@estebanforge/pi-antigravity-bridge 1.7.1 → 1.7.3

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.7.3] - 2026-09-24
+
+### Fixed
+
+- **Collapsed ACP tool cards no longer repeat the tool name.** The `agy-native-event` renderer filled the muted detail slot with the tool name itself whenever an event carried neither a path nor a recognized command argument, so `ls` and `exec_command` collapsed to "✓ ls ls" / "✓ exec_command exec_command". The detail now prefers the path basename, then the command's first line, then agy's own display text (the first line of the completed call's output, e.g. "Run make test in wicket-cli-atlas"), and stays empty when none exists; the name always stands alone. ACP tool_call frames carry no per-tool reasoning, so agy's display text is the closest honest signal.
+
+## [1.7.2] - 2026-09-24
+
+### Added
+
+- **ACP permission requests park on a human decision.** `session/request_permission` was answered silently in-process (skip turns auto-allowed, everything else auto-denied), making ACP turns all-or-nothing with no per-tool human say. Interactive turns now hold the JSON-RPC request open and surface the server's options as a pi select dialog under the dialog lock, with the turn budget paused while the human decides: 480 s park, deny on timeout/esc/throw/connection death, and a cancel instead of an answer when the server offers no reject option (a deny must never degrade into picking an allow). `skipPermissions` keeps the synchronous auto-allow; `approvals.mode allow` maps to it, deny and headless stay fail-closed. `allow_always`/`reject_always` answers are remembered per connection for identical later requests, and first settle wins: a late dialog answer after a timeout is forgotten. Nine new tests pin the behavior, including a scenario proving a late answer writes nothing. tsc clean.
+
+### Changed
+
+- **Removed the dead `acp.permissions` config key.** It documented the in-connection auto policy but never had a consumer. Configs carrying it keep loading (unknown `acp` keys are ignored) and it drops out of the file on the next save.
+
 ## [1.7.1] - 2026-09-23
 
 ### Fixed

package/README.md

@@ -73,7 +73,7 @@ cards for read-only steps.
 
 ## Approval gate (agy native tools)
 
-agy runs its own agent loop with native tools (`run_command`, `create_file`, `edit_file`, ...), which pi's permission extensions never saw. The optional approval gate routes those calls through a pi-side approval: a staged PreToolUse hook parks the call, the provider surfaces it as a shadow `bash`/`write`/`edit` toolUse, and your permission extension (or the built-in ask/allow/deny fallback) decides before agy executes it. Off by default (`approvals.gateMode: auto` enables it only when a pi permission extension is detected); denials fail closed; read-only agy tools stay ungated.
+agy runs its own agent loop with native tools (`run_command`, `create_file`, `edit_file`, ...), which pi's permission extensions never saw. The optional approval gate routes those calls through a pi-side approval: a staged PreToolUse hook parks the call, the provider surfaces it as a shadow `bash`/`write`/`edit` toolUse, and your permission extension (or the built-in ask/allow/deny fallback) decides before agy executes it. Off by default (`approvals.gateMode: auto` enables it only when a pi permission extension is detected); denials fail closed; read-only agy tools stay ungated. On ACP turns the server has its own per-tool permission ask: when one fires (`skipPermissions` off), the request parks on a real pi dialog instead of a silent deny, and allow-always choices are remembered per connection.
 
 Full mechanics, configuration, and a sample gate extension: [docs/APPROVAL-GATE.md](docs/APPROVAL-GATE.md).
 

