@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.30.0: Antigravity that asks first
+
+- **Antigravity runs through Google's official ACP agent server** (the
+  `antigravity-acp` entry in the ACP registry) instead of `agy`'s print mode.
+  It now sends permission requests, so ShadowCode's approvals apply to its
+  commands and edits, it accepts images, and it resumes sessions with
+  `session/load`. Models come from the session's `model` config option and are
+  switched with `session/set_config_option`.
+- **Install from Accounts.** The server is downloaded only when you choose
+  **Install** (334 MB from dl.google.com, size and SHA-256 pinned), unpacked
+  into `~/.local/share/shadowcode/antigravity-acp/1.2.1`, and can be removed
+  again. A built-in unzip handles the archive.
+- **Private sign-in.** The server keeps its Google sign-in in a profile owned
+  by ShadowCode. **Connect** opens the browser and relays the link;
+  **Disconnect** deletes the profile. Status checks and tasks can't open a
+  browser: a printed sign-in link marks the row *Sign in*, and a task stops
+  with that message at once.
+- **Clean launches.** Each launch gets its own temp directory, removed
+  afterwards, and runs without Google API-key or cloud-project variables. On
+  hosts without an IPv6 loopback, the server's own
+  `--enforce_kernel_ipv6_support=false` switch is passed.
+- Questions the server asks through the permission channel are skipped with a
+  note for now.
+
 ## 0.29.0: OpenRouter, working web search
 
 - **OpenRouter API keys.** People without a subscription can paste an
 
@@ -4,7 +4,7 @@ default-members = ["native/core"]
 resolver = "2"
 
 [workspace.package]
-version = "0.29.0"
+version = "0.30.0"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT"
 
@@ -26,15 +26,15 @@ need Ollama, LM Studio or any other model server.
   ShadowCode's own tools can be rewound.
 
 Release history is in [CHANGELOG.md](CHANGELOG.md). What's new in this release:
-[0.29.0 release notes](docs/RELEASE_NOTES.md).
+[0.30.0 release notes](docs/RELEASE_NOTES.md).
 
 ## Install
 
 Releases target x86_64 Linux with glibc 2.39 or newer (Ubuntu 24.04 or later).
 Download from [GitHub releases](https://github.com/Shadowfetchapps/ShadowCode/releases/latest):
 
-- `ShadowCode_0.29.0_amd64.AppImage`
-- `ShadowCode_0.29.0_amd64.deb`
+- `ShadowCode_0.30.0_amd64.AppImage`
+- `ShadowCode_0.30.0_amd64.deb`
 - `SHA256SUMS`
 
 ### AppImage (recommended)
@@ -45,7 +45,7 @@ from a checkout of this repository:
 ```bash
 sha256sum --ignore-missing -c SHA256SUMS
 git clone https://github.com/Shadowfetchapps/ShadowCode.git
-./ShadowCode/scripts/install-appimage.sh ~/Downloads/ShadowCode_0.29.0_amd64.AppImage
+./ShadowCode/scripts/install-appimage.sh ~/Downloads/ShadowCode_0.30.0_amd64.AppImage
 ```
 
 [`scripts/install-appimage.sh`](scripts/install-appimage.sh):
@@ -65,14 +65,14 @@ git clone https://github.com/Shadowfetchapps/ShadowCode.git
   AppImages only after a successful install.
 
 To run the AppImage without installing it:
-`./ShadowCode_0.29.0_amd64.AppImage --appimage-extract-and-run`. FUSE is not
+`./ShadowCode_0.30.0_amd64.AppImage --appimage-extract-and-run`. FUSE is not
 required.
 
