@estebanforge/pi-antigravity-bridge 1.8.0 → 1.8.1

package/CHANGELOG.md

@@ -2,8 +2,32 @@
 
 All notable changes to this project will be documented in this file.
 
+## 1.8.1 — 2026-10-13
+
 ## [Unreleased]
 
+### Changed
+
+- **The engine picker rides the shared dialog kit.** `showEnginePicker` now renders through `@estebanforge/pi-tui-dialogs`' new `dialogChoice` primitive (extracted from this picker) instead of a hand-rolled SelectList overlay: same title, intro, options, preselect, and esc-means-decide-later semantics, now drawn in the kit's framed style. Esc resolves `undefined` instead of `null`; both call sites are updated.
+
+### Fixed
+
+- **An unrelated config save no longer promotes a legacy install to the acp default.** `saveConfig` merged `DEFAULTS` over the raw file, so any save (mode, digest, the patch-cleanup notice) on a config file predating the engine key wrote `engine: "acp"` to disk, defeating the legacy continuity rule on the next start. `saveConfig` now persists the resolved legacy engine (`stream-json`) for key-less files, honors explicit `patch.engine`, and never bakes `AGY_ENGINE` into the file.
+
+- **The choice modal windows its option list.** `dialogChoice` computed its SelectList window at construction and handed the frame the full list, so on short terminals or with a long description the frame clipped trailing options while the selection could still move into the invisible region. The list viewport now follows the frame height per render (the settings menu's rule), with room for SelectList's `(n/m)` scroll-position line, and the tests pin a 10-option dialog on a 12-row terminal.
+
+- **New installs default to the ACP engine; stream-json is the fallback.** `config.engine` unset (no file key, no `AGY_ENGINE`) now resolves to `acp` (`DEFAULT_ENGINE` in config.ts), and stale/garbage stored values fall back to that same default instead of stream-json. One carve-out for continuity: an existing config file that predates the engine key (no `engine` field at all) keeps `stream-json` — the acp default is for new installs, and an existing install must not silently start the ~1.5 GB binary download. The first-run picker preselects acp and explains the trade in that order; the existing startup self-heal covers the rest (binary install + sign-in chain on engine acp). Both engines stay fully supported and every existing config with a saved engine is untouched.
+
+- **The `/agy` settings picker refuses plan against the on-disk engine too.** The plan-mode guard checked only the session-latched engine; since the Switch engine row can change the on-disk engine mid-session without a restart, it now blocks on either (latched or saved) so plan + ACP can never land on disk through the settings surface.
+
+### Added
+
+- **The `/agy` settings picker has a Switch engine row again** (first row, showing the active engine as its value). It is deliberately not a cycle row: Enter on it closes settings and opens the same picker modal `/agy engine` uses — explanations, plan-blocks-acp guard, and the acp pick's self-service setup + sign-in chain all come from the one shared path. Esc in the picker changes nothing.
+
+### Fixed
+
+- **ACP sign-in no longer fails on servers that authenticate without writing `acp_token.json`.** Server 1.1.1 can answer `authenticate` OK from legacy `~/.gemini` credential artifacts (observed on darwin/arm64: instant OK, no browser, no token file, working turns) — but `/agy auth` treated the absent token file as a distinct failure and the session-start self-heal nagged login-pending forever on a fully working setup. The token file is a server-internal detail, not a contract. `/agy auth` now verifies the token-absent branch with a live `session/new` probe on the same connection: probe success is a real sign-in (result carries a note, the success toast says so), probe failure is an honest "no usable credentials" error that covers the lazily started browser flow. Both verified paths record a bridge-side marker (`~/.pi/agent/antigravity-bridge/acp-auth-verified.json`, a boolean plus timestamp, never a credential); `ensureAcpReady` treats the marker as login-done, `/agy doctor` shows `oauth-personal (verified, no token file)`, and any server-side `-32000` clears the marker so a stale one never masks a real logout.
+
 ## [1.8.0] - 2026-10-12
 
 ### Changed

package/README.md

@@ -1,6 +1,6 @@
 # pi-antigravity-bridge
 
-A Gemini model provider **and** the `AskAntigravity` delegation tool for [pi](https://github.com/earendil-works/pi), built on Google's official Antigravity binaries: the `agy` CLI by default, or **Google's official ACP server** (opt-in). It registers `antigravity/gemini-*` models in pi's `/model` picker (streaming), and provides the `AskAntigravity` tool for one-shot delegation - the same combined shape as `pi-claude-bridge`.
+A Gemini model provider **and** the `AskAntigravity` delegation tool for [pi](https://github.com/earendil-works/pi), built on Google's official Antigravity binaries: **Google's official ACP server** by default (new installs), with the `agy` CLI engine kept as the fallback. It registers `antigravity/gemini-*` models in pi's `/model` picker (streaming), and provides the `AskAntigravity` tool for one-shot delegation - the same combined shape as `pi-claude-bridge`.
 
