@estebanforge/pi-antigravity-bridge 1.8.4 → 1.8.6

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.8.6] - 2026-10-20
+
+### Changed
+
+- **Declare native subagent masking explicitly in the staged system-prompt carrier (`subagent: false`, `agents: []`; issue #7).** Agent-file presence already suppresses the native subagent tools, but that was an accident of staging; the frontmatter now states it so provider sessions do not depend on an undocumented engine behavior (probe attribution of presence vs keys is untested). Sessions without the carrier (`systemPrompt: false` or a custom agent) keep native tools; the tool-priority note steers the model to bridge delegation where a delegation tool is listed.
+
+## [1.8.5] - 2026-10-20
+
+### Fixed
+
+- **Skip `call_mcp_tool` replay and guard synthetic `antigravity` toolUse against inactive whitelist in subagents (issue #6).** In subagent sessions with strict tool whitelists, unconditional wrap replay caused 39 consecutive `Tool antigravity not found` errors. In parent sessions, Antigravity's internal `call_mcp_tool` steps generated duplicate dummy tool calls returning `(agy recorded no output)`. The bridge now drops `call_mcp_tool` from wrap replay and checks `feats.nativeActive("antigravity")` before emitting synthetic toolUse.
+
+### Changed
+
+- **Subagent delegation routes through pi and holds a longer synchronous window (issue #6).** Antigravity orchestrators picked agy's native `invoke_subagent`/`run_subagent`/`manage_subagents`, whose spawns run inside agy, never surface in pi, and leave pi-side harnesses at "0 active / 0 finished". The tool-priority note now mandates bridged delegation tools when one exists (conditional, so a session without one keeps the native fallback), and delegation-shaped bridge calls (`subagent`/`subagent_run`-style tools, the Claude Code-style exact `Agent`, pi's `agent_spawn`/`agent_wait` family, `*delegate*`) hold the synchronous window 120s instead of 20s: the 30-120s subagent range now returns a plain tool result while staying under agy's ~180s `tools/call` abandonment, and longer runs escalate to the existing poll path. `escalateLongTools` in config.json (env `AGY_ESCALATE_LONG_TOOLS`, comma-separated) adds custom names; `escalateAfterMs: 0` still disables the early ack.
+
 ## [1.8.4] - 2026-10-15
 
 ### Security

package/README.md

@@ -42,7 +42,7 @@ The bridge starts a localhost MCP server inside pi's process. The exposed catalo
 
 **Upstream pi APIs only.** Bridge calls park in the provider's round-trip store; the provider ends the pi assistant message with a `toolUse` stop reason for the real pi tool, pi executes it in its own loop (native cards, permissions, hooks), and the toolResult completes the parked MCP response on the next stream call.
 
-**Long calls don't die.** agy's MCP client abandons a `tools/call` request at a flat ~180s, which used to kill any pi tool that ran longer (a long peer review, a build, a commit preview waiting for you). A call still running after ~20 seconds now settles its HTTP request with a `STILL RUNNING` answer carrying a `callId` while pi keeps executing; agy fetches the result through the bridge-local `bridge_poll_result` tool and polls until it lands. Escalated calls get their own 30-minute budget, so human-gated tools can take as long as the human takes. Fast calls stay fully synchronous and never see any of this. If a park does fail (abort, timeout, recycle), the late result is re-routed to agy as a follow-up prompt in the same conversation instead of being lost.
+**Long calls don't die.** agy's MCP client abandons a `tools/call` request at a flat ~180s, which used to kill any pi tool that ran longer (a long peer review, a build, a commit preview waiting for you). A call still running after ~20 seconds now settles its HTTP request with a `STILL RUNNING` answer carrying a `callId` while pi keeps executing; agy fetches the result through the bridge-local `bridge_poll_result` tool and polls until it lands. Delegation-shaped tools (pi subagent/delegation tools, e.g. `subagent_run`, `agent_spawn`) hold the synchronous window 120s instead (issue #6: orchestrators expect a plain result across the 30-120s subagent range, and 120s stays under the 180s wall); `escalateLongTools` in config.json adds custom names. Escalated calls get their own 30-minute budget, so human-gated tools can take as long as the human takes. Fast calls stay fully synchronous and never see any of this. If a park does fail (abort, timeout, recycle), the late result is re-routed to agy as a follow-up prompt in the same conversation instead of being lost.
 