 ### Debian package
 
 ```bash
 sha256sum --ignore-missing -c SHA256SUMS
-sudo apt install ./ShadowCode_0.29.0_amd64.deb
+sudo apt install ./ShadowCode_0.30.0_amd64.deb
 ```
 
 The deb installs `shadowcode` and the same llama.cpp runtime in
@@ -130,7 +130,7 @@ for that vendor.
 | Codex | `codex app-server` (JSON-RPC) | `codex login` | app-server `model/list` | Yes (`localImage`), per model | Yes: command and file-change requests. Codex runs in its own sandbox (`workspace-write`, or `read-only` for Plan/Review) | Rate-limit windows per quota pool (for example 5-hour and weekly), reset times, plan, and credits only when reported |
 | Claude Code | `claude -p --output-format stream-json --input-format stream-json --permission-prompts host` | `claude auth login` | *Default* plus the aliases listed in `claude --help` | Yes (image blocks) | Yes, through `--permission-prompts host`. Claude's own settings can pre-approve tools without asking | *Usage unavailable*: Claude Code exposes no plan usage to other apps |
 | Cursor | `cursor-agent acp` (Agent Client Protocol) | `cursor-agent login` | ACP session models, with exact IDs | When ACP `initialize` advertises image support | Yes, through ACP permission requests | *Usage unavailable*: Cursor reports its plan tier, not the remaining allowance |
-| Antigravity | `agy --output-format stream-json --input-format stream-json --print=` | Not available from ShadowCode: run `agy` once to sign in | `agy models` | No (text-only input) | **No**: Antigravity applies its own permission settings in headless mode | *Usage unavailable*: usage appears only in `agy`'s interactive `/usage` panel |
+| Antigravity | Google's ACP agent server `agy_acp_server.par` (installed from Accounts) | Google sign-in through the server's `authenticate` | The `model` config option of the ACP session | Yes (ACP image support) | Yes, through ACP permission requests | *Usage unavailable*: the server reports no plan usage |
 | Grok | `grok agent stdio` (ACP) | `grok login` | ACP session models (falls back to `grok models`) | No: ACP reports `image: false` | Yes, through ACP. Grok has no read-only mode, so Plan/Review is not enforced by Grok | *Usage unavailable*: Grok reports per-session tokens only |
 
 - **API keys are never used.** Vendor CLIs start with provider API-key
@@ -146,11 +146,11 @@ for that vendor.
 
 Setup details: [subscriptions](docs/SUBSCRIPTIONS.md).
 
-**Antigravity limitation.** `agy`'s headless mode can't ask ShadowCode for
-permission, so it denies any command it would normally ask about. A task that
-needs one now fails with that explanation instead of ending with an empty
-answer. Use Antigravity for questions and edits it may make on its own, or
-pick another model for tasks that run commands.
+**Antigravity** runs through Google's official ACP agent server instead of the
+`agy` CLI, so it asks ShadowCode before running commands or editing files.
+**Install** on its Accounts card downloads the server once (334 MB from
+dl.google.com, checksum-verified); **Connect** signs in with Google. Details:
+[subscriptions](docs/SUBSCRIPTIONS.md#antigravitys-agent-server).
 
 ## API keys (OpenRouter)
 
 
@@ -27,15 +27,18 @@ separate account when you need stronger isolation.
 
 - **ShadowCode never reads vendor credentials.** Sign-in state comes from each
   vendor's documented status command or protocol: Codex app-server
-  `account/read`, `claude auth status`, the ACP handshake for Cursor and Grok,
-  `agy models`. ShadowCode never opens `~/.codex/auth.json`, Claude's
-  credential files, the Grok or Cursor login files, or Antigravity's keyring
-  entry.
+  `account/read`, `claude auth status`, the ACP handshake for Cursor, Grok and
+  Antigravity. ShadowCode never opens `~/.codex/auth.json`, Claude's
+  credential files, the Grok or Cursor login files, or the token in
+  Antigravity's profile.
 - **Connect and Disconnect** run the vendor's own login and logout commands
   as supervised child processes. The vendor opens the browser or prints a URL
   or device code. ShadowCode only relays the printed lines after redaction, and
   never shows a URL that carries a code or token parameter as a link.
-  Antigravity sign-in and sign-out happen only inside `agy`.
+  Antigravity's Connect asks its agent server to `authenticate`; the server
+  opens the browser and stores the token in ShadowCode's private Antigravity
+  profile, which Disconnect deletes. Status checks and tasks run the server
+  with a no-op `BROWSER`, so it can't open a sign-in page on its own.
 - **No API keys reach vendor CLIs.** Every vendor CLI that runs a task, and
   every login and logout, starts without `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`,
   `OPENAI_API_KEY`, `CODEX_API_KEY`, `CURSOR_API_KEY`, `XAI_API_KEY`,
@@ -98,6 +101,14 @@ network mode is *Online*.
   ShadowCode names itself in its user agent and never works around a bot
   check.
 
