@estebanforge/pi-antigravity-bridge 1.6.1 → 1.6.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.6.3] - 2026-09-22
+
+### Fixed
+
+- **The approval gate no longer leaks into standalone sessions, and its verdicts parse.** Thanks @explesy for the report (https://github.com/EstebanForge/pi-antigravity-bridge/issues/5). Two defects in the generated hook script and its staging. Every terminal path printed the bare decision scalar (`"deny"` / `"allow"`) instead of a JSON object, so any session that loaded a staged gate failed hook parsing outright (`protojson: syntax error`): the direct-POST and polling branches now print the full response object guarded by a `typeof json.decision === "string"` check, fall back to a fail-closed deny object on malformed bodies, and read ticket and poll status through `json?.`. The gate group itself was staged into the shared workspace `.agents/hooks.json`, so any standalone IDE or CLI session in that workspace loaded pi's gate: tool calls were denied with "no active antigravity turn" while pi sat idle, and mid-turn they parked into pi's approval queue. A live probe of the CLI settled the discovery rule (hooks load from `--add-dir` directories in stream-json and interactive sessions; print mode reads only the global config), and the gate now stages `.agents/hooks.json` into the session-private per-pid bridge dir beside `mcp_config.json`, which only this session's agy receives as an extra `--add-dir`. Staging into a pid-private file dropped the merge/backup/symlink surface to a plain atomic replace; the driver passes the dir when the gate is staged even without an MCP config; a legacy sweep at session start strips groups that dead sessions left in workspace files (live and foreign groups are never touched). The hook also gained per-fetch aborts (`AbortSignal.timeout`, POST capped at 10s, polls bounded by the remaining park budget) so a hung bridge request can never outlive the park deadline into an ungated soft-pass. Seven stub-server hook-execution regression tests pin the object contract; the staging suite covers the private-dir semantics and the sweep. 364 tests, tsc clean.
+
+## [1.6.2] - 2026-09-19
+
+### Fixed
+
+- **Compatibility with host 0.86.0's normalized provider stream input.** Stream entry points now receive a branded `TranscriptContext` (`{ messages }` only): the `context.systemPrompt` / `context.tools` fields are gone, and only `normalizeContext()` produces the new type. G10 fresh-conversation delivery read `context.systemPrompt`, so every fresh agy conversation silently lost the system prompt block (operating instructions, AGENTS.md project context, tool-priority note); the prompt now comes from the transcript via `getCurrentSystemPrompt(context.messages)`. `emitToolUse` arguments are restricted to `Record<string, JsonValue>` per the tightened `ToolCall.arguments` contract (driver args arrive JSON-decoded off the wire, so the two call-site casts are sound). Test fixtures in `provider-{sysprompt,streaming,late-result,escalation}.test.ts` and the `scripts/test-provider.ts` smoke context wrap raw objects with `normalizeContext()`. Dev pins `@earendil-works/*` raised `^0.85.0` to `^0.86.0`; `tsc` clean, 360 tests green.
+
 ## [1.6.1] - 2026-09-18
 
 ### Added

package/docs/APPROVAL-GATE.md

@@ -2,7 +2,9 @@
 
 agy is not a plain model: it runs its own agent loop with its own native tools (`run_command`, `create_file`, `edit_file`, ...). Those calls execute inside agy with no pi involvement, so pi's permission extensions never saw them. The approval gate closes that gap: agy native tool calls pass through a pi-side approval in a form the existing permission-extension ecosystem gates with zero changes.
 
