@estebanforge/pi-antigravity-bridge 1.8.7 → 1.9.0

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.9.0] - 2026-10-27
+
+### Fixed
+
+- **`/agy-stop` no longer discards an answer that already finished computing.** Between the agy process closing and the run settling (conversation discovery + classification, up to ~500ms), a stop settled the run failed and silently dropped the computed answer. The stop handler now consults a finishing guard (the new opt-in `guard` option on pi-ask-shared's `createStopHandler`) and refuses with "already finished; its result is being delivered" while that window is open; the wake then delivers normally.
+
+- **`details.stderr` is redacted at the boundary.** Tool-result details are persisted in session files, and raw stderr can carry auth material; the stored field now passes through the bridge's redactor. The blocking answer text stays raw, like every other ask tool. This rides the same change as the background feature, which introduced the background-run stderr wake path that made the asymmetry visible.
+
+- **The suppression refcount survives `/reload`.** It lived in module state, so a runtime replacement reset it to zero and the old runtime's late release (its kill path is async) could re-enable the bridge's global entries while the new runtime's delegation was still live. It now lives in a `Symbol.for`-keyed `globalThis` slot, shared by every runtime instance in the process.
+
+### Changed
+
+- **Refusal results render with the error glyph.** Refusal paths returned `exitCode: 0`, so pi showed "✓ AskAntigravity" for calls that never ran. They now carry `details.refused`, and `renderResult` flips to ✗. Details only; refusal text is unchanged.
+
+### Added
+
+- **`AskAntigravity` supports background runs, 1:1 with the standalone pi-ask-antigravity extension.** The old `background: true` refusal is gone: the call returns a `bg_` runId at once and the full answer arrives as an UNTRUSTED-tagged wake message (customType `ask-antigravity-result`, secret-redacted through the bridge's redactor) when the detached `agy -p` tree settles, carrying the conversationId resume handle. New `/agy-stop [runId]` command kills a run by id prefix, or the only running one with no argument. Shared `pi-ask-shared` machinery gives the same semantics as every other ask tool: concurrency cap 4 with a visible refusal, settle-once so a stop and a natural close can never double-wake, TTL sweep, and `session_shutdown` killing in-flight runs silently (pi's `/new`, `/resume`, `/fork`, `/reload` wipe module state and take the runs with them). Background is refused in print/json mode, where the process exits before the wake could arrive. Two behavior fixes ride along: the MCP-suppression window now spans background runs too (execute() returns while agy is still alive, so the release moved into the run lifecycle and fires exactly once per run), and the per-conversation lock (one run per conversationId, since two runs resuming the same conversation interleave turns inside agy's SQLite state) now also covers blocking calls. The delegation path itself is unchanged and engine-independent: always a fresh one-shot `agy -p`, never the ACP or stream-json turn engine. Review hardening riding in the same change: the detached run now settles on stream close instead of process exit (an exit-time settle could truncate the answer and disarmed the SIGKILL escalation while group members were still dying), stdout/stderr buffers carry valves (1M/64k) so a runaway child cannot grow memory over a days-long timeout, the timeout wake's partial-output slice is redacted before cutting (a sliced secret can fall under the redactor's length thresholds), and the suppression release is exactly-once at the call site, not just inside the callee's refcount guard.
+
+## [1.8.8] - 2026-10-27
+
+### Fixed
+
+- **Short-circuit observational-memory background turns instead of letting Gemini hunt the missing observer tool.** pi-observational-memory's turn-end observer falls back to the session model, and its prompt demands a private `record_observations` tool the bridge never sends; on antigravity models that spawned autonomous `find`/`grep`/`sed` shell sweeps (~500 ms per cycle) hunting the tool before reporting "observer found nothing new in this chunk". `streamSimple` now detects the observer context structurally (its `record_observations`/`record_reflections`/`drop_observations` tool names) and finalizes with a clean empty stop, which engages the observer's empty-backoff instead of erroring every turn; a one-time per-process `observational-memory-unsupported` warning explains the gap.
