Gate CLI tool calls with policy-driven auto-approval

agy-auto is a PreToolUse hook and security harness for Antigravity CLI. It evaluates pending tool calls through a sequence of policy layers intended to support reviewed unattended execution. The design combines deterministic denials, deterministic allowance of parsed read-only or workspace-confined operations, classifier review for ambiguous commands, and narrowly scoped human approvals.

Hard-deny examples include credential reads, recursive deletion outside the workspace, Git history rewrites, package publishing, system configuration writes, and attempts to modify the gate itself. Fast-allow rules handle known operations without a model call. Ambiguous calls use a configured cloud model or local llama.cpp or Ollama endpoint, with timeout treated as a denial.

This workflow requires an already installed tool whose exact version, complete dependencies, and integrity have been reviewed. It does not bootstrap or activate plugins. A missing prerequisite stops the executable path; static review can continue.

Use when evaluating unattended Antigravity workflows, granular shell and file permissions, or auditable controls within a verified workspace boundary. The harness does not justify bypassing native permissions merely because a hook exists.

Retain the native gate unless the exact CLI-and-hook combination has been shown to fail closed when hooks are missing, broken, or tampered with, and the user explicitly authorizes the host permission change. The documented always-proceed setting can remove effective protection when hook enforcement fails. A classifier is not policy or merge authority.

Inputs are the pending tool, normalized command, working directory, workspace boundary, policy, and relevant conversation context. Calls receive an allow, deny, or approval requirement. A six-character approval token is single-use and bound to the specific tool, command, and directory; conversational yes or proceed responses do not authorize it.

The headless usage example declares its workspace explicitly:

agy --add-dir . -p "Run test suite and fix failing cases"

Without --add-dir, headless invocations may report that a path is outside the workspace. This example assumes the reviewed prerequisite and authorized configuration already exist.

Classifier setup can use a currently available provider or a local compatible endpoint. Verify cloud pricing and private-context transmission before choosing a remote backend. Local timeouts may need adjustment, but timeout behavior must remain fail-closed.

Before activation, validate disposable allowed and denied fixtures covering path or symlink escape, shell expansion, network requests, missing hooks, classifier timeout, and token replay. Preserve a tested disable or rollback path. A unit-test pass alone does not establish interception of all host access.

The hook covers tool calls, not Antigravity's internal context reads or internal network reasoning. Complex shell constructs can require classifier or manual approval. Self-protected policy files need direct human-shell maintenance rather than edits through the guarded tool path.