@estebanforge/pi-antigravity-bridge 1.4.9 → 1.4.10

package/extensions/index.ts

@@ -17,10 +17,15 @@
 // ~/.pi/agent/antigravity-bridge/config.json so toggles survive restarts.
 
 import os from "node:os";
+import fs from "node:fs";
+import path from "node:path";
 import {
 	type ExtensionAPI,
 	type ExtensionCommandContext,
 	type ExtensionUIContext,
+	createBashToolDefinition,
+	createEditToolDefinition,
+	createWriteToolDefinition,
 	getSettingsListTheme,
 } from "@earendil-works/pi-coding-agent";
 import {
@@ -38,6 +43,7 @@ import {
 } from "../src/models.js";
 import { SessionStore } from "../src/sessions.js";
 import {
+	APPROVAL_PARK_MS,
 	POLL_TOOL_NAME,
 	ToolRoundTrips,
 	WrapperReplay,
@@ -45,7 +51,15 @@ import {
 	formatEscalatedAck,
 	formatPollAnswer,
 } from "../src/provider.js";
-import { AgyDriver } from "../src/driver.js";
+import {
+	createShadowTool,
+	stripMarkerFields,
+	type AnyToolDefinition,
+	type GatePolicy,
+} from "../src/approval-gate.js";
+import { detectPermissionGateExtensions, resolveGateMode } from "../src/approval-detect.js";
+import { hookScriptSource, removeGateHooks, stageGateHooks } from "../src/approval-hook.js";
+import { StreamDriver } from "../src/driver.js";
 import { AcpDriver } from "../src/acp/driver.js";
 import { runAcpAuth } from "../src/acp/auth.js";
 import { setupAuthUrlCapture } from "../src/acp/browser-capture.js";
@@ -55,6 +69,11 @@ import { CONFIG_PATH, loadConfig, logsDir, saveConfig, type AgyMode, type Bridge
 import { createDailyLogger, type DailyLogger } from "../src/daily-log.js";
 import { registerAskAntigravityTool, toolModelsFromRaw } from "../src/ask-tool.js";
 import { startMcpServer, TOKEN_HEADER, type McpServerHandle } from "../src/mcp-server.js";
+import {
+	registerBridgeServer,
+	sweepStaleBridgeServers,
+	unregisterBridgeServer,
+} from "../src/mcp-registration.js";
 import {
 	ACTIVATE_SKILL_TOOL_NAME,
 	activateSkillSchema,
@@ -107,7 +126,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	const engine: Engine = loadConfig().engine;
 	// Engine switching requires a restart, so the catalog-time engine read is
 	// authoritative for input advertising: image attach rides only when turns
-	// will run on the ACP engine (the legacy CLI prompt is text-only).
+	// will run on the ACP engine (the stream-json CLI prompt is text-only).
 	const modelInput: Array<"text" | "image"> = engine === "acp" ? ["text", "image"] : ["text"];
 	const models = entries.map((e) => toPiModel(e, modelInput));
 
