@estebanforge/pi-antigravity-bridge 1.4.0 → 1.4.2

package/extensions/index.ts

@@ -11,10 +11,12 @@
 //   ("[agy tool: editing foo.ts]") for visibility, but the edits already landed
 //   on disk and pi's inline diff review does not engage.
 //
-// /agy command: status, mode picker (plan / accept-edits),
-// and session clear. Config persists to ~/.pi/agent/antigravity-bridge/
-// config.json so toggles survive restarts.
+// /agy command: full runtime config surface (engine, mode, permissions,
+// bridge tools, model, thinking, digest, system prompt, acp binary) plus
+// doctor, auth, patch-cleanup, and session clear. Config persists to
+// ~/.pi/agent/antigravity-bridge/config.json so toggles survive restarts.
 
+import os from "node:os";
 import {
 	type ExtensionAPI,
 	type ExtensionCommandContext,
@@ -38,7 +40,7 @@ import { SessionStore } from "../src/sessions.js";
 import { ToolRoundTrips, WrapperReplay, createStreamSimple } from "../src/provider.js";
 import { AgyDriver } from "../src/driver.js";
 import { AcpDriver } from "../src/acp/driver.js";
-import { resolveAcpBinary } from "../src/acp/connection.js";
+import { ensureAcpReady, inspectAcpSetup } from "../src/acp/setup.js";
 import type { TurnDriver } from "../src/driver-types.js";
 import { CONFIG_PATH, loadConfig, saveConfig, type AgyMode, type BridgeTools, type Engine, type ThinkingTier } from "../src/config.js";
 import { registerAskAntigravityTool, toolModelsFromRaw } from "../src/ask-tool.js";
@@ -97,14 +99,32 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	// MCP bridge handle, declared early: the ACP engine reads the bridge port
 	// at session/new / session/load time.
 	let mcpHandle: McpServerHandle | null = null;
+	// ACP self-heal runs once per process (session_start re-fires on /reload;
+	// a ready setup is two file stats, so re-running is harmless anyway).
+	let acpSelfHealRan = false;
 	// Two turn engines behind one contract (plan §9): stream-json (tested
 	// default) and the official ACP server (opt-in via config.engine, off by
 	// default). Neither spawns anything until its first turn.
+	// ACP log routing: only genuine failures reach stderr. Routine lifecycle
+	// (driver-created, spawn, session-new, ...) stays in the driver's
+	// #lifecycle ring buffer, visible via /agy doctor. An unfiltered sink fired
+	// console.error at extension load ("driver-created"), before any UI exists,
+	// and leaked raw driver lines into the terminal on every startup.
+	const acpFailures = new Set([
+		"start-failed", "spawn-error", "parse-error", "write-failed",
+		"mode-apply-failed", "timeout", "stall", "auth-required",
+		"session-load-failed-creating-fresh", "connection-exited", "cancel-failed",
+		"unsupported-server-request",
+	]);
 	const legacyDriver = new AgyDriver();
 	const acpDriver = new AcpDriver({
-		bin: resolveAcpBinary(loadConfig().acp.bin),
-		log: (msg, data) =>
-			console.error(`[antigravity-bridge acp] ${msg}${data !== undefined ? " " + JSON.stringify(data) : ""}`),
+		// Resolved per connection: the setup flow can install the binary and
+		// update acp.bin mid-session; the next turn picks it up (no restart).
+		bin: () => loadConfig().acp.bin,
+		log: (msg, data) => {
+			if (!acpFailures.has(msg)) return;
+			console.error(`[antigravity-bridge acp] ${msg}${data !== undefined ? " " + JSON.stringify(data) : ""}`);
+		},
 		mcpServers: () => {
 			const handle = mcpHandle;
 			if (!handle) return [];
@@ -233,29 +253,52 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		} catch {
 			/* detection is best-effort */
 		}
-		// Bridge lifecycle/error logger. Routes through ctx.ui.notify (an
-		// ephemeral toast that fades) instead of stderr: pi's TUI captures stderr
-		// and pins it above the input for the whole session, which left the
-		// startup "bridge-config-written" / "listening" lines stuck on screen all
-		// session. Headless modes (print/json, hasUI === false) have no toast, so
-		// fall back to stderr there. Per-turn success events (list-tools /
-		// call-tool) stay silent either way.
+		// ACP self-heal: engine=acp needs a server binary + auth. Silent when
