v1.1.8: Antigravity CLI (agy) backend

Google retired the Gemini CLI for free, Google AI Pro, and Google AI Ultra users on 2026-06-18. This release adds the Antigravity CLI (agy) backend and makes it the automatic default from that date, so the tool keeps working through the transition.

Highlights

• Pluggable backend via GEMINI_MCP_BACKEND (gemini or agy/antigravity). Unset uses a date-aware default that switches to agy on 2026-06-18.
• Enterprise and paid-API-key users are unaffected. Set GEMINI_MCP_BACKEND=gemini to stay on the Gemini CLI.
• agy output recovery: clean JSON stdout, plain stdout, opt-in PTY (AGY_MCP_PTY=1), then on-disk transcript.
• Configurable timeout GEMINI_MCP_TIMEOUT (minutes, default 45); agy's --print-timeout derives from it so long agent runs are not capped at agy's 5m default.
• Honest failures: agy's own errors (quota, auth) surface verbatim, and missing-CLI guidance names the retirement with the real agy install command.
• @file is inlined by us on the agy backend, keeping the CVE-2026-0755 project-root guard. dompurify bumped to 3.4.11 (#101).

Install: npm install -g gemini-mcp-tool

Migration guide: docs/migration/antigravity-cli.md and https://goo.gle/gemini-cli-migration

Reliability patch and the project's first automated test suite. Hardens cross-platform execution and adds a categorized node:test suite that gates CI. No runtime or default-config changes versus 1.1.6; the only new knob is the opt-in GEMINI_CLI_PATH.

Fixed

• Windows stdin prompt passing: changeMode and @file prompts are delivered on stdin instead of the -p flag, avoiding cmd.exe argument parsing and the OS command-line length limit. This also resolves the deprecated -p positional-prompt conflict for those prompts (#48). Adds windowsHide to suppress the popup console window (harvested from #27 via #77).
• Windows executable resolution: honours GEMINI_CLI_PATH, otherwise resolves the real gemini shim via where (preferring .cmd), and never selects an unlaunchable .ps1 or extensionless shim. Fixes "command not found" when the server does not inherit the shell PATH.
• Clearer ENOENT guidance when the executable is not found.
• stdin EPIPE and spawn-error hardening, so a child closing stdin early cannot drop the long-lived server connection (candidate fix for #64).
• Help tool now invokes gemini --help instead of -help.

Added

• Categorized node:test suite under test/: unit and integration (hermetic, gate CI on Node 18, 20, and 22), e2e (the real gemini CLI driven through the built MCP server, opt-in), and an LLM-as-a-Judge semantic tier (opt-in, work in progress). Includes a regression test for the changeMode cache-miss path (#67).
• Internal doctor tooling (npm run doctor, doctor test, doctor:judge), excluded from the published package.
• Maintained CHANGELOG.md documenting 1.1.1 through 1.1.7 (#39).

Thanks

Thanks to @samuelgudi (#48), @toller892 (#67), @jacobcxdev (#64), and @henricook (#39) for the reports and review that shaped this release.

Full changelog: https://github.com/jamubc/gemini-mcp-tool/blob/main/CHANGELOG.md

Pre-release of 1.2.0. Not published to NPM.
A cumulative beta of the Windows work since 1.1.5 (bundles the CVE-2026-0755 fix from 1.1.6 + the stdin/windowsHide feature work from #77).

Install/test from this tag: npm install -g github:jamubc/gemini-mcp-tool#v1.2.0-beta.1

Security (included from 1.1.6)

• CVE-2026-0755 (CWE-78) — removed the broken prompt quoting that injected literal quotes under shell:false and corrupted @file references; added assertSafeFileReferences() to contain @file refs to the working directory (blocks @/etc/passwd, @~/.ssh/…, ../ traversal); hardened Windows cmd.exe argument quoting so metacharacters in spaceless tokens can't break out. Fixes #73, #66.

Windows

• Complex prompts (changeMode / @file) are sent via stdin, sidestepping cmd.exe parsing and the OS command-line length limit on large prompts.
• windowsHide suppresses the popup console window.
• Resolves the word-splitting / "positional + --prompt" failures (#62, #40, #30, #28).

Thanks

Windows diagnosis & PRs from @quantitypg-jpg, @toller892, @Sundeepg98, @cj-elevate, @leonardommello, @orzcls.

🔒 Security release — upgrade immediately

All users on 1.1.2 – 1.1.5 should upgrade to 1.1.6.

CVE-2026-0755 (CWE-78) — OS command injection / @file exfiltration

Untrusted prompt input could reach the Gemini CLI @file parser, allowing it to read and exfiltrate arbitrary local files (@/etc/passwd, @~/.ssh/id_rsa, @../../secret). On Windows, unquoted cmd.exe metacharacters could break out into OS command injection.

Fix

• Removed the broken shell:false double-quote wrapping that provided no protection and corrupted @file references.
• Added assertSafeFileReferences() — rejects any @file reference resolving outside the project working directory (absolute paths, ~ home references, and ../ traversal).
• Hardened Windows cmd.exe argument quoting so metacharacters in spaceless tokens can no longer break out.

References

• NVD — CVE-2026-0755
• ZDI-26-021
• Snyk — SNYK-JS-GEMINIMCPTOOL-15091895

Fixes #73, #66.

Upgrade: npm install -g gemini-mcp-tool@1.1.6

Security fix: path-traversal protections for fetch-chunk and chunkCache (CWE-22). See CHANGELOG.md for details.

What's Changed

• Automatic fallback from gemini-2.5-pro to gemini-2.5-flash when quota is exceeded

See README for installation and usage instructions.