@estebanforge/pi-antigravity-bridge 1.7.2 → 1.7.4

package/CHANGELOG.md

@@ -2,11 +2,38 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.7.4] - 2026-09-25
+
+### Added
+
+- **`/agy agent <name|off>` — select a custom agy agent for stream-json turns.** The agent list comes from a one-shot `agy agent` spawn through the same bounded raw-spawn helper as the model catalog (8 s watchdog, 1 MiB cap, fail-closed to an empty list), parsed line-oriented: banner and help noise skipped, first whitespace token per line taken, filesystem-safe names validated, duplicates dropped. The choice persists in config with an `AGY_AGENT` env override, rides `--agent` on stream-json spawns, and recycles the process when it changes. ACP has no protocol slot for agent selection, so the command refuses it there with a stream-json-only message instead of silently ignoring the knob.
+- **`/agy subagents` — live subagent roster.** agy's subagent steps were invisible from pi: spawn, message, and manage activity now folds from the engine-agnostic activity stream into an in-memory roster (spawn tools open entries, `send_message` counts messages, `manage_subagents` kills mark entries killed, done/error closes them). Entries key by tool-call id on ACP and step id on stream-json, with name, status, duration, message count, detail, and last error rendered on demand. Works on both engines; deliberately never persisted — agy's conversation database is the durable record, and telemetry must never be able to fail a turn.
+- **`/agy quota` — subscription quota view.** One-shot `agy --print /usage` fetch rendered as bars per window, 5h ranked before weekly, with reset times. The fetch carries its own 30 s budget (the live call answers in ~10 s) and the wrapper watchdog is padded 5 s past agy's own `--print-timeout` so agy's clean self-timeout always wins the race over a SIGKILL. Quota reflects the CLI's Google account identity, so the reading is equally true under both engines; a CLI-less ACP-only install gets a fail-closed pointer to `/agy doctor` rather than a raw spawn error.
+- **`/agy artifacts [open <n|name>]` — browse the conversation brain dir.** Non-recursive scan of the conversation root, `.tempmediaStorage`, and `.user_uploaded`, deduped by canonical path, newest first, with kind/size/last-write shown. `open` resolves by index, exact name, or unique substring and launches the OS opener detached. Path containment canonicalizes the scan root once and re-realpaths every entry before opening, so symlinked ancestors (macOS `/var` → `/private/var`, symlinked homes) cannot silently empty the listing — the first containment gate compared raw paths and did exactly that on such machines.
+- **Parked-answer recovery on stream-json deadline guards.** When the stall or total-timeout guard fires, the driver now kills the child first (bumping the generation so a racing exit handler cannot settle the turn ERROR mid-probe), then probes the conversation's brain transcript: if the NEWEST step written during the turn is a clean, tool-free DONE MODEL response, the turn settles OK with the withheld answer instead of discarding finished work. The newest-step rule is the load-bearing part — a corpus sweep found 96.6% of PLANNER_RESPONSE transcript steps carry tool_calls; they are intermediate plan-and-act steps whose content is status text, not answers, and an older scan that accepted any matching step could settle a turn with "Running test..." as the answer. ACP reports turn completion itself, so the probe is stream-json-only by construction.
+- **`/agy tasks [tail <id>]` — read-only background-task dashboard.** Scans the conversation's task logs (newest first, 128 cap, missing dirs degrade to an empty list) and marks a task ACTIVE while any process holds its log open, via one batched `lsof -nP -Fpn` call — a reader counts too, so the state is a watch, not a fact. Watch-only by design: modern agy pipes task output through itself, making log ownership unprovable, so nothing is ever stopped from here and a missing lsof shows `liveness?` instead of a guess. `tail <id>` resolves against the scanned list and prints the last 40 lines.
+- **Agy CLI version awareness.** A warn-once session toast fires when the CLI reports older than the 1.1.22 stream-json floor; development builds pass, unparseable output classifies as invalid, and a failed spawn maps to a distinct unavailable status rather than a fake verdict. `/agy doctor` gained a CLI version line, labeled "(optional here; AskAntigravity delegations use the CLI)" on ACP-only installs because the CLI matters on both engines. Warn-only by design: a hard spawn gate would block turns on a slow `--version` in odd environments, and an old agy already fails turns with parse noise the warning explains. ACP server versions stay display-only — `agy_acp_server_1.1.1` and CLI `1.2.10` are unrelated streams, and no floor is enforced against the server until its versioning is understood.
+
+### Removed
+
+- **`/agy status`.** It was never a real subcommand — the old argument guard let the literal name fall through to the settings picker while the printed summary read as a broken second status surface. `/agy doctor` is now the single status surface: bridge state, driver counters, CLI and ACP versions, lifecycle, plus the settings rows folded in (nothing duplicated — rows doctor already rendered stay out of the shared block). Typing the retired name gets a one-line pointer to doctor; bare `/agy` keeps its settings picker.
+
+### Fixed
+
+- **The agy models discovery spawn can no longer balloon memory.** It accumulated child stdout with no cap, so a runaway agy could exhaust the whole pi session. Output is now capped at 1 MiB (decoded-length proxy, documented); past the cap the child is SIGKILLed and the result fails closed to empty, which engages the baked-in fallback catalog — and a capped empty result never overwrites a good on-disk cache.
+- **Plan mode never receives `--dangerously-skip-permissions`.** agy's plan-mode no-write gate IS a permission request ("File creation requires plan approval"), and the skip flag auto-approves every permission request — so passing the flag alongside `--mode plan` silently turned review-only into full write access inside the `--add-dir` grant. Probed both directions on 2026-09-25: with the flag a plan run wrote files; without it, file-write and run_command attempts end exit 0 in ~20-30 s with a "confirm plan" message — fail-visible, never the upstream #318 prompt-hang. Both spawn surfaces (the AskAntigravity one-shot and the stream-json driver) now withhold the flag in plan mode through one shared helper; the recycle profile stores the effective value and compares effective-vs-effective so plan sessions keep process reuse. README and ENGINES.md now state the enforcement instead of the aspirational claim.
+
+## [1.7.3] - 2026-09-24
+
+### Fixed
+
+- **Collapsed ACP tool cards no longer repeat the tool name.** The `agy-native-event` renderer filled the muted detail slot with the tool name itself whenever an event carried neither a path nor a recognized command argument, so `ls` and `exec_command` collapsed to "✓ ls ls" / "✓ exec_command exec_command". The detail now prefers the path basename, then the command's first line, then agy's own display text (the first line of the completed call's output, e.g. "Run make test in wicket-cli-atlas"), and stays empty when none exists; the name always stands alone. ACP tool_call frames carry no per-tool reasoning, so agy's display text is the closest honest signal.
+
 ## [1.7.2] - 2026-09-24
 