+		// everything is ready; installs from the registry and bootstraps auth
+		// otherwise; manual instructions only on failure. Fire-and-forget: it
+		// must not delay session start (and nothing spawns until the first turn).
+		if (engine === "acp" && !acpSelfHealRan) {
+			acpSelfHealRan = true;
+			void ensureAcpReady({ configBin: loadConfig().acp.bin }).then((status) => {
+				if (status.ok) {
+					if (status.binarySource === "installed" || status.binarySource === "existing") {
+						saveConfig({ acp: { bin: status.bin, permissions: loadConfig().acp.permissions } });
+					}
+					if (status.needsLogin) {
+						const msg =
+							"ACP: one-time Google login pending. Your next antigravity message opens the browser; sign in with your Antigravity subscription account (the same login as the agy CLI). Tokens stay on your machine.";
+						if (ctx.hasUI) ctx.ui.notify(msg, "info");
+						else console.error(`[antigravity-bridge] ${msg}`);
+					}
+					return;
+				}
+				const msg = `ACP auto-setup failed (${status.error}).\n${status.manual}`;
+				if (ctx.hasUI) ctx.ui.notify(msg, "warning");
+				else console.error(`[antigravity-bridge] ${msg}`);
+			});
+		}
+		// Bridge failure logger. Routine lifecycle (listening,
+		// bridge-config-written/removed, closed) is normal startup/teardown
+		// traffic: toasting it every session, or pinning it via stderr in
+		// headless mode, was noise. Only genuine failures surface - as a
+		// warning toast (ctx.ui.notify, ephemeral) or stderr when headless.
+		// Per-turn success events (list-tools / call-tool) stay silent.
 		const mcpLog = (s: string, d?: unknown) => {
-			const surfaced = new Set([
-				"listening", "capability-missing", "http-error", "closed",
-				"bridge-config-written", "bridge-config-removed", "bridge-config-write-failed",
-				"call-tool-fail", "transport-error", "handleRequest-error",
-				"request-error", "request-handler-error", "unauthorized", "self-patch-error",
+			// Routine abort traffic: failAll fires on turn end / session shutdown
+			// and the bridge answers every parked call with an error. Not a fault.
+			if (s === "call-tool-fail") {
+				const detail = (d as { msg?: string } | undefined)?.msg ?? "";
+				if (detail.includes("unresolved pi tool call") || detail.includes("session shut down")) return;
+			}
+			const failures = new Set([
+				"http-error", "bridge-config-write-failed", "call-tool-fail",
+				"transport-error", "handleRequest-error", "request-error",
+				"request-handler-error", "unauthorized",
 			]);
-			if (!surfaced.has(s)) return;
+			if (!failures.has(s)) return;
 			const msg = `[antigravity-bridge mcp] ${s}${d !== undefined ? " " + JSON.stringify(d) : ""}`;
-			if (ctx.hasUI) {
-				const ok = s === "listening" || s === "bridge-config-written"
-					|| s === "bridge-config-removed" || s === "closed";
-				ctx.ui.notify(msg, ok ? "info" : "warning");
-			} else {
-				console.error(msg);
-			}
+			if (ctx.hasUI) ctx.ui.notify(msg, "warning");
+			else console.error(msg);
 		};
 		// Start the bridge unless the user turned it off. No patch gate, no
 		// consent flow: calls route through pi's normal toolUse loop.
@@ -263,7 +306,9 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		if (bridgeMode === "none") return; // user opted out
 		if (mcpHandle) return; // already running (reload re-fires session_start)
 		const SKIP = new Set(["AskAntigravity"]);
-		const skills: SkillLite[] = scanSkills(process.cwd());
+		// pi loads project skill locations only after the project is trusted;
+		// mirror that gate. Global skill dirs are always scanned.
+		const skills: SkillLite[] = scanSkills(ctx.isProjectTrusted() ? process.cwd() : undefined);
 		const getAll = (pi as unknown as {
 			getAllTools: () => Array<{ name: string; description?: string; parameters?: object; sourceInfo?: { source?: string } }>;
 		}).getAllTools.bind(pi);
@@ -350,6 +395,9 @@ interface PendingConfig {
 	skipPermissions?: boolean;
 	defaultModel?: string;
 	defaultThinking?: ThinkingTier;
+	bridgeTools?: BridgeTools;
+	digest?: boolean;
+	systemPrompt?: boolean;
 }
 
