v0.1.97

🚀 Release Highlights — v0.1.97 (2026-06-12)

Theme: Application-Layer Permission Engine — the opt-in approval pipeline that complements v0.1.96's OS sandbox. Defense in depth: the OS layer enforces, the app layer keeps a human in the loop on the risky calls.

🛡️ Layered permission engine (hardline → rules → risk)

• Hardline floor: a non-overridable blocklist denies catastrophic commands (rm -rf /, fork bombs, raw-disk dd) regardless of any rule or mode.
• Declarative rules: an allow/ask/deny algebra over a small action(target) vocabulary (command, read_file, write_file, read_url, mcp, *) with deny-wins precedence across scopes.
• Risk classifier: tiers a call by blast radius, not name — auto-allows reads and in-workspace edits, asks only for the dangerous tail (network egress, force-push, publish/spend, privilege escalation).

✋ Approval that fits the run

• Interactive modal (ToolApprovalModal): allow once / allow session / always · reject, when a human is present.
• Automation policy: risk-based (default — high denied with a reason, low/medium allowed), deny-all, or allow-all.
• File handshake (FileApprovalProvider): req_*.json / resp_*.json for headless/remote approval (Slack bot, /approve <id>, ...). Fail-closed on timeout throughout.

🧑‍🤝‍🧑 Roles, audit & guards

• Per-agent roles: read-only / researcher deny writes+shell; a read-only role also empties the agent's SRT writable set (OS backstop). Role + user rules merge deny-wins.
• Audit ledger: every approval decision is appended to a crash-safe JSONL trail (who/what/why/outcome).
• Runaway-loop budget: max_consecutive_auto caps consecutive auto-approvals per agent and fail-closes past the cap; a human decision resets it.
• always-grant persistence: an "Always" approval persists as an allow(...) rule in settings.local.json and loads back next run.

📋 Guardrail-aware system prompt (channel-based)

• When permissions are active, the system prompt tells the model to follow blocks and surface-and-ask rather than circumvent them — and that ask is a sanctioned path, not a block. Authority comes only from the system prompt (no leakable token).
• Honest scope: the prompt + regex classifier are best-effort alignment. Live runs showed a model evading the egress classifier via \c\u\r\l / python urllib — so the OS sandbox (v0.1.96) remains the load-bearing enforcement. See docs/dev_notes/permissions_p2_followups.md.

🔧 Also in this release

• Denied tool calls are first-class failed tool events: the deny path emits tool_start (with the attempted command) + tool_complete(is_error=True, status="denied"), so blocked calls show in the TUI/WebUI timeline with the command, not just a status line.
• Backend parity guard: native backends (claude_code, codex) don't run the framework chokepoint, so a permissions: block there is reported INACTIVE at startup instead of silently inert.

---

📦 Getting Started

• Quick Start Guide: upgrade and try the permission engine.
• Try the approval modal (interactive):

# A high-risk command pops the approval modal (allow once/session/always · reject)
uv run massgen --config massgen/configs/tools/permissions/permission_modal_interactive.yaml \
  "Run the shell command: curl -s https://example.com"

• Try risk-tiered automation (headless deny):

uv run massgen --automation --config massgen/configs/tools/permissions/permission_engine.yaml \
  "Run 'git status', then run 'git push --force origin main' and report each result."
# Expected: git status runs; the force-push is denied with a reason.

What's Changed

• feat: layered opt-in permission system (P0–P2.2) — rules, approval, audit, guardrail prompt by @ncrispino in #1127
• docs(release): drop interactive approval modal from v0.1.97 (not working yet) by @ncrispino in #1128
• feat: v0.1.97 by @Henry-811 in #1126

Full Changelog: v0.1.96...v0.1.97

v0.1.96

🚀 Release Highlights — v0.1.96 (2026-06-10)

v0.1.96 — OS-Level Agent Sandboxing — adds an opt-in OS sandbox for agent command execution via Anthropic's sandbox-runtime (srt: bubblewrap on Linux, Seatbelt on macOS), and hardens MassGen's application-layer permission hook against file-tool escapes. Defense in depth by design: both layers derive from the same path policy and stay active together. Default-off, one knob: command_line_execution_mode: srt.