 ### Added
 
-- **ACP permission requests park on a human decision.** `session/request_permission` was answered silently in-process (skip turns auto-allowed, everything else auto-denied), making ACP turns all-or-nothing with no per-tool human say. Interactive turns now hold the JSON-RPC request open and surface the server's options as a pi select dialog under the dialog lock, with the turn budget paused while the human decides: 480 s park, deny on timeout/esc/throw/connection death, and a cancel instead of an answer when the server offers no reject option (a deny must never degrade into picking an allow). `skipPermissions` keeps the synchronous auto-allow; `approvals.mode allow` maps to it, deny and headless stay fail-closed. `allow_always`/`reject_always` answers are remembered per connection for identical later requests, and first settle wins: a late dialog answer after a timeout is forgotten. Nine new tests pin the behavior, including a scenario proving a late answer writes nothing. 1217 tests, tsc clean.
+- **ACP permission requests park on a human decision.** `session/request_permission` was answered silently in-process (skip turns auto-allowed, everything else auto-denied), making ACP turns all-or-nothing with no per-tool human say. Interactive turns now hold the JSON-RPC request open and surface the server's options as a pi select dialog under the dialog lock, with the turn budget paused while the human decides: 480 s park, deny on timeout/esc/throw/connection death, and a cancel instead of an answer when the server offers no reject option (a deny must never degrade into picking an allow). `skipPermissions` keeps the synchronous auto-allow; `approvals.mode allow` maps to it, deny and headless stay fail-closed. `allow_always`/`reject_always` answers are remembered per connection for identical later requests, and first settle wins: a late dialog answer after a timeout is forgotten. Nine new tests pin the behavior, including a scenario proving a late answer writes nothing. tsc clean.
 
 ### Changed
 

package/README.md

@@ -40,7 +40,7 @@ While agy is the active model it normally cannot see pi's universe of extensions
 
 The bridge starts a localhost MCP server inside pi's process. The exposed catalog is computed live from pi's active tools on every `tools/list` and re-checked immediately before every `tools/call`: the `bridgeTools` mode, the session's `/agy tools` hidden set, and the bridge's own internal tools (`AskAntigravity`, the display-only `antigravity` wrapper, `activate_skill`, `bridge_poll_result`, the `agy_web_search`/`agy_read_url` wrappers) are filtered each time, and a call for anything outside the fresh set is rejected - a cached MCP catalog is not authorization. A call that passes routes into pi's own tool loop via the round-trip described below. Discovery has two layers. The provider's agy gets a per-invocation config: the bridge writes `.agents/mcp_config.json` into a bridge-controlled dir (`~/.pi/agent/antigravity-bridge/agy-mcp-<pid>/`) and the driver passes that dir as an extra `--add-dir` when it spawns agy. A per-pid entry (`pi-bridge-<pid>`) is also registered in the user's global agy config (`~/.gemini/config/mcp_config.json`; foreign servers preserved, stale entries swept at start), so agy builds that read only the global config still find the bridge.
 
-**No patch required.** Bridge calls park in the provider's round-trip store; the provider ends the pi assistant message with a `toolUse` stop reason for the real pi tool, pi executes it in its own loop (native cards, permissions, hooks), and the toolResult completes the parked MCP response on the next stream call. This is the same mechanism tianzuo/pi-antigravity uses; upstream pi APIs only.
+**Upstream pi APIs only.** Bridge calls park in the provider's round-trip store; the provider ends the pi assistant message with a `toolUse` stop reason for the real pi tool, pi executes it in its own loop (native cards, permissions, hooks), and the toolResult completes the parked MCP response on the next stream call.
 
 **Long calls don't die.** agy's MCP client abandons a `tools/call` request at a flat ~180s, which used to kill any pi tool that ran longer (a long peer review, a build, a commit preview waiting for you). A call still running after ~20 seconds now settles its HTTP request with a `STILL RUNNING` answer carrying a `callId` while pi keeps executing; agy fetches the result through the bridge-local `bridge_poll_result` tool and polls until it lands. Escalated calls get their own 30-minute budget, so human-gated tools can take as long as the human takes. Fast calls stay fully synchronous and never see any of this. If a park does fail (abort, timeout, recycle), the late result is re-routed to agy as a follow-up prompt in the same conversation instead of being lost.
 
@@ -73,13 +73,13 @@ cards for read-only steps.
 