 function statusText(ctx: AgyCommandCtx): string {
@@ -370,7 +418,7 @@ function statusText(ctx: AgyCommandCtx): string {
 		`  digest:        ${config.digest ? "on" : "off"}`,
 		`  system prompt: ${config.systemPrompt ? "on" : "off"}`,
 		"",
-		"Subcommands: /agy engine stream-json|acp, /agy mode plan|accept-edits, /agy permissions on|off, /agy model flash|pro|gemini, /agy thinking low|medium|high, /agy digest on|off, /agy system-prompt on|off, /agy acp-auth, /agy patch-cleanup, /agy clear",
+		"Subcommands: /agy engine stream-json|acp, /agy mode plan|accept-edits, /agy permissions on|off, /agy bridge all|mcp|none, /agy model <alias>, /agy thinking low|medium|high, /agy digest on|off, /agy system-prompt on|off, /agy acp-bin <path|auto>, /agy acp-auth, /agy patch-cleanup, /agy clear",
 	].join("\n");
 }
 
@@ -378,7 +426,7 @@ function statusText(ctx: AgyCommandCtx): string {
 function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 	pi.registerCommand("agy", {
 		description:
-			"Antigravity provider: status, doctor, engine picker, mode picker, clear sessions. Usage: /agy [status|doctor|engine stream-json|acp|mode [plan|accept-edits]|permissions on|off|digest on|off|system-prompt on|off|acp-auth|patch-cleanup|clear]",
+			"Antigravity provider: status, doctor, settings picker, clear sessions. Usage: /agy [status|doctor|engine stream-json|acp|mode plan|accept-edits|permissions on|off|bridge all|mcp|none|model <alias>|thinking low|medium|high|digest on|off|system-prompt on|off|acp-bin <path|auto>|acp-auth|patch-cleanup|clear]",
 		handler: async (args, cmdCtx: ExtensionCommandContext) => {
 			const ui = cmdCtx.ui;
 			const mode = cmdCtx.mode;
@@ -413,9 +461,32 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 			}
 			if (sub === "engine") {
 				if (val === "acp" || val === "stream-json") {
+					if (val === "acp" && loadConfig().mode === "plan") {
+						ui?.notify("mode is plan; the ACP engine has no plan mode. /agy mode accept-edits first.", "warning");
+						return;
+					}
 					const next = saveConfig({ engine: val });
+					if (next.engine !== "acp") {
+						ui?.notify("engine set to stream-json. Takes effect on the next pi start (or /reload).", "info");
+						return;
+					}
+					// Self-service setup: install the server from the official
+					// registry and bootstrap auth now, so the restart just works.
+					// Manual instructions only when a step fails.
+					ui?.notify("engine set to acp. Preparing the server (binary + auth)…", "info");
+					const status = await ensureAcpReady({
+						configBin: loadConfig().acp.bin,
+						onProgress: (m) => ui?.notify(m, "info"),
+					});
+					if (!status.ok) {
+						ui?.notify(`ACP auto-setup failed (${status.error}).\n${status.manual}`, "warning");
+						return;
+					}
+					saveConfig({ acp: { bin: status.bin, permissions: loadConfig().acp.permissions } });
 					ui?.notify(
-						`engine set to ${next.engine}. Takes effect on the next pi start (or /reload).${next.engine === "acp" ? "\nRequires the official ACP server binary (AGY_ACP_BIN or acp.bin) and a one-time auth: /agy acp-auth" : ""}`,
+						status.needsLogin
+							? "ACP engine ready. Your first ACP message opens the Google login in your browser: sign in with the account of your Antigravity subscription (the same login as the Antigravity CLI, agy). One-time; tokens stay on your machine and this extension never sees them. Takes effect on the next pi start (or /reload)."
+							: `ACP engine ready (auth: ${status.auth}). Takes effect on the next pi start (or /reload).`,
 						"info",
 					);
 				} else {
@@ -423,20 +494,47 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				}
 				return;
 			}
+			if (sub === "acp-bin") {
+				const rest = (args ?? "").trim().split(/\s+/).slice(1).join(" ");
+				if (rest.length > 0) {
+					// Only the keyword compares case-insensitively; the path keeps its case.
+					const bin = rest.toLowerCase() === "auto" ? "" : rest.replace(/^~(?=\/|$)/, os.homedir());
+					saveConfig({ acp: { bin, permissions: loadConfig().acp.permissions } });
+					ui?.notify(
+						bin
+							? `acp.bin set to ${bin}. The next ACP turn (re)connects with it.`
+							: "acp.bin cleared. Auto-setup (or AGY_ACP_BIN) picks the binary on the next ACP turn.",
+						"info",
+					);
+				} else {
+					const cur = loadConfig().acp.bin;
