@estebanforge/pi-antigravity-bridge 1.6.2 → 1.6.4

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.6.3] - 2026-09-22
+
+### Fixed
+
+- **The approval gate no longer leaks into standalone sessions, and its verdicts parse.** Thanks @explesy for the report (https://github.com/EstebanForge/pi-antigravity-bridge/issues/5). Two defects in the generated hook script and its staging. Every terminal path printed the bare decision scalar (`"deny"` / `"allow"`) instead of a JSON object, so any session that loaded a staged gate failed hook parsing outright (`protojson: syntax error`): the direct-POST and polling branches now print the full response object guarded by a `typeof json.decision === "string"` check, fall back to a fail-closed deny object on malformed bodies, and read ticket and poll status through `json?.`. The gate group itself was staged into the shared workspace `.agents/hooks.json`, so any standalone IDE or CLI session in that workspace loaded pi's gate: tool calls were denied with "no active antigravity turn" while pi sat idle, and mid-turn they parked into pi's approval queue. A live probe of the CLI settled the discovery rule (hooks load from `--add-dir` directories in stream-json and interactive sessions; print mode reads only the global config), and the gate now stages `.agents/hooks.json` into the session-private per-pid bridge dir beside `mcp_config.json`, which only this session's agy receives as an extra `--add-dir`. Staging into a pid-private file dropped the merge/backup/symlink surface to a plain atomic replace; the driver passes the dir when the gate is staged even without an MCP config; a legacy sweep at session start strips groups that dead sessions left in workspace files (live and foreign groups are never touched). The hook also gained per-fetch aborts (`AbortSignal.timeout`, POST capped at 10s, polls bounded by the remaining park budget) so a hung bridge request can never outlive the park deadline into an ungated soft-pass. Seven stub-server hook-execution regression tests pin the object contract; the staging suite covers the private-dir semantics and the sweep. 364 tests, tsc clean.
+
 ## [1.6.2] - 2026-09-19
 
 ### Fixed

package/README.md

@@ -13,7 +13,7 @@ A Gemini model provider **and** the `AskAntigravity` delegation tool for [pi](ht
 </p>
 
 
-If you also have [`@estebanforge/pi-ask-antigravity`](https://github.com/EstebanForge/pi-ask-antigravity) installed, this bridge takes over: pi-ask-antigravity detects the bridge and registers nothing, so the `AskAntigravity` tool is never duplicated.
+If you also have [`@estebanforge/pi-ask-antigravity`](https://github.com/EstebanForge/pi-extensions/tree/main/packages/pi-ask-antigravity) installed, this bridge takes over: pi-ask-antigravity detects the bridge and registers nothing, so the `AskAntigravity` tool is never duplicated.
 