 ## Approval gate (agy native tools)
 
-agy runs its own agent loop with native tools (`run_command`, `create_file`, `edit_file`, ...), which pi's permission extensions never saw. The optional approval gate routes those calls through a pi-side approval: a staged PreToolUse hook parks the call, the provider surfaces it as a shadow `bash`/`write`/`edit` toolUse, and your permission extension (or the built-in ask/allow/deny fallback) decides before agy executes it. Off by default (`approvals.gateMode: auto` enables it only when a pi permission extension is detected); denials fail closed; read-only agy tools stay ungated.
+agy runs its own agent loop with native tools (`run_command`, `create_file`, `edit_file`, ...), which pi's permission extensions never saw. The optional approval gate routes those calls through a pi-side approval: a staged PreToolUse hook parks the call, the provider surfaces it as a shadow `bash`/`write`/`edit` toolUse, and your permission extension (or the built-in ask/allow/deny fallback) decides before agy executes it. Off by default (`approvals.gateMode: auto` enables it only when a pi permission extension is detected); denials fail closed; read-only agy tools stay ungated. On ACP turns the server has its own per-tool permission ask: when one fires (`skipPermissions` off), the request parks on a real pi dialog instead of a silent deny, and allow-always choices are remembered per connection.
 
 Full mechanics, configuration, and a sample gate extension: [docs/APPROVAL-GATE.md](docs/APPROVAL-GATE.md).
 
 ## Install
 
-> **No patch required.** The bridge runs on pi's public APIs only; the extension never edits your pi install. If an older version of this extension patched your pi (adding `pi.invokeTool()`), the leftover is inert and a pi update removes it. The extension detects it once and offers `/agy patch-cleanup` to restore the original files from the backup immediately.
+> The bridge runs on pi's public APIs; the extension never edits your pi install.
 
 Install with pi's package manager:
 
@@ -132,9 +132,8 @@ The `activate_skill` catalog mirrors pi's directory-based skill discovery: the t
 `/agy` configures the provider at runtime. Settings persist to `~/.pi/agent/antigravity-bridge/config.json` and take effect on the next turn.
 
 ```
-/agy                      status, or open the full settings picker (TUI)
-/agy status               print current settings + session counts
-/agy doctor               bridge state, driver counters, bridge port, last lifecycle events, log dir
+/agy                      status summary, or open the full settings picker (TUI)
+/agy doctor               single status surface: bridge state, driver counters, versions, acp state, lifecycle, settings, log dir
 /agy auth                 run the antigravity-acp sign-in now (engine acp): opens the Google login in your browser, shows the URL when no browser opens
 /agy mode plan            review-only: agy plans but writes nothing
 /agy mode accept-edits    agy applies edits directly (default)
@@ -150,7 +149,6 @@ The `activate_skill` catalog mirrors pi's directory-based skill discovery: the t
 /agy acp-bin <path|auto>  point the ACP engine at a specific server binary (auto = setup installs, or AGY_ACP_BIN; applies on the next ACP turn)
 /agy engine acp|stream-json   switch the turn engine (restart to apply; default stream-json; acp is beta and runs self-service setup: binary install + auth bootstrap). No arguments opens the engine picker modal (TUI)
 /agy auth-manual             manual ACP credential setup (fallback; auto-setup normally covers this; default login = your Antigravity subscription, same account as the agy CLI)
-/agy patch-cleanup        restore the original pi files if an older version patched them
 /agy clear                drop all session bindings (force fresh conversations)
 ```
 
@@ -158,9 +156,9 @@ The `activate_skill` catalog mirrors pi's directory-based skill discovery: the t
 
 pi itself has no built-in approval gate. Unlike codex, claude, or agy running interactively, pi does not prompt you to confirm each tool action before it runs. That is the host environment this extension lives in.
 
-Because agy runs non-interactively under this provider (nothing can answer a `y/n` prompt), this extension passes `--dangerously-skip-permissions` by default. It is technically necessary: `accept-edits` auto-approves file edits but not shell commands, so a `run_command` would otherwise hang forever waiting for a prompt nothing can answer (upstream [google-antigravity/antigravity-cli#318](https://github.com/google-antigravity/antigravity-cli/issues/318)). The net effect is that agy executes commands the same way pi already executes your other tools: without per-action review.
+Because agy runs non-interactively under this provider (nothing can answer a `y/n` prompt), this extension passes `--dangerously-skip-permissions` by default on `accept-edits` runs. It is technically necessary there: `accept-edits` auto-approves file edits but not shell commands, so a `run_command` would otherwise hang forever waiting for a prompt nothing can answer (upstream [google-antigravity/antigravity-cli#318](https://github.com/google-antigravity/antigravity-cli/issues/318)). The net effect is that agy executes commands the same way pi already executes your other tools: without per-action review.
 
-If you want agy to execute nothing, use `/agy mode plan`. Do not combine `--sandbox` with skip-permissions ([#36](https://github.com/google-antigravity/antigravity-cli/issues/36)).
+Plan mode never receives the flag: the flag auto-approves every permission request, including plan mode's own approval gate, which would silently turn review-only into full write access inside the `--add-dir` grant (probed 2026-09-25: with the flag a plan run wrote files; without it, file and command attempts end the run quickly with a "confirm plan" message). So `/agy mode plan` (and `AskAntigravity` with `mode: "plan"`) genuinely executes nothing. Do not combine `--sandbox` with skip-permissions ([#36](https://github.com/google-antigravity/antigravity-cli/issues/36)).
 
