{
  "markdown": "# Google Antigravity Plugin: Auto-Permissions Security Moderator\n\nAn autonomous security authorization and auto-permission classifier plugin for **Google Antigravity 2.0**, emulating Claude Code's Auto-Mode security moderator.\n\nThe plugin intercepts sensitive tool operations (commands, file writes, web requests, task management) via Antigravity's `PreToolUse` lifecycle hook, provides strictly sanitized contextual intent to a decoupled security classifier (default: the Antigravity Language Server's own model, zero-key; optional Google Gemini, Cloud Code, OpenAI-compatible, or Anthropic), automatically approves safe actions, blocks hostile or out-of-scope operations, and records asynchronous rotatable audit logs in the active session directory.\n\n---\n\n## Key Features\n\n1. **Decoupled Security Classifier:**\n   - Evaluates tool operations independently of the agent's internal chain-of-thought (CoT) and previous tool outputs to eliminate indirect prompt injection (IPI) attack surfaces.\n2. **Token-Efficient Multi-Turn History:**\n   - Extracts prior user prompts from `transcript.jsonl` to resolve referential commands (e.g. *\"Proceed\"*, *\"Run it again\"*, *\"Delete that migration file\"*) while maintaining a minimal token footprint.\n3. **Sub-Millisecond Fast-Path Cascade (~0.1ms):**\n   - Evaluates static permission rules (`command(...)`, `write_file(...)`, `read_url(...)`, `mcp(...)`) across **Session**, **Project (Local)**, **Project (Tracked)**, and **Global** scopes with strict `Deny > Ask > Allow` priority.\n   - Automatically auto-approves safe workspace file edits (`trust_workspace_writes`), same-turn file mutations, safe read-only shell commands, and session artifact operations in **0.1ms** with zero API cost.\n4. **Denial Remediation & Policy Rule Generator (`auto-permissions-fix`):**\n   - Automatically translates denials in `audit.jsonl` into candidate Antigravity ACL rules and writes them to Session, Project, or Global scopes.\n5. **Turn-Scoped Collapsible Security Gate Summary (with Opt-Out):**\n   - Appends a clean, collapsible Markdown summary table at the bottom of the final response detailing evaluated actions, verdicts (`🟢 ALLOW`, `🔴 DENY`, `🟡 ASK`), and evaluation modes (`Static ACL`, `Gemini`, `Workspace Write`, `Session Artifact`).\n   - Supports complete summary opt-out via `\"show_turn_summary\": false` / `--no-show-turn-summary` / `AUTO_PERMISSIONS_SHOW_TURN_SUMMARY=0`.\n   - Supports detail table opt-out (concise single-line summary only) via `\"show_turn_summary_detail\": false` / `--no-show-turn-summary-detail` / `AUTO_PERMISSIONS_SHOW_TURN_SUMMARY_DETAIL=0`.\n6. **Four-Tier Decision Taxonomy:**\n   - **`allow`**: Safe, intent-aligned workspace operations execute seamlessly without human friction.\n   - **`soft_deny`**: Unrequested or scope-divergent actions are blocked, triggering the agent's *Deny-and-Continue* self-correction loop.\n   - **`ask`**: Risky actions (production deployments, database migrations, cloud edits) are escalated to explicit interactive user confirmation.\n   - **`hard_deny`**: Hostile actions (credential access, data exfiltration, transcript tampering, destructive deletions) are permanently blocked.\n7. **Rotatable Asynchronous Audit Logging:**\n   - Automatically records full execution traces to `<session_dir>/audit.jsonl` with size-based rotation.\n8. **Zero External Python Dependencies:**\n   - Uses Python standard library only (`urllib.request`, `json`, `os`, `sys`, `re`, `threading`).