+
+- **Strip Antigravity's echoed `<SYSTEM_MESSAGE>` notifications and default Queued Messages to send-immediately.** The backend injects async background-task notifications wrapped in `<SYSTEM_MESSAGE>` blocks, and Gemini (notably 3.8 Flash) echoes them verbatim as assistant text; a stateful streaming sanitizer (`src/stream-sanitizer.ts`) now suppresses the exact preamble+block pattern in both engines' text paths, failing open at EOF so legitimate text is never lost. Separately, the engines' default "Queued Messages" behavior buffered user input until turn end while pi sends interactive input mid-turn; the bridge now writes `"queuedMessages": "send-immediately"` to each engine's settings.json when unset (atomic, existing config respected, corrupt files never touched).
+
+- **Deliver image pixels across all the paths that used to lose them.** Verified live 2026-10-22 (couch session): gemini-3.8-flash read a screenshot, the parked bridge call escalated, the model never polled `bridge_poll_result`, and the stranded redelivery carried text only — the image never reached it and the model fell back to hunting OCR libraries. Late/stranded redeliveries now carry image blocks via `driver.run` (ACP native prompt blocks; stream-json stages them), user-attached images on the stream-json engine stage to temp files with a prompt note pointing at the bridge read tool (the CLI turn input is text-only; `src/prompt-images.ts`), and both engines now advertise `text+image` input. The tool-priority note states outright that `read` returns visible images (models refused screenshots from priors) and mandates polling `bridge_poll_result` before other work after a STILL RUNNING ack. Staging failures degrade to an explicit "image(s) could not be delivered" note instead of dropping silently.
+
 ## [1.8.7] - 2026-10-21
 
 ### Changed

package/README.md

@@ -150,6 +150,7 @@ The `activate_skill` catalog mirrors pi's directory-based skill discovery: the t
 /agy engine acp|stream-json   switch the turn engine (restart to apply; default acp, stream-json is the fallback; acp runs self-service setup: binary install + auth bootstrap). No arguments opens the engine picker modal (TUI)
 /agy auth-manual             manual ACP credential setup (fallback; auto-setup normally covers this; default login = your Antigravity subscription, same account as the agy CLI)
 /agy clear                drop all session bindings (force fresh conversations)
+/agy-stop [runId]         stop a background AskAntigravity run (id prefix, or the only running one with no argument)
 ```
 
 ### Permissions
@@ -226,9 +227,9 @@ pi-antigravity-bridge practical risk is low, near zero. But not zero: the "in co
 
 This is engineering analysis, not legal advice. Use against your own Antigravity account at your own risk; I am not responsible for any consequence to your account.
 
-## Delegation tool: background is refused
+## Delegation tool: background runs
 
-The `AskAntigravity` delegation tool rejects `background: true` by design: a background wake would land in the pi session even when the caller is a nested delegation through the bridge catalog, and long delegations already have the bridge's own async flow (early-ack plus `bridge_poll_result`). Call without `background`; for unattended peer runs launch the CLI directly in a terminal.
+`AskAntigravity` accepts `background: true` (1:1 with the standalone pi-ask-antigravity extension): the call returns a `bg_` runId at once and the full answer arrives later as an UNTRUSTED-tagged message (secret-redacted) carrying the resume handle. `/agy-stop [runId]` stops a run by id prefix, or the only running one with no argument; the concurrency cap is 4. A stop landing after agy already closed but before the result settles (the discovery window) is refused with "already finished; its result is being delivered" instead of dropping the answer. Background is refused in pi's print/json modes (the process exits before the message could arrive), and `/new`, `/resume`, `/fork`, `/reload` kill in-flight runs. Delegation always spawns a one-shot `agy -p` process - never the ACP or stream-json turn engine.