package/extensions/index.ts

@@ -298,6 +298,23 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		// a restart. Without this the driver defaults to "estimate" and the
 		// config knob (incl. "off") is dead.
 		usageEstimate: () => loadConfig().acp.usageEstimate,
+		// ACP request_permission parity with the approval gate: skipPermissions
+		// turns auto-allow in the driver; approvals.mode allow short-circuits
+		// to the same synchronous allow; everything else opens a dialog (esc
+		// and headless deny fail-closed) under the shared dialog lock.
+		permissionPolicy: () => (loadConfig().approvals.mode === "allow" ? "auto" : "deny"),
+		onPermissionRequest: async (req) => {
+			const ui = activeUi;
+			if (loadConfig().approvals.mode === "deny" || !ui) return undefined;
+			return await withDialogLock(async () => {
+				const labels = req.options.map((o) => o.name ?? o.kind ?? o.optionId ?? "?");
+				const title = req.toolCall?.title ? `agy requests: ${req.toolCall.title}` : "agy requests permission";
+				const picked = await ui.select(title, labels);
+				if (picked === undefined) return undefined;
+				const idx = labels.indexOf(picked);
+				return idx >= 0 ? (req.options[idx]?.optionId ?? undefined) : undefined;
+			});
+		},
 		...(authCapture ? { extraEnv: authCapture.browserEnv, authUrlFile: authCapture.file } : {}),
 		log: acpLog,
 		mcpServers: () => {
@@ -340,9 +357,13 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	if (engine === "acp") {
 		pi.registerEntryRenderer<NativeDisplayEvent>("agy-native-event", (entry, { expanded }, theme) => {
 			const event = entry.data;
-			const title = (event?.path ? path.basename(event.path) : event?.command?.split(/\r?\n/, 1)[0] ?? event?.name ?? "tool").slice(0, 160);
+			// Collapsed detail: most-specific signal wins (path, command, agy's own
+			// display text). The name is NOT a fallback here - it rendered "ls ls"
+			// duplication whenever the event carried neither path nor command.
+			const firstLine = (value: string | undefined): string | undefined => value?.split(/\r?\n/, 1)[0].trim() || undefined;
+			const detail = event?.path ? path.basename(event.path) : firstLine(event?.command) ?? firstLine(event?.output);
 			const status = event?.status === "failed" ? theme.fg("error", "✗") : theme.fg("success", "✓");
-			const lines = [`${status} ${theme.fg("toolTitle", event?.name ?? "Antigravity")} ${theme.fg("muted", title)}`];
+			const lines = [`${status} ${theme.fg("toolTitle", event?.name ?? "Antigravity")}${detail ? ` ${theme.fg("muted", detail.slice(0, 160))}` : ""}`];
 			if (expanded) {
 				if (event?.path) lines.push(theme.fg("dim", event.path));
 				if (event?.diff) {
@@ -1218,7 +1239,7 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				if (rest.length > 0) {
 					// Only the keyword compares case-insensitively; the path keeps its case.
 					const bin = rest.toLowerCase() === "auto" ? "" : rest.replace(/^~(?=\/|$)/, os.homedir());
-					// Spread, not a bare acp patch: a bare {bin, permissions} object
+					// Spread, not a bare acp patch: a bare {bin} object
 					// would drop sibling keys (usageEstimate) from the file.
 					saveConfig({ acp: { ...loadConfig().acp, bin } });
 					ui?.notify(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/connection.ts

@@ -11,9 +11,10 @@
 //     the effort tier baked in, e.g. gemini-3.8-flash-low)
 //   - session/cancel returns -32601 on RC01 (not implemented) — the driver
 //     treats that as "cancel unsupported" and falls back to teardown+kill
-//   - session/request_permission is answered in-connection: policy per turn
-//     (skipPermissions on -> first allow option; off -> first reject option,
-//     fail-closed)
+//   - session/request_permission: skipPermissions turns answer the first
+//     allow option synchronously; otherwise a wired human handler PARKS the
+//     request (the JSON-RPC reply waits for the decision), and everything
+//     else fail-closes to the first reject option
 //   - session/load replays history as notifications BEFORE its response; the
 //     driver suppresses updates while the load is in flight
 //   - mcpServers entries: {name, type:"http", url, headers:[]} — headers is a
@@ -65,9 +66,17 @@ export interface AcpConnectionOptions {
 	 *  the same param). Evaluated lazily per call. */
 	mcpServers?: () => AcpMcpServer[];
 	/** Permission policy for session/request_permission, evaluated per request:
-	 *  "auto" selects the first allow option; "deny" fail-closes to the first
-	 *  reject option. Absent = deny (fail closed). */
+	 *  "auto" selects the first allow option; "deny" consults the human
+	 *  handler (parking) or fail-closes to the first reject option. Absent =
+	 *  deny (fail closed). */
 	permissions?: () => "auto" | "deny";
+	/** Human gate for "deny"-policy turns. The request is PARKED: the JSON-RPC
+	 *  reply waits until the handler settles. The returned optionId is
+	 *  validated against the server's options; undefined/null deny. Absent =
+	 *  synchronous deny (fail closed). */
+	onPermissionRequest?: AcpPermissionHandler;
+	/** Park budget for one permission dialog. Tests shrink it. */
+	permissionParkMs?: number;
 	/** Record file for BROWSER-captured OAuth URLs (src/acp/browser-capture.ts).
 	 *  The server hands the login URL only to the browser-open call, so the
 	 *  wrapper records it there; the connection watches the file and logs
@@ -78,6 +87,30 @@ export interface AcpConnectionOptions {
 const INIT_TIMEOUT_MS = 30_000;
 const SESSION_OP_TIMEOUT_MS = 20_000;
 