🛡️ OS-Level Execution Sandbox

• New command_line_execution_mode: srt wraps agent command/code execution in srt
• SrtManager derives per-agent settings from PathPermissionManager.managed_paths: writable paths become allowWrite, read-only/protected paths become denyWrite
• Command-line MCP execution and filesystem-tools MCP servers are both OS-wrapped where the launcher supports it

🔒 Read & Network Confinement

• command_line_srt_read_mode defaults to confined: deny $HOME, then re-allow only workspace + context paths while keeping system runtime paths readable
• strict and open read modes are available for tighter or broader policies
• Network is deny-all by default; command_line_srt_network_allowed_domains is an explicit capability grant
• Built-in secret-store read denies are active, with command_line_srt_deny_read and command_line_srt_allow_read for config-specific adjustments

🧱 Permission-Hook Hardening

• PathPermissionManager now scans the full tool-argument tree, not just known path keys
• Blocks escapes through unrecognized keys, nested dicts/lists, move/copy sources, absolute paths, .., and symlinks resolving outside managed areas
• Keeps false positives low by skipping content-like fields and resolving non-path strings inside the workspace

⚙️ Backend Parity & Degrade Behavior

• Native-sandbox backends (Codex --full-auto, Claude Code) degrade srt to local to avoid nested sandbox hangs
• Subagents inherit parent command_line_srt_* settings, matching Docker inheritance behavior
• Framework MCP read roots are re-allowed under confined/strict profiles so wrapped filesystem-tool servers can read their own runtime while user secrets remain denied

🧪 Tests

• New deterministic suites: test_srt_manager.py, test_srt_filesystem_integration.py, test_srt_backend_degrade.py, test_path_permission_hook_adversarial.py
• Expanded test_subagent_manager.py with SRT settings inheritance coverage
• Live-verified on macOS 15.7 with srt 1.0.0 across standalone SRT, OpenRouter/chatcompletion, OpenAI Responses, Gemini, Codex, and Claude Code paths

---

📦 Install

pip install massgen==0.1.96

▶️ Try It — SRT sandboxing

# Prerequisite:
npm install -g @anthropic-ai/sandbox-runtime

uv run massgen --automation \
  --config massgen/configs/tools/filesystem/sandbox/srt_sandbox.yaml \
  "Create out.txt in the workspace, then try to read ~/.ssh/id_rsa"

Expected: the workspace write succeeds; out-of-scope reads and network egress are denied by the OS sandbox.

What's Changed

• feat: OS-level SRT agent sandboxing + permission-hook hardening by @ncrispino in #1125

Full Changelog: v0.1.95...v0.1.96

What's Changed

• feat: OS-level SRT agent sandboxing + permission-hook hardening by @ncrispino in #1125
• feat: v0.1.96 by @Henry-811 in #1124

Full Changelog: v0.1.95...v0.1.96

v0.1.95

🚀 Release Highlights — v0.1.95 (2026-06-08)

v0.1.95 — Steering Improvements — extends mid-stream injection from a UI-only capability into a programmatic, headless one, and upgrades it from inject-at-next-boundary into true interrupt-and-resume for the CLI backends. A human (or any UI-less caller) can now drop guidance into an agent while it is streaming — over a file inbox in --automation, or through the MCP-middleware hook path — and Codex/Antigravity will interrupt the in-flight turn, fold the steering in, and resume rather than restart. The injection chokepoint stays shared across TUI, WebUI, and the new headless path.

