@estebanforge/pi-antigravity-bridge 1.7.0 → 1.7.2

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.7.2] - 2026-09-24
+
+### Added
+
+- **ACP permission requests park on a human decision.** `session/request_permission` was answered silently in-process (skip turns auto-allowed, everything else auto-denied), making ACP turns all-or-nothing with no per-tool human say. Interactive turns now hold the JSON-RPC request open and surface the server's options as a pi select dialog under the dialog lock, with the turn budget paused while the human decides: 480 s park, deny on timeout/esc/throw/connection death, and a cancel instead of an answer when the server offers no reject option (a deny must never degrade into picking an allow). `skipPermissions` keeps the synchronous auto-allow; `approvals.mode allow` maps to it, deny and headless stay fail-closed. `allow_always`/`reject_always` answers are remembered per connection for identical later requests, and first settle wins: a late dialog answer after a timeout is forgotten. Nine new tests pin the behavior, including a scenario proving a late answer writes nothing. 1217 tests, tsc clean.
+
+### Changed
+
+- **Removed the dead `acp.permissions` config key.** It documented the in-connection auto policy but never had a consumer. Configs carrying it keep loading (unknown `acp` keys are ignored) and it drops out of the file on the next save.
+
+## [1.7.1] - 2026-09-23
+
+### Fixed
+
+- **Subprocess stderr can no longer leak secrets into logs or the chat.** The `agy` CLI can print auth material (API keys, OAuth tokens, credential headers) to stderr, and six surfaces carried that text verbatim: the daily support log users attach to bug reports, the stream-json turn-failure error, the ACP connection-exit rejection reasons and `/agy doctor` tail, the web tools' failure note, and the AskAntigravity delegation exit note. A key in an auth error therefore landed on disk and in the transcript unchanged. Redaction now runs on the reassembled stderr tail at exit and getter boundaries - never per chunk - so a token split across two pipe events still matches, and the raw tail stays internal. New `redactText()` scrubs four secret-shaped pattern classes (API-key prefixes, OAuth tokens, credential headers, token-ish JSON fields), anchored with a word boundary so ordinary text like `desk-123456789012` survives, and carries no length cap because callers already bound their own output sizes. The daily log scrubber additionally scans string values, not just secret-shaped keys, and routes `Error.message` through the same pass; values are scanned before truncation so a cut token cannot lose the characters a pattern needs. Best-effort by design: a last line against leak paths, not a sandbox. Ten new tests pin the behavior, two of them spawning real processes (a secret-bearing crash and a token split across stderr chunks). 1200 tests, tsc clean.
+
 ## [1.7.0] - 2026-09-23
 
 ### Added

package/extensions/index.ts

@@ -298,6 +298,23 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		// a restart. Without this the driver defaults to "estimate" and the
 		// config knob (incl. "off") is dead.
 		usageEstimate: () => loadConfig().acp.usageEstimate,
+		// ACP request_permission parity with the approval gate: skipPermissions
+		// turns auto-allow in the driver; approvals.mode allow short-circuits
+		// to the same synchronous allow; everything else opens a dialog (esc
+		// and headless deny fail-closed) under the shared dialog lock.
+		permissionPolicy: () => (loadConfig().approvals.mode === "allow" ? "auto" : "deny"),
+		onPermissionRequest: async (req) => {
+			const ui = activeUi;
+			if (loadConfig().approvals.mode === "deny" || !ui) return undefined;
+			return await withDialogLock(async () => {
+				const labels = req.options.map((o) => o.name ?? o.kind ?? o.optionId ?? "?");
+				const title = req.toolCall?.title ? `agy requests: ${req.toolCall.title}` : "agy requests permission";
+				const picked = await ui.select(title, labels);
+				if (picked === undefined) return undefined;
+				const idx = labels.indexOf(picked);
+				return idx >= 0 ? (req.options[idx]?.optionId ?? undefined) : undefined;
+			});
+		},
 		...(authCapture ? { extraEnv: authCapture.browserEnv, authUrlFile: authCapture.file } : {}),
 		log: acpLog,
 		mcpServers: () => {
@@ -1218,7 +1235,7 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				if (rest.length > 0) {
 					// Only the keyword compares case-insensitively; the path keeps its case.
 					const bin = rest.toLowerCase() === "auto" ? "" : rest.replace(/^~(?=\/|$)/, os.homedir());
-					// Spread, not a bare acp patch: a bare {bin, permissions} object
+					// Spread, not a bare acp patch: a bare {bin} object
 					// would drop sibling keys (usageEstimate) from the file.
 					saveConfig({ acp: { ...loadConfig().acp, bin } });
 					ui?.notify(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/connection.ts

