@estebanforge/pi-antigravity-bridge 1.4.7 → 1.4.9

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.4.9] - 2026-09-05
+
+### Added
+
+- Warn toasts in the pi UI: bridge tool failures, stalls, timeouts, process exits, and other warnings surface as native warning notifications the moment they happen, so users see them and can report them. Over SSH or without a UI the same text falls back to stderr. Deliberate aborts, connection exits (the turn's own error block carries real crashes), and `call-tool-fail` (same-instant duplicate of `round-trip-fail`) stay silent.
+- Gate B watch in `/agy doctor`: the ACP connection latches the first `session/update` payload that carries usage/token fields, and doctor prints one "acp tokens: AVAILABLE" line when that happens. Silent until then; the day the line appears, wiring real token counts becomes a small mapping job. Auth-style string `"token"` keys inside tool frames cannot trip the latch.
+
+### Fixed
+
+- Esc-abort on the ACP engine no longer dumps the dying server's raw stderr tail (a google3 stack trace) into the transcript. Teardown exits (abort kill, shutdown, idle recycle) are marked expected and never render; a genuine mid-turn crash surfaces as the turn's own clean error block instead. Raw tails still land in the file log for post-mortems.
+
+### Changed
+
+- The ACP engine is now beta. Parity is verified live against RC01 (text streaming, multi-turn resume, bridge tools, effort switching, serialization, abort recovery - see `scripts/parity-live.mjs`), so it graduates from opt-in-experimental to a supported alternative engine. It stays behind `config.engine` for now; the two known RC01 gaps (no usage fields, kill+reload abort) are documented in the README.
+- Daily log volume: the default tier now writes ONLY errors, so a regular session costs the disk nothing. Warns live in the UI (see above); `AGY_DEBUG=1` restores the full debug/info/warn/error trail for reproducing a problem. Docs: README debug-logs section, `/agy doctor` hint.
+- The tool-priority note now steers agy's native `view_file` (artifact-sandboxed on RC01) to the Pi Bridge file tools (`read`, `ls`, `grep`, `find`, `edit`, `execute`) for any real filesystem path. Observed live: repeated `invalid_args` rejections on `operator/pkg/tmux/client.go` before the model fell back to `edit`.
+
+## [1.4.8] - 2026-09-05
+
+### Added
+
+- Early-ack + poll for long bridge calls. agy's MCP client abandons a `tools/call` request at a flat ~180s (observed twice at exactly 180.000s), so any pi tool that ran longer died with "agy disconnected before the tool result arrived": the 225.7s `AskClaude` peer review that exposed it never reached agy, and agy salvaged its turn without the result. Now a call still running after ~20 seconds settles the HTTP request with a `STILL RUNNING` answer carrying a `callId`, and the new bridge-local `bridge_poll_result` tool returns the result when it lands (or "still running" on the way). pi keeps executing the whole time; fast calls never see any of this. An escalated park re-arms its own timeout to 30 minutes, so human-gated tools (commit previews, permission dialogs) can take as long as the human takes.
+- Late tool-result delivery as a backstop: a park that does fail (abort, timeout, recycle) leaves a bounded tombstone, and when the toolResult arrives anyway the provider re-routes it to agy as a new prompt in the same conversation ("Late tool delivery: ...") instead of erroring the turn. A late result that lands while another park still anchors the pass is deferred to the next pass (`late-result-deferred`), never dropped.
+- A `progress-token` probe in the bridge server: if agy's requests ever carry `_meta.progressToken`, MCP progress notifications become a testable zero-UX fix for the deadline. The exact-180s signature says it likely never fires; one log line settles it.
+
+### Fixed
+
+- A toolResult whose park already died no longer misclassifies the turn as "No user message to send to agy." That was the second half of the incident, and it turned a recoverable late delivery into a hard error.
+- `failAll` (fired on every turn end, OK turns included) no longer marks escalated calls failed: an escalated call outlives its agy turn by design, and the poll handle must not lie about a still-running tool (peer-review blocker).
+- `EscalationRegistry` eviction can no longer strand a running call: only settled entries evict, so a saturated cap grows instead of losing an in-flight result.
+
+### Changed
+
+- The tool-priority note now also teaches the poll pattern: long bridge calls answer `STILL RUNNING` + `bridge_poll_result`, and work that is known-long should use `exec_command`'s session output or background agents.
+- New daily-log events: `call-tool-escalated`, `poll-tool`, `late-result` (with a `freshConversation` flag), `late-result-deferred`, `progress-token`. Docs: README bridge section, ACP-PROTOCOL-REFERENCE timing table.
+
 ## [1.4.7] - 2026-09-05
 
 ### Added

package/README.md

@@ -21,11 +21,11 @@ Multi-turn works. The provider binds a pi session to an agy conversation id (per
 Turns run through one of two engines behind the same provider surface (`config.engine`, default `stream-json`):
 
 - **stream-json** (default): the persistent `agy` CLI process. The tested default; live token usage; conversation resume via `--conversation`.
-- **acp**: Google's official ACP server (`agy_acp_server.par`), JSON-RPC 2.0 over stdio. Opt-in while it matures: the current build (RC01) ships no usage fields (token display shows zero) and no cancel (abort tears the server down and reloads it next turn). Everything else is parity-verified live - text streaming, multi-turn resume via `session/load`, bridge tools, effort switching, serialization, abort recovery - see `scripts/parity-live.mjs`.
+- **acp** (beta): Google's official ACP server (`agy_acp_server.par`), JSON-RPC 2.0 over stdio. Beta: parity-verified live against the current build (RC01) - text streaming, multi-turn resume via `session/load`, bridge tools, effort switching, serialization, abort recovery (see `scripts/parity-live.mjs`). Two known RC01 gaps remain: no usage fields (token display shows zero) and no cancel (abort tears the server down and reloads it next turn).
 
 Engine-dependent features: pi image attachments ride natively only on the ACP engine (the picker offers image attach automatically when `config.engine` is `acp`; the stream-json CLI prompt is text-only). With the optional G1 digest enabled, its delivery also differs: ACP ships it as a native `embeddedContext` resource block, stream-json prepends it to the prompt text. The `AskAntigravity` delegation tool is unaffected by `config.engine` and runs the `stream-json` CLI (`agy -p`) across both configurations.
