@estebanforge/pi-antigravity-bridge 1.7.6 → 1.7.8

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.7.8] - 2026-09-30
+
+### Fixed
+
+- **The system prompt no longer rides the prompt line on stream-json.** Probed on agy 1.2.14: the CLI silently drops any single prompt past a ~25KB input cap. The drop reports SUCCESS with an empty response, zero usage, and no model step, and a conversation whose turn was dropped never answers again - resuming it hangs with no result frame. The G10 system-prompt block shipped inline on the first prompt of every fresh conversation by default and routinely crossed the cap, so provider sessions answered boilerplate while the user's message never ran (issue #2). The block now stages as an agy agent file under the agents discovery root and rides `--agent`: the CLI reads agent files from disk, so the cap never applies, and the prompt line carries only the user message. Staging is content-addressed - one dir per distinct body, write-once, pid-marked, orphan-swept - so two conversations in one process can never overwrite each other's carrier (the round-2 review blocked the original per-process slot for exactly that cross-contamination). A user-configured `config.agent` always wins, with the inline block as fallback and a one-time warning. ACP keeps the inline block: the JSON-RPC transport has no cap and no `--agent` slot.
+- **A dropped or dead turn now fails loudly instead of poisoning the session.** The stream-json driver settles every turn with model-output and result-frame evidence. An OK outcome with no model output - the exact signature of the silent over-cap drop - fails the turn with the cause and the remedy, and never stores the conversation binding; a deadline on a bound conversation with no result frame clears the binding so the next turn starts a fresh conversation instead of hanging forever on a dead one. Real terse turns (tool steps, thinking, any usage) are untouched; a deadline that recovered a withheld answer keeps settling OK.
+- **Regression coverage pins the whole failure chain at both layers.** The fake agy binary grew a SILENT-DROP branch reproducing the exact wire signature; driver tests pin the evidence fields; provider tests cover the drop, the poisoned resume, a deadline-with-result keeping its binding, terse-turn false positives, carrier isolation across interleaved conversations, and deadline-flavored error copy. 1343 tests, tsc clean; round-2 adversarial review signed off after the carrier-isolation blocker fix.
+
+Thanks @Jamsa for the report (#2).
+
+## [1.7.7] - 2026-09-30
+
+### Fixed
+
+- **A recreated agy conversation no longer starves the context digest.** When `session/load` failed, the ACP engine silently fell back to a fresh conversation (`session-load-failed-creating-fresh`), but the end-of-turn write-back kept advancing the stored watermark, so the new conversation never received the backlog: the digest delivered only the current prompt for the rest of the session, and the G10 system-prompt gate stayed closed too, because the surviving record always carried a conversation id. The write-back now compares the outcome's conversation id against the one stored before the turn and drops the record on a mismatch: the next turn re-delivers the full digest backlog and re-arms the system prompt, on both engines, with no protocol change. `SessionStore` gained a per-key `delete()` whose removal persists exactly once (the removal set prunes after a durable write, so a later persist can never destroy a record another process wrote in the meantime), preserving the multi-process merge invariant.
+- **Failed and aborted turns no longer advance the digest watermark.** The write-back recorded `lastMessageCount` on any turn that reported a conversation id, ERROR and aborts included. Whether the prompt actually landed in the conversation's history is not observable from the provider, and advancing on that ambiguity starves the digest of the missed turn (the same failure class as the recreation bug above). The watermark now advances only on a clean, non-aborted turn; failed, aborted, and unknown outcomes leave the pre-turn record untouched, so the next digest re-delivers the missed turn bounded by the existing `maxChars` cap (default 8000) instead of losing it. With the digest off (the default) neither fix changes observable behavior.
+- **Regression coverage pins both behaviors at the provider layer.** Eight new tests: record drop, backlog re-delivery, and system-prompt re-arm across the id swap; unchanged watermark across failed, aborted, and unknown outcomes on the same conversation; and the session-store delete and multi-process semantics, including a reclaimed key surviving an unrelated persist from another process. 1329 tests, tsc clean.
+
+Thanks @fishfuuu for the report (#1).
+
 ## [1.7.6] - 2026-09-28
 