@@ -11,9 +11,10 @@
 //     the effort tier baked in, e.g. gemini-3.8-flash-low)
 //   - session/cancel returns -32601 on RC01 (not implemented) — the driver
 //     treats that as "cancel unsupported" and falls back to teardown+kill
-//   - session/request_permission is answered in-connection: policy per turn
-//     (skipPermissions on -> first allow option; off -> first reject option,
-//     fail-closed)
+//   - session/request_permission: skipPermissions turns answer the first
+//     allow option synchronously; otherwise a wired human handler PARKS the
+//     request (the JSON-RPC reply waits for the decision), and everything
+//     else fail-closes to the first reject option
 //   - session/load replays history as notifications BEFORE its response; the
 //     driver suppresses updates while the load is in flight
 //   - mcpServers entries: {name, type:"http", url, headers:[]} — headers is a
@@ -26,6 +27,7 @@ import path from "node:path";
 import { parseAuthPort, readLastUrl } from "./browser-capture.js";
 import { frameCarriesUsage } from "./events.js";
 import type { AgyUsage } from "../driver-types.js";
+import { redactText } from "../redact.js";
 import { JsonRpcResponseError, JsonRpcSession } from "./jsonrpc.js";
 
 export interface AcpMcpServer {
@@ -64,9 +66,17 @@ export interface AcpConnectionOptions {
 	 *  the same param). Evaluated lazily per call. */
 	mcpServers?: () => AcpMcpServer[];
 	/** Permission policy for session/request_permission, evaluated per request:
-	 *  "auto" selects the first allow option; "deny" fail-closes to the first
-	 *  reject option. Absent = deny (fail closed). */
+	 *  "auto" selects the first allow option; "deny" consults the human
+	 *  handler (parking) or fail-closes to the first reject option. Absent =
+	 *  deny (fail closed). */
 	permissions?: () => "auto" | "deny";
+	/** Human gate for "deny"-policy turns. The request is PARKED: the JSON-RPC
+	 *  reply waits until the handler settles. The returned optionId is
+	 *  validated against the server's options; undefined/null deny. Absent =
+	 *  synchronous deny (fail closed). */
+	onPermissionRequest?: AcpPermissionHandler;
+	/** Park budget for one permission dialog. Tests shrink it. */
+	permissionParkMs?: number;
 	/** Record file for BROWSER-captured OAuth URLs (src/acp/browser-capture.ts).
 	 *  The server hands the login URL only to the browser-open call, so the
 	 *  wrapper records it there; the connection watches the file and logs
@@ -77,6 +87,30 @@ export interface AcpConnectionOptions {
 const INIT_TIMEOUT_MS = 30_000;
 const SESSION_OP_TIMEOUT_MS = 20_000;
 
+/** Human-decision budget for one parked permission request. Mirrors the
+ *  approval-gate park budget (APPROVAL_PARK_TIMEOUT_MS): the dialog must
+ *  deny by itself, never hold the agy prompt open forever. */
+const PERMISSION_PARK_MS = 480_000;
+
+/** One session/request_permission option block (the subset we consume). */
+export interface AcpPermissionOption {
+	optionId?: string;
+	kind?: string;
+	name?: string;
+}
+
+/** Payload handed to the permission handler when the server asks for a human
+ *  decision. Options are server-defined data; the handler returns the chosen
+ *  optionId, or undefined/null to deny. */
+export interface AcpPermissionRequest {
+	sessionId?: string;
+	options: AcpPermissionOption[];
+	toolCall?: { toolCallId?: string; kind?: string; title?: string };
+}
+
+export type AcpPermissionHandler = (req: AcpPermissionRequest) => Promise<string | null | undefined>;
+
+
 export class AcpConnection {
 	#opts: AcpConnectionOptions;
 	#child: ChildProcess | undefined;
@@ -96,6 +130,13 @@ export class AcpConnection {
 	lastConfigOptions: unknown = undefined;
 	#authUrlWatcher: fs.FSWatcher | undefined;
 	#lastAuthUrl: string | null = null;
+	/** Parked permission dialogs: each entry settles its own request with a
+	 *  deny. #finish drains the set so a dying connection never leaves the
+	 *  server's request hanging. */
+	#permissionPending = new Set<() => void>();
+	/** allow_always / reject_always answers, keyed by toolCall kind|title for
+	 *  the life of this connection: identical requests skip the dialog. */
+	#permissionMemory = new Map<string, string>();
 
 	constructor(opts: AcpConnectionOptions) {
 		this.#opts = opts;
@@ -110,7 +151,9 @@ export class AcpConnection {
 	}
 
 	get stderrTail(): string {
-		return this.#stderrTail;
+		// Redacted at the boundary: the raw tail stays internal, every consumer
+		// (doctor display, driver exit logs, failure messages) sees redacted text.
+		return redactText(this.#stderrTail);
 	}
 