@@ -156,6 +175,9 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	// MCP bridge handle, declared early: the ACP engine reads the bridge port
 	// at session/new / session/load time.
 	let mcpHandle: McpServerHandle | null = null;
+	// Approval-gate hook script (per-pid, token embedded). Written at session
+	// start when the gate is active; removed at session_shutdown.
+	let gateScriptPath: string | null = null;
 	// ACP self-heal runs once per process (session_start re-fires on /reload;
 	// a ready setup is two file stats, so re-running is harmless anyway).
 	let acpSelfHealRan = false;
@@ -184,11 +206,11 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		"session-load-failed-creating-fresh", "connection-exited", "cancel-failed",
 		"unsupported-server-request",
 	]);
-	const legacyDriver = new AgyDriver();
-	// Mirror the legacy driver's lifecycle ring into the daily file log
+	const streamDriver = new StreamDriver();
+	// Mirror the stream driver's lifecycle ring into the daily file log
 	// (spawn/exit/abort/stall/recycle). The ACP driver reaches the same file
 	// through acpLog below.
-	legacyDriver.log = (msg, data) => {
+	streamDriver.log = (msg, data) => {
 		// Level classification mirrors acpLog's failure set: stalls, aborts,
 		// timeouts and nonzero exits are the "what broke" greps (warn);
 		// turn-start is the per-turn skeleton (info); everything else is
@@ -260,7 +282,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			const handle = mcpHandle;
 			if (!handle) return [];
 			// The bridge 403s any request without the shared-secret header; the
-			// legacy engine carries it via mcp_config.json, ACP via headers[].
+			// stream engine carries it via mcp_config.json, ACP via headers[].
 			return [
 				{
 					name: "pi-bridge",
@@ -272,15 +294,23 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		},
 	});
 	// The active engine is resolved from the latched load-time value.
-	const activeDriver = (): TurnDriver => (engine === "acp" ? acpDriver : legacyDriver);
-	// The provider's stream-json slot gets the LEGACY driver explicitly - never
+	const activeDriver = (): TurnDriver => (engine === "acp" ? acpDriver : streamDriver);
+	// The provider's stream-json slot gets the STREAM driver explicitly - never
 	// activeDriver(), or a load-time acp engine would make deps.driver and
 	// deps.acpDriver the same object and break the engine identity check.
-	const driver = legacyDriver;
+	const driver = streamDriver;
 	// The no-patch pi-tool round-trip store: the MCP bridge parks calls here;
 	// the provider emits them as real pi toolUse turns and completes them from
 	// the next call's toolResult.
-	const roundTrips = new ToolRoundTrips(activeDriver, (s, d) => fileLog.log(s, d, s === "round-trip-fail" ? "warn" : "debug"));
+	const roundTrips = new ToolRoundTrips(
+		activeDriver,
+		(s, d, level) =>
+			fileLog.log(
+				s,
+				d,
+				level ?? (s === "round-trip-fail" ? "warn" : "debug"),
+			),
+	);
 	const replay = new WrapperReplay();
 	// Native re-exec only emits for builtins actually active in the session;
 	// anything else (or an unknown name) falls back to the wrapper card.
@@ -306,7 +336,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		);
 		roundTrips.failAll("antigravity turn ended with an unresolved pi tool call");
 	};
-	legacyDriver.onTurnEnd = onTurnEnd;
+	streamDriver.onTurnEnd = onTurnEnd;
 	acpDriver.onTurnEnd = onTurnEnd;
 	const streamSimple = createStreamSimple({
 		entries,
@@ -557,9 +587,113 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 				isError: !skill,
 			});
 		};
-		const r = await startMcpServer({ listTools, onToolCall: bridgeOnToolCall }, { log: mcpLog });
+		const r = await startMcpServer(
+			{
+				listTools,
+				onToolCall: bridgeOnToolCall,
+				onApproval: (ticket, payload) => roundTrips.onApproval(ticket, payload),
+			},
+			{ log: mcpLog },
+		);
 		if (r.ok && r.handle) {
 			mcpHandle = r.handle;
+			// Stream-json engine registration: the agy CLI discovers MCP servers
+			// from ~/.gemini/config/mcp_config.json (ACP uses session/new
+			// mcpServers instead; verified live 2026-09-07). Per-pid entry,
+			// removed at session_shutdown; stale entries swept at start.
+			sweepStaleBridgeServers();
+			registerBridgeServer({
+				pid: process.pid,
+				port: r.handle.port,
+				token: r.handle.token,
+				tokenHeader: TOKEN_HEADER,
+			});
+			// --- Approval gate (docs/TODO.md 2.5) ------------------------------
+			// agy native tool calls pass through a pi-side approval: a PreToolUse
+			// hook parks in the bridge, the provider emits a shadow toolUse, and
+			// pi's permission extensions gate it like any native call. Off until
+			// enabled (auto = on only when a third-party gate extension exists).
+			{
+				const cfg = loadConfig();
+				const mode = resolveGateMode(cfg.approvals.gateMode, detectPermissionGateExtensions());
+				if (mode === "dedicated") {
+					// The explicit antigravity_approve variant is planned; until it
+					// ships, dedicated stages the same shadow tools. Say so, so the
+					// config value never lies silently.