 ### Fixed

package/README.md

@@ -119,7 +119,7 @@ If `agy models` fails at load (binary missing, auth not done, network stall), a
 | `webTools` | `off` (no web tools), `on` (register `agy_web_search` + `agy_read_url` as Pi tools, usable by ANY provider's model). Each call spawns a one-shot search-only `agy` agent (plan mode, bridge MCP inheritance off), gates the answer on an observed native `search_web`/`read_url_content` step, and spends Antigravity quota. Off by default: Antigravity sessions already have native web tools on both engines; these serve other providers | `off` |
 | `bridgeTools` | `none` (bridge off), `all` (every non-builtin tool, incl. other `Ask*` delegations), `mcp` (pi-mcp-adapter tools + skills bridge only) | `all` |
 | `digest` | `off` (stable prompts; agy's prompt cache hits) or `on` (inject a delta of pi-side context - compaction summaries, other-provider turns - into each agy prompt; the delta changes every turn, so agy re-bills the full context). Enable for mixed-provider sessions where agy must see pi-side context | `off` |
-| `systemPrompt` | `on` (prepend pi's system prompt - operating instructions plus the global agent-dir `AGENTS.md` and ancestor `AGENTS.md`/`CLAUDE.md` - to the first prompt of each new agy conversation, plus a tool-priority note: Pi Bridge tools win over agy's native interactive ones, which never reach the user) or `off` (agy-native behavior) | `on` |
+| `systemPrompt` | `on` (send pi's system prompt - operating instructions plus the global agent-dir `AGENTS.md` and ancestor `AGENTS.md`/`CLAUDE.md` - to the first prompt of each new agy conversation, plus a tool-priority note: Pi Bridge tools win over agy's native interactive ones, which never reach the user. Delivery: stream-json stages it as an agy agent file via `--agent`, off the prompt line - the CLI silently drops single prompts past a ~25KB cap and the dropped turn kills the conversation; ACP prepends it to the first prompt) or `off` (agy-native behavior) | `on` |
 | `turnTimeoutMin` | Overall cap on ONE agy turn, minutes, both engines. When it fires, the bridge kills the agy process mid-task ("ACP turn exceeded the 10m deadline" / "agy exceeded the 10m turn timeout") - it is a bridge cap, not a Google server limit. Default is TTY-aware: `0` (no cap) on an interactive pi - you are the backstop with Esc; `20` headless, where nobody can abort and one runaway turn blocks the serialized turn queue. Opt into a gate with 1-1440 (free type via `config.json` or `/agy timeout <1-1440|off>`, or the `/agy` picker's preset list); `0` disables explicitly; anything else falls back to the TTY-aware default. The 5m inactivity stall guard always still bounds a hung server | `0` TTY / `20` headless |
 | `inactivityTimeoutMin` | Silence cap, minutes, both engines: no stream-json stdout / no ACP session/update for this long fails the turn as a stall. `0` disables the guard | `5` |
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.7.6",
-  "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
+  "version": "1.7.8",
+  "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",
     "pi-extension",

package/src/driver-types.ts

@@ -90,6 +90,20 @@ export interface TurnOutcome {
 	usage?: AgyUsage;
 	finished: boolean;
 	aborted: boolean;
+	/** The model demonstrably produced output this turn: an agent_response
+	 *  or tool step was observed, or the settled response/usage is non-empty.
+	 *  Stream-json sets it on every outcome; ACP leaves it undefined.
+	 *  false + status OK is agy's silent over-cap drop signature (issue #2:
+	 *  prompts past ~25KB are discarded with SUCCESS, no error). */
+	modelOutputSeen?: boolean;
+	/** Stream-json only: a result frame arrived for this turn. Undefined on
+	 *  ACP. A deadline kill or process exit before the result frame means the
+	 *  turn never committed. */
+	sawResult?: boolean;
+	/** Stream-json only: the turn ended via the overall/inactivity deadline
+	 *  guard (not a user abort, not a process crash). With sawResult false on
+	 *  a resumed conversation this marks the conversation as poisoned. */
+	deadline?: "timeout" | "stall";
 }
 
 export interface TurnHandle {

package/src/driver.ts

@@ -67,6 +67,10 @@ interface ActiveTurn {
 	 *  transcript steps to those written after this. */
 	startedAt: number;
 	sawResult: boolean;
+	/** An agent_response or tool step arrived this turn. Distinguishes a
+	 *  real (if terse) turn from agy's silent over-cap drop, which settles
+	 *  SUCCESS with no model step at all (issue #2). */
+	sawModelStep: boolean;
 	/** Text-dedupe guard state (delta vs cumulative response_text). */
 	cumulativeText: boolean | undefined;
 	/** Open bridge parks. Each one suspends the stdout idle timer: agy is
@@ -120,6 +124,20 @@ function nowIso(): string {
 	return new Date().toISOString().slice(11, 19);
 }
 