+## Antigravity agent download
+
+The Antigravity agent server is downloaded only when you choose **Install**,
+from the URL in the ACP registry (`dl.google.com`). ShadowCode refuses it
+unless its size and SHA-256 match the values pinned in the release, unpacks
+only plain file names from the archive, and starts it without Google API-key
+or cloud-project variables.
+
 ## OpenRouter API key
 
 The key is checked with OpenRouter's `GET /api/v1/key`, then stored in the
@@ -135,7 +146,7 @@ What each vendor runtime enforces (from `permissions.rs`, shown in
 | Claude Code | Permission prompts come to ShadowCode (`--permission-prompts host`). Plan/Review uses `--permission-mode plan`. Claude's own settings can pre-approve tools that ShadowCode never sees |
 | Cursor | ACP permission requests come to ShadowCode. Plan/Review uses Cursor's plan mode when offered |
 | Grok | ACP permission requests come to ShadowCode. Grok has no read-only mode, so Plan/Review is not enforced by Grok |
-| Antigravity | Never asks ShadowCode. It applies its own settings (`~/.gemini/antigravity-cli/settings.json`) and soft-denies actions it may not run. Plan/Review uses `--mode plan` |
+| Antigravity | Asks through ACP `session/request_permission`, like Cursor and Grok. In Plan/Review ShadowCode denies its requests |
 
 In read-only tasks, ShadowCode denies vendor approval requests automatically.
 Unanswered vendor requests are denied after `approval_timeout_sec` (600 s by
 
@@ -1,6 +1,19 @@
-ShadowCode 0.29.0 adds OpenRouter for people without a subscription, and
-makes web search work from networks where DuckDuckGo refuses automated
-requests. The 0.28 notes follow below.
+ShadowCode 0.30.0 makes Antigravity a full citizen: it now asks before it
+acts, like Codex, Claude Code, Cursor and Grok. The 0.29 notes follow below.
+
+## New in 0.30.0
+
+- **Antigravity asks first.** It now runs through Google's official ACP agent
+  server instead of the `agy` CLI's print mode, which silently denied any
+  command. Commands and edits reach ShadowCode's approvals, images work, and
+  conversations resume.
+- **One-time install.** **Settings › Accounts › Antigravity › Install**
+  downloads the server from Google (334 MB, checksum-verified). **Connect**
+  then signs in with Google in your browser. This sign-in is ShadowCode's own
+  and separate from the `agy` CLI.
+- **No surprise browser tabs.** Status checks and tasks never open a sign-in
+  page. If the sign-in expires, the row says *Sign in* and a task stops with
+  that message.
 
 ## New in 0.29.0
 
@@ -119,9 +132,9 @@ runtime that ships with the app.
 
 ## Downloads
 
-- `ShadowCode_0.29.0_amd64.AppImage`
-- `ShadowCode_0.29.0_amd64.deb`
-- `ShadowCode_0.29.0_appimage-runtime-sources.tar.gz`
+- `ShadowCode_0.30.0_amd64.AppImage`
+- `ShadowCode_0.30.0_amd64.deb`
+- `ShadowCode_0.30.0_appimage-runtime-sources.tar.gz`
 - `SHA256SUMS`
 
 Builds are for x86_64 Linux with glibc 2.39 or newer (Ubuntu 24.04 or later).
 