 	/** Gate B watch: latched true once any session/update frame carried
@@ -152,8 +195,8 @@ export class AcpConnection {
 		// try/catch in #write cannot see them. Without this listener an EPIPE
 		// (server died mid-handshake) is uncaught and kills pi.
 		child.stdin?.on("error", (err) => {
-			this.#opts.log("stdin-error", { message: err.message });
-			if (!this.#exited && !this.#killed) this.#finish(err.message);
+			this.#opts.log("stdin-error", { message: redactText(err.message) });
+			if (!this.#exited && !this.#killed) this.#finish(redactText(err.message));
 		});
 
 		const rpc = new JsonRpcSession({
@@ -161,6 +204,24 @@ export class AcpConnection {
 			onRequest: (method, params) => this.#onServerRequest(method, params),
 			onNotification: (method, params) => this.#onNotification(method, params),
 			onParseError: (line) => this.#opts.log("parse-error", { line }),
+			onOverflow: (detail) => {
+				// The session already aborted its pending requests with the typed
+				// reason; finish so later events are ignored, then take the whole
+				// process GROUP down: a flooder is broken or hostile, and the
+				// binary may be a wrapper script with live descendants.
+				this.#opts.log("frame-overflow", { detail });
+				this.#finish(`stdout frame overflow: ${detail}`);
+				const child = this.#child;
+				try {
+					if (child?.pid && process.platform !== "win32") {
+						process.kill(-child.pid, "SIGKILL");
+					} else {
+						child?.kill("SIGKILL");
+					}
+				} catch {
+					/* already gone */
+				}
+			},
 		});
 		this.#rpc = rpc;
 
@@ -169,12 +230,14 @@ export class AcpConnection {
 			this.#stderrTail = (this.#stderrTail + chunk).slice(-8192);
 		});
 		child.on("error", (err) => {
-			this.#opts.log("spawn-error", { message: err.message });
-			this.#finish(err.message);
+			this.#opts.log("spawn-error", { message: redactText(err.message) });
+			this.#finish(redactText(err.message));
 		});
 		child.on("exit", (code, signal) => {
 			this.#opts.log("exit", { code: code ?? signal ?? "?" });
-			this.#finish(this.#stderrTail.trim());
+			// The reason rides into pending-request rejections, so it must be
+			// redacted here (server stderr can carry auth material).
+			this.#finish(redactText(this.#stderrTail.trim()));
 		});
 
 		const result = (await this.request(
@@ -302,21 +365,12 @@ export class AcpConnection {
 		await this.guarded("session/close", { sessionId }, SESSION_OP_TIMEOUT_MS);
 	}
 
-	/** Protocol-level permission answering: policy from the driver ("auto"
-	 *  selects the first allow option; "deny" fail-closes to the first reject
-	 *  option). Never hangs: options are data from the server and the answer
-	 *  is computed synchronously. */
+	/** Protocol-level permission answering: policy "auto" selects the first
+	 *  allow option synchronously; "deny" consults the parked human handler
+	 *  (#answerPermission) or fail-closes. See there for the full matrix. */
 	#onServerRequest(method: string, params: unknown): Promise<unknown> {
 		if (method === "session/request_permission") {
-			const options = (
-				typeof params === "object" && params !== null ? (params as Record<string, unknown>).options : undefined
-			) as Array<{ optionId?: string; kind?: string }> | undefined;
-			const allow = options?.find((o) => typeof o.kind === "string" && o.kind.startsWith("allow"));
-			const deny = options?.find((o) => typeof o.kind === "string" && o.kind.startsWith("reject"));
-			const policy = this.#opts.permissions?.() ?? "deny";
-			const chosen = policy === "auto" ? (allow ?? deny ?? options?.[0]) : (deny ?? options?.[0]);
-			this.#opts.log("permission", { optionId: chosen?.optionId, policy });
-			return Promise.resolve({ outcome: { outcome: "selected", optionId: chosen?.optionId } });
+			return this.#answerPermission(params as AcpPermissionRequest);
 		}
 		// fs/* and terminal/* are declined: our client capabilities are off and
 		// agy keeps executing its own tools (plan §8 capability posture).
@@ -324,6 +378,86 @@ export class AcpConnection {
 		return Promise.reject(new Error(`client capability not enabled: ${method}`));
 	}
 