+					fileLog.log("approval-dedicated-as-shadow", {}, "warn");
+				}
+				if (mode === "off") {
+					// Gate off: remove ONLY this session's group. Other sessions'
+					// groups in a shared workspace are never touched - a gate-off
+					// session must not strip a gate-on session's matchers.
+					const unstaged = removeGateHooks(process.cwd());
+					if (unstaged.wrote) fileLog.log("approval-unstaged", unstaged, "info");
+				} else {
+					// Script: per-pid file; 0600 because the bridge token is
+					// embedded (peer review 2026-09-07).
+					const scriptPath = path.join(logsDir(), `approval-hook-${process.pid}.js`);
+					fs.mkdirSync(path.dirname(scriptPath), { recursive: true, mode: 0o700 });
+					fs.writeFileSync(
+						scriptPath,
+						hookScriptSource({
+							port: r.handle.port,
+							token: r.handle.token,
+							deadlineMs: APPROVAL_PARK_MS,
+						}),
+						{ mode: 0o600 },
+					);
+					gateScriptPath = scriptPath;
+					const staged = stageGateHooks(process.cwd(), {
+						port: r.handle.port,
+						token: r.handle.token,
+						scriptPath,
+						parkBudgetMs: APPROVAL_PARK_MS,
+					});
+					fileLog.log("approval-staged", { mode, script: scriptPath, ...staged }, staged.wrote ? "info" : "debug");
+
+					// Shadow bases: factory twins of pi's own builtins (public API).
+					// pi.getAllTools() is unusable here: it returns ToolInfo, which
+					// strips execute. Marker calls never execute; non-marker calls
+					// delegate to the twins, so behavior matches the standard
+					// builtins (session-level bash-operations overrides are not
+					// inherited; documented in README).
+					const gateCwd = process.cwd();
+					const bases: Record<string, AnyToolDefinition> = {
+						bash: createBashToolDefinition(gateCwd) as unknown as AnyToolDefinition,
+						write: createWriteToolDefinition(gateCwd) as unknown as AnyToolDefinition,
+						edit: createEditToolDefinition(gateCwd) as unknown as AnyToolDefinition,
+					};
+					const askMode = cfg.approvals.mode;
+					const policy: GatePolicy = async ({ tool, params, ctx }) => {
+						if (askMode === "allow") return { allow: true };
+						if (askMode === "deny") {
+							return { allow: false, reason: `blocked by approval gate (mode: deny): ${tool}` };
+						}
+						const extCtx = ctx as { hasUI?: boolean; ui?: Pick<ExtensionUIContext, "confirm"> } | undefined;
+						if (!extCtx?.hasUI || typeof extCtx.ui?.confirm !== "function") {
+							return { allow: false, reason: `approval gate: no UI to approve ${tool} (headless)` };
+						}
+						const what =
+							typeof params.command === "string"
+								? params.command
+								: typeof params.path === "string"
+									? params.path
+									: JSON.stringify(stripMarkerFields(params)).slice(0, 200);
+						const ok = await extCtx.ui.confirm(`agy ${tool}?`, what, { timeout: APPROVAL_PARK_MS });
+						return ok ? { allow: true } : { allow: false, reason: `declined in pi (agy ${tool})` };
+					};
+					const handle = r.handle;
+					for (const [name, base] of Object.entries(bases)) {
+						pi.registerTool(
+							createShadowTool(base, policy, { verifyTicket: (t) => handle.approvals.has(t) }),
+						);
+					}
+					// The park is wired ONLY after the shadows are registered: an
+					// approval toolUse must never dispatch to the REAL builtin and
+					// execute locally.
+					roundTrips.approvalPark = handle.approvals;
+				}
+			}
 		} else {
 			console.error(`[antigravity-bridge] MCP tool bridge disabled: ${r.reason}`);
 		}
@@ -572,8 +706,29 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		mcpHandle = null;
 		await h?.close();
 		roundTrips.failAll("antigravity session shut down");
-		await legacyDriver.close("shutdown");
-		await acpDriver.close("shutdown");
+		// "recycle", NOT "shutdown": pi fires session_shutdown on /new, /resume
+		// and /fork (docs/extensions.md session lifecycle), not only on process
+		// exit. The drivers are process-lifetime singletons; closing them with
+		// "shutdown" latched them permanently and every later turn failed with
+		// "ACP driver is shut down." (regression 2026-09-07). Recycle kills the
+		// connection now; the next turn respawns it. event.reason is
+		// deliberately ignored: recycle is correct even on real process exit
+		// ("quit") - the connection kill is identical and nothing runs after.
+		await streamDriver.close("recycle", "session shutdown");
+		await acpDriver.close("recycle", "session shutdown");
+		unregisterBridgeServer(process.pid);
+		// Approval gate: unstage hooks and remove the per-pid script. Pending
+		// approvals already failed closed via handle close (bridge shutdown deny).
+		const unstaged = removeGateHooks(process.cwd());
+		if (unstaged.wrote) fileLog.log("approval-unstaged", unstaged, "info");
+		if (gateScriptPath) {
+			try {
+				fs.rmSync(gateScriptPath, { force: true });
+			} catch {
+				/* best effort */
+			}
+			gateScriptPath = null;
+		}
 	});
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.4.9",
+  "version": "1.4.10",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/driver.ts

