antigravity: worktree isolation unusable — agy trust is exact-path, so every worktree hangs on the trust dialog

[pbean]

Problem

antigravity (Google's agy) gates every workspace on an interactive trust dialog:

Do you trust the contents of this project?
> Yes, I trust this folder
  No, exit

Spawned sessions cannot answer it, so a pending dialog reads as a session timeout.

Verified trust semantics (agy 1.1.3, empirical 3-run matrix)

Launch shape matched the real adapter (agy -i "<prompt>" --dangerously-skip-permissions in tmux):

Run	trustedWorkspaces contains	Result
A (control)	neither /tmp nor the dir	prompts
B (prefix)	/tmp	still prompts
C (exact)	the dir itself	no prompt, turn starts

Conclusions:

• ~/.gemini/antigravity-cli/settings.json → trustedWorkspaces is the gate.
• Matching is exact-path. Trusting a parent does not cover subdirectories.
• --dangerously-skip-permissions does not bypass it (it covers tool permissions only).
• No trust-bypass env var exists (searched AGY_* / ANTIGRAVITY_* / GEMINI_* in the binary).

Impact

• isolation = "none" (the default) works — the project root is trusted once, by hand.
• isolation = "worktree" does not work. Worktrees live at <project>/.bmad-loop/runs/<run_id>/worktrees/<unit> — a fresh, untrusted path per run, so every session hangs on the dialog until the stall timeout.
• probe-adapter antigravity --probe cannot self-serve either: it launches in a fresh mkdtemp that by definition can't be pre-trusted.

Documented as a limitation in the profile's first_run_note and the setup guide (see the antigravity finishing work). This issue tracks lifting it.

Proposal (opt-in, default off)

An opt-in knob (e.g. [adapter] antigravity_seed_worktree_trust = false) that appends a worktree path to trustedWorkspaces on creation, with:

• Containment guard — only ever add a path whose enclosing project root is already in trustedWorkspaces. The user has already granted trust to that repo; a worktree is the same repo at a path inside it, so this grants no new authority. Never seed for an untrusted root.
• Pruning on teardown — worktrees are per-run, so entries must be removed in close_unit_workspace or trustedWorkspaces grows unboundedly.
• Never on by default. This writes to a global vendor config outside the project, a new class of act for bmad-loop: seed_files / provision_worktree only ever copy within the project and are containment-guarded.

Also worth considering

probe-adapter --workspace DIR — let the probe run in a caller-chosen (pre-trusted) directory instead of mkdtemp. Useful for any trust-gated CLI, not just agy, and it would make --probe usable for antigravity without touching vendor config at all.

Notes

Verified against agy 1.1.3. Related: #159 (hook registration not recognized for this dialect).

[coderabbitai]

🔗 Related PRs

#67 - feat(adapters): add Antigravity CLI (agy) adapter profile [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[pbean]

Trust semantics and the docs-side limitation landed in #171 (profile first_run_note, README, FEATURES, setup guide). This issue remains open for the actual fix — the opt-in seeding knob, and/or probe-adapter --workspace DIR.