 ## What it does
 

package/extensions/index.ts

@@ -58,7 +58,7 @@ import {
 	type GatePolicy,
 } from "../src/approval-gate.js";
 import { detectPermissionGateExtensions, resolveGateMode } from "../src/approval-detect.js";
-import { hookScriptSource, removeGateHooks, stageGateHooks } from "../src/approval-hook.js";
+import { hookScriptSource, removeGateHooks, stageGateHooks, sweepWorkspaceGateGroups } from "../src/approval-hook.js";
 import { StreamDriver } from "../src/driver.js";
 import { AcpDriver } from "../src/acp/driver.js";
 import { runAcpAuth } from "../src/acp/auth.js";
@@ -69,7 +69,7 @@ import { CONFIG_PATH, loadConfig, logsDir, MAX_TURN_CAP_MIN, parseCapMinutes, sa
 import { agyMissingMessage, isAgyInstalled, savedEngineMessage, showEnginePicker, shouldOfferEnginePicker } from "../src/engine-picker.js";
 import { createDailyLogger, type DailyLogger } from "../src/daily-log.js";
 import { registerAskAntigravityTool, toolModelsFromRaw } from "../src/ask-tool.js";
-import { startMcpServer, TOKEN_HEADER, type McpServerHandle } from "../src/mcp-server.js";
+import { bridgeMcpConfigDir, startMcpServer, TOKEN_HEADER, type McpServerHandle } from "../src/mcp-server.js";
 import {
 	registerBridgeServer,
 	healBridgeSuppression,
@@ -752,11 +752,17 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 					// config value never lies silently.
 					fileLog.log("approval-dedicated-as-shadow", {}, "warn");
 				}
+				// Legacy cleanup (issue #5): 1.6.x staged the gate into the shared
+				// workspace hooks.json, where standalone IDE/CLI sessions load it.
+				// Staging now lives in the session-private add-dir; sweep groups left
+				// behind by dead sessions from the old scheme. Live sessions' and
+				// foreign groups are never touched.
+				const sweptLegacy = sweepWorkspaceGateGroups(process.cwd());
+				if (sweptLegacy > 0) fileLog.log("approval-workspace-swept", { swept: sweptLegacy }, "info");
 				if (mode === "off") {
-					// Gate off: remove ONLY this session's group. Other sessions'
-					// groups in a shared workspace are never touched - a gate-off
-					// session must not strip a gate-on session's matchers.
-					const unstaged = removeGateHooks(process.cwd());
+					// Gate off: drop this session's private hooks file. Other sessions
+					// own their own per-pid files; nothing shared to preserve.
+					const unstaged = removeGateHooks();
 					if (unstaged.wrote) fileLog.log("approval-unstaged", unstaged, "info");
 				} else {
 					// Script: per-pid file; 0600 because the bridge token is
@@ -773,7 +779,10 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 						{ mode: 0o600 },
 					);
 					gateScriptPath = scriptPath;
-					const staged = stageGateHooks(process.cwd(), {
+					// Private per-pid staging (issue #5 isolation): the gate group goes
+					// into the bridge add-dir that ONLY this session's agy receives.
+					// Standalone sessions in the workspace never load it.
+					const staged = stageGateHooks(bridgeMcpConfigDir(), {
 						port: r.handle.port,
 						token: r.handle.token,
 						scriptPath,
@@ -856,7 +865,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		unregisterBridgeServer(process.pid);
 		// Approval gate: unstage hooks and remove the per-pid script. Pending
 		// approvals already failed closed via handle close (bridge shutdown deny).
-		const unstaged = removeGateHooks(process.cwd());
+		const unstaged = removeGateHooks();
 		if (unstaged.wrote) fileLog.log("approval-unstaged", unstaged, "info");
 		if (gateScriptPath) {
 			try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",
@@ -26,24 +26,19 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/EstebanForge/pi-antigravity-bridge.git"
+    "url": "git+https://github.com/EstebanForge/pi-extensions.git",
+    "directory": "packages/pi-antigravity-bridge"
   },
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
-  "scripts": {
-    "build": "tsc --noEmit",
-    "test": "vitest run",
-    "prepublishOnly": "npm run build && npm test",
-    "smoke:pi": "bash scripts/smoke-in-pi.sh"
-  },
   "files": [
     "extensions",
     "src",
-    "docs",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "LICENSE"
   ],
   "pi": {
     "extensions": [
@@ -58,17 +53,6 @@
       "optional": true
     }
   },
-  "devDependencies": {
-    "@earendil-works/pi-ai": "^0.86.0",
-    "@earendil-works/pi-coding-agent": "^0.86.0",
-    "@earendil-works/pi-server": "^0.86.0",
-    "@earendil-works/pi-tui": "^0.86.0",
-    "@types/node": "^22.0.0",
-    "tsx": "^4.19.0",
-    "typebox": "^1.1.38",
-    "typescript": "^5.8.0",
-    "vitest": "^4.1.7"
-  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0"
   }

package/src/approval-hook.ts

@@ -1,30 +1,42 @@
 // Staging for the approval-gate hooks.json (docs/TODO.md 2.5).
 //
-// The ACP server and the agy CLI fire workspace `.agents/hooks.json`
-// PreToolUse hooks (V2: deny honored, reason reaches the model; V3: hook
-// TIMEOUT = soft-pass, agy proceeds ungated). Therefore:
+// The agy CLI discovers `.agents/hooks.json` in its --add-dir directories
+// (live-probed 2026-09-22: stream-json and interactive sessions load and
+// execute PreToolUse hooks from any add-dir; print mode reads only the
+// global config) and fires them before a gated tool runs (V2: deny
+// honored, reason reaches the model; V3: hook TIMEOUT = soft-pass, agy
+// proceeds ungated). Therefore:
 //   - the staged handler timeout must exceed the whole park budget with
 //     margin (never rely on timeout as a deny), and
 //   - the staged command delegates to the bundled poll script, which
 //     early-acks and polls the bridge for the terminal decision.
 //
-// Merge rules: never clobber a foreign hooks.json. Parse failures abort
-// staging; first-time modification of an existing file writes a
-// timestamped backup next to it (the 2026-09-05 incident rule: every
-// destructive path gets a guard).
+// ISOLATION (issue #5): the gate group is staged into the session-private
+// per-pid bridge dir (bridgeMcpConfigDir()), NOT the shared workspace. Only
+// this session's agy gets that dir as an extra --add-dir (driver.ts), so
+// standalone IDE/CLI sessions in the workspace can never load the gate -
+// neither denying their tools while pi is idle nor parking their calls
+// into a live pi turn. The private file is ours alone: no merge, no
+// foreign-file backup dance.
+//
+// Legacy: 1.6.x staged into the shared workspace `.agents/hooks.json`.
+// sweepWorkspaceGateGroups() removes gate groups left there by sessions
+// whose pid is dead; groups of live sessions and foreign groups are never
+// touched.
 //
 // Run: npm test
 
 import fs from "node:fs";
 import path from "node:path";
+import { bridgeMcpConfigDir } from "./mcp-server.js";
 
 export const HOOK_GROUP = "pi-bridge-gate";
 