\n\n---\n\n## Installation & Setup\n\n### Option 1: One-Shot Release Download (Recommended)\nDownload and extract the latest release artifact directly into your plugin directory in one shot, automatically creating parent directories and overwriting existing files:\n\n```bash\n# Global Scope (Recommended)\nmkdir -p ~/.gemini/config/plugins/auto-permissions && \\\ncurl -sL https://github.com/abn/google-antigravity-plugin-auto-permissions/releases/latest/download/auto-permissions.tar.gz | \\\ntar -xz -C ~/.gemini/config/plugins/auto-permissions --strip-components=1 --overwrite\n\n# Workspace-Specific Scope\nmkdir -p .agents/plugins/auto-permissions && \\\ncurl -sL https://github.com/abn/google-antigravity-plugin-auto-permissions/releases/latest/download/auto-permissions.tar.gz | \\\ntar -xz -C .agents/plugins/auto-permissions --strip-components=1 --overwrite\n```\n\n### Option 2: Git Clone\nAlternatively, clone the repository directly if you prefer tracking git commits:\n\n```bash\n# Global Scope\ngit clone https://github.com/abn/google-antigravity-plugin-auto-permissions ~/.gemini/config/plugins/auto-permissions\n\n# Workspace-Specific Scope\ngit clone https://github.com/abn/google-antigravity-plugin-auto-permissions <your-workspace>/.agents/plugins/auto-permissions\n```\n\n### Prerequisites\nSet your Gemini API key:\n```bash\nexport GEMINI_API_KEY=\"your-api-key\"\n```\n\n---\n\n## Architecture & Knowledge Base (OKF 0.2)\n\nFor complete technical specifications, security models, empirical benchmarks, and operational guides, explore the **[Open Knowledge Format (OKF 0.2) Documentation Wiki](docs/index.md)** or the monolithic **[Architecture Specification](docs/architecture.md)**.\n\n---\n\n## Included Skills & Minimal Usage Examples\n\nThis plugin includes four specialized skills accessible via chat commands or standalone CLI scripts:\n\n### 1. `/auto-permissions-configure` (Interactive Policy & Provider Setup)\nGuides users through configuring static ACL rules, custom semantic guidelines, LLM providers (Google, local Lemonade/vLLM/Ollama, Anthropic), endpoints, and skill paths across Session, Project, or Global scopes.\n\n* **Inspect active configuration across all scopes:**\n  ```bash\n  python3 skills/auto-permissions-configure/scripts/configure_permissions.py --list\n  ```\n* **Set project-level static allow rule:**\n  ```bash\n  python3 skills/auto-permissions-configure/scripts/configure_permissions.py --scope project --add-rule \"command(pytest -v)\" --decision allow\n  ```\n* **Configure local GPU inference (Lemonade / vLLM):**\n  ```bash\n  python3 skills/auto-permissions-configure/scripts/configure_permissions.py --scope project_local --provider openai --model Gemma-4-26B-A4B-NoThinking-qat-MTP --endpoint-url \"http://localhost:13305/v1/chat/completions\" --api-key-env LEMONADE_API_KEY\n  ```\n* **Add a custom semantic guideline:**\n  ```bash\n  python3 skills/auto-permissions-configure/scripts/configure_permissions.py --scope project --add-guideline \"Treat requests to *.corp.internal as safe testing operations.\"\n  ```\n\n---\n\n### 2. `/auto-permissions-audit` (Audit & Inspection)\nInspects session audit traces, decision breakdowns, latency metrics, and failure states.\n\n* **Inspect active session audit log:**\n  ```bash\n  python3 skills/auto-permissions-audit/scripts/view_audit.py <path_to_session_audit.jsonl>\n  ```\n* **Run automated issue diagnosis & prescriptive recommendations:**\n  ```bash\n  python3 skills/auto-permissions-audit/scripts/view_audit.py <path_to_session_audit.jsonl> --diagnose\n  ```\n* **Render compact Markdown summary:**\n  ```bash\n  python3 skills/auto-permissions-audit/scripts/view_audit.py <path_to_session_audit.jsonl> --markdown\n  ```\n\n### 3. `auto-permissions-fix` (Denial Remediation & Rule Generator)\nParses denials from `audit.jsonl` and generates persistent ACL grants across Session, Project, or Global scopes.