Antigravity

Google Antigravity (`agy`) lifecycle hook contract and setup paths for macOS, Linux, and native Windows.

The Antigravity connector is hook-only: Antigravity continues to contact its model provider directly, while its documented lifecycle hooks send local events to the authenticated DefenseClaw gateway. DefenseClaw does not proxy Antigravity model traffic.

Google currently publishes Antigravity 2.0 v2.4.3. Its updater manifest and official CLI releases publish CLI v1.1.10. The official install page documents native Windows, macOS, and Linux clients. This is vendor availability metadata, not DefenseClaw validation or certification.

Platform support

Platform	Status	Notes
macOS and Linux	Supported	DefenseClaw installs the portable `antigravity-hook.sh` runtime and writes the five documented handlers to `~/.gemini/config/hooks.json`.
Native Windows x64	Supported	DefenseClaw supports the direct native x64 client and uses a bounded Windows PowerShell launcher for the packaged hook executable. Windows 10 64-bit is the upstream minimum. Upstream ARM64 availability is not a DefenseClaw ARM64 support claim; authentication, HITL, and official-client live evidence remain unverified and `live=false`.

Three scenarios end-to-end against the same agy session: (1) a benign command flows through with action=allow / severity=NONE; (2) a sensitive-file read produces an approval prompt under the policy used for this historical recording; (3) writing a synthetic secret to an environment file matches a CRITICAL finding → DefenseClaw returns decision=deny → agy refuses without prompting. Current builds keep an ordinary sensitive-file read as a MEDIUM detection-only advisory unless the same action proves a mutation or external egress. Each verdict appears live in the Splunk pane on the left. This demo also used an unredacted destination projection; current v8 deployments select an explicit redaction profile per destination or route.

Setup

Install the official agy client using Google's installation guide, complete its normal provider sign-in, and then configure DefenseClaw:

agy --version
defenseclaw setup antigravity                 # observe (default)
defenseclaw setup antigravity --mode action   # deny or ask at PreToolUse

Setup writes five DefenseClaw-owned registrations to ~/.gemini/config/hooks.json and installs the portable hook runtime at ~/.defenseclaw/hooks/antigravity-hook.sh. It backs up the original document, preserves unrelated hooks, stores the connector-scoped credential in the protected DefenseClaw runtime, and records the resolved contract in ~/.defenseclaw/hook_contract_lock.json. Google documents no configuration-home override for this global hook file.

Install the official client from PowerShell:

irm https://antigravity.google/cli/install.ps1 | iex
agy --version
defenseclaw setup antigravity
defenseclaw setup antigravity --mode action

Google installs agy.exe under %LOCALAPPDATA%\agy\bin (normally C:\Users\<Username>\AppData\Local\agy\bin). Authentication uses Windows Credential Manager for secure token profiles, with browser authentication as the fallback. The vendor installer verifies the manifest-provided SHA-512. DefenseClaw discovery accepts only the token-bound Known Folder form of this canonical path, applies its trusted ACL boundary, and checks a stable no-follow SHA-512 across the version probe. It does not claim a vendor signer pin or certification.

No protected-client, authentication, HITL, client-provenance, or official-client live evidence is claimed. Provider login through Windows Credential Manager or the vendor browser flow remains required; there is no authentication bypass.

The native Setup lifecycle and manual validation harness implement this connector's custody and acceptance infrastructure. Ordinary defenseclaw setup antigravity, first-run, batch, and CLI/TUI selection are supported independently of the optional protected live harness.

DefenseClaw uses a native Windows process chain:

agy.exe → system Windows PowerShell 5.1 Start-Process -Wait → defenseclaw-hook.exe → loopback gateway.

The registered command uses -EncodedCommand, keeps Windows paths with spaces out of Antigravity's visible tokenizer input, inherits stdin/stdout, waits synchronously, and propagates the launcher status. Enforcement does not depend on that status: Google documents structured stdout, not non-zero hook exit codes, as the policy interface.

Native Setup writes five DefenseClaw-owned registrations to the official %USERPROFILE%\.gemini\config\hooks.json path. Google documents no configuration-home environment override. Setup retains a predecessor custom path only as internal custody needed for exact restoration and migration; backs up the original file; preserves unrelated hooks; writes connector-scoped gateway credentials into the protected DefenseClaw runtime; and records the resolved contract in %USERPROFILE%\.defenseclaw\hook_contract_lock.json.

Modes and enforcement

observe records findings and always permits tool execution. action may deny or ask only at PreToolUse.

The official hooks documentation defines PreToolUse as a synchronous pre-execution hook. Its stdout must carry one of allow, deny, ask, or force_ask in decision. DefenseClaw uses:

{ "decision": "deny", "reason": "policy denied" }

for a hard block and:

{ "decision": "ask", "reason": "operator confirmation required" }

for native confirmation. This synchronous PreToolUse decision is the only hard-blocking claim for the connector.