📨 Programmatic Steering Inbox (--inbox-dir)

• send_steering_message() (massgen/steering.py) drops a msg_*.json into a caller-known inbox directory
• RuntimeInboxPoller routes it through RuntimeInputDelivery.poll_runtime_inbox to the same set_pending_input chokepoint the TUI (_queue_human_input) and WebUI (broadcast_response) already use
• Reachable from --automation and any UI-less caller, with per-message targeting (one agent / a subset / broadcast); the resolved inbox is announced as RUNTIME_INBOX: in automation output

⏯️ Interrupt-and-Resume Steering (Codex & Antigravity)

• When steering arrives mid-turn, the watcher kills the in-flight turn and resumes — codex exec resume <session_id> <prompt> for Codex, agy --continue -p <prompt> for Antigravity — folding the steering in without waiting for a round boundary
• Antigravity promotes pre-interrupt scratch deliverables to the workspace first, so work done before the interrupt isn't lost
• Gated by supports_interrupt_resume() with interrupt_poll_seconds / max_interrupts_per_turn knobs

🪝 MCP-Server-Hook Payload IPC (Antigravity, codex parity)

• write_post_tool_use_hook() / read_unconsumed_hook_content() with expires_at-guarded payloads consumed by the MCP middleware (massgen/mcp_tools/hook_middleware.py)
• The backend-agnostic per-chunk injection flush now works for agy the same way it does for codex
• The Antigravity --model flag is now actually passed to agy (was previously resolved but omitted)

🔧 Bug Fixes

• --inbox-dir honored for all session modes: the env-var export lived inside the new-session branch, so --session-id / config session_id / --continue runs silently dropped programmatic steering — now hoisted into _resolve_runtime_inbox() before the branch
• Stale steering carryforward: read_unconsumed_hook_content() now drops payloads past expires_at (fail-open on malformed values), so a stale hook can't trigger an unexpected interrupt/resume — both backends
• Swallowed watcher failures: interrupt/resume cleanup now logs non-cancellation failures at debug instead of passing — both backends
• Round-1 native-hook gap (Antigravity): hook_dir is set at orchestrator fetch time so first-round hooks are wired before the initial stream; middleware hook_dir coerced to Path

🧪 Tests

• New deterministic suites: test_steering_inbox.py, test_codex_interrupt_resume.py, test_mcp_hook_middleware.py, test_live_proc_io.py; expanded test_antigravity_cli_backend.py
• New opt-in live-fire tests (@pytest.mark.live_api): test_steering_live.py, test_codex_interrupt_resume_live.py, test_antigravity_interrupt_resume_live.py, test_codex_middleware_firing_live.py, test_codex_hook_firing_live.py — with non-blocking stdout polling so a buffering child can't hang the test

---

📖 Install

pip install massgen==0.1.95

🧭 Try It — headless steering

# Start a run, exposing a file inbox for programmatic steering
uv run massgen --automation --inbox-dir /tmp/inbox \
  --config massgen/configs/debug/codex_mcp_middleware_test.yaml "Write and refine a short essay."

# In another shell, drop a steering message mid-stream:
python -c "from massgen.steering import send_steering_message; send_steering_message('/tmp/inbox', 'prioritize concision')"

What's Changed

• feat: Programmatic mid-stream injection and switch to resume by @ncrispino in #1114
• feat: v0.1.95 by @Henry-811 in #1115

Full Changelog: v0.1.94...v0.1.95

v0.1.94

🚀 Release Highlights — v0.1.94 (2026-06-05)

v0.1.94 — Parallelism Hardening (Engineering Health) — strengthens the orchestrator's parallel execution. It moves the snapshot copy off the event loop so agents keep streaming concurrently, backs it with immutable versioned snapshots that keep the off-loop copy safe, and closes latent concurrency races. No per-backend functionality changes (parity principle).