-/** Group-key namespace. Each pi session stages its OWN group keyed per-pid
- *  (`pi-bridge-gate-<pid>`): hooks.json lives in the SHARED workspace, and
- *  two concurrent sessions must never remove or overwrite each other's gate
- *  (audit 2026-09-07: a single shared key let a gate-off session silently
- *  strip a gate-on session's PreToolUse matchers). */
+/** Group-key namespace. Each session's group is keyed per-pid
+ *  (`pi-bridge-gate-<pid>`): the key doubles as the ownership proof for the
+ *  legacy workspace sweep, which may only remove groups whose owning
+ *  session is dead (a stale shared key must never strip a live session's
+ *  gate - audit 2026-09-07). */
 export const GATE_GROUP_PREFIX = "pi-bridge-gate";
 
 /** This session's group key. */
@@ -85,6 +97,10 @@ export function hookScriptSource(opts: { port: number; token: string; deadlineMs
 const PORT = ${opts.port};
 const TOKEN = ${JSON.stringify(opts.token)};
 const DEADLINE = Date.now() + ${opts.deadlineMs};
+// Per-fetch abort: a hung fetch must never outlive the park deadline. A hook
+// killed by agy's staged timeout soft-passes (V3), so the script itself must
+// always reach a printed deny.
+const POST_TIMEOUT_MS = Math.min(10_000, ${opts.deadlineMs});
 let body = "";
 process.stdin.setEncoding("utf8");
 for await (const chunk of process.stdin) body += chunk;
@@ -94,14 +110,15 @@ try {
 		method: "POST",
 		headers: { "content-type": "application/json", "x-bridge-token": TOKEN },
 		body,
+		signal: AbortSignal.timeout(POST_TIMEOUT_MS),
 	});
 	const json = await res.json();
 	// Ungated payloads get a terminal decision right on the POST (no park).
-	if (json && typeof json === "object" && "decision" in json) {
-		console.log(JSON.stringify(json.decision));
+	if (json && typeof json === "object" && typeof json.decision === "string") {
+		console.log(JSON.stringify(json));
 		process.exit(0);
 	}
-	ticket = json.ticket ?? "";
+	ticket = json?.ticket ?? "";
 } catch {}
 if (!ticket) {
 	console.log(JSON.stringify({ decision: "deny", reason: "approval gate unreachable (bridge down?)" }));
@@ -112,10 +129,17 @@ while (Date.now() < DEADLINE) {
 	try {
 		const res = await fetch(\`http://127.0.0.1:\${PORT}/approval/\${encodeURIComponent(ticket)}\`, {
 			headers: { "x-bridge-token": TOKEN },
+			// Bounded by the remaining park budget: an aborted poll falls through
+			// to the loop condition and lands on the deadline deny.
+			signal: AbortSignal.timeout(Math.max(1, DEADLINE - Date.now())),
 		});
 		const json = await res.json();
-		if (json.status !== "pending") {
-			console.log(JSON.stringify(json.decision ?? { decision: "deny", reason: "gate returned no decision" }));
+		if (json?.status !== "pending") {
+			if (json && typeof json === "object" && typeof json.decision === "string") {
+				console.log(JSON.stringify(json));
+			} else {
+				console.log(JSON.stringify({ decision: "deny", reason: "gate returned no decision" }));
+			}
 			process.exit(0);
 		}
 	} catch {}
@@ -131,7 +155,7 @@ export function stagedTimeoutSeconds(parkBudgetMs: number): number {
 	return Math.max(60, Math.ceil(parkBudgetMs / 1000) + 60);
 }
 
-/** Build our hooks.json group for one workspace staging. */
+/** Build our hooks.json group for private-dir staging. */
 export function buildGateGroup(opts: StageOptions): Record<string, unknown> {
 	const command = `node ${JSON.stringify(opts.scriptPath)}`;
 	return {
@@ -153,100 +177,94 @@ export function buildGateGroup(opts: StageOptions): Record<string, unknown> {
 
 export interface StageResult {
 	wrote: boolean;
-	/** Backup file written before first modification of a foreign file. */
-	backup?: string;
-	/** Why nothing was written (parse failure, already current, ...). */
+	/** Why nothing was written (already current, ...). */
 	reason?: string;
 }
 
