Antigravity 1.0.9: TUI won't crash on bad formatting, headless mode stops

Release notes

FEATURE

TUI won't crash on bad formatting, headless mode stops spamming history, and plugins auto-fetch submodules

The terminal user interface (TUI) is now much more robust. Previously, if the text formatting was too complex (like checkboxes nested inside lists), the program could outright crash; now, it gracefully falls back to plain text with a warning banner instead of giving up completely. The underlying engine handling mouse and keyboard protocols has also been upgraded, fixing several data races and bugs that could cause panics. If you continue an existing conversation in headless mode (running in pure text without interactive windows), the system will now only print the newest response, instead of spamming your screen with hundreds of lines of historical chat logs. Furthermore, when installing external plugins, the system automatically fetches and initializes any included Git submodules, saving you the manual work; and it no longer redundantly begs for permission to read its own built-in settings directory on startup. Lastly, a compatibility issue on ARM devices lacking AES hardware acceleration has been fixed. Like buying flat-pack furniture: you used to have to go buy the screws separately, but now everything comes in one box, and if the instructions have a typo, it won't cause the whole cabinet to collapse halfway through assembly.

FEATURE

Hardened sandbox security and proper quoting for approved commands

The system's defense lines are now drawn much tighter. The system strictly forbids unauthorized programs from messing with your project's .git folder (the heart of your version control history), preventing any malicious tampering with your crucial history. It is also much stricter when checking command permissions: PowerShell scripts and complex output redirections (like > or 2>&1) now require an exact string match, plugging loopholes that might let bad actors escape the sandbox (a secure isolation zone that restricts program privileges). But it's not all restrictions: previously, if you allowlisted a "command with quotes" (like python -c "print(1)"), the system would fail to handle the spaces inside the quotes and wouldn't recognize it, forcing you to manually approve it anyway; this silly bug is now fixed, and the allowlist works as intended. Like corporate security: it now strictly forbids strangers from sneaking into the archives room, but the guards have finally learned how to read foreign visitor names with spaces in them, so they no longer turn away guests who already made a reservation.

Original changelog

Original changelogTUI won't crash on bad formatting, headless mode stops spamming history, and plugins auto-fetch submodules

Added submodule support for plugins installation. External plugin installation now automatically resolves and initializes Git submodules.
Optimized customizations permissions: Automatically grants read-only access to the builtin customizations directory, eliminating redundant permission prompts on startup.
Improved glamour parser error handling (like nested checkboxes inside list emphasis) and preventing it from crashing the TUI, falling back to raw text with a warning banner.
Updated bubbletea to v2.0.7: Resolves a potential TUI panic when terminal input is unavailable, fixes a data race in mouse handling within the Cursed Renderer, and corrects mouse release behavior under the Kitty Keyboard protocol.
Fixed a bug in headless print mode resumption (`--conversation`/`-c` `-p ...`) where the CLI would dump the entire historical conversation transcript instead of only printing the newly generated response.
Fixed a CPU compatibility issue on ARM64 devices without AES hardware support.

Original changelogHardened sandbox security and proper quoting for approved commands

Hardened command execution permission checks by enforcing strict exact-match verification for PowerShell scripts, complex shell redirections ( `>` , `2>&1` ), and unparseable strings to prevent sandbox escapes.
Hardened sandbox execution by adding `.git` to the core list of dangerous paths, preventing unauthorized or destructive repository modifications.
Fixed a bug where allowlisted terminal commands with quoted arguments (e.g., `python -c "print(1)"`) would silently fail to match at runtime due to flawed whitespace tokenization.