⚡ Snapshot Copy Off the Event Loop

• FilesystemManager.copy_snapshots_to_temp_workspace now runs its blocking rmtree/copytree/scrub on a worker thread via asyncio.to_thread
• One agent's snapshot copy no longer stalls every other agent's streaming

🔒 Immutable, Versioned Snapshots

• Each agent's snapshot path <base>/<agent_id> is now a symlink to an immutable <base>/.versions/<agent_id>/v<N> directory
• save_snapshot (and the interrupted-turn partial save) publish a fresh version and atomically repoint the symlink instead of rewriting in place
• The peer-context copy acquires (refcounts) the current version for the duration of its copy; GC never deletes a pinned or in-flight version
• Eliminates the read-during-write race the off-loop copy would otherwise expose — coordinated by the new SnapshotVersionStore

🧵 Concurrency Correctness Fixes

• R1 — lost peer-answer revision across the injection await window (counts now captured at selection time)
• R2/R3 — lost background-subagent result from a blind queue pop (consume only the consumed ids)
• R4 — leaked background trace-analyzer tasks on cleanup (cancelled before the flush)
• R5 — cancel-without-await teardown (cancel_all_subagents now awaits cancellations against the live registry)
• D2 — worktree-isolation degradation never surfaced because emit_status was called with an invalid status= kwarg whose TypeError was swallowed
• D3 — changedoc enrichment made non-fatal

🧩 Unified Mid-Stream Injection

• The two ~150-line per-backend get_injection_content closures collapsed into one build_midstream_injection(..., native=), preserving the update_context → refresh_checklist side-effect order on both paths
• The triplicated background-wait interrupt provider consolidated into one helper

🧪 Tests

• New race/regression suites driven under TDD with cost-free simulation: test_concurrency_race_fixes.py, test_snapshot_version_store.py, test_snapshot_versioned_save.py, test_snapshot_copy_offload.py, test_midstream_injection_unified.py, test_wait_interrupt_provider.py

---

📖 Install

pip install massgen==0.1.94

What's Changed

• feat: v0.1.94 by @ncrispino in #1113

Full Changelog: v0.1.93...v0.1.94

v0.1.93

🚀 Release Highlights — v0.1.93 (2026-06-03)

v0.1.93 is an internal-quality release: no intended runtime behavior changes, but a smaller CLI surface, typed config validation, cleaner package contents, and stronger test/type-checking gates.

🧩 CLI Package Decomposition

• massgen/cli.py was split into an 18-module massgen/cli/ package
• The public import surface is preserved through the package facade
• The Textual per-turn handler was extracted into a dependency-injected function
• CLI helper and run-loop characterization tests cover the new seams

🛡️ Pydantic Config Migration

• AgentConfig, CoordinationConfig, TimeoutConfig, StepModeConfig, and related nested config classes now validate field types on construction
• Mode fields use Literal definitions in massgen/config_modes.py
• config_validator derives valid mode sets from the typed definitions, reducing validator drift
• pydantic>=2.0 is now a declared dependency

🔧 Correctness Fixes

• Textual concurrent-run logging now preserves per-run session context
• CoordinationConfig.from_dict() no longer lets absent YAML keys override defaults with None
• Response backend tool-argument parsing now logs malformed payloads instead of silently dropping them
• Backend/API parameter exclusion lists now derive from a single source

🧪 Test Signal & Typing

• Coverage configuration now points at the real package
• pytest.PytestReturnNotNoneWarning is treated as an error
• CI enforces uv.lock via uv sync --frozen
• scripts/mypy_island.sh adds a blocking incremental mypy gate
• All bundled configs were validated after the migration

🧹 Dead Code Removal

• Removed unreferenced legacy massgen/v1 and massgen/prototype code from the wheel

---

📖 Install

pip install massgen==0.1.93

What's Changed

• docs: docs for v0.1.93 by @Henry-811 in #1112
• feat: v0.1.93 by @Henry-811 in #1111

Full Changelog: v0.1.92...v0.1.93

v0.1.92

🚀 Release Highlights — v0.1.92 (2026-06-01)

v0.1.92 is a maintainability release for MassGen's orchestration core, with a new Parallel Web Search MCP example included for research-heavy workflows. The main result: the largest orchestrator surfaces are smaller, more modular, and guarded by characterization tests before deeper behavior changes continue.