+/** Human-decision budget for one parked permission request. Mirrors the
+ *  approval-gate park budget (APPROVAL_PARK_TIMEOUT_MS): the dialog must
+ *  deny by itself, never hold the agy prompt open forever. */
+const PERMISSION_PARK_MS = 480_000;
+
+/** One session/request_permission option block (the subset we consume). */
+export interface AcpPermissionOption {
+	optionId?: string;
+	kind?: string;
+	name?: string;
+}
+
+/** Payload handed to the permission handler when the server asks for a human
+ *  decision. Options are server-defined data; the handler returns the chosen
+ *  optionId, or undefined/null to deny. */
+export interface AcpPermissionRequest {
+	sessionId?: string;
+	options: AcpPermissionOption[];
+	toolCall?: { toolCallId?: string; kind?: string; title?: string };
+}
+
+export type AcpPermissionHandler = (req: AcpPermissionRequest) => Promise<string | null | undefined>;
+
+
 export class AcpConnection {
 	#opts: AcpConnectionOptions;
 	#child: ChildProcess | undefined;
@@ -97,6 +130,13 @@ export class AcpConnection {
 	lastConfigOptions: unknown = undefined;
 	#authUrlWatcher: fs.FSWatcher | undefined;
 	#lastAuthUrl: string | null = null;
+	/** Parked permission dialogs: each entry settles its own request with a
+	 *  deny. #finish drains the set so a dying connection never leaves the
+	 *  server's request hanging. */
+	#permissionPending = new Set<() => void>();
+	/** allow_always / reject_always answers, keyed by toolCall kind|title for
+	 *  the life of this connection: identical requests skip the dialog. */
+	#permissionMemory = new Map<string, string>();
 
 	constructor(opts: AcpConnectionOptions) {
 		this.#opts = opts;
@@ -164,6 +204,24 @@ export class AcpConnection {
 			onRequest: (method, params) => this.#onServerRequest(method, params),
 			onNotification: (method, params) => this.#onNotification(method, params),
 			onParseError: (line) => this.#opts.log("parse-error", { line }),
+			onOverflow: (detail) => {
+				// The session already aborted its pending requests with the typed
+				// reason; finish so later events are ignored, then take the whole
+				// process GROUP down: a flooder is broken or hostile, and the
+				// binary may be a wrapper script with live descendants.
+				this.#opts.log("frame-overflow", { detail });
+				this.#finish(`stdout frame overflow: ${detail}`);
+				const child = this.#child;
+				try {
+					if (child?.pid && process.platform !== "win32") {
+						process.kill(-child.pid, "SIGKILL");
+					} else {
+						child?.kill("SIGKILL");
+					}
+				} catch {
+					/* already gone */
+				}
+			},
 		});
 		this.#rpc = rpc;
 
@@ -307,21 +365,12 @@ export class AcpConnection {
 		await this.guarded("session/close", { sessionId }, SESSION_OP_TIMEOUT_MS);
 	}
 