@@ -1,8 +1,8 @@
 // AcpDriver: the ACP turn engine. Implements the same TurnDriver surface as
-// the legacy stream-json driver (see src/driver-types.ts) so provider.ts and
+// the stream-json driver (see src/driver-types.ts) so provider.ts and
 // the G9 round-trip store work unchanged.
 //
-// Engine differences vs legacy, all verified live (docs/ACP-PROTOCOL-REFERENCE.md):
+// Engine differences vs stream-json, all verified live (docs/ACP-PROTOCOL-REFERENCE.md):
 //   - no process recycle on profile drift: one server process, sessions
 //     selected per turn via session/new / session/load
 //   - model/effort via session/set_config_option (configId "model", FULL slug
@@ -110,7 +110,6 @@ export class AcpDriver implements TurnDriver {
 	#generation = 0;
 	#active: ActiveTurn | undefined;
 	#queueTail: Promise<void> = Promise.resolve();
-	#shutdown = false;
 	#lifecycle: string[] = [];
 	#onTurnEnd: ((outcome: TurnOutcome) => void) | undefined;
 	#stats = {
@@ -168,7 +167,7 @@ export class AcpDriver implements TurnDriver {
 	}
 
 	/** Turns are serialized; a parked turn stays open and the continuation
-	 *  path uses reentry() (same contract as the legacy driver). */
+	 *  path uses reentry() (same contract as the stream-json driver). */
 	run(request: DriverTurnRequest): Promise<TurnHandle> {
 		let release!: () => void;
 		const prev = this.#queueTail;
@@ -190,7 +189,10 @@ export class AcpDriver implements TurnDriver {
 	}
 
 	#runExclusive(request: DriverTurnRequest): Promise<TurnHandle> {
-		if (this.#shutdown) return Promise.reject(new Error("ACP driver is shut down."));
+		// No shutdown latch here: pi fires session_shutdown on /new, /resume and
+		// /fork (not only process exit), so a closed driver must respawn on the
+		// next turn instead of rejecting forever. Regression 2026-09-07:
+		// /compact after a model switch failed with "ACP driver is shut down."
 		if (request.signal?.aborted) return Promise.reject(new Error("aborted before start"));
 
 		const turn = this.#createTurn(request);
@@ -218,7 +220,7 @@ export class AcpDriver implements TurnDriver {
 		}
 
 		// Execute asynchronously: the handle returns as soon as the prompt is
-		// dispatched, and activities stream through next() (legacy contract).
+		// dispatched, and activities stream through next() (stream-json contract).
 		void this.#executeTurn(turn).catch((err: unknown) => {
 			this.#failTurn(turn, `ACP turn failed: ${describe(err)}`);
 		});
@@ -679,7 +681,6 @@ export class AcpDriver implements TurnDriver {
 	// --- TurnDriver surface ----------------------------------------------------
 
 	async close(reason: "recycle" | "shutdown", cause?: string): Promise<void> {
-		if (reason === "shutdown") this.#shutdown = true;
 		this.#log(`close:${reason}${cause ? `:${cause}` : ""}`);
 		const turn = this.#active;
 		if (turn && !turn.closed) {
@@ -687,7 +688,7 @@ export class AcpDriver implements TurnDriver {
 				conversationId: turn.sessionId,
 				status: "ERROR",
 				response: turn.response.text,
-				error: `ACP driver ${reason}ed mid-turn${cause ? ` (${cause})` : ""}`,
+				error: `ACP driver ${reason === "recycle" ? "recycled" : "shut down"} mid-turn${cause ? ` (${cause})` : ""}`,
 				finished: true,
 				aborted: false,
 			});