 
 If you also have [`@estebanforge/pi-ask-antigravity`](https://github.com/EstebanForge/pi-extensions/tree/main/packages/pi-ask-antigravity) installed, this bridge takes over: pi-ask-antigravity detects the bridge and registers nothing, so the `AskAntigravity` tool is never duplicated.
@@ -13,12 +13,12 @@ Multi-turn works. The provider binds a pi session to an agy conversation id (per
 
 ### Two engines
 
-Turns run through one of two engines behind the same provider surface (`config.engine`, default `stream-json`):
+Turns run through one of two engines behind the same provider surface (`config.engine`, default `acp`):
 
-- **stream-json** (default): the persistent `agy` CLI process. The tested default; live token usage; conversation resume via `--conversation`.
-- **acp** (beta): Google's official ACP server (`agy_acp_server.par`), JSON-RPC 2.0 over stdio. Beta: parity-verified live against the current build (RC01) - text streaming, multi-turn resume via `session/load`, bridge tools, effort switching, serialization, abort recovery (see `scripts/parity-live.mjs`). Two known RC01 gaps remain: no usage fields (token display runs on live client-side estimates via `acp.usageEstimate`, default `estimate`, streamed per delta and superseded automatically the day the server starts sending real per-turn usage) and no cancel (abort tears the server down and reloads it next turn).
+- **acp** (default): Google's official ACP server (`agy_acp_server.par`), JSON-RPC 2.0 over stdio. Parity-verified live against the current build (RC01) - text streaming, multi-turn resume via `session/load`, bridge tools, effort switching, serialization, abort recovery (see `scripts/parity-live.mjs`). Two known RC01 gaps remain: no usage fields (token display runs on live client-side estimates via `acp.usageEstimate`, default `estimate`, streamed per delta and superseded automatically the day the server starts sending real per-turn usage) and no cancel (abort tears the server down and reloads it next turn).
+- **stream-json** (fallback): the persistent `agy` CLI process. Live token usage; conversation resume via `--conversation`.
 
-The choice of engine is left to the user, with the trade-offs explained in the tool: a first-run picker modal asks once on a fresh install (stream-json preselected; `esc` defers, and the modal reappears next start), and `/agy engine` with no arguments reopens it anytime. An `acp` pick downloads the ~1.5 GB server binary and starts the Google sign-in immediately; a restart applies the engine. With stream-json active and the `agy` binary missing, pi warns on every start until the binary is found.
+The choice of engine is left to the user, with the trade-offs explained in the tool: a first-run picker modal asks once on a fresh install (acp preselected; `esc` defers, and the modal reappears next start), and `/agy engine` with no arguments reopens it anytime. An `acp` pick downloads the ~1.5 GB server binary and starts the Google sign-in immediately; a restart applies the engine. Fresh installs default to acp and the startup self-heal installs the binary + chains the sign-in; with stream-json active and the `agy` binary missing, pi warns on every start until the binary is found.
 
 Full capability comparison, switching, and setup/auth details: [docs/ENGINES.md](docs/ENGINES.md).
 