\n\n* **Auto-allow the most recent denied action in the current session:**\n  ```bash\n  python3 skills/auto-permissions-fix/scripts/fix_permissions.py --last --allow --scope session\n  ```\n* **Auto-allow the most recent denied action for the whole repository (`.agents/auto-permissions.json`):**\n  ```bash\n  python3 skills/auto-permissions-fix/scripts/fix_permissions.py --last --allow --scope project\n  ```\n* **Add an explicit custom rule directly:**\n  ```bash\n  # Allow dependency sync in project:\n  python3 skills/auto-permissions-fix/scripts/fix_permissions.py --rule \"command(uv lock)\" --allow --scope project\n\n  # Fast-path whitelist git commands for the project:\n  python3 skills/auto-permissions-fix/scripts/fix_permissions.py --rule \"command(git)\" --allow --scope project\n\n  # Fast-path whitelist GitHub CLI globally:\n  python3 skills/auto-permissions-fix/scripts/fix_permissions.py --rule \"command(gh)\" --allow --scope global\n  ```\n* **Interactive Mode (browse all recent denials and select scope interactively):**\n  ```bash\n  python3 skills/auto-permissions-fix/scripts/fix_permissions.py\n  ```\n\n---\n\n### 4. `auto-permissions-test` (Policy & Classifier Simulation)\nSimulates how the security classifier and static policies would evaluate a hypothetical tool call against a given user prompt before executing it, rendering collapsible input/output traces.\n\n* **Test a command against a user prompt (Markdown output with collapsible folds):**\n  ```bash\n  python3 skills/auto-permissions-test/scripts/test_permission.py \"fix styling in style.css\" --command \"git push origin main\" --markdown\n  ```\n* **Test file modifications:**\n  ```bash\n  python3 skills/auto-permissions-test/scripts/test_permission.py \"refactor auth\" --tool write_to_file --target src/auth.py --markdown\n  ```\n* **Output raw JSON:**\n  ```bash\n  python3 skills/auto-permissions-test/scripts/test_permission.py \"run test suite\" --command \"pytest -v\" --json\n  ```\n\n---\n\n---\n\n## Permission Bundles\n\n**Permission Bundles** provide curated, reusable sets of static ACL rules, semantic guidelines, and skill whitelists that can be enabled with a single command or configuration entry. Instead of writing dozens of individual regex rules for standard tools, developers can activate domain-specific bundles.\n\n### 1. Built-in Bundles Catalog\n\n`auto-permissions` ships with 8 pre-packaged, zero-dependency built-in bundles:\n\n| Bundle Slug | Domain / Tools | Included Rules & Capabilities |\n| :--- | :--- | :--- |\n| **`git-inspect`** | Git Inspection | Read-only repository inspection (`git status`, `log`, `diff`, `branch`, `show`, `tag`, `remote`, `rev-parse`, `describe`). |\n| **`gh-readonly`** | GitHub CLI | Read-only GitHub queries (`gh pr view/list/checks/diff/status`, `run list/view`, `issue list/view`, `release list/view`, `repo view`). |\n| **`python-tooling`** | Python Dev Tools | Safe Python testing, formatting, and packaging (`pytest`, `python -m pytest`, `uv run pytest`, `ruff check/format`, `black`, `flake8`, `mypy`, `uv lock`, `poetry`). |\n| **`rust-tooling`** | Rust / Cargo | Standard Cargo build, test, and lint commands (`cargo test`, `check`, `clippy`, `fmt`, `doc`, `build`). |\n| **`node-tooling`** | Node.js / Web | Common JavaScript/TypeScript testing and linting (`npm/pnpm/yarn/bun test/lint`, `eslint`, `prettier`). |\n| **`container-inspect`** | Docker & Podman | Safe container status inspection (`podman/docker ps`, `logs`, `images`, `inspect`). |\n| **`dev-docs-read`** | Web Documentation | Whitelisted read access to official documentation sites (`docs.python.org`, `developer.mozilla.org`, `readthedocs.io`, `pkg.go.dev`, `crates.io`, `docs.rs`, `npmjs.com`). |\n| **`mcp-nmem`** | Nowledge