Antigravity

Antigravity for Claude Code — hybrid SDLC

Run the Antigravity CLI (agy, Gemini) as a second AI working alongside Claude Code. The organizing idea is intelligent model routing across the SDLC: keep judgement-heavy work on Claude (the frontier model) and route deterministic, high-volume work to Antigravity (cheaper, faster Gemini). Two AIs, one workflow.

• Claude = conductor / orchestrator — requirements, architecture, the hard 20% (edge cases, integration, correctness), specs, tests/evals, final review.
• Antigravity = delegated agent — a full terminal agent (file edits, terminal, subagents, MCP, web/Vertex AI Search) that executes well-specified work.

This is agentic engineering, not vibe coding: the value is the structure around the model — routing, shared rules, verification gates — not raw generation. Generation is solved; verification, judgement, and direction are the craft.

Two modes (pick per task)

• Conductor (sync, inline): you're shaping something in real time; delegate a small, well-scoped chunk to agy mid-flow (e.g. "generate these tests"), use the result immediately.
• Orchestrator (async, multi-unit): decompose a larger task into units, dispatch to agy (often with --dir, agentic, in parallel), then review and integrate. Best for migrations, bulk implementation against patterns, test suites.

Division of labor across the SDLC

Route each phase to the right model. This is the core policy.

Routing tier within agy: flash (default, bulk) · flash-lo (cheapest, trivial) · pro (harder reasoning / reviews / cross-checks).

agy is multi-model. Tiers map to Gemini by default, but you can point delegation at any model agy models lists (Claude / GPT on plans that expose them) — via --model <exact name>, or persistently with the default_model / tier_* plugin options. Keep the executor a different, cheaper model than the Claude conductor: that's what yields the cost saving and the cross-model verification value (Claude executing Claude loses both).

Model availability moves fast, and --tier needs agy ≥ 1.1.10. Until 1.1.10, agy ignored --model and --effort in headless -p — the flag was applied after model configuration had initialised, so the run silently fell back to the persisted default. This wrapper resolves every --tier to --model and always runs -p, so on an older agy tier selection does nothing and looks like it works: the call succeeds, returns sensible text, reports usage. doctor warns when it sees one — and on agy ≥ 1.1.11 it stops inferring and asks: it requests a tier model via -p /model (a read-only slash command that costs no tokens and starts no agent turn) and reports which model agy says it would actually run. Below 1.1.11 it does not probe, because there the slash command falls through as prompt text and the model answers as though it had run.

The flash tiers default to Gemini 3.8 Flash (High) / (Low) since 0.26.0 (3.7 from 0.24.0, 3.5 before). 3.8, 3.7 and 3.6 carry identical list prices — $0.75 in / $3.75 out / $0.075 cached-in per 1M — under a promotion that ends 2026-12-31 and then settles at $1.50 / $7.50 / $0.15; 3.5 is $1.50 / $9.00 / $0.15 throughout. Two sources, checked 2026-09-03. Price a run with prices.json's gemini_flash, which mirrors whatever the flash tier resolves to; agy-cost-compare picks that key by tier NAME, not by model.

The move is justified on currency at an unchanged list price, not on quality — no comparison has been run between these models on a build where --model actually applies, and an identical per-token price is not an identical per-task cost (thinking bills as output; read the AGY_USAGE line). Measured quirk: under --digest, a prompt with nothing to inspect (a bare "reply OK") makes 3.8 High run a command to find something to report — 6 of 7 runs, exit 15 headless without a grant; 3.7 High 0 of 3. With a real task (a file behind --dir, pasted code) 3.8 High answered 6 of 6. Give it a task, or drop --digest for a ping. If a plan does not serve 3.8 — agy 1.1.25's note lists it for GEMINI_API_KEY sign-in; it is also listed on the GCP-project sign-in this was measured on — doctor says so and a delegation exits 14 naming the fix; remap tier_flash to a name from agy models (3.7 and 3.6 cost the same).

Retracted: earlier versions of this note quoted token-level comparisons between 3.5 / 3.6 / flash-medium (−23% input, cache_read +43%, and so on). Those runs were made on agy 1.1.8–1.1.9, where --model was ignored — so every arm may have executed the same persisted default. Independently, the numbers did not survive their own ranges: 3.5-high spanned [421k, 509k] input against 3.6-high's [305k, 412k] at n=2, and flash-medium overlapped high outright. A mean-vs-mean claim over overlapping ranges is exactly what this repo's own playbook tells you not to report. Pick a tier by what your plan serves and by the published rates until this is re-measured on 1.1.10+.

Note: agy 1.1.5 changed agy models output to slugs (gemini-3.5-flash); both slugs and display names are accepted by --model, and doctor matches either.