@@ -17,7 +17,7 @@ tools** (`cli_agents.<vendor>_binary`).
 | Codex | `codex` | `npm i -g @openai/codex` | **Connect** runs `codex login` |
 | Claude Code | `claude` | [Claude Code](https://code.claude.com/docs/en/headless) | **Connect** runs `claude auth login` |
 | Cursor | `cursor-agent` | [Cursor CLI](https://cursor.com/docs/cli/acp) | **Connect** runs `cursor-agent login` |
-| Antigravity | `agy` | [Antigravity CLI](https://antigravity.google/docs/cli/install/) (the `antigravity` desktop app is not the CLI) | Run `agy` once in a terminal. ShadowCode can't start this sign-in |
+| Antigravity | `agy_acp_server.par` (Google's ACP agent server) | **Install** in **Settings › Accounts** downloads Google's official agent server (334 MB from dl.google.com, checked against a pinned SHA-256) | **Connect** signs in with Google in the browser |
 | Grok | `grok` | [xAI CLI](https://docs.x.ai/build) | **Connect** runs `grok login` |
 
 - **Connect** runs the login command with your environment, minus provider API
@@ -29,26 +29,51 @@ tools** (`cli_agents.<vendor>_binary`).
   `claude auth logout`, `cursor-agent logout` or `grok logout`. Those sign the
   CLI out everywhere on this computer, not only in ShadowCode. ShadowCode then
   forgets the vendor's cached status, stored usage snapshots and every
-  conversation's stored vendor session. Antigravity keeps its login in the OS
-  keyring: type `/logout` inside `agy`.
+  conversation's stored vendor session. For Antigravity, Disconnect deletes
+  ShadowCode's private Antigravity profile (its Google sign-in); the `agy` CLI
+  and the Antigravity app keep their own sign-ins.
 - **Refresh** checks one vendor again. Otherwise each vendor is checked at
   most once every 5 minutes, and failures back off. In *Offline* mode no vendor
   process is started for status, models or usage.
 
 A row is **Ready** only after the vendor's own status check says so. An
 installed binary or a login file is not enough.
 
+## Antigravity's agent server
+
+Antigravity runs through Google's official ACP agent server, the one listed in
+the [ACP registry](https://github.com/agentclientprotocol/registry) and used by
+other editors. It asks ShadowCode before it runs commands or edits files, which
+the `agy` CLI's print mode could not do.
+
+- **Install.** **Settings › Accounts › Antigravity › Install** downloads
+  version 1.2.1 from `dl.google.com` (334 MB), checks its size and SHA-256,
+  and unpacks it (about 1.1 GB) into
+  `~/.local/share/shadowcode/antigravity-acp/1.2.1`. **Remove agent** deletes
+  it. To use a copy you manage yourself, set `cli_agents.antigravity_binary`
+  to its `agy_acp_server.par` path (with `localharness_external` beside it).
+- **Sign-in.** The server keeps its Google sign-in in a private profile,
+  `~/.local/share/shadowcode/antigravity-acp/profile`, separate from the `agy`
+  CLI and the Antigravity app. **Connect** lets it open your browser;
+  ShadowCode also shows the link. Status checks and tasks never open a browser:
+  if the sign-in is missing or expired, the row says *Sign in* and a task
+  stops with that message.
+- **Temp files.** Each launch gets its own temp directory, removed afterwards.
+- **Hosts without IPv6.** The server refuses to start without an IPv6
+  loopback (`::1`); on such hosts ShadowCode passes the server's own
+  `--enforce_kernel_ipv6_support=false` switch.
+
 ## What each vendor exposes
 
