fix(hooks): enforce path policies on Antigravity's current file tools

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.0.13-beta.3 — 2026-11-02
+
+### Fixes
+
+- **Path policies enforce on Antigravity's current file tools again.** agy delivers `read_file {Path}`, `write_file {Path, Content}` and `edit_file {Path, Target, Replacement}`, none of which were mapped, so every path-based policy and the always-on guard over failproofai's own state saw no path and allowed the call: live on agy 1.4.12, an agent printed `.env`, overwrote and edited it, created `id_rsa`, and overwrote `.failproofai/policies-config.json`. All are now denied, and the older spellings stay mapped (#961)
+
 ## 1.0.13-beta.0 — 2026-10-27
 
 ### Features

CLAUDE.md

@@ -684,8 +684,12 @@ No `local` scope. `timeout` is in **seconds** (30). Command: project
 After that the existing extraction works. `run_command`'s args are PascalCase
 (`CommandLine`/`Cwd`) → `ANTIGRAVITY_TOOL_INPUT_MAP` (keyed by canonical `Bash`)
 maps them to `command`/`cwd`. Tool names via `ANTIGRAVITY_TOOL_MAP`
-(`run_command→Bash` VERIFIED; `view_file→Read`, `edit_file→Edit`, … best-effort;
-unknown tools pass through).
+(`run_command→Bash`, `read_file→Read`, `write_file→Write`, `edit_file→Edit` VERIFIED
+live against agy 1.4.12; unknown tools pass through). The file tools have moved once:
+1.4.9 and 1.4.12 deliver `read_file {Path}`, `write_file {Path, Content}` and
+`edit_file {Path, Target, Replacement}`, where earlier builds delivered `view_file
+{AbsolutePath}` and `write_to_file {TargetFile, CodeContent}`. Both spellings stay
+mapped. A missed name or key raises no error: the policy sees no path and allows.
 
 **Response shapes (Antigravity's OWN — `policy-evaluator.ts` `cli === "antigravity"`):**
 

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/*"]
 
 [workspace.package]
-version = "1.0.13-beta.0"
+version = "1.0.13-beta.3"
 edition = "2024"
 license-file = "LICENSE"
 repository = "https://github.com/FailproofAI/failproofai"

__tests__/e2e/helpers/payloads.ts

@@ -758,6 +758,18 @@ export const AntigravityPayloads = {
         },
       };
     },
+    // A native tool call, exactly as agy delivers it: `name` and `args` are the
+    // vendor's own, un-canonicalized.
+    tool(name: string, args: Record<string, unknown>, cwd: string): Record<string, unknown> {
+      return {
+        conversationId: ANTIGRAVITY_CONVERSATION_ID,
+        workspacePaths: [cwd],
+        transcriptPath: TRANSCRIPT_PATH,
+        modelName: "auto",
+        stepIdx: 19,
+        toolCall: { name, args },
+      };
+    },
   },
   postToolUse: {
     bash(command: string, cwd: string): Record<string, unknown> {

__tests__/e2e/hooks/antigravity-integration.e2e.test.ts

@@ -160,6 +160,75 @@ describe("E2E: Antigravity integration — hook protocol", () => {
   });
 });
 