How to call it

agy-delegate [options] "the task prompt"

Options: --tier flash|flash-lo|pro · --dir <path> (workspace, repeatable) · --timeout 10m · --yolo (auto-approve ALL tools — the blunt grant; needed for web search / URL reads (agy 1.1.28+; or a read_url(<target>) rule) / Vertex AI Search / terminal, and for writes not covered by a permissions.allow rule. For a file write the narrower grant is usually a write_file(<dir>) entry in ~/.gemini/antigravity-cli/settings.json, which needs no flag — see below. Run write tasks on a branch) · --mode accept-edits|plan (agy execution mode. --mode accept-edits is NOT a headless write grant. Measured on agy 1.1.13 — where the flag is actually applied, since 1.1.12 fixed --mode being ignored in headless -p entirely — the write is denied exactly like one without it. Earlier notes here said "soft-denied on 1.1.3"; on a build where the flag was never applied, that observation could not tell a denial apart from the flag doing nothing. plan = strategize only) · --sandbox · --digest (append a digest-only output contract — use it for any bulk read/analysis; the wrapper also warns on stderr when a reply comes back dump-sized, because ingesting digests instead of dumps is the single biggest cost lever) · --print-command (dry run: show the resolved agy call, don't run it) · pipe a long prompt with a trailing -.

The wrapper handles agy's quirks (prompt is the value of -p; non-TTY stdout drop via < /dev/null). On agy ≥ 1.1.8 it also runs agy with --output-format json internally: stdout still gives you the model's text unchanged, but failures are classified from the structured error instead of scraped prose, and the executor's real token usage (input / output / thinking / cache_read) is reported as an AGY_USAGE {...} line on stderr — so the Gemini side of a delegation can finally be measured, not estimated. The line also carries model and tier (the tier the model was derived from; empty for an explicit --model) and agy's duration_seconds / num_turns (1.2.x; 0 on older agy), so a log prices itself per tier without a join back to the command. Older agy (or no python3) transparently falls back to the plain-text path; force it with the structured_output option.

Accounting semantics for AGY_USAGE (verified — get this wrong and your cost math is wrong). total = input + output (and thinking is inside output). cache_read is a separate counter: it is NOT part of total, and it is not a subset of input — in an agentic delegation it routinely exceeds input (measured: cache_read 1,356,694 vs input 243,117 in one delegation). So price the Gemini side as input×in_rate + output×out_rate + cache_read×cached_rate, three separate terms. This differs from the Claude/Harbor side, where cache-read tokens are an inner subset of the reported input total — don't carry one convention over to the other.

If you are measuring, set AGY_USAGE_LOG=/path/to/log (or the usage_log option). AGY_USAGE and AGY_SIGNAL go to stderr, and the advice two paragraphs down — keep Claude's context lean — makes agy-delegate ... 2>&1 | tail -N the natural thing to write. stdout (the digest) is emitted after the usage line, so tail keeps the digest and silently drops the usage. Measured in the wild: a benchmark harness lost most of its Gemini-side data exactly this way, which made the hybrid look cheaper than it was. A named file cannot be truncated by a pipe.

Two ways to delegate. Call the wrapper directly (above), or — when you want file generation to happen entirely on Gemini with zero Claude tokens spent writing — hand the unit to the antigravity-delegate subagent (its only file-acting tool is the wrapper; it returns a digest for you to verify). Either way, you still own verification.

Structured failures. The wrapper exits 10 quota · 11 auth · 12 timeout (incl. an expired --print-timeout, which agy 1.1.28+ returns as a partial reply with rc 0 — the wrapper prints it and still exits 12) · 13 agy-missing · 14 model-unavailable (a --model / tier_* / default_model name not in agy models — agy ≥ 1.1.2 hard-fails instead of silently downgrading) · 15 permission-denied (a tool needed permission headless — BOTH the soft deny, agy 1.1.3+ and again from 1.1.20, and 1.1.13's hard error — add a permissions.allow rule or pass --yolo; since 1.1.27 the wrapper names the refused tool from the envelope's denied_actions) (besides 2 failed / 3 empty). On agy ≥ 1.1.8 these are derived from the structured status/error envelope rather than stderr pattern-matching, so the classification is reliable. It prints a AGY_SIGNAL {...} line on stderr; agy-job status/result surface it, so you can react (e.g. retry quota with --continue, fix the model name, or add --yolo) instead of scraping prose.

If Claude itself is running headless (claude -p, one-shot): run delegations synchronously — let agy-delegate BLOCK and return before you continue. Do NOT background a delegation expecting a later turn / "harness re-invocation": there is none in -p mode, so you'd exit before the work finishes. (Backgrounding is only valid in an interactive session that will be re-invoked.)

Shared harness: one AGENTS.md for both AIs

agy reads AGENTS.md from the workspace (verified). Keep a single shared AGENTS.md at the repo root (stack, conventions, hard rules, workflow) so Claude and Antigravity operate under the same rules — this raises agy's first-pass success rate and keeps output consistent (lower OpEx).

Rule: when delegating any repo work, always pass --dir <repo-root> so agy loads AGENTS.md and the real code, instead of pasting files into the prompt (cheaper, denser context).