Antigravity does not document non-zero hook exit status as enforcement. DefenseClaw therefore does not advertise connector-wide fail-closed support. Gateway, authentication, or decoding failures use an event-correct no-op response in normal fail-open operation. A strict local fallback can emit decision: "deny" for PreToolUse; other events still use their documented non-blocking output shapes.

Official lifecycle schema

All command handlers are synchronous and registered with a 30-second timeout. The event name is not present in Antigravity's documented stdin. DefenseClaw binds each registration to a trusted --event argument and forwards that metadata to the gateway in a local header without rewriting the original stdin captured for audit.

Event	Registration shape	Documented stdin beyond common metadata	DefenseClaw stdout
`PreInvocation`	direct handler list; matcher ignored	`invocationNum`, `initialNumSteps`	`{}` or `injectSteps` containing `ephemeralMessage`
`PreToolUse`	matcher group with nested `hooks`	`toolCall{name,args}`, `stepIdx`	required `decision`; `deny` is the hard block
`PostToolUse`	matcher group with nested `hooks`	`stepIdx`, optional `error`	`{}`
`PostInvocation`	direct handler list; matcher ignored	`invocationNum`, `initialNumSteps`	`{}` or `injectSteps`; optional documented `terminationBehavior` is not used
`Stop`	direct handler list; matcher ignored	`executionNum`, `terminationReason`, `error`, `fullyIdle`	required `decision`; DefenseClaw uses `allow`

Common stdin fields are conversationId, workspacePaths, transcriptPath, and artifactDirectoryPath. The documented transcript roots are ~/.gemini/antigravity for the app and ~/.gemini/antigravity-cli for the CLI.

The on-disk registration intentionally mixes two schemas:

{
  "defenseclaw-antigravity-pretooluse": {
    "PreToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "<event-bound native command>",
            "timeout": 30
          }
        ]
      }
    ]
  },
  "defenseclaw-antigravity-stop": {
    "Stop": [
      {
        "type": "command",
        "command": "<event-bound native command>",
        "timeout": 30
      }
    ]
  }
}

Claude Code fields such as systemMessage, additionalContext, and permissionDecision are not part of this connector's output.

Repair, Doctor, and removal

defenseclaw doctor passively validates:

the exact five-event mixed schema and 30-second timeouts;
each event's matching native --event binding;
the protected defenseclaw-hook.exe PE target and hook contract lock;
connector-scoped gateway authentication and runtime freshness;
stale, malformed, foreign, missing, or inconsistent registrations.

Doctor never executes command text read from hooks.json. Public defenseclaw setup antigravity repairs the connector through the same guarded custody and rollback path. For an existing recorded packaged installation, the cached DefenseClaw Setup /repair action without a CONNECTOR override also reloads the recorded connector and reconciles its native registration.

Teardown restores the pre-Setup file when it is unchanged. If an operator edited it, teardown removes only DefenseClaw-owned current and legacy commands, preserves foreign hooks, tombstones cached hook launchers, and verifies that no managed registration remains:

defenseclaw setup guardrail --disable

Retired Gemini CLI cleanup boundary

Gemini CLI setup is deprecated. Existing DefenseClaw-managed Gemini CLI state may still exist under ~/.gemini, so Antigravity lifecycle operations keep a separate ownership boundary. Installing, repairing, or removing Antigravity must not restore or remove retired Gemini CLI entries; remove those explicitly with defenseclaw setup remove geminicli --yes.

Google's changelog records relevant Windows and hook transitions: v1.0.8 corrected the shared ~/.gemini/config/hooks.json path; v1.0.10 selected PowerShell as the Windows default shell; v1.0.15 fixed Windows output behavior; v1.1.1 fixed workspace hook loading; v1.1.7 fixed disabled plugins still running hooks; and v1.1.8 is the compatibility floor for the five-event contract. The current v1.1.10 updater/release metadata does not document a replacement hook schema, so DefenseClaw does not infer one from the version delta and does not promote the connector's authentic validation metadata; live: false remains unchanged.

Local customization surfaces

hooks.json

mcp_config.json

DefenseClaw writes hooks only to the global file to avoid duplicated global and workspace evaluation. MCP and AgentSkills retain their documented global and workspace behavior; rules plus standalone and plugin-contained agents remain discovery-only as listed in the connector matrix. Rule inventory reads bounded, stable bytes without following links or reparse points from global GEMINI.md, current .agents/rules, legacy .agent/rules, and plugin rules/*.md sources.

Enterprise/managed, Team, ProgramData, cloud-dashboard, MDM, and organization policy surfaces are outside this connector contract and remain unverified.