imbue-mngr-antigravity 0.1.3

Antigravity agent type plugin for mngr

imbue-mngr-antigravity

Plugin that registers the antigravity agent type for mngr.

Antigravity CLI is Google's terminal-based AI coding assistant, the successor to the legacy Gemini CLI. Google announced on 2026-05-19 that Gemini CLI is being replaced by Antigravity CLI, with the legacy request path turning off for paid-tier accounts on 2026-06-18. This plugin lets you run the new CLI (agy) as an mngr agent.

Authentication

Each agent runs agy under its own $HOME and reads its token from $HOME/.gemini/antigravity-cli/antigravity-oauth-token. By default mngr creates that per-agent token as a symlink to the shared ~/.gemini/antigravity-cli/antigravity-oauth-token — even when the shared token doesn't exist yet (a dangling symlink). Because agy writes the token in place, the result is "log in once, anywhere":

• If the shared token already exists, every agent's symlink resolves to it → agents are authenticated with no per-agent login.
• If it doesn't, the first agent you log into writes its token through the symlink to the shared path, which immediately authenticates every other agent pointing at it. Token refreshes propagate the same way.

This works on both Linux (no keychain — the file token is native) and macOS (where agy stores the token in the login keychain, which a relocated per-agent $HOME can't reliably read, so the file token is the cross-agent mechanism there too). Set symlink_oauth_token = false for full per-agent isolation (each agent authenticates independently; no sharing or propagation).

macOS popup during login is expected and harmless. When you sign in to an agent on macOS you may see a system dialog: "A keychain cannot be found to store "antigravity."" Because each agent runs under a relocated $HOME, agy has no per-agent keychain to write to, so it falls back to writing the file token — which is exactly the mechanism mngr relies on (the file token is then shared across agents via the symlink, as above). Just dismiss the dialog; authentication still completes and propagates normally.

Usage

mngr create my-agent antigravity

Pass arguments to the agy command with --:

mngr create my-agent antigravity -- --help

Per-agent isolation

Each antigravity agent runs agy under its own $HOME (at <agent_state_dir>/plugin/antigravity/home/). agy resolves its entire config/permission/auth/session tree from $HOME/.gemini and has no config-dir override env var, so relocating $HOME is the only lever that gives an agent its own settings.json. This delivers, per agent:

• Permissions -- a per-agent allow/deny/ask policy (see below), instead of the all-or-nothing --dangerously-skip-permissions.
• Model -- a per-agent model selection.
• Isolated state -- the agent's own transcripts/conversations rather than sharing the user's global ~/.gemini.

This is unconditional: there is no "isolated vs non-isolated" mode. Whether an agent is locked down or open is purely data -- whether its settings.json carries a permissions block. Heavy caches (ms-playwright-go browser binaries) are shared across agents by symlinking each agent's home cache to the user's real host cache, so they are downloaded once.

Configuration

Define a custom variant in your mngr config (mngr config edit):

[agent_types.readonly_agy]
parent_type = "antigravity"
settings_overrides = { permissions = { allow = ["command(git)"], deny = ["command(rm -rf)"], ask = ["command(*)"] }, toolPermission = "proceed-in-sandbox", model = "Gemini 3.5 Flash (Medium)" }

Then create agents with your custom type:

mngr create my-agent readonly_agy

Fields

• settings_overrides (dict, default {}) -- a free-form blob merged last into the per-agent settings.json (mirrors mngr_claude's field of the same name). Common keys:
  • permissions -- {allow, deny, ask}, each a list of action(target) resources. Actions: read_file, write_file, read_url, execute_url, command, unsandboxed, mcp. Precedence is Deny > Ask > Allow. command(...) matches a token-prefix/regex with no path scoping; file/url targets must be canonical (on macOS /tmp -> /private/tmp) -- a wrong target fails open to Ask rather than erroring.
  • toolPermission -- the global default mode, e.g. "proceed-in-sandbox" or "request-review".
  • model -- a display name exactly as listed by agy models, e.g. "Gemini 3.5 Flash (Medium)".
• sync_home_settings (bool, default true) -- base the per-agent settings.json on a copy of the user's real ~/.gemini/antigravity-cli/settings.json, with settings_overrides layered on top. When false, start from an empty base. This is a data-source choice, not a separate code path. Note that this copies only the global settings.json scope, which in practice holds theme/telemetry/trust; it does not capture the user's model, permission grants, or behavioral policies (fileAccessPolicy/internetPolicy/etc.), which agy persists in other scopes (config/config.json userSettings, per-project config/projects/<uuid>.json) that this copy intentionally does not read -- importing the user's grants would weaken per-agent isolation. Set an agent's model and permission policy explicitly via settings_overrides.
• symlink_oauth_token (bool, default true) -- symlink the shared oauth token into each agent's home (so refreshes propagate) or copy it (false) for full isolation.
• auto_allow_permissions (bool, default false) -- auto-approve every tool call via agy's --dangerously-skip-permissions flag. (It is not a hook: agy's documented PreToolUse {"decision": "allow"} output does not gate the run_command confirmation dialog -- verified live against agy 1.0.3.) When combined with a permissions policy in settings_overrides, skip-permissions wins (the policy is moot), matching mngr_claude.
• auto_dismiss_dialogs (bool, default false) -- silently trust the source repo without prompting (see Trust below).
• emit_common_transcript (bool, default true) -- start a background worker that streams agy's per-conversation JSONL transcripts into events/antigravity/common_transcript/events.jsonl. mngr transcript <agent> reads from there.

