@estebanforge/pi-antigravity-bridge 1.9.0 → 1.9.2

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.9.2] - 2026-11-02
+
+### Fixed
+- The AskAntigravity tool's expand hint now comes from the render context pi injects (`context.keyHint`) instead of the package import. pi 1.5 blinds an imported `keyHint` to the host keybindings (app.* ids format as ""), so the hint rendered as "to expand" with no key. Peer floor moves to `^1.5.0` accordingly.
+
+## [1.9.1] - 2026-10-29
+
+### Fixed
+
+- **A retry-dropped attempt no longer stalls the session with "No user message to send to agy."** When pi retries after a failed turn, pi core drops the failed attempt from the projected context (`_omitRecoveryAttempt`), leaving a `toolResult` or assistant tail with no user prompt, no pending park, and nothing late. The fresh-pass guard used to hard-error there, and pi does not retry that error, so an unattended session stalled for ~6 hours on it (issue #8). With a bound conversation, the provider now re-opens it with a synthetic resume prompt (telling agy the previous attempt was discarded and not to repeat completed actions) instead of erroring. The digest is skipped on resume turns, the guard stays for unbound conversations and empty transcripts, and the `no-user-message` turn error now logs at error level (it was debug, so the failure left no trace in the error-only daily log).
+
+- **A first-ever turn that parks now binds its conversation immediately.** The binding used to be written only on a completed OK pass, so a first turn that parked a bridge call and then died (failed continuation, process restart) left no record, and the retry-dropped tail above still hit the hard error. A park is positive evidence that agy received the prompt, so the provider persists the snapshot's conversation id at park time (first binding only, staged agent moving with it). A later ERROR keeps the park-time binding, except the issue #2 signatures that prove the conversation dead (silent drop / deadline kill with no model output seen), which still clear it by design.
+
+### Changed
+
+- **The stream-json overall cap now pauses on parks, matching the ACP engine.** `turnTimeoutMin` used to be armed once and cleared only at settle on stream-json, so parked pi-tool time and human-gated escalations consumed the turn cap (with a 15m cap, a 16m escalation died mid-turn). The cap now carries a wall-clock deadline plus a remaining-budget capture, pauses at the first park, and resumes with the remainder on unpark; a 0 cap stays disabled across park cycles. Turn durations on stream-json can now exceed `turnTimeoutMin` by the parked span. This makes the documented "escalated calls get their own 30-minute budget" claim true on both engines.
+
+### Known limits
+
+- **A tool result whose tombstone died with the process is lost, not delivered.** Tombstones are in-memory. After a process restart, a retry-dropped tail whose tool result never reached agy resumes the conversation without that output; agy may repeat the call or proceed without it.
+
 ## [1.9.0] - 2026-10-27
 
 ### Fixed

package/README.md

@@ -42,7 +42,7 @@ The bridge starts a localhost MCP server inside pi's process. The exposed catalo
 
 **Upstream pi APIs only.** Bridge calls park in the provider's round-trip store; the provider ends the pi assistant message with a `toolUse` stop reason for the real pi tool, pi executes it in its own loop (native cards, permissions, hooks), and the toolResult completes the parked MCP response on the next stream call.
 
