@estebanforge/pi-antigravity-bridge 1.8.2 → 1.8.4

package/CHANGELOG.md

@@ -2,7 +2,26 @@
 
 All notable changes to this project will be documented in this file.
 
-## [Unreleased]
+## [1.8.4] - 2026-10-15
+
+### Security
+
+- **The MCP SDK floor now carries the OAuth credential-routing fix.**
+  `@modelcontextprotocol/sdk` 1.12.0-1.30.1 lets a malicious MCP server
+  redirect client OAuth credentials to an attacker-chosen authorization
+  server (GHSA-6qxp-vccf-f47h). The bridge runs the SDK server-side only
+  (`Server` + `StreamableHTTPServerTransport`) and never acts as an MCP
+  OAuth client, so its own exposure was nil, but the floor now points at
+  1.31.0, the first fixed version, so installs stop tripping audit. The
+  protocol-version clamp is unaffected: it rewrites any unsupported
+  `MCP-Protocol-Version` header to the SDK's own `LATEST_PROTOCOL_VERSION`,
+  whatever ceiling the new version ships. Lockfiles resolve 1.32.1.
+
+## [1.8.3] - 2026-10-13
+
+### Fixed
+
+- **The G10 carrier agent no longer dies on invalid YAML frontmatter (issue #5).** `syspromptAgentMd()` wrote the `description` value as an unquoted plain scalar containing a second `: `, which is invalid YAML. agy silently skips an agent whose frontmatter does not parse, so every stream-json turn with the staged carrier (default `systemPrompt: true`, no user-set `config.agent`) failed with `unknown agent "pi-bridge-sys-…"`; the bug has been present since 1.7.8. The value is now quoted, and all three agent.md generators (sysprompt carrier, web delegate, ask-tool reviewer) are pinned by tests that parse the generated frontmatter with a real YAML parser, so a future wording edit cannot reintroduce the silent drop. Leftover broken `pi-bridge-sys-*` dirs need no manual cleanup: the stale-agent sweep prunes them on next staging.
 
 ## [1.8.2] - 2026-10-13
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.8.2",
+  "version": "1.8.4",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",
@@ -56,6 +56,6 @@
   "dependencies": {
     "@estebanforge/pi-ask-shared": "^0.1.2",
     "@estebanforge/pi-tui-dialogs": "^0.1.2",
-    "@modelcontextprotocol/sdk": "^1.29.0"
+    "@modelcontextprotocol/sdk": "^1.31.0"
   }
 }

package/src/sysprompt-agent.ts

@@ -44,7 +44,9 @@ export function syspromptAgentMd(name: string, body: string): string {
 	return [
 		"---",
 		`name: ${name}`,
-		"description: Pi bridge system-prompt carrier: pi operating instructions plus project AGENTS.md context",
+		// Quoted value: it contains ': ', invalid inside an unquoted plain
+		// scalar — agy then silently drops the agent (issue #5).
+		"description: \"Pi bridge system-prompt carrier: pi operating instructions plus project AGENTS.md context\"",
 		"mainAgent: true",
 		"model: inherit",
 		"---",

package/src/web-tools.ts

@@ -114,6 +114,11 @@ export interface WebRunOptions {
 	log?: (event: string, data?: unknown, level?: "info" | "warn" | "error") => void;
 }
 
+/** agent.md for the one-shot web delegate: search-only, no inheritance. */
+export function webAgentMd(name: string): string {
+	return `---\nname: ${name}\ndescription: Temporary Pi web delegate\nmainAgent: true\nsubagent: false\nmodel: inherit\nexcludeDefaultComponents: true\ninheritCustomizations: false\ninheritMcp: false\ncommandExecutionPolicy: auto\ntools:\n  - search_web\n  - read_url_content\nskills: []\nrules: []\nagents: []\nmcpServers: []\n---\n\nAnswer the user's query using search_web (and read_url_content when a page must be opened). Cite sources. Use no other tools.\n`;
+}
+
 /** One gated one-shot web run. Creates a unique restricted agent, streams the
  *  NDJSON frames, refuses answers with no observed allowed-tool step, and
  *  always removes the agent dir. */
@@ -128,11 +133,9 @@ export async function runWebAgent(opts: WebRunOptions): Promise<WebRunResult> {
 	// commandExecutionPolicy stays at the live-validated "auto": the template's
 	// tools list has no command tool and plan mode blocks edits; an unvalidated
 	// stricter enum risks agent discovery failing outright.
-	writeFileSync(
-		path.join(agentDir, "agent.md"),
-		`---\nname: ${agentName}\ndescription: Temporary Pi web delegate\nmainAgent: true\nsubagent: false\nmodel: inherit\nexcludeDefaultComponents: true\ninheritCustomizations: false\ninheritMcp: false\ncommandExecutionPolicy: auto\ntools:\n  - search_web\n  - read_url_content\nskills: []\nrules: []\nagents: []\nmcpServers: []\n---\n\nAnswer the user's query using search_web (and read_url_content when a page must be opened). Cite sources. Use no other tools.\n`,
-		{ mode: 0o600 },
-	);
+	writeFileSync(path.join(agentDir, "agent.md"), webAgentMd(agentName), {
+		mode: 0o600,
+	});
 	writeFileSync(path.join(agentDir, ".pid"), `${process.pid}\n`, { mode: 0o600 });
 
 	const bin = opts.bin ?? process.env.AGY_BIN ?? "agy";