@@ -147,7 +147,7 @@ The `activate_skill` catalog mirrors pi's directory-based skill discovery: the t
 /agy tools [hide|show <name>|reset]   session-only bridge-catalog hides (multi-word names OK; reset restores the full set; bare lists exposed + hidden; never touches saved config)
 /agy web on|off            register the agy_web_search + agy_read_url pi tools for ANY provider's model (default off; applies on the next pi start or /reload; every call spawns agy and spends Antigravity quota)
 /agy acp-bin <path|auto>  point the ACP engine at a specific server binary (auto = setup installs, or AGY_ACP_BIN; applies on the next ACP turn)
-/agy engine acp|stream-json   switch the turn engine (restart to apply; default stream-json; acp is beta and runs self-service setup: binary install + auth bootstrap). No arguments opens the engine picker modal (TUI)
+/agy engine acp|stream-json   switch the turn engine (restart to apply; default acp, stream-json is the fallback; acp runs self-service setup: binary install + auth bootstrap). No arguments opens the engine picker modal (TUI)
 /agy auth-manual             manual ACP credential setup (fallback; auto-setup normally covers this; default login = your Antigravity subscription, same account as the agy CLI)
 /agy clear                drop all session bindings (force fresh conversations)
 ```

package/extensions/index.ts

@@ -58,11 +58,12 @@ import { hookScriptSource, removeGateHooks, stageGateHooks, sweepWorkspaceGateGr
 import { StreamDriver } from "../src/driver.js";
 import { AcpDriver } from "../src/acp/driver.js";
 import { runAcpAuth } from "../src/acp/auth.js";
+import { setAuthInvalidatedHook } from "../src/acp/connection.js";
 import { setupAuthUrlCapture } from "../src/acp/browser-capture.js";
-import { ensureAcpReady, inspectAcpSetup } from "../src/acp/setup.js";
+import { clearAcpAuthVerified, ensureAcpReady, inspectAcpSetup } from "../src/acp/setup.js";
 import type { TurnDriver, TurnOutcome } from "../src/driver-types.js";
 import { CONFIG_PATH, loadConfig, logsDir, MAX_TURN_CAP_MIN, parseCapMinutes, saveConfig, type AgyMode, type BridgeTools, type Engine, type ThinkingTier } from "../src/config.js";
-import { agyMissingMessage, isAgyInstalled, savedEngineMessage, showEnginePicker, shouldOfferEnginePicker } from "../src/engine-picker.js";
+import { agyMissingMessage, ENGINE_SETTINGS_ROW_ID, engineSettingsRow, isAgyInstalled, savedEngineMessage, showEnginePicker, shouldOfferEnginePicker } from "../src/engine-picker.js";
 import { checkAgyCliVersion, describeAgyVersionCheck, MIN_AGY_VERSION } from "../src/agy-version.js";
 import { isValidAgyAgentName, listAgyAgents } from "../src/agents.js";
 import { formatSubagentRoster, SubagentRoster } from "../src/subagent-roster.js";
@@ -98,6 +99,11 @@ import { Type } from "typebox";
 import { patchStatus, restorePatch } from "../src/patch-cleanup.js";
 import { withDialogLock } from "../src/dialog-lock.js";
 
+// The server disowning our verified marker (-32000 anywhere: turn, session
+// new/load, cancel) must drop it, or ensureAcpReady keeps reporting a login
+// that no longer exists. Wire once at load; the hook is a no-op until set.
+setAuthInvalidatedHook(() => clearAcpAuthVerified());
+
 // Last UI seen (session_start / /agy commands). The ACP login URL arrives
 // via the driver log sink, which has no command context; the stash lets that
 // sink toast instead of only logging to stderr. Module scope: both the
@@ -217,9 +223,9 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		// login URLs would silently stop appearing on headless boxes.
 		console.error("[antigravity-bridge] OAuth URL capture unavailable; login URL surfacing is off (setup failed).");
 	}
-	// Two turn engines behind one contract (plan §9): stream-json (tested
-	// default) and the official ACP server (opt-in via config.engine, off by
-	// default). Neither spawns anything until its first turn.
+	// Two turn engines behind one contract (plan §9): the official ACP
+	// server (default for new installs) and the stream-json `agy` CLI
+	// (fallback). Neither spawns anything until its first turn.
 	// ACP log routing: only genuine failures reach stderr. Routine lifecycle
 	// (driver-created, spawn, session-new, ...) stays in the driver's
 	// #lifecycle ring buffer, visible via /agy doctor. An unfiltered sink fired
@@ -605,8 +611,12 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 				log: acpLog,
 			});
 			fileLog.log("acp-auth", r.ok ? { ok: true } : { ok: false, error: r.error }, r.ok ? "info" : "warn");
-			if (r.ok) ctx.ui.notify("Signed in. The ACP engine is ready; restart applies it.", "info");
-			else ctx.ui.notify(`ACP sign-in failed (${r.error}).\nRun /agy auth to retry; /agy auth-manual has manual steps.`, "warning");
+			if (r.ok) {
+				ctx.ui.notify(
+					r.note ? `Signed in (${r.note}). The ACP engine is ready; restart applies it.` : "Signed in. The ACP engine is ready; restart applies it.",
+					"info",
+				);
+			} else ctx.ui.notify(`ACP sign-in failed (${r.error}).\nRun /agy auth to retry; /agy auth-manual has manual steps.`, "warning");
 		} catch (err) {
 			ctx.ui.setStatus("agy-acp", undefined);
 			fileLog.log("acp-setup", { error: String(err) }, "warn");
@@ -1102,7 +1112,7 @@ function statusText(ctx: AgyCommandCtx): string {
 	const source = ctx.usingFallback ? "fallback (agy models failed)" : "discovered";
 	return [
 		"Antigravity bridge",
-		`  engine:        ${config.engine}${config.engine === "acp" ? " (official server, opt-in)" : ""}`,
+		`  engine:        ${config.engine}${config.engine === "stream-json" ? " (agy CLI fallback)" : " (official server)"}`,
 		`  models:        ${ctx.entries.length} ${source}`,
 		...settingsRows(ctx),
 		`  sessions:      ${ctx.store.size} bound`,
