@estebanforge/pi-antigravity-bridge 1.6.4 → 1.7.1

package/src/acp/connection.ts

@@ -25,6 +25,8 @@ import os from "node:os";
 import path from "node:path";
 import { parseAuthPort, readLastUrl } from "./browser-capture.js";
 import { frameCarriesUsage } from "./events.js";
+import type { AgyUsage } from "../driver-types.js";
+import { redactText } from "../redact.js";
 import { JsonRpcResponseError, JsonRpcSession } from "./jsonrpc.js";
 
 export interface AcpMcpServer {
@@ -82,6 +84,10 @@ export class AcpConnection {
 	#rpc: JsonRpcSession | undefined;
 	#stderrTail = "";
 	#usageSeen = false;
+	/** Set ONLY by a parsed PromptResponse.usage; this gates estimate
+	 *  suppression. #usageSeen stays diagnostic: any usage-shaped frame trips
+	 *  it, and the connection outlives turns. */
+	#exactUsageSeen = false;
 	#exited = false;
 	#killed = false;
 	#suppressUpdates = false;
@@ -105,7 +111,9 @@ export class AcpConnection {
 	}
 
 	get stderrTail(): string {
-		return this.#stderrTail;
+		// Redacted at the boundary: the raw tail stays internal, every consumer
+		// (doctor display, driver exit logs, failure messages) sees redacted text.
+		return redactText(this.#stderrTail);
 	}
 
 	/** Gate B watch: latched true once any session/update frame carried
@@ -115,6 +123,11 @@ export class AcpConnection {
 		return this.#usageSeen;
 	}
 
+	/** True once the server sent real per-turn usage (PromptResponse.usage). */
+	get exactUsageSeen(): boolean {
+		return this.#exactUsageSeen;
+	}
+
 	/** While true, session/update notifications are dropped: they are the
 	 *  full-text history replay that precedes a session/load response, never
 	 *  live generation (run 6). */
@@ -142,8 +155,8 @@ export class AcpConnection {
 		// try/catch in #write cannot see them. Without this listener an EPIPE
 		// (server died mid-handshake) is uncaught and kills pi.
 		child.stdin?.on("error", (err) => {
-			this.#opts.log("stdin-error", { message: err.message });
-			if (!this.#exited && !this.#killed) this.#finish(err.message);
+			this.#opts.log("stdin-error", { message: redactText(err.message) });
+			if (!this.#exited && !this.#killed) this.#finish(redactText(err.message));
 		});
 
 		const rpc = new JsonRpcSession({
@@ -159,12 +172,14 @@ export class AcpConnection {
 			this.#stderrTail = (this.#stderrTail + chunk).slice(-8192);
 		});
 		child.on("error", (err) => {
-			this.#opts.log("spawn-error", { message: err.message });
-			this.#finish(err.message);
+			this.#opts.log("spawn-error", { message: redactText(err.message) });
+			this.#finish(redactText(err.message));
 		});
 		child.on("exit", (code, signal) => {
 			this.#opts.log("exit", { code: code ?? signal ?? "?" });
-			this.#finish(this.#stderrTail.trim());
+			// The reason rides into pending-request rejections, so it must be
+			// redacted here (server stderr can carry auth material).
+			this.#finish(redactText(this.#stderrTail.trim()));
 		});
 
 		const result = (await this.request(
@@ -237,7 +252,7 @@ export class AcpConnection {
 		text: string,
 		images: Array<{ data: string; mimeType: string }> = [],
 		contextBlock?: { uri: string; text: string },
-	): Promise<{ stopReason: string }> {
+	): Promise<{ stopReason: string; usage?: AgyUsage }> {
 		// Block order: images, then the embedded-context resource (pi-side
 		// digest), then the text question last (it refers to everything before
 		// it). Shapes per the ACP v1 content-block schema; embeddedContext is
@@ -264,7 +279,15 @@ export class AcpConnection {
 		if (typeof stopReason !== "string") {
 			throw new Error("ACP session/prompt returned no stopReason");
 		}
-		return { stopReason };
+		// Optional, unstable ACP PromptResponse.usage: absent on 1.1.1 but
+		// parsed for the day the server forwards its SDK usage_metadata. Never
+		// infer exact counts from a context-window usage_update ({used,size}).
+		const usage = parseAcpTurnUsage(result?.usage);
+		if (usage) {
+			this.#usageSeen = true;
+			this.#exactUsageSeen = true;
+		}
+		return { stopReason, ...(usage ? { usage } : {}) };
 	}
 
