Antigravity CLI

What changed

On 13 October 2026, stable 1.3.4, Google made remote-control serve load saved settings.json and fixed browser-approved grants that kept applying after removal. Remote users can now change permissions and artifact review from the browser; before unattended work, restart the daemon with a saved deny rule and try the denied command.

Where it stands, 2026-10-13

Before remote or unattended work, install the release above. Install the stable 1.3.4 GitHub release asset for your platform and verify its SHA-256. The tagged README provides the platform-specific installation instructions. For an audited fleet, set AGY_CLI_DISABLE_AUTO_UPDATE=true for every interactive and CI account. Homebrew’s cask also leaves the self-updater active. Check the running version before relying on the pin. This profile identifies no listed feature as preview, beta or available only on main.

Enable and test the sandbox before delegating. The CLI sandbox is off by default; use --sandbox or enableTerminalSandbox: true. 1.3.3 blocked sandboxed macOS commands from reading ~/Library/Application Support by default, because desktop apps keep credentials and session tokens there. Try reading a harmless test file outside the workspace through shell commands and file tools, and confirm that denied paths stay denied.

Before unattended use, test that a refusal ends the requested work. Google says 1.2.15 stops the agent working around unapproved requests through other commands, scripts or tools. Inspect earlier refused runs for workarounds. Keep explicit deny rules and containment.

Treat the signed-in Google account as a remote permission controller. Review earlier browser-driven transcripts and inspect settings.json and the shared config.json for leftover grants.

Check that your review choices survive saving. The CLI writes only settings that differ from defaults; choosing today’s default does not freeze it. 1.3.0 moved even users who had selected the old high-verbosity default to medium summaries. Set high again if individual steps matter. After saving permission and artifact-review choices, inspect settings.json.

Plugin admission is a permission decision

Inspect plugin bundles before enabling them. 1.3.2’s marketplace puts skills, MCP servers, subagents, hooks and runnable bin/ tools in one install. Rebuild inventories with agy plugin list --json, the repaired agy plugin validate and the /plugin Agents row that now includes root-declared subagents. Desktop marketplace installs update automatically and appear in the CLI; disable those you need to audit. In always-proceed, MCP tools run without a prompt. Treat enabling a bundle as approving code to act for you.

Unattended work needs completion checks

Inspect real checkouts for unexpected edits from older subagent runs. 1.3.3 fixed branch or share subagents silently using real checkouts in multi-repository workspaces. 1.3.1 also corrected failed subagents shown as Done; verify earlier outputs accepted on that label alone.

In CI, check completed output and exit status. Unknown headless --agent names now exit 1; late model or agent errors in -p runs exit 3 with AGY_ERROR, while multi-turn stream-json sessions still warn and continue. Reject non-empty denied_actions even on exit zero.

Set --print-timeout explicitly. Since 1.2.9 ends headless daemons with the run and caps background waits at 30 minutes, start persistent test servers outside agy.

Put human plan approval outside headless runs. Headless runs pass plan review automatically. Interactive /plan sessions regained review under --dangerously-skip-permissions in 1.3.2. Choose artifactReviewPolicy: always-proceed separately if those interactive plans should continue automatically.

Model access belongs to the job’s account

Replace retiring model pins under the job’s account. Ultra has no Claude Sonnet 4.6 or Opus 4.6 access; remaining 4.6 access and GPT-OSS-120b are scheduled to end on 2 November 2026. Free and AI Plus have no Claude 5.5 access; non-trial Pro and Ultra do. Enterprise Claude 5.5 requires administrator opt-in and token billing. Run agy models under the job’s account and replace Free and AI Plus pins with an available Gemini model. Check service access separately from the binary pin.

Delegate the image loop, keep the visual decision

Delegate prompt writing and image checks to image-generator.

The 1.2.16 image-generator subagent writes prompts, checks results with up to three attempts and saves conversation artifacts. Delegate that loop; keep the visual call.

What is unresolved

• Earlier daemon policy: the 1.3.4 saved-settings repair leaves the permissions used by older remote-control serve sessions unspecified. A dated explanation from Google naming the permission sources and defaults used before 1.3.4, or a versioned reproduction of an older daemon with a saved deny rule, would settle which policy those sessions used.
• Old browser grants: the revocation fix does not promise cleanup of existing copies. Upgrade an old config, revoke a grant and try the previously allowed command.
• Sandbox enforcement: the CLI sandbox description and Enterprise guidance do not establish enforcement on your deployment. Test shell and file-tool denied paths, then check mounts and network access. Record the version and platform tested.
• Legacy permissions: the unsandboxed deprecation note gives no removal version. The script-approval change does not say whether old broad grants are narrowed. Explicit removal and migration releases, each tested against an old config, would settle both questions.
• Live model access: the dated tier table does not establish which models your account can use. Run agy models and a bounded replacement-model job under the deploying account before 2 November 2026.