 **Recursion safety.** Only the provider's agy receives the extra `--add-dir`. `AskAntigravity` is also filtered from the exposed tool list. Its delegated `agy -p` spawns with just the workspace, and for the whole delegated run the bridge hides its global per-pid entries: disabled before the spawn, released only on process close or error - agy watches the config and hot-reloads MCP servers on file changes, so a mid-run re-enable would poke the live delegation back into pi. A cross-process marker (`suppression.json` in the bridge's extensions-data dir) coordinates concurrent delegations: entries come back only when no live delegation remains, a session starting mid-delegation registers its own entry disabled, and the session-start heal re-enables only once the last delegator is gone (dead entries pruned by pid liveness with a 24h age bound). The inner agy therefore sees no bridge and cannot re-enter pi. Foreign servers in the global config are never touched.
 
@@ -119,7 +119,7 @@ If `agy models` fails at load (binary missing, auth not done, network stall), a
 | `webTools` | `off` (no web tools), `on` (register `agy_web_search` + `agy_read_url` as Pi tools, usable by ANY provider's model). Each call spawns a one-shot search-only `agy` agent (plan mode, bridge MCP inheritance off), gates the answer on an observed native `search_web`/`read_url_content` step, and spends Antigravity quota. Off by default: Antigravity sessions already have native web tools on both engines; these serve other providers | `off` |
 | `bridgeTools` | `none` (bridge off), `all` (every non-builtin tool, incl. other `Ask*` delegations), `mcp` (pi-mcp-adapter tools + skills bridge only) | `all` |
 | `digest` | `off` (stable prompts; agy's prompt cache hits) or `on` (inject a delta of pi-side context - compaction summaries, other-provider turns - into each agy prompt; the delta changes every turn, so agy re-bills the full context). Enable for mixed-provider sessions where agy must see pi-side context | `off` |
-| `systemPrompt` | `on` (send pi's system prompt - operating instructions plus the global agent-dir `AGENTS.md` and ancestor `AGENTS.md`/`CLAUDE.md` - to the first prompt of each new agy conversation, plus a tool-priority note: Pi Bridge tools win over agy's native interactive ones, which never reach the user. Delivery: stream-json stages it as an agy agent file via `--agent`, off the prompt line - the CLI silently drops single prompts past a ~25KB cap and the dropped turn kills the conversation; ACP prepends it to the first prompt) or `off` (agy-native behavior) | `on` |
+| `systemPrompt` | `on` (send pi's system prompt - operating instructions plus the global agent-dir `AGENTS.md` and ancestor `AGENTS.md`/`CLAUDE.md` - to the first prompt of each new agy conversation, plus a tool-priority note: Pi Bridge tools win over agy's native interactive ones, which never reach the user. Delivery: stream-json stages it as an agy agent file via `--agent`, off the prompt line - the CLI silently drops single prompts past a ~25KB cap and the dropped turn kills the conversation; the carrier declares `subagent: false` + `agents: []` so the native subagent tools stay masked (ACP carries no agent file, so its natives remain and the tool-priority note steers the model to pi delegation). ACP prepends it to the first prompt) or `off` (agy-native behavior) | `on` |
 | `turnTimeoutMin` | Overall cap on ONE agy turn, minutes, both engines. When it fires, the bridge kills the agy process mid-task ("ACP turn exceeded the 10m deadline" / "agy exceeded the 10m turn timeout") - it is a bridge cap, not a Google server limit. Default is TTY-aware: `0` (no cap) on an interactive pi - you are the backstop with Esc; `20` headless, where nobody can abort and one runaway turn blocks the serialized turn queue. Opt into a gate with 1-1440 (free type via `config.json` or `/agy timeout <1-1440|off>`, or the `/agy` picker's preset list); `0` disables explicitly; anything else falls back to the TTY-aware default. The 5m inactivity stall guard always still bounds a hung server | `0` TTY / `20` headless |
 | `inactivityTimeoutMin` | Silence cap, minutes, both engines: no stream-json stdout / no ACP session/update for this long fails the turn as a stall. `0` disables the guard | `5` |
 