 
 ## License
 

package/extensions/index.ts

@@ -63,6 +63,7 @@ import { runAcpAuth } from "../src/acp/auth.js";
 import { setAuthInvalidatedHook } from "../src/acp/connection.js";
 import { setupAuthUrlCapture } from "../src/acp/browser-capture.js";
 import { clearAcpAuthVerified, ensureAcpReady, inspectAcpSetup } from "../src/acp/setup.js";
+import { ensureQueuedMessagesDefaults } from "../src/queued-messages.js";
 import type { TurnDriver, TurnOutcome } from "../src/driver-types.js";
 import { CONFIG_PATH, loadConfig, logsDir, MAX_TURN_CAP_MIN, parseCapMinutes, saveConfig, type AgyMode, type BridgeTools, type Engine, type ThinkingTier } from "../src/config.js";
 import { agyMissingMessage, ENGINE_SETTINGS_ROW_ID, engineSettingsRow, isAgyInstalled, savedEngineMessage, showEnginePicker, shouldOfferEnginePicker } from "../src/engine-picker.js";
@@ -117,6 +118,8 @@ function resolveAgyBinary(): string {
 }
 
 export default async function (pi: ExtensionAPI): Promise<void> {
+	ensureQueuedMessagesDefaults({ onlyIfDirExists: true });
+
 	// Claim the AskAntigravity tool for this process. pi-ask-antigravity (if also
 	// installed) checks this in-process flag OR the bridge's package.json on disk
 	// and defers. See that extension's isBridgeInstalled().
@@ -144,9 +147,10 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	// kickIdle, and reentry pointing at the other engine (round-7 finding).
 	const engine: Engine = loadConfig().engine;
 	// Engine switching requires a restart, so the catalog-time engine read is
-	// authoritative for input advertising: image attach rides only when turns
-	// will run on the ACP engine (the stream-json CLI prompt is text-only).
-	const modelInput: Array<"text" | "image"> = engine === "acp" ? ["text", "image"] : ["text"];
+	// authoritative for input advertising. Both engines accept images: ACP
+	// rides native content blocks; stream-json stages user attachments to
+	// temp files and the prompt points the model at them (prompt-images.ts).
+	const modelInput: Array<"text" | "image"> = ["text", "image"];
 	const models = entries.map((e) => toPiModel(e, modelInput));
 
 	// failAll reasons the bridge treats as routine (turn end / shutdown

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.8.7",
+  "version": "1.9.0",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",
@@ -54,7 +54,7 @@
     }
   },
   "dependencies": {
-    "@estebanforge/pi-ask-shared": "^0.1.2",
+    "@estebanforge/pi-ask-shared": "^0.1.3",
     "@estebanforge/pi-tui-dialogs": "^0.1.2",
     "@modelcontextprotocol/sdk": "^1.31.0"
   }

package/src/acp/driver.ts

@@ -736,6 +736,13 @@ export class AcpDriver implements TurnDriver {
 
 	#settle(turn: ActiveTurn, outcome: TurnOutcome): void {
 		if (turn.closed) return;
+		const flushed = turn.response.flush();
+		if (flushed) {
+			turn.textDeltas += 1;
+			turn.textTokens += estimateTokens(flushed);
+			this.#emit(turn, { type: "text", delta: flushed });
+		}
+		outcome.response = turn.response.text;
 		// Gate B stopgap: synthesize usage on clean turns while the server sends
 		// none. Runs BEFORE close so the usage activity drains through the
 		// normal #nextActivity loop (provider maps it onto partial.usage).

package/src/acp/events.ts

@@ -14,6 +14,10 @@
 //   - available_commands_update { availableCommands: [...] }
 // Usage: ABSENT on RC01 (Gate B) — mapped defensively should a future build add it.