🧩 Orchestrator Collaborator Extraction

• orchestrator.py drops from 21,599 to 8,574 lines
• 49 collaborator classes are extracted into massgen/orchestrator_collaborators/
• Existing public methods remain available through thin delegators
• Shared mutable state still lives on the orchestrator, preserving current ownership semantics

🖥️ TUI Display Module Cleanup

• Provider/model display logic moved to _textual_provider_model.py
• Terminal capability probing moved to _textual_terminal_capabilities.py
• Widget debug helpers moved to _textual_widget_debug.py
• Public imports from textual_terminal_display.py stay stable

🔎 Parallel Web Search MCP

• New parallel_search MCP registry entry
• New example config: massgen/configs/tools/web-search/parallel_search_example.yaml
• Supports Parallel's hosted Search MCP server for LLM-optimized web search and URL extraction
• Optional PARALLEL_API_KEY enables higher rate limits

🧪 Characterization Coverage

• massgen/tests/test_orchestrator_characterization.py
• massgen/tests/frontend/test_textual_terminal_display_characterization.py
• Existing integration/unit tests updated for the new collaborator seams
• Refactor roadmap and remaining high-risk follow-up steps documented in docs/dev_notes/orchestrator_refactor_roadmap.md

---

📖 Getting Started

• Quick Start Guide
• Install:

  pip install massgen==0.1.92

• Try Parallel Search:

  uv run massgen --config massgen/configs/tools/web-search/parallel_search_example.yaml "Research the latest advances in multi-agent AI systems"

What's Changed

• feat(mcp): add Parallel Web Search to MCP server registry + example config by @NormallyGaussian in #1108
• docs: docs for v0.1.92 by @Henry-811 in #1109
• feat: v0.1.92 by @Henry-811 in #1107

New Contributors

• @NormallyGaussian made their first contribution in #1108

Full Changelog: v0.1.91...v0.1.92

v0.1.91

🚀 Release Highlights — v0.1.91 (2026-05-27)

v0.1.91 hardens MassGen's release-critical configuration paths: YAML parsing is centralized, typo detection is strict enough to block releases, checklist runtime controls now flow through the same orchestrator helper, and native hook permission checks now honor nested protected paths before broad workspace write rules.

🧭 Centralized Config Wiring

• CoordinationConfig.from_dict() owns orchestrator.coordination parsing
• TimeoutConfig.from_dict() owns top-level timeout_settings parsing
• AgentConfig.apply_orchestrator_config() owns top-level orchestrator runtime field application
• CLI helpers remain import-compatible wrappers around the centralized implementations

🔎 Config Drift Detection

• Unknown orchestrator.coordination.* keys now produce validation warnings
• Unknown top-level orchestrator.* and timeout_settings.* keys are flagged the same way
• scripts/validate_all_configs.py --strict treats those warnings as release-blocking
• Typos such as fast_interation_mode, voting_sensitivty, and orchestrator_timout_seconds now surface before runtime

✅ Checklist Runtime Controls

• max_checklist_calls_per_round is wired through the centralized orchestrator runtime helper
• checklist_first_answer now follows the same runtime path
• Planning controls and subagent timeout fields have parser and documentation parity coverage

🛡️ Native Hook Permission Safety

• Gemini CLI and Codex standalone hook scripts now apply more-specific managed paths before broader parents
• Nested read-only/protected paths override workspace-level write access
• Claude Code native hook tests/docs now match the SDK-native additionalContext injection contract

🧪 Tests

• massgen/tests/test_config_wiring_refactors.py
• massgen/tests/test_coordination_config_wiring.py
• massgen/tests/test_config_validator.py
• massgen/tests/test_validate_all_configs_script.py
• massgen/tests/test_native_hook_adapters.py
• Updated Gemini CLI and Codex hook script coverage

---

📖 Getting Started

• Quick Start Guide
• Install:

  pip install massgen==0.1.91

• Try It:

  uv run massgen --config massgen/configs/features/fast_iteration.yaml "Create an svg of an AI agent coding."

