fix: keep agy websearch permissions enabled (#1625)

lib/hooks/websearch-transformer.cjs

@@ -901,17 +901,9 @@ function tryAgySearch(query, timeoutSec = DEFAULT_TIMEOUT_SEC) {
     const timeoutMs = timeoutSec * 1000;
     const model = process.env.CCS_WEBSEARCH_AGY_MODEL || PROVIDER_CONFIG.agy.model;
     const prompt = buildPrompt('agy', query);
-    // gemini flag mapping: `--yolo` -> `--dangerously-skip-permissions`, `-m` -> `--model`,
-    // shell `timeout N` -> native `--print-timeout Ns`. The prompt is passed to `-p` (print mode).
-    const args = [
-      '--model',
-      model,
-      '--dangerously-skip-permissions',
-      '--print-timeout',
-      `${timeoutSec}s`,
-      '-p',
-      prompt,
-    ];
+    // Use print mode without disabling Antigravity permission checks. WebSearch queries can
+    // contain untrusted prompt text, so permission prompts must remain enforced.
+    const args = ['--model', model, '--print-timeout', `${timeoutSec}s`, '-p', prompt];
 
     debug(`Executing Antigravity (agy) fallback with model ${model}`);
     return runAgyCommand(args, timeoutMs);

tests/unit/hooks/websearch-transformer.test.ts

@@ -133,6 +133,16 @@ describe('websearch-transformer legacy CLI safety', () => {
     expect(source).not.toContain('shell: isWindows');
     expect(source.match(/shell: false/g) || []).toHaveLength(4);
   });
+
+  it('does not disable Antigravity permission checks for query-derived prompts', () => {
+    const source = readFileSync(hookPath, 'utf8');
+
+    expect(source).not.toContain("'--dangerously-skip-permissions'");
+    expect(source).not.toContain('"--dangerously-skip-permissions"');
+    expect(source).toContain(
+      "const args = ['--model', model, '--print-timeout', `${timeoutSec}s`, '-p', prompt]"
+    );
+  });
 });
 
 describe('websearch-transformer hook helpers', () => {