Antigravity is the first harness whose hooks can ask
Run agents? ACP lets you see, control, and price every tool call they make — allow/ask/deny policy, per-session cost, and a full audit log for Claude Code, Cursor, Codex, and OpenClaw, in one command:
curl -sf https://agenticcontrolplane.com/install.sh | bashGetting started → · see your first governed call → · free up to 5 agents · prefer fully on-device? add --local
Google Antigravity — the agent ecosystem that absorbed Gemini CLI in May and went enterprise in August — now has ACP support via @agenticcontrolplane/antigravity: every tool call policy-checked before it runs across the agy CLI, the IDE, and the app, with an audit record and a session receipt.
Integrating it taught us something no other harness has offered yet, and two things you have to design around. All of it is verified — the hook docs are public, and what they don’t say, the shipped 1.1.21 binary does.
force_ask: the primitive we’ve been translating around
Every prior integration has had to simulate an ask. Grok Build’s hook gate is allow/deny only, so an ACP ask resolves by mode — and an explicit local allow rule outranks it in attended sessions, a caveat we document. Muse Code speaks Claude’s ask vocabulary. dsh resolves asks to deny.
Antigravity’s PreToolUse hooks answer with a first-class decision vocabulary: allow, deny, ask, force_ask, deny_unless_prior_grant. The one that matters for an external policy layer is force_ask: prompt the human, ignoring cached “Always Allow” grants. When ACP policy says a call needs a person, Antigravity renders its own approval card and no remembered local grant can pre-empt it. The Grok Build caveat doesn’t exist here — this is the strongest ask mapping on the board.
Headless, the same answer costs nothing: Antigravity soft-denies unobtainable approvals natively — the run continues, exit 0, stderr names the tool. The empty chair resolves to deny without our hook doing anything mode-aware.
Fail-closed hooks: the right default, with a sharp edge
Antigravity is the first mainstream harness we’ve verified whose hook core fails closed: a crashed, timed-out, or non-zero-exiting pre-tool hook blocks the call. (The binary’s own error string: pre-tool hook failed.) Claude Code and Grok Build both fail open — a broken policy hook there is a silent allow, the exact failure class we exist to remove.
Google’s choice is the control-friendly one, but it moves the burden: a hook that lets an upstream outage become its own crash bricks every tool call in the session. So the plugin never exits non-zero and never lets an exception escape — every outcome, including its own crash handling, travels as JSON with exit 0, and the unreachability posture is explicit: attended sessions fail open with a loud UNGOVERNED warning and a durable lapse-log line; unattended tiers fail closed. Same posture as our other plugins — enforced from inside the hook rather than inherited from the harness.
The fine print worth knowing
Three contract details that will bite naive ports, all in the deep page:
- The payload doesn’t name its event. No
hookEventNamefield — the registration passes the event as a CLI argument instead. A Claude-shaped hook that switches on the payload’s event name silently misroutes everything. PostToolUsecan’t see tool output. The payload carries the call and an error string, not what the tool returned — so post-hoc content scanning isn’t possible from the hook alone, and our post event is an audit/completion record. (The transcript file the payload points at has the full exchange; that’s a future enhancement, not a v0.1 claim.)- The hook environment is sanitized. Env-var configuration mostly doesn’t reach the subshell; configuration rides in
~/.acp/config.json.
And one finding the docs don’t state, which our live pass settled the same day: --dangerously-skip-permissions bypasses the hook layer entirely. A/B on otherwise-identical headless turns — without the flag the hook fires (before the permission layer, incidentally); with it, zero hook invocations. No stats, no lapse, no record. Claude Code’s denies and hooks survive its bypass flag; Grok Build fires deny rules and PreToolUse hooks in always-approve mode; Antigravity removes the interception surface itself. The rest of the live pass verified the happy paths: the run_command payload key is CommandLine, the production hardline floor denied a recursive root delete under the native tool shape, and headless soft-deny plus the session receipt behave exactly as documented.
Google shipped real controls. That’s good — and it’s one fleet’s worth
The obvious question: Antigravity has a genuinely good permissions engine, a sandbox, and an enterprise tier with central audit logging, MCP restrictions, and spend caps. Why add ACP?
Because the controls attach at the Gemini Enterprise tier and end at the ecosystem boundary. If your fleet is Antigravity-only and enterprise-licensed, use those controls — they’re well designed, and this page will keep saying so. Most fleets we see aren’t. They’re Claude Code plus Codex plus Cursor plus whatever shipped last Tuesday, and every vendor’s admin plane governs exactly its own harness. One hook per harness, one policy set, one approval queue, one ledger across all of them — that’s the job. Classifiers spread; ledgers didn’t.
Install
curl -sf https://agenticcontrolplane.com/install.sh | bash
Detects Antigravity, drops one zero-dependency Node file, merges the registration into the shared ~/.gemini/config/hooks.json under its own key — never overwriting your existing hooks — and the next session is governed. Manual steps and the full contract: the install guide.