+// Payload shapes captured live from agy 1.4.9 and 1.4.12 with a recorder hook
+// (#961). Every case here was a silent allow before the maps learned this tool set.
+describe("E2E: Antigravity integration — native file tools", () => {
+  const deniedCases: Array<[string, string[], string, (cwd: string) => Record<string, unknown>]> = [
+    ["read_file .env", ["block-env-files"], "read_file", (cwd) => ({ Path: `${cwd}/.env` })],
+    ["read_file outside the project", ["block-read-outside-cwd"], "read_file", () => ({ Path: "/etc/passwd" })],
+    ["view_file with Path", ["block-env-files"], "view_file", (cwd) => ({ Path: `${cwd}/.env` })],
+    ["write_file .env", ["block-env-files"], "write_file", (cwd) => ({ Path: `${cwd}/.env`, Content: "X=1" })],
+    ["write_file a private key", ["block-secrets-write"], "write_file", (cwd) => ({ Path: `${cwd}/id_rsa`, Content: "k" })],
+    ["edit_file .env", ["block-env-files"], "edit_file", (cwd) => ({ Path: `${cwd}/.env`, Target: "a", Replacement: "b" })],
+    // No policy enabled at all: this one is the always-on guard, and writing this
+    // file is how an agent would switch every other policy off.
+    ["write_file over failproofai's own config", [], "write_file", (cwd) => ({ Path: `${cwd}/.failproofai/policies-config.json`, Content: "{}" })],
+    ["edit_file on failproofai's own config", [], "edit_file", (cwd) => ({ Path: `${cwd}/.failproofai/policies-config.json`, Target: "a", Replacement: "b" })],
+  ];
+
+  it.each(deniedCases)("denies %s", (_label, policies, tool, args) => {
+    const env = createAntigravityEnv();
+    try {
+      writeConfig(env.cwd, policies);
+      const result = runHook(
+        "PreToolUse",
+        AntigravityPayloads.preToolUse.tool(tool, args(env.cwd), env.cwd),
+        { homeDir: env.home, cli: "antigravity" },
+      );
+      assertAntigravityDeny(result);
+    } finally {
+      env.cleanup();
+    }
+  });
+
+  // agy reads its own skills and artifacts with read_file. Those reads only became
+  // visible to block-read-outside-cwd once Path mapped, so the ~/.gemini allowlist
+  // now carries them.
+  it("still allows agy reading its own files under the user's ~/.gemini", () => {
+    const env = createAntigravityEnv();
+    try {
+      writeConfig(env.cwd, ["block-read-outside-cwd"]);
+      const result = runHook(
+        "PreToolUse",
+        AntigravityPayloads.preToolUse.tool(
+          "read_file",
+          { Path: `${env.home}/.gemini/antigravity-cli/builtin/skills/agy-customizations/docs/hooks.md` },
+          env.cwd,
+        ),
+        { homeDir: env.home, cli: "antigravity" },
+      );
+      assertAllow(result);
+    } finally {
+      env.cleanup();
+    }
+  });
+
+  it("still allows an ordinary read inside the project", () => {
+    const env = createAntigravityEnv();
+    try {
+      writeConfig(env.cwd, ["block-env-files", "block-read-outside-cwd"]);
+      const result = runHook(
+        "PreToolUse",
+        AntigravityPayloads.preToolUse.tool("read_file", { Path: `${env.cwd}/notes.txt` }, env.cwd),
+        { homeDir: env.home, cli: "antigravity" },
+      );
+      assertAllow(result);
+    } finally {
+      env.cleanup();
+    }
+  });
+});
+
 describe("E2E: Antigravity integration — install/uninstall", () => {
   it("policies --install --cli antigravity --scope project writes .agents/hooks.json with named-hook schema", () => {
     const env = createAntigravityEnv();

__tests__/hooks/antigravity-canonicalize.test.ts

@@ -45,6 +45,7 @@ describe("Antigravity tool-name canonicalization", () => {
   it("canonicalizes agy tool ids to Claude builtins", () => {
     expect(canonicalizeToolName("run_command", "antigravity")).toBe("Bash");
     expect(canonicalizeToolName("write_to_file", "antigravity")).toBe("Write");
+    expect(canonicalizeToolName("write_file", "antigravity")).toBe("Write");
     expect(canonicalizeToolName("read_file", "antigravity")).toBe("Read");
     expect(canonicalizeToolName("view_file", "antigravity")).toBe("Read");
     expect(canonicalizeToolName("edit_file", "antigravity")).toBe("Edit");
@@ -100,6 +101,47 @@ describe("Antigravity tool-input canonicalization", () => {
     expect(out.file_path).toBe("/repo/.env");
   });
 
+  // The tool set agy delivers now, captured live from 1.4.9 and 1.4.12 (#961).
+  it("maps read_file's Path to file_path on Read, keeping its range args", () => {
+    const out = canonicalizeToolInput(
+      "Read",
+      { Path: "/repo/.env", StartLine: 1, EndLine: 9, ByteOffset: 0 },
+      "antigravity",
+    ) as Record<string, unknown>;
+    expect(out.file_path).toBe("/repo/.env");
+    expect(out.Path).toBeUndefined();
+    expect(out.StartLine).toBe(1);
+  });
+
+  it("maps write_file's Path/Content to file_path/content on Write", () => {
+    const out = canonicalizeToolInput(
+      "Write",
+      { Path: "/repo/.env", Content: "SECRET=x", Overwrite: true, Append: false },
+      "antigravity",
+    ) as Record<string, unknown>;
+    expect(out.file_path).toBe("/repo/.env");
+    expect(out.content).toBe("SECRET=x");
+    expect(out.Overwrite).toBe(true);
+  });
+
+  it("maps edit_file's Path/Target/Replacement to file_path/old_string/new_string on Edit", () => {
+    const out = canonicalizeToolInput(
+      "Edit",
+      { Path: "/repo/.env", Target: "alpha", Replacement: "gamma" },
+      "antigravity",
+    ) as Record<string, unknown>;
+    expect(out.file_path).toBe("/repo/.env");
+    expect(out.old_string).toBe("alpha");
+    expect(out.new_string).toBe("gamma");
+  });
+
+  it("keeps the older aliases, which agy versions still in the wild deliver", () => {
+    for (const key of ["TargetFile", "AbsolutePath", "File"]) {
+      const out = canonicalizeToolInput("Read", { [key]: "/repo/a" }, "antigravity") as Record<string, unknown>;
+      expect(out.file_path, key).toBe("/repo/a");
+    }
+  });
+
   it("leaves a tool with no map entry untouched (reference-equal)", () => {
     const input = { pattern: "TODO" };
     expect(canonicalizeToolInput("Grep", input, "antigravity")).toBe(input);