+/** True when any usage counter carries a real value. The silent over-cap
+ *  drop reports all-zero usage (no model call happened); a turn that burned
+ *  any tokens demonstrably reached the model. */
+function hasTokenEvidence(usage: AgyUsage | undefined): boolean {
+	if (!usage) return false;
+	return (
+		(usage.input_tokens ?? 0) > 0 ||
+		(usage.output_tokens ?? 0) > 0 ||
+		(usage.thinking_tokens ?? 0) > 0 ||
+		(usage.cache_read_tokens ?? 0) > 0 ||
+		(usage.total_tokens ?? 0) > 0
+	);
+}
+
 /** True when `next` is a cumulative resend of `accumulated` (it repeats every
  *  byte already streamed) rather than a fresh delta. Exported for tests. */
 export function isCumulativeResend(accumulated: string, next: string): boolean {
@@ -287,6 +305,7 @@ export class StreamDriver implements TurnDriver {
 			outcome,
 			response: "",
 			sawResult: false,
+			sawModelStep: false,
 			cumulativeText: undefined,
 			parks: 0,
 			startedAt: Date.now(),
@@ -500,6 +519,7 @@ export class StreamDriver implements TurnDriver {
 					emit(turn, { type: "usage", usage: s.usage });
 				}
 				if (s.step_type === "agent_response") {
+					turn.sawModelStep = true;
 					const text =
 						typeof s.text_delta === "string"
 							? s.text_delta
@@ -513,6 +533,7 @@ export class StreamDriver implements TurnDriver {
 					break;
 				}
 				if (s.step_type === "tool") {
+					turn.sawModelStep = true;
 					const name = s.tool_name ?? s.tool_info?.name ?? "tool";
 					const args =
 						s.tool_info?.parameters && typeof s.tool_info.parameters === "object"
@@ -614,9 +635,22 @@ export class StreamDriver implements TurnDriver {
 		this.#state = this.#child ? "ready" : "dead";
 		for (const wake of turn.wake) wake();
 		turn.wake = [];
-		turn.resolve(outcome);
+		// Evidence fields every consumer can rely on. modelOutputSeen separates a
+		// real (if terse) turn from agy's silent over-cap drop, which settles
+		// SUCCESS with NO model step, empty response, and zero usage (issue #2).
+		const usage = outcome.usage ?? turn.usage;
+		const enriched: TurnOutcome = {
+			...outcome,
+			usage,
+			sawResult: turn.sawResult,
+			modelOutputSeen:
+				turn.sawModelStep ||
+				outcome.response.length > 0 ||
+				hasTokenEvidence(usage),
+		};
+		turn.resolve(enriched);
 		try {
-			this.#onTurnEnd?.(outcome);
+			this.#onTurnEnd?.(enriched);
 		} catch {
 			/* listener errors must not break settling */
 		}
@@ -630,7 +664,7 @@ export class StreamDriver implements TurnDriver {
 	 *  One found, the turn settles OK with the withheld answer instead of
 	 *  discarding finished work; either way the next turn respawns into a
 	 *  known state. */
-	async #turnDeadlineGuard(turn: ActiveTurn, label: string, message: string): Promise<void> {
+	async #turnDeadlineGuard(turn: ActiveTurn, label: "timeout" | "stall", message: string): Promise<void> {
 		if (turn.closed) return;
 		this.#log(`${label}:${turn.id}`);
 		this.#killChild();
@@ -650,13 +684,14 @@ export class StreamDriver implements TurnDriver {
 				usage: turn.usage,
 				finished: true,
 				aborted: false,
+				deadline: label,
 			});
 			return;
 		}
-		this.#failTurn(turn, message);
+		this.#failTurn(turn, message, label);
 	}
 