-	/** Protocol-level permission answering: policy from the driver ("auto"
-	 *  selects the first allow option; "deny" fail-closes to the first reject
-	 *  option). Never hangs: options are data from the server and the answer
-	 *  is computed synchronously. */
+	/** Protocol-level permission answering: policy "auto" selects the first
+	 *  allow option synchronously; "deny" consults the parked human handler
+	 *  (#answerPermission) or fail-closes. See there for the full matrix. */
 	#onServerRequest(method: string, params: unknown): Promise<unknown> {
 		if (method === "session/request_permission") {
-			const options = (
-				typeof params === "object" && params !== null ? (params as Record<string, unknown>).options : undefined
-			) as Array<{ optionId?: string; kind?: string }> | undefined;
-			const allow = options?.find((o) => typeof o.kind === "string" && o.kind.startsWith("allow"));
-			const deny = options?.find((o) => typeof o.kind === "string" && o.kind.startsWith("reject"));
-			const policy = this.#opts.permissions?.() ?? "deny";
-			const chosen = policy === "auto" ? (allow ?? deny ?? options?.[0]) : (deny ?? options?.[0]);
-			this.#opts.log("permission", { optionId: chosen?.optionId, policy });
-			return Promise.resolve({ outcome: { outcome: "selected", optionId: chosen?.optionId } });
+			return this.#answerPermission(params as AcpPermissionRequest);
 		}
 		// fs/* and terminal/* are declined: our client capabilities are off and
 		// agy keeps executing its own tools (plan §8 capability posture).
@@ -329,6 +378,86 @@ export class AcpConnection {
 		return Promise.reject(new Error(`client capability not enabled: ${method}`));
 	}
 
+	/** Answer session/request_permission. "auto" (skipPermissions turns)
+	 *  selects the first allow option synchronously. Otherwise a wired handler
+	 *  parks the request — the reply waits for the human — while every other
+	 *  path fail-closes synchronously: no handler, esc, throw, timeout,
+	 *  connection death. A chosen *_always option is remembered per connection
+	 *  for identical later requests (same toolCall kind+title). */
+	#answerPermission(params: AcpPermissionRequest): Promise<unknown> {
+		const options = Array.isArray(params?.options) ? params.options : [];
+		const allow = options.find((o) => typeof o.kind === "string" && o.kind.startsWith("allow"));
+	const denyId = options.find((o) => typeof o.kind === "string" && o.kind.startsWith("reject"))?.optionId;
+		const policy = this.#opts.permissions?.() ?? "deny";
+		if (policy === "auto") {
+			const chosen = (allow ?? options[0])?.optionId;
+			this.#opts.log("permission", { optionId: chosen, policy });
+			return Promise.resolve({ outcome: { outcome: "selected", optionId: chosen } });
+		}
+		const handler = this.#opts.onPermissionRequest;
+		if (!handler) {
+			this.#opts.log("permission", { optionId: denyId, policy });
+			return Promise.resolve(
+				denyId !== undefined
+					? { outcome: { outcome: "selected", optionId: denyId } }
+					: { outcome: { outcome: "cancelled" } },
+			);
+		}
+		// Always-memory needs a stable identity: the title. Without one, every
+		// untitled call would collapse onto one key and inherit its answer.
+		const memKey = params?.toolCall?.title ? `${params.toolCall.kind ?? ""}|${params.toolCall.title}` : undefined;
+		const remembered = memKey !== undefined ? this.#permissionMemory.get(memKey) : undefined;
+		if (remembered !== undefined && options.some((o) => o.optionId === remembered)) {
+			this.#opts.log("permission", { optionId: remembered, policy: "memory" });
+			return Promise.resolve({ outcome: { outcome: "selected", optionId: remembered } });
+		}
+		const parkMs = this.#opts.permissionParkMs ?? PERMISSION_PARK_MS;
+		return new Promise((resolve) => {
+			let timer: NodeJS.Timeout | undefined;
+			// First settle wins: a late dialog answer after a timeout/deny must
+			// not re-log or record an always-memory from a dead request.
+			let settled = false;
+			const settle = (optionId: string | undefined, why: string): void => {
+				if (settled) return;
+				settled = true;
+				if (timer) clearTimeout(timer);
+				this.#permissionPending.delete(settleDeny);
+				this.#opts.log("permission", { optionId, policy: why });
+				// undefined optionId (no reject option on the table) cancels
+				// instead of selecting nothing.
+				resolve(
+					optionId !== undefined
+						? { outcome: { outcome: "selected", optionId } }
+						: { outcome: { outcome: "cancelled" } },
+				);
+			};
+			const settleDeny = (): void => settle(denyId, "dialog-deny");
+			timer = setTimeout(() => {
+				this.#opts.log("permission-timeout", { parkMs });
+				settleDeny();
+			}, parkMs);
+			this.#permissionPending.add(settleDeny);
+			Promise.resolve()
+				.then(() => handler(params))
+				.then((picked) => {
+					if (settled) return;
+					const chosen = picked != null ? options.find((o) => o.optionId === picked) : undefined;
+					if (!chosen?.optionId) {
+						settle(denyId, "dialog-deny");
+						return;
+					}
+					if (chosen.kind === "allow_always" || chosen.kind === "reject_always") {
+						if (memKey !== undefined) this.#permissionMemory.set(memKey, chosen.optionId);
+					}
+					settle(chosen.optionId, "dialog");
+				})
+				.catch((err: unknown) => {
+					this.#opts.log("permission-error", { message: err instanceof Error ? err.message : String(err) });
+					settle(denyId, "dialog-error");
+				});
+		});
+	}
+
 	#onNotification(method: string, params: unknown): void {
 		if (method === "session/update") {
 			// Latched before the suppression gate: history-replay frames are the
@@ -448,6 +577,11 @@ export class AcpConnection {
 		this.#exited = true;
 		this.#authUrlWatcher?.close();
 		this.#authUrlWatcher = undefined;
+		// Pending permission dialogs must not outlive the connection: deny them
+		// so their replies race the teardown instead of hanging the server.
+		const pendings = [...this.#permissionPending];
+		this.#permissionPending.clear();
+		for (const deny of pendings) deny();
 		this.abortAll(`connection exited: ${reason || "process gone"}`);
 		this.#opts.onExit({ code: null, signal: null, stderrTail: redactText(this.#stderrTail) });
 	}