+	/** Answer session/request_permission. "auto" (skipPermissions turns)
+	 *  selects the first allow option synchronously. Otherwise a wired handler
+	 *  parks the request — the reply waits for the human — while every other
+	 *  path fail-closes synchronously: no handler, esc, throw, timeout,
+	 *  connection death. A chosen *_always option is remembered per connection
+	 *  for identical later requests (same toolCall kind+title). */
+	#answerPermission(params: AcpPermissionRequest): Promise<unknown> {
+		const options = Array.isArray(params?.options) ? params.options : [];
+		const allow = options.find((o) => typeof o.kind === "string" && o.kind.startsWith("allow"));
+	const denyId = options.find((o) => typeof o.kind === "string" && o.kind.startsWith("reject"))?.optionId;
+		const policy = this.#opts.permissions?.() ?? "deny";
+		if (policy === "auto") {
+			const chosen = (allow ?? options[0])?.optionId;
+			this.#opts.log("permission", { optionId: chosen, policy });
+			return Promise.resolve({ outcome: { outcome: "selected", optionId: chosen } });
+		}
+		const handler = this.#opts.onPermissionRequest;
+		if (!handler) {
+			this.#opts.log("permission", { optionId: denyId, policy });
+			return Promise.resolve(
+				denyId !== undefined
+					? { outcome: { outcome: "selected", optionId: denyId } }
+					: { outcome: { outcome: "cancelled" } },
+			);
+		}
+		// Always-memory needs a stable identity: the title. Without one, every
+		// untitled call would collapse onto one key and inherit its answer.
+		const memKey = params?.toolCall?.title ? `${params.toolCall.kind ?? ""}|${params.toolCall.title}` : undefined;
+		const remembered = memKey !== undefined ? this.#permissionMemory.get(memKey) : undefined;
+		if (remembered !== undefined && options.some((o) => o.optionId === remembered)) {
+			this.#opts.log("permission", { optionId: remembered, policy: "memory" });
+			return Promise.resolve({ outcome: { outcome: "selected", optionId: remembered } });
+		}
+		const parkMs = this.#opts.permissionParkMs ?? PERMISSION_PARK_MS;
+		return new Promise((resolve) => {
+			let timer: NodeJS.Timeout | undefined;
+			// First settle wins: a late dialog answer after a timeout/deny must
+			// not re-log or record an always-memory from a dead request.
+			let settled = false;
+			const settle = (optionId: string | undefined, why: string): void => {
+				if (settled) return;
+				settled = true;
+				if (timer) clearTimeout(timer);
+				this.#permissionPending.delete(settleDeny);
+				this.#opts.log("permission", { optionId, policy: why });
+				// undefined optionId (no reject option on the table) cancels
+				// instead of selecting nothing.
+				resolve(
+					optionId !== undefined
+						? { outcome: { outcome: "selected", optionId } }
+						: { outcome: { outcome: "cancelled" } },
+				);
+			};
+			const settleDeny = (): void => settle(denyId, "dialog-deny");
+			timer = setTimeout(() => {
+				this.#opts.log("permission-timeout", { parkMs });
+				settleDeny();
+			}, parkMs);
+			this.#permissionPending.add(settleDeny);
+			Promise.resolve()
+				.then(() => handler(params))
+				.then((picked) => {
+					if (settled) return;
+					const chosen = picked != null ? options.find((o) => o.optionId === picked) : undefined;
+					if (!chosen?.optionId) {
+						settle(denyId, "dialog-deny");
+						return;
+					}
+					if (chosen.kind === "allow_always" || chosen.kind === "reject_always") {
+						if (memKey !== undefined) this.#permissionMemory.set(memKey, chosen.optionId);
+					}
+					settle(chosen.optionId, "dialog");
+				})
+				.catch((err: unknown) => {
+					this.#opts.log("permission-error", { message: err instanceof Error ? err.message : String(err) });
+					settle(denyId, "dialog-error");
+				});
+		});
+	}
+
 	#onNotification(method: string, params: unknown): void {
 		if (method === "session/update") {
 			// Latched before the suppression gate: history-replay frames are the
@@ -443,8 +577,13 @@ export class AcpConnection {
 		this.#exited = true;
 		this.#authUrlWatcher?.close();
 		this.#authUrlWatcher = undefined;
+		// Pending permission dialogs must not outlive the connection: deny them
+		// so their replies race the teardown instead of hanging the server.
+		const pendings = [...this.#permissionPending];
+		this.#permissionPending.clear();
+		for (const deny of pendings) deny();
 		this.abortAll(`connection exited: ${reason || "process gone"}`);
-		this.#opts.onExit({ code: null, signal: null, stderrTail: this.#stderrTail });
+		this.#opts.onExit({ code: null, signal: null, stderrTail: redactText(this.#stderrTail) });
 	}
 }
 

package/src/acp/driver.ts

@@ -15,12 +15,16 @@
 //     probed once per connection; when upstream ships it, abort goes graceful
 //   - overall-timer pause uses remaining-budget semantics on G9 parks (never a
 //     fresh cap); every park carries its own timeout (BRIDGE_TIMEOUT_MS)
-//   - single `auto` permission policy: request_permission answered
-//     in-connection (plan §9.3); no provider involvement
+//   - request_permission: skipPermissions turns answer the first allow option
+//     synchronously; otherwise an optional human handler (extension dialog)
+//     PARKS the request with the turn budget paused; no handler = deny
+//     fail-closed. Approvals-mode parity: a permissionPolicy override maps
+//     approvals.mode allow to the same synchronous auto path
 
 import { randomUUID } from "node:crypto";
 import type { UsageEstimate } from "../config.js";
-import { AcpConnection, resolveAcpBinary, type AcpMcpServer } from "./connection.js";
+import { AcpConnection, resolveAcpBinary, type AcpMcpServer, type AcpPermissionRequest } from "./connection.js";
+import type { AcpPermissionHandler } from "./connection.js";
 import { mapStopReason, mapUpdate, TextAccumulator, type AcpEditDiff } from "./events.js";
 import { estimateTokens, synthesizeUsage } from "./usage-estimate.js";
 import type {
@@ -53,6 +57,16 @@ export interface AcpDriverOptions {
 	 *  none. A function is resolved per turn (follows live config, like bin).
 	 *  Default "estimate". */
 	usageEstimate?: UsageEstimate | (() => UsageEstimate);
+	/** Human gate for ACP request_permission on non-skip turns. Forwarded to
+	 *  the connection; the driver parks the turn budget around each call
+	 *  (dialog time does not eat the deadline). */
+	onPermissionRequest?: AcpPermissionHandler;
+	/** Park budget for one permission dialog (tests shrink it). */
+	permissionParkMs?: number;
+	/** Standing policy consulted when the turn is not skipPermissions:
+	 *  "auto" answers the first allow option synchronously, "deny" consults
+	 *  the human handler or fail-closes. Default deny. */
+	permissionPolicy?: () => "auto" | "deny";
 	log?: (msg: string, data?: unknown) => void;
 }
 
