyed off the realpath of the workspace root. A caller that holds a logical, symlinked spelling of the same directory (macOS os.tmpdir()) and a background worker whose process.cwd() is already the physical path therefore use the same leaf. An existing install's jobs, stored under the pre-085 logical-path leaf, stay reachable until that leaf is moved. A realpath leaf is preferred once it exists. The logical leaf is still read until then. A background job's worker receives the parent's exact workspace spelling. A job started through a logical spelling stays under the leaf it was created in.

Security

• Slash expansion disabled. Every print-mode agy invocation now forwards --disable-slash-commands. Prompt text that starts with /, including untrusted diff, review, rescue, or task content, reaches the model as plain text. It is not parsed as an agy slash command or skill. A live 1.1.27 task whose prompt began with /model completed with answer OK.

Compatibility

• Live coverage was measured on agy 1.1.27 on 2026-09-09 from commit 4f9b317. Transcripts: t5-live-*.txt. setup was not run live. review --json returned no_changes.
• Node.js >=22.3.0. CI cells use Node 22.3.x and Node 24.
• CI run 34289858536 covered Linux (ubuntu-latest / ubuntu-24.04), Windows (windows-latest / windows-2025-vs2026), and macOS (macos-latest / macos-26-arm64).
• Job state leaf: sanitized workspace basename plus a 12-character hash of the resolved (realpath) path. An older logical-path leaf stays in use until the realpath leaf exists. A background worker receives the caller's exact workspace spelling. A caller that switches spelling while only the older leaf exists starts a new leaf.
• Older live coverage remains: agy 1.1.15 and 1.1.17 (all eight verbs, 2026-08-21); agy 1.1.24 (rescue, task, vision, result, 2026-09-02).

Upgrade notes

Commands below match docs/INSTALL.md.

Claude Code

claude plugin marketplace add SouthCarpet/antigravity-plugin
claude plugin install antigravity@antigravity

Then /antigravity:setup if this host is new.

Codex CLI

If the antigravity marketplace is a local clone, pull that clone first. plugin add installs the version the clone holds.

codex plugin marketplace add <path-to-clone>
codex plugin add antigravity@antigravity

agy

A plain reinstall merges into ~/.gemini/config/plugins/antigravity/ instead of replacing it.

agy plugin uninstall antigravity
agy plugin install <path-to-clean-clone>

Standalone

npx @southcarpet/antigravity-plugin setup
npx @southcarpet/antigravity-plugin review

An unversioned npx @southcarpet/antigravity-plugin <command> resolves the latest published version.

Verification

Commit 4f9b317. CI run 34289858536 (created 2026-09-08 23:16:08), success. CodeQL run 34289858532, success.

Cell	Runner image	Conclusion	Tests	Pass	Fail	Skipped
Node 22.3.x / macos-latest	macos-26-arm64	success	886	873	0	13
Node 22.3.x / windows-latest	windows-2025-vs2026	success	886	881	0	5
Node 24 / windows-latest	windows-2025-vs2026	success	886	881	0	5
Node 24 / macos-latest	macos-26-arm64	success	886	873	0	13
Node 22.3.x / ubuntu-latest	ubuntu-24.04	success	886	873	0	13
Node 24 / ubuntu-latest	ubuntu-24.04	success	886	873	0	13

v1.2.0

antigravity-plugin v1.2.0

Version 1.2.0 keeps the frozen 1.x public contract. The eight verbs, flags, exit codes, JSON envelope, and state locations stay unchanged. New flags are additive only. This release ships with npm provenance.

Highlights

Added

• Retrievable result size. status reports stored answer byte and line counts, and result adds --head <n> and --tail <n>.
• Safer registry retries for the update check. update retries eligible failed registry requests within one total budget.
• --model on task and rescue. Both verbs accept --model <id> and forward it to agy.

Security

• Socket-flagged host bootstrap moved to a shipped module. Wrappers validate the plugin root and the shipped module before loading it.
• Vision image access. Vision checks file identity while it reads an image and keeps the 10 MiB limit when a file grows.
• Vision MCP request processing. Malformed requests do not stop the server, oversized input frames are rejected, and paused clients have bounded replies.
• Update command execution. Updates reject invalid registry and cache versions, reject unsafe Windows batch paths and arguments, and prefer native executables.