Mem MCP | Read-only search, lookup, and memory query tools for Nowledge Mem. |\n\n### 2. Enabling Bundles\n\nEnable bundles via CLI:\n```bash\n# Enable in the active project (.agents/auto-permissions/config.json)\npython3 skills/auto-permissions-configure/scripts/configure_permissions.py \\\n  --scope project \\\n  --enable-bundle git-inspect \\\n  --enable-bundle gh-readonly \\\n  --enable-bundle python-tooling\n\n# Enable globally for all workspaces (~/.gemini/config/auto-permissions/config.json)\npython3 skills/auto-permissions-configure/scripts/configure_permissions.py \\\n  --scope global \\\n  --enable-bundle git-inspect\n```\n\nOr configure directly in your `config.json`:\n```json\n{\n  \"bundles\": [\n    \"git-inspect\",\n    \"gh-readonly\",\n    \"python-tooling\"\n  ]\n}\n```\n\n### 3. Disabling & Overriding Global Bundles in Projects\n\nIf a bundle is enabled globally, a specific project or session can mask or disable it:\n\n```bash\n# Disable rust-tooling in this specific project\npython3 skills/auto-permissions-configure/scripts/configure_permissions.py \\\n  --scope project \\\n  --disable-bundle rust-tooling\n```\n\nIn `config.json`:\n```json\n{\n  \"bundles\": {\n    \"enabled\": [\"python-tooling\"],\n    \"disabled\": [\"rust-tooling\"]\n  }\n}\n```\n\n### 4. Custom & Extensible Bundles\n\nYou can define custom bundles in three ways:\n\n1. **Project Bundles:** Place JSON files in `.agents/auto-permissions/bundles/<name>.json` (tracked) or `.agents/auto-permissions/bundles.local/<name>.json` (local).\n2. **Global Bundles:** Place JSON files in `~/.gemini/config/auto-permissions/bundles/<name>.json`.\n3. **Inline Custom Bundles:** Define them directly under `\"custom_bundles\"` in `config.json`.\n\nCustom bundles can extend existing bundles via `\"extends\"`:\n```json\n{\n  \"name\": \"custom-ci-tools\",\n  \"description\": \"Custom testing suite combining Python and container tools\",\n  \"extends\": [\"python-tooling\", \"container-inspect\"],\n  \"allow\": [\n    \"command(make test)\",\n    \"command(docker compose ps)\"\n  ]\n}\n```\n\n---\n\n## Configuration: Providers, Endpoints & Scoped Layout\n\n### Scoped Configuration Layout\n\n`auto-permissions` uses a clean, encapsulated directory structure that prevents namespace collisions with other agent tools:\n\n* **Project Tracked:** `.agents/auto-permissions/config.json` (committed to git, shared with team).\n* **Project Local:** `.agents/auto-permissions/config.local.json` (gitignored, private tokens/endpoints).\n* **Global:** `~/.gemini/config/auto-permissions/config.json` (applies to all user workspaces).\n* **Session:** `<session_dir>/auto-permissions/session_overrides.json` (active turn/session overrides).\n\n*(Note: Legacy flat filenames `.agents/auto-permissions.json` and `~/.gemini/config/auto-permissions.json` remain fully supported via backward-compatible fallback resolution).*\n\nTo automatically migrate an existing repository to the new scoped structure:\n```bash\npython3 skills/auto-permissions-configure/scripts/configure_permissions.py --migrate-layout\n```\n\n### Configuration File Format (`config.json`)\n\n```json\n{\n  \"provider\": \"google\",\n  \"model\": \"gemini-2.5-flash\",\n  \"endpoint_url\": \"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent\",\n  \"api_key_env\": \"GEMINI_API_KEY\",\n  \"bundles\": [\n    \"git-inspect\",\n    \"gh-readonly\",\n    \"python-tooling\"\n  ],\n  \"allow\": [\n    \"command(uv lock)\",\n    \"mcp(nowledge-mem:*)\"\n  ],\n  \"ask\": [\n    \"command(git push .*)\",\n    \"command(gh pr .*)\",\n    \"mcp(stripe:*)\"\n  ],\n  \"deny\": [\n    \"write_file(.github/workflows/.