 	/** Probe-and-cancel. Returns supported:false when the server does not
@@ -426,10 +449,32 @@ export class AcpConnection {
 		this.#authUrlWatcher?.close();
 		this.#authUrlWatcher = undefined;
 		this.abortAll(`connection exited: ${reason || "process gone"}`);
-		this.#opts.onExit({ code: null, signal: null, stderrTail: this.#stderrTail });
+		this.#opts.onExit({ code: null, signal: null, stderrTail: redactText(this.#stderrTail) });
 	}
 }
 
+/** ACP's optional (unstable) per-turn PromptResponse.usage, not the
+ *  session/usage_update context-window occupancy notification. */
+export function parseAcpTurnUsage(value: unknown): AgyUsage | undefined {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+	const u = value as Record<string, unknown>;
+	const count = (v: unknown): number | undefined =>
+		typeof v === "number" && Number.isSafeInteger(v) && v >= 0 ? v : undefined;
+	const input = count(u.inputTokens);
+	const output = count(u.outputTokens);
+	const total = count(u.totalTokens);
+	const thought = count(u.thoughtTokens);
+	const cacheRead = count(u.cachedReadTokens);
+	if (input === undefined || output === undefined || total === undefined) return undefined;
+	return {
+		input_tokens: input,
+		output_tokens: output,
+		total_tokens: total,
+		...(thought === undefined ? {} : { thinking_tokens: thought }),
+		...(cacheRead === undefined ? {} : { cache_read_tokens: cacheRead }),
+	};
+}
+
 export function translateError(method: string, err: unknown): Error {
 	if (err instanceof AcpAuthError) return err;
 	if (err instanceof JsonRpcResponseError) {

package/src/acp/driver.ts

@@ -73,6 +73,8 @@ interface ActiveTurn {
 	thoughtTokens: number;
 	textDeltas: number;
 	thoughtDeltas: number;
+	/** Estimated once, not re-tokenized for every streaming delta. */
+	estimatedInputTokens: number;
 	sawResult: boolean;
 	/** True once the prompt RPC was issued. Abort before this point has
 	 *  nothing to cancel: probing would risk a success-as-noop answer from a
@@ -89,12 +91,7 @@ interface ActiveTurn {
 	idleTimer?: ReturnType<typeof setTimeout>;
 	/** toolCallId → tool name + args + optional native diff (diff rides on
 	 *  the pending tool_call frame; updates don't repeat it). */
-	toolCalls: Map<string, { name: string; args: Record<string, unknown>; diff?: AcpEditDiff }>;
-	/** Last pending native tool seen. The supersede quirk (run 6, finding 7)
-	 *  means the executing call can arrive under a DIFFERENT id than the
-	 *  approved one; unknown-id updates adopt this so the diff and name are
-	 *  not lost. */
-	lastNativeTool?: { name: string; args: Record<string, unknown>; diff?: AcpEditDiff };
+	toolCalls: Map<string, { name: string; args: Record<string, unknown>; diff?: AcpEditDiff; mcpServer?: string }>;
 }
 
 /** Recombine the provider's (base slug, effort) into the FULL ACP model slug.
@@ -309,6 +306,10 @@ export class AcpDriver implements TurnDriver {
 		// Timers: overall (turn deadline, pause-aware) + idle (inactivity).
 		this.#armOverall(turn);
 		this.#armIdle(turn);
+		// Live usage is explicitly an estimate: ACP 1.1.1 does not forward the
+		// SDK's exact usage_metadata onto the ACP wire. Emit input first; output
+		// estimates advance with each text/thought delta below.
+		this.#emitLiveEstimate(turn);
 