+					ui?.notify(`acp.bin: ${cur || "(auto: setup installs, or AGY_ACP_BIN)"}\nusage: /agy acp-bin <path|auto>`, "info");
+				}
+				return;
+			}
 			if (sub === "acp-auth") {
 				ui?.notify(
 					[
-						"ACP engine authentication (one-time):",
-						"1. Install the server binary (agy_acp_server.par from the ACP registry",
-						"   build URL) and point acp.bin or AGY_ACP_BIN at it.",
-						"2. Pick one credential path:",
-						'   - oauth-personal: put {"auth":{"type":"oauth-personal"}} in',
-						"     ~/.gemini/antigravity-acp/settings.json, run one turn, and open the",
-						"     login URL the server produces (headless: tunnel 127.0.0.1:<port>",
-						"     over ssh, then open the URL on your machine).",
-						'   - gemini-api-key: export GEMINI_API_KEY and set',
-						'     {"auth":{"type":"gemini-api-key"}} (headless-friendly; metered).',
-						"   The agent never reads or writes your credentials.",
+						"ACP engine authentication (one-time; usually automatic -",
+						"/agy engine acp and session start set this up for you):",
+						"",
+						"The server is Google's official Antigravity ACP, installed from Google's",
+						"own registry. Logging in uses your Antigravity subscription: the same",
+						"Google account and plan as the Antigravity CLI (agy). It is no different",
+						"from logging into the CLI; the server just keeps its own token file on",
+						"your machine, like any Google tool. This extension never sees your",
+						"credentials.",
+						"",
+						"1. Server binary: auto-setup installs it. Manual: agy_acp_server.par from",
+						"   the antigravity-acp registry; point acp.bin or AGY_ACP_BIN at it.",
+						'2. Default: put {"auth":{"type":"oauth-personal"}} in',
+						"   ~/.gemini/antigravity-acp/settings.json, run one turn, and complete the",
+						"   Google login that opens in your browser (headless: tunnel 127.0.0.1:<port>",
+						"   over ssh, then open the URL on your machine).",
+						'   Headless alternative: GEMINI_API_KEY + {"auth":{"type":"gemini-api-key"}}',
+						"   (metered paid API - not your Antigravity plan). The key is used only",
+						"   when that type is selected; with the default oauth-personal in place,",
+						"   an exported key is ignored.",
 						"3. Run one turn; /agy doctor shows the server version when auth is OK.",
 					].join("\n"),
 					"info",
@@ -469,11 +567,22 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 					lines.push("  lifecycle (last 5):");
 					for (const entry of snap.lifecycle.slice(-5)) lines.push(`    ${entry}`);
 				}
+				if (engine === "acp") {
+					const setup = inspectAcpSetup({ configBin: config.acp.bin });
+					lines.push(
+						`  acp binary:    ${setup.bin ?? "not found (auto-setup offers install)"}${setup.source ? ` (${setup.source})` : ""}`,
+						`  acp auth:      ${setup.auth ?? "not configured (auto-setup bootstraps)"}`,
+					);
+				}
 				ui?.notify(lines.join("\n"), "info");
 				return;
 			}
 			if (sub === "mode") {
 				if (val === "plan" || val === "accept-edits") {
+					if (val === "plan" && ctx.engine === "acp") {
+						ui?.notify("the ACP engine has no plan mode (RC01). /agy engine stream-json first, or /agy mode accept-edits.", "warning");
+						return;
+					}
 					const next = saveConfig({ mode: val as AgyMode });
 					ui?.notify(`mode set to ${next.mode}`, "info");
 				} else {
@@ -491,6 +600,20 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				}
 				return;
 			}
+			if (sub === "bridge") {
+				if (val === "all" || val === "mcp" || val === "none") {
+					const next = saveConfig({ bridgeTools: val });
+					ui?.notify(
+						next.bridgeTools === "none"
+							? "bridge off. The MCP tool bridge will not start on the next pi start (or /reload)."
+							: `bridge tools set to ${next.bridgeTools}. The catalog rebuilds on the next pi start (or /reload).`,
+						"info",
+					);
+				} else {
+					ui?.notify(`bridge: ${loadConfig().bridgeTools}\nusage: /agy bridge all|mcp|none\n  all: every non-builtin pi tool (default). mcp: pi-mcp-adapter tools + skills only. none: bridge off.`, "info");
+				}
+				return;
+			}
 			if (sub === "model") {
 				if (val && val.length > 0) {
 					const next = saveConfig({ defaultModel: val });
@@ -556,7 +679,10 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 	});
 }
 