 
-| Capability | `stream-json` (default) | `acp` |
+| Capability | `stream-json` (default) | `acp` (beta) |
 | --- | --- | --- |
 | Show thinking text | No (token count only, floor 64, no text body) | Yes (streams thought text via `agent_thought_chunk`; sparse on RC01 where reasoning often arrives in message text) |
 | Live token usage | Yes (live metrics from CLI step events) | No (absent in RC01, displays zero tokens) |
@@ -68,6 +68,8 @@ The bridge starts a localhost MCP server inside pi's process. `tools/list` retur
 
 **No patch required.** Bridge calls park in the provider's round-trip store; the provider ends the pi assistant message with a `toolUse` stop reason for the real pi tool, pi executes it in its own loop (native cards, permissions, hooks), and the toolResult completes the parked MCP response on the next stream call. This is the same mechanism tianzuo/pi-antigravity uses; upstream pi APIs only.
 
+**Long calls don't die.** agy's MCP client abandons a `tools/call` request at a flat ~180s, which used to kill any pi tool that ran longer (a long peer review, a build, a commit preview waiting for you). A call still running after ~20 seconds now settles its HTTP request with a `STILL RUNNING` answer carrying a `callId` while pi keeps executing; agy fetches the result through the bridge-local `bridge_poll_result` tool and polls until it lands. Escalated calls get their own 30-minute budget, so human-gated tools can take as long as the human takes. Fast calls stay fully synchronous and never see any of this. If a park does fail (abort, timeout, recycle), the late result is re-routed to agy as a follow-up prompt in the same conversation instead of being lost.
+
 **Recursion safety.** Only the provider's agy receives the extra `--add-dir`. The `AskAntigravity` tool spawns its own agy with just the workspace, so that inner agy starts plain (no pi tools) and cannot re-enter. `AskAntigravity` is also filtered from the exposed tool list. Standalone agy is unaffected because nothing is written to its global config.
 
 **Cost / fan-out.** Every registered pi tool except builtins (and `AskAntigravity`) is exposed, including other delegation tools like `AskClaude`/`AskCodex`. agy can therefore chain into other models via the bridge, which is a new cost/time fan-out vector that did not exist before this feature.
@@ -155,7 +157,7 @@ The `activate_skill` catalog mirrors pi's directory-based skill discovery: the t
 /agy system-prompt on|off send pi's system prompt + AGENTS.md + the Pi Bridge tool-priority note to new agy conversations (default on)
 /agy bridge all|mcp|none  which pi tools the MCP bridge exposes to agy (default all; none = bridge off)
 /agy acp-bin <path|auto>  point the ACP engine at a specific server binary (auto = setup installs, or AGY_ACP_BIN; applies on the next ACP turn)
-/agy engine acp|stream-json   switch the turn engine (restart to apply; default stream-json; acp runs self-service setup: binary install + auth bootstrap)
+/agy engine acp|stream-json   switch the turn engine (restart to apply; default stream-json; acp is beta and runs self-service setup: binary install + auth bootstrap)
 /agy auth-manual             manual ACP credential setup (fallback; auto-setup normally covers this; default login = your Antigravity subscription, same account as the agy CLI)
 /agy patch-cleanup        restore the original pi files if an older version patched them
 /agy clear                drop all session bindings (force fresh conversations)
@@ -186,7 +188,7 @@ For isolation when running any agent that executes commands without a confirmati
 | `AGY_SKIP_PERMISSIONS` | `1`/`true` (default) to pass `--dangerously-skip-permissions` so commands don't hang on an unanswerable prompt in `-p` mode. `0`/`false` to prompt (hangs any `run_command` non-interactively). Wins over the config file. |
 | `AGY_DEFAULT_MODEL` | Default model alias for the `AskAntigravity` tool (`flash`/`pro`/`gemini`, or a tier/version qualifier). Wins over the config file. |
 | `AGY_DEFAULT_THINKING` | Default thinking tier for the `AskAntigravity` tool: `low`/`medium`/`high`. Anything else falls back to `medium`. Wins over the config file. |
-| `AGY_DEBUG` | `1`/`true`/`on` writes verbose debug records to the daily log (driver lifecycle, raw bridge traffic). Default off: only the light info/warn/error stream. |
+| `AGY_DEBUG` | `1`/`true`/`on` writes the full trail to the daily log (driver lifecycle, raw bridge traffic). Default off: **only `error` records land on disk** - routine disk writes are zero for regular users, and warnings surface as UI toasts instead. |
 
 ## Debug logs
 
@@ -196,14 +198,14 @@ The extension keeps a daily log on your machine, sorted by day:
 ~/.pi/extensions-data/estebanforge/pi-antigravity-bridge/logs/<YYYY-MM-DD>.ndjson
 ```
 
-One JSON record per line. Two verbosity tiers keep the disk cost negligible for regular users: by default only `info`/`warn`/`error` records land on disk, which is the useful skeleton: turn starts and outcomes with error text (both engines), bridge tool calls and round-trip failures, `AskAntigravity` runs, `/agy` commands, ACP setup/self-heal, auth URLs, and every driver failure (stall, abort, timeout, nonzero exit). Set `AGY_DEBUG=1` before reproducing a problem for the full trail: per-event driver lifecycle (spawn, exit, session load/new, unparks), list-tools traffic, recycle causes, and the raw bridge chatter. `/agy doctor` prints the log directory.
+One JSON record per line. Two verbosity tiers keep the disk cost at zero for regular users: by default only `error` records land on disk - everything routine (turn starts, tool calls, escalations, commands, driver failures) is withheld. Warnings are not lost: the extension toasts each one in the pi UI (bridge tool failures, stalls, timeouts, process exits), so users see them and can report them; deliberate aborts and failures pi already renders as the turn's own error block stay silent. Set `AGY_DEBUG=1` before reproducing a problem for the full trail: per-event driver lifecycle (spawn, exit, session load/new, unparks), turn starts and outcomes, bridge tool calls, escalations and poll traffic, late deliveries, list-tools traffic, recycle causes, and the raw bridge chatter. `/agy doctor` prints the log directory.
 
 Notes:
 
 - Retention: 14 days. Older files are pruned automatically.
 - Privacy: prompt text, tool arguments, and tool output never land in the log. Secret-shaped values (tokens, API keys, credentials, header blocks) are redacted, and long strings are truncated. The `auth-url` record strips the login URL's query string.
 - Logging never throws: an unwritable directory is skipped silently and retried on the next record.
-- SSD wear: default volume is a handful of records per turn. Verbose mode (`AGY_DEBUG=1`) writes more; turn it off after reproducing.
+- SSD wear: default volume is effectively zero until something actually errors. Verbose mode (`AGY_DEBUG=1`) writes more; turn it off after reproducing.