 		// Prompt. Updates stream through the connection's onUpdate callback.
 		try {
@@ -317,11 +318,15 @@ export class AcpDriver implements TurnDriver {
 			const result = await conn.prompt(turn.sessionId, request.prompt, request.images, request.contextBlock);
 			if (turn.closed) return;
 			turn.sawResult = true;
+			// When a future server fills ACP PromptResponse.usage, exact counts
+			// supersede every partial estimate at the end of the turn.
+			if (result.usage) this.#emit(turn, { type: "usage", usage: result.usage });
 			const mapped = mapStopReason(result.stopReason);
 			this.#settle(turn, {
 				conversationId: turn.sessionId,
 				status: mapped.status,
 				response: turn.response.text,
+				usage: result.usage,
 				error: mapped.error,
 				finished: true,
 				aborted: mapped.aborted,
@@ -376,42 +381,49 @@ export class AcpDriver implements TurnDriver {
 				if (emit) {
 					turn.textDeltas += 1;
 					turn.textTokens += estimateTokens(emit);
+					this.#emitLiveEstimate(turn);
 					this.#emit(turn, { type: "text", delta: emit });
 				}
 				return;
 			}
 			case "thought": {
+				if (!mapped.delta) return;
 				turn.thoughtDeltas += 1;
 				turn.thoughtTokens += estimateTokens(mapped.delta);
+				this.#emitLiveEstimate(turn);
 				this.#emit(turn, { type: "thought", delta: mapped.delta });
 				return;
 			}
 			case "tool_start": {
-				const entry = { name: mapped.name, args: mapped.args, diff: mapped.diff };
+				const entry = { name: mapped.name, args: mapped.args, diff: mapped.diff, mcpServer: mapped.mcpServer };
 				turn.toolCalls.set(mapped.toolCallId, entry);
-				turn.lastNativeTool = { ...entry };
-				this.#emit(turn, { type: "tool_start", name: mapped.name, args: mapped.args });
+				this.#emit(turn, { type: "tool_start", name: mapped.name, args: mapped.args, mcpServer: mapped.mcpServer });
 				return;
 			}
 			case "tool_done": {
 				let entry = turn.toolCalls.get(mapped.toolCallId);
-				if (!entry && turn.lastNativeTool) {
-					// Unknown id with a recent native tool: adopt it (supersede).
-					entry = { ...turn.lastNativeTool };
-					turn.toolCalls.set(mapped.toolCallId, entry);
-					turn.lastNativeTool = undefined;
+				if (!entry && turn.toolCalls.size === 1) {
+					// The server can finish an approved tool under a different id.
+					// Adopt only when exactly one call is pending: with concurrent
+					// tools, guessing would attach an edit diff to the wrong file.
+					// Residual: an unrelated done with an unknown id still pairs
+					// with the pending entry; strictly better than guessing ANY id.
+					entry = turn.toolCalls.values().next().value;
+					turn.toolCalls.clear();
 				}
+				turn.toolCalls.delete(mapped.toolCallId);
 				const name = entry?.name ?? "tool";
 				const args = entry?.args ?? {};
 				// Native diff from the stored tool_call frame; the update's own
 				// diff (future builds) wins when present.
-				this.#emit(turn, { type: "tool_done", name, args, output: mapped.output, diff: mapped.diff ?? entry?.diff });
+				this.#emit(turn, { type: "tool_done", name, args, output: mapped.output, diff: mapped.diff ?? entry?.diff, mcpServer: mapped.mcpServer ?? entry?.mcpServer });
 				return;
 			}
 			case "tool_error": {
 				const entry = turn.toolCalls.get(mapped.toolCallId);
+				turn.toolCalls.delete(mapped.toolCallId);
 				const name = entry?.name ?? "tool";
-				this.#emit(turn, { type: "tool_error", name, message: mapped.message });
+				this.#emit(turn, { type: "tool_error", name, message: mapped.message, mcpServer: mapped.mcpServer ?? entry?.mcpServer });
 				return;
 			}
 			case "replay_user":
@@ -567,6 +579,7 @@ export class AcpDriver implements TurnDriver {
 			thoughtTokens: 0,
 			textDeltas: 0,
 			thoughtDeltas: 0,
+			estimatedInputTokens: estimateTokens(request.contextBlock?.text ? `${request.prompt}\n${request.contextBlock.text}` : request.prompt),
 			sawResult: false,
 		promptStarted: false,
 			aborted: false,
@@ -717,16 +730,26 @@ export class AcpDriver implements TurnDriver {
 		return (typeof opt === "function" ? opt() : opt) ?? "estimate";
 	}
 