-**Long calls don't die.** agy's MCP client abandons a `tools/call` request at a flat ~180s, which used to kill any pi tool that ran longer (a long peer review, a build, a commit preview waiting for you). A call still running after ~20 seconds now settles its HTTP request with a `STILL RUNNING` answer carrying a `callId` while pi keeps executing; agy fetches the result through the bridge-local `bridge_poll_result` tool and polls until it lands. Delegation-shaped tools (pi subagent/delegation tools, e.g. `subagent_run`, `agent_spawn`) hold the synchronous window 120s instead (issue #6: orchestrators expect a plain result across the 30-120s subagent range, and 120s stays under the 180s wall); `escalateLongTools` in config.json adds custom names. Escalated calls get their own 30-minute budget, so human-gated tools can take as long as the human takes. Fast calls stay fully synchronous and never see any of this. If a park does fail (abort, timeout, recycle), the late result is re-routed to agy as a follow-up prompt in the same conversation instead of being lost. Consecutive polls render as ONE ♊︎-marked counted line (`♊︎ bridge_poll_result Poll git_commit (x30)`) instead of one entry per poll, with a live muted status counter while a run is open.
+**Long calls don't die.** agy's MCP client abandons a `tools/call` request at a flat ~180s, which used to kill any pi tool that ran longer (a long peer review, a build, a commit preview waiting for you). A call still running after ~20 seconds now settles its HTTP request with a `STILL RUNNING` answer carrying a `callId` while pi keeps executing; agy fetches the result through the bridge-local `bridge_poll_result` tool and polls until it lands. Delegation-shaped tools (pi subagent/delegation tools, e.g. `subagent_run`, `agent_spawn`) hold the synchronous window 120s instead (issue #6: orchestrators expect a plain result across the 30-120s subagent range, and 120s stays under the 180s wall); `escalateLongTools` in config.json adds custom names. Escalated calls get their own 30-minute budget, so human-gated tools can take as long as the human takes. Fast calls stay fully synchronous and never see any of this. If a park does fail (abort, timeout, recycle), the late result is re-routed to agy as a follow-up prompt in the same conversation instead of being lost. If pi retries a failed turn and drops the attempt from the projected context (pi core `_omitRecoveryAttempt`), leaving a toolResult or assistant tail with no live turn, the provider re-opens the bound conversation with a synthetic resume prompt instead of the unretryable "No user message" hard error (issue #8); a first-ever turn that parks binds its conversation at park time, so a retry-dropped tail has a conversation to resume into unless the park produced no conversation id or the later failure proved the conversation dead. Consecutive polls render as ONE ♊︎-marked counted line (`♊︎ bridge_poll_result Poll git_commit (x30)`) instead of one entry per poll, with a live muted status counter while a run is open.
 
 **Recursion safety.** Only the provider's agy receives the extra `--add-dir`. `AskAntigravity` is also filtered from the exposed tool list. Its delegated `agy -p` spawns with just the workspace, and for the whole delegated run the bridge hides its global per-pid entries: disabled before the spawn, released only on process close or error - agy watches the config and hot-reloads MCP servers on file changes, so a mid-run re-enable would poke the live delegation back into pi. A cross-process marker (`suppression.json` in the bridge's extensions-data dir) coordinates concurrent delegations: entries come back only when no live delegation remains, a session starting mid-delegation registers its own entry disabled, and the session-start heal re-enables only once the last delegator is gone (dead entries pruned by pid liveness with a 24h age bound). The inner agy therefore sees no bridge and cannot re-enter pi. Foreign servers in the global config are never touched.
 