 
 When you report an issue, attach the last day or two of files from that directory. For anything that needs reproduction, run with `AGY_DEBUG=1` once and attach that day's file. They usually contain the exact failure sequence (engine, session, bridge call, error) with no need to guess.
 

package/docs/ACP-PROTOCOL-REFERENCE.md

@@ -349,6 +349,7 @@ or `terminal/*` delegation occurred with capabilities off.
 | set_config_option response | < 1 s |
 | Prompt first chunk | ~1-2 s (Flash, low effort) |
 | OAuth onboarding window | minutes-scale; one timeout observed at ~8.5 min |
+| Bridge `tools/call` HTTP request | agy's MCP client abandons the request at ~180s (observed twice at exactly 180.000s on 2026-09-05: AskClaude at 225.7s, then a follow-up exec_command). Mitigations: the bridge early-acks any call still running after ~20s with a poll handle (`bridge_poll_result`, `call-tool-escalated` log event) so the request never reaches the deadline; escalated parks re-arm at 30 min for human-gated latency; a result that outlives polling is re-delivered as a new same-conversation prompt (late delivery, `late-result` log event). `mcp-server` logs `progress-token` when a request carries `_meta.progressToken`: if agy ever sends one, progress notifications become a testable zero-UX fix |
 | Steady RSS | ~327 MB (5 min mixed load; VSZ ~5.3 GB is TCMalloc reservation) |
 
 ## Run 6 findings (2026-09-03, post-restart session; raw traffic

package/extensions/index.ts

@@ -37,7 +37,14 @@ import {
 	type AgyModelEntry,
 } from "../src/models.js";
 import { SessionStore } from "../src/sessions.js";
-import { ToolRoundTrips, WrapperReplay, createStreamSimple } from "../src/provider.js";
+import {
+	POLL_TOOL_NAME,
+	ToolRoundTrips,
+	WrapperReplay,
+	createStreamSimple,
+	formatEscalatedAck,
+	formatPollAnswer,
+} from "../src/provider.js";
 import { AgyDriver } from "../src/driver.js";
 import { AcpDriver } from "../src/acp/driver.js";
 import { runAcpAuth } from "../src/acp/auth.js";
@@ -109,6 +116,36 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	// src/daily-log.ts). Fire-and-forget, secrets redacted, old days pruned.
 	// Support flow: "attach the last days' files from that dir".
 	const fileLog = createDailyLogger({ dir: logsDir() });
+	// Warn tier = user-facing: the default file log keeps ONLY errors (zero
+	// routine disk traffic), so a warn that never reaches the UI is lost.
+	// Every warn toasts here instead; AGY_DEBUG=1 restores the full file
+	// trail. Silent exceptions: deliberate aborts (pi already shows
+	// "Operation aborted"), connection exits (the turn's own error block
+	// carries real crashes), and call-tool-fail (same-instant duplicate of
+	// round-trip-fail). No UI (headless): warn text falls back to stderr.
+	const rawFileLog = fileLog.log.bind(fileLog);
+	fileLog.log = (event, data, level) => {
+		rawFileLog(event, data, level);
+		if (level !== "warn") return;
+		if (event.startsWith("abort:") || event === "connection-exited" || event === "call-tool-fail") return;
+		const d = (data ?? {}) as Record<string, unknown>;
+		let text: string;
+		if (event === "round-trip-fail") {
+			text = `Bridge tool call failed: ${String(d.name ?? "tool")} (${String(d.reason ?? "unknown")})`;
+		} else if (event.startsWith("stall:")) {
+			text = "Antigravity stalled with no output; the turn was stopped";
+		} else if (event.startsWith("timeout:")) {
+			text = "Antigravity turn timed out";
+		} else if (event.startsWith("exit:") && event !== "exit:0") {
+			text = "Antigravity process exited unexpectedly";
+		} else if (event === "turn-error") {
+			text = `Antigravity turn issue: ${String(d.reason ?? "unknown")}`;
+		} else {
+			text = `Antigravity warning: ${event}`;
+		}
+		if (activeUi) activeUi.notify(text, "warning");
+		else console.error(`[antigravity-bridge] ${text}`);
+	};
 	fileLog.log(
 		"extension-load",
 		{ engine, models: models.length, fallback: usingFallback, bridge: loadConfig().bridgeTools, askTool: loadConfig().askTool },
@@ -176,12 +213,19 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 				: data;
 		// Failures warn; turn-start + auth-url are the always-on skeleton;
 		// routine per-event lifecycle (spawn, session-load, unparked, ...) is
-		// verbose-only.
-		const level = acpFailures.has(msg)
-			? "warn"
-			: msg === "turn-start" || msg === "auth-url"
-				? "info"
-				: "debug";
+		// verbose-only. Deliberate teardown exits (Esc abort kill, shutdown,
+		// idle recycle) demote to debug: routine, and the warn tier stays the
+		// "what broke" grep.
+		const expectedExit =
+			msg === "connection-exited" &&
+			(data as { expected?: boolean } | undefined)?.expected === true;
+		const level = expectedExit
+			? "debug"
+			: acpFailures.has(msg)
+				? "warn"
+				: msg === "turn-start" || msg === "auth-url"
+					? "info"
+					: "debug";
 		fileLog.log(msg, fileData, level);
 		if (msg === "auth-url") {
 			const { url, port } = (data ?? {}) as { url?: string; port?: number | null };
@@ -202,7 +246,9 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			return;
 		}
 		if (!acpFailures.has(msg)) return;
-		console.error(`[antigravity-bridge acp] ${msg}${data !== undefined ? " " + JSON.stringify(data) : ""}`);
+		// Console noise is gone: warns toast through the fileLog wrapper (with
+		// a stderr fallback when no UI exists), and raw tails stay in the file
+		// log behind AGY_DEBUG.
 	};
 	const acpDriver = new AcpDriver({
 		// Resolved per connection: the setup flow can install the binary and
@@ -459,6 +505,19 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 					inputSchema: activateSkillSchema(skills) as object,
 				});
 			}
+			// Bridge-local, like activate_skill: answered from the escalation
+			// registry without a pi round-trip. Pairs with the STILL RUNNING
+			// early-ack that keeps slow calls under agy's ~180s request deadline.