hermes-plugin/plugin.yaml

@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.13-beta.0
+version: 1.0.13-beta.3
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1

package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.13-beta.0",
+  "version": "1.0.13-beta.3",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",

src/hooks/types.ts

@@ -863,16 +863,19 @@ export const ANTIGRAVITY_EVENT_MAP: Record<AntigravityHookEventType, HookEventTy
 /**
  * Antigravity's tool names → Claude PascalCase canonical names so existing
  * builtin policies (which match `toolName === "Bash"`, etc.) fire unchanged.
- * Tool names VERIFIED against the agy binary's tool registry + live transcripts:
- * the file tool is `write_to_file` (NOT `write_file`), listing is `list_dir`
- * (NOT `list_directory`), and glob is `find_by_name` (NOT `find_filepath`) — the
- * earlier best-effort names were wrong, so `block-env-files`/`block-secrets-write`
- * silently no-op'd on Antigravity file writes. Unknown tools pass through via the
- * `?? raw` fallback.
+ * Tool names VERIFIED against live recorder-hook captures, and they have moved
+ * once: agy 1.4.9 and 1.4.12 deliver `read_file`/`write_file`/`edit_file`, with
+ * listing and search reached through `read_file` on a directory and `run_command`.
+ * Earlier builds delivered `view_file`/`write_to_file`/`replace_file_content`/
+ * `list_dir`/`find_by_name`/`grep_search`; those stay mapped for installs that
+ * have not updated. A file tool missing here is not an error anywhere: every
+ * policy matching on the canonical name silently allows it. Unknown tools pass
+ * through via the `?? raw` fallback.
  */
 export const ANTIGRAVITY_TOOL_MAP: Record<string, string> = {
   run_command: "Bash",
   write_to_file: "Write",
+  write_file: "Write",
   read_file: "Read",
   view_file: "Read",
   edit_file: "Edit",
@@ -886,20 +889,20 @@ export const ANTIGRAVITY_TOOL_MAP: Record<string, string> = {
 
 /**
  * Antigravity tool args are PascalCase. Keyed by the CANONICAL tool name
- * (canonicalizeToolInput runs after canonicalizeToolName). VERIFIED live:
- * `run_command` delivers `CommandLine`/`Cwd`; `write_to_file` delivers the path
- * as `TargetFile` and body as `CodeContent`. Without the Write/Edit/Read entries
- * the path/content builtins (`block-env-files`, `block-secrets-write`,
- * `block-read-outside-cwd`) never saw a `file_path` and silently no-op'd on
- * Antigravity file operations. Read/Edit path keys are best-effort within the
- * same tool family (all file tools operate on `TargetFile`); extra keys are
- * harmless (only remapped when present).
+ * (canonicalizeToolInput runs after canonicalizeToolName). VERIFIED live against
+ * agy 1.4.12: `run_command` delivers `CommandLine`; `read_file` delivers `Path`;
+ * `write_file` delivers `Path`/`Content`; `edit_file` delivers
+ * `Path`/`Target`/`Replacement`. Earlier builds delivered `AbsolutePath` on
+ * `view_file` and `TargetFile`/`CodeContent` on `write_to_file`, kept because
+ * extra keys are harmless (only remapped when present). Without these entries
+ * the path/content builtins, and the always-on guard over failproofai's own
+ * state, never see a `file_path` and silently allow the call.
  */
 export const ANTIGRAVITY_TOOL_INPUT_MAP: Record<string, Record<string, string>> = {
   Bash: { CommandLine: "command", Cwd: "cwd" },
-  Write: { TargetFile: "file_path", CodeContent: "content" },
-  Edit: { TargetFile: "file_path" },
-  Read: { TargetFile: "file_path", AbsolutePath: "file_path", File: "file_path" },
+  Write: { Path: "file_path", Content: "content", TargetFile: "file_path", CodeContent: "content" },
+  Edit: { Path: "file_path", Target: "old_string", Replacement: "new_string", TargetFile: "file_path" },
+  Read: { Path: "file_path", TargetFile: "file_path", AbsolutePath: "file_path", File: "file_path" },
 };
 
 // ── Goose (codename goose, Block) ────────────────────────────────────────────