feat(ENG-593): defender-antigravity - sibling plugin for Google Antigravity CLI

[hiskudin]

Summary

• New plugin at plugins/security/stackone-defender-antigravity/ that ports the Claude Code StackOne Defender to Google's Antigravity CLI (agy)
• Reuses the existing Node daemon, ONNX model, and shared ~/.claude/defender.sock socket — if both plugins are installed, they share one in-memory classifier
• Same silent-cue UX as Claude Code: scan tool output at PostToolUse, inject a one-line system message into the agent's next turn on high-risk findings; silent-pass otherwise

What's different from the Claude Code plugin

	Claude Code	Antigravity
Manifest	.claude-plugin/plugin.json	top-level plugin.json
Stdin	{tool_name, tool_output, …}	PostToolHookArgs proto3-JSON (toolName, toolResult, …) — accepts snake_case fallback
Stdout	{hookSpecificOutput: {hookEventName, additionalContext}}	{inject_steps: [{system_message: {text}}]}
Tool matcher	narrow allow-list	.* (Antigravity's tool surface is less stable)

The daemon, config, SKILL.md, and the 12-fixture regression suite are byte-identical to the Claude Code plugin.

Why now

Our Gemini 2.5 Flash read-exfil probe measured baseline 25.8% attack success halved to 12.5% by the exact Defender hint this plugin emits — the largest absolute risk reduction we've measured. That's the model class Antigravity ships on.

Validation

• agy plugin validate → ok (skills: 1, hooks: 1)
• agy plugin install / uninstall → clean
• npm test → 12/12 fixtures green (benign / realistic / tricky buckets, same corpus as sibling plugin)
• Empty / under-threshold stdin → clean exit
• Hook script syntax-checks with node --check

Test plan

• Install in a real agy session: agy plugin install plugins/security/stackone-defender-antigravity
• Trigger the first run with a tool call returning >500 bytes (e.g. read a file). Confirm the daemon spawns and the next tool call returns in low ms.
• Run a known-injection fixture through agy and confirm the inject_steps payload lands in the model's next turn.
• Confirm sharing the daemon with the existing Claude Code plugin works (both installed, single daemon serves both).

Known limitations

• Stdin field names are inferred from the agy binary's protobuf tags, not from a live capture. The hook accepts both proto3-camelCase and snake_case defensively. If the live shape diverges, capture the stdin via a wrapper script and open an issue.
• The daemon still lives under ~/.claude/ (historical path, shared with the Claude Code plugin). Consider migrating to a neutral path in a future major version.
• Marketplace install path will land once the StackOne marketplace registry supports Antigravity; for now install from the repo.

---

Summary by cubic

Add stackone-defender-antigravity, a PostToolUse security plugin for Google’s Antigravity CLI that scans tool results on-device and injects a one-line system cue on high‑risk findings. Also fixes a socket timeout bug in the client scan path and clarifies docs about offline scanning; addresses ENG-593.

• New Features

  • New plugin at plugins/security/stackone-defender-antigravity/ for Antigravity CLI (agy) PostToolUse.
  • Local scan of tool results; injects one-line system cue on high risk; silent pass otherwise.
  • Stdin: PostToolHookArgs proto3‑JSON (camelCase or snake_case). Stdout: inject_steps[].system_message.
  • Shares the Defender daemon, ONNX model, and socket ~/.claude/defender.sock; single in-memory classifier across plugins.
  • Includes 12 regression fixtures with node --test, plus README and SKILL.

• Bug Fixes

  • Client scan timeout: use socket.setTimeout only pre-connect and clear on connect so the outer scan budget governs; applied to both the Antigravity plugin and the sibling Claude Code plugin.
  • Docs: clarify “no network egress during scanning” and note first‑run npm fetch; update troubleshooting to avoid $CLAUDE_PLUGIN_ROOT shell usage and add host‑specific install path; keep SKILL wording platform‑neutral and mention both Claude Code and Antigravity transports; remove a broken README link.

^{Written for commit 65c92c2. Summary will update on new commits.}

[Copilot]

Pull request overview

This PR adds a new stackone-defender-antigravity plugin that ports the existing StackOne Defender “PostToolUse” scanning flow to Google’s Antigravity CLI (agy), reusing the same local daemon/socket and classifier configuration while adapting stdin/stdout envelopes to Antigravity’s hook protocol.