+			tools.push({
+				name: POLL_TOOL_NAME,
+				description:
+					"Fetch the result of a long-running bridge tool call that answered STILL RUNNING with a callId. Poll again if it still reports running; the result or an error arrives here.",
+				inputSchema: {
+					type: "object",
+					properties: { callId: { type: "string", description: "callId from the STILL RUNNING answer" } },
+					required: ["callId"],
+				},
+			});
 			return tools;
 		};
 		// activate_skill never round-trips through pi: the bridge answers it
@@ -469,7 +528,22 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			args: Record<string, unknown>,
 			signal: AbortSignal,
 		) => {
-			if (name !== ACTIVATE_SKILL_TOOL_NAME) return roundTrips.onToolCall(callId, name, args, signal);
+			// Bridge-local, like activate_skill: answered from the escalation
+			// registry, never parked into pi.
+			if (name === POLL_TOOL_NAME) {
+				const wanted = typeof args.callId === "string" ? args.callId : "";
+				mcpLog("poll-tool", { callId: wanted });
+				return Promise.resolve(formatPollAnswer(wanted, roundTrips.poll(wanted)));
+			}
+			if (name !== ACTIVATE_SKILL_TOOL_NAME) {
+				return roundTrips.onToolCall(callId, name, args, signal).then((r) => {
+					// Early-ack: answer the HTTP request before agy's ~180s client
+					// deadline with a poll handle; pi keeps executing meanwhile.
+					if (!("escalated" in r)) return r;
+					mcpLog("call-tool-escalated", { name, callId: r.callId });
+					return formatEscalatedAck(r);
+				});
+			}
 			const wanted = typeof args.name === "string" ? args.name : "";
 			const skill = findSkillByName(skills, wanted);
 			const body = skill ? readSkillBody(skill) : `unknown skill: ${wanted || "(none given)"}`;
@@ -758,7 +832,7 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 					`  sessions:      ${ctx.store.size} bound`,
 					`  models:        ${ctx.entries.length} ${ctx.usingFallback ? "FALLBACK (agy models failed)" : "discovered"}`,
 					`  config:        ${CONFIG_PATH}`,
-					`  logs:          ${logsDir()} (attach recent days' files when reporting issues)`,
+					`  logs:          ${logsDir()} (attach recent days' files when reporting issues; set AGY_DEBUG=1 to capture details)`,
 				];
 				if (snap.engine === "acp" && snap.acp) {
 					lines.push(
@@ -766,6 +840,11 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 						`  acp server:    ${snap.acp.serverVersion ?? "unknown"}${snap.acp.agentTitle ? ` (${snap.acp.agentTitle})` : ""}`,
 						`  acp stats:     prompts=${snap.acp.prompts} created=${snap.acp.sessionsCreated} loaded=${snap.acp.sessionsLoaded} kills=${snap.acp.kills} reconnects=${snap.acp.reconnects} cancel=${snap.acp.cancelSupported === null ? "unprobed" : snap.acp.cancelSupported ? "supported" : "unsupported (kill+reload)"}`,
 					);
+					// Gate B watch: silent while the server offers no token counts; one
+					// line the day it starts (then real usage mapping is worth wiring).
+					if (snap.acp.usageSeen) {
+						lines.push("  acp tokens:    AVAILABLE in server payloads (wire real usage mapping next)");
+					}
 				}
 				if (snap.lifecycle.length > 0) {
 					lines.push("  lifecycle (last 5):");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.4.7",
+  "version": "1.4.9",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/connection.ts

@@ -24,6 +24,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { parseAuthPort, readLastUrl } from "./browser-capture.js";
+import { frameCarriesUsage } from "./events.js";
 import { JsonRpcResponseError, JsonRpcSession } from "./jsonrpc.js";
 
 export interface AcpMcpServer {
@@ -80,6 +81,7 @@ export class AcpConnection {
 	#child: ChildProcess | undefined;
 	#rpc: JsonRpcSession | undefined;
 	#stderrTail = "";
+	#usageSeen = false;
 	#exited = false;
 	#killed = false;
 	#suppressUpdates = false;
@@ -106,6 +108,13 @@ export class AcpConnection {
 		return this.#stderrTail;
 	}
 
+	/** Gate B watch: latched true once any session/update frame carried
+	 *  usage/token fields. /agy doctor surfaces it the day upstream starts
+	 *  sending token counts; silent until then. */
+	get usageSeen(): boolean {
+		return this.#usageSeen;
+	}
+
 	/** While true, session/update notifications are dropped: they are the
 	 *  full-text history replay that precedes a session/load response, never
 	 *  live generation (run 6). */
@@ -299,6 +308,9 @@ export class AcpConnection {
 
 	#onNotification(method: string, params: unknown): void {
 		if (method === "session/update") {
+			// Latched before the suppression gate: history-replay frames are the
+			// server's payloads too, and they are the cheapest signal source.
+			if (!this.#usageSeen && frameCarriesUsage(params)) this.#usageSeen = true;
 			if (this.#suppressUpdates) return; // load replay: history, not live text
 			const p = typeof params === "object" && params !== null ? (params as Record<string, unknown>) : {};
 			const sessionId = typeof p.sessionId === "string" ? p.sessionId : this.#updateSessionId;

package/src/acp/driver.ts

@@ -409,7 +409,12 @@ export class AcpDriver implements TurnDriver {
 		const turn = this.#active;
 		this.#conn = undefined;
 		this.#state = "dead";
-		this.#log("connection-exited", { tail: info.stderrTail.slice(-200) });
+		// Teardown exits (abort kill, shutdown, idle recycle) are deliberate:
+		// their stderr tail must never reach the UI. Only a live turn dying
+		// mid-flight is user-reportable, and it surfaces as a normal turn
+		// error, not as raw console noise.
+		const turnActive = Boolean(turn && !turn.closed && !turn.aborted && !turn.sawResult);
+		this.#log("connection-exited", { expected: !turnActive, tail: info.stderrTail.slice(-200) });
 		if (!turn || turn.closed) return;
 		if (turn.aborted || turn.sawResult) {
 			this.#settle(turn, {
@@ -421,7 +426,7 @@ export class AcpDriver implements TurnDriver {
 			});
 			return;
 		}
-		this.#failTurn(turn, info.stderrTail.trim() || "ACP server exited mid-turn");
+		this.#failTurn(turn, "Antigravity session exited unexpectedly; it restarts on the next turn");
 	}
 
 	#ensureConnection(request: DriverTurnRequest): Promise<AcpConnection> {
@@ -721,6 +726,7 @@ export class AcpDriver implements TurnDriver {
 				reconnects: Math.max(0, this.#stats.spawns - 1),
 				agentName: this.#agentInfo?.name,
 				agentTitle: this.#agentInfo?.title,
+				usageSeen: this.#conn?.usageSeen ?? false,
 			},
 		};
 	}

package/src/acp/events.ts

@@ -248,3 +248,20 @@ export class TextAccumulator {
 		return this.#acc;
 	}
 }
+
+const USAGE_KEY = /usage|tokens?/i;
+
+/** Gate B watch: true when a server payload carries usage/token fields.