@@ -120,8 +120,8 @@ If `agy models` fails at load (binary missing, auth not done, network stall), a
 | `bridgeTools` | `none` (bridge off), `all` (every non-builtin tool, incl. other `Ask*` delegations), `mcp` (pi-mcp-adapter tools + skills bridge only) | `all` |
 | `digest` | `off` (stable prompts; agy's prompt cache hits) or `on` (inject a delta of pi-side context - compaction summaries, other-provider turns - into each agy prompt; the delta changes every turn, so agy re-bills the full context). Enable for mixed-provider sessions where agy must see pi-side context | `off` |
 | `systemPrompt` | `on` (send pi's system prompt - operating instructions plus the global agent-dir `AGENTS.md` and ancestor `AGENTS.md`/`CLAUDE.md` - to the first prompt of each new agy conversation, plus a tool-priority note: Pi Bridge tools win over agy's native interactive ones, which never reach the user. Delivery: stream-json stages it as an agy agent file via `--agent`, off the prompt line - the CLI silently drops single prompts past a ~25KB cap and the dropped turn kills the conversation; the carrier declares `subagent: false` + `agents: []` so the native subagent tools stay masked (ACP carries no agent file, so its natives remain and the tool-priority note steers the model to pi delegation). ACP prepends it to the first prompt) or `off` (agy-native behavior) | `on` |
-| `turnTimeoutMin` | Overall cap on ONE agy turn, minutes, both engines. When it fires, the bridge kills the agy process mid-task ("ACP turn exceeded the 10m deadline" / "agy exceeded the 10m turn timeout") - it is a bridge cap, not a Google server limit. Default is TTY-aware: `0` (no cap) on an interactive pi - you are the backstop with Esc; `20` headless, where nobody can abort and one runaway turn blocks the serialized turn queue. Opt into a gate with 1-1440 (free type via `config.json` or `/agy timeout <1-1440|off>`, or the `/agy` picker's preset list); `0` disables explicitly; anything else falls back to the TTY-aware default. The 5m inactivity stall guard always still bounds a hung server | `0` TTY / `20` headless |
-| `inactivityTimeoutMin` | Silence cap, minutes, both engines: no stream-json stdout / no ACP session/update for this long fails the turn as a stall. `0` disables the guard | `5` |
+| `turnTimeoutMin` | Overall cap on ONE agy turn, minutes, both engines. Parked time (pi-tool round-trips, escalated calls, human-gated approvals) does not count against it on either engine: the cap pauses with remaining-budget semantics and resumes on unpark. When it fires, the bridge kills the agy process mid-task ("ACP turn exceeded the 10m deadline" / "agy exceeded the 10m turn timeout") - it is a bridge cap, not a Google server limit. Default is TTY-aware: `0` (no cap) on an interactive pi - you are the backstop with Esc; `20` headless, where nobody can abort and one runaway turn blocks the serialized turn queue. Opt into a gate with 1-1440 (free type via `config.json` or `/agy timeout <1-1440|off>`, or the `/agy` picker's preset list); `0` disables explicitly; anything else falls back to the TTY-aware default. The 5m inactivity stall guard always still bounds a hung server | `0` TTY / `20` headless |
+| `inactivityTimeoutMin` | Silence cap, minutes, both engines: no stream-json stdout / no ACP session/update for this long fails the turn as a stall. `0` disables the guard. Parks (bridge calls, escalated calls, ACP permission dialogs) pause it; agy-native long steps such as builds do not. A false kill costs the whole turn, and on stream-json a stall kill with no result frame clears the conversation binding. Keep `5`; use `2`-`3` only when native steps are known to be short; do not use `1` | `5` |
 
 Env overrides: `AGY_BRIDGE_TOOLS`, `AGY_ASK_TOOL`, `AGY_WEB_TOOLS`, `AGY_DIGEST`, `AGY_SYSTEM_PROMPT`, `AGY_TURN_TIMEOUT_MIN`, `AGY_INACTIVITY_TIMEOUT_MIN`. Env wins over the file, so while `AGY_DIGEST` or `AGY_SYSTEM_PROMPT` is set, the matching `/agy digest` or `/agy system-prompt` toggle persists a value that never takes effect.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",
@@ -46,7 +46,7 @@
     ]
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^1.0.0"
+    "@earendil-works/pi-coding-agent": "^1.5.0"
   },
   "peerDependenciesMeta": {
     "@earendil-works/pi-coding-agent": {

package/src/ask-tool.ts

@@ -16,7 +16,7 @@ import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { buildSessionContext, getAgentDir, keyHint } from "@earendil-works/pi-coding-agent";
+import { buildSessionContext, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { contentText, type ThinkingLevel } from "@earendil-works/pi-ai";
 import { Type } from "typebox";
@@ -759,7 +759,7 @@ export async function registerAskAntigravityTool(
 			}
 			return new Text(text, 0, 0);
 		},
-		renderResult(result, { expanded, isPartial }, theme) {
+		renderResult(result, { expanded, isPartial }, theme, context) {
 			const d = result.details as AgyDetails | undefined;
 			if (isPartial) {
 				const status = result.content[0]?.type === "text" ? result.content[0].text : "working...";
@@ -789,7 +789,7 @@ export async function registerAskAntigravityTool(
 				const lines = truncated.split("\n").slice(0, PREVIEW_MAX_LINES);
 				if (lines.length) text += `\n${theme.fg("toolOutput", lines.join("\n"))}`;
 				if (body.length > PREVIEW_MAX_CHARS || body.split("\n").length > PREVIEW_MAX_LINES) {
-					text += `\n${theme.fg("dim", `… (${keyHint("app.tools.expand", "to expand")})`)}`;
+					text += `\n${theme.fg("dim", `… (${context.keyHint("app.tools.expand", "to expand")})`)}`;
 				}
 			}
 			return new Text(text, 0, 0);