@@ -1222,23 +1232,7 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 					// the explanations, not a bare usage line. Semantics match the
 					// direct path above: plan blocks acp, an acp pick chains setup
 					// + sign-in immediately, restart applies the switch.
-					const current = loadConfig().engine;
-					const picked = await showEnginePicker(ui);
-					if (picked === null) {
-						ui.notify(`engine unchanged: ${current}.`, "info");
-						return;
-					}
-					if (picked === current) {
-						ui.notify(`engine is already ${current}. Restart applies it if set this session.`, "info");
-						return;
-					}
-					if (picked === "acp" && loadConfig().mode === "plan") {
-						ui.notify("mode is plan; the ACP engine has no plan mode. /agy mode accept-edits first.", "warning");
-						return;
-					}
-					saveConfig({ engine: picked });
-					ui.notify(savedEngineMessage(picked), "info");
-					if (picked === "acp") void ctx.runAcpPickSetup({ ui });
+					await runEngineModal(ui, ctx);
 				} else {
 					ui?.notify(`current engine: ${loadConfig().engine}\nusage: /agy engine stream-json|acp`, "info");
 				}
@@ -1282,7 +1276,10 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				});
 				ctx.fileLog.log("acp-auth", r.ok ? { ok: true } : { ok: false, error: r.error }, r.ok ? "info" : "warn");
 				if (r.ok) {
-					ui?.notify("Signed in. The ACP engine is ready; takes effect on the next pi start (or /reload).", "info");
+					ui?.notify(
+						r.note ? `Signed in (${r.note}). The ACP engine is ready; takes effect on the next pi start (or /reload).` : "Signed in. The ACP engine is ready; takes effect on the next pi start (or /reload).",
+						"info",
+					);
 				} else {
 					ui?.notify(`ACP sign-in failed (${r.error}).\nRun /agy auth to retry; /agy auth-manual has manual steps.`, "warning");
 				}
@@ -1794,14 +1791,17 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 }
 
 /** Interactive settings picker (TUI only). Rows: the runtime config surface
- *  (mode, permissions, model, thinking, bridge, digest, system prompt).
- *  Engine switching is command-only: /agy engine stream-json|acp (the
- *  command also runs self-service binary + auth setup for acp). */
+ *  (mode, permissions, model, thinking, bridge, digest, system prompt) plus
+ *  the engine row, which resolves the menu on Enter and opens the same
+ *  picker modal as /agy engine (self-service binary + auth setup for acp). */
 async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promise<void> {
 	const config = loadConfig();
 	const pending: PendingConfig = {};
 
 	const rows: DialogRow[] = [
+		// Value-less action row: DialogMenu resolves the menu with this id on
+		// Enter (see runEngineModal below); every other row cycles in place.
+		engineSettingsRow(config.engine),
 		{
 			id: "mode",
 			label: "Execution mode",
@@ -1892,7 +1892,7 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 		},
 	];
 
-	await ui.custom<void>(
+	const resolved = await ui.custom<string | undefined>(
 		(host, theme, _kb, done) => {
 			const menu = new DialogMenu(
 				host,
@@ -1928,7 +1928,7 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 						}
 					},
 				},
-				() => done(),
+				(rowId) => done(rowId),
 			);
 			return {
 				render: (w: number) => menu.render(w),
@@ -1942,14 +1942,18 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 		DIALOG_OPTIONS,
 	);
 
-	if (Object.keys(pending).length === 0) return;
+	if (Object.keys(pending).length === 0) {
+		if (resolved === ENGINE_SETTINGS_ROW_ID) await runEngineModal(ui, ctx);
+		return;
+	}
 
 	// The picker cannot switch engines (command-only: /agy engine), but the
-	// mode row can still produce plan while the latched engine is acp. Plan
-	// cannot be enforced on provider turns on either engine (#1181 + RC01);
-	// refuse the combination.
+	// mode row can still produce plan while the engine is acp - either the
+	// session-latched engine or the on-disk one, which the Switch engine row
+	// can change mid-session without a restart. Plan cannot be enforced on
+	// provider turns on either engine (#1181 + RC01); refuse the combination.
 	const nextMode = pending.mode ?? config.mode;
-	if (nextMode === "plan" && ctx.engine === "acp") {
+	if (nextMode === "plan" && (ctx.engine === "acp" || config.engine === "acp")) {
 		ui.notify(
 			"plan cannot be enforced on provider turns on either engine (google-antigravity/antigravity-cli#1181; ACP additionally has no plan mode, RC01). /agy mode accept-edits.",
 			"warning",
@@ -1983,4 +1987,30 @@ async function openAgyPicker(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promis
 			"error",
 		);
 	}
+
+	if (resolved === ENGINE_SETTINGS_ROW_ID) await runEngineModal(ui, ctx);
+}
+
+/** The engine-pick modal shared by /agy engine (no args) and the settings
+ *  picker's engine row: the same explanations as the first-run wizard and the
+ *  same semantics — plan blocks acp, an acp pick chains setup + sign-in
+ *  immediately, restart applies the switch. */
+async function runEngineModal(ui: ExtensionUIContext, ctx: AgyCommandCtx): Promise<void> {
+	const current = loadConfig().engine;
+	const picked = await showEnginePicker(ui);
+	if (picked === undefined) {
+		ui.notify(`engine unchanged: ${current}.`, "info");
+		return;
+	}
+	if (picked === current) {
+		ui.notify(`engine is already ${current}. Restart applies it if set this session.`, "info");
+		return;
+	}
+	if (picked === "acp" && loadConfig().mode === "plan") {
+		ui.notify("mode is plan; the ACP engine has no plan mode. /agy mode accept-edits first.", "warning");
+		return;
+	}
+	saveConfig({ engine: picked });
+	ui.notify(savedEngineMessage(picked), "info");
+	if (picked === "acp") void ctx.runAcpPickSetup({ ui });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/auth.ts