@@ -166,6 +180,33 @@ export class AcpDriver implements TurnDriver {
 		this.#emit(t, activity);
 	}
 
+	/** Run the human permission dialog with the turn parked: same budget
+	 *  semantics as bridge parks (dialog time does not consume the deadline).
+	 *  The finally unparks the CAPTURED turn, never whatever is active at
+	 *  exit: the turn can close mid-dialog (abort, server death) and a new
+	 *  turn must not inherit this park's accounting. */
+	async #parkForPermission(req: AcpPermissionRequest): Promise<string | null | undefined> {
+		const t = this.#active;
+		const parked = t !== undefined && !t.closed;
+		if (parked) {
+			t.parks += 1;
+			this.#clearIdle(t);
+			this.#pauseOverall(t);
+		}
+		try {
+			return await this.#opts.onPermissionRequest!(req);
+		} finally {
+			if (parked && !t.closed && t.parks > 0) {
+				t.parks -= 1;
+				if (t.parks === 0) {
+					this.#armIdle(t);
+					this.#resumeOverall(t);
+					this.#log("unparked");
+				}
+			}
+		}
+	}
+
 	kickIdle(): void {
 		const t = this.#active;
 		if (!t || t.closed) return;
@@ -476,8 +517,17 @@ export class AcpDriver implements TurnDriver {
 			cwd: request.cwd,
 			mcpServers: this.#opts.mcpServers,
 			log: (msg, data) => this.#log(msg, data),
-			// Fail-closed permissions: only turns with skipPermissions answer allow.
-			permissions: () => (this.#active?.request.skipPermissions ? "auto" : "deny"),
+			// Fail-closed permissions: skipPermissions answers allow; a standing
+			// policy override (approvals.mode allow) may widen that; everything
+			// else goes to the human handler or denies.
+			permissions: () =>
+				this.#active?.request.skipPermissions
+					? "auto"
+					: (this.#opts.permissionPolicy?.() ?? "deny"),
+			onPermissionRequest: this.#opts.onPermissionRequest
+				? (req) => this.#parkForPermission(req)
+				: undefined,
+			permissionParkMs: this.#opts.permissionParkMs,
 			onUpdate: (sessionId, update) => this.#onConnectionUpdate(sessionId, update),
 			onExit: (info) => this.#onConnectionExit(conn, info),
 		});

package/src/acp/jsonrpc.ts

@@ -16,6 +16,8 @@
 //   - `abortAll()` rejects every pending request (Gate D teardown: no promise
 //     survives a killed connection).
 
+import { isKnownNoiseLine, MAX_FRAME_BYTES, stripGluedNoise } from "../frame-guard.js";
+
 export interface JsonRpcErrorShape {
 	code: number;
 	message: string;
@@ -41,6 +43,9 @@ export interface JsonRpcSessionOptions {
 	onNotification?: (method: string, params: unknown) => void;
 	/** Unparseable line (logged, never fatal). */
 	onParseError?: (line: string) => void;
+	/** Frame-cap breach: the peer flooded stdout with no newline. The session
+	 *  aborts itself; the transport must kill the process. */
+	onOverflow?: (detail: string) => void;
 	/** Default timeout for requests without an explicit one (ms). 0 = none. */
 	defaultTimeoutMs?: number;
 }
@@ -58,6 +63,7 @@ export class JsonRpcSession {
 	#pending = new Map<number, Pending>();
 	#nextId = 1;
 	#aborted = false;
+	#overflowed = false;
 	#lineBuf = "";
 	parseErrors = 0;
 