package/src/acp/driver.ts

@@ -15,12 +15,16 @@
 //     probed once per connection; when upstream ships it, abort goes graceful
 //   - overall-timer pause uses remaining-budget semantics on G9 parks (never a
 //     fresh cap); every park carries its own timeout (BRIDGE_TIMEOUT_MS)
-//   - single `auto` permission policy: request_permission answered
-//     in-connection (plan §9.3); no provider involvement
+//   - request_permission: skipPermissions turns answer the first allow option
+//     synchronously; otherwise an optional human handler (extension dialog)
+//     PARKS the request with the turn budget paused; no handler = deny
+//     fail-closed. Approvals-mode parity: a permissionPolicy override maps
+//     approvals.mode allow to the same synchronous auto path
 
 import { randomUUID } from "node:crypto";
 import type { UsageEstimate } from "../config.js";
-import { AcpConnection, resolveAcpBinary, type AcpMcpServer } from "./connection.js";
+import { AcpConnection, resolveAcpBinary, type AcpMcpServer, type AcpPermissionRequest } from "./connection.js";
+import type { AcpPermissionHandler } from "./connection.js";
 import { mapStopReason, mapUpdate, TextAccumulator, type AcpEditDiff } from "./events.js";
 import { estimateTokens, synthesizeUsage } from "./usage-estimate.js";
 import type {
@@ -53,6 +57,16 @@ export interface AcpDriverOptions {
 	 *  none. A function is resolved per turn (follows live config, like bin).
 	 *  Default "estimate". */
 	usageEstimate?: UsageEstimate | (() => UsageEstimate);
+	/** Human gate for ACP request_permission on non-skip turns. Forwarded to
+	 *  the connection; the driver parks the turn budget around each call
+	 *  (dialog time does not eat the deadline). */
+	onPermissionRequest?: AcpPermissionHandler;
+	/** Park budget for one permission dialog (tests shrink it). */
+	permissionParkMs?: number;
+	/** Standing policy consulted when the turn is not skipPermissions:
+	 *  "auto" answers the first allow option synchronously, "deny" consults
+	 *  the human handler or fail-closes. Default deny. */
+	permissionPolicy?: () => "auto" | "deny";
 	log?: (msg: string, data?: unknown) => void;
 }
 