 For per-action review of agy's mutating native tools (`run_command`, `create_file`, `edit_file`, ...), see the [Approval gate](docs/APPROVAL-GATE.md): with it on, the call must pass a pi-side approval (your permission extension, or the built-in ask/allow/deny fallback) before agy executes it.
 

package/extensions/index.ts

@@ -68,6 +68,16 @@ import { ensureAcpReady, inspectAcpSetup } from "../src/acp/setup.js";
 import type { TurnDriver, TurnOutcome } from "../src/driver-types.js";
 import { CONFIG_PATH, loadConfig, logsDir, MAX_TURN_CAP_MIN, parseCapMinutes, saveConfig, type AgyMode, type BridgeTools, type Engine, type ThinkingTier } from "../src/config.js";
 import { agyMissingMessage, isAgyInstalled, savedEngineMessage, showEnginePicker, shouldOfferEnginePicker } from "../src/engine-picker.js";
+import { checkAgyCliVersion, describeAgyVersionCheck, MIN_AGY_VERSION } from "../src/agy-version.js";
+import { isValidAgyAgentName, listAgyAgents } from "../src/agents.js";
+import { formatSubagentRoster, SubagentRoster } from "../src/subagent-roster.js";
+import { spawn } from "node:child_process";
+import { fetchAgyQuota, formatAgyQuotaReport } from "../src/usage.js";
+import { artifactOpenCommand, listAgyArtifacts } from "../src/artifacts.js";
+import { showArtifactsBrowser } from "../src/artifacts-ui.js";
+import { listAgyTasks, tailAgyTaskLog } from "../src/tasks.js";
+import { showTasksBrowser } from "../src/tasks-ui.js";
+import { agyConversationDir } from "../src/agy-paths.js";
 import { createDailyLogger, type DailyLogger } from "../src/daily-log.js";
 import { registerAskAntigravityTool, toolModelsFromRaw } from "../src/ask-tool.js";
 import { registerWebTools } from "../src/web-tools.js";
@@ -197,8 +207,10 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	// ACP self-heal runs once per process (session_start re-fires on /reload;
 	// a ready setup is two file stats, so re-running is harmless anyway).
 	let acpSelfHealRan = false;
-	// Warn-once-per-process flag for the missing-agy-CLI toast (stream-json).
+	// Warn-once-per-process flags for the missing-agy-CLI toast and the
+	// too-old-agy version gate (both stream-json).
 	let agyMissingWarned = false;
+	let agyVersionWarned = false;
 	// OAuth URL capture: the server hands the login URL only to the
 	// browser-open call (nothing on stdio), so a BROWSER wrapper records it
 	// and the driver logs it as "auth-url". Local users keep the automatic
@@ -351,15 +363,22 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			),
 	);
 	const replay = new WrapperReplay();
+	// Subagent roster: folded from every driver activity (both engines) via
+	// the provider; /agy subagents renders it. In-memory, process-lifetime.
+	const roster = new SubagentRoster();
 	// ACP tool activity is display-only: durable Pi entries with native-looking
 	// titles and optional diffs. Unlike a synthetic Pi toolCall this does not
 	// re-execute edits, park the turn, or add tool results to model context.
 	if (engine === "acp") {
 		pi.registerEntryRenderer<NativeDisplayEvent>("agy-native-event", (entry, { expanded }, theme) => {
 			const event = entry.data;
-			const title = (event?.path ? path.basename(event.path) : event?.command?.split(/\r?\n/, 1)[0] ?? event?.name ?? "tool").slice(0, 160);
+			// Collapsed detail: most-specific signal wins (path, command, agy's own
+			// display text). The name is NOT a fallback here - it rendered "ls ls"
+			// duplication whenever the event carried neither path nor command.
+			const firstLine = (value: string | undefined): string | undefined => value?.split(/\r?\n/, 1)[0].trim() || undefined;
+			const detail = event?.path ? path.basename(event.path) : firstLine(event?.command) ?? firstLine(event?.output);
 			const status = event?.status === "failed" ? theme.fg("error", "✗") : theme.fg("success", "✓");
-			const lines = [`${status} ${theme.fg("toolTitle", event?.name ?? "Antigravity")} ${theme.fg("muted", title)}`];
+			const lines = [`${status} ${theme.fg("toolTitle", event?.name ?? "Antigravity")}${detail ? ` ${theme.fg("muted", detail.slice(0, 160))}` : ""}`];
 			if (expanded) {
 				if (event?.path) lines.push(theme.fg("dim", event.path));
 				if (event?.diff) {
@@ -456,6 +475,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		replay,
 		nativeActive,
 		onNativeEvent,
+		roster,
 		engine,
 		log: fileLog.log.bind(fileLog),
 	});
@@ -491,6 +511,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		hiddenBridgeTools,
 		acpLog,
 		fileLog,
+		roster,
 		authCapture: authCapture ?? null,
 		runAcpPickSetup,
 	});
@@ -637,6 +658,20 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			if (ctx.hasUI) ctx.ui.notify(msg, "warning");
 			else console.error(`[antigravity-bridge] ${msg}`);
 		}
+		// Version gate (stream-json): an agy older than MIN_AGY_VERSION fails
+		// turns with raw stream errors that look like bridge bugs. Warn once
+		// with the fix in the message; doctor carries the full verdict.
+		// Development builds and unreadable output stay silent here (an agy
+		// from source works; doctor shows what we could not parse).
+		if (engine === "stream-json" && !agyVersionWarned && isAgyInstalled(binary)) {
+			void checkAgyCliVersion(binary).then((check) => {
+				if (agyVersionWarned || check.status !== "unsupported") return;
+				agyVersionWarned = true;
+				const msg = `agy ${check.version} is too old; install ${MIN_AGY_VERSION} or newer. Stream-json turns may fail in confusing ways until then (/agy doctor inspects).`;
+				if (ctx.hasUI) ctx.ui.notify(msg, "warning");
+				else console.error(`[antigravity-bridge] ${msg}`);
+			});
+		}
 		// Legacy cleanup: users who ran the old consent-gated patcher still
 		// carry pi.invokeTool in their installed pi. Inert, but tell them once
 		// and offer /agy patch-cleanup. Never auto-edits the install.
@@ -1006,6 +1041,8 @@ interface AgyCommandCtx {
 	acpLog: (msg: string, data?: unknown) => void;
 	/** Daily file logger (src/daily-log.ts); command + doctor surfacing. */
 	fileLog: DailyLogger;
+	/** Live subagent roster (folded in the provider); /agy subagents. */
+	roster: SubagentRoster;
 	/** Wizard-pick follow-through (download now + chained sign-in); reused
 	 *  by /agy engine's no-args modal so both entry points behave alike. */
 	runAcpPickSetup: (cmdCtx: { ui: ExtensionUIContext }) => Promise<void>;
@@ -1027,30 +1064,39 @@ interface PendingConfig {
 	systemPrompt?: boolean;
 }
 
