Antigravity CLI Print Mode for QA: Audit Guardrails Without an Agent Turn

Antigravity CLI print mode for QA gives test teams a low-impact way to inspect important agent guardrails before an AI-assisted task begins. Current Google documentation supports read-only slash commands such as /permissions, /hooks, /config, /help, and /changelog in non-interactive print mode. They can return text, JSON, or streaming JSON without starting an agent turn, consuming model quota, or leaving a conversation behind.

That makes print mode useful for a preflight audit, but it is not a security certificate. QA still has to verify the effective configuration, normalize machine output, test precedence and failure paths, protect sensitive paths in artifacts, and require a human to approve policy changes.

What this tutorial builds

You will create a disposable guardrail audit that captures five read-only inventories, compares them with a reviewed baseline, flags risky changes, and proves that the audit itself does not launch an agent conversation. The workflow is intentionally evidence-only: it does not edit permissions, enable hooks, run an MCP tool, actuate a browser, or skip approvals.

The audit contract is:

Given a known Antigravity CLI installation and reviewed workspace, collect supported read-only guardrail state, validate the response shape, redact sensitive values, compare semantic policy invariants, and fail visibly on missing, malformed, ambiguous, or unexpected output without changing agent configuration.

Why print mode is safer than asking the model

The official Antigravity changelog documents direct non-interactive answers for supported read-only slash commands. This distinction matters. If a command is supported, the CLI answers it as a command rather than sending the text to a model and accepting a plausible description of the configuration.

The current changelog also says remaining interactive-only slash commands are explicitly refused in print mode instead of falling through as literal prompt text. Treat that refusal as a testable boundary. A made-up success response is worse than a clear unsupported-command error because it can make a QA gate trust state that was never inspected.

Step 1: freeze the audit context

Before collecting output, record an audit ID, timestamp, operating system, CLI build, working directory, repository commit, active workspace roots, authentication mode, configuration file hash, and the exact commands you will run. Use a repository with synthetic paths and no production secrets for the first trial.

Antigravity CLI stores persistent preferences in ~/.gemini/antigravity-cli/settings.json, but Google describes this file as sparse: values equal to system defaults may not be written. Therefore, a file-only review can miss effective defaults. Capture the raw settings file hash and the effective /config output as separate evidence.

Step 2: discover what the installed build supports

Start with help rather than assuming every installation exposes the same read-only command set:

agy -p "/help" --output-format json

The official changelog says /help lists the commands that print mode can answer. Save that result with the build identifier. If a planned command is missing, mark the audit unsupported for that build; do not silently send it as a normal prompt.

Google currently documents read-only print answers for permissions, hooks, help, changelog and config, plus account or runtime views including usage, quota, credits, model, effort and skills. Use the installed help response as the source of truth because rollout timing and supported commands can change.

Step 3: capture the core inventories

Run each collection separately so one failure cannot hide another:

agy -p "/permissions" --output-format json
agy -p "/hooks" --output-format json
agy -p "/config" --output-format json
agy -p "/changelog" --output-format json

Keep standard output and standard error separate. Antigravity headless documentation says responses go to standard output while diagnostics such as errors, authentication notices, progress, and permission messages go to standard error. A parser should reject mixed or truncated output rather than guessing where JSON ends.

Do not hard-code a guessed JSON schema from a screenshot. Capture one reviewed specimen from the installed build, document required fields and types, then validate future runs against that adapter. Preserve the original payload alongside the normalized report so reviewers can audit the transformation.

Step 4: normalize permission rules semantically

Antigravity permissions use action(target) resources across Deny, Ask, and Allow lists. Current documentation states that conflicts are evaluated in the order Deny, then Ask, then Allow. A broad Ask rule can therefore override a narrow Allow rule. Sorting strings alone will not tell you the effective behavior.

Normalize every rule into these fields:

Field	Purpose
scope	Global, project, shared, or other reported source
decision	Deny, Ask, or Allow
action	Command, file read/write, URL read/execute, MCP, or unsandboxed command
target	Normalized target without secret values
source_hash	Traceability to the raw inventory
review_status	Approved baseline, new, changed, removed, or ambiguous

Test important implications too. The permissions guide says allowing a write for a path implies read access to that same path, while denying read also denies write. It also documents default Ask behavior for web access and other unconfigured actions, with workspace file behavior governed by system defaults and active safety settings. Audit both the rule lists and active toolPermission, sandbox, and non-workspace settings before predicting behavior.

Step 5: test cross-platform path handling

Windows deserves a dedicated fixture. Google documents that Windows drive letters are stripped and backslashes are converted to forward slashes before permission evaluation. Create synthetic equivalent paths such as a Windows-style workspace path and its normalized form, then confirm your comparison logic treats them consistently.