@@ -1,5 +1,5 @@
 import { AcpConnection } from "./connection.js";
-import { hasAcpToken } from "./setup.js";
+import { hasAcpToken, writeAcpAuthVerified } from "./setup.js";
 
 // Explicit sign-in (/agy auth): spawn a short-lived server, send
 // `authenticate` (the RPC that fires the loopback listener + browser OAuth
@@ -9,6 +9,13 @@ import { hasAcpToken } from "./setup.js";
 // blocks until the browser round-trip completes; the observed window is
 // minutes-scale (one flow timed out at ~8.5 minutes), so the timeout is
 // generous.
+//
+// Token-absent after an OK reply is NOT always a failure: server 1.1.1 can
+// authenticate from legacy ~/.gemini credential artifacts and never writes
+// acp_token.json (observed on darwin/arm64 2026-10-13). A live session/new
+// probe separates that from a hollow accept: probe success = signed in
+// (recorded in the bridge-side verified marker), probe failure = the server
+// holds no usable credentials.
 
 export const AUTH_TIMEOUT_MS = 10 * 60_000;
 
@@ -25,18 +32,41 @@ export interface AcpAuthOptions {
 	 *  authenticate replies, but write-after-reply is unverified; after a
 	 *  successful reply the run polls for the token up to this long before
 	 *  SIGTERM, so a laggard write is never killed mid-flight. A token that
-	 *  never appears is a distinct failure, not silent success. */
+	 *  never appears is verified through a live session probe instead of
+	 *  failing outright. */
 	tokenGraceMs?: number;
+	/** Bridge-side verified-sign-in marker. Written on every verified
+	 *  success (token file or live session probe). Default is the real
+	 *  bridge path; tests point this at a fixture. */
+	authVerifiedFile?: string;
 	timeoutMs?: number;
 	log?: (msg: string, data?: unknown) => void;
 }
 
 export interface AcpAuthResult {
 	ok: boolean;
+	/** Present when verified through the session probe: the server
+	 *  authenticated from existing credentials without writing a local
+	 *  token file. Absent on the normal token-file path and on failure. */
+	note?: string;
 	/** Failure reason (spawn, timeout, -32000 family, concurrent run). Absent when ok. */
 	error?: string;
 }
 
+/** Live credential probe for the token-absent branch: a server with usable
+ *  credentials answers session/new; a hollow accept starts (or wants) a
+ *  browser flow and the request times out or errors. Closes the probe
+ *  session; the caller kills the connection either way. */
+async function probeUsableCredentials(conn: AcpConnection, cwd?: string): Promise<boolean> {
+	try {
+		const s = await conn.newSession(cwd ?? process.cwd());
+		await conn.closeSession(s.sessionId).catch(() => {});
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 let authInFlight: Promise<AcpAuthResult> | null = null;
 
 export function runAcpAuth(opts: AcpAuthOptions): Promise<AcpAuthResult> {
@@ -59,11 +89,19 @@ export function runAcpAuth(opts: AcpAuthOptions): Promise<AcpAuthResult> {
 			const deadline = Date.now() + grace;
 			while (!hasAcpToken(opts.tokenDir) && Date.now() < deadline) await sleep(200);
 			if (!hasAcpToken(opts.tokenDir)) {
-				return {
-					ok: false,
-					error: `the server accepted the sign-in, but no token file appeared in ${opts.tokenDir ?? "~/.gemini/antigravity-acp"} within ${Math.round(grace / 1000)}s`,
-				};
+				// authenticate replied but no token file: either the server
+				// authenticated from artifacts outside antigravity-acp, or the
+				// reply is hollow. A live session/new separates the two.
+				if (!(await probeUsableCredentials(conn, opts.cwd))) {
+					return {
+						ok: false,
+						error: `the server accepted the sign-in but holds no usable credentials (session probe failed; token file absent in ${opts.tokenDir ?? "~/.gemini/antigravity-acp"}). Finish the Google sign-in if a browser opened, then retry /agy auth.`,
+					};
+				}
+				writeAcpAuthVerified(opts.authVerifiedFile);
+				return { ok: true, note: "the server authenticated from existing credentials; no browser sign-in was needed" };
 			}
+			writeAcpAuthVerified(opts.authVerifiedFile);
 			return { ok: true };
 		} catch (err) {
 			return { ok: false, error: err instanceof Error ? err.message : String(err) };

package/src/acp/connection.ts

@@ -50,6 +50,16 @@ export class AcpAuthError extends Error {
 	}
 }
 
+/** Fired exactly when the SERVER reports an auth failure (-32000 family).
+ *  The extension entry wires this to clearAcpAuthVerified(): a verified
+ *  marker must never outlive the server disagreeing with it. Kept as a hook
+ *  so the low-level connection stays decoupled from bridge file paths. */
+let authInvalidatedHook: (() => void) | null = null;
+
+export function setAuthInvalidatedHook(fn: (() => void) | null): void {
+	authInvalidatedHook = fn;
+}
+
 export interface AcpConnectionOptions {
 	/** Process working directory for the spawned server. */
 	cwd: string;
@@ -613,6 +623,7 @@ export function translateError(method: string, err: unknown): Error {
 	if (err instanceof AcpAuthError) return err;
 	if (err instanceof JsonRpcResponseError) {
 		if (err.code === -32000) {
+			authInvalidatedHook?.();
 			const detail = typeof err.data === "object" && err.data !== null ? (err.data as { message?: unknown }).message : undefined;
 			const detailText = typeof detail === "string" ? `: ${detail}` : `: ${err.message}`;
 			return new AcpAuthError(`ACP authentication required for ${method}${detailText}. Run /agy auth to sign in; /agy auth-manual has manual steps.`);

package/src/acp/setup.ts

@@ -29,6 +29,10 @@ export interface SetupOptions {
 	installRoot?: string;
 	/** Server settings dir. Default ~/.gemini/antigravity-acp. */
 	geminiDir?: string;
+	/** Bridge-side verified-sign-in marker file. Default
