@estebanforge/pi-antigravity-bridge 1.9.2 → 1.9.3

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.9.3] - 2026-11-06
+
+### Fixed
+
+- **A silently dying ACP server now reports its exit code and signal.** The exit handler received the child's code and signal but dropped them (hardcoded null), so a `.par` that died before answering initialize surfaced only as "process gone" with no cause (issue #9). The code and signal now reach the abort reason and the user-facing mid-turn failure, and the `connection-exited` log line records them alongside the stderr tail.
+
+- **The registry's declared `distribution.binary.args` are now honored.** The installer read only `archive` and `cmd`, so a Linux-only arg like `--uid=` was silently dropped and the server never received it (issue #9). Args are validated as a flat string array, persisted to a sidecar `args.json` next to `zip.sha256` (so the already-installed early-return path recovers them), and resolved by path identity against the managed `<root>/current` binary: setup persists that path into `acp.bin`, so a source-label check would wrongly treat it as a user override on the next turn. Env and config overrides (a user shim such as `agy acp`) own their argv and get no registry args. Both `/agy auth` flows and the per-connection driver receive them.
+
+- **A ToS-disabled Google account is detected at sign-in instead of on the first real prompt.** The credential probe used only `session/new`, which a disabled account passes, so it wrote a sticky verified marker and `/agy doctor` kept reporting healthy (issue #9). The probe now sends one bounded `session/prompt` and scans the streamed reply for the disablement notice (Google returns it as normal content, not a -32000 auth error). A disabled account fails auth immediately with appeal guidance and writes no marker; the probe is time-capped so a hollow or hung server fails rather than hanging `/agy auth`, and the reply head is logged so a change in Google's wording is diagnosable. The probe is scoped to the token-absent branch to avoid a model call on every normal browser sign-in.
+
 ## [1.9.2] - 2026-11-02
 
 ### Fixed

package/extensions/index.ts

@@ -62,7 +62,7 @@ import { AcpDriver } from "../src/acp/driver.js";
 import { runAcpAuth } from "../src/acp/auth.js";
 import { setAuthInvalidatedHook } from "../src/acp/connection.js";
 import { setupAuthUrlCapture } from "../src/acp/browser-capture.js";
-import { clearAcpAuthVerified, ensureAcpReady, inspectAcpSetup } from "../src/acp/setup.js";
+import { clearAcpAuthVerified, ensureAcpReady, inspectAcpSetup, resolveInstalledArgs } from "../src/acp/setup.js";
 import { ensureQueuedMessagesDefaults } from "../src/queued-messages.js";
 import type { TurnDriver, TurnOutcome } from "../src/driver-types.js";
 import { CONFIG_PATH, loadConfig, logsDir, MAX_TURN_CAP_MIN, parseCapMinutes, saveConfig, type AgyMode, type BridgeTools, type Engine, type ThinkingTier } from "../src/config.js";
@@ -313,6 +313,10 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		// Resolved per connection: the setup flow can install the binary and
 		// update acp.bin mid-session; the next turn picks it up (no restart).
 		bin: () => loadConfig().acp.bin,
+		// Registry-declared argv for the managed binary (e.g. linux --uid=).
+		// Empty for env/config overrides, which own their argv. Resolved per
+		// connection alongside bin so a mid-session install picks them up.
+		binArgs: () => resolveInstalledArgs({ configBin: loadConfig().acp.bin }),
 		// Resolved per turn: /agy and AGY_USAGE_ESTIMATE changes apply without
 		// a restart. Without this the driver defaults to "estimate" and the
 		// config knob (incl. "off") is dead.
@@ -656,6 +660,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			);
 			const r = await runAcpAuth({
 				bin: status.bin,
+				binArgs: status.args,
 				...(authCapture ? { extraEnv: authCapture.browserEnv, authUrlFile: authCapture.file } : {}),
 				log: acpLog,
 			});
@@ -1319,6 +1324,7 @@ function registerAgyCommand(pi: ExtensionAPI, ctx: AgyCommandCtx): void {
 				);
 				const r = await runAcpAuth({
 					bin: status.bin,
+					binArgs: status.args,
 					extraEnv: ctx.authCapture?.browserEnv,
 					authUrlFile: ctx.authCapture?.file,
 					log: ctx.acpLog,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.9.2",
+  "version": "1.9.3",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/auth.ts

@@ -1,4 +1,5 @@
 import { AcpConnection } from "./connection.js";
+import { mapUpdate } from "./events.js";
 import { hasAcpToken, writeAcpAuthVerified } from "./setup.js";
 
 // Explicit sign-in (/agy auth): spawn a short-lived server, send
@@ -53,23 +54,62 @@ export interface AcpAuthResult {
 	error?: string;
 }
 