Changes:

• Introduces an Antigravity-specific scan-tool-result.mjs hook that parses PostToolHookArgs-style stdin and emits inject_steps on flagged scans.
• Adds a detached Unix-socket daemon (defender-daemon.mjs) plus shared config (defender-daemon.config.json) and the StackOne Defender skill file.
• Adds a 12-fixture regression suite (benign/realistic/tricky) and plugin packaging files (plugin.json, hooks/hooks.json, npm metadata/lockfile).

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
plugins/security/stackone-defender-antigravity/.gitignore	Ignores local node_modules/ for the plugin.
plugins/security/stackone-defender-antigravity/hooks/hooks.json	Registers the PostToolUse hook for Antigravity.
plugins/security/stackone-defender-antigravity/package-lock.json	Locks npm dependency graph for the plugin.
plugins/security/stackone-defender-antigravity/package.json	Defines plugin npm metadata and dependencies.
plugins/security/stackone-defender-antigravity/plugin.json	Declares Antigravity plugin manifest (name/version/description).
plugins/security/stackone-defender-antigravity/README.md	Documents install/behavior/config for the Antigravity variant.
plugins/security/stackone-defender-antigravity/scripts/defender-daemon.config.json	Provides default PromptDefense/threshold/model configuration.
plugins/security/stackone-defender-antigravity/scripts/defender-daemon.mjs	Implements long-running local scanning daemon over UDS.
plugins/security/stackone-defender-antigravity/scripts/scan-tool-result.mjs	Implements Antigravity hook client (stdin parse, daemon IPC, inject_steps output).
plugins/security/stackone-defender-antigravity/skills/stackone-defender/SKILL.md	Adds agent behavioral guidance when Defender flags tool output.
plugins/security/stackone-defender-antigravity/tests/qa-fixtures.test.mjs	Adds regression test runner for fixture corpus vs live classifier.
plugins/security/stackone-defender-antigravity/tests/fixtures/benign/git-log.txt	Benign fixture: git log shaped output.
plugins/security/stackone-defender-antigravity/tests/fixtures/benign/hiking-trail.md	Benign fixture: prose content.
plugins/security/stackone-defender-antigravity/tests/fixtures/benign/lms-training-modules.txt	Benign fixture: LMS/training listing content.
plugins/security/stackone-defender-antigravity/tests/fixtures/benign/sourdough-recipe.md	Benign fixture: prose content.
plugins/security/stackone-defender-antigravity/tests/fixtures/realistic/document-summary.md	Realistic fixture: injected DAN-style directive in summary.
plugins/security/stackone-defender-antigravity/tests/fixtures/realistic/slack-thread.txt	Realistic fixture: “system override” prompt injection in chat thread.
plugins/security/stackone-defender-antigravity/tests/fixtures/realistic/support-ticket.txt	Realistic fixture: “SYSTEM NOTE TO ASSISTANT” injection in ticket.
plugins/security/stackone-defender-antigravity/tests/fixtures/tricky/api-response-listing.json	Tricky fixture: structured JSON listing likely to FP.
plugins/security/stackone-defender-antigravity/tests/fixtures/tricky/employee-policy.md	Tricky fixture: policy text containing “disregard” phrasing.
plugins/security/stackone-defender-antigravity/tests/fixtures/tricky/incident-postmortem.md	Tricky fixture: incident writeup quoting injection language.
plugins/security/stackone-defender-antigravity/tests/fixtures/tricky/release-notes-2.5.md	Tricky fixture: security-focused release notes.
plugins/security/stackone-defender-antigravity/tests/fixtures/tricky/research-note-on-injection.md	Tricky fixture: research prose quoting canonical injection strings.

Files not reviewed (1)

• plugins/security/stackone-defender-antigravity/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

0 issues found across 4 files (changes from recent commits).

<sub>Requires human review: This PR adds an entirely new security plugin with a daemon, hooks, and ONNX model inference totaling 2,699 lines; despite the AI review finding no issues, the blast radius and risk of breaking core functionality or the shared daemon are too high for unsupervised auto-approval.

Re-trigger cubic</sub>

[cubic-dev-ai]

2 issues found across 24 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Auto-approved: This PR adds an isolated new plugin for Antigravity CLI that ports the existing Claude Code Defender plugin, reusing the same daemon and test fixtures; the changes are additive, well-tested, and confined to a new directory with no modifications to existing code, so the risk of breakage is very low.

Re-trigger cubic</sub>