+	 *  ~/.pi/agent/antigravity-bridge/acp-auth-verified.json (tests point this
+	 *  at a fixture to stay hermetic). */
+	authVerifiedFile?: string;
 	/** acp.bin from config (second resolution priority after AGY_ACP_BIN). */
 	configBin?: string;
 	/** Environment. Default process.env (test injection). */
@@ -244,6 +248,41 @@ export function hasAcpToken(dir?: string): boolean {
 	return tokenPresent(dir ?? path.join(os.homedir(), ".gemini", "antigravity-acp"));
 }
 
+/** Bridge-side record that the ACP server proved its own credentials in a
+ *  verified sign-in (runAcpAuth). Needed because servers may authenticate
+ *  from artifacts this module cannot see: 1.1.1 honors legacy ~/.gemini
+ *  credential files (e.g. jetski-standalone-oauth-token) and never writes
+ *  acp_token.json, so the file check alone would nag login-pending forever
+ *  on a working setup. Cleared the moment the server reports an auth error
+ *  (-32000), so a stale marker never masks a real logout. Never holds a
+ *  credential value: a boolean and a timestamp. */
+export function defaultAcpAuthVerifiedPath(): string {
+	return path.join(os.homedir(), ".pi", "agent", "antigravity-bridge", "acp-auth-verified.json");
+}
+
+export function readAcpAuthVerified(file: string = defaultAcpAuthVerifiedPath()): boolean {
+	try {
+		const raw = JSON.parse(fs.readFileSync(file, "utf8")) as { verified?: unknown };
+		return raw.verified === true;
+	} catch {
+		return false;
+	}
+}
+
+export function writeAcpAuthVerified(file: string = defaultAcpAuthVerifiedPath()): void {
+	fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+	fs.writeFileSync(file, `${JSON.stringify({ verified: true, at: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
+}
+
+export function clearAcpAuthVerified(file: string = defaultAcpAuthVerifiedPath()): void {
+	try {
+		fs.rmSync(file, { force: true });
+	} catch {
+		/* best effort: a leftover marker only over-reports readiness, and the
+		   next auth error clears it again. */
+	}
+}
+
 /** Auth state WITHOUT reading any credential value: settings.json carries
  *  only auth.type (+ non-secret gcp placement), acp_token.json is stat()ed. */
 export function readAuthState(dir?: string): AuthState {
@@ -302,8 +341,14 @@ export function resolveInstalledBinary(opts: SetupOptions = {}): BinaryResolutio
 /** Read-only setup state (for /agy doctor): no installs, no writes. */
 export function inspectAcpSetup(opts: SetupOptions = {}): { bin: string | null; source: string | null; auth: string | null } {
 	const binary = resolveInstalledBinary(opts);
-	const auth = readAuthState(defaultGeminiDir(opts));
-	return { bin: binary.bin, source: binary.source, auth: auth.configured ? (auth.type ?? "token") : null };
+	const gdir = defaultGeminiDir(opts);
+	const auth = readAuthState(gdir);
+	if (!auth.configured) return { bin: binary.bin, source: binary.source, auth: null };
+	const type = auth.type ?? "token";
+	// Surface the verified-marker state so a setup that authenticates without
+	// a token file (1.1.1 legacy artifacts) reads as healthy in doctor.
+	const verified = type !== "gemini-api-key" && !tokenPresent(gdir) && readAcpAuthVerified(opts.authVerifiedFile);
+	return { bin: binary.bin, source: binary.source, auth: verified ? `${type} (verified, no token file)` : type };
 }
 
 /** Orchestrate everything the ACP engine needs, in order: binary (install
@@ -358,10 +403,12 @@ export async function ensureAcpReady(opts: SetupOptions = {}): Promise<AcpSetupS
 	}
 	// settings.json alone proves nothing: setup writes it before the login,
 	// the token file only appears after the browser round-trip. oauth-personal
-	// without a token = login still pending, and every caller (switch toast,
-	// session_start self-heal) must keep saying so until the token exists.
-	// gemini-api-key has no browser login; a present token file means done.
-	const needsLogin = auth.type !== "gemini-api-key" && !tokenPresent(gdir);
+	// without a token is login-pending UNLESS a verified sign-in recorded that
+	// this server authenticates from artifacts the bridge cannot see (1.1.1
+	// legacy ~/.gemini credentials; marker written by runAcpAuth, cleared on
+	// any -32000). gemini-api-key has no browser login; a present token file
+	// means done.
+	const needsLogin = auth.type !== "gemini-api-key" && !tokenPresent(gdir) && !readAcpAuthVerified(opts.authVerifiedFile);
 	return {
 		ok: true,
 		bin: binary.bin!,

package/src/config.ts

@@ -38,9 +38,16 @@ export function logsDir(): string {
 	);
 }
 
-/** Which turn engine drives turns. "stream-json" is the tested default;
- *  "acp" is the official-server engine, opt-in (plan §9.5). */
+/** Which turn engine drives turns. "acp" (the official server) is the
+ *  default for new installs; "stream-json" (the `agy` CLI) remains a fully
+ *  supported fallback. */
 export type Engine = "stream-json" | "acp";
+
+/** The engine a fresh install runs when nothing is configured (no file key,
+ *  no AGY_ENGINE): the official ACP server. Unknown/stale stored values also
+ *  fall back here; the first startup's acp self-heal installs the binary and
+ *  chains the sign-in. */
+export const DEFAULT_ENGINE: Engine = "acp";
 export type AgyMode = "accept-edits" | "plan";
 export type ThinkingTier = "low" | "medium" | "high";
 export type BridgeTools = "none" | "mcp" | "all";
@@ -187,7 +194,7 @@ export interface AgyConfig {
 }
 
 const DEFAULTS: AgyConfig = {
-	engine: "stream-json",
+	engine: DEFAULT_ENGINE,
 	mode: "accept-edits",
 	readOnly: false,
 	skipPermissions: true,
@@ -250,9 +257,16 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 	// explicit AGY_MODE=accept-edits when the file says plan, violating the
 	// documented precedence. Check env first.