+	/** Update Pi's partial usage before the next visible text/thought delta.
+	 *  This is not provider-reported billing or an exact context-window count. */
+	#emitLiveEstimate(turn: ActiveTurn): void {
+		const usage = this.#syntheticUsage(turn);
+		if (usage) this.#emit(turn, { type: "usage", usage });
+	}
+
 	#syntheticUsage(turn: ActiveTurn): AgyUsage | undefined {
 		const mode = this.#usageMode();
 		if (mode === "off") return undefined;
-		// Gate B latch: any server frame with usage/token keys means real
-		// usage exists upstream; estimates must never shadow it.
-		if (this.#conn?.usageSeen) return undefined;
+		// Superseded only by EXACT PromptResponse.usage. Diagnostic usage-shaped
+		// frames (context windows, occupancy) must not silence the estimates:
+		// the connection outlives turns and no exact data ever replaces them
+		// on ACP 1.1.1 (peer review 2026-09-23).
+		if (this.#conn?.exactUsageSeen) return undefined;
 		return synthesizeUsage({
 			mode,
 			prompt: turn.request.prompt,
 			contextText: turn.request.contextBlock?.text,
+			inputTokens: turn.estimatedInputTokens,
 			textTokens: turn.textTokens,
 			thoughtTokens: turn.thoughtTokens,
 			textDeltas: turn.textDeltas,

package/src/acp/events.ts

@@ -30,9 +30,9 @@ export interface AcpEditDiff {
 export type MappedUpdate =
 	| { kind: "text"; delta: string }
 	| { kind: "thought"; delta: string }
-	| { kind: "tool_start"; toolCallId: string; name: string; args: Record<string, unknown>; diff?: AcpEditDiff }
-	| { kind: "tool_done"; toolCallId: string; output?: string; diff?: AcpEditDiff }
-	| { kind: "tool_error"; toolCallId: string; message: string }
+	| { kind: "tool_start"; toolCallId: string; name: string; args: Record<string, unknown>; diff?: AcpEditDiff; mcpServer?: string }
+	| { kind: "tool_done"; toolCallId: string; output?: string; diff?: AcpEditDiff; mcpServer?: string }
+	| { kind: "tool_error"; toolCallId: string; message: string; mcpServer?: string }
 	| { kind: "replay_user" }
 	| null;
 
@@ -56,6 +56,7 @@ export function mapUpdate(update: unknown): MappedUpdate {
 				toolCallId: id,
 				name: metaToolName(u._meta) ?? toolName(u.title, u.kind),
 				args: rawArguments(u.rawInput),
+				mcpServer: stringField(recordField(recordField(u._meta).mcp).server),
 				// Edits carry their native diff HERE, on the pending tool_call
 				// frame (run 6:10) — the completed update carries only display
 				// text. contentDiff on the update stays as a future-build
@@ -74,17 +75,20 @@ export function mapUpdate(update: unknown): MappedUpdate {
 				// failure next to a successful edit.
 				const raw = stringField(u.rawOutput);
 				if (raw?.includes("approved but never executed")) return null;
-				return { kind: "tool_error", toolCallId: id, message: raw ?? "tool failed" };
+				const mcpServer = stringField(recordField(recordField(u._meta).mcp).server);
+				return { kind: "tool_error", toolCallId: id, message: raw ?? "tool failed", ...(mcpServer ? { mcpServer } : {}) };
 			}
 			if (u.status === "completed") {
 				// content[] first (edits carry their diff there); rawOutput alone is
 				// often just the server's display title, not the result (probe
 				// 2026-09-03: completed MCP call, rawOutput "Call bridge_echo").
 				const diff = contentDiff(u.content);
+				const mcpServer = stringField(recordField(recordField(u._meta).mcp).server);
 				return {
 					kind: "tool_done",
 					toolCallId: id,
 					output: contentText(u.content) ?? stringField(u.rawOutput),
+					...(mcpServer ? { mcpServer } : {}),
 					...(diff ? { diff } : {}),
 				};
 			}