package/extensions/index.ts

@@ -43,6 +43,7 @@ import {
 	ToolRoundTrips,
 	WrapperReplay,
 	createStreamSimple,
+	defaultEscalateAfterMs,
 	formatEscalatedAck,
 	formatPollAnswer,
 	type NativeDisplayEvent,
@@ -362,6 +363,9 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 				d,
 				level ?? (s === "round-trip-fail" ? "warn" : "debug"),
 			),
+		// Delegation tools hold the sync window 120s (issue #6); config adds
+		// extra long-running names, re-read per call so edits apply live.
+		{ escalateAfterMs: (name) => defaultEscalateAfterMs(name, loadConfig().escalateLongTools) },
 	);
 	const replay = new WrapperReplay();
 	// Subagent roster: folded from every driver activity (both engines) via

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.8.4",
+  "version": "1.8.6",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/config.ts

@@ -142,6 +142,13 @@ export interface AgyConfig {
 	 *  "mcp" surface serves an empty catalog on installs without
 	 *  pi-mcp-adapter), "mcp" (pi-mcp-adapter tools + skills bridge only). */
 	bridgeTools: BridgeTools;
+	/** Extra pi tool names that get the long (120s) synchronous escalation
+	 *  window, in addition to delegation-shaped names (subagent_run,
+	 *  agent_spawn/agent_wait, *delegate*; issue #6). For custom tools that
+	 *  legitimately run minutes-long but must return a plain result to an
+	 *  orchestrator. Env AGY_ESCALATE_LONG_TOOLS (comma-separated) wins over
+	 *  the file. Takes effect on the next bridge call. */
+	escalateLongTools?: string[];
 	/** Inject a delta digest of pi-side context (compaction summaries, turns
 	 *  handled by other providers or pi's own tools) into each agy prompt.
 	 *
@@ -318,6 +325,20 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 			? bridgeRaw
 			: DEFAULTS.bridgeTools;
 
+	// Extra long-window tool names for the bridge escalation (issue #6).
+	// Comma-separated in the env; junk entries and junk shapes are dropped,
+	// not fatal - loadConfig runs per bridge call and must never throw.
+	const longToolsRaw: unknown =
+		process.env.AGY_ESCALATE_LONG_TOOLS ?? file.escalateLongTools;
+	const longToolsParts: unknown[] = typeof longToolsRaw === "string"
+		? longToolsRaw.split(",")
+		: Array.isArray(longToolsRaw) ? longToolsRaw : [];
+	const escalateLongTools = longToolsParts
+		.filter((s): s is string => typeof s === "string")
+		.map((s) => s.trim())
+		.filter((s) => s.length > 0)
+		.slice(0, 32);
+
 	const digest = process.env.AGY_DIGEST !== undefined
 		? ["1", "true", "on"].includes(process.env.AGY_DIGEST.toLowerCase())
 		: file.digest ?? false;
@@ -381,6 +402,7 @@ export function loadConfig(configPath: string = CONFIG_PATH): AgyConfig {
 		askTool,
 		webTools,
 		bridgeTools,
+		escalateLongTools,
 		digest,
 		systemPrompt,
 		turnTimeoutMin,

package/src/provider.ts

@@ -140,7 +140,7 @@ export const SYSTEM_PROMPT_END = "[END SYSTEM PROMPT]";
  *  the user's machine must go through the bridge. Rides the systemPrompt
  *  gate: the note ships only when the system prompt ships. */
 export const TOOL_PRIORITY_NOTE =
-	"[Tool priority: this conversation runs inside pi, not as a standalone agy session; the user only sees what surfaces in pi. Native interactive tools, for example ask_question, never reach the user. When a Pi Bridge tool covers the same purpose, always use the Pi Bridge tool; for user questions use ask_user_question. Your native file tools such as view_file only read brain artifacts and reject real filesystem paths; for any path on the user's machine use the Pi Bridge tools (read, ls, grep, find, edit, execute). Long-running bridge calls do not fail: after ~20 seconds the bridge answers STILL RUNNING with a callId; fetch the result with bridge_poll_result and poll until it lands. For work you already know is long, prefer exec_command's session-output pattern or background agents so you keep working while it runs.]";
+	"[Tool priority: this conversation runs inside pi, not as a standalone agy session; the user only sees what surfaces in pi. Native interactive tools, for example ask_question, never reach the user. When a Pi Bridge tool covers the same purpose, always use the Pi Bridge tool; for user questions use ask_user_question. Your native file tools such as view_file only read brain artifacts and reject real filesystem paths; for any path on the user's machine use the Pi Bridge tools (read, ls, grep, find, edit, execute). Delegate subagent work the same way: when pi's tool list includes a delegation tool (for example subagent, Agent, agent_spawn, agent_wait, or subagent_run), always delegate through it and never through the native invoke_subagent, run_subagent, or manage_subagents; use native ones only if no pi delegation tool is listed, because native subagents run inside agy and are invisible to pi and anything watching it. Long-running bridge calls do not fail: after ~20 seconds the bridge answers STILL RUNNING with a callId; fetch the result with bridge_poll_result and poll until it lands. For work you already know is long, prefer exec_command's session-output pattern or background agents so you keep working while it runs.]";
 