-/** Stage the gate group into <workspaceDir>/.agents/hooks.json under THIS
- *  session's per-pid key. Merge-safe:
- *  - foreign groups are preserved;
- *  - gate groups of DEAD sessions are swept (their bridge is gone; the hook
- *    would fail closed forever), groups of live sessions never touched;
- *  - a foreign file is backed up before its first modification;
- *  - unparseable files are never touched. */
-export function stageGateHooks(workspaceDir: string, opts: StageOptions): StageResult {
-	const dir = path.join(workspaceDir, ".agents");
-	const file = path.join(dir, "hooks.json");
-	const group = buildGateGroup(opts);
-	const ownKey = gateGroupKey();
-	let current: Record<string, unknown> = {};
-	const existed = fs.existsSync(file);
-	if (existed) {
-		try {
-			if (fs.lstatSync(file).isSymbolicLink()) {
-				return { wrote: false, reason: "hooks.json is a symlink; refusing to follow it" };
-			}
-		} catch {
-			return { wrote: false, reason: "hooks.json vanished while staging" };
-		}
+/** The session-private hooks.json for gate staging (beside the bridge's
+ *  mcp_config.json in the per-pid add-dir). */
+function gateHooksFile(dir: string = bridgeMcpConfigDir()): string {
+	return path.join(dir, ".agents", "hooks.json");
+}
+
+/** True if this session's gate hooks are currently staged in the private
+ *  add-dir. The driver uses this to decide whether to pass the extra
+ *  --add-dir even when the MCP config is absent. */
+export function gateHooksStaged(dir: string = bridgeMcpConfigDir()): boolean {
+	return fs.existsSync(gateHooksFile(dir));
+}
+
+/** Stage the gate group into the session-private per-pid dir:
+ *  <bridgeMcpConfigDir()>/.agents/hooks.json. The dir (and everything in
+ *  it) belongs to this pid alone, so the write is a plain atomic replace -
+ *  no merge, no foreign-file guards. */
+export function stageGateHooks(dir: string, opts: StageOptions): StageResult {
+	const file = gateHooksFile(dir);
+	const next = JSON.stringify({ [gateGroupKey()]: buildGateGroup(opts) }, null, 2) + "\n";
+	try {
+		if (fs.readFileSync(file, "utf8") === next) return { wrote: false, reason: "already staged" };
+	} catch {
+		/* absent or unreadable: write */
+	}
+	fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+	const tmp = `${file}.${process.pid}.tmp`;
+	try {
+		fs.writeFileSync(tmp, next, { mode: 0o600 });
+		fs.renameSync(tmp, file);
+	} catch (err) {
 		try {
-			const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-				return { wrote: false, reason: "hooks.json is not an object; refusing to touch it" };
-			}
-			current = parsed as Record<string, unknown>;
+			fs.unlinkSync(tmp);
 		} catch {
-			return { wrote: false, reason: "hooks.json is not valid JSON; refusing to touch it" };
-		}
-		// Sweep gate groups whose owning session is gone. Never touch groups of
-		// live sessions (concurrent pi sessions share this workspace) or groups
-		// we cannot attribute.
-		let swept = 0;
-		for (const key of Object.keys(current)) {
-			if (key === ownKey) continue;
-			const isGateGroup = key === GATE_GROUP_PREFIX || key.startsWith(`${GATE_GROUP_PREFIX}-`);
-			if (!isGateGroup) continue;
-			const pid = gateGroupPid(current[key]);
-			if (pid === null || pidAlive(pid)) continue;
-			delete current[key];
-			swept += 1;
-		}
-		if (swept > 0 && JSON.stringify(current[ownKey]) === JSON.stringify(group)) {
-			// Own group already current; the pass only swept dead peers.
-			fs.writeFileSync(file, JSON.stringify(current, null, 2) + "\n");
-			return { wrote: true, reason: `swept ${swept} dead gate group(s)` };
-		}
-		if (JSON.stringify(current[ownKey]) === JSON.stringify(group)) {
-			return { wrote: false, reason: "already staged" };
+			/* nothing */
 		}
+		throw err;
 	}
-	const backup =
-		existed && current[ownKey] === undefined
-			? `${file}.backup-${new Date().toISOString().replace(/[:.]/g, "-")}`
-			: undefined;
-	if (backup) fs.copyFileSync(file, backup);
-	current[ownKey] = group;
-	fs.mkdirSync(dir, { recursive: true });
-	fs.writeFileSync(file, JSON.stringify(current, null, 2) + "\n");
-	return { wrote: true, backup };
+	return { wrote: true };
 }
 