-	#failTurn(turn: ActiveTurn, message: string): void {
+	#failTurn(turn: ActiveTurn, message: string, deadline?: "timeout" | "stall"): void {
 		this.#settle(turn, {
 			conversationId: turn.conversationId,
 			status: "ERROR",
@@ -665,6 +700,7 @@ export class StreamDriver implements TurnDriver {
 			usage: turn.usage,
 			finished: true,
 			aborted: false,
+			deadline,
 		});
 	}
 

package/src/provider.ts

@@ -43,9 +43,22 @@ import { GATE_MARKER, mapNativeToShadow, stripMarkerFields } from "./approval-ga
 import type { ApprovalDecision, ApprovalPayload, ApprovalParkApi } from "./mcp-server.js";
 import path from "node:path";
 import { TurnDiffContext, createExecGitOps, formatInlineDiff, parseEditToolInput } from "./diff-render.js";
+import { stageSyspromptAgent } from "./sysprompt-agent.js";
 
 const DEFAULT_TIMEOUT_MIN = 10;
 
+/** Warned once per process: config.agent set while the system prompt needs
+ *  the staged carrier agent (issue #2 inline-block fallback). */
+let warnedUserAgentConflict = false;
+
+/** conversationId -> staged carrier agent name. Gate-closed turns look the
+ *  name up here so a conversation's agent field never flips: a change would
+ *  recycle the agy process mid-conversation (profile drift), and a respawn
+ *  must reload THAT conversation's own staged instructions. Content-addressed
+ *  staging (one dir per body) keeps sibling conversations from overwriting
+ *  each other's files. */
+const stagedAgentByConversation = new Map<string, string>();
+
 /** Zero-usage helper. agy doesn't expose token counts; pi's cost math gets
  *  zeros (we're not billing through this provider). */
 function zeroUsage(): Usage {
@@ -1182,6 +1195,10 @@ async function runTurnDriver(
 	}
 
 	let handle: TurnHandle;
+	// Name of the carrier agent staged for THIS turn's fresh conversation, if
+	// any. Recorded into stagedAgentByConversation once the outcome binds the
+	// conversation id, so later gate-closed turns pass the same agent.
+	let stagedAgentName: string | undefined;
 	if (isContinuation) {
 		const active = deps.driver.reentry();
 		if (!active) {
@@ -1225,12 +1242,44 @@ async function runTurnDriver(
 		// The uri is suffixed per turn so a deduping server cannot serve stale
 		// content on turn 2+.
 		const embeddedDigest = deps.engine === "acp" && digest ? digest : undefined;
-		// Fresh conversation only: agy stores the block in its own history, so
-		// re-sending it every turn would bloat each prompt and bust the cache.
-		const sysPrompt =
-			config.systemPrompt && !existing?.conversationId
-				? getCurrentSystemPrompt(context.messages) || undefined
-				: undefined;
+		// G10, fresh conversations only (bound conversations ride agy's own
+		// history; re-sending would bloat every prompt and bust the cache).
+		// stream-json delivery is a staged agent file, NOT prompt text: agy's
+		// stream-json path silently drops any turn past a ~25KB input cap and
+		// the dropped turn leaves the conversation permanently unresponsive
+		// (issue #2, probed 2026-09-30), and the block routinely crossed it.
+		// ACP keeps the inline block (JSON-RPC transport; --agent is a CLI
+		// feature). A user-configured agent always wins: never clobber it.
+		const gateOpen = config.systemPrompt && !existing?.conversationId;
+		const rawSysPrompt = gateOpen ? getCurrentSystemPrompt(context.messages) || undefined : undefined;
+		let sysPrompt = rawSysPrompt;
+		let agent = config.agent;
+		if (deps.engine !== "acp") {
+			if (rawSysPrompt && !config.agent) {
+				const stagedName = stageSyspromptAgent(
+					[SYSTEM_PROMPT_PREAMBLE, rawSysPrompt, TOOL_PRIORITY_NOTE].join("\n\n"),
+				);
+				if (stagedName) {
+					agent = stagedName;
+					sysPrompt = undefined;
+					stagedAgentName = stagedName;
+				}
+				// Staging failed: inline fallback. The silent-drop guard below
+				// keeps the resulting cap failure visible instead of quiet.
+			} else if (rawSysPrompt && config.agent && !warnedUserAgentConflict) {
+				warnedUserAgentConflict = true;
+				deps.log?.(
+					"sysprompt-agent-conflict",
+					{ agent: config.agent, effect: "system prompt ships inline in the prompt (over-cap drop risk)" },
+					"warn",
+				);
+			} else if (!rawSysPrompt && !config.agent && existing?.conversationId) {
+				// Gate closed (bound conversation): pass the carrier staged for
+				// THIS conversation, if any, so the driver profile never drifts on
+				// "agent" and a respawned process reloads its own instructions.
+				agent = stagedAgentByConversation.get(existing.conversationId);
+			}
+		}
 		const fullPrompt =
 			late.length > 0
 				? buildLateResultPrompt(late, prompt || undefined)
@@ -1242,12 +1291,12 @@ async function runTurnDriver(
 				effort,
 				mode: config.mode,
 				skipPermissions: config.skipPermissions,
-				agent: config.agent,
 				timeoutMin: config.turnTimeoutMin,
 				inactivityMin: config.inactivityTimeoutMin,
 				conversationId: existing?.conversationId ?? null,
 				prompt: fullPrompt,
 				images: images.length > 0 ? images : undefined,
+				agent,
 				contextBlock: embeddedDigest
 					? {
 							uri: `urn:pi-bridge:context-digest/${messageCount}`,
@@ -1282,12 +1331,74 @@ async function runTurnDriver(
 	}
 