-/** Interactive settings picker (TUI only). Rows: mode + permissions + model + thinking. */
+/** Interactive settings picker (TUI only). Rows: the full runtime config
+ *  surface (mode, permissions, model, thinking, bridge, digest, system
+ *  prompt). Engine stays a subcommand: switching runs install + auth setup
+ *  and needs a restart. */
 async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promise<void> {
 	const config = loadConfig();
 	const pending: PendingConfig = {};
@@ -594,6 +720,30 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 			currentValue: config.defaultThinking,
 			values: ["low", "medium", "high"],
 		},
+		{
+			id: "bridge",
+			label: "Bridge tools",
+			description:
+				"Which pi tools the MCP bridge exposes to agy. all: every non-builtin tool (default). mcp: pi-mcp-adapter tools + skills. none: bridge off.",
+			currentValue: config.bridgeTools,
+			values: ["all", "mcp", "none"],
+		},
+		{
+			id: "digest",
+			label: "Context digest",
+			description:
+				"Inject a delta of pi-side context into each agy prompt. Defeats agy's prompt cache (~25-30k tokens re-billed per turn).",
+			currentValue: config.digest ? "on" : "off",
+			values: ["on", "off"],
+		},
+		{
+			id: "system-prompt",
+			label: "System prompt",
+			description:
+				"Prepend pi's system prompt (incl. AGENTS.md files) to the first prompt of each new agy conversation.",
+			currentValue: config.systemPrompt ? "on" : "off",
+			values: ["on", "off"],
+		},
 	];
 
 	await ui.custom((tui, theme, _kb, done) => {
@@ -614,6 +764,12 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 					pending.defaultModel = newValue;
 				} else if (id === "thinking") {
 					pending.defaultThinking = newValue as ThinkingTier;
+				} else if (id === "bridge") {
+					pending.bridgeTools = newValue as BridgeTools;
+				} else if (id === "digest") {
+					pending.digest = newValue === "on";
+				} else if (id === "system-prompt") {
+					pending.systemPrompt = newValue === "on";
 				}
 			},
 			() => done(undefined),
@@ -630,13 +786,12 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 		};
 	});
 
-	if (
-		pending.mode === undefined &&
-		pending.skipPermissions === undefined &&
-		pending.defaultModel === undefined &&
-		pending.defaultThinking === undefined
-	)
+	if (Object.keys(pending).length === 0) return;
+
+	if (pending.mode === "plan" && ctx.engine === "acp") {
+		ui.notify("the ACP engine has no plan mode (RC01). Switch /agy engine stream-json first.", "warning");
 		return;
+	}
 