-/** Remove ONLY this session's gate group (or the given pid's). Other
- *  sessions' groups - including live ones in a shared workspace - are never
- *  touched: a gate-off session must not strip a gate-on session's matchers
- *  (audit 2026-09-07). Foreign content stays; an object file is left in
- *  place (harmless). */
-export function removeGateHooks(workspaceDir: string, pid: number = process.pid): StageResult {
-	const file = path.join(workspaceDir, ".agents", "hooks.json");
+/** Remove the private gate hooks file. The rest of the per-pid dir (the MCP
+ *  config) is managed by the bridge server lifecycle and stays until close. */
+export function removeGateHooks(dir: string = bridgeMcpConfigDir()): StageResult {
+	const file = gateHooksFile(dir);
 	if (!fs.existsSync(file)) return { wrote: false, reason: "no hooks.json" };
 	try {
-		if (fs.lstatSync(file).isSymbolicLink()) {
-			return { wrote: false, reason: "hooks.json is a symlink; refusing to follow it" };
-		}
+		fs.rmSync(file, { force: true });
+		return { wrote: true };
+	} catch {
+		return { wrote: false, reason: "remove failed" };
+	}
+}
+
+/** Legacy cleanup (issue #5): remove gate groups that 1.6.x staged into the
+ *  SHARED workspace `.agents/hooks.json` when their owning session is dead
+ *  (its bridge is gone; the hook would fail closed forever). Live sessions'
+ *  groups and groups we cannot attribute are never touched; foreign groups
+ *  and foreign files are never touched. Returns the number of swept groups. */
+export function sweepWorkspaceGateGroups(workspaceDir: string): number {
+	const file = path.join(workspaceDir, ".agents", "hooks.json");
+	let current: Record<string, unknown>;
+	try {
+		if (fs.lstatSync(file).isSymbolicLink()) return 0;
+		const parsed: unknown = JSON.parse(fs.readFileSync(file, "utf8"));
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return 0;
+		current = parsed as Record<string, unknown>;
 	} catch {
-		return { wrote: false, reason: "hooks.json vanished while removing" };
+		return 0;
+	}
+	let swept = 0;
+	for (const key of Object.keys(current)) {
+		const isGateGroup = key === GATE_GROUP_PREFIX || key.startsWith(`${GATE_GROUP_PREFIX}-`);
+		if (!isGateGroup) continue;
+		const pid = gateGroupPid(current[key]);
+		if (pid === null || pidAlive(pid)) continue;
+		delete current[key];
+		swept += 1;
 	}
+	if (swept === 0) return 0;
 	try {
-		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-		if (!parsed || typeof parsed !== "object") return { wrote: false, reason: "not an object; refusing" };
-		const ownKey = gateGroupKey(pid);
-		if (parsed[ownKey] === undefined) return { wrote: false, reason: "not staged" };
-		delete parsed[ownKey];
-		fs.writeFileSync(file, JSON.stringify(parsed, null, 2) + "\n");
-		return { wrote: true };
+		fs.writeFileSync(file, JSON.stringify(current, null, 2) + "\n");
 	} catch {
-		return { wrote: false, reason: "not valid JSON; refusing" };
+		return 0;
 	}
+	return swept;
 }

package/src/driver.ts

@@ -18,6 +18,7 @@ import { spawn, type ChildProcess } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { parseAgyLine } from "./stream-events.js";
 import { bridgeMcpConfigDir, bridgeMcpConfigExists } from "./mcp-server.js";
+import { gateHooksStaged } from "./approval-hook.js";
 import type {
 	AgyUsage,
 	DriverActivity,
@@ -335,7 +336,11 @@ export class StreamDriver implements TurnDriver {
 		this.#stderrTail = "";
 
 		const args: string[] = ["--add-dir", request.cwd];
-		if (bridgeMcpConfigExists()) args.push("--add-dir", bridgeMcpConfigDir());
+		// The bridge dir carries .agents/mcp_config.json (tool bridge) and, when
+		// the approval gate is on, .agents/hooks.json (gate staging). Only this
+		// session's agy ever gets it: standalone IDE/CLI sessions in the
+		// workspace must never load our gate (issue #5 isolation).
+		if (bridgeMcpConfigExists() || gateHooksStaged()) args.push("--add-dir", bridgeMcpConfigDir());
 		args.push("--model", request.model);
 		if (request.effort) args.push("--effort", request.effort);
 		args.push("--mode", request.mode);