@@ -166,6 +180,33 @@ export class AcpDriver implements TurnDriver {
 		this.#emit(t, activity);
 	}
 
+	/** Run the human permission dialog with the turn parked: same budget
+	 *  semantics as bridge parks (dialog time does not consume the deadline).
+	 *  The finally unparks the CAPTURED turn, never whatever is active at
+	 *  exit: the turn can close mid-dialog (abort, server death) and a new
+	 *  turn must not inherit this park's accounting. */
+	async #parkForPermission(req: AcpPermissionRequest): Promise<string | null | undefined> {
+		const t = this.#active;
+		const parked = t !== undefined && !t.closed;
+		if (parked) {
+			t.parks += 1;
+			this.#clearIdle(t);
+			this.#pauseOverall(t);
+		}
+		try {
+			return await this.#opts.onPermissionRequest!(req);
+		} finally {
+			if (parked && !t.closed && t.parks > 0) {
+				t.parks -= 1;
+				if (t.parks === 0) {
+					this.#armIdle(t);
+					this.#resumeOverall(t);
+					this.#log("unparked");
+				}
+			}
+		}
+	}
+
 	kickIdle(): void {
 		const t = this.#active;
 		if (!t || t.closed) return;
@@ -476,8 +517,17 @@ export class AcpDriver implements TurnDriver {
 			cwd: request.cwd,
 			mcpServers: this.#opts.mcpServers,
 			log: (msg, data) => this.#log(msg, data),
-			// Fail-closed permissions: only turns with skipPermissions answer allow.
-			permissions: () => (this.#active?.request.skipPermissions ? "auto" : "deny"),
+			// Fail-closed permissions: skipPermissions answers allow; a standing
+			// policy override (approvals.mode allow) may widen that; everything
+			// else goes to the human handler or denies.
+			permissions: () =>
+				this.#active?.request.skipPermissions
+					? "auto"
+					: (this.#opts.permissionPolicy?.() ?? "deny"),
+			onPermissionRequest: this.#opts.onPermissionRequest
+				? (req) => this.#parkForPermission(req)
+				: undefined,
+			permissionParkMs: this.#opts.permissionParkMs,
 			onUpdate: (sessionId, update) => this.#onConnectionUpdate(sessionId, update),
 			onExit: (info) => this.#onConnectionExit(conn, info),
 		});

package/src/acp/jsonrpc.ts

@@ -16,6 +16,8 @@
 //   - `abortAll()` rejects every pending request (Gate D teardown: no promise
 //     survives a killed connection).
 
+import { isKnownNoiseLine, MAX_FRAME_BYTES, stripGluedNoise } from "../frame-guard.js";
+
 export interface JsonRpcErrorShape {
 	code: number;
 	message: string;
@@ -41,6 +43,9 @@ export interface JsonRpcSessionOptions {
 	onNotification?: (method: string, params: unknown) => void;
 	/** Unparseable line (logged, never fatal). */
 	onParseError?: (line: string) => void;
+	/** Frame-cap breach: the peer flooded stdout with no newline. The session
+	 *  aborts itself; the transport must kill the process. */
+	onOverflow?: (detail: string) => void;
 	/** Default timeout for requests without an explicit one (ms). 0 = none. */
 	defaultTimeoutMs?: number;
 }
@@ -58,6 +63,7 @@ export class JsonRpcSession {
 	#pending = new Map<number, Pending>();
 	#nextId = 1;
 	#aborted = false;
+	#overflowed = false;
 	#lineBuf = "";
 	parseErrors = 0;
 