-Mechanics: the extension stages an `.agents/hooks.json` group in the workspace; the Antigravity server/CLI fires a `PreToolUse` hook before each mutating native tool runs. The hook script (generated, per-pid, mode 0600 because it embeds the bridge token) POSTs the call to the bridge and polls for a decision. The bridge parks it, the provider interrupts the pi-side view of the agy turn with a `toolUse` for a SHADOW tool named `bash`/`write`/`edit` (same schema as the real builtin plus internal `__agy*` marker fields), and pi's whole `tool_call` surface applies: any installed permission extension gates the call unchanged, and only if nothing blocks does the fallback policy run. The decision travels back to the hook and agy enforces it; on deny the reason text is what agy's model sees. Marker calls never execute locally (a ticket check denies forged ones); non-marker calls delegate to a factory twin of the real builtin, so normal pi bash/write/edit behavior is unchanged. Read-only agy tools stay ungated. Every decision lands in the daily log with tool names, source, and latency.
+Mechanics: the extension stages an `.agents/hooks.json` group into its session-private bridge dir (the per-pid directory that is passed to this session's agy as an extra `--add-dir`); the Antigravity server/CLI discovers hooks in its add-dir directories and fires a `PreToolUse` hook before each mutating native tool runs. Because only this session's agy receives the directory, standalone IDE or CLI sessions in the same workspace never load the gate: their tool calls cannot be denied while pi is idle, and cannot be parked into a live pi turn (issue #5 isolation). The hook script (generated, per-pid, mode 0600 because it embeds the bridge token) POSTs the call to the bridge and polls for a decision. The bridge parks it, the provider interrupts the pi-side view of the agy turn with a `toolUse` for a SHADOW tool named `bash`/`write`/`edit` (same schema as the real builtin plus internal `__agy*` marker fields), and pi's whole `tool_call` surface applies: any installed permission extension gates the call unchanged, and only if nothing blocks does the fallback policy run. The decision travels back to the hook and agy enforces it; on deny the reason text is what agy's model sees. Marker calls never execute locally (a ticket check denies forged ones); non-marker calls delegate to a factory twin of the real builtin, so normal pi bash/write/edit behavior is unchanged. Read-only agy tools stay ungated. Every decision lands in the daily log with tool names, source, and latency.
+
+Upgrades from 1.6.x: that line staged the gate group into the shared workspace `.agents/hooks.json`, where standalone sessions loaded it. The extension now sweeps gate groups left in the workspace file by sessions whose pid is dead at every session start; groups of live sessions and foreign groups are never touched.
 
 Configuration (`/agy` config keys or environment):
 