package/src/approval-detect.ts

@@ -0,0 +1,146 @@
+// Third-party pi permission-extension detection for the approval gate
+// (docs/TODO.md 2.5). The gate defaults to "auto": OFF until one of these
+// extensions is present. Detection reads pi's settings (the packages array
+// is the primary, name-exact signal) plus known on-disk config markers for
+// the audited permission packages (sources: ~/tmp/pi-perm-research/, audit
+// 2026-09-07). Best effort by design: a miss only means the user enables
+// the gate manually; a false positive stages hooks.json, which is inert
+// unless the ACP/CLI server loads it, and observation-only hooks are safe.
+//
+// Run: npm test
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+/** npm names of the audited pi permission packages (docs/TODO.md 2.4). */
+export const KNOWN_GATE_PACKAGES = [
+	"@gotgenes/pi-permission-system",
+	"@zhushanwen/pi-permission",
+	"pi-permission-system",
+	"@xzzpig/pi-permission-system",
+	"@diegopetrucci/pi-permission-gate",
+	"pi-permission-modes",
+	"@inobit/pi-permission",
+	"@thurstonsand/pi-permissions",
+	"@monroewilliams/pi-permission-system",
+	"@rhedbull/pi-permissions",
+] as const;
+
+export interface GateExtensionHit {
+	/** The known package name matched. */
+	name: string;
+	/** How it was detected: "settings:<path>" or "config:<path>". */
+	evidence: string;
+}
+
+function readJsonIfPresent(file: string): { packages?: unknown } | undefined {
+	try {
+		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function packagesFrom(settingsFile: string): string[] {
+	const parsed = readJsonIfPresent(settingsFile);
+	const raw = parsed?.packages;
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((entry): entry is string => typeof entry === "string");
+}
+
+function nameMatchesPackage(entry: string): string | undefined {
+	// entries look like "npm:@scope/name@1.2.3", "git:...", or a bare path.
+	// Boundary-aware match: the known name must start after :/@ (or the
+	// string start) and must not be a prefix of a longer package name
+	// ("pi-permission-system-clone" must NOT match). Version suffix @x.y is
+	// fine. Peer review 2026-09-07 finding 4.
+	const lower = entry.toLowerCase();
+	let best: string | undefined;
+	for (const name of KNOWN_GATE_PACKAGES) {
+		if (containsName(lower, name) && (best === undefined || name.length > best.length)) best = name;
+	}
+	// Longest match wins: "@xzzpig/pi-permission-system" must resolve to the
+	// scoped name, not to the shorter unscoped fork "pi-permission-system".
+	return best;
+}
+
+function containsName(lower: string, name: string): boolean {
+	let idx = lower.indexOf(name);
+	while (idx >= 0) {
+		const before = idx === 0 ? "" : lower[idx - 1];
+		const after = lower[idx + name.length] ?? "";
+		const okBefore = before === "" || ":/@".includes(before);
+		const okAfter = after === "" || after === "@" || !/[a-z0-9_-]/.test(after);
+		if (okBefore && okAfter) return true;
+		idx = lower.indexOf(name, idx + 1);
+	}
+	return false;
+}
+
+/**
+ * Detect installed third-party permission extensions.
+ *
+ * @param opts.home  HOME override for tests.
+ * @param opts.cwd   project dir override for tests (project settings).
+ * @param opts.settingsFiles  extra settings files to scan (tests).
+ */
+export function detectPermissionGateExtensions(
+	opts: { home?: string; cwd?: string; settingsFiles?: string[] } = {},
+): GateExtensionHit[] {
+	const home = opts.home ?? os.homedir();
+	const cwd = opts.cwd ?? process.cwd();
+	const hits: GateExtensionHit[] = [];
+	const seen = new Set<string>();
+
+	const settingsCandidates = [
+		...(opts.settingsFiles ?? []),
+		path.join(home, ".pi", "agent", "settings.json"),
+		path.join(cwd, ".pi", "settings.json"),
+	];
+	for (const file of settingsCandidates) {
+		for (const entry of packagesFrom(file)) {
+			const name = nameMatchesPackage(entry);
+			if (name && !seen.has(name)) {
+				seen.add(name);
+				hits.push({ name, evidence: `settings:${file}` });
+			}
+		}
+	}
+
+	// Known config-file markers from the audit. Presence of the config does
+	// not prove the extension is installed, but every audited package writes
+	// its config only after install + first run, which is evidence enough for
+	// an opt-in default.
+	const markers: Array<{ file: string; name: string }> = [
+		{ file: path.join(home, ".pi", "agent", "extensions", "pi-permission-system"), name: "@gotgenes/pi-permission-system" },
+		{ file: path.join(home, ".agent", "pi-permissions.jsonc"), name: "@monroewilliams/pi-permission-system" },
+		{ file: path.join(home, ".pi", "agent", "extensions", "permissions.json"), name: "@rhedbull/pi-permissions" },
+		{ file: path.join(cwd, ".pi", "agent", "pi-permissions.jsonc"), name: "@gotgenes/pi-permission-system" },
+	];
+	for (const marker of markers) {
+		if (!seen.has(marker.name)) {
+			try {
+				fs.statSync(marker.file);
+				seen.add(marker.name);
+				hits.push({ name: marker.name, evidence: `config:${marker.file}` });
+			} catch {
+				/* absent - fine */
+			}
+		}
+	}
+
+	return hits;
+}
+
+/** Resolve the effective gate shape from config + detection. "auto" defers
+ *  to detection (shadow when any gate extension is present, else off). */
+export function resolveGateMode(
+	gateMode: "auto" | "shadow" | "dedicated" | "off",
+	hits: GateExtensionHit[],
+): "shadow" | "dedicated" | "off" {
+	if (gateMode === "off") return "off";
+	if (gateMode === "shadow" || gateMode === "dedicated") return gateMode;
+	return hits.length > 0 ? "shadow" : "off";
+}