package/src/driver.ts

@@ -62,6 +62,12 @@ interface ActiveTurn {
 	resolve: (o: TurnOutcome) => void;
 	outcome: Promise<TurnOutcome>;
 	overallTimer?: NodeJS.Timeout;
+	/** Overall-cap bookkeeping for park pauses: a wall-clock deadline while
+	 *  the timer runs, null while parked (parked time must not consume the
+	 *  budget), mirroring the ACP driver's remaining-budget semantics. */
+	overallDeadline: number | null;
+	/** Remaining budget captured at park time; null while the timer runs. */
+	overallRemainingMs: number | null;
 	idleTimer?: NodeJS.Timeout;
 	onAbort?: () => void;
 	response: string;
@@ -117,6 +123,17 @@ function makeHandle(turn: ActiveTurn): TurnHandle {
 		pushExternal: (activity) => {
 			if (activity.type === "bridge_call") {
 				turn.parks += 1;
+				// A park suspends both caps: agy is blocked waiting on the MCP
+				// HTTP response, so parked time consumes neither the stall guard
+				// nor the turn deadline (pi-tool and human-gated time stay free).
+				if (turn.overallTimer) {
+					clearTimeout(turn.overallTimer);
+					turn.overallTimer = undefined;
+				}
+				if (turn.overallDeadline !== null) {
+					turn.overallRemainingMs = Math.max(0, turn.overallDeadline - Date.now());
+					turn.overallDeadline = null;
+				}
 				if (turn.idleTimer) {
 					clearTimeout(turn.idleTimer);
 					turn.idleTimer = undefined;
@@ -204,13 +221,20 @@ export class StreamDriver implements TurnDriver {
 		const turn = this.#active;
 		if (!turn || turn.closed) return;
 		if (turn.parks > 0) turn.parks -= 1;
-		if (turn.parks === 0 && !turn.idleTimer) {
-			const idleMin = turn.request.inactivityMin ?? 5;
-			// 0 disables the stall guard (config inactivityTimeoutMin: 0).
-			if (idleMin > 0) {
-				turn.idleTimer = setTimeout(() => {
-					void this.#turnDeadlineGuard(turn, "stall", `agy stalled for ${idleMin}m with no output`);
-				}, idleMin * 60_000);
+		if (turn.parks === 0) {
+			if (turn.overallRemainingMs !== null) {
+				const remaining = turn.overallRemainingMs;
+				turn.overallRemainingMs = null;
+				this.#startOverallTimer(turn, remaining);
+			}
+			if (!turn.idleTimer) {
+				const idleMin = turn.request.inactivityMin ?? 5;
+				// 0 disables the stall guard (config inactivityTimeoutMin: 0).
+				if (idleMin > 0) {
+					turn.idleTimer = setTimeout(() => {
+						void this.#turnDeadlineGuard(turn, "stall", `agy stalled for ${idleMin}m with no output`);
+					}, idleMin * 60_000);
+				}
 			}
 		}
 	}
@@ -312,6 +336,8 @@ export class StreamDriver implements TurnDriver {
 			outcome,
 			response: "",
 			rawResponse: "",
+			overallDeadline: null,
+			overallRemainingMs: null,
 			sanitizer: new StreamSanitizer(),
 			sawResult: false,
 			sawModelStep: false,
@@ -343,11 +369,7 @@ export class StreamDriver implements TurnDriver {
 		// 0 disables a cap (config turnTimeoutMin / inactivityTimeoutMin: 0):
 		// setTimeout(fn, 0) would fire instantly and kill every turn.
 		const totalMin = turn.request.timeoutMin ?? 10;
-		if (totalMin > 0) {
-			turn.overallTimer = setTimeout(() => {
-				void this.#turnDeadlineGuard(turn, "timeout", `agy exceeded the ${totalMin}m turn timeout`);
-			}, totalMin * 60_000);
-		}
+		if (totalMin > 0) this.#startOverallTimer(turn, totalMin * 60_000);
 		const idleMin = turn.request.inactivityMin ?? 5;
 		if (idleMin > 0) {
 			turn.idleTimer = setTimeout(() => {
@@ -356,6 +378,18 @@ export class StreamDriver implements TurnDriver {
 		}
 	}
 