+ *  Key-name based so future shapes (usage blocks, _meta.tokenCount, top-level
+ *  token totals) all trip it. String values are exempt so auth-style "token"
+ *  args inside tool-call frames cannot false-positive the latch; depth-capped
+ *  so the walk stays cheap on every frame until it latches. */
+export function frameCarriesUsage(value: unknown, depth = 0): boolean {
+	if (depth > 8 || typeof value !== "object" || value === null) return false;
+	if (Array.isArray(value)) return value.some((v) => frameCarriesUsage(v, depth + 1));
+	for (const [key, v] of Object.entries(value)) {
+		if (USAGE_KEY.test(key) && (typeof v === "number" || typeof v === "object")) return true;
+		if (frameCarriesUsage(v, depth + 1)) return true;
+	}
+	return false;
+}

package/src/daily-log.ts

@@ -15,10 +15,10 @@
 //     redacted and long strings are truncated before they reach disk.
 //   - Retention: files older than `retentionDays` are pruned once per
 //     process, so the dir cannot grow unbounded.
-//   - Two tiers, to keep SSD wear negligible for regular users: only
-//     info/warn/error records (failures, turn/tool boundaries, commands,
-//     setup) are written by default. Full verbose trails (per-event driver
-//     lifecycle, raw bridge traffic) require AGY_DEBUG=1.
+//   - Volume tiers: default installs write ONLY errors — routine logging
+//     costs the disk nothing. Warns surface as UI toasts instead (the
+//     extension wraps this logger); AGY_DEBUG=1 restores the full trail
+//     (debug/info/warn/error).
 
 import { appendFile, mkdir, readdir, unlink } from "node:fs/promises";
 import path from "node:path";
@@ -30,9 +30,9 @@ export interface DailyLoggerOptions {
 	dir: string;
 	/** Files older than this many days are pruned once per process. Default 14. */
 	retentionDays?: number;
-	/** Verbose gate. When false (default), debug-level records are dropped:
-	 *  only info/warn/error land on disk, the light stream regular users
-	 *  keep. AGY_DEBUG=1 (or this option) restores the full trail. */
+	/** Verbose gate. When false (default), only error-level records land on
+	 *  disk; debug/info/warn are dropped so regular users write nothing
+	 *  routine. AGY_DEBUG=1 (or this option) restores the full trail. */
 	debug?: boolean;
 	/** Injectable clock for tests. */
 	now?: () => Date;
@@ -166,9 +166,10 @@ export function createDailyLogger(opts: DailyLoggerOptions): DailyLogger {
 
 	return {
 		log(event, data, level = "debug") {
-			// Volume gate: debug is the verbose tier. Default installs write
-			// only info/warn/error so the disk cost stays negligible.
-			if (level === "debug" && !verbose) return;
+			// Volume gate: default installs write only errors so routine disk
+			// traffic is zero for regular users; the extension toasts warns
+			// instead. AGY_DEBUG=1 restores the full trail.
+			if (!verbose && level !== "error") return;
 			write(level, event, data);
 		},
 		flush() {

package/src/driver-types.ts

@@ -125,6 +125,10 @@ export interface DriverSnapshot {
 		/** From the initialize handshake agentInfo block. */
 		agentName?: string;
 		agentTitle?: string;
+		/** Gate B watch: true once this server process sent usage/token fields
+		 *  in any session/update frame. /agy doctor surfaces it when true and
+		 *  stays silent otherwise. */
+		usageSeen: boolean;
 	};
 }
 

package/src/mcp-server.ts

@@ -256,6 +256,14 @@ export async function startMcpServer(
 
 	const callHandler = async (request: { params: { name: string; arguments?: unknown } }, signal?: AbortSignal) => {
 		const { name, arguments: args } = request.params;
+		// Progress probe: agy's MCP client killed long bridge calls at exactly
+		// ~180s (see ACP-PROTOCOL-REFERENCE). If its requests ever carry a
+		// progressToken, MCP progress notifications become a testable zero-UX
+		// fix for that deadline; log presence to find out.
+		const meta = (request.params as { _meta?: { progressToken?: unknown } })._meta;
+		if (meta && meta.progressToken !== undefined) {
+			log("progress-token", { name, token: String(meta.progressToken) });
+		}
 		const callId = crypto.randomUUID();
 		log("call-tool", { name, callId });
 		try {

package/src/provider.ts

@@ -114,12 +114,14 @@ export const SYSTEM_PROMPT_END = "[END SYSTEM PROMPT]";
 
 /** Brief tool-priority note appended inside every system prompt block: agy
  *  runs embedded in pi, so its native interactive tools never reach the
- *  user. Equivalent Pi Bridge tools must win. Concrete clash observed live:
- *  agy picked its native ask_question over the bridge's ask_user_question
- *  and the question never displayed. Rides the systemPrompt gate: the note
- *  ships only when the system prompt ships. */
+ *  user. Equivalent Pi Bridge tools must win. Concrete clashes observed
+ *  live: agy picked its native ask_question over the bridge's
+ *  ask_user_question and the question never displayed; on ACP its native
+ *  view_file rejects real filesystem paths (artifact sandbox), so reads of
+ *  the user's machine must go through the bridge. Rides the systemPrompt
+ *  gate: the note ships only when the system prompt ships. */
 export const TOOL_PRIORITY_NOTE =
-	"[Tool priority: this conversation runs inside pi, not as a standalone agy session; the user only sees what surfaces in pi. Native interactive tools, for example ask_question, never reach the user. When a Pi Bridge tool covers the same purpose, always use the Pi Bridge tool; for user questions use ask_user_question.]";
+	"[Tool priority: this conversation runs inside pi, not as a standalone agy session; the user only sees what surfaces in pi. Native interactive tools, for example ask_question, never reach the user. When a Pi Bridge tool covers the same purpose, always use the Pi Bridge tool; for user questions use ask_user_question. Your native file tools such as view_file only read brain artifacts and reject real filesystem paths; for any path on the user's machine use the Pi Bridge tools (read, ls, grep, find, edit, execute). Long-running bridge calls do not fail: after ~20 seconds the bridge answers STILL RUNNING with a callId; fetch the result with bridge_poll_result and poll until it lands. For work you already know is long, prefer exec_command's session-output pattern or background agents so you keep working while it runs.]";
 
 /** Assemble the full agy prompt: system prompt block, pi-side digest, user
  *  prompt. Empty parts are dropped. Pure; exported for unit testing.