 /** Assemble the full agy prompt: system prompt block, pi-side digest, user
  *  prompt. Empty parts are dropped. Pure; exported for unit testing.
@@ -418,6 +418,27 @@ export const POLL_TOOL_NAME = "bridge_poll_result";
 /** Default quiet period before a park escalates to a poll handle. Well under
  *  agy's ~180s request deadline; fast tools never see it. */
 export const ESCALATE_AFTER_MS = 20_000;
+
+/** Synchronous window for delegation-shaped tools. pi subagents commonly run
+ *  30-120s (issue #6) and orchestrators expect a plain tool result; past this
+ *  they escalate to the poll path. The ceiling stays under agy's ~180s
+ *  tools/call abandonment, which would kill the request with no result and no
+ *  poll handle. */
+export const DELEGATION_ESCALATE_MS = 120_000;
+
+/** Names that get the long synchronous window: pi's agent_spawn/agent_wait
+ *  family, subagent_run-style tools, *delegate*, and the Claude Code-style
+ *  exact name "Agent" (start-anchored stem so incidental agent_ substrings
+ *  elsewhere in a name keep the fast ack). Human-gated tools
+ *  (ask_user_question) deliberately stay on the fast ack: their poll path is
+ *  load-bearing for permission flows. */
+const DELEGATION_NAME_RE = /subagent|delegate|^agent(_|$)/i;
+
+/** Per-call escalation threshold. Config can add extra long-running names
+ *  (escalateLongTools). */
+export function defaultEscalateAfterMs(name: string, extraLongNames: readonly string[] = []): number {
+	return DELEGATION_NAME_RE.test(name) || extraLongNames.includes(name) ? DELEGATION_ESCALATE_MS : ESCALATE_AFTER_MS;
+}
 /** Escalated parks carry a longer TTL: human-gated tools (commit previews,
  *  permission dialogs) legitimately block for many minutes. */
 export const ESCALATED_TIMEOUT_MS = 1_800_000;
@@ -647,7 +668,7 @@ export class ToolRoundTrips {
 	 *  late-delivery path (see buildLateResultPrompt). */
 	#dead = new Map<string, { name: string; reason: string }>();
 	#escalations = new EscalationRegistry();
-	#escalateAfterMs: number;
+	#escalateAfterMs: number | ((name: string) => number);
 	#getDriver: () => TurnDriver;
 	#log: (s: string, d?: unknown, level?: "debug" | "info" | "warn" | "error") => void;
 	/** Approval park controls (mcp-server handle). Assigned by the extension
@@ -660,11 +681,11 @@ export class ToolRoundTrips {
 	constructor(
 		driver: TurnDriver | (() => TurnDriver),
 		log?: (s: string, d?: unknown, level?: "debug" | "info" | "warn" | "error") => void,
-		opts: { escalateAfterMs?: number } = {},
+		opts: { escalateAfterMs?: number | ((name: string) => number) } = {},
 	) {
 		this.#getDriver = typeof driver === "function" ? driver : () => driver;
 		this.#log = log ?? (() => {});
-		this.#escalateAfterMs = opts.escalateAfterMs ?? ESCALATE_AFTER_MS;
+		this.#escalateAfterMs = opts.escalateAfterMs ?? defaultEscalateAfterMs;
 	}
 