 	// Engine: narrow to the known set; anything else (incl. the pre-1.3.2
-	// "sqlite" value) falls back to the tested default.
-	const engineRaw = String(process.env.AGY_ENGINE ?? file.engine ?? DEFAULTS.engine).toLowerCase();
-	const engine: Engine = engineRaw === "acp" ? "acp" : "stream-json";
+	// "sqlite" value) falls back to the default engine, same as an absent key.
+	// One absence exception: a config file WITHOUT an engine key belongs to an
+	// existing install (saveConfig persists the resolved legacy engine), and
+	// the acp default is for new installs only - an existing install keeps
+	// the legacy stream-json engine instead of silently starting the ~1.5 GB
+	// acp download. existsSync is false on EACCES too, which reads as fresh
+	// and picks acp; an unreadable config dir is a broken install either way.
+	const freshInstall = !fs.existsSync(configPath);
+	const engineFallback = freshInstall || file.engine !== undefined ? DEFAULT_ENGINE : "stream-json";
+	const engine = narrowEngine(String(process.env.AGY_ENGINE ?? file.engine ?? engineFallback).toLowerCase());
 
 	const mode: AgyMode =
 		process.env.AGY_MODE !== undefined
@@ -377,6 +391,14 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 	};
 }
 
+/** Narrow a raw engine string to the known set; anything unknown (incl. the
+ *  pre-1.3.2 "sqlite" value) falls to the default engine. Shared by
+ *  loadConfig's effective-engine resolution and saveConfig's persistence so
+ *  the two can never drift. */
+function narrowEngine(raw: string): Engine {
+	return raw === "acp" || raw === "stream-json" ? raw : DEFAULT_ENGINE;
+}
+
 /** Atomically persist a config patch (temp + rename). Merges onto the RAW
  *  FILE values, never loadConfig(): env overrides must not be baked into the
  *  file (AGY_READONLY=1 in the env would otherwise persist readOnly: true to
@@ -390,6 +412,13 @@ export function saveConfig(patch: Partial<AgyConfig>, configPath: string = CONFI
 	// triggers normalization (a null becomes the default shape, never null).
 	const fileAcp: Partial<AcpConfig> = file.acp && typeof file.acp === "object" ? file.acp : {};
 	const fileApprovals: Partial<GateConfig> = file.approvals && typeof file.approvals === "object" ? file.approvals : {};
+	// Engine persistence follows loadConfig's continuity rule minus env (env
+	// must never be baked into the file). A legacy file without an engine key
+	// persists "stream-json": the bare DEFAULTS spread below would otherwise
+	// write the acp default into an existing install's file on any unrelated
+	// save, arming the ~1.5 GB download on the next start.
+	const persistedEngine = patch.engine ?? file.engine
+		?? (fs.existsSync(configPath) ? "stream-json" : DEFAULT_ENGINE);
 	const next: AgyConfig = {
 		...DEFAULTS,
 		...file,
@@ -400,6 +429,7 @@ export function saveConfig(patch: Partial<AgyConfig>, configPath: string = CONFI
 			? { approvals: { gateMode: fileApprovals.gateMode ?? DEFAULTS.approvals.gateMode, mode: fileApprovals.mode ?? DEFAULTS.approvals.mode } }
 			: {}),
 		...patch,
+		engine: narrowEngine(String(persistedEngine).toLowerCase()),
 	};
 	const dir = path.dirname(configPath);
 	fs.mkdirSync(dir, { recursive: true });

package/src/engine-picker.ts

@@ -7,43 +7,37 @@
 // Every start with the stream-json engine active also re-checks that the
 // `agy` binary exists and warns until it does (re-auth is out of scope).
 //
-// UI: tui.md "Pattern 1" - SelectList framed by DynamicBorder inside pi's
-// native overlay (the window feel pi-rtk builds its modal on).
+// UI: the shared framed choice modal from @estebanforge/pi-tui-dialogs
+// (dialogChoice): one decision statement, a closed option list, esc cancels.
 
 import type { ExtensionUIContext } from "@earendil-works/pi-coding-agent";
-import { DynamicBorder } from "@earendil-works/pi-coding-agent";
-import {
-	Container,
-	type SelectItem,
-	SelectList,
-	Spacer,
-	Text,
-} from "@earendil-works/pi-tui";
+import { dialogChoice, type ChoiceOption, type DialogContext, type DialogRow } from "@estebanforge/pi-tui-dialogs";
 import fs from "node:fs";
 import path from "node:path";
-import type { Engine } from "./config.js";
+import { DEFAULT_ENGINE, type Engine } from "./config.js";
 
-/** Picker order is the default answer order: stream-json first. */
-export const ENGINE_PICKER_ITEMS: SelectItem[] = [
-	{
-		value: "stream-json",
-		label: "Stream-JSON CLI",
-		description: "default, recommended",
-	},
+/** Picker order is the default answer order: acp (the default engine)
+ *  preselected first, stream-json as the fallback. */
+export const ENGINE_PICKER_ITEMS: ChoiceOption[] = [
 	{
 		value: "acp",
 		label: "ACP server (official Google)",
-		description: "second sign-in, ~1.5 GB binary download",
+		description: "default · official Google server",
+	},
+	{
+		value: "stream-json",
+		label: "Stream-JSON CLI",
+		description: "the `agy` CLI, fallback",
 	},
 ];
 
 /** Intro paragraph above the list. Text wraps, so explanations stay here and
- *  SelectItem descriptions stay one-liners (SelectList truncates long lines). */
+ *  option descriptions stay one-liners (the choice list truncates long lines). */
 export const ENGINE_PICKER_INTRO = [
 	"Pick the engine that runs your Antigravity turns. Switch anytime with /agy engine (restart applies it).",
 	"",
-	"stream-json: the `agy` CLI you already installed and authenticated. Persistent process, streamed output. Tested default.",
-	"ACP: Google's official server (agy_acp_server.par). Needs a second Google sign-in and a ~1.5 GB server binary downloaded from Google (automatic, one-time, unavoidable: the server is not part of the agy CLI).",
+	"ACP (default): Google's official server (agy_acp_server.par). Needs a second Google sign-in and a ~1.5 GB server binary downloaded from Google (automatic, one-time, unavoidable: the server is not part of the agy CLI).",