 	const outcome = await handle.outcome;
+	// Issue #2 recovery paths. agy's stream-json prompt path silently drops an
+	// over-cap turn (SUCCESS, empty response, zero usage, NO model step) and a
+	// dropped turn leaves the conversation permanently unresponsive, so both
+	// failures clear the binding instead of settling a quiet empty reply —
+	// settling OK here would persist a dead conversation for every later turn
+	// (probe 2026-09-30: resume of a dropped-turn conversation never returns
+	// a result frame). stream-json only: the ACP driver leaves the evidence
+	// fields undefined.
+	const silentDrop = outcome.status === "OK" && outcome.modelOutputSeen === false;
+	const poisonedResume =
+		outcome.status === "ERROR" &&
+		outcome.deadline !== undefined &&
+		outcome.sawResult === false &&
+		Boolean(existing?.conversationId);
+	if (silentDrop || poisonedResume) {
+		if (existing?.conversationId || outcome.conversationId) {
+			store.delete(key);
+			if (outcome.conversationId) stagedAgentByConversation.delete(outcome.conversationId);
+		}
+		deps.log?.(
+			"turn-error",
+			{
+				reason: silentDrop ? "silent-overcap-drop" : "poisoned-conversation",
+				conversation: outcome.conversationId ?? null,
+			},
+			"error",
+		);
+		// A deadline with no model output is a stall/timeout, not the over-cap
+		// signature: label it by its real cause (the deadline guard's recovered-
+		// answer probe can settle OK with an empty response after the kill).
+		const dropCause = outcome.deadline
+			? "the turn hit its time limit and produced no model output"
+			: "the prompt was silently dropped (agy discards prompts past ~25KB with no error)";
+		finalize(
+			stream,
+			blocks,
+			"error",
+			silentDrop
+				? `agy returned success but produced no model output: ${dropCause}. Common cause: a very large pasted prompt. The conversation binding was cleared; retry with a smaller prompt.`
+				: "agy stopped responding on the resumed conversation (no response frame before the deadline; the conversation is dead). The binding was cleared, so the next antigravity turn starts a fresh conversation.",
+		);
+		return;
+	}
 	if (outcome.conversationId) {
-		store.set(key, {
-			conversationId: outcome.conversationId,
-			lastStepIdx: -1,
-			lastMessageCount: messageCount,
-		});
+		// A different id than the stored one means the driver recreated the
+		// conversation under us (ACP session-load fallback, stream-json CLI
+		// dropping a stale --conversation). The recreated conversation has seen
+		// NOTHING, so the record's watermark would starve the digest forever and
+		// its bound id would keep the sysPrompt gate closed. Drop the record:
+		// the next turn resumes from watermark 0 with the gate re-armed (issue
+		// #1). The recreation turn itself is past the gate, so it is the
+		// documented residual; recovery starts on the next turn.
+		if (existing?.conversationId && outcome.conversationId !== existing.conversationId) {
+			store.delete(key);
+			stagedAgentByConversation.delete(existing.conversationId);
+		} else if (outcome.status === "OK" && !outcome.aborted) {
+			store.set(key, {
+				conversationId: outcome.conversationId,
+				lastStepIdx: -1,
+				lastMessageCount: messageCount,
+			});
+			if (stagedAgentName) stagedAgentByConversation.set(outcome.conversationId, stagedAgentName);
+		}
+		// A failed or aborted turn on the SAME conversation keeps the pre-turn
+		// record: whether the prompt actually landed in agy's DB is not
+		// observable from here. Keeping the watermark re-delivers the missed
+		// turn in the next digest (bounded by the digest cap); advancing it
+		// would starve the conversation of context it may never have received.
 	}
 	if (outcome.aborted) {
 		finalize(stream, blocks, "aborted", "Operation aborted");