package/extensions/index.ts

@@ -58,7 +58,7 @@ import {
 	type GatePolicy,
 } from "../src/approval-gate.js";
 import { detectPermissionGateExtensions, resolveGateMode } from "../src/approval-detect.js";
-import { hookScriptSource, removeGateHooks, stageGateHooks } from "../src/approval-hook.js";
+import { hookScriptSource, removeGateHooks, stageGateHooks, sweepWorkspaceGateGroups } from "../src/approval-hook.js";
 import { StreamDriver } from "../src/driver.js";
 import { AcpDriver } from "../src/acp/driver.js";
 import { runAcpAuth } from "../src/acp/auth.js";
@@ -69,7 +69,7 @@ import { CONFIG_PATH, loadConfig, logsDir, MAX_TURN_CAP_MIN, parseCapMinutes, sa
 import { agyMissingMessage, isAgyInstalled, savedEngineMessage, showEnginePicker, shouldOfferEnginePicker } from "../src/engine-picker.js";
 import { createDailyLogger, type DailyLogger } from "../src/daily-log.js";
 import { registerAskAntigravityTool, toolModelsFromRaw } from "../src/ask-tool.js";
-import { startMcpServer, TOKEN_HEADER, type McpServerHandle } from "../src/mcp-server.js";
+import { bridgeMcpConfigDir, startMcpServer, TOKEN_HEADER, type McpServerHandle } from "../src/mcp-server.js";
 import {
 	registerBridgeServer,
 	healBridgeSuppression,
@@ -752,11 +752,17 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 					// config value never lies silently.
 					fileLog.log("approval-dedicated-as-shadow", {}, "warn");
 				}
+				// Legacy cleanup (issue #5): 1.6.x staged the gate into the shared
+				// workspace hooks.json, where standalone IDE/CLI sessions load it.
+				// Staging now lives in the session-private add-dir; sweep groups left
+				// behind by dead sessions from the old scheme. Live sessions' and
+				// foreign groups are never touched.
+				const sweptLegacy = sweepWorkspaceGateGroups(process.cwd());
+				if (sweptLegacy > 0) fileLog.log("approval-workspace-swept", { swept: sweptLegacy }, "info");
 				if (mode === "off") {
-					// Gate off: remove ONLY this session's group. Other sessions'
-					// groups in a shared workspace are never touched - a gate-off
-					// session must not strip a gate-on session's matchers.
-					const unstaged = removeGateHooks(process.cwd());
+					// Gate off: drop this session's private hooks file. Other sessions
+					// own their own per-pid files; nothing shared to preserve.
+					const unstaged = removeGateHooks();
 					if (unstaged.wrote) fileLog.log("approval-unstaged", unstaged, "info");
 				} else {
 					// Script: per-pid file; 0600 because the bridge token is
@@ -773,7 +779,10 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 						{ mode: 0o600 },
 					);
 					gateScriptPath = scriptPath;
-					const staged = stageGateHooks(process.cwd(), {
+					// Private per-pid staging (issue #5 isolation): the gate group goes
+					// into the bridge add-dir that ONLY this session's agy receives.
+					// Standalone sessions in the workspace never load it.
+					const staged = stageGateHooks(bridgeMcpConfigDir(), {
 						port: r.handle.port,
 						token: r.handle.token,
 						scriptPath,
@@ -856,7 +865,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		unregisterBridgeServer(process.pid);
 		// Approval gate: unstage hooks and remove the per-pid script. Pending
 		// approvals already failed closed via handle close (bridge shutdown deny).
-		const unstaged = removeGateHooks(process.cwd());
+		const unstaged = removeGateHooks();
 		if (unstaged.wrote) fileLog.log("approval-unstaged", unstaged, "info");
 		if (gateScriptPath) {
 			try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",
@@ -59,10 +59,10 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.85.0",
-    "@earendil-works/pi-coding-agent": "^0.85.0",
-    "@earendil-works/pi-server": "^0.85.0",
-    "@earendil-works/pi-tui": "^0.85.0",
+    "@earendil-works/pi-ai": "^0.87.0",
+    "@earendil-works/pi-coding-agent": "^0.87.0",
+    "@earendil-works/pi-server": "^0.87.0",
+    "@earendil-works/pi-tui": "^0.87.0",
     "@types/node": "^22.0.0",
     "tsx": "^4.19.0",
     "typebox": "^1.1.38",

package/src/approval-hook.ts

@@ -1,30 +1,42 @@
 // Staging for the approval-gate hooks.json (docs/TODO.md 2.5).
 //
-// The ACP server and the agy CLI fire workspace `.agents/hooks.json`
-// PreToolUse hooks (V2: deny honored, reason reaches the model; V3: hook
-// TIMEOUT = soft-pass, agy proceeds ungated). Therefore:
+// The agy CLI discovers `.agents/hooks.json` in its --add-dir directories
+// (live-probed 2026-09-22: stream-json and interactive sessions load and
+// execute PreToolUse hooks from any add-dir; print mode reads only the
+// global config) and fires them before a gated tool runs (V2: deny
+// honored, reason reaches the model; V3: hook TIMEOUT = soft-pass, agy
+// proceeds ungated). Therefore:
 //   - the staged handler timeout must exceed the whole park budget with
 //     margin (never rely on timeout as a deny), and
 //   - the staged command delegates to the bundled poll script, which
 //     early-acks and polls the bridge for the terminal decision.
 //
-// Merge rules: never clobber a foreign hooks.json. Parse failures abort
-// staging; first-time modification of an existing file writes a
-// timestamped backup next to it (the 2026-09-05 incident rule: every
-// destructive path gets a guard).
+// ISOLATION (issue #5): the gate group is staged into the session-private
+// per-pid bridge dir (bridgeMcpConfigDir()), NOT the shared workspace. Only
+// this session's agy gets that dir as an extra --add-dir (driver.ts), so
+// standalone IDE/CLI sessions in the workspace can never load the gate -
+// neither denying their tools while pi is idle nor parking their calls
+// into a live pi turn. The private file is ours alone: no merge, no
+// foreign-file backup dance.
+//
+// Legacy: 1.6.x staged into the shared workspace `.agents/hooks.json`.
+// sweepWorkspaceGateGroups() removes gate groups left there by sessions
+// whose pid is dead; groups of live sessions and foreign groups are never
+// touched.
 //
 // Run: npm test
 