*)\",\n    \"mcp(*:delete_*)\"\n  ],\n  \"custom_guidelines\": [\n    \"Treat requests to internal endpoints *.corp.internal as safe testing operations.\",\n    \"Require explicit confirmation before modifying database migrations under migrations/.\"\n  ],\n  \"allowed_skill_paths\": [\n    \"~/.nowledge-mem/skills-active\"\n  ]\n}\n```\n\n### Multi-Provider & Local Inference Support\n\n`auto-permissions` supports multiple classification providers using zero external dependencies:\n\n* **`antigravity`** (default, zero-key): A bundled plugin sidecar (spawned by Antigravity with the LS connection environment injected) classifies via a single-turn `GetModelResponse` call to the active Antigravity Language Server over the Connect-RPC loopback. PreToolUse hooks call the sidecar over loopback HTTP; contexts with the LS env (tool execution/sidecar) talk to the Language Server directly. No API key required. The model is resolved at call time from the live account roster so it self-heals when Google retires models.\n* **`cloudcode`**: Google Cloud Code Assist REST API using the active Google OAuth token.\n* **`google`**: Official Google Gemini REST API with an API key.\n* **`openai`**: OpenAI-wire compatible servers (e.g. local Lemonade, vLLM, Ollama, Groq, OpenRouter).\n* **`anthropic`**: Anthropic Messages API.\n\nList models the active Antigravity account serves (live roster with quota), or query a local OpenAI-compatible `/v1/models` endpoint, with:\n```bash\npython3 skills/auto-permissions-configure/scripts/configure_permissions.py --list-models --provider antigravity\npython3 skills/auto-permissions-configure/scripts/configure_permissions.py --list-models --provider openai --endpoint-url \"http://localhost:8000/v1/chat/completions\"\n```\n\n```json\n// Example: Zero-key Antigravity (default)\n{\n  \"provider\": \"antigravity\"\n}\n```\n\n```json\n// Example: Local Self-Hosted LLM on GPU (Lemonade / vLLM / Ollama)\n{\n  \"provider\": \"openai\",\n  \"model\": \"gemma-2-9b-it\",\n  \"endpoint_url\": \"http://localhost:8000/v1/chat/completions\",\n  \"api_key\": \"optional-local-token\"\n}\n```\n\n### Complete Configuration Levers Reference\n\n#### 1. JSON Policy Configuration Levers (`config.json`, `config.local.json`, `session_overrides.json`)\n\n| Configuration Field | Type | Default | Description |\n| :--- | :--- | :--- | :--- |\n| `bundles` | `array[string]` or `object` | `[]` | Active permission bundles (`[\"git-inspect\", ...]` or `{\"enabled\": [...], \"disabled\": [...]}`). |\n| `custom_bundles` | `object` | `{}` | Inline custom bundle definitions dictionary. |\n| `provider` | `string` | `\"google\"` | Classification provider/protocol (`\"google\"`, `\"antigravity\"`, `\"cloudcode\"`, `\"openai\"`, `\"anthropic\"`; aliases `gemini`, `claude`, `oauth`). |\n| `model` | `string` | `\"gemini-2.5-flash\"` | Target LLM model name (e.g. `gemini-2.5-flash`, `gpt-4o-mini`, `claude-3-5-haiku-20241022`, or an Antigravity roster token). |\n| `endpoint_url` | `string` | *Provider default* | Custom REST API endpoint URI (e.g. local vLLM/Lemonade/Ollama or reverse proxy). |\n| `api_key` | `string` | `null` | Direct API token string (recommended only in `config.local.json`). |\n| `api_key_env` | `string` | *Provider default* | Name of custom environment variable holding the API key. |\n| `allow` | `array[string]` | `[]` | Static ACL rules auto-approved in `0.1ms` without invoking LLM classifier. |\n| `ask` | `array[string]` | `[]` | Static ACL rules forcing interactive human prompt in `0.1ms`. |\n| `deny` | `array[string]` | `[]` | Static ACL rules blocked in `0.1ms` (highest priority). |\n| `custom_guidelines` | `array[string]` | `[]` | Semantic