@@ -385,21 +387,138 @@ export function toAgyEffort(
 // agy continues its still-running turn. No pi patch, no privileged API.
 
 const BRIDGE_TIMEOUT_MS = 480_000;
+/** Bounded memory of failed bridge parks (late-delivery tombstones). */
+const MAX_PARK_TOMBSTONES = 64;
 
 export interface BridgeCallResultShape {
 	content: Array<{ type: string; text?: string }>;
 	isError: boolean;
 }
 
+/** Early-ack sentinel: onToolCall settles with this when the pi tool is still
+ *  running after escalateAfterMs (~20s). agy's MCP client abandons a
+ *  tools/call HTTP request at ~180s (observed; see ACP-PROTOCOL-REFERENCE), so
+ *  slow calls must not hold the request. The bridge answers with
+ *  formatEscalatedAck and the real result arrives via bridge_poll_result (or,
+ *  if agy never polls, the late-delivery path). */
+export interface BridgeEscalation {
+	escalated: true;
+	callId: string;
+	name: string;
+}
+
+export const POLL_TOOL_NAME = "bridge_poll_result";
+
+/** Default quiet period before a park escalates to a poll handle. Well under
+ *  agy's ~180s request deadline; fast tools never see it. */
+export const ESCALATE_AFTER_MS = 20_000;
+/** Escalated parks carry a longer TTL: human-gated tools (commit previews,
+ *  permission dialogs) legitimately block for many minutes. */
+export const ESCALATED_TIMEOUT_MS = 1_800_000;
+
+export interface PollView {
+	state: "running" | "done" | "failed";
+	name: string;
+	text?: string;
+	isError?: boolean;
+	reason?: string;
+}
+
+/** Escalated bridge calls. Bounded: past the cap, oldest settled entries
+ *  evict first (a running call is never evicted while a newer one is). */
+export class EscalationRegistry {
+	#calls = new Map<string, PollView>();
+	#trim(): void {
+		// Soft cap: only settled entries evict. Evicting a RUNNING call would
+		// strand its result (settle becomes a no-op, poll reports unknown), so
+		// saturating the cap with in-flight calls grows the map instead.
+		while (this.#calls.size > MAX_PARK_TOMBSTONES) {
+			const victim = [...this.#calls.entries()].find(([, e]) => e.state !== "running")?.[0];
+			if (victim === undefined) break;
+			this.#calls.delete(victim);
+		}
+	}
+	escalate(callId: string, name: string): void {
+		this.#calls.set(callId, { name, state: "running" });
+		this.#trim();
+	}
+	settleDone(callId: string, text: string, isError: boolean): void {
+		const e = this.#calls.get(callId);
+		if (!e) return;
+		e.state = "done";
+		e.text = text;
+		e.isError = isError;
+		this.#trim();
+	}
+	settleFailed(callId: string, reason: string): void {
+		const e = this.#calls.get(callId);
+		if (!e) return;
+		e.state = "failed";
+		e.reason = reason;
+		this.#trim();
+	}
+	poll(callId: string): PollView | undefined {
+		const e = this.#calls.get(callId);
+		return e ? { ...e } : undefined;
+	}
+}
+
+export function formatEscalatedAck(e: BridgeEscalation): BridgeCallResultShape {
+	return {
+		content: [
+			{
+				type: "text",
+				text: [
+					`STILL RUNNING: the pi tool "${e.name}" has not finished yet.`,
+					`Call ${POLL_TOOL_NAME} with callId "${e.callId}" to get the result. Poll again if it still reports running; you may do other work between polls.`,
+					"This is not an error and nothing is lost: if you stop polling, the bridge re-delivers the result in a later turn.",
+				].join("\n"),
+			},
+		],
+		isError: false,
+	};
+}
+
+export function formatPollAnswer(callId: string, view: PollView | undefined): BridgeCallResultShape {
+	if (!view) {
+		return {
+			content: [
+				{
+					type: "text",
+					text: `Error: no escalated bridge call "${callId}". It either finished within the first seconds (its result is in your original tool result) or the callId is wrong.`,
+				},
+			],
+			isError: true,
+		};
+	}
+	if (view.state === "running") {
+		return {
+			content: [{ type: "text", text: `STILL RUNNING: "${view.name}" (callId ${callId}) has not finished. Poll again later.` }],
+			isError: false,
+		};
+	}
+	if (view.state === "failed") {
+		return {
+			content: [{ type: "text", text: `Error: bridge call "${view.name}" (callId ${callId}) failed: ${view.reason}` }],
+			isError: true,
+		};
+	}
+	return { content: [{ type: "text", text: view.text || "(no output)" }], isError: view.isError ?? false };
+}
+
 interface PendingRoundTrip {
 	/** "bridge": parked MCP HTTP call; resolve() completes it.