 import fs from "node:fs";
 import path from "node:path";
+import { bridgeMcpConfigDir } from "./mcp-server.js";
 
 export const HOOK_GROUP = "pi-bridge-gate";
 
-/** Group-key namespace. Each pi session stages its OWN group keyed per-pid
- *  (`pi-bridge-gate-<pid>`): hooks.json lives in the SHARED workspace, and
- *  two concurrent sessions must never remove or overwrite each other's gate
- *  (audit 2026-09-07: a single shared key let a gate-off session silently
- *  strip a gate-on session's PreToolUse matchers). */
+/** Group-key namespace. Each session's group is keyed per-pid
+ *  (`pi-bridge-gate-<pid>`): the key doubles as the ownership proof for the
+ *  legacy workspace sweep, which may only remove groups whose owning
+ *  session is dead (a stale shared key must never strip a live session's
+ *  gate - audit 2026-09-07). */
 export const GATE_GROUP_PREFIX = "pi-bridge-gate";
 
 /** This session's group key. */
@@ -85,6 +97,10 @@ export function hookScriptSource(opts: { port: number; token: string; deadlineMs
 const PORT = ${opts.port};
 const TOKEN = ${JSON.stringify(opts.token)};
 const DEADLINE = Date.now() + ${opts.deadlineMs};
+// Per-fetch abort: a hung fetch must never outlive the park deadline. A hook
+// killed by agy's staged timeout soft-passes (V3), so the script itself must
+// always reach a printed deny.
+const POST_TIMEOUT_MS = Math.min(10_000, ${opts.deadlineMs});
 let body = "";
 process.stdin.setEncoding("utf8");
 for await (const chunk of process.stdin) body += chunk;
@@ -94,14 +110,15 @@ try {
 		method: "POST",
 		headers: { "content-type": "application/json", "x-bridge-token": TOKEN },
 		body,
+		signal: AbortSignal.timeout(POST_TIMEOUT_MS),
 	});
 	const json = await res.json();
 	// Ungated payloads get a terminal decision right on the POST (no park).
-	if (json && typeof json === "object" && "decision" in json) {
-		console.log(JSON.stringify(json.decision));
+	if (json && typeof json === "object" && typeof json.decision === "string") {
+		console.log(JSON.stringify(json));
 		process.exit(0);
 	}
-	ticket = json.ticket ?? "";
+	ticket = json?.ticket ?? "";
 } catch {}
 if (!ticket) {
 	console.log(JSON.stringify({ decision: "deny", reason: "approval gate unreachable (bridge down?)" }));
@@ -112,10 +129,17 @@ while (Date.now() < DEADLINE) {
 	try {
 		const res = await fetch(\`http://127.0.0.1:\${PORT}/approval/\${encodeURIComponent(ticket)}\`, {
 			headers: { "x-bridge-token": TOKEN },
+			// Bounded by the remaining park budget: an aborted poll falls through
+			// to the loop condition and lands on the deadline deny.
+			signal: AbortSignal.timeout(Math.max(1, DEADLINE - Date.now())),
 		});
 		const json = await res.json();
-		if (json.status !== "pending") {
-			console.log(JSON.stringify(json.decision ?? { decision: "deny", reason: "gate returned no decision" }));
+		if (json?.status !== "pending") {
+			if (json && typeof json === "object" && typeof json.decision === "string") {
+				console.log(JSON.stringify(json));
+			} else {
+				console.log(JSON.stringify({ decision: "deny", reason: "gate returned no decision" }));
+			}
 			process.exit(0);
 		}
 	} catch {}
@@ -131,7 +155,7 @@ export function stagedTimeoutSeconds(parkBudgetMs: number): number {
 	return Math.max(60, Math.ceil(parkBudgetMs / 1000) + 60);
 }
 