-/** Live credential probe for the token-absent branch: a server with usable
- *  credentials answers session/new; a hollow accept starts (or wants) a
- *  browser flow and the request times out or errors. Closes the probe
- *  session; the caller kills the connection either way. */
-async function probeUsableCredentials(conn: AcpConnection, cwd?: string): Promise<boolean> {
+/** Google returns account-disablement as a normal session/prompt reply
+ *  (stopReason end_turn) carrying this text, not a -32000 auth error, so a
+ *  session/new probe alone cannot tell "authenticated" from "entitled". */
+const ACCOUNT_DISABLED_RE = /disabled in this account|violation of\s+Terms of Service|submit an appeal/i;
+
+/** Bounds the probe's session/prompt. A real first token normally lands well
+ *  under this; a hollow or hung server hits the cap and fails auth. */
+const PROBE_PROMPT_TIMEOUT_MS = 30_000;
+
+/** Live credential probe for the token-absent branch. session/new alone is
+ *  too shallow: a ToS-disabled account passes it. So the probe sends one
+ *  trivial session/prompt and inspects the streamed reply (collected by the
+ *  caller's onUpdate into `sink`): the disablement notice means the account
+ *  is blocked (distinct from a hollow accept). Returns "usable" only when
+ *  the prompt completes without that notice. Closes the probe session; the
+ *  caller kills the connection either way. */
+async function probeUsableCredentials(
+	conn: AcpConnection,
+	sink: { text: string },
+	log: (event: string, data?: unknown) => void,
+	cwd?: string,
+): Promise<"usable" | "disabled" | "unusable"> {
+	let timer: NodeJS.Timeout | undefined;
 	try {
 		const s = await conn.newSession(cwd ?? process.cwd());
-		await conn.closeSession(s.sessionId).catch(() => {});
-		return true;
+		try {
+			sink.text = "";
+			// conn.prompt has no timeout by design (driver timers govern real
+			// turns). The probe runs during interactive auth, so bound it: a
+			// hollow server that accepts session/new but never answers the
+			// prompt must fail, not hang /agy auth and the authInFlight lock.
+			await Promise.race([
+				conn.prompt(s.sessionId, "ping"),
+				new Promise<never>((_, reject) => {
+					timer = setTimeout(() => reject(new Error("probe prompt timed out")), PROBE_PROMPT_TIMEOUT_MS);
+				}),
+			]);
+		} finally {
+			clearTimeout(timer);
+			await conn.closeSession(s.sessionId).catch(() => {});
+		}
+		// Log the reply head so a change in Google's disablement wording (which
+		// would silently regress the regex to "usable") is diagnosable.
+		log("auth-probe-reply", { head: sink.text.slice(0, 200) });
+		return ACCOUNT_DISABLED_RE.test(sink.text) ? "disabled" : "usable";
 	} catch {
-		return false;
+		return "unusable";
 	}
 }
 
 let authInFlight: Promise<AcpAuthResult> | null = null;
 
 export function runAcpAuth(opts: AcpAuthOptions): Promise<AcpAuthResult> {
+	// Collects streamed reply text so the credential probe can detect an
+	// account-disablement notice (which arrives as normal prompt content).
+	const probeSink = { text: "" };
 	const conn = new AcpConnection({
 		bin: opts.bin,
 		binArgs: opts.binArgs,
@@ -77,7 +117,10 @@ export function runAcpAuth(opts: AcpAuthOptions): Promise<AcpAuthResult> {
 		extraEnv: opts.extraEnv,
 		authUrlFile: opts.authUrlFile,
 		log: opts.log ?? (() => {}),
-		onUpdate: () => {},
+		onUpdate: (_sessionId, update) => {
+			const mapped = mapUpdate(update);
+			if (mapped?.kind === "text") probeSink.text += mapped.delta;
+		},
 		onExit: () => {},
 	});
 	const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
@@ -91,8 +134,15 @@ export function runAcpAuth(opts: AcpAuthOptions): Promise<AcpAuthResult> {
 			if (!hasAcpToken(opts.tokenDir)) {
 				// authenticate replied but no token file: either the server
 				// authenticated from artifacts outside antigravity-acp, or the
-				// reply is hollow. A live session/new separates the two.
-				if (!(await probeUsableCredentials(conn, opts.cwd))) {
+				// reply is hollow. A live session prompt separates the two.
+				const probe = await probeUsableCredentials(conn, probeSink, opts.log ?? (() => {}), opts.cwd);
+				if (probe === "disabled") {
+					return {
+						ok: false,
+						error: "this Google account is disabled for the Antigravity service (Terms of Service). Signing in again will not help; submit an appeal with Google to restore access.",
+					};
+				}
+				if (probe !== "usable") {
 					return {
 						ok: false,
 						error: `the server accepted the sign-in but holds no usable credentials (session probe failed; token file absent in ${opts.tokenDir ?? "~/.gemini/antigravity-acp"}). Finish the Google sign-in if a browser opened, then retry /agy auth.`,
@@ -101,6 +151,11 @@ export function runAcpAuth(opts: AcpAuthOptions): Promise<AcpAuthResult> {
 				writeAcpAuthVerified(opts.authVerifiedFile);
 				return { ok: true, note: "the server authenticated from existing credentials; no browser sign-in was needed" };
 			}
+			// Token present (normal browser sign-in): no entitlement probe. A
+			// ToS-disabled account that completes a real sign-in still verifies
+			// here and surfaces the disablement on its first real prompt. The
+			// prompt probe is scoped to the token-absent branch (issue #9's
+			// `agy acp` shim path) to avoid a model call on every sign-in.
 			writeAcpAuthVerified(opts.authVerifiedFile);
 			return { ok: true };
 		} catch (err) {