Conversation resume

Stopping an antigravity agent and starting it again (mngr stop / mngr start) resumes the agent's prior agy conversation, keeping its full context rather than starting fresh. This is automatic; there is no flag to set. The conversation resumed is the agent's main (root) one, tracked in the per-agent root_conversation file (written by the PreInvocation marker hook with whichever conversation opens each turn). It is deliberately not read from the conversation-ids file, whose entries also include the agent's subagents. (Cloning an agent does not yet carry the source's conversation forward -- that is a separate follow-up.)

Caveats

• agy PATH shadowing: if the Antigravity 2.0 desktop app is installed, its bundled agy shim can shadow the standalone CLI in PATH. Remove the desktop app's bin/agy or override command with an absolute path to the Go binary.
• Workspace symlink workaround: agy refuses to add any path with a dot-prefixed segment as a workspace (logs Failed to add workspace folder ... is hidden: ignore uri and falls back to the user's home dir). mngr's work_dir lives under ~/.mngr/worktrees/..., which trips this check. As a workaround, mngr_antigravity creates a per-agent symlink at /tmp/mngr_antigravity_workspaces/<agent_id> that targets the real work_dir, and launches agy with cwd set to the symlink. (HOME relocation does not change this: agy accepts a hidden config dir, just not a hidden workspace.) The symlink is recreated via ln -sfn on every launch; /tmp wipes are self-repairing. Symlinks aren't pruned when agents are destroyed (they're inert and small). Track the upstream agy bug report for when a flag-level fix lands; we can drop the workaround then.
• Trust: agy suppresses its first-launch "Do you trust this folder?" dialog for any path in its settings.json trustedWorkspaces. mngr seeds the agent's transient workspace path into the per-agent settings.json (the running agy exact-matches its cwd), and additionally persists the durable source-repo path into the user's global ~/.gemini/antigravity-cli/settings.json so trust isn't re-prompted across agents/worktrees of the same repo. The transient per-agent path is never written to the global file. Granting trust is gated (mngr never silently runs an agent on untrusted code):
  • mngr create --yes (mngr_ctx.is_auto_approve) or auto_dismiss_dialogs = true: silent trust.
  • Interactive shell: mngr prompts via click.confirm before writing.
  • Non-interactive shell without either opt-in, or a declined prompt: provisioning exits cleanly (SystemExit). Re-run with --yes or set auto_dismiss_dialogs = true.
• Hooks (lifecycle marker + conversation capture): mngr_antigravity writes a per-agent hooks.json to $HOME/.gemini/config/hooks.json (in the agent's relocated home); agy executes it directly with no trust prompt and no --add-dir. A PreInvocation/Stop pair maintains an active marker so the agent reports RUNNING while working and WAITING when idle (agy writes no such marker on its own). PreInvocation runs set_active_marker.sh, which touches the marker and -- when the marker was absent, i.e. this invocation opens a new turn -- records the conversation id as the turn's root in root_conversation. Stop runs clear_active_marker_when_idle.sh, which removes the marker only on the root agent's fully-idle Stop: the payload's conversation id must match the recorded root and report "fullyIdle":true. This matters because agy runs the Stop hooks for every conversation -- the root agent and each subagent it launches share the same hook -- and a subagent fires its own "fullyIdle":true Stop when it finishes, which can arrive while the root is still working; gating on the root conversation keeps the agent RUNNING until the root itself is done. An interim Stop (the root waiting on async work, or a subagent finishing) sends "fullyIdle":false or a non-root id, so the marker is kept; the final root Stop sends "fullyIdle":true for the root id, clearing it. Because the root is re-recorded at each turn boundary (whenever the marker is absent), /clear, /fork, /switch, and resume stay correct. Verified live against agy 1.0.5: a backgrounded shell task produced the false-then-true root sequence, a mid-flight user message kept the marker held, and a subagent's fullyIdle:true Stop did not clear the root's marker. A second PreInvocation handler (capture_conversation_id.sh) records every conversation ID the agent touches -- the root's and its subagents' -- into the conversation-ids file, which scopes transcript streaming (the set of conversations to tail); resume instead uses the root_conversation id from the first handler (see "Conversation resume" above). agy delivers the hook payload to each handler independently, so the two handlers don't contend for stdin. Note: the in-TUI /hooks command writes to ~/.gemini/antigravity-cli/hooks.json, which the hook execution engine never runs -- that path is loaded only for the TUI's display, while only ~/.gemini/config/hooks.json and per-workspace .agents/hooks.json are actually executed (antigravity-cli#49).
• No readiness sentinel: readiness is signalled purely by polling the rendered TUI banner. agy's hook events are execution-loop events (PreToolUse/PostToolUse/PreInvocation/PostInvocation/Stop) with no "input prompt ready" analog, so they can't replace the banner poll.
• No permission-specific WAITING reason: agy exposes no permission-dialog hook event, and no hook fires while the agent is blocked at the dialog, so mngr can't currently flag why an agent is waiting (as mngr_claude does). With auto_allow_permissions = true there are no dialogs anyway; surfacing a permission-WAITING reason in supervised mode is left for a follow-up.

See the mngr agent types documentation for more details.