 	 *  "rt": native re-exec / wrapper round-trip; pi already executed, the
 	 *  toolResult only confirms continuation, nothing remote to settle. */
 	kind: "bridge" | "rt";
 	name: string;
-	resolve?: (r: BridgeCallResultShape) => void;
+	resolve?: (r: BridgeCallResultShape | BridgeEscalation) => void;
 	reject?: (e: Error) => void;
 	timer?: NodeJS.Timeout;
+	/** Set when the early-ack fired: the HTTP request was answered with a poll
+	 *  handle, so the settling value must go to the registry, not the socket. */
+	escalated?: boolean;
+	escalateTimer?: NodeJS.Timeout;
 	onAbort?: () => void;
 	signal?: AbortSignal;
 }
@@ -430,23 +549,61 @@ export class WrapperReplay {
 
 export class ToolRoundTrips {
 	#pending = new Map<string, PendingRoundTrip>();
+	/** Failed bridge parks: the pi tool keeps running and its toolResult will
+	 *  arrive with the park already gone. Bounded; consumed by the
+	 *  late-delivery path (see buildLateResultPrompt). */
+	#dead = new Map<string, { name: string; reason: string }>();
+	#escalations = new EscalationRegistry();
+	#escalateAfterMs: number;
 	#getDriver: () => TurnDriver;
 	#log: (s: string, d?: unknown) => void;
 
 	/** Accepts a driver or a getter: with two engines wired, the ACTIVE driver
 	 *  is resolved at call time from config (plan §9.5). */
-	constructor(driver: TurnDriver | (() => TurnDriver), log?: (s: string, d?: unknown) => void) {
+	constructor(
+		driver: TurnDriver | (() => TurnDriver),
+		log?: (s: string, d?: unknown) => void,
+		opts: { escalateAfterMs?: number } = {},
+	) {
 		this.#getDriver = typeof driver === "function" ? driver : () => driver;
 		this.#log = log ?? (() => {});
+		this.#escalateAfterMs = opts.escalateAfterMs ?? ESCALATE_AFTER_MS;
 	}
 
 	get pendingIds(): string[] {
 		return [...this.#pending.keys()];
 	}
 
-	/** Fail all pending calls (driver recycle/shutdown path). */
+	/** Call ids whose park already failed (tombstones). */
+	get deadIds(): string[] {
+		return [...this.#dead.keys()];
+	}
+
+	/** Take and clear the tombstone for a failed park, if any. */
+	consumeDead(toolCallId: string): { name: string; reason: string } | undefined {
+		const dead = this.#dead.get(toolCallId);
+		if (!dead) return undefined;
+		this.#dead.delete(toolCallId);
+		return dead;
+	}
+
+	/** Poll view for an escalated call (undefined when the id never escalated:
+	 *  fast calls settle synchronously and need no handle). */
+	poll(callId: string): PollView | undefined {
+		return this.#escalations.poll(callId);
+	}
+
+	/** Fail all pending calls (driver recycle/shutdown path). Escalated bridge
+	 *  calls are skipped: their HTTP request was already answered with a poll
+	 *  handle, and the agy turn ending does NOT make the still-running pi tool
+	 *  a failure. They settle through resolve(), their own 30m timer, or an
+	 *  abort signal on the pi tool call. */
 	failAll(reason: string): void {
-		for (const id of [...this.#pending.keys()]) this.#fail(id, reason);
+		for (const id of [...this.#pending.keys()]) {
+			const entry = this.#pending.get(id);
+			if (entry?.kind === "bridge" && entry.escalated) continue;
+			this.#fail(id, reason);
+		}
 	}
 
 	#fail(callId: string, reason: string): void {
@@ -459,20 +616,33 @@ export class ToolRoundTrips {
 		}
 		this.#pending.delete(callId);
 		clearTimeout(entry.timer);
+		if (entry.escalateTimer) clearTimeout(entry.escalateTimer);
 		if (entry.onAbort && entry.signal) entry.signal.removeEventListener("abort", entry.onAbort);
+		this.#dead.set(callId, { name: entry.name, reason });
+		while (this.#dead.size > MAX_PARK_TOMBSTONES) {
+			const oldest = this.#dead.keys().next().value;
+			if (oldest === undefined) break;
+			this.#dead.delete(oldest);
+		}
+		if (entry.escalated) this.#escalations.settleFailed(callId, reason);
 		entry.reject!(new Error(reason));
 		this.#getDriver().kickIdle();
 		this.#log("round-trip-fail", { callId, name: entry.name, reason });
 	}
 
-	/** Park the MCP call: inject into the live agy turn; the promise settles
-	 *  when pi's toolResult lands (resolve) or fail-closed (timeout/abort). */
+	/** Park the MCP call: inject into the live agy turn. Fast calls settle
+	 *  with the real BridgeCallResultShape. Calls still running after
+	 *  escalateAfterMs settle with a BridgeEscalation sentinel instead: the
+	 *  bridge answers the HTTP request with a poll handle while pi keeps
+	 *  executing, so agy's ~180s request deadline is never hit. The real
+	 *  result reaches agy via bridge_poll_result, or via the late-delivery
+	 *  path if agy never polls. Fail-closed: timeout/abort still reject. */
 	onToolCall = (
 		callId: string,
 		name: string,
 		args: Record<string, unknown>,
 		signal: AbortSignal,
-	): Promise<BridgeCallResultShape> => {
+	): Promise<BridgeCallResultShape | BridgeEscalation> => {
 		const handle = this.#getDriver().activeHandle;
 		if (!handle) {
 			return Promise.reject(
@@ -481,13 +651,32 @@ export class ToolRoundTrips {
 				),
 			);
 		}
-		return new Promise<BridgeCallResultShape>((resolve, reject) => {
+		return new Promise<BridgeCallResultShape | BridgeEscalation>((resolve, reject) => {
 			const timer = setTimeout(() => {
 				this.#fail(callId, `pi tool round-trip timed out after ${BRIDGE_TIMEOUT_MS / 1000}s`);
 			}, BRIDGE_TIMEOUT_MS);
 			const onAbort = () => this.#fail(callId, "agy disconnected before the tool result arrived");
 			signal.addEventListener("abort", onAbort, { once: true });
-			this.#pending.set(callId, { kind: "bridge", name, resolve, reject, timer, onAbort, signal });
+			const entry: PendingRoundTrip = { kind: "bridge", name, resolve, reject, timer, onAbort, signal };
+			if (this.#escalateAfterMs > 0) {
+				entry.escalateTimer = setTimeout(() => {
+					const e = this.#pending.get(callId);
+					// Resolved (or failed) between arm and fire: nothing to escalate.
+					if (!e || e.kind !== "bridge") return;
+					e.escalated = true;
+					// Human-gated calls (commit previews, permission dialogs) can
+					// block far longer than the standard park TTL; re-arm generously.
+					if (e.timer) {
+						clearTimeout(e.timer);
+						e.timer = setTimeout(() => {
+							this.#fail(callId, `escalated bridge call timed out after ${ESCALATED_TIMEOUT_MS / 60_000} minutes`);
+						}, ESCALATED_TIMEOUT_MS);
+					}
+					this.#escalations.escalate(callId, e.name);
+					resolve({ escalated: true, callId, name: e.name });
+				}, this.#escalateAfterMs);
+			}
+			this.#pending.set(callId, entry);
 			handle.pushExternal({ type: "bridge_call", callId, name, args });
 		});
 	};
@@ -505,12 +694,21 @@ export class ToolRoundTrips {
 		if (!entry) return false;
 		this.#pending.delete(toolCallId);
 		clearTimeout(entry.timer);
+		if (entry.escalateTimer) clearTimeout(entry.escalateTimer);
 		if (entry.onAbort && entry.signal) entry.signal.removeEventListener("abort", entry.onAbort);
 		if (entry.kind === "rt") {
 			this.#log("round-trip-rt-done", { callId: toolCallId, name: entry.name, isError });
 			return true;
 		}
-		entry.resolve!({ content: [{ type: "text", text }], isError });
+		// Escalated call: the HTTP response already carried the poll handle, so
+		// the result lands in the registry for the next bridge_poll_result. The
+		// original promise settled with the sentinel; re-resolving is a silent
+		// no-op, so gate it to keep that explicit.