package/src/acp/usage-estimate.ts

@@ -22,6 +22,8 @@ export interface UsageEstimateInput {
 	mode: UsageEstimate;
 	/** Full outgoing prompt text (input side; always regex-estimated). */
 	prompt: string;
+	/** Cached estimate for repeated live updates during the same turn. */
+	inputTokens?: number;
 	/** ACP embeddedContext resource text (G1 digest): also reaches the model. */
 	contextText?: string;
 	/** Per-delta token sums (mode "estimate"). Summing per delta, like
@@ -38,7 +40,7 @@ export interface UsageEstimateInput {
  *  reporting (mode off, or a turn with no prompt and no output). */
 export function synthesizeUsage(input: UsageEstimateInput): AgyUsage | undefined {
 	if (input.mode === "off") return undefined;
-	const inputTokens = estimateTokens(
+	const inputTokens = input.inputTokens ?? estimateTokens(
 		input.contextText ? `${input.prompt}\n${input.contextText}` : input.prompt,
 	);
 	const thoughtTokens =

package/src/ask-tool.ts

@@ -25,6 +25,7 @@ import {
 	snapshotConversations,
 } from "./discovery.js";
 import { loadConfig, type AgyMode, type ThinkingTier } from "./config.js";
+import { redactText } from "./redact.js";
 import { acquireBridgeSuppression } from "./mcp-registration.js";
 import { AGY_EFFORT_ORDER, spawnAgyModelsRaw, toAgyEffort } from "./models.js";
 
@@ -742,8 +743,10 @@ export async function registerAskAntigravityTool(
 				}
 
 				if (outcome.exitCode !== 0) {
-					const note = details.stderr.trim()
-						? `agy exited with status ${outcome.exitCode}: ${details.stderr.trim()}`
+					// stderr can carry auth material; the note is chat-visible.
+					const stderr = redactText(details.stderr.trim());
+					const note = stderr
+						? `agy exited with status ${outcome.exitCode}: ${stderr}`
 						: `agy exited with status ${outcome.exitCode}`;
 					return {
 						content: [{ type: "text", text: text ? `${text}\n\n[${note}]` : note }],

package/src/bridge-catalog.ts

@@ -0,0 +1,29 @@
+import type { BridgeTools } from "./config.js";
+
+export interface BridgeToolInfo {
+	name: string;
+	description?: string;
+	parameters?: object;
+	sourceInfo?: { source?: string };
+}
+
+/** The bridge has one live HTTP endpoint. Catalog and dispatch must both use
+ * the CURRENT Pi active set: /mcp and pi.setActiveTools() can change it mid-session.
+ * A stale tools/call must not bypass a disabled Pi tool. */
+export function bridgedPiTools(
+	all: BridgeToolInfo[], active: readonly string[], mode: BridgeTools, hidden: ReadonlySet<string>,
+): BridgeToolInfo[] {
+	if (mode === "none") return [];
+	const enabled = new Set(active);
+	return all.filter((tool) =>
+		enabled.has(tool.name) && !hidden.has(tool.name) &&
+		// Never bridge the bridge's own tools. agy has native web tools, so
+		// our quota-burning one-shot wrappers must not tempt it through MCP.
+		tool.name !== "AskAntigravity" && tool.name !== "antigravity" &&
+		tool.name !== "agy_web_search" && tool.name !== "agy_read_url" &&
+		tool.name !== "bridge_poll_result" && tool.name !== "activate_skill" &&
+		(mode === "mcp"
+			? /pi-mcp-adapter/.test(tool.sourceInfo?.source ?? "")
+			: tool.sourceInfo?.source !== "builtin"),
+	);
+}

package/src/config.ts

@@ -107,6 +107,11 @@ export interface AgyConfig {
 	 *  and models (no delegation tool in the model's window context).
 	 *  Takes effect at pi start (or /reload). */
 	askTool: boolean;
+	/** Register the agy_web_search + agy_read_url Pi tools. Default OFF:
+	 *  inside Antigravity sessions the model already has native web tools;
+	 *  these exist for NON-Antigravity provider sessions and every call
+	 *  spends Antigravity quota. Takes effect at pi start (or /reload). */
+	webTools: boolean;
 	/** Set after the one-time notice about a leftover legacy invokeTool patch
 	 *  on the installed pi. The notice never repeats; /agy patch-cleanup is
 	 *  always available. */
@@ -175,6 +180,7 @@ const DEFAULTS: AgyConfig = {
 	defaultModel: "flash",
 	defaultThinking: "medium",
 	askTool: true,
+	webTools: false,
 	bridgeTools: "all",
 	digest: false,
 	systemPrompt: true,
@@ -257,6 +263,10 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 		? ["1", "true", "on"].includes(process.env.AGY_ASK_TOOL.toLowerCase())
 		: file.askTool ?? DEFAULTS.askTool;
 