-function statusText(ctx: AgyCommandCtx): string {
+function settingsRows(ctx: AgyCommandCtx): string[] {
 	const config = loadConfig();
-	const source = ctx.usingFallback ? "fallback (agy models failed)" : "discovered";
 	const perm = config.skipPermissions ? "auto-approved (DANGEROUS)" : "prompt (hangs in -p)";
 	// padEnd keyed to the longest label ("AskAntigravity thinking:") so the
-	// value column stays aligned as labels grow.
+	// value column stays aligned as labels grow. Doctor-only state (engine,
+	// models, sessions, config path) lives in /agy doctor, not here: one
+	// surface per concern — this is the config surface, doctor is health.
 	const row = (label: string, value: string) => `  ${label.padEnd(24)} ${value}`;
 	return [
-		"Antigravity bridge",
-		row("engine:", `${config.engine}${config.engine === "acp" ? " (official server, opt-in)" : ""}`),
-		row("models:", `${ctx.entries.length} ${source}`),
 		row("mode:", config.mode),
 		row("permissions:", perm),
 		row("AskAntigravity tool:", config.askTool ? "on" : "off"),
 		row("Web tools:", config.webTools ? "on" : "off"),
 		row("AskAntigravity model:", config.defaultModel),
 		row("AskAntigravity thinking:", config.defaultThinking),
-		row("sessions:", `${ctx.store.size} bound`),
-		row("config:", CONFIG_PATH),
 		row("bridge tools:", config.bridgeTools),
 		row("digest:", config.digest ? "on" : "off"),
 		row("system prompt:", config.systemPrompt ? "on" : "off"),
+	];
+}
+
+function statusText(ctx: AgyCommandCtx): string {
+	const config = loadConfig();
+	const source = ctx.usingFallback ? "fallback (agy models failed)" : "discovered";
+	return [
+		"Antigravity bridge",
+		`  engine:        ${config.engine}${config.engine === "acp" ? " (official server, opt-in)" : ""}`,
+		`  models:        ${ctx.entries.length} ${source}`,
+		...settingsRows(ctx),
+		`  sessions:      ${ctx.store.size} bound`,
+		`  config:        ${CONFIG_PATH}`,
 		"",
-		"Subcommands: /agy auth, /agy auth-manual, /agy engine stream-json|acp, /agy mode plan|accept-edits, /agy permissions on|off, /agy ask on|off, /agy model <alias>, /agy thinking low|medium|high, /agy bridge all|mcp|none, /agy tools [hide|show <name>|reset], /agy web on|off, /agy digest on|off, /agy system-prompt on|off, /agy acp-bin <path|auto>, /agy patch-cleanup, /agy clear",
+		"Subcommands: /agy auth, /agy auth-manual, /agy engine stream-json|acp, /agy mode plan|accept-edits, /agy permissions on|off, /agy ask on|off, /agy model <alias>, /agy thinking low|medium|high, /agy agent <name|off>, /agy subagents, /agy quota, /agy artifacts [open <n|name>], /agy tasks [tail <id>], /agy bridge all|mcp|none, /agy tools [hide|show <name>|reset], /agy web on|off, /agy digest on|off, /agy system-prompt on|off, /agy timeout <1-1440|off>, /agy acp-bin <path|auto>, /agy patch-cleanup, /agy clear, /agy doctor",
 	].join("\n");
 }
 