package/src/acp/connection.ts

@@ -246,8 +246,13 @@ export class AcpConnection {
 		child.on("exit", (code, signal) => {
 			this.#opts.log("exit", { code: code ?? signal ?? "?" });
 			// The reason rides into pending-request rejections, so it must be
-			// redacted here (server stderr can carry auth material).
-			this.#finish(redactText(this.#stderrTail.trim()));
+			// redacted here (server stderr can carry auth material). When the
+			// server dies with no output the exit code/signal is the only clue,
+			// so it goes into the reason ahead of the stderr tail.
+			const where = signal ? `signal ${signal}` : code !== null ? `code ${code}` : "";
+			const tail = redactText(this.#stderrTail.trim());
+			const detail = [where, tail || "process gone"].filter(Boolean).join(": ");
+			this.#finish(detail, code, signal);
 		});
 
 		const result = (await this.request(
@@ -582,7 +587,7 @@ export class AcpConnection {
 		this.#opts.log("auth-url", { url, port: parseAuthPort(url) });
 	}
 
-	#finish(reason: string): void {
+	#finish(reason: string, code: number | null = null, signal: NodeJS.Signals | null = null): void {
 		if (this.#exited) return;
 		this.#exited = true;
 		this.#authUrlWatcher?.close();
@@ -593,7 +598,7 @@ export class AcpConnection {
 		this.#permissionPending.clear();
 		for (const deny of pendings) deny();
 		this.abortAll(`connection exited: ${reason || "process gone"}`);
-		this.#opts.onExit({ code: null, signal: null, stderrTail: redactText(this.#stderrTail) });
+		this.#opts.onExit({ code, signal, stderrTail: redactText(this.#stderrTail) });
 	}
 }
 

package/src/acp/driver.ts

@@ -45,8 +45,10 @@ export interface AcpDriverOptions {
 	 *  is resolved per connection: setup can install the binary and update
 	 *  config mid-session, and the next turn picks it up without a restart. */
 	bin: string | (() => string);
-	/** Extra argv for the binary (tests: node + fake-server script). */
-	binArgs?: string[];
+	/** Extra argv for the binary (tests: node + fake-server script). A
+	 *  function is resolved per connection, like bin, so registry args from a
+	 *  mid-session managed install apply without a restart. */
+	binArgs?: string[] | (() => string[]);
 	extraEnv?: Record<string, string>;
 	/** Record file for BROWSER-captured OAuth URLs; passed to the connection,
 	 *  which logs "auth-url" when the server tries to open a login. */
@@ -472,7 +474,7 @@ export class AcpDriver implements TurnDriver {
 		}
 	}
 
-	#onConnectionExit(conn: AcpConnection, info: { stderrTail: string }): void {
+	#onConnectionExit(conn: AcpConnection, info: { code: number | null; signal: string | null; stderrTail: string }): void {
 		if (this.#conn !== conn) {
 			// A replaced connection reporting its death late (RC01's signal
 			// handler intercepts SIGTERM and can outlive its replacement by
@@ -489,7 +491,12 @@ export class AcpDriver implements TurnDriver {
 		// mid-flight is user-reportable, and it surfaces as a normal turn
 		// error, not as raw console noise.
 		const turnActive = Boolean(turn && !turn.closed && !turn.aborted && !turn.sawResult);
-		this.#log("connection-exited", { expected: !turnActive, tail: info.stderrTail.slice(-200) });
+		this.#log("connection-exited", {
+			expected: !turnActive,
+			code: info.code,
+			signal: info.signal,
+			tail: info.stderrTail.slice(-200),
+		});
 		if (!turn || turn.closed) return;
 		if (turn.aborted || turn.sawResult) {
 			this.#settle(turn, {
@@ -501,7 +508,10 @@ export class AcpDriver implements TurnDriver {
 			});
 			return;
 		}
-		this.#failTurn(turn, "Antigravity session exited unexpectedly; it restarts on the next turn");
+		// A silent death (no stderr) leaves only the