 
+import { StreamSanitizer, sanitizeSystemMessage } from "../stream-sanitizer.js";
+
+export { StreamSanitizer, sanitizeSystemMessage };
+
 /** Map one `update` object to a driver-level event, or null when the update
  *  carries nothing the driver consumes (plan/commands are doctor/phase-2
  *  material; user_message_chunk is load replay and must never reach pi as
@@ -218,38 +222,60 @@ export function mapStopReason(stopReason: unknown): {
 const FLIP_MIN_CHARS = 32;
 
 export class TextAccumulator {
-	#acc = "";
+	#rawAcc = "";
+	#sanitizedAcc = "";
 	#cumulative: boolean | undefined;
+	#sanitizer = new StreamSanitizer();
 
 	/** Returns the delta to emit, or null when nothing new should be emitted. */
 	append(delta: string): string | null {
+		let rawEmit: string | null = null;
 		if (this.#cumulative === undefined) this.#cumulative = false;
 		else if (
 			!this.#cumulative &&
-			this.#acc.length >= FLIP_MIN_CHARS &&
-			delta.length > this.#acc.length &&
-			delta.startsWith(this.#acc)
+			this.#rawAcc.length >= FLIP_MIN_CHARS &&
+			delta.length > this.#rawAcc.length &&
+			delta.startsWith(this.#rawAcc)
 		) {
 			this.#cumulative = true;
 		}
 		if (this.#cumulative) {
-			if (!delta.startsWith(this.#acc)) {
+			if (!delta.startsWith(this.#rawAcc)) {
 				// Misflip evidence: back to deltas.
 				this.#cumulative = false;
-				this.#acc += delta;
-				return delta;
+				this.#rawAcc += delta;
+				rawEmit = delta;
+			} else if (delta.length <= this.#rawAcc.length) {
+				return null; // duplicate frame
+			} else {
+				rawEmit = delta.slice(this.#rawAcc.length);
+				this.#rawAcc = delta;
 			}
-			if (delta.length <= this.#acc.length) return null; // duplicate frame
-			const emit = delta.slice(this.#acc.length);
-			this.#acc = delta;
-			return emit;
+		} else {
+			this.#rawAcc += delta;
+			rawEmit = delta;
+		}
+
+		if (rawEmit === null) return null;
+		const sanitized = this.#sanitizer.push(rawEmit);
+		if (sanitized.length > 0) {
+			this.#sanitizedAcc += sanitized;
+			return sanitized;
+		}
+		return null;
+	}
+
+	flush(): string | null {
+		const flushed = this.#sanitizer.flush();
+		if (flushed.length > 0) {
+			this.#sanitizedAcc += flushed;
+			return flushed;
 		}
-		this.#acc += delta;
-		return delta;
+		return null;
 	}
 
 	get text(): string {
-		return this.#acc;
+		return this.#sanitizedAcc;
 	}
 }
 

package/src/acp/setup.ts

@@ -16,6 +16,7 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { ensureQueuedMessagesInFile, QUEUED_MESSAGES_SEND_IMMEDIATELY } from "../queued-messages.js";
 
 export const REGISTRY_URL =
 	"https://raw.githubusercontent.com/agentclientprotocol/registry/main/antigravity-acp/agent.json";
@@ -312,7 +313,11 @@ export function writeAuthType(type: "gemini-api-key" | "oauth-personal", dir?: s
 		/* fresh file */
 	}
 	const prevAuth = (typeof settings.auth === "object" && settings.auth !== null ? settings.auth : {}) as Record<string, unknown>;
-	fs.writeFileSync(file, `${JSON.stringify({ ...settings, auth: { ...prevAuth, type } }, null, 2)}\n`, { mode: 0o600 });
+	const nextSettings: Record<string, unknown> = { ...settings, auth: { ...prevAuth, type } };
+	if (typeof nextSettings.queuedMessages !== "string" || !nextSettings.queuedMessages.trim()) {
+		nextSettings.queuedMessages = QUEUED_MESSAGES_SEND_IMMEDIATELY;
+	}
+	fs.writeFileSync(file, `${JSON.stringify(nextSettings, null, 2)}\n`, { mode: 0o600 });
 }
 
 export interface BinaryResolution {
@@ -386,6 +391,7 @@ export async function ensureAcpReady(opts: SetupOptions = {}): Promise<AcpSetupS
 	// plan as the agy CLI login). gemini-api-key (metered paid API) stays a
 	// manual option for headless boxes (/agy auth-manual); never the default.
 	const gdir = defaultGeminiDir(opts);
+	ensureQueuedMessagesInFile(path.join(gdir, "settings.json"));
 	const auth = readAuthState(gdir);
 	if (!auth.configured) {
 		try {