@@ -1058,7 +1104,7 @@ function statusText(ctx: AgyCommandCtx): string {
 function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 	pi.registerCommand("agy", {
 		description:
-			"Antigravity provider: status, doctor, settings picker, clear sessions. Usage: /agy [status|doctor|auth|auth-manual|engine stream-json|acp|mode plan|accept-edits|permissions on|off|ask on|off|model <alias>|thinking low|medium|high|bridge all|mcp|none|tools [hide|show <name>|reset]|web on|off|digest on|off|system-prompt on|off|timeout <1-1440|off>|acp-bin <path|auto>|patch-cleanup|clear]",
+			"Antigravity provider: doctor (health + settings), settings picker, clear sessions. Usage: /agy [doctor|auth|auth-manual|engine stream-json|acp|mode plan|accept-edits|permissions on|off|ask on|off|model <alias>|thinking low|medium|high|agent <name|off>|subagents|quota|artifacts [open <n|name>]|tasks [tail <id>]|bridge all|mcp|none|tools [hide|show <name>|reset]|web on|off|digest on|off|system-prompt on|off|timeout <1-1440|off>|acp-bin <path|auto>|patch-cleanup|clear]",
 		handler: async (args, cmdCtx: ExtensionCommandContext) => {
 			const ui = cmdCtx.ui;
 			if (ui) activeUi = ui;
@@ -1286,6 +1332,15 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				const engine = ctx.engine;
 				const snap = (engine === "acp" ? ctx.acpDriver : ctx.driver).snapshot();
 				const port = ctx.getMcpPort();
+				// The CLI matters on both engines (AskAntigravity shells out to
+				// `agy -p` even when turns ride ACP), but on an ACP session a
+				// missing CLI is a supported shape, so label it optional there
+				// instead of showing a bare failure line.
+				const cliCheck = await checkAgyCliVersion(resolveAgyBinary());
+				const cliSuffix =
+					cliCheck.status === "unavailable" && engine === "acp"
+						? " (optional here; AskAntigravity delegations use the CLI)"
+						: "";
 				const lines = [
 					"Antigravity doctor (no tokens spent)",
 					`  engine:        ${engine}`,
@@ -1294,6 +1349,7 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 					`  driver stats:  spawns=${snap.stats.spawns} turns=${snap.stats.turns} reused=${snap.stats.reused} recycles=${snap.stats.recycles}${snap.stats.lastRecycleReason ? ` (last: ${snap.stats.lastRecycleReason})` : ""}`,
 					`  sessions:      ${ctx.store.size} bound`,
 					`  models:        ${ctx.entries.length} ${ctx.usingFallback ? "FALLBACK (agy models failed)" : "discovered"}`,
+					`  agy cli:       ${describeAgyVersionCheck(cliCheck)} (min ${MIN_AGY_VERSION})${cliSuffix}`,
 					`  config:        ${CONFIG_PATH}`,
 					`  logs:          ${logsDir()} (attach recent days' files when reporting issues; set AGY_DEBUG=1 to capture details)`,
 				];
@@ -1322,6 +1378,9 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 						`  acp auth:      ${setup.auth ?? "not configured (auto-setup bootstraps)"}`,
 					);
 				}
+				// The config surface lives here too, so doctor is the ONE status
+				// surface (former /agy status is gone).
+				lines.push("", "settings:", ...settingsRows(ctx));
 				ui?.notify(lines.join("\n"), "info");
 				return;
 			}
@@ -1338,6 +1397,214 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				}
 				return;
 			}
+			if (sub === "tasks") {
+				const engine = ctx.engine;
+				const snap = (engine === "acp" ? ctx.acpDriver : ctx.driver).snapshot();
+				const conversationId = snap.conversationId ?? undefined;
+				if (!conversationId) {
+					ui?.notify("no Antigravity conversation bound yet; run a turn first.", "warning");
+					return;
+				}
+				const dir = agyConversationDir(engine, conversationId);
+				const rest = (args ?? "").trim().split(/\s+/);
+
+				// /agy tasks tail <id>: last bytes of one task log into chat.
+				// Resolved against the scanned list, not a rebuilt filename:
+				// the id->filename convention must not live in two places.
+				if (rest[0]?.toLowerCase() === "tail") {
+					const id = Number(rest[1]);
+					if (!Number.isInteger(id) || id < 0) {
+						ui?.notify("usage: /agy tasks tail <id>. /agy tasks lists them.", "warning");
+						return;
+					}
+					const tasks = await listAgyTasks(dir);
+					const task = tasks.find((t) => t.id === id);
+					if (!task) {
+						ui?.notify(`no task #${id} in this conversation. /agy tasks lists them.`, "warning");
+						return;
+					}
+					const tail = await tailAgyTaskLog(task.logPath);
+					if (tail === "") {
+						ui?.notify(`task #${id} has no readable log.`, "warning");
+						return;
+					}
+					const lines = tail.split("\n");
+					const body = lines.length > 40 ? `…\n${lines.slice(-40).join("\n")}` : tail;
+					ui?.notify(`task #${id} tail:\n${body}`, "info");
+					return;
+				}
+
+				// Dashboard form; r rescans by re-listing fresh.
+				let tasks = await listAgyTasks(dir);
+				if (tasks.length === 0) {
+					ui?.notify("no background tasks recorded for this conversation.", "info");
+					return;
+				}
+				if (!ui) {
+					const lines = tasks.map((t) => {
+						const state = t.livenessKnown ? (t.active ? "ACTIVE" : "idle") : "liveness?";
+						return `#${t.id}  ${state}  ${t.bytes}B`;
+					});
+					console.log([`antigravity tasks (${tasks.length}):`, ...lines].join("\n"));
+					return;
+				}
+				for (;;) {
+					const action = await showTasksBrowser(ui, tasks, tasks[0]?.livenessKnown ?? false);
+					if (action.type === "rescan") {
+						tasks = await listAgyTasks(dir);
+						if (tasks.length === 0) {
+							ui?.notify("no background tasks recorded for this conversation.", "info");
+						}
+						continue;
+					}
+					break;
+				}
+				return;
+			}
+			if (sub === "artifacts") {
+				const engine = ctx.engine;
+				const snap = (engine === "acp" ? ctx.acpDriver : ctx.driver).snapshot();
+				const conversationId = snap.conversationId ?? undefined;
+				if (!conversationId) {
+					ui?.notify("no Antigravity conversation bound yet; run a turn first.", "warning");