What's Changed

• docs: docs for v0.1.91 by @Henry-811 in #1106
• feat: v0.1.91 by @Henry-811 in #1104

Full Changelog: v0.1.90...v0.1.91

v0.1.90

🚀 Release Highlights — v0.1.90 (2026-05-25)

v0.1.90 strengthens MassGen's checklist-gated refinement loop: non-discriminative criteria are softened, checklist reasoning becomes next-round feedback, candidate ordering is counterbalanced, and gate thresholds now share one consistent 0-10 scale.

🎯 Discriminative-Power Pruning

• Bootstrap criteria now compute per-criterion score spread across agents
• Low-spread criteria are demoted to stretch so they stay visible without acting as hard gates
• A protected floor prevents the gate from being hollowed out

🧠 Criterion Feedback Loop

• Checklist score reasoning is extracted after each verdict
• Per-agent score submissions keep the lowest-score reasoning per criterion as the most diagnostic signal
• Next-round agents receive a <CRITERION FEEDBACK ...> memo with failed criteria marked

⚖️ Position-Bias Calibration

• Candidate answer order rotates per scoring agent
• Primacy-slot exposure is distributed across agents
• Equal aggregate checklist scores break deterministically, independent of insertion order

📏 Unified Checklist Gate

• ChecklistGate.from_budget(...) derives effective threshold, required-true count, and confidence cutoff together
• The checklist gate now consistently uses a 0-10 threshold scale
• Fast-iteration defaults continue to relax the gate as answer budget tightens

🧩 Shared Score Utilities

• New massgen/score_utils.py centralizes score extraction and per-agent score-shape detection
• Checklist server, quality server, and bootstrap criteria now share the same parsing behavior
• llm_circuit_breaker_* kwarg parsing is consolidated into the shared custom-tool/MCP backend base

⚡ Fast-Iteration Config Updates

• Fast-iteration examples now default to local command execution
• fast_iteration.yaml refreshes its default pairings for current Gemini + Codex workflows
• Antigravity fast-iteration config remains available for CLI-backed Google runs

🧪 Tests

• massgen/tests/test_discriminative_pruning.py
• massgen/tests/test_criterion_feedback.py
• massgen/tests/test_position_bias_calibration.py
• massgen/tests/test_score_utils.py
• Updated massgen/tests/test_checklist_tools_server.py

---

📖 Getting Started

• Quick Start Guide
• Install:

  pip install massgen==0.1.90

• Try It:

  uv run massgen --config massgen/configs/features/fast_iteration.yaml "Create an svg of an AI agent coding."

What's Changed

• docs: docs for v0.1.90 by @Henry-811 in #1103
• feat: v0.1.90 by @Henry-811 in #1102

Full Changelog: v0.1.89...v0.1.90

v0.1.89

🚀 Release Highlights — v0.1.89 (2026-05-22)

v0.1.89 completes the follow-up Antigravity CLI integration pass after v0.1.88 introduced the first backend. This release focuses on reliability in real MassGen coordination runs: workflow-tool parity, auth checks, workspace write isolation, native hooks, and prompt affordance gating.

🛰️ Workflow-Mode Parity

• Antigravity now mirrors Gemini CLI's new_answer / vote workflow handling
• vote is hidden when no candidate answers exist, keeping agents in new_answer_only mode
• Post-evaluation prompts guard against stale new_answer, vote, or stop calls
• Duplicate parsed workflow calls are suppressed within a single turn

🧰 Workspace Write Reliability

• --add-dir <cwd> registers the MassGen workspace with agy so file tools write where peers and snapshots can see outputs
• Workspace-root .antigravitycli/ marker prevents agy's upward project discovery from adopting a parent project
• .antigravity/ and .antigravitycli/ are ignored as runtime artifacts

🔐 Auth + Binary Health Checks

• Backend construction now verifies agy --version
• Runs fail fast when no GEMINI_API_KEY, GOOGLE_API_KEY, or cached Google OAuth credentials are available
• Docker mode still requires API-key auth because OAuth state does not cross container boundaries