@@ -68,26 +74,62 @@ export class JsonRpcSession {
 
 	/** Feed raw transport bytes. Stdio chunks are NOT newline-aligned: bytes
 	 *  are buffered and only complete lines are parsed (a frame split across a
-	 *  64KB pipe boundary must never be dropped). */
+	 *  64KB pipe boundary must never be dropped). The buffer is capped: a peer
+	 *  flooding stdout with no newline breaches the cap and the session dies
+	 *  (onOverflow + abortAll), it never grows without bound. */
 	feed(chunk: string): void {
+		if (this.#overflowed) return;
 		this.#lineBuf += chunk;
+		if (this.#lineBuf.length > MAX_FRAME_BYTES) {
+			const detail = `${this.#lineBuf.length} bytes buffered with no newline (cap ${MAX_FRAME_BYTES})`;
+			this.#overflow(detail);
+			return;
+		}
 		const lines = this.#lineBuf.split("\n");
 		this.#lineBuf = lines.pop() ?? "";
 		for (const raw of lines) {
 			const line = raw.trim();
 			if (!line) continue;
+			// Known foreign noise (e.g. the Chromium launcher behind a browser
+			// login) is dropped before parsing, not counted as a parse error.
+			if (isKnownNoiseLine(line)) continue;
 			let msg: JsonRpcIncoming;
 			try {
 				msg = JSON.parse(line) as JsonRpcIncoming;
 			} catch {
-				this.parseErrors += 1;
-				this.#opts.onParseError?.(line.slice(0, 200));
-				continue;
+				// A noise FRAGMENT without its newline glued itself onto the next
+				// real frame; strip everything up to the marker and re-parse.
+				const repaired = stripGluedNoise(line);
+				if (repaired) {
+					try {
+						msg = JSON.parse(repaired) as JsonRpcIncoming;
+					} catch {
+						this.parseErrors += 1;
+						this.#opts.onParseError?.(line.slice(0, 200));
+						continue;
+					}
+				} else {
+					// Malformed lines are counted and dropped, never fatal (the
+					// parseAgyLine lesson: a chatty banner must not kill the reader
+					// loop).
+					this.parseErrors += 1;
+					this.#opts.onParseError?.(line.slice(0, 200));
+					continue;
+				}
 			}
 			this.#handleMessage(msg);
 		}
 	}
 
+	#overflow(detail: string): void {
+		this.#overflowed = true;
+		this.#lineBuf = "";
+		// Aborting first gives pending requests the typed overflow reason; the
+		// transport's own teardown afterwards is a no-op on the empty map.
+		this.abortAll(`stdout frame overflow: ${detail}`);
+		this.#opts.onOverflow?.(detail);
+	}
+
 	#handleMessage(msg: JsonRpcIncoming): void {
 		// Response to one of our requests.
 		if (msg.method === undefined && msg.id !== undefined && msg.id !== null) {

package/src/ask-tool.ts

@@ -25,6 +25,7 @@ import {
 	snapshotConversations,
 } from "./discovery.js";
 import { loadConfig, type AgyMode, type ThinkingTier } from "./config.js";
+import { redactText } from "./redact.js";
 import { acquireBridgeSuppression } from "./mcp-registration.js";
 import { AGY_EFFORT_ORDER, spawnAgyModelsRaw, toAgyEffort } from "./models.js";
 
@@ -742,8 +743,10 @@ export async function registerAskAntigravityTool(
 				}
 
 				if (outcome.exitCode !== 0) {
-					const note = details.stderr.trim()
-						? `agy exited with status ${outcome.exitCode}: ${details.stderr.trim()}`
+					// stderr can carry auth material; the note is chat-visible.
+					const stderr = redactText(details.stderr.trim());
+					const note = stderr
+						? `agy exited with status ${outcome.exitCode}: ${stderr}`
 						: `agy exited with status ${outcome.exitCode}`;
 					return {
 						content: [{ type: "text", text: text ? `${text}\n\n[${note}]` : note }],

package/src/config.ts

@@ -76,10 +76,6 @@ export interface GateConfig {
 export interface AcpConfig {
 	/** Path to agy_acp_server.par. Empty = env AGY_ACP_BIN > PATH. */
 	bin: string;
-	/** Single policy today: auto-approve request_permission in-connection
-	 *  (parity with skipPermissions). Kept as a key so future policies do not
-	 *  change the config shape. */
-	permissions: "auto";
 	/** Gate B stopgap: client-side token estimates for ACP turns so pi's
 	 *  usage surfaces show nonzero numbers. Estimates are labeled as such in
 	 *  /agy doctor and auto-disable when the server sends real usage. */
@@ -187,7 +183,7 @@ const DEFAULTS: AgyConfig = {
 	turnTimeoutMin: 0, // placeholder: the real default is resolved per loadConfig call (defaultTurnTimeoutMin)
 	inactivityTimeoutMin: 5,
 	approvals: { gateMode: "auto", mode: "ask" },
-	acp: { bin: "", permissions: "auto", usageEstimate: "estimate" },
+	acp: { bin: "", usageEstimate: "estimate" },
 };
 
 /** Hard ceiling for a free-typed turn cap: one day, in minutes. */
@@ -317,7 +313,6 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 		bin:
 			process.env.AGY_ACP_BIN ??
 			(typeof fileAcp.bin === "string" ? fileAcp.bin : DEFAULTS.acp.bin),
-		permissions: "auto",
 		usageEstimate,
 	};
 

package/src/daily-log.ts

@@ -12,7 +12,9 @@
 //   - One appendFile per record: O_APPEND keeps single-line writes atomic,
 //     so two pi tabs sharing the dir stay line-consistent.
 //   - No secrets, no prompt content: values of secret-shaped keys are
-//     redacted and long strings are truncated before they reach disk.
+//     redacted wholesale, secret-shaped material inside string values
+//     (stderr tails, error messages) is scrubbed, and long strings are
+//     truncated before they reach disk.
 //   - Retention: files older than `retentionDays` are pruned once per
 //     process, so the dir cannot grow unbounded.
 //   - Volume tiers: default installs write ONLY errors — routine logging
@@ -22,6 +24,7 @@
 
 import { appendFile, mkdir, readdir, unlink } from "node:fs/promises";
 import path from "node:path";
+import { redactText } from "./redact.js";
 
 export type LogLevel = "debug" | "info" | "warn" | "error";
 