Fixed

• Live job retention. Queued and running jobs remain available when terminal history reaches its 50-job cap.
• Recoverable job state. State details are committed before index entries, corrupt indexes are rebuilt, and unreadable selected job files make result exit 1.
• Bounded agy runs. Jobs have a 30-minute default limit, support ANTIGRAVITY_AGY_TIMEOUT_MS, and fail with diagnostics for excess output.
• Interrupted foreground runs. Ctrl+C terminates agy and its child processes before the command exits.

Changed

• Unknown flags. Unknown flags exit 1 and direct prompt text to follow --.
• Cyclomatic complexity lint gate. npm run lint uses ESLint 10 with a complexity ceiling and runs in CI and the release workflow.

Upgrade

Claude Code

claude plugin marketplace update antigravity
claude plugin update antigravity@antigravity

Restart Claude Code.

Codex CLI

codex plugin remove antigravity@antigravity
codex plugin add antigravity@antigravity

Pull a local-clone marketplace first.

agy

agy plugin uninstall antigravity
agy plugin install <path-to-clean-clone>

A plain reinstall merges with the old copy.

One command

npx @southcarpet/antigravity-plugin update --apply

Requirements

• Node.js >= 22.3.0 at runtime.
• npm run lint needs a Node version eslint 10 supports: ^20.19.0 || ^22.13.0 || >=24.
• Tested agy versions are 1.1.15, 1.1.17, and 1.1.24. These versions form the tested matrix.

Full changelog

Read the full changelog.

Compare v1.1.3 to v1.2.0.

v1.1.3

Changed

• 1.1.2 republished as 1.1.3. The npm publish of 1.1.2 ran during an npm
  registry incident on 2026-09-03 and left no installable version, while npm
  still records the number as used. 1.1.3 ships the same content. The release
  runbook now checks the npm status page before a tag is pushed.

This release carries the full 1.1.2 change set, which never became installable on npm:

Added

• docs/ and CHANGELOG.md in the package. The npm tarball now ships the
  documentation the README links to. Before this, an installed copy had a
  README whose relative links pointed at files that were not there, and the
  Troubleshooting table could not be read offline. The pack check derives the
  required list from the README links, so a new documentation link tightens
  the gate by itself.
• A check for stale documentation. A bump now rewrites every
  Plugin <version> phrase in the README and in docs/, and
  bump-version --check fails when such a phrase names a version that is not
  the one in package.json. The pack check also fails when the README links
  a markdown file that is not in the package.

Changed

• update --apply refreshes the Claude Code marketplace. The plan runs
  claude plugin marketplace update antigravity before
  claude plugin update antigravity@antigravity. Without that step,
  plugin update reports the version you already have as the latest.
• update --apply reports a local Codex marketplace. The plan runs
  codex plugin marketplace list first. If the antigravity marketplace is a
  local clone, the command prints the path and tells you to pull that clone,
  because plugin add installs the version the clone holds. After the install
  it prints the installed version, and one more line when that version is not
  the latest. It never pulls or changes your clone.
• Socket badge. The badge now sits in the badge row at the top of the
  README and links to the Socket overview page. The image URL stays
  unversioned, so it needs no change per release.
• Update instructions. The README now says that Claude Code needs
  claude plugin marketplace update antigravity before plugin update, that
  Codex installs from the registered marketplace (pull a local clone first),
  and what update --apply does for each host. The commands reference gains
  an update section, and the installation guide gains a Troubleshooting row
  for a Codex reinstall of an old version. The README no longer states a test
  count, the Socket badge sits with the other badges without a version pin,
  and the compatibility contract notes the wrapper manifest check.

Full changelog: v1.1.1...v1.1.3

v1.1.2

npm publish of this version failed inside an npm registry incident on 2026-09-03 (status.npmjs.org: Intermittent Failures Impacting npm Publish). The registry holds no installable 1.1.2 and npm records the number as used, so the same content is published as v1.1.3. GitHub Packages does hold 1.1.2. Install 1.1.3.

Added

• docs/ and CHANGELOG.md in the package. The npm tarball now ships the
  documentation the README links to. Before this, an installed copy had a
  README whose relative links pointed at files that were not there, and the
  Troubleshooting table could not be read offline. The pack check derives the
  required list from the README links, so a new documentation link tightens
  the gate by itself.
• A check for stale documentation. A bump now rewrites every
  Plugin <version> phrase in the README and in docs/, and
  bump-version --check fails when such a phrase names a version that is not
  the one in package.json. The pack check also fails when the README links
  a markdown file that is not in the package.