-/** Build our hooks.json group for one workspace staging. */
+/** Build our hooks.json group for private-dir staging. */
 export function buildGateGroup(opts: StageOptions): Record<string, unknown> {
 	const command = `node ${JSON.stringify(opts.scriptPath)}`;
 	return {
@@ -153,100 +177,94 @@ export function buildGateGroup(opts: StageOptions): Record<string, unknown> {
 
 export interface StageResult {
 	wrote: boolean;
-	/** Backup file written before first modification of a foreign file. */
-	backup?: string;
-	/** Why nothing was written (parse failure, already current, ...). */
+	/** Why nothing was written (already current, ...). */
 	reason?: string;
 }
 
-/** Stage the gate group into <workspaceDir>/.agents/hooks.json under THIS
- *  session's per-pid key. Merge-safe:
- *  - foreign groups are preserved;
- *  - gate groups of DEAD sessions are swept (their bridge is gone; the hook
- *    would fail closed forever), groups of live sessions never touched;
- *  - a foreign file is backed up before its first modification;
- *  - unparseable files are never touched. */
-export function stageGateHooks(workspaceDir: string, opts: StageOptions): StageResult {
-	const dir = path.join(workspaceDir, ".agents");
-	const file = path.join(dir, "hooks.json");
-	const group = buildGateGroup(opts);
-	const ownKey = gateGroupKey();
-	let current: Record<string, unknown> = {};
-	const existed = fs.existsSync(file);
-	if (existed) {
-		try {
-			if (fs.lstatSync(file).isSymbolicLink()) {
-				return { wrote: false, reason: "hooks.json is a symlink; refusing to follow it" };
-			}
-		} catch {
-			return { wrote: false, reason: "hooks.json vanished while staging" };
-		}
+/** The session-private hooks.json for gate staging (beside the bridge's
+ *  mcp_config.json in the per-pid add-dir). */
+function gateHooksFile(dir: string = bridgeMcpConfigDir()): string {
+	return path.join(dir, ".agents", "hooks.json");
+}
+
+/** True if this session's gate hooks are currently staged in the private
+ *  add-dir. The driver uses this to decide whether to pass the extra
+ *  --add-dir even when the MCP config is absent. */
+export function gateHooksStaged(dir: string = bridgeMcpConfigDir()): boolean {
+	return fs.existsSync(gateHooksFile(dir));
+}
+
+/** Stage the gate group into the session-private per-pid dir:
+ *  <bridgeMcpConfigDir()>/.agents/hooks.json. The dir (and everything in
+ *  it) belongs to this pid alone, so the write is a plain atomic replace -
+ *  no merge, no foreign-file guards. */
+export function stageGateHooks(dir: string, opts: StageOptions): StageResult {
+	const file = gateHooksFile(dir);
+	const next = JSON.stringify({ [gateGroupKey()]: buildGateGroup(opts) }, null, 2) + "\n";
+	try {
+		if (fs.readFileSync(file, "utf8") === next) return { wrote: false, reason: "already staged" };
+	} catch {
+		/* absent or unreadable: write */
+	}
+	fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+	const tmp = `${file}.${process.pid}.tmp`;
+	try {
+		fs.writeFileSync(tmp, next, { mode: 0o600 });
+		fs.renameSync(tmp, file);
+	} catch (err) {
 		try {
-			const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-				return { wrote: false, reason: "hooks.json is not an object; refusing to touch it" };
-			}
-			current = parsed as Record<string, unknown>;
+			fs.unlinkSync(tmp);
 		} catch {
-			return { wrote: false, reason: "hooks.json is not valid JSON; refusing to touch it" };
-		}
-		// Sweep gate groups whose owning session is gone. Never touch groups of
-		// live sessions (concurrent pi sessions share this workspace) or groups
-		// we cannot attribute.
-		let swept = 0;
-		for (const key of Object.keys(current)) {
-			if (key === ownKey) continue;
-			const isGateGroup = key === GATE_GROUP_PREFIX || key.startsWith(`${GATE_GROUP_PREFIX}-`);
-			if (!isGateGroup) continue;
-			const pid = gateGroupPid(current[key]);
-			if (pid === null || pidAlive(pid)) continue;
-			delete current[key];
-			swept += 1;
-		}
-		if (swept > 0 && JSON.stringify(current[ownKey]) === JSON.stringify(group)) {
-			// Own group already current; the pass only swept dead peers.
-			fs.writeFileSync(file, JSON.stringify(current, null, 2) + "\n");
-			return { wrote: true, reason: `swept ${swept} dead gate group(s)` };
-		}
-		if (JSON.stringify(current[ownKey]) === JSON.stringify(group)) {
-			return { wrote: false, reason: "already staged" };
+			/* nothing */
 		}
+		throw err;
 	}
-	const backup =
-		existed && current[ownKey] === undefined
-			? `${file}.backup-${new Date().toISOString().replace(/[:.]/g, "-")}`
-			: undefined;
-	if (backup) fs.copyFileSync(file, backup);
-	current[ownKey] = group;
-	fs.mkdirSync(dir, { recursive: true });
-	fs.writeFileSync(file, JSON.stringify(current, null, 2) + "\n");
-	return { wrote: true, backup };
+	return { wrote: true };
 }
 