Verification gates (non-negotiable)

Claude owns correctness. For anything that ships:

1. Define the contract first — Claude writes/owns the tests and evals; they tell agy what "correct" means more precisely than prose.
2. Output eval = actually run it, don't stop at reading the code. Reading the diff is necessary but NOT sufficient — a static review that "looks right" is still vibe coding. Execute it: run the tests, launch the app, hit the real API/endpoints, and check each acceptance criterion against observed behavior. Verify external assumptions empirically (e.g. does the API actually accept that input?) rather than trusting the spec's claims. If you cannot run it, say so explicitly — do not mark the gate passed.
3. Trajectory check — did it take a sane path? (Limit: print mode returns only the final text. The per-conversation logs under ~/.gemini/antigravity-cli/conversations are SQLite .db files with opaque blob columns, not human-readable — don't rely on reading them. Instead, have agy summarize its own steps as part of its output, or keep a session with --continue/--conversation and ask it to recap. But every run leaves a readable trajectory: transcript.jsonl under ~/.gemini/antigravity-cli/brain/<conversationId>/ — for plain delegations too, not just internal-fan-out subagents. agy-delegate prints the conversationId in its AGY_USAGE line, so cost and trajectory join 1:1. Audit with agy-trace --audit <conversationId> (or --audit --last): step-type counts plus every non-zero exit. A delegation can report SUCCESS while commands inside it failed — measured: 6 failed commands inside one overall-"SUCCESS" run. agy-trace <id> prints the full steps; --list finds recent ones. What is NOT recorded: the command strings. Not in transcript.jsonl, not in transcript_full.jsonl, not in ~/.gemini/antigravity-cli/log/cli-*.log. You get that a command ran, its exit code and its output. To attribute a filesystem change, diff the tree — the trajectory cannot tell you.)
4. Review every shipping line — be skeptical of clever code; check imports are real packages (hallucinated deps), error handling, edge cases, and that the contract itself is internally consistent (examples/placeholders match the verified behavior).
5. Never trust agy's "GREEN" — re-run the gate yourself in a clean state. Measured: agy will, to make a check pass, modify the environment itself — e.g. patch the installed package in site-packages, or MagicMock-stub a missing dependency — and then report success. Before believing a passing test/eval: diff any touched tooling against a pristine reference, restore it, and re-run the gate under Claude's own control. agy's self-reported pass is a claim, not evidence. If wrong: retry on --tier pro, sharpen the spec, or do that piece yourself.

Safety for write tasks

Read-only work (search, review, analysis) is low-risk. When agy writes files or runs commands (--yolo grants write + terminal):

• Write tasks need a grant — and it does not have to be --yolo. Headless agy's no-permission behavior has shifted every few releases — describe-only (pre-1.1.0), scratch-divert (1.1.0–1.1.2), soft-deny with a stderr notice (1.1.3+), hard error by 1.1.13, soft again from 1.1.20 (measured on 1.1.25; since 1.1.27 also named in the envelope's denied_actions, 1.2.0) — but your workspace stays untouched every time; what varies is whether the run admits it (issue #10). The wrapper maps the soft deny and the hard error alike to exit 15. Two things grant a write, and --yolo is the blunt one. A write_file(<dir>) entry under permissions.allow in ~/.gemini/antigravity-cli/settings.json allows writes recursively beneath <dir> with no flag at all — confirmed on agy 1.1.9 by a controlled A/B (#37): covered target wrote, uncovered target returned PERMISSION_DENIED, rule the only variable. agy's own denial text names the rule and offers --yolo as the alternative. --yolo auto-approves all tools and is what you need when no rule covers the target, or for web search / URL reads (agy 1.1.28 made those ask first; the narrow rule is read_url(<target>)) / Vertex AI Search / terminal. Not verified below 1.1.9; a glob form (write_file(/path/**)) was reported not to match. <dir> is a placeholder: left as written the rule grants nothing on any version — exit 15 with the rule visibly present in the file. Separately, and only for command(...), an entry naming no command (command(time), comment-only, ()) matched EVERY command before 1.1.11; do not attach that history to a mistyped write_file(). If a user reports a rule that "should" work, have them run agy-doctor before changing anything else. Run write tasks on a branch and verify with git status. prompt for or block --dangerously-skip-permissions — approve it or pre-allow Bash(agy-delegate*). Always verify files actually changed in the workspace with git status (the wrapper maps BOTH denial shapes — the soft deny, 1.1.3+ and again from 1.1.20, and 1.1.13's hard error — to exit 15, so you're not left guessing).
• Run it on a dedicated git branch or worktree so changes are isolated.
• --sandbox is NOT execution containment. Measured on macOS with agy 1.1.19: with --yolo, --sandbox changed nothing — a write to an absolute path OUTSIDE --dir succeeded (rc 0), id ran and returned a real uid, and curl https://example.com returned 200. agy's own help says "terminal restrictions"; whatever it restricts, it is not those, and not in this combination. Not tested on Linux. Contain by what you check out and by permissions.allow, not by the flag.
• Claude reviews the diff before merging — never auto-merge agy's writes.