@@ -63,14 +66,24 @@ const MAX_RECORD = 4000;
 // lives in `value`, which a name-only regex would miss.
 const SECRET_KEY = /token|secret|password|passphrase|authorization|api[-_]?key|cookie|headers/i;
 
-/** Redact secret-shaped values and cap runaway strings before disk. */
+/** Redact secret-shaped keys wholesale, scrub secrets embedded in string
+ *  values, and cap runaway strings before disk. */
 function scrub(value: unknown, depth: number): unknown {
 	if (value === null || value === undefined) return value;
 	if (value instanceof Error) {
-		return { name: value.name, message: value.message, stack: scrub(value.stack, depth) };
+		// message goes through the string branch: errors are the main carrier of
+		// subprocess stderr text (the exact leak class this scrubber exists for).
+		return {
+			name: value.name,
+			message: scrub(value.message, depth),
+			stack: scrub(value.stack, depth),
+		};
 	}
 	if (typeof value === "string") {
-		return value.length > MAX_STRING ? value.slice(0, MAX_STRING) + "…(truncated)" : value;
+		// Value scan first, truncate second: a cut token could lose the tail
+		// characters the pattern needs to match.
+		const clean = redactText(value);
+		return clean.length > MAX_STRING ? clean.slice(0, MAX_STRING) + "…(truncated)" : clean;
 	}
 	if (typeof value === "number" || typeof value === "boolean") return value;
 	if (depth >= MAX_DEPTH) return "(depth limit)";

package/src/driver.ts

@@ -17,8 +17,10 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { parseAgyLine } from "./stream-events.js";
+import { isKnownNoiseLine, MAX_FRAME_BYTES, stripGluedNoise } from "./frame-guard.js";
 import { bridgeMcpConfigDir, bridgeMcpConfigExists } from "./mcp-server.js";
 import { gateHooksStaged } from "./approval-hook.js";
+import { redactText } from "./redact.js";
 import type {
 	AgyUsage,
 	DriverActivity,
@@ -403,7 +405,9 @@ export class StreamDriver implements TurnDriver {
 				} else {
 					this.#failTurn(
 						turn,
-						this.#stderrTail.trim() || `agy exited with status ${code ?? "signal"}`,
+						// agy stderr can carry auth material; the tail becomes the
+						// user-facing error and a daily-log value.
+						redactText(this.#stderrTail.trim()) || `agy exited with status ${code ?? "signal"}`,
 					);
 				}
 			}
@@ -421,6 +425,18 @@ export class StreamDriver implements TurnDriver {
 		// Buffer the trailing partial line: a frame split across pipe chunks is
 		// reassembled when its newline arrives (mirrors JsonRpcSession.feed).
 		this.#stdoutBuf += chunk;
+		if (this.#stdoutBuf.length > MAX_FRAME_BYTES) {
+			// A no-newline flood over the cap means the peer is broken or
+			// hostile: fail the turn and tear the process tree down instead of
+			// growing memory without bound.
+			const detail = `${this.#stdoutBuf.length} bytes buffered with no newline (cap ${MAX_FRAME_BYTES})`;
+			this.#stdoutBuf = "";
+			const turn = this.#active;
+			this.#log("frame-overflow", { detail });
+			if (turn && !turn.closed) this.#failTurn(turn, `stdout frame overflow: ${detail}`);
+			this.#killChild();
+			return;
+		}
 		const lines = this.#stdoutBuf.split("\n");
 		this.#stdoutBuf = lines.pop() ?? "";
 		const turn = this.#active;
@@ -428,7 +444,19 @@ export class StreamDriver implements TurnDriver {
 		if (turn.idleTimer) turn.idleTimer.refresh();
 		for (const line of lines) {
 			if (!line.trim()) continue;
-			this.#applyParsed(turn, parseAgyLine(line));
+			// Known foreign noise (e.g. the Chromium launcher behind a browser
+			// login) is dropped; a noise FRAGMENT glued onto a real frame is
+			// stripped so the frame still parses.
+			if (isKnownNoiseLine(line)) continue;
+			let parsed = parseAgyLine(line);
+			// Repair applies only to true parse failures (raw is the string
+			// fragment): a valid JSON object agy sent with an unrecognized shape
+			// also lands as "unknown" and must reach the turn untouched.
+			if (parsed.kind === "unknown" && typeof parsed.raw === "string") {
+				const repaired = stripGluedNoise(line);
+				if (repaired) parsed = parseAgyLine(repaired);
+			}
+			this.#applyParsed(turn, parsed);
 			if (turn.closed) return;
 		}
 	}