+					return;
+				}
+				const dir = agyConversationDir(engine, conversationId);
+				const rest = (args ?? "").trim().split(/\s+/).slice(1);
+				const openWord = rest[0]?.toLowerCase();
+
+				// /agy artifacts open <name|index>: direct open, no overlay.
+				if (openWord === "open") {
+					const artifacts = await listAgyArtifacts(dir);
+					if (artifacts.length === 0) {
+						ui?.notify("no artifacts in this conversation.", "info");
+						return;
+					}
+					const target = rest.slice(1).join(" ").trim();
+					if (target === "") {
+						ui?.notify("usage: /agy artifacts open <name|index>. /agy artifacts lists them.", "warning");
+						return;
+					}
+					const byIndex = /^\d+$/.test(target) ? Number(target) : undefined;
+					const artifact =
+						byIndex !== undefined
+							? artifacts[byIndex]
+							: artifacts.find((a) => a.name.toLowerCase() === target.toLowerCase()) ??
+								(artifacts.filter((a) => a.name.toLowerCase().includes(target.toLowerCase())).length === 1
+									? artifacts.find((a) => a.name.toLowerCase().includes(target.toLowerCase()))
+									: undefined); // ambiguous or no match
+					if (!artifact) {
+						ui?.notify(`no unique artifact matches ${JSON.stringify(target)}. /agy artifacts lists them.`, "warning");
+						return;
+					}
+					const openCmd = artifactOpenCommand();
+					if (!openCmd) {
+						ui?.notify(`no file-open handler for ${process.platform}; the file is at ${artifact.absolutePath}`, "warning");
+						return;
+					}
+					spawn(openCmd.cmd, [artifact.absolutePath], { detached: true, stdio: "ignore", shell: false }).unref();
+					ui?.notify(`opened ${artifact.name}`, "info");
+					return;
+				}
+
+				// Browser loop; r rescans by re-listing fresh. The first scan is
+				// reused so the emptiness gate does not cost a second readdir pass.
+				let artifacts = await listAgyArtifacts(dir);
+				if (artifacts.length === 0) {
+					ui?.notify("no artifacts in this conversation (media dirs appear once agy generates or receives files).", "info");
+					return;
+				}
+				if (!ui) {
+					// Headless: no overlay is possible; print the indexed list.
+					const lines = artifacts.map((a, i) => `${i}  ${a.name} (${a.kind}, ${a.bytes}B)`);
+					console.log([`antigravity artifacts (${artifacts.length}):`, ...lines].join("\n"));
+					return;
+				}
+				for (;;) {
+					const action = await showArtifactsBrowser(ui, artifacts);
+					if (action.type === "rescan") {
+						artifacts = await listAgyArtifacts(dir);
+						continue;
+					}
+					if (action.type === "open") {
+						const openCmd = artifactOpenCommand();
+						if (!openCmd) {
+							ui.notify(`no file-open handler for ${process.platform}.`, "warning");
+							continue;
+						}
+						spawn(openCmd.cmd, [action.artifact.absolutePath], { detached: true, stdio: "ignore", shell: false }).unref();
+					}
+					break;
+				}
+				return;
+			}
+			if (sub === "quota") {
+				// Quota lives in the CLI's Google identity. A pure-ACP install
+				// without the CLI is a supported shape; say what is missing instead
+				// of rendering a fetch failure.
+				const bin = resolveAgyBinary();
+				if (!isAgyInstalled(bin)) {
+					ui?.notify(
+						"quota comes from the agy CLI, which is not installed. ACP-only setups can install the CLI separately (same Google account) to see subscription quota (/agy doctor shows what IS available).",
+						"warning",
+					);
+					return;
+				}
+				// /usage answers in ~10s live; surface the wait instead of a dead
+				// command line.
+				ui?.setStatus("agy-quota", "checking agy quota…");
+				try {
+					const report = await fetchAgyQuota(bin);
+					if (report === undefined) {
+						ui?.notify("quota unavailable: agy did not return a /usage payload (see /agy doctor for binary health).", "warning");
+						return;
+					}
+					ui?.notify(formatAgyQuotaReport(report), "info");
+				} finally {
+					ui?.setStatus("agy-quota", undefined);
+				}
+				return;
+			}
+			if (sub === "subagents") {
+				const entries = ctx.roster.snapshot();
+				if (entries.length === 0) {
+					ui?.notify("antigravity subagents: none tracked this session\n\nagy spawns subagents as ordinary tool steps; they appear here once a turn uses them.", "info");
+					return;
+				}
+				ui?.notify(formatSubagentRoster(entries), "info");
+				return;
+			}
+			if (sub === "agent") {
+				// ACP has no agent slot in the protocol (RC01): refuse instead of
+				// silently ignoring a configured agent.
+				if (ctx.engine === "acp") {
+					ui?.notify("the ACP engine has no agent selection (RC01). /agy engine stream-json first.", "warning");
+					return;
+				}
+				const name = (args ?? "").trim().split(/\s+/).slice(1).join(" ").trim();
+				if (!name) {
+					const agents = await listAgyAgents(resolveAgyBinary());
+					const current = loadConfig().agent;
+					const agentList =
+						agents.length > 0
+							? agents.map((a) => `${a === current ? ">" : " "} ${a}`).join("\n")
+							: "(no custom agents defined)";
+					ui?.notify(`current agent: ${current ?? "(agy default)"}\n\n${agentList}\n\nusage: /agy agent <name|off>`, "info");
+					return;
+				}
+				if (name === "off" || name === "none" || name === "default") {
+					saveConfig({ agent: undefined });
+					ui?.notify("agent cleared: agy default", "info");
+					return;
+				}
+				if (!isValidAgyAgentName(name)) {
+					ui?.notify(`invalid agent name: ${name} (use letters, digits, dot, dash, underscore)`, "warning");
+					return;
+				}
+				saveConfig({ agent: name });
+				ui?.notify(`agent set: ${name} (takes effect on the next stream-json turn)`, "info");
+				return;
+			}
 			if (sub === "permissions") {
 				if (val === "on" || val === "off") {
 					const next = saveConfig({ skipPermissions: val === "on" });
@@ -1457,9 +1724,11 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 			}
 