 	try {
 		const next = saveConfig(pending);
@@ -647,6 +802,9 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 				: null,
 			pending.defaultModel !== undefined ? `tool model=${next.defaultModel}` : null,
 			pending.defaultThinking !== undefined ? `tool thinking=${next.defaultThinking}` : null,
+			pending.bridgeTools !== undefined ? `bridge=${next.bridgeTools}` : null,
+			pending.digest !== undefined ? `digest=${next.digest ? "on" : "off"}` : null,
+			pending.systemPrompt !== undefined ? `system-prompt=${next.systemPrompt ? "on" : "off"}` : null,
 		]
 			.filter(Boolean)
 			.join(", ");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",
@@ -59,9 +59,10 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.3",
-    "@earendil-works/pi-coding-agent": "^0.84.3",
-    "@earendil-works/pi-tui": "^0.84.3",
+    "@earendil-works/pi-ai": "^0.85.0",
+    "@earendil-works/pi-coding-agent": "^0.85.0",
+    "@earendil-works/pi-server": "^0.85.0",
+    "@earendil-works/pi-tui": "^0.85.0",
     "@types/node": "^22.0.0",
     "tsx": "^4.19.0",
     "typebox": "^1.1.38",

package/src/acp/connection.ts

@@ -11,8 +11,9 @@
 //     the effort tier baked in, e.g. gemini-3.8-flash-low)
 //   - session/cancel returns -32601 on RC01 (not implemented) — the driver
 //     treats that as "cancel unsupported" and falls back to teardown+kill
-//   - session/request_permission is answered in-connection: single `auto`
-//     policy, first allow option selected (plan §9.3)
+//   - session/request_permission is answered in-connection: policy per turn
+//     (skipPermissions on -> first allow option; off -> first reject option,
+//     fail-closed)
 //   - session/load replays history as notifications BEFORE its response; the
 //     driver suppresses updates while the load is in flight
 //   - mcpServers entries: {name, type:"http", url, headers:[]} — headers is a
@@ -58,6 +59,10 @@ export interface AcpConnectionOptions {
 	/** mcpServers entries for session/new AND session/load (run 6: load takes
 	 *  the same param). Evaluated lazily per call. */
 	mcpServers?: () => AcpMcpServer[];
+	/** Permission policy for session/request_permission, evaluated per request:
+	 *  "auto" selects the first allow option; "deny" fail-closes to the first
+	 *  reject option. Absent = deny (fail closed). */
+	permissions?: () => "auto" | "deny";
 }
 
 const INIT_TIMEOUT_MS = 30_000;
@@ -114,6 +119,13 @@ export class AcpConnection {
 		this.#child = child;
 		child.stdout?.setEncoding("utf8");
 		child.stderr?.setEncoding("utf8");
+		// Pipe failures arrive asynchronously as stream 'error' events; the sync
+		// try/catch in #write cannot see them. Without this listener an EPIPE
+		// (server died mid-handshake) is uncaught and kills pi.
+		child.stdin?.on("error", (err) => {
+			this.#opts.log("stdin-error", { message: err.message });
+			if (!this.#exited && !this.#killed) this.#finish(err.message);
+		});
 
 		const rpc = new JsonRpcSession({
 			send: (frame) => this.#write(frame),
@@ -253,9 +265,10 @@ export class AcpConnection {
 		await this.guarded("session/close", { sessionId }, SESSION_OP_TIMEOUT_MS);
 	}
 
-	/** Protocol-level abort: single `auto` policy (plan §9.3) — select the
-	 *  first allow option. Never hangs: options are data from the server and
-	 *  the answer is computed synchronously. */
+	/** Protocol-level permission answering: policy from the driver ("auto"
+	 *  selects the first allow option; "deny" fail-closes to the first reject
+	 *  option). Never hangs: options are data from the server and the answer
+	 *  is computed synchronously. */
 	#onServerRequest(method: string, params: unknown): Promise<unknown> {
 		if (method === "session/request_permission") {
 			const options = (
@@ -263,9 +276,10 @@ export class AcpConnection {
 			) as Array<{ optionId?: string; kind?: string }> | undefined;
 			const allow = options?.find((o) => typeof o.kind === "string" && o.kind.startsWith("allow"));
 			const deny = options?.find((o) => typeof o.kind === "string" && o.kind.startsWith("reject"));
-			const chosen = allow ?? deny ?? options?.[0];
-			this.#opts.log("permission", { optionId: chosen?.optionId ?? "allow", policy: "auto" });
-			return Promise.resolve({ outcome: { outcome: "selected", optionId: chosen?.optionId ?? "allow" } });
+			const policy = this.#opts.permissions?.() ?? "deny";
+			const chosen = policy === "auto" ? (allow ?? deny ?? options?.[0]) : (deny ?? options?.[0]);
+			this.#opts.log("permission", { optionId: chosen?.optionId, policy });
+			return Promise.resolve({ outcome: { outcome: "selected", optionId: chosen?.optionId } });
 		}
 		// fs/* and terminal/* are declined: our client capabilities are off and
 		// agy keeps executing its own tools (plan §8 capability posture).