+	const webTools = process.env.AGY_WEB_TOOLS !== undefined
+		? ["1", "true", "on"].includes(process.env.AGY_WEB_TOOLS.toLowerCase())
+		: file.webTools ?? DEFAULTS.webTools;
+
 	const bridgeRaw = (process.env.AGY_BRIDGE_TOOLS ?? file.bridgeTools ?? DEFAULTS.bridgeTools).toLowerCase();
 	const bridgeTools: BridgeTools =
 		bridgeRaw === "none" || bridgeRaw === "all" || bridgeRaw === "mcp"
@@ -319,6 +329,7 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 		defaultModel,
 		defaultThinking,
 		askTool,
+		webTools,
 		bridgeTools,
 		digest,
 		systemPrompt,

package/src/daily-log.ts

@@ -12,7 +12,9 @@
 //   - One appendFile per record: O_APPEND keeps single-line writes atomic,
 //     so two pi tabs sharing the dir stay line-consistent.
 //   - No secrets, no prompt content: values of secret-shaped keys are
-//     redacted and long strings are truncated before they reach disk.
+//     redacted wholesale, secret-shaped material inside string values
+//     (stderr tails, error messages) is scrubbed, and long strings are
+//     truncated before they reach disk.
 //   - Retention: files older than `retentionDays` are pruned once per
 //     process, so the dir cannot grow unbounded.
 //   - Volume tiers: default installs write ONLY errors — routine logging
@@ -22,6 +24,7 @@
 
 import { appendFile, mkdir, readdir, unlink } from "node:fs/promises";
 import path from "node:path";
+import { redactText } from "./redact.js";
 
 export type LogLevel = "debug" | "info" | "warn" | "error";
 
@@ -63,14 +66,24 @@ const MAX_RECORD = 4000;
 // lives in `value`, which a name-only regex would miss.
 const SECRET_KEY = /token|secret|password|passphrase|authorization|api[-_]?key|cookie|headers/i;
 
-/** Redact secret-shaped values and cap runaway strings before disk. */
+/** Redact secret-shaped keys wholesale, scrub secrets embedded in string
+ *  values, and cap runaway strings before disk. */
 function scrub(value: unknown, depth: number): unknown {
 	if (value === null || value === undefined) return value;
 	if (value instanceof Error) {
-		return { name: value.name, message: value.message, stack: scrub(value.stack, depth) };
+		// message goes through the string branch: errors are the main carrier of
+		// subprocess stderr text (the exact leak class this scrubber exists for).
+		return {
+			name: value.name,
+			message: scrub(value.message, depth),
+			stack: scrub(value.stack, depth),
+		};
 	}
 	if (typeof value === "string") {
-		return value.length > MAX_STRING ? value.slice(0, MAX_STRING) + "…(truncated)" : value;
+		// Value scan first, truncate second: a cut token could lose the tail
+		// characters the pattern needs to match.
+		const clean = redactText(value);
+		return clean.length > MAX_STRING ? clean.slice(0, MAX_STRING) + "…(truncated)" : clean;
 	}
 	if (typeof value === "number" || typeof value === "boolean") return value;
 	if (depth >= MAX_DEPTH) return "(depth limit)";