 | | Codex | Claude Code | Cursor | Antigravity | Grok |
 | --- | --- | --- | --- | --- | --- |
-| Runtime | `codex app-server` (JSON-RPC 2.0) | `claude -p --output-format stream-json --input-format stream-json --verbose --include-partial-messages --permission-prompts host` | `cursor-agent acp` (Agent Client Protocol) | `agy --output-format stream-json --input-format stream-json --print=` | `grok agent stdio` (ACP) |
-| Sign-in check | app-server `account/read` (falls back to `codex login status`) | `claude auth status` | ACP `initialize` → `authenticate` → `session/new` | `agy models` | ACP handshake (falls back to `grok models`) |
-| Models | app-server `model/list` | *Default* plus the aliases (`fable`, `opus`, `sonnet`, `haiku`) that the installed `claude --help` lists | ACP session models. Exact IDs, including bracketed parameters, set with `session/set_model`. *Auto* is Cursor's own router | `agy models` | ACP session models |
-| Image input | Yes (`localImage`), for models that accept images | Yes (base64 image blocks) | When ACP `initialize` reports image support | No: text blocks only, and images are refused before sending | No: ACP reports `image: false` |
-| Approvals reach ShadowCode | Yes: command and file-change requests | Yes: `can_use_tool` control requests | Yes: `session/request_permission` | **No**: its own settings decide, and refusals are reported afterwards | Yes: `session/request_permission` |
-| Plan/Review (read-only) | `sandbox: read-only` | `--permission-mode plan` | ACP mode `plan`, when offered | `--mode plan` | Not enforced by Grok |
-| Resume | `thread/resume` | `--resume <session>` | `session/load` | `--conversation <id>` | `session/load` |
+| Runtime | `codex app-server` (JSON-RPC 2.0) | `claude -p --output-format stream-json --input-format stream-json --verbose --include-partial-messages --permission-prompts host` | `cursor-agent acp` (Agent Client Protocol) | `agy_acp_server.par --uid=` (Agent Client Protocol) | `grok agent stdio` (ACP) |
+| Sign-in check | app-server `account/read` (falls back to `codex login status`) | `claude auth status` | ACP `initialize` → `authenticate` → `session/new` | ACP `initialize` → `authenticate` (`oauth-personal`) → `session/new`; a printed Google sign-in link means *Sign in* | ACP handshake (falls back to `grok models`) |
+| Models | app-server `model/list` | *Default* plus the aliases (`fable`, `opus`, `sonnet`, `haiku`) that the installed `claude --help` lists | ACP session models. Exact IDs, including bracketed parameters, set with `session/set_model`. *Auto* is Cursor's own router | The `model` option of `session/new`'s `configOptions`, set with `session/set_config_option` | ACP session models |
+| Image input | Yes (`localImage`), for models that accept images | Yes (base64 image blocks) | When ACP `initialize` reports image support | Yes: ACP `initialize` reports image support | No: ACP reports `image: false` |
+| Approvals reach ShadowCode | Yes: command and file-change requests | Yes: `can_use_tool` control requests | Yes: `session/request_permission` | Yes: `session/request_permission` (questions it asks are skipped with a note) | Yes: `session/request_permission` |
+| Plan/Review (read-only) | `sandbox: read-only` | `--permission-mode plan` | ACP mode `plan`, when offered | ShadowCode denies its requests | Not enforced by Grok |
+| Resume | `thread/resume` | `--resume <session>` | `session/load` | `session/load` | `session/load` |
 | Usage shown | Plan rate-limit windows per quota pool | *Usage unavailable* | *Usage unavailable* | *Usage unavailable* | *Usage unavailable* |
 
 Grok isn't one of the featured vendors: its rows are listed after the others.
@@ -67,8 +92,7 @@ ShadowCode shows only what a vendor reports. It never estimates a figure.
   *Usage unavailable* and links to `claude.ai/settings/usage`.
 - **Cursor** reports its plan tier but no remaining allowance, so the row says
   *Usage unavailable*.
-- **Antigravity** shows usage only in its interactive `/usage` panel, which
-  can't be read by another program.
+- **Antigravity**'s agent server reports no plan usage to other programs.
 - **Grok** reports per-session token counts only.
 
 After a restart, the last Codex snapshot is loaded from the database and marked