domain guidelines injected into the classifier prompt. |\n| `allowed_skill_paths` | `array[string]` | `[]` | Extra directory roots permitted for safe `0.1ms` skill file reads. |\n| `trust_workspace_writes` | `boolean` | `true` | When `true` (default), enables `0.1ms` fast-path for non-sensitive workspace writes. |\n| `show_turn_summary` | `boolean` | `true` | When `true` (default), appends turn-scoped collapsible security gate summary table to final response. |\n| `disclose_turn_summary` | `boolean` | `true` | Alias for `show_turn_summary`. |\n| `show_turn_summary_detail` | `boolean` | `true` | When `true` (default), includes detailed per-action table in summary. When `false`, outputs concise single-line summary header only. |\n| `disclose_turn_summary_detail` | `boolean` | `true` | Alias for `show_turn_summary_detail`. |\n| `govern_subagents` | `boolean` | `false` | When `true`, intercepts `invoke_subagent` and evaluates via classifier. |\n| `govern_schedule` | `boolean` | `false` | When `true`, intercepts `schedule` (cron/timers) and evaluates via classifier. |\n| `govern_images` | `boolean` | `false` | When `true`, intercepts `generate_image` and evaluates via classifier. |\n| `govern_surfaces` | `array[string]` | `[]` | Array alias for toggling governed surfaces (`[\"subagents\", \"schedule\", \"images\"]`). |\n\n#### 2. Environment Variable Levers\n\n| Environment Variable | Default | Purpose |\n| :--- | :--- | :--- |\n| `GEMINI_API_KEY` / `GOOGLE_API_KEY` | - | Primary API key for Google Gemini provider. |\n| `OPENAI_API_KEY` | - | API key for OpenAI-compatible endpoints. |\n| `ANTHROPIC_API_KEY` | - | API key for Anthropic Claude provider. |\n| `AUTO_PERMISSIONS_API_KEY` | - | Generic provider API key override. |\n| `AUTO_PERMISSIONS_PROVIDER` | - | Override active provider globally (`google`, `antigravity`, `cloudcode`, `openai`, `anthropic`). |\n| `AUTO_PERMISSIONS_MODEL` | - | Override active model identifier globally (or `GEMINI_MODEL`, `OPENAI_MODEL`, `ANTHROPIC_MODEL`). |\n| `AUTO_PERMISSIONS_ENDPOINT_URL` | - | Override custom REST endpoint globally (or `OPENAI_BASE_URL`, `ANTHROPIC_BASE_URL`). |\n| `AUTO_PERMISSIONS_TRUST_WORKSPACE_WRITES` | `1` | Override workspace write fast-path (`1`/`0` or `true`/`false`). |\n| `AUTO_PERMISSIONS_SHOW_TURN_SUMMARY` | `1` | Override turn-scoped security gate disclosure table (`1`/`0` or `true`/`false`). |\n| `AUTO_PERMISSIONS_DISCLOSE_TURN_SUMMARY` | `1` | Alias for `AUTO_PERMISSIONS_SHOW_TURN_SUMMARY`. |\n| `AUTO_PERMISSIONS_SHOW_TURN_SUMMARY_DETAIL` | `1` | Override summary action table detail (`1`/`0` or `true`/`false`). |\n| `AUTO_PERMISSIONS_SUMMARY_DETAIL` | `1` | Alias for `AUTO_PERMISSIONS_SHOW_TURN_SUMMARY_DETAIL`. |\n| `AUTO_PERMISSIONS_DISCLOSE_TURN_SUMMARY_DETAIL` | `1` | Alias for `AUTO_PERMISSIONS_SHOW_TURN_SUMMARY_DETAIL`. |\n| `AUTO_PERMISSIONS_TIMEOUT` | `6.0` | HTTP classifier timeout in seconds (or `AUTO_PERMISSIONS_TIMEOUT_SECS`). Configurable via policy files (`timeout`) or CLI. |\n| `AUTO_PERMISSIONS_GOVERN_SUBAGENTS` | `0` | Set `1` to enable classifier evaluation for `invoke_subagent`. |\n| `AUTO_PERMISSIONS_GOVERN_SCHEDULE` | `0` | Set `1` to enable classifier evaluation for `schedule`. |\n| `AUTO_PERMISSIONS_GOVERN_IMAGES` | `0` | Set `1` to enable classifier evaluation for `generate_image`. |\n| `AUTO_PERMISSIONS_GOVERN_SURFACES` | - | Comma-separated list of surfaces to govern (e.g. `subagents,schedule,images`). |\n| `AUTO_PERMISSIONS_SESSION_DIR` | - | Override session directory path for audit logs and overrides (or `ANTIGRAVITY_ARTIFACT_DIR`). |\n| `AUTO_PERMISSIONS_SIDECAR_PORT` | `4020` | Loopback port for the bundled plugin sidecar (shared default between the hook