Do not normalize away meaningful boundaries. A rule for one project directory must not become equivalent to a parent directory, a sibling repository, or a global wildcard. Flag * targets and non-workspace access for explicit human review.

Step 6: audit hooks as executable supply-chain inputs

The /hooks inventory identifies active pre-flight or post-format handlers. For each reported hook, capture its source, event, command or handler reference, enabled state, configuration hash, script hash when locally available, and whether the referenced file is writable by an unexpected principal.

Seed a benign test hook in a disposable profile and verify it appears exactly once. Then disable or remove it and confirm the normalized inventory changes. Test duplicate names, missing scripts, unreadable paths, malformed configuration, and a path containing spaces. Never execute an unreviewed hook merely to prove it exists.

Redact environment values and credentials before uploading evidence. A machine-readable inventory can reveal usernames, local paths, server names, plugin layout, and other operational details even when it does not include a secret directly.

Step 7: compare invariants, not entire files

Exact snapshots are brittle because ordering, new harmless fields, sparse defaults, and build changes can create noise. Define high-value invariants instead:

• No global wildcard is newly allowed for commands, MCP, URLs, or files.
• Destructive command patterns remain denied or require review.
• Production domains are not auto-actuated.
• Non-workspace file access remains off unless a reviewed exception exists.
• Terminal sandbox and tool-permission modes match the approved profile.
• Every active hook has a reviewed source and stable hash.
• No unknown plugin or skill silently expands the command surface.
• Interactive-only commands are refused in print mode.

Store a hash of the normalized evidence, adapter version, rule set, raw payload hashes, and reviewer identity. A change should produce a small explainable diff rather than a wall of reordered JSON.

Step 8: prove the no-agent-turn property

The official changelog says supported read-only print commands do not start an agent turn, spend quota, or leave a conversation. Verify this on your build instead of merely repeating the claim.

1. Capture /usage or /quota in supported print mode before the audit.
2. Record the current conversation inventory or local state using an approved read-only method.
3. Run the five audit commands.
4. Capture the same usage and conversation evidence afterward.
5. Require no new agent conversation and no model-token delta attributable to the commands.

Allow for account refresh timestamps and unrelated concurrent activity. Run the experiment in an isolated test profile if other sessions could change the same counters.

Step 9: exercise negative and corruption cases

A reliable audit must fail closed and explain why. Test:

• Unauthenticated execution: expect a clear authentication error instead of a hang.
• Unsupported slash command: expect explicit refusal, not a model-generated answer.
• Malformed or truncated JSON: reject the collection and retain standard error.
• Unexpected schema version or missing inventory: mark the gate indeterminate.
• Oversized output: preserve the full file and prevent parser memory exhaustion.
• Non-zero exit: record failure even if a partial payload exists.
• Concurrent settings edit: detect before-and-after hashes and retry only after review.
• Adapter bug: compare raw and normalized counts and keep fixtures for regression tests.

For general headless agent prompts, Google notes that a tool requiring an unavailable interactive approval can be soft-denied while the overall run still exits zero. This read-only command audit should not invoke tools, but the broader lesson still applies: never use exit code alone as proof that every requested check occurred. Validate the expected payload and inventory contents.

Step 10: add a human-reviewed CI gate

Run the audit in a protected preflight job before any agent-enabled QA workflow. The job should collect evidence, validate schemas, apply invariant tests, publish a redacted diff, and stop on new high-risk access. It should not automatically rewrite the user’s settings or approve the requested change.

Require two outputs: a machine result for CI and a compact reviewer report showing what changed, effective risk, source evidence, owner, expiry date for exceptions, and rollback instructions. A reviewer can then approve the guardrail state before a separate job invokes tests or an agent.

QA rollout checklist

• Installed build and supported print commands are captured from /help
• Raw settings hash and effective config output are both retained
• Standard output and standard error are captured separately
• JSON shape is validated against a versioned adapter
• Deny, Ask, and Allow precedence is evaluated semantically
• Windows and Unix path fixtures are tested
• Wildcards, non-workspace access, web actuation, MCP, and unsandboxed commands require review
• Hooks have reviewed sources and hashes
• Sensitive paths and values are redacted from artifacts
• No agent turn, quota spend, or new conversation is independently checked
• Unsupported commands, auth failure, malformed output, and concurrent edits fail visibly
• CI reports drift but does not rewrite policy
• Humans approve exceptions, agent execution, merge, and release

Official sources

• Google Antigravity changelog
• Antigravity CLI headless mode
• Antigravity CLI permissions
• Antigravity CLI reference
• Antigravity CLI settings

Print mode turns guardrail state into useful QA evidence only when the collection is scoped, machine output is validated, policy meaning is tested, and risky changes remain human decisions. Treat the audit as a preflight signal—not permission to trust every later agent action.