package/src/sessions.ts

@@ -68,6 +68,7 @@ export class SessionStore {
 	private readonly path: string;
 	private cache: StoreMap = {};
 	private readonly dirty = new Set<string>();
+	private readonly removed = new Set<string>();
 	private writeChain: Promise<void> = Promise.resolve();
 
 	constructor(storePath: string = STORE_PATH) {
@@ -100,6 +101,7 @@ export class SessionStore {
 	set(key: string, session: AgySession): void {
 		this.cache[key] = session;
 		this.dirty.add(key);
+		this.removed.delete(key);
 		// Serialize through a chain so concurrent sets don't interleave renames.
 		this.writeChain = this.writeChain
 			.then(() => this.persist())
@@ -108,6 +110,22 @@ export class SessionStore {
 			});
 	}
 
+	/** Drop one session binding and persist the deletion. Used when the driver
+	 *  recreated the conversation under us: the record's watermark claims
+	 *  history the new conversation never saw, and its bound id keeps the
+	 *  sysPrompt gate closed. Dropping resets the watermark to 0 AND re-arms
+	 *  the gate on the next turn (issue #1). The write is queued. */
+	delete(key: string): void {
+		delete this.cache[key];
+		this.dirty.delete(key);
+		this.removed.add(key);
+		this.writeChain = this.writeChain
+			.then(() => this.persist())
+			.catch(() => {
+				/* swallow; next write retries */
+			});
+	}
+
 	private async persist(): Promise<void> {
 		const dir = path.dirname(this.path);
 		await fs.promises.mkdir(dir, { recursive: true });
@@ -126,6 +144,9 @@ export class SessionStore {
 		for (const key of this.dirty) {
 			merged[key] = this.cache[key];
 		}
+		for (const key of this.removed) {
+			delete merged[key];
+		}
 
 		const tmp = `${this.path}.${process.pid}.tmp`;
 		await fs.promises.writeFile(tmp, JSON.stringify(merged, null, 2) + "\n", {
@@ -133,6 +154,10 @@ export class SessionStore {
 		});
 		await fs.promises.rename(tmp, this.path);
 		this.dirty.clear();
+		// Mirror dirty: once the deletion is durable, stop re-asserting it. A
+		// later unrelated persist must not destroy a record another process
+		// wrote for that key after our delete landed.
+		this.removed.clear();
 	}
 
 	/** Wipe all session bindings (forces fresh agy conversations on every
@@ -140,6 +165,7 @@ export class SessionStore {
 	clear(): void {
 		this.cache = {};
 		this.dirty.clear();
+		this.removed.clear();
 		this.writeChain = this.writeChain
 			.then(async () => {
 				const tmp = `${this.path}.${process.pid}.tmp`;