-/** Remove ONLY this session's gate group (or the given pid's). Other
- *  sessions' groups - including live ones in a shared workspace - are never
- *  touched: a gate-off session must not strip a gate-on session's matchers
- *  (audit 2026-09-07). Foreign content stays; an object file is left in
- *  place (harmless). */
-export function removeGateHooks(workspaceDir: string, pid: number = process.pid): StageResult {
-	const file = path.join(workspaceDir, ".agents", "hooks.json");
+/** Remove the private gate hooks file. The rest of the per-pid dir (the MCP
+ *  config) is managed by the bridge server lifecycle and stays until close. */
+export function removeGateHooks(dir: string = bridgeMcpConfigDir()): StageResult {
+	const file = gateHooksFile(dir);
 	if (!fs.existsSync(file)) return { wrote: false, reason: "no hooks.json" };
 	try {
-		if (fs.lstatSync(file).isSymbolicLink()) {
-			return { wrote: false, reason: "hooks.json is a symlink; refusing to follow it" };
-		}
+		fs.rmSync(file, { force: true });
+		return { wrote: true };
+	} catch {
+		return { wrote: false, reason: "remove failed" };
+	}
+}
+
+/** Legacy cleanup (issue #5): remove gate groups that 1.6.x staged into the
+ *  SHARED workspace `.agents/hooks.json` when their owning session is dead
+ *  (its bridge is gone; the hook would fail closed forever). Live sessions'
+ *  groups and groups we cannot attribute are never touched; foreign groups
+ *  and foreign files are never touched. Returns the number of swept groups. */
+export function sweepWorkspaceGateGroups(workspaceDir: string): number {
+	const file = path.join(workspaceDir, ".agents", "hooks.json");
+	let current: Record<string, unknown>;
+	try {
+		if (fs.lstatSync(file).isSymbolicLink()) return 0;
+		const parsed: unknown = JSON.parse(fs.readFileSync(file, "utf8"));
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return 0;
+		current = parsed as Record<string, unknown>;
 	} catch {
-		return { wrote: false, reason: "hooks.json vanished while removing" };
+		return 0;
+	}
+	let swept = 0;
+	for (const key of Object.keys(current)) {
+		const isGateGroup = key === GATE_GROUP_PREFIX || key.startsWith(`${GATE_GROUP_PREFIX}-`);
+		if (!isGateGroup) continue;
+		const pid = gateGroupPid(current[key]);
+		if (pid === null || pidAlive(pid)) continue;
+		delete current[key];
+		swept += 1;
 	}
+	if (swept === 0) return 0;
 	try {
-		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-		if (!parsed || typeof parsed !== "object") return { wrote: false, reason: "not an object; refusing" };
-		const ownKey = gateGroupKey(pid);
-		if (parsed[ownKey] === undefined) return { wrote: false, reason: "not staged" };
-		delete parsed[ownKey];
-		fs.writeFileSync(file, JSON.stringify(parsed, null, 2) + "\n");
-		return { wrote: true };
+		fs.writeFileSync(file, JSON.stringify(current, null, 2) + "\n");
 	} catch {
-		return { wrote: false, reason: "not valid JSON; refusing" };
+		return 0;
 	}
+	return swept;
 }