+	"stream-json (fallback): the `agy` CLI you already installed and authenticated. Persistent process, streamed output.",
 ].join("\n");
 
 /** True only for a genuine first interactive run: no saved config yet (any
@@ -64,9 +58,9 @@ export function shouldOfferEnginePicker(
 
 /** Narrow a picker value to an Engine. Items are our own constants, but an
  *  unknown value must never reach config as a cast string: it falls back to
- *  the tested default. */
+ *  the default engine (acp), same rule as loadConfig's narrowing. */
 export function toEngine(value: string): Engine {
-	return value === "acp" ? "acp" : "stream-json";
+	return value === "acp" || value === "stream-json" ? value : DEFAULT_ENGINE;
 }
 
 /** Toast copy shown after the choice is saved. ACP names the promise that
@@ -78,6 +72,23 @@ export function savedEngineMessage(engine: Engine): string {
 		: "Engine saved: stream-json. Restart pi to apply.";
 }
 
+/** /agy settings row that opens the engine picker. Deliberately value-less:
+ *  DialogMenu cycles rows that carry `values`, but resolves the menu with the
+ *  row id on Enter for rows without — the caller then closes settings and
+ *  opens the same modal as the first-run wizard. The active engine rides as
+ *  the display value so the row reads like the rest of the surface. */
+export const ENGINE_SETTINGS_ROW_ID = "engine";
+
+export function engineSettingsRow(engine: Engine): DialogRow {
+	return {
+		id: ENGINE_SETTINGS_ROW_ID,
+		label: "Switch engine",
+		description:
+			"Open the engine picker (stream-json CLI vs the official ACP server). Enter opens it and closes settings; esc in the picker changes nothing. Restart applies a switch.",
+		currentValue: engine,
+	};
+}
+
 /** True when the `agy` CLI binary can be found. A binRef with a path
  *  separator (AGY_BIN=/opt/agy/agy) must exist as a file; a bare name is
  *  searched on PATH. statSync cannot throw through the guards, but a race
@@ -108,48 +119,23 @@ export function agyMissingMessage(): string {
 	return "The `agy` CLI is not installed. Install it from https://antigravity.google/product/antigravity-cli and log in on it to use Antigravity models.";
 }
 
-/** Render the picker overlay. Resolves with the chosen engine, or null when
- *  the user pressed esc (decide later - nothing is persisted). */
-export async function showEnginePicker(ctx: ExtensionUIContext): Promise<Engine | null> {
-	return ctx.custom<Engine | null>(
-		(tui, theme, _keybindings, done) => {
-			const container = new Container();
-			container.addChild(new DynamicBorder((s: string) => theme.fg("accent", s)));
-			container.addChild(
-				new Text(theme.fg("accent", theme.bold("Antigravity Bridge: choose your engine")), 1, 0),
-			);
-			container.addChild(new Text(theme.fg("muted", ENGINE_PICKER_INTRO), 1, 0));
-			container.addChild(new Spacer(1));
-
-			const list = new SelectList(ENGINE_PICKER_ITEMS, ENGINE_PICKER_ITEMS.length, {
-				selectedPrefix: (t: string) => theme.fg("accent", t),
-				selectedText: (t: string) => theme.fg("accent", t),
-				description: (t: string) => theme.fg("muted", t),
-				scrollInfo: (t: string) => theme.fg("dim", t),
-				noMatch: (t: string) => theme.fg("warning", t),
-			});
-			list.onSelect = (item) => done(toEngine(item.value));
-			list.onCancel = () => done(null);
-			container.addChild(list);
-
-			container.addChild(new Spacer(1));
-			container.addChild(
-				new Text(theme.fg("dim", "↑↓ navigate · enter select · esc decide later"), 1, 0),
-			);
-			container.addChild(new DynamicBorder((s: string) => theme.fg("accent", s)));
+/** The kit's DialogContext wants the whole extension context, but both picker
+ *  call sites hold only the ui object and are TUI-gated (ctx.mode === "tui")
+ *  before they run. Wrap instead of threading two different ctx shapes. The
+ *  cast is the pi-custom-options vs unknown-options signature gap; custom and
+ *  notify exist at runtime on ExtensionUIContext. */
+function asDialogContext(ui: ExtensionUIContext): DialogContext {
+	return { hasUI: true, mode: "tui", ui: ui as unknown as DialogContext["ui"] };
+}
 
-			return {
-				render: (width: number) => container.render(width),
-				invalidate: () => container.invalidate(),
-				handleInput: (data: string) => {
-					list.handleInput(data);
-					tui.requestRender();
-				},
-			};
-		},
-		{
-			overlay: true,
-			overlayOptions: { anchor: "center" as const, width: 80, maxHeight: "85%" as const, margin: 1 },
-		},
-	);
+/** Render the choice modal via the shared dialog kit. Resolves with the
+ *  chosen engine, or undefined when the user pressed esc (decide later -
+ *  nothing is persisted). */
+export async function showEnginePicker(ctx: ExtensionUIContext): Promise<Engine | undefined> {
+	const picked = await dialogChoice(asDialogContext(ctx), "Antigravity Bridge: choose your engine", {
+		description: ENGINE_PICKER_INTRO,
+		options: ENGINE_PICKER_ITEMS,
+		footer: "↑↓ navigate · enter select · esc decide later",
+	});
+	return picked === undefined ? undefined : toEngine(picked);
 }

package/src/provider.ts

@@ -345,8 +345,9 @@ export interface StreamSimpleDeps {
 	 *  driver and bridge calls park as toolUse round-trips. Required with
 	 *  roundTrips. */
 	driver?: TurnDriver;
-	/** Official-server ACP engine. Opt-in via config.engine = "acp"; when
-	 *  absent the config switch falls back to the stream driver. */
+	/** Official-server ACP engine (the default engine). Selected via
+	 *  config.engine = "acp"; when absent the config switch falls back to
+	 *  the stream driver. */
 	acpDriver?: TurnDriver;
 	roundTrips?: ToolRoundTrips;
 	/** Replay store for the display-only antigravity wrapper tool. Required