package/src/sysprompt-agent.ts

@@ -0,0 +1,109 @@
+// G10 delivery for the stream-json engine: staged system-prompt agent.
+//
+// agy's stream-json prompt path silently drops any turn past a ~25KB input
+// cap (probed 2026-09-30, issue #2: status SUCCESS, empty response, zero
+// usage, no error — and the dropped turn leaves the conversation permanently
+// unresponsive to later input). The pi system prompt block used to ride the
+// first prompt of every fresh conversation and routinely crossed that cap,
+// killing the whole session. It now stages as an agy agent file discovered
+// under ~/.gemini/config/agents and passed via --agent: the CLI reads agent
+// files from disk, off the prompt line, so the cap never applies.
+//
+// Frontmatter keeps agy's DEFAULTS on purpose (no excludeDefaultComponents,
+// no tools list, no inheritMcp override): provider sessions need the normal
+// toolset and the bridge MCP config for G9 round-trips. Contrast the ask-tool
+// reviewer agent, which strips everything for sandboxing.
+//
+// Lifecycle: one agent dir per DISTINCT body (content-addressed by sha256);
+// two conversations with different system prompts in one process stage two
+// dirs and never overwrite each other, so a driver respawn mid-conversation
+// always reloads that conversation's own instructions. Same body -> same dir
+// (write-once; identical bytes are never rewritten). The name stays stable
+// across the turns of a conversation so the driver's profile comparison
+// never recycles on "agent" drift. The .pid marker lets sweepStaleWebAgents
+// prune orphans (same doctrine as the web delegates and the ask-tool
+// reviewer).
+
+import { createHash, randomBytes } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { sweepStaleWebAgents } from "./web-tools.js";
+
+export const SYS_AGENT_PREFIX = "pi-bridge-sys-";
+
+/** AGY_AGENTS_ROOT override for tests and sandboxes (same contract as the
+ *  ask-tool reviewer root). */
+export function syspromptAgentsRoot(): string {
+	return process.env.AGY_AGENTS_ROOT ?? path.join(os.homedir(), ".gemini", "config", "agents");
+}
+
+/** agent.md for the carrier. The body is the pi system prompt composed by the
+ *  provider (preamble + transcript system prompt + tool-priority note). */
+export function syspromptAgentMd(name: string, body: string): string {
+	return [
+		"---",
+		`name: ${name}`,
+		"description: Pi bridge system-prompt carrier: pi operating instructions plus project AGENTS.md context",
+		"mainAgent: true",
+		"model: inherit",
+		"---",
+		"",
+		body,
+		"",
+	].join("\n");
+}
+
+interface Staged {
+	root: string;
+	name: string;
+	dir: string;
+}
+
+/** Content-addressed staging cache: body sha256 -> staged dir. Two
+ *  conversations with different system prompts in one process must never
+ *  share a carrier file (a rewrite would leak one conversation's instructions
+ *  into the other's respawned agy process). */
+const stagedByHash = new Map<string, Staged>();
+
+function bodyHash(body: string): string {
+	return createHash("sha256").update(body).digest("hex").slice(0, 12);
+}
+
+/** Stage the carrier agent with `body` as its instructions. Content-addressed:
+ *  the same body reuses its dir (no rewrite), a new body gets a fresh dir.
+ *  Returns the agent name for --agent, or null when staging failed — the
+ *  caller then falls back to the legacy inline prompt block, where the
+ *  silent-drop guard keeps the cap risk visible. */
+export function stageSyspromptAgent(
+	body: string,
+	opts: { agentsRoot?: string } = {},
+): string | null {
+	try {
+		const root = opts.agentsRoot ?? syspromptAgentsRoot();
+		const hash = bodyHash(body);
+		const cached = stagedByHash.get(hash);
+		if (cached && cached.root === root) return cached.name;
+		sweepStaleWebAgents(root, Date.now(), SYS_AGENT_PREFIX);
+		fs.mkdirSync(root, { recursive: true });
+		// Nonce: two pi processes staging the same body must not fight over one
+		// dir; the pid plus nonce keeps every staging attempt self-contained.
+		const name = `${SYS_AGENT_PREFIX}${hash}-${process.pid}-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
+		const dir = path.join(root, name);
+		fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+		fs.writeFileSync(path.join(dir, ".pid"), `${process.pid}\n`, { mode: 0o600 });
+		fs.writeFileSync(path.join(dir, "agent.md"), syspromptAgentMd(name, body), {
+			mode: 0o600,
+		});
+		const entry: Staged = { root, name, dir };
+		stagedByHash.set(hash, entry);
+		return entry.name;
+	} catch {
+		return null;
+	}
+}
+
+/** Test hook: forget the staging cache without touching the filesystem. */
+export function resetSyspromptAgentForTests(): void {
+	stagedByHash.clear();
+}