package/src/driver.ts

@@ -18,6 +18,7 @@ import { spawn, type ChildProcess } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { parseAgyLine } from "./stream-events.js";
 import { bridgeMcpConfigDir, bridgeMcpConfigExists } from "./mcp-server.js";
+import { gateHooksStaged } from "./approval-hook.js";
 import type {
 	AgyUsage,
 	DriverActivity,
@@ -335,7 +336,11 @@ export class StreamDriver implements TurnDriver {
 		this.#stderrTail = "";
 
 		const args: string[] = ["--add-dir", request.cwd];
-		if (bridgeMcpConfigExists()) args.push("--add-dir", bridgeMcpConfigDir());
+		// The bridge dir carries .agents/mcp_config.json (tool bridge) and, when
+		// the approval gate is on, .agents/hooks.json (gate staging). Only this
+		// session's agy ever gets it: standalone IDE/CLI sessions in the
+		// workspace must never load our gate (issue #5 isolation).
+		if (bridgeMcpConfigExists() || gateHooksStaged()) args.push("--add-dir", bridgeMcpConfigDir());
 		args.push("--model", request.model);
 		if (request.effort) args.push("--effort", request.effort);
 		args.push("--mode", request.mode);

package/src/provider.ts

@@ -19,13 +19,15 @@
 
 import {
 	createAssistantMessageEventStream,
+	getCurrentSystemPrompt,
 	type AssistantMessage,
 	type AssistantMessageEventStream,
-	type Context,
+	type JsonValue,
 	type Message,
 	type Model,
 	type SimpleStreamOptions,
 	type ThinkingLevel,
+	type TranscriptContext,
 	type Usage,
 } from "@earendil-works/pi-ai";
 import fs from "node:fs";
@@ -59,7 +61,7 @@ function zeroUsage(): Usage {
 /** Extract the latest user message as a flat prompt string. agy maintains its
  *  own conversation history via --conversation, so we collapse pi's structured
  *  message to text. Returns null if the last message isn't a user message. */
-function extractUserPrompt(context: Context): string | null {
+function extractUserPrompt(context: TranscriptContext): string | null {
 	const last = context.messages[context.messages.length - 1];
 	if (!last || last.role !== "user") return null;
 	const content = last.content;
@@ -75,7 +77,7 @@ function extractUserPrompt(context: Context): string | null {
 /** Image blocks of the latest user message (pi-ai ImageContent: base64 data
  *  + mimeType). The ACP engine forwards them as typed content blocks; the
  *  stream-json CLI prompt is text-only, so its driver simply ignores these. */
-function extractImages(context: Context): Array<{ data: string; mimeType: string }> {
+function extractImages(context: TranscriptContext): Array<{ data: string; mimeType: string }> {
 	const last = context.messages[context.messages.length - 1];
 	if (!last || last.role !== "user" || typeof last.content === "string") return [];
 	return last.content
@@ -100,7 +102,8 @@ const DIGEST_PREAMBLE =
 