@@ -68,26 +74,62 @@ export class JsonRpcSession {
 
 	/** Feed raw transport bytes. Stdio chunks are NOT newline-aligned: bytes
 	 *  are buffered and only complete lines are parsed (a frame split across a
-	 *  64KB pipe boundary must never be dropped). */
+	 *  64KB pipe boundary must never be dropped). The buffer is capped: a peer
+	 *  flooding stdout with no newline breaches the cap and the session dies
+	 *  (onOverflow + abortAll), it never grows without bound. */
 	feed(chunk: string): void {
+		if (this.#overflowed) return;
 		this.#lineBuf += chunk;
+		if (this.#lineBuf.length > MAX_FRAME_BYTES) {
+			const detail = `${this.#lineBuf.length} bytes buffered with no newline (cap ${MAX_FRAME_BYTES})`;
+			this.#overflow(detail);
+			return;
+		}
 		const lines = this.#lineBuf.split("\n");
 		this.#lineBuf = lines.pop() ?? "";
 		for (const raw of lines) {
 			const line = raw.trim();
 			if (!line) continue;
+			// Known foreign noise (e.g. the Chromium launcher behind a browser
+			// login) is dropped before parsing, not counted as a parse error.
+			if (isKnownNoiseLine(line)) continue;
 			let msg: JsonRpcIncoming;
 			try {
 				msg = JSON.parse(line) as JsonRpcIncoming;
 			} catch {
-				this.parseErrors += 1;
-				this.#opts.onParseError?.(line.slice(0, 200));
-				continue;
+				// A noise FRAGMENT without its newline glued itself onto the next
+				// real frame; strip everything up to the marker and re-parse.
+				const repaired = stripGluedNoise(line);
+				if (repaired) {
+					try {
+						msg = JSON.parse(repaired) as JsonRpcIncoming;
+					} catch {
+						this.parseErrors += 1;
+						this.#opts.onParseError?.(line.slice(0, 200));
+						continue;
+					}
+				} else {
+					// Malformed lines are counted and dropped, never fatal (the
+					// parseAgyLine lesson: a chatty banner must not kill the reader
+					// loop).
+					this.parseErrors += 1;
+					this.#opts.onParseError?.(line.slice(0, 200));
+					continue;
+				}
 			}
 			this.#handleMessage(msg);
 		}
 	}
 
+	#overflow(detail: string): void {
+		this.#overflowed = true;
+		this.#lineBuf = "";
+		// Aborting first gives pending requests the typed overflow reason; the
+		// transport's own teardown afterwards is a no-op on the empty map.
+		this.abortAll(`stdout frame overflow: ${detail}`);
+		this.#opts.onOverflow?.(detail);
+	}
+
 	#handleMessage(msg: JsonRpcIncoming): void {
 		// Response to one of our requests.
 		if (msg.method === undefined && msg.id !== undefined && msg.id !== null) {

package/src/config.ts

@@ -76,10 +76,6 @@ export interface GateConfig {
 export interface AcpConfig {
 	/** Path to agy_acp_server.par. Empty = env AGY_ACP_BIN > PATH. */
 	bin: string;
-	/** Single policy today: auto-approve request_permission in-connection
-	 *  (parity with skipPermissions). Kept as a key so future policies do not
-	 *  change the config shape. */
-	permissions: "auto";
 	/** Gate B stopgap: client-side token estimates for ACP turns so pi's
 	 *  usage surfaces show nonzero numbers. Estimates are labeled as such in
 	 *  /agy doctor and auto-disable when the server sends real usage. */
@@ -187,7 +183,7 @@ const DEFAULTS: AgyConfig = {
 	turnTimeoutMin: 0, // placeholder: the real default is resolved per loadConfig call (defaultTurnTimeoutMin)
 	inactivityTimeoutMin: 5,
 	approvals: { gateMode: "auto", mode: "ask" },
-	acp: { bin: "", permissions: "auto", usageEstimate: "estimate" },
+	acp: { bin: "", usageEstimate: "estimate" },
 };
 
 /** Hard ceiling for a free-typed turn cap: one day, in minutes. */
@@ -317,7 +313,6 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 		bin:
 			process.env.AGY_ACP_BIN ??
 			(typeof fileAcp.bin === "string" ? fileAcp.bin : DEFAULTS.acp.bin),
-		permissions: "auto",
 		usageEstimate,
 	};
 

