AI 程式工具
Antigravity CLI 1.1.7 Stops Disabled Plugins from Running Hooks and Adds Full Context to Compound Command Approvals
Google has fixed an issue in Antigravity CLI where hooks, rules, and other custom components continued to load after a plugin was disabled, preventing broken or untrusted scripts from continuing to interfere with agent workflows. The new version also displays compound shell commands in full when approval is required, but relaxes OAuth issuer validation for compatibility with non-standard MCP providers—a change that deployers should review separately.
Google has released Antigravity CLI 1.1.7, fixing a lifecycle bug that directly affected the boundaries of agent customization: after users disabled a plugin in settings, its hooks and other custom components could still be loaded. Because Antigravity plugins can include skills, rules, MCP server configurations, and `hooks.json`—and hooks can launch commands before and after model calls and tool execution, as well as when an agent stops—this was more than a UI state synchronization issue. Broken code, or code users intended to revoke, could continue modifying prompts, interfering with file tools, or causing external side effects.
Version 1.1.7 ensures that a disabled plugin can no longer contribute hooks or other customizations. The official documentation already specifies that an individual hook can be disabled with `enabled: false`, with supported events including `PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, and `Stop`. After upgrading, teams using workspace-level `.agents/plugins/` or global `~/.gemini/config/plugins/` directories should still check both locations for duplicate plugins and use an unprivileged test workspace to confirm that disabled scripts no longer generate process or network activity.
The release also updates the command approval interface. When only some segments of a compound shell command require authorization, the prompt now displays the complete command rather than only the portion determined to require approval. This allows users to see pipelines, redirections, and the side effects of adjacent command segments, providing better context for human review. Headless mode also adds `cache_read_tokens`, allowing CI or cost-tracking systems to separately measure prompt cache hits.
Another change warrants a risk assessment from the opposite direction. To support MCP OAuth providers such as Salesforce and Atlassian that do not strictly follow the specification, the CLI relaxes issuer validation and adds the `refresh_token` grant. This may improve connection success rates, but it also broadens the range of identity metadata accepted by the client. Enterprises using agents to connect to internal MCP services should retest issuer handling, redirect URIs, token storage, and revocation policies rather than treating the “compatibility fix” as a security enhancement.