package/src/driver-types.ts

@@ -55,12 +55,13 @@ export type DriverActivity =
 	/** Stream-json emits a token count only; ACP carries the actual thought text in
 	 *  `delta`. The provider renders whichever is present. */
 	| { type: "thought"; tokens?: number; delta?: string }
-	| { type: "tool_start"; stepId?: number; name: string; args: Record<string, unknown> }
+	| { type: "tool_start"; stepId?: number; name: string; args: Record<string, unknown>; mcpServer?: string }
 	| {
 			type: "tool_done";
 			stepId?: number;
 			name: string;
 			args: Record<string, unknown>;
+			mcpServer?: string;
 			output?: string;
 			durationSeconds?: number;
 			/** ACP only: the server's native edit diff from `tool_call`
@@ -68,7 +69,7 @@ export type DriverActivity =
 			 *  sets it; the provider renders it without any git subprocess. */
 			diff?: { path: string; oldText?: string; newText: string };
 	  }
-	| { type: "tool_error"; stepId?: number; name: string; message: string }
+	| { type: "tool_error"; stepId?: number; name: string; message: string; mcpServer?: string }
 	| { type: "usage"; usage: AgyUsage }
 	/** Synthetic: injected by the provider when the MCP bridge receives a call
 	 *  (G9). Parks the turn: output is expected to stall while pi executes the

package/src/driver.ts

@@ -19,6 +19,7 @@ import { randomUUID } from "node:crypto";
 import { parseAgyLine } from "./stream-events.js";
 import { bridgeMcpConfigDir, bridgeMcpConfigExists } from "./mcp-server.js";
 import { gateHooksStaged } from "./approval-hook.js";
+import { redactText } from "./redact.js";
 import type {
 	AgyUsage,
 	DriverActivity,
@@ -403,7 +404,9 @@ export class StreamDriver implements TurnDriver {
 				} else {
 					this.#failTurn(
 						turn,
-						this.#stderrTail.trim() || `agy exited with status ${code ?? "signal"}`,
+						// agy stderr can carry auth material; the tail becomes the
+						// user-facing error and a daily-log value.
+						redactText(this.#stderrTail.trim()) || `agy exited with status ${code ?? "signal"}`,
 					);
 				}
 			}

package/src/provider.ts

@@ -314,6 +314,16 @@ export interface BlockState {
 	started: boolean;
 }
 
+export interface NativeDisplayEvent {
+	name: string;
+	mcpServer?: string;
+	status: "started" | "completed" | "failed";
+	path?: string;
+	command?: string;
+	output?: string;
+	diff?: string;
+}
+
 export interface StreamSimpleDeps {
 	entries: AgyModelEntry[];
 	store: SessionStore;
@@ -336,6 +346,9 @@ export interface StreamSimpleDeps {
 	 *  read decides (tests); production wiring always passes it so a
 	 *  mid-session config flip cannot move one side of a parked turn. */
 	engine?: "stream-json" | "acp";
+	/** Output-only ACP tool events; persisted as TUI entries, never sent to
+	 *  Antigravity or dispatched through Pi's executable tools. */
+	onNativeEvent?: (event: NativeDisplayEvent) => void;
 	/** Daily file log sink (src/daily-log.ts). Records pre-dispatch turn
 	 *  errors that never create a driver turn (and so never reach onTurnEnd). */
 	log?: (event: string, data?: unknown, level?: "debug" | "info" | "warn" | "error") => void;
@@ -902,6 +915,7 @@ export interface DriverDeps {
 	roundTrips: ToolRoundTrips;
 	replay?: WrapperReplay;
 	nativeActive?: (name: string) => boolean;
+	onNativeEvent?: (event: NativeDisplayEvent) => void;
 	/** Active engine (config), for engine-scoped session keys. */
 	engine: "stream-json" | "acp";
 	/** Daily file log sink for pre-dispatch errors (see StreamSimpleDeps). */
@@ -915,6 +929,7 @@ export interface ActivityFeatures {
 	nativeActive?: (name: string) => boolean;
 	roundTrips?: ToolRoundTrips;
 	engine?: "stream-json" | "acp";
+	onNativeEvent?: (event: NativeDisplayEvent) => void;
 }
 