 // --- pi system prompt (G10) ----------------------------------------------------
 //
-// pi composes context.systemPrompt every turn: its own operating instructions
+// pi normalizes the system prompt into the transcript every turn (read via
+// getCurrentSystemPrompt): its own operating instructions
 // plus every AGENTS.md/CLAUDE.md it loaded (global agent dir first, then
 // ancestors). The provider used to drop it, so agy models never saw the user's
 // machine-level or project-level instructions. agy has no system-prompt flag
@@ -921,13 +924,14 @@ function nextRtId(kind: "nat" | "wrap"): string {
 	return `${kind}-${++RT_SEQ}`;
 }
 
-/** Emit a complete toolCall block and end the pi call with toolUse. */
+/** Emit a complete toolCall block and end the pi call with toolUse.
+ *  pi 0.86 restricts ToolCall.arguments to JSON-compatible values. */
 function emitToolUse(
 	stream: AssistantMessageEventStream,
 	blocks: BlockState,
 	id: string,
 	name: string,
-	args: Record<string, unknown>,
+	args: Record<string, JsonValue>,
 ): void {
 	const partial = blocks.partial;
 	closeThinking(stream, blocks);
@@ -1050,7 +1054,7 @@ function acpEditFileArg(args: Record<string, unknown>): string | undefined {
 				emitToolUse(stream, blocks, id, mapped.tool, {
 					reasoning: `re-exec of agy ${activity.name} for display`,
 					...mapped.args,
-				});
+				} as Record<string, JsonValue>);
 				return "parked";
 			}
 			{
@@ -1067,7 +1071,9 @@ function acpEditFileArg(args: Record<string, unknown>): string | undefined {
 		case "bridge_call": {
 			// Park the pi call: real tool name + args, toolUse stopReason. pi
 			// executes; the toolResult returns on the next stream call.
-			emitToolUse(stream, blocks, activity.callId, activity.name, activity.args);
+			// Driver args are JSON-decoded off the agy wire, so the JsonValue
+			// cast is sound.
+			emitToolUse(stream, blocks, activity.callId, activity.name, activity.args as Record<string, JsonValue>);
 			return "parked";
 		}
 	}
@@ -1077,7 +1083,7 @@ function acpEditFileArg(args: Record<string, unknown>): string | undefined {
 async function runTurnDriver(
 	stream: AssistantMessageEventStream,
 	model: Model<Api>,
-	context: Context,
+	context: TranscriptContext,
 	options: SimpleStreamOptions | undefined,
 	entries: AgyModelEntry[],
 	store: SessionStore,
@@ -1179,7 +1185,9 @@ async function runTurnDriver(
 		// Fresh conversation only: agy stores the block in its own history, so
 		// re-sending it every turn would bloat each prompt and bust the cache.
 		const sysPrompt =
-			config.systemPrompt && !existing?.conversationId ? context.systemPrompt : undefined;
+			config.systemPrompt && !existing?.conversationId
+				? getCurrentSystemPrompt(context.messages) || undefined
+				: undefined;
 		const fullPrompt =
 			late.length > 0
 				? buildLateResultPrompt(late, prompt || undefined)
@@ -1258,7 +1266,7 @@ async function runTurnDriver(
  *  fallback). */
 export function createStreamSimple(
 	deps: StreamSimpleDeps,
-): (model: Model<Api>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream {
+): (model: Model<Api>, context: TranscriptContext, options?: SimpleStreamOptions) => AssistantMessageEventStream {
 	const { entries, store, roundTrips } = deps;
 
 	return function streamSimple(model, context, options) {