package/src/acp/driver.ts

@@ -34,8 +34,10 @@ import type {
 const LIFECYCLE_LIMIT = 24;
 
 export interface AcpDriverOptions {
-	/** Config acp.bin value (may be empty). Env AGY_ACP_BIN wins. */
-	bin: string;
+	/** Config acp.bin value (may be empty). Env AGY_ACP_BIN wins. A function
+	 *  is resolved per connection: setup can install the binary and update
+	 *  config mid-session, and the next turn picks it up without a restart. */
+	bin: string | (() => string);
 	/** Extra argv for the binary (tests: node + fake-server script). */
 	binArgs?: string[];
 	extraEnv?: Record<string, string>;
@@ -88,11 +90,11 @@ export function acpModelSlug(model: string, effort?: string): string {
 	return `${model}-${effort}`;
 }
 
-/** Map our config knobs onto ACP session modes. Under the single `auto`
- *  policy the practical effect of the modes converges (everything is
- *  approved); the mapping keeps the server-side counters honest.
- *  Known gap: the CLI's `--mode plan` has no ACP equivalent (review 4,
- *  finding 4) — plan delegations stay on the legacy path. */
+/** Map our config knobs onto ACP session modes. skipPermissions=false also
+ *  fail-closes the in-connection permission handler (reject options), so the
+ *  modes keep their server-side meaning. Known gap: the CLI's `--mode plan`
+ *  has no ACP equivalent (review 4, finding 4) — plan + acp is refused at the
+ *  command level and fails the turn visibly. */
 export function acpMode(mode: string, skipPermissions: boolean): string {
 	if (skipPermissions) return "yolo";
 	return mode === "plan" ? "default" : "auto_edit";
@@ -122,7 +124,7 @@ export class AcpDriver implements TurnDriver {
 
 	constructor(opts: AcpDriverOptions) {
 		this.#opts = opts;
-		this.#log("driver-created", { bin: resolveAcpBinary(opts.bin) });
+		this.#log("driver-created", { bin: typeof opts.bin === "function" ? "(resolved per turn)" : resolveAcpBinary(opts.bin) });
 	}
 
 	get state(): DriverState {
@@ -417,17 +419,19 @@ export class AcpDriver implements TurnDriver {
 		this.#state = "starting";
 		this.#stats.spawns += 1;
 		const conn = new AcpConnection({
-			bin: resolveAcpBinary(this.#opts.bin),
+			bin: resolveAcpBinary(typeof this.#opts.bin === "function" ? this.#opts.bin() : this.#opts.bin),
 			binArgs: this.#opts.binArgs,
 			extraEnv: this.#opts.extraEnv,
 			cwd: request.cwd,
 			mcpServers: this.#opts.mcpServers,
 			log: (msg, data) => this.#log(msg, data),
+			// Fail-closed permissions: only turns with skipPermissions answer allow.
+			permissions: () => (this.#active?.request.skipPermissions ? "auto" : "deny"),
 			onUpdate: (sessionId, update) => this.#onConnectionUpdate(sessionId, update),
 			onExit: (info) => this.#onConnectionExit(conn, info),
 		});
 		this.#conn = conn;
-		this.#log("spawn", { bin: resolveAcpBinary(this.#opts.bin) });
+		this.#log("spawn", { bin: resolveAcpBinary(typeof this.#opts.bin === "function" ? this.#opts.bin() : this.#opts.bin) });
 		return conn
 			.start()
 			.then(() => {