Antigravity CLI & IDE Lifecycle Hooks

ctxsec integrates directly into Google Antigravity (CLI, 2.0, and IDE) using native lifecycle hooks configured in .agents/hooks.json.

---

Configuration (.agents/hooks.json)

Configure the PreToolUse hook to route command execution and file write attempts through ctx hook:

{
  "ctxsec-guard": {
    "enabled": true,
    "PreToolUse": [
      {
        "matcher": "run_command|write_to_file|replace_file_content",
        "hooks": [
          {
            "type": "command",
            "command": "../bin/ctx hook --format=antigravity",
            "timeout": 5
          }
        ]
      }
    ]
  }
}

Working Directory Context

Antigravity executes lifecycle hooks with the working directory set to .agents/. If invoking a local binary under the workspace root, specify ../bin/ctx or provide the full absolute path.

---

The Hook Evaluation Lifecycle

sequenceDiagram
    participant AG as Antigravity Agent
    participant Hook as ctx hook
    participant Policy as CEL Evaluator

    AG->>Hook: JSON ToolCall Payload on stdin
    Note over Hook: Parse tool name, args, caller role
    Hook->>Policy: Evaluate ctxsec.yaml CEL rules
    alt Blocked
        Policy-->>Hook: Decision: DENY / Reason
        Hook-->>AG: {"decision": "deny", "reason": "Policy violation"}
        Note over AG: Agent tool call hard blocked
    else Require Confirmation
        Policy-->>Hook: Decision: ASK
        Hook-->>AG: {"decision": "ask", "reason": "Requires user confirmation"}
    else Allowed
        Policy-->>Hook: Decision: ALLOW
        Hook-->>AG: {"decision": "allow"}
        Note over AG: Execution proceeds
    end

Hold "Alt" / "Option" to enable pan & zoom