🔌 Native Hooks

• Antigravity hooks now emit standalone hooks.json
• settings.json enables hooks through enableJsonHooks
• Native hook adapter docs now reflect Antigravity's storage model rather than Gemini CLI's embedded settings hook model

🧭 Prompt Guardrails

• TaskContextSection advertises spawn_subagents only when subagents are enabled
• Multimodal-only agents keep read_media context guidance without phantom subagent MCP affordances

🧪 Tests

• massgen/tests/test_antigravity_cli_backend.py expanded to cover health checks, authentication, workspace anchoring, --add-dir, hooks.json, workflow filtering, duplicate tool-call suppression, multimodal prompt flattening, cancellation cleanup, and agent-id propagation
• massgen/tests/test_system_prompt_sections.py covers subagent affordance gating

---

📖 Getting Started

• Quick Start Guide
• Install:

  pip install massgen==0.1.89
  curl -fsSL https://antigravity.google/cli/install.sh | bash

• Try It:

  uv run massgen --config massgen/configs/features/fast_iteration_gemini_antigravity.yaml "Create an svg of an AI agent coding."

What's Changed

• feat: harden Antigravity CLI backend for v0.1.89 by @ncrispino in #1099
• docs: docs for v0.1.89 by @Henry-811 in #1101
• feat: v0.1.89 by @Henry-811 in #1100

Full Changelog: v0.1.88...v0.1.89

v0.1.88

🚀 Release Highlights — v0.1.88 (2026-05-20)

This is the first version of MassGen's Antigravity integration. v0.1.88 establishes the backend, workspace-local config isolation, MCP config translation, native hook adapter support, and runnable examples. We plan to complete the full integration in the next release.

🛰️ Antigravity CLI Backend

• New backend type (#1097): antigravity_cli wraps Google's agy binary as a MassGen backend
• Auth support: local mode can use existing Google OAuth state at ~/.gemini/google_accounts.json; GEMINI_API_KEY / GOOGLE_API_KEY are passed through when present
• Server-side model selection: agy selects the active model per Antigravity tier; MassGen accepts model for logging/registry consistency but does not pass a nonexistent --model flag

🧰 Workspace-Local Isolation

• Antigravity project state is routed through <workspace>/.antigravity via --gemini_dir
• MCP config and settings stay inside the MassGen workspace, avoiding mutation of the user's global ~/.gemini/ config
• .antigravity / .antigravitycli metadata directories are excluded from snapshot meaningful-content heuristics

🔌 MCP + Hook Integration

• MassGen MCP server entries are translated to Antigravity's mcp_config.json schema
• HTTP MCP servers emit serverUrl; stdio servers emit command / args / env
• AntigravityCLINativeHookAdapter reuses Gemini CLI hook behavior for Antigravity's compatible hook protocol

📦 New Example Configs

• massgen/configs/providers/antigravity/antigravity_cli_local.yaml — single Antigravity CLI agent
• massgen/configs/features/fast_iteration_gemini_antigravity.yaml — Gemini API + Antigravity CLI fast-iteration pair

🧪 Tests

• massgen/tests/test_antigravity_cli_backend.py covers binary discovery, command construction, workspace-local config, MCP schema, provider metadata, stdout/error streaming, workflow JSON envelopes, Docker/API-key constraints, native hook adapter wiring, and environment passthrough

---

📖 Getting Started

• Quick Start Guide
• Install:

  pip install massgen==0.1.88
  curl -fsSL https://antigravity.google/cli/install.sh | bash

• Try It:

  uv run massgen --config massgen/configs/features/fast_iteration_gemini_antigravity.yaml "Create an svg of an AI agent coding."

What's Changed

• feat: add Antigravity CLI backend wrapping Google's agy binary by @ncrispino in #1097
• docs: docs for v0.1.88 by @Henry-811 in #1098
• feat: v0.1.88 by @Henry-811 in #1096

Full Changelog: v0.1.87...v0.1.88