package/src/driver.ts

@@ -17,6 +17,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { parseAgyLine } from "./stream-events.js";
+import { isKnownNoiseLine, MAX_FRAME_BYTES, stripGluedNoise } from "./frame-guard.js";
 import { bridgeMcpConfigDir, bridgeMcpConfigExists } from "./mcp-server.js";
 import { gateHooksStaged } from "./approval-hook.js";
 import { redactText } from "./redact.js";
@@ -424,6 +425,18 @@ export class StreamDriver implements TurnDriver {
 		// Buffer the trailing partial line: a frame split across pipe chunks is
 		// reassembled when its newline arrives (mirrors JsonRpcSession.feed).
 		this.#stdoutBuf += chunk;
+		if (this.#stdoutBuf.length > MAX_FRAME_BYTES) {
+			// A no-newline flood over the cap means the peer is broken or
+			// hostile: fail the turn and tear the process tree down instead of
+			// growing memory without bound.
+			const detail = `${this.#stdoutBuf.length} bytes buffered with no newline (cap ${MAX_FRAME_BYTES})`;
+			this.#stdoutBuf = "";
+			const turn = this.#active;
+			this.#log("frame-overflow", { detail });
+			if (turn && !turn.closed) this.#failTurn(turn, `stdout frame overflow: ${detail}`);
+			this.#killChild();
+			return;
+		}
 		const lines = this.#stdoutBuf.split("\n");
 		this.#stdoutBuf = lines.pop() ?? "";
 		const turn = this.#active;
@@ -431,7 +444,19 @@ export class StreamDriver implements TurnDriver {
 		if (turn.idleTimer) turn.idleTimer.refresh();
 		for (const line of lines) {
 			if (!line.trim()) continue;
-			this.#applyParsed(turn, parseAgyLine(line));
+			// Known foreign noise (e.g. the Chromium launcher behind a browser
+			// login) is dropped; a noise FRAGMENT glued onto a real frame is
+			// stripped so the frame still parses.
+			if (isKnownNoiseLine(line)) continue;
+			let parsed = parseAgyLine(line);
+			// Repair applies only to true parse failures (raw is the string
+			// fragment): a valid JSON object agy sent with an unrecognized shape
+			// also lands as "unknown" and must reach the turn untouched.
+			if (parsed.kind === "unknown" && typeof parsed.raw === "string") {
+				const repaired = stripGluedNoise(line);
+				if (repaired) parsed = parseAgyLine(repaired);
+			}
+			this.#applyParsed(turn, parsed);
 			if (turn.closed) return;
 		}
 	}

package/src/frame-guard.ts

@@ -0,0 +1,38 @@
+// Frame-guard: shared stdout framing defense for both engines.
+//
+// agy's stdout is a protocol stream, but foreign processes occasionally write
+// into the same inherited pipe (the Chromium launcher behind a browser login
+// prints "Opening in existing browser session." straight into it). Two
+// defenses:
+//
+//   1. A hard per-frame ceiling: a line with no newline must never grow the
+//      reassembly buffer without bound. Breach = the peer is broken or
+//      hostile, the transport is dead.
+//   2. Known-noise handling: a complete noise line is dropped before parsing;
+//      a noise FRAGMENT without a trailing newline glues itself onto the next
+//      real frame, so repair strips everything up to and including the marker.
+
+/** Hard ceiling on one buffered (newline-terminated) frame. 32MB matches the
+ *  reference ACP transport; real frames are KBs, machine-generated output
+ *  with no newline for 32MB is a flood, not a frame. */
+export const MAX_FRAME_BYTES = 32 * 1024 * 1024;
+
+const NOISE_MARKERS = ["Opening in existing browser session."];
+
+/** True when a complete line is pure known noise: drop before parsing. */
+export function isKnownNoiseLine(line: string): boolean {
+	const trimmed = line.trim();
+	if (!trimmed) return false;
+	return NOISE_MARKERS.some((m) => trimmed === m);
+}
+
+/** Repair for the glue case: a noise fragment arrived without its newline and
+ *  the next real frame is now "noise + json". Returns the remainder after the
+ *  first known marker, or null when the line carries no marker. */
+export function stripGluedNoise(line: string): string | null {
+	for (const marker of NOISE_MARKERS) {
+		const idx = line.indexOf(marker);
+		if (idx >= 0) return line.slice(idx + marker.length).trim();
+	}
+	return null;
+}