+	/** Arm the overall turn cap. A deadline is a wall-clock instant while
+	 *  running; parks capture the remainder and clear it (see
+	 *  ActiveTurn.overallDeadline). A 0ms remainder fires on the next tick,
+	 *  which is correct: the budget is spent. */
+	#startOverallTimer(turn: ActiveTurn, ms: number): void {
+		const totalMin = turn.request.timeoutMin ?? 10;
+		turn.overallDeadline = Date.now() + ms;
+		turn.overallTimer = setTimeout(() => {
+			void this.#turnDeadlineGuard(turn, "timeout", `agy exceeded the ${totalMin}m turn timeout`);
+		}, ms);
+	}
+
 	#start(request: DriverTurnRequest): void {
 		this.#state = "starting";
 		this.#generation += 1;

package/src/provider.ts

@@ -138,7 +138,18 @@ function extractImages(context: TranscriptContext): Array<{ data: string; mimeTy
 
 const COMPACTION_MARKER = "compacted into the following summary";
 
-const DIGEST_PREAMBLE =
+/** Synthetic prompt for a resume turn (issue #8): pi's retry dropped the
+ *  failed attempt from the projected context (_omitRecoveryAttempt), leaving
+ *  a toolResult or assistant tail with no live agy turn. The bound
+ *  conversation already holds the task history, so re-open it with this
+ *  instead of the unretryable "no user message" hard error (which stalled
+ *  an unattended session for ~6 hours). The wording must stress not
+ *  repeating actions: the discarded attempt may have half-run with side
+ *  effects agy saw but pi never recorded. */
+export const RESUME_PROMPT =
+	"[The previous attempt of this turn failed and was discarded. Check your conversation history for the last step you completed, then continue the task from there. Do not repeat completed actions.]";
+
+export const DIGEST_PREAMBLE =
 	"[The following is context from the broader pi session that this Antigravity turn was not directly spawned for: compaction summaries and turns handled by other providers or pi's own tools. Your own prior turns are already in your conversation history. Use this for continuity only.]";
 