 /** Process-wide counter: round-trip ids must never repeat across turns in
@@ -976,7 +991,13 @@ export function consumeActivity(
 			toPiUsage(activity.usage, partial.usage);
 			return "continue";
 		case "tool_start":
-			// Rendering happens on completion (output/diff available).
+			// Transient status while Antigravity executes; no Pi tool call or
+			// model-facing result is produced. Persist a card only on completion.
+			if (feats.engine === "acp" && feats.onNativeEvent) {
+				try {
+					feats.onNativeEvent({ name: activity.name, mcpServer: activity.mcpServer, status: "started" });
+				} catch { /* UI failure must not fail the generation. */ }
+			}
 			return "continue";
 /** File-path argument of an ACP edit tool (observed: `file_path`); other
  *  tool kinds (execute, read) don't carry one. Returns undefined for
@@ -998,27 +1019,33 @@ function acpEditFileArg(args: Record<string, unknown>): string | undefined {
 			//      output the stream-json engine produces, one readFileSync.
 			if (feats.engine === "acp") {
 				const d = activity.diff;
-				if (d) {
-					appendThinking(stream, blocks, `[agy edit: ${path.basename(d.path)}]\n`);
-					const diffText = formatInlineDiff(d.oldText ?? "", d.newText);
-					if (diffText) appendThinking(stream, blocks, `${diffText}\n`);
-					return "continue";
-				}
 				const editFile = ACP_EDIT_TOOLS.has(activity.name) ? acpEditFileArg(activity.args) : undefined;
-				if (editFile) {
-					const absFile = path.isAbsolute(editFile) ? editFile : path.resolve(cwd, editFile);
-					appendThinking(stream, blocks, `[agy edit: ${path.basename(absFile)}]\n`);
+				const file = d?.path ?? (editFile ? (path.isAbsolute(editFile) ? editFile : path.resolve(cwd, editFile)) : undefined);
+				let diffText = d ? formatInlineDiff(d.oldText ?? "", d.newText) : undefined;
+				if (!d && file) {
 					let disk = "";
 					try {
-						disk = fs.readFileSync(absFile, "utf8");
+						disk = fs.readFileSync(file, "utf8");
 					} catch {
 						/* deleted or unreadable: diffEdit degrades to a summary */
 					}
-					const outcome = diffCtx.diffEdit(absFile, disk);
-					if (outcome.text) appendThinking(stream, blocks, `${outcome.text}\n`);
-					return "continue";
+					diffText = diffCtx.diffEdit(file, disk).text;
+				}
+				const command = ["CommandLine", "command_line", "command"].map((k) => activity.args[k]).find((v): v is string => typeof v === "string" && v.length > 0);
+				let displayed = false;
+				try {
+					if (feats.onNativeEvent) {
+						feats.onNativeEvent({ name: activity.name, mcpServer: activity.mcpServer, status: "completed", path: file, command, output: activity.output, diff: diffText });
+						displayed = true;
+					}
+				} catch { /* A stale renderer must never fail the model turn. */ }
+				if (displayed) return "continue";
+				if (file) {
+					appendThinking(stream, blocks, `[agy edit: ${path.basename(file)}]\n`);
+					if (diffText) appendThinking(stream, blocks, `${diffText}\n`);
+				} else {
+					appendThinking(stream, blocks, `[agy tool: ${activity.name}]\n`);
 				}
-				appendThinking(stream, blocks, `[agy tool: ${activity.name}]\n`);
 				return "continue";
 			}
 			// G8 (stream-json): agy file edits surface a git-sourced diff in a
@@ -1066,6 +1093,12 @@ function acpEditFileArg(args: Record<string, unknown>): string | undefined {
 			}
 		}
 		case "tool_error":
+			if (feats.engine === "acp" && feats.onNativeEvent) {
+				try {
+					feats.onNativeEvent({ name: activity.name, mcpServer: activity.mcpServer, status: "failed", output: activity.message });
+					return "continue";
+				} catch { /* Fall back to a thinking label. */ }
+			}
 			appendThinking(stream, blocks, `[agy tool: ${activity.name} failed: ${activity.message}]\n`);
 			return "continue";
 		case "bridge_call": {
@@ -1227,6 +1260,7 @@ async function runTurnDriver(
 		nativeActive: deps.nativeActive,
 		roundTrips: deps.roundTrips,
 		engine: deps.engine,
+		onNativeEvent: deps.onNativeEvent,
 	};
 
 	for (;;) {
@@ -1293,6 +1327,7 @@ export function createStreamSimple(
 				roundTrips,
 				replay: deps.replay,
 				nativeActive: deps.nativeActive,
+				onNativeEvent: deps.onNativeEvent,
 				// Record the engine of the driver that will ACTUALLY run: if the
 				// ACP driver is absent, the config switch falls back to stream,
 				// and keying the session as @acp would store a stream