Changed

• update --apply refreshes the Claude Code marketplace. The plan runs
  claude plugin marketplace update antigravity before
  claude plugin update antigravity@antigravity. Without that step,
  plugin update reports the version you already have as the latest.
• update --apply reports a local Codex marketplace. The plan runs
  codex plugin marketplace list first. If the antigravity marketplace is a
  local clone, the command prints the path and tells you to pull that clone,
  because plugin add installs the version the clone holds. After the install
  it prints the installed version, and one more line when that version is not
  the latest. It never pulls or changes your clone.
• Socket badge. The badge now sits in the badge row at the top of the
  README and links to the Socket overview page. The image URL stays
  unversioned, so it needs no change per release.
• Update instructions. The README now says that Claude Code needs
  claude plugin marketplace update antigravity before plugin update, that
  Codex installs from the registered marketplace (pull a local clone first),
  and what update --apply does for each host. The commands reference gains
  an update section, and the installation guide gains a Troubleshooting row
  for a Codex reinstall of an old version. The README no longer states a test
  count, the Socket badge sits with the other badges without a version pin,
  and the compatibility contract notes the wrapper manifest check.

Full changelog: v1.1.1...v1.1.2

v1.1.1

Added

• GitHub Packages mirror. A workflow republishes each v* release tarball
  to GitHub Packages and supports a manual run for an existing tag.
• Troubleshooting guide. The installation guide now lists measured command
  failures, their first output lines, exit codes, and corrective actions.
• Automated repository checks. .github/dependabot.yml checks GitHub
  Actions pins each week. Its npm entry stays idle until a dependency exists.
  .github/workflows/codeql.yml scans javascript-typescript on pushes and
  pull requests to main, and each week.
• Socket badge. The README now links to the Socket score for the published
  npm package.

Changed

• Local vault notes. .vault/, which contains the maintainer's local
  vault-ops notes, is no longer tracked in the repository.
• Release documentation. The README now uses per-host quick starts and
  includes how the plugin works, release integrity, and contributing guidance.
  The release runbook now warns that trusted publisher fields must match
  exactly. The vision reference now includes the measured model guidance.

Fixed

• The host wrapper spawned a script from any plugin root. The wrapper took
  CLAUDE_PLUGIN_ROOT as given and ran <root>/scripts/commands/<verb>.mjs
  from it. It now reads <root>/plugin.json first and exits 1 with one line
  unless that manifest names this plugin. The standalone dispatcher applies
  the same check to ANTIGRAVITY_SCRIPT_ROOT before it imports a verb.
• A missing agy or Git surfaced as a raw Node error. rescue, task
  and vision now probe agy first and exit 1 with
  antigravity:<verb> — \agy` is not on PATH (). Run
  /antigravity:setup.before any job record or spawn.reviewreads the diff first, so nothing to review still exits 0 with theno_changesresult and never needsagy; with changes to send it prints the same line and exits 1. A run whose process never starts prints failed: instead offailed (failed)., and reviewwithout Git printsgit is not on PATH (spawnSync git ENOENT).`
• vision started agy for a file it could never send. An unsupported
  extension or a file over the 10 MiB cap failed only when the model called
  the local image server, which spent tokens and returned an answer-shaped
  reply. The command now checks both limits before any spawn and exits 1.
• update --apply sent Codex an unqualified plugin name. The Codex plan's
  plugin remove step passed antigravity, and Codex refuses that with
  "plugin requires --marketplace unless passed as <plugin>@<marketplace>",
  stopping the whole run before plugin add could run. The remove step now
  passes antigravity@antigravity. The remove and add argv now match the
  printed instruction.
• update --apply could reinstall a stale cached version on agy. The
  24 h cache is right for the plain report, but --apply read it too, so a
  run could pack a version the cache still remembered even after a newer
  release shipped. --apply now always asks the npm registry once and
  rewrites the cache. With ANTIGRAVITY_NO_UPDATE_CHECK=1 the agy step is
  skipped with a clear message instead of packing an unknown version; Claude
  Code and Codex, which do not need a version number, still run.

Full changelog: v1.1.0...v1.1.1