and the sidecar). |\n| `AUTO_PERMISSIONS_TEMPERATURE` | `0.0` | OpenAI-wire sampling temperature (0 = deterministic verdicts). |\n| `AUTO_PERMISSIONS_TOP_P` | `1.0` | OpenAI-wire nucleus sampling (1.0 = stable at temp 0). |\n| `AUTO_PERMISSIONS_TOP_K` | - | OpenAI-wire top-k sampling (only sent when set; `-1`/`0` = off on llama.cpp-style backends). |\n| `AUTO_PERMISSIONS_MAX_TOKENS` | `800` | OpenAI-wire output cap bounding thinking/latency (`0` = server default). |\n| `AUTO_PERMISSIONS_SEED` | - | OpenAI-wire fixed seed for reproducible verdicts (when supported). |\n| `AUTO_PERMISSIONS_REASONING_EFFORT` | - | Reasoning effort passthrough (`low`/`medium`/`high`) for thinking-capable local models. |\n| `AUTO_PERMISSIONS_JSON_MODE` | `1` | OpenAI-wire `response_format: json_object` (set `0` for servers that reject it). |\n\n---\n\n## Directory Structure\n\n```text\nauto-permissions/\n├── LICENSE                                  # MIT License\n├── plugin.json                              # Manifest metadata\n├── hooks.json                               # Lifecycle hook configuration\n├── pyproject.toml                           # uv project and test configuration\n├── .agents/\n│   └── auto-permissions/\n│       ├── config.json                      # Project-level static ACL grants & active bundles (tracked)\n│       ├── config.local.json                # Local untracked secrets & overrides (gitignored)\n│       ├── bundles/                         # Project-specific custom bundles (tracked)\n│       └── bundles.local/                   # Project-specific local custom bundles (untracked)\n├── hooks/\n│   ├── bundles/                             # Built-in zero-dependency bundles\n│   │   ├── __init__.py                      # Bundle loader and registry\n│   │   ├── git_inspect.json                 # git-inspect bundle\n│   │   ├── gh_readonly.json                 # gh-readonly bundle\n│   │   ├── python_tooling.json              # python-tooling bundle\n│   │   ├── rust_tooling.json                # rust-tooling bundle\n│   │   ├── node_tooling.json                # node-tooling bundle\n│   │   ├── container_inspect.json           # container-inspect bundle\n│   │   ├── dev_docs_read.json               # dev-docs-read bundle\n│   │   └── mcp_nmem.json                    # mcp-nmem bundle\n│   ├── auto_approve_gate.py                 # Main PreToolUse entrypoint\n│   ├── pre_invocation.py                    # PreInvocation dynamic summary injector\n│   ├── policy_engine.py                     # Fast-path static policy evaluation & scoping\n│   ├── classifier.py                        # Multi-provider security classifier\n│   ├── transcript_parser.py                 # Token-efficient user prompt extractor\n│   └── audit_logger.py                      # Async rotatable JSONL audit logger\n├── rules/\n│   └── auto_permissions.md                  # Agent operational guidance rule\n├── skills/\n│   ├── auto-permissions-configure/\n│   │   ├── SKILL.md                         # Interactive policy & provider configuration\n│   │   └── scripts/\n│   │       └── configure_permissions.py    # Policy configuration CLI\n│   ├── auto-permissions-audit/\n│   │   ├── SKILL.md                         # Audit inspection procedure\n│   │   └── scripts/\n│   │       └── view_audit.py                # Audit log summary CLI\n│   ├── auto-permissions-fix/\n│   │   ├── SKILL.md                         # ACL rule generator from denials (policy remediation)\n│   │   └── scripts/\n│   │       └── fix_permissions.py          # Policy rule fixer CLI\n│   └── auto-permissions-test/\n│       ├── SKILL.md                         # Policy & classifier simulation procedure\n│       └── scripts/\n│           └── test_permission.py          # Classifier simulation CLI\n├── docs/\n│   ├── index.md                             # OKF 0.2 Wiki root catalog & concept graph\n│   ├── logs.md                              # Knowledge evolution & provenance log\n│   ├── architecture.md                      # Comprehensive technical architecture\n│   ├── architecture/                        # Modular architecture specifications\n│   ├── guides/                              # Developer & operational guides\n│   ├── skills/                              # Agent skills reference & workflows\n│   ├── benchmarks/                          # Empirical benchmarks & latency analysis\n│   └── reference/                           # Policy schemas, bundle catalog & rule syntax\n└── tests/\n    ├── test_bundles.py                      # Unit tests for permission bundles & resolution\n    ├── test_configure_skill.py              # Unit tests for configure CLI\n    ├── test_transcript_parser.py\n    ├── test_audit_logger.py\n    ├── test_classifier.py\n    ├── test_policy_engine.py\n    ├── test_pre_invocation.py\n    ├── test_fix_permissions.py\n    ├── test_permission_skill.py\n    ├── test_package_plugin.py\n    └── test_gate_e2e.py\n```\n\n---\n\n## Running Tests & Static Analysis\n\nRun the automated test suite with `uv`:\n```bash\nuv run pytest -v\n```\n\nVerify formatting and linting:\n```bash\nuv run ruff check .\nuv run ruff format --check .\n```\n\n---\n\n## Security Layers: Plugin Gate vs. Platform Container Sandbox\n\nGoogle Antigravity enforces security across two distinct layers:\n\n```text\n[ Proposed Tool Call ]\n         │\n         ▼\n┌─────────────────────────────────────────────────────────────┐\n│ Layer 1: auto-permissions Plugin Gate (Intent Authorization)│\n│  - Evaluates user prompt vs proposed tool action.           │\n│  - Emits: allow, ask, or deny.                              │\n└────────────────────────┬────────────────────────────────────┘\n                         │ (allow)\n                         ▼\n┌─────────────────────────────────────────────────────────────┐\n│ Layer 2: Antigravity Container Sandbox (System Isolation)   │\n│  - Sandboxed (BypassSandbox: false): Workspace isolated,    │\n│    .git/ mounted as read-only.                              │\n│  - Unsandboxed (BypassSandbox: true): Required for commands │\n│    writing to .git/ (git commit, git merge, git checkout).  │\n│  - Triggers host platform confirmation modal.               │\n└─────────────────────────────────────────────────────────────┘\n```\n\n### Why does `git commit` trigger a host prompt even if the plugin auto-approves it?\n1. The **`auto-permissions` gate (Layer 1)** checks your prompt and auto-approves the commit because you explicitly requested it.\n2. The **Antigravity container sandbox (Layer 2)** protects `.git/` by mounting it read-only.\n3. When git commands write to `.git/`, the tool must run unsandboxed (`BypassSandbox: true`), which causes the **Antigravity host IDE** to display an interactive platform modal.\n\n### How to Mitigate\n* When the Antigravity Sandbox bypass modal appears for `git commit`, click **\"Always allow for this workspace\"**.\n* This whitelists unsandboxed execution for that command pattern in your workspace, allowing subsequent commits to run completely unattended.\n\n---\n\n## License\n\nThis project is licensed under the [MIT License](LICENSE).\n",
  "bytes": 28769,
  "sha": "9f5d6fef42d9a222b1a00f4fb446afaeffbe1d0908f8710ca38154aac926c23a",
  "repo_slug": "abn/google-antigravity-plugin-auto-permissions",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_abn_google_antigravity_plugin_auto_permi_c6625cf7/readme"
}