package/src/frame-guard.ts

@@ -0,0 +1,38 @@
+// Frame-guard: shared stdout framing defense for both engines.
+//
+// agy's stdout is a protocol stream, but foreign processes occasionally write
+// into the same inherited pipe (the Chromium launcher behind a browser login
+// prints "Opening in existing browser session." straight into it). Two
+// defenses:
+//
+//   1. A hard per-frame ceiling: a line with no newline must never grow the
+//      reassembly buffer without bound. Breach = the peer is broken or
+//      hostile, the transport is dead.
+//   2. Known-noise handling: a complete noise line is dropped before parsing;
+//      a noise FRAGMENT without a trailing newline glues itself onto the next
+//      real frame, so repair strips everything up to and including the marker.
+
+/** Hard ceiling on one buffered (newline-terminated) frame. 32MB matches the
+ *  reference ACP transport; real frames are KBs, machine-generated output
+ *  with no newline for 32MB is a flood, not a frame. */
+export const MAX_FRAME_BYTES = 32 * 1024 * 1024;
+
+const NOISE_MARKERS = ["Opening in existing browser session."];
+
+/** True when a complete line is pure known noise: drop before parsing. */
+export function isKnownNoiseLine(line: string): boolean {
+	const trimmed = line.trim();
+	if (!trimmed) return false;
+	return NOISE_MARKERS.some((m) => trimmed === m);
+}
+
+/** Repair for the glue case: a noise fragment arrived without its newline and
+ *  the next real frame is now "noise + json". Returns the remainder after the
+ *  first known marker, or null when the line carries no marker. */
+export function stripGluedNoise(line: string): string | null {
+	for (const marker of NOISE_MARKERS) {
+		const idx = line.indexOf(marker);
+		if (idx >= 0) return line.slice(idx + marker.length).trim();
+	}
+	return null;
+}

package/src/redact.ts

@@ -0,0 +1,27 @@
+// Secret redaction for free text: stderr tails, error messages, log string
+// values. Patterns ported from pi-antigravity-acp-provider's errors.redact
+// (MIT). No length cap here on purpose: callers already bound their own
+// output sizes (8192 stderr tails, MAX_STRING truncation), and a cap inside
+// this function would silently shorten their output.
+
+const SECRET_PATTERNS: Array<[RegExp, string]> = [
+	// API-key prefixes: Google (AIza), OpenAI-style (sk-), npm, GitHub. The
+	// left word-boundary stops mid-word matches ("desk-123456789012").
+	[/\b(?:AIza|sk-|npm_|gh[opurs]_)[A-Za-z0-9_-]{12,}/gu, "<redacted>"],
+	// Google OAuth tokens (access ya29., refresh 1//).
+	[/\b(?:ya29\.|1\/\/)[A-Za-z0-9._~+/-]{12,}/gu, "<redacted>"],
+	// Credential header values; the key text stays (useful context).
+	[/((?:authorization|cookie|set-cookie)\s*[:=]\s*(?:bearer\s+)?)[^\s,;]+/giu, "$1<redacted>"],
+	// Token-ish JSON fields; the key stays.
+	[
+		/((?:["']?(?:access_token|refresh_token|id_token|client_secret|api[-_]?key)["']?)\s*[:=]\s*["']?)[^"'\s,;&}]+/giu,
+		"$1<redacted>",
+	],
+];
+
+/** Replace secret-shaped material with `<redacted>`, preserving structure. */
+export function redactText(text: string): string {
+	let out = text;
+	for (const [pattern, replacement] of SECRET_PATTERNS) out = out.replace(pattern, replacement);
+	return out;
+}

package/src/web-tools.ts

@@ -21,6 +21,7 @@ import { mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync }
 import os from "node:os";
 import path from "node:path";
 import { Type } from "typebox";
+import { redactText } from "./redact.js";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export const WEB_AGENT_PREFIX = "pi-bridge-web-";
@@ -119,7 +120,7 @@ export async function runWebAgent(opts: WebRunOptions): Promise<WebRunResult> {
 	const agentName = `${WEB_AGENT_PREFIX}${process.pid}-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
 	const agentDir = path.join(root, agentName);
 	mkdirSync(agentDir, { recursive: true, mode: 0o700 });
-	// commandExecutionPolicy stays at the fork-validated "auto": the template's
+	// commandExecutionPolicy stays at the live-validated "auto": the template's
 	// tools list has no command tool and plan mode blocks edits; an unvalidated
 	// stricter enum risks agent discovery failing outright.
 	writeFileSync(
@@ -178,7 +179,7 @@ export async function runWebAgent(opts: WebRunOptions): Promise<WebRunResult> {
 			child.once("close", resolve);
 		});
 		if (!failed && opts.signal?.aborted) failed = "web run aborted";
-		if (!failed && code !== 0) failed = `agy exited with code ${code}${stderrTail ? `: ${stderrTail.trim().slice(-300)}` : ""}`;
+		if (!failed && code !== 0) failed = `agy exited with code ${code}${stderrTail ? `: ${redactText(stderrTail.trim()).slice(-300)}` : ""}`;
 		if (!failed && !allowedToolUsed) failed = `Antigravity returned an answer without an observed ${opts.gatedTool} step; refusing it as unverified`;
 		if (!failed && response === "") failed = "Antigravity web run produced no answer";
 		if (failed) {