 // --- pi system prompt (G10) ----------------------------------------------------
@@ -1453,20 +1464,40 @@ async function runTurnDriver(
 			return;
 		}
 		// Fresh pass, or a stranded escalated result being re-delivered.
-		const prompt = extractUserPrompt(context);
+		const userPrompt = extractUserPrompt(context);
 		const images = extractImages(context);
+		// Resume pass (issue #8): pi's retry dropped the failed attempt from the
+		// projected context, so the transcript ends in a toolResult or assistant
+		// message and there is no user prompt, no pending park, and nothing
+		// late. With a bound conversation, agy holds the task history: re-open
+		// it with a synthetic resume prompt instead of the hard error below
+		// (pi does not retry that error; it stalls unattended sessions). The
+		// binding is required: "continue" into a brand-new conversation has no
+		// task to continue. Restricted to the two retry tails: an empty
+		// transcript (lastRole undefined) and a user tail both keep their
+		// existing behavior.
+		const lastRole = context.messages[context.messages.length - 1]?.role;
+		const resume =
+			!userPrompt &&
+			images.length === 0 &&
+			late.length === 0 &&
+			Boolean(existing?.conversationId) &&
+			(lastRole === "toolResult" || lastRole === "assistant");
+		const prompt = resume ? RESUME_PROMPT : userPrompt;
+		if (resume) deps.log?.("resume-turn", { conversation: existing?.conversationId }, "error");
 		// An image-only message (no text) is valid on the ACP engine; only fail
 		// when there is nothing at all to send (no text, no images, no late
 		// tool results to deliver).
 		if (!prompt && images.length === 0 && late.length === 0) {
-			deps.log?.("turn-error", { reason: "no-user-message" }, "debug");
+			deps.log?.("turn-error", { reason: "no-user-message" }, "error");
 			finalize(stream, blocks, "error", "No user message to send to agy.");
 			return;
 		}
 		const watermark = existing?.lastMessageCount ?? 0;
-		// Late turns re-open the conversation with a synthetic prompt; the digest
-		// would re-send context agy already holds, so skip it.
-		const digest = config.digest && late.length === 0 ? buildContextDigest(context.messages, watermark) : "";
+		// Late and resume turns re-open the conversation with a synthetic
+		// prompt; the digest would re-send context agy already holds (against a
+		// stale watermark: a failed pass never advances it), so skip it.
+		const digest = config.digest && late.length === 0 && !resume ? buildContextDigest(context.messages, watermark) : "";
 		// G1 delivery per engine. stream-json: digest rides inline in the prompt
 		// (the CLI has no context channel). ACP: the server advertises
 		// `embeddedContext`, so the digest ships as a native resource block
@@ -1575,7 +1606,24 @@ async function runTurnDriver(
 			if (consumeActivity(stream, blocks, activity, diffCtx, cwd, feats) === "parked") return "parked";
 		}
 	};
-	if ((await drainTurn(handle)) === "parked") return;
+	if ((await drainTurn(handle)) === "parked") {
+		// A park proves agy got the prompt and is working in this conversation.
+		// Persist a first-turn binding now: otherwise a first-ever turn that
+		// parks and then dies (failed continuation, process restart) leaves no
+		// record, and the retry-dropped tail (issue #8) has nothing to resume
+		// into. Only when no record exists: an unbound run() cannot have
+		// recreated a conversation, so the snapshot id is the real one, and
+		// the staged agent must move with the binding or a stream-json resume
+		// re-runs without its carrier-agent profile.
+		if (!existing) {
+			const parkedConv = deps.driver.snapshot().conversationId;
+			if (parkedConv) {
+				store.set(key, { conversationId: parkedConv, lastStepIdx: -1, lastMessageCount: messageCount });
+				if (stagedAgentName) stagedAgentByConversation.set(parkedConv, stagedAgentName);
+			}
+		}
+		return;
+	}
 
 	let outcome = await handle.outcome;
 	// Issue #2 recovery paths. agy's stream-json prompt path silently drops an
@@ -1585,12 +1633,17 @@ async function runTurnDriver(
 	// settling OK here would persist a dead conversation for every later turn
 	// (probe 2026-09-30: resume of a dropped-turn conversation never returns
 	// a result frame). stream-json only: the ACP driver leaves the evidence
-	// fields undefined.
+	// fields undefined. modelOutputSeen === false keeps deadline kills of a
+	// turn that demonstrably worked (it parked, so a model step arrived) on
+	// the plain retryable error path: "conversation is dead" would be wrong
+	// for a first turn, and deleting a park-time binding (issue #8) would
+	// strip the retry of its conversation.
 	const silentDrop = outcome.status === "OK" && outcome.modelOutputSeen === false;
 	const poisonedResume =
 		outcome.status === "ERROR" &&
 		outcome.deadline !== undefined &&
 		outcome.sawResult === false &&
+		outcome.modelOutputSeen === false &&
 		Boolean(existing?.conversationId);
 	if (silentDrop || poisonedResume) {
 		if (existing?.conversationId || outcome.conversationId) {