 
-			// No subcommand (or "status"): print status, or open the picker in TUI.
-			if (sub && sub !== "status") {
-				ui?.notify(`unknown subcommand: ${sub}\n${statusText(ctx)}`, "warning");
+			// No subcommand: print status, or open the picker in TUI. The old
+			// "status" alias is retired; /agy doctor is the one status surface.
+			if (sub) {
+				const pointer = sub === "status" ? "/agy status was removed; use /agy doctor.\n" : "";
+				ui?.notify(`${pointer}unknown subcommand: ${sub}\n${statusText(ctx)}`, "warning");
 				return;
 			}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/driver.ts

@@ -438,7 +438,7 @@ export class AcpDriver implements TurnDriver {
 			case "tool_start": {
 				const entry = { name: mapped.name, args: mapped.args, diff: mapped.diff, mcpServer: mapped.mcpServer };
 				turn.toolCalls.set(mapped.toolCallId, entry);
-				this.#emit(turn, { type: "tool_start", name: mapped.name, args: mapped.args, mcpServer: mapped.mcpServer });
+				this.#emit(turn, { type: "tool_start", name: mapped.name, args: mapped.args, mcpServer: mapped.mcpServer, toolCallId: mapped.toolCallId });
 				return;
 			}
 			case "tool_done": {
@@ -457,14 +457,14 @@ export class AcpDriver implements TurnDriver {
 				const args = entry?.args ?? {};
 				// Native diff from the stored tool_call frame; the update's own
 				// diff (future builds) wins when present.
-				this.#emit(turn, { type: "tool_done", name, args, output: mapped.output, diff: mapped.diff ?? entry?.diff, mcpServer: mapped.mcpServer ?? entry?.mcpServer });
+				this.#emit(turn, { type: "tool_done", name, args, output: mapped.output, diff: mapped.diff ?? entry?.diff, mcpServer: mapped.mcpServer ?? entry?.mcpServer, toolCallId: mapped.toolCallId });
 				return;
 			}
 			case "tool_error": {
 				const entry = turn.toolCalls.get(mapped.toolCallId);
 				turn.toolCalls.delete(mapped.toolCallId);
 				const name = entry?.name ?? "tool";
-				this.#emit(turn, { type: "tool_error", name, message: mapped.message, mcpServer: mapped.mcpServer ?? entry?.mcpServer });
+				this.#emit(turn, { type: "tool_error", name, message: mapped.message, mcpServer: mapped.mcpServer ?? entry?.mcpServer, toolCallId: mapped.toolCallId });
 				return;
 			}
 			case "replay_user":

package/src/agents.ts

@@ -0,0 +1,64 @@
+// agy custom-agent roster (stream-json engine only).
+//
+// `agy agent` (alias `agents`) lists the user's custom agents one per line.
+// Live-verified against agy 1.2.10: bare names, no banner and no columns
+// when agents exist; help text on bad flags; empty output when none. The
+// parser still tolerates a name-plus-description column layout and banner
+// lines so a future agy that annotates the listing keeps parsing.
+//
+// A picked name rides the turn request as `--agent` (same flag our web
+// tools already pass for their throwaway agents). ACP has no agent slot in
+// the protocol (RC01), so selection is refused at the command level there.
+
+import { spawnAgyRaw } from "./models.js";
+
+/** Agent names are agy agent-dir names: filesystem-safe tokens. */
+export const AGENT_NAME_MAX = 128;
+const AGENT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+/** Parse raw `agy agent` output into agent names. Tolerant: skips empty and
+ *  banner/help lines, takes the first whitespace-separated token per line
+ *  (a future description column survives), rejects names that are not
+ *  filesystem-safe tokens, dedupes preserving order. */
+export function parseAgyAgentsRaw(text: string): string[] {
+	const seen = new Set<string>();
+	const agents: string[] = [];
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		// Help output and older banner formats are noise, not agent names
+		// (checked on the whole line: "List available agents" has no single
+		// banner token).
+		if (/^(usage:|flags:|-h\b|list available|available agents)/i.test(trimmed)) continue;
+		const token = trimmed.split(/\s+/)[0] ?? "";
+		if (!AGENT_NAME_RE.test(token) || seen.has(token)) continue;
+		seen.add(token);
+		agents.push(token);
+	}
+	return agents;
+}
+
+/** True when `name` is a valid agent-dir token (what `--agent` accepts). */
+export function isValidAgyAgentName(name: string): boolean {
+	return AGENT_NAME_RE.test(name);
+}
+
+/** Normalize a configured agent value: trim, cap, strip control characters;
+ *  empty result means "no agent configured". Kept permissive beyond the
+ *  token regex so a user typo reaches agy's own validation (a visible
+ *  turn error) instead of silently reverting to the default agent. */
+export function normalizeAgyAgentName(value: string | undefined): string | undefined {
+	if (value === undefined) return undefined;
+	const cleaned = value
+		.trim()
+		.replace(/[\x00-\x1f\x7f]/g, "")
+		.slice(0, AGENT_NAME_MAX);
+	return cleaned === "" ? undefined : cleaned;
+}
+
+/** List the custom agents `agy agent` reports. "" stdout (missing binary,
+ *  failure, cap) parses to [], so callers can treat "no agents" and "could
+ *  not ask" the same way the command layer renders it. */
+export async function listAgyAgents(binary: string = "agy"): Promise<string[]> {
+	return parseAgyAgentsRaw(await spawnAgyRaw(binary, ["agent"]));
+}