+		if (entry.escalated) {
+			this.#escalations.settleDone(toolCallId, text, isError);
+		} else {
+			entry.resolve!({ content: [{ type: "text", text }], isError });
+		}
 		this.#getDriver().kickIdle();
 		this.#log("round-trip-resolved", { callId: toolCallId, name: entry.name, isError });
 		return true;
@@ -534,6 +732,29 @@ export function collectToolResults(
 	return out;
 }
 
+export interface LateToolResult {
+	name: string;
+	reason: string;
+	text: string;
+	isError: boolean;
+}
+
+/** Frame late tool results so agy treats them as the results its bridge calls
+ *  never received (the round-trip died while the pi tool was still running,
+ *  e.g. agy's ~180s MCP client timeout on tools/call). */
+export function buildLateResultPrompt(late: LateToolResult[], userPrompt?: string): string {
+	const blocks = late.map((r) =>
+		[
+			`pi tool "${r.name}": the bridge round-trip expired before this result reached you (${r.reason}).`,
+			r.isError ? "The tool reported an error:" : "Result:",
+			r.text.trim() || "(no output)",
+		].join("\n"),
+	);
+	const header = "Late tool delivery: treat the following as the results of your earlier tool calls.";
+	const body = [header, ...blocks].join("\n\n");
+	return userPrompt ? `${body}\n\n${userPrompt}` : body;
+}
+
 // --- stream-json engine -------------------------------------------------------
 
 export interface DriverDeps {
@@ -739,12 +960,47 @@ async function runTurnDriver(
 	// agy receives the result via the bridge's MCP HTTP response.
 	const results = collectToolResults(context.messages, deps.roundTrips.pendingIds);
 	const isContinuation = results.length > 0;
+	// Escalated calls answer through bridge_poll_result, not through an agy
+	// turn waiting on the park, so note them before resolving.
+	const escalatedNames = results
+		.map((r) => deps.roundTrips.poll(r.toolCallId)?.name)
+		.filter((n): n is string => Boolean(n));
 	for (const r of results) deps.roundTrips.resolve(r.toolCallId, r.text, r.isError);
 
+	// Late delivery: a toolResult whose park already failed (the abort/timeout
+	// path failed the park while the pi tool kept running). The work is done,
+	// so re-route the result to agy as a new prompt in the same conversation
+	// instead of dropping it. Both drivers serialize run(), so delivery queues
+	// behind agy's own salvaged turn when one is still active.
+	// A pass that anchors a still-pending park (isContinuation) has nowhere to
+	// put a late result: it can neither ride the pending call's HTTP response
+	// nor start a new prompt. Leave the tombstone for the next fresh pass
+	// instead of consuming it blind.
+	const late: LateToolResult[] = [];
+	if (!isContinuation) {
+		for (const r of collectToolResults(context.messages, deps.roundTrips.deadIds)) {
+			const dead = deps.roundTrips.consumeDead(r.toolCallId);
+			if (dead) late.push({ name: dead.name, reason: dead.reason, text: r.text, isError: r.isError });
+		}
+		if (late.length > 0) {
+			deps.log?.("late-result", { tools: late.map((l) => l.name), freshConversation: !existing?.conversationId }, "info");
+		}
+	} else if (deps.roundTrips.deadIds.length > 0) {
+		deps.log?.("late-result-deferred", { count: deps.roundTrips.deadIds.length }, "info");
+	}
+
 	let handle: TurnHandle;
 	if (isContinuation) {
 		const active = deps.driver.reentry();
 		if (!active) {
+			// Escalated calls have no turn to re-enter BY DESIGN: agy already
+			// got the poll handle and the result lives in the registry. Settle
+			// quietly instead of erroring the turn.
+			if (escalatedNames.length > 0) {
+				appendText(stream, blocks, `[bridge] ${escalatedNames.join(", ")} finished; the result is available via ${POLL_TOOL_NAME}.`);
+				finalize(stream, blocks, "stop");
+				return;
+			}
 			deps.log?.("turn-error", { reason: "tool-result-no-active-turn" }, "warn");
 			finalize(stream, blocks, "error", "tool result arrived but no antigravity turn is running");
 			return;
@@ -754,8 +1010,9 @@ async function runTurnDriver(
 		const prompt = extractUserPrompt(context);
 		const images = extractImages(context);
 		// An image-only message (no text) is valid on the ACP engine; only fail
-		// when there is nothing at all to send.
-		if (!prompt && images.length === 0) {
+		// when there is nothing at all to send (no text, no images, no late
+		// tool results to deliver).
+		if (!prompt && images.length === 0 && late.length === 0) {
 			deps.log?.("turn-error", { reason: "no-user-message" }, "debug");
 			finalize(stream, blocks, "error", "No user message to send to agy.");
 			return;
@@ -764,7 +1021,9 @@ async function runTurnDriver(
 		const agyModel = entry?.full ?? model.id;
 		const effort = entry?.efforts?.length ? toAgyEffort(options?.reasoning, entry.efforts) : undefined;
 		const watermark = existing?.lastMessageCount ?? 0;
-		const digest = config.digest ? buildContextDigest(context.messages, watermark) : "";
+		// Late turns re-open the conversation with a synthetic prompt; the digest
+		// would re-send context agy already holds, so skip it.
+		const digest = config.digest && late.length === 0 ? buildContextDigest(context.messages, watermark) : "";
 		// G1 delivery per engine. stream-json: digest rides inline in the prompt
 		// (the CLI has no context channel). ACP: the server advertises
 		// `embeddedContext`, so the digest ships as a native resource block
@@ -778,7 +1037,10 @@ async function runTurnDriver(
 		// re-sending it every turn would bloat each prompt and bust the cache.
 		const sysPrompt =
 			config.systemPrompt && !existing?.conversationId ? context.systemPrompt : undefined;
-		const fullPrompt = buildFullPrompt(sysPrompt, embeddedDigest ? "" : digest, prompt ?? "");
+		const fullPrompt =
+			late.length > 0
+				? buildLateResultPrompt(late, prompt || undefined)
+				: buildFullPrompt(sysPrompt, embeddedDigest ? "" : digest, prompt ?? "");
 		try {
 			handle = await deps.driver.run({
 				cwd,