 	get pendingIds(): string[] {
@@ -862,7 +883,8 @@ export class ToolRoundTrips {
 			const onAbort = () => this.#fail(callId, "agy disconnected before the tool result arrived");
 			signal.addEventListener("abort", onAbort, { once: true });
 			const entry: PendingRoundTrip = { kind: "bridge", name, resolve, reject, timer, onAbort, signal };
-			if (this.#escalateAfterMs > 0) {
+			const escalateAfterMs = typeof this.#escalateAfterMs === "function" ? this.#escalateAfterMs(name) : this.#escalateAfterMs;
+			if (escalateAfterMs > 0) {
 				entry.escalateTimer = setTimeout(() => {
 					const e = this.#pending.get(callId);
 					// Resolved (or failed) between arm and fire: nothing to escalate.
@@ -878,7 +900,7 @@ export class ToolRoundTrips {
 					}
 					this.#escalations.escalate(callId, e.name);
 					resolve({ escalated: true, callId, name: e.name });
-				}, this.#escalateAfterMs);
+				}, escalateAfterMs);
 			}
 			this.#pending.set(callId, entry);
 			// Strip the internal marker fields from model-supplied args (peer
@@ -1051,6 +1073,7 @@ export interface ActivityFeatures {
 	engine?: "stream-json" | "acp";
 	onNativeEvent?: (event: NativeDisplayEvent) => void;
 	roster?: SubagentRoster;
+	log?: (event: string, data?: unknown, level?: "debug" | "info" | "warn" | "error") => void;
 }
 
 /** Process-wide counter: round-trip ids must never repeat across turns in
@@ -1197,6 +1220,7 @@ function acpEditFileArg(args: Record<string, unknown>): string | undefined {
 			// resume on the toolResult continuation. Without a replay store
 			// (feature off) keep the label-only behavior.
 			if (!feats.replay || !feats.roundTrips) return "continue";
+			if (activity.name === "call_mcp_tool") return "continue";
 			const mapped = mapAgyToolToNative(activity.name, activity.args);
 			if (mapped && (!feats.nativeActive || feats.nativeActive(mapped.tool))) {
 				const id = nextRtId("nat");
@@ -1209,6 +1233,12 @@ function acpEditFileArg(args: Record<string, unknown>): string | undefined {
 				} as Record<string, JsonValue>);
 				return "parked";
 			}
+			if (feats.nativeActive && !feats.nativeActive("antigravity")) {
+				// Subagent sessions whitelist tools and drop the display wrapper;
+				// emitting here would fail every card with "not found".
+				feats.log?.("wrap-skip", { tool: activity.name }, "debug");
+				return "continue";
+			}
 			{
 				const id = nextRtId("wrap");
 				feats.replay.set(id, activity.output ?? "(agy recorded no output)");
@@ -1464,6 +1494,7 @@ async function runTurnDriver(
 		engine: deps.engine,
 		onNativeEvent: deps.onNativeEvent,
 		roster: deps.roster,
+		log: deps.log,
 	};
 
 	const drainTurn = async (h: TurnHandle): Promise<"parked" | undefined> => {

package/src/sysprompt-agent.ts

@@ -11,8 +11,13 @@
 //
 // Frontmatter keeps agy's DEFAULTS on purpose (no excludeDefaultComponents,
 // no tools list, no inheritMcp override): provider sessions need the normal
-// toolset and the bridge MCP config for G9 round-trips. Contrast the ask-tool
-// reviewer agent, which strips everything for sandboxing.
+// toolset and the bridge MCP config for G9 round-trips. The subagent keys are
+// the one deliberate exception: agent-file presence already suppresses agy's
+// native subagent tools (probed 2026-10-20, issue #7), and declaring it makes
+// the suppression explicit instead of relying on the accident (whether the
+// keys themselves mask, apart from presence, is unattributed).
+// Contrast the ask-tool reviewer agent, which strips everything for
+// sandboxing.
 //
 // Lifecycle: one agent dir per DISTINCT body (content-addressed by sha256);
 // two conversations with different system prompts in one process stage two
@@ -49,6 +54,8 @@ export function syspromptAgentMd(name: string, body: string): string {
 		"description: \"Pi bridge system-prompt carrier: pi operating instructions plus project AGENTS.md context\"",
 		"mainAgent: true",
 		"model: inherit",
+		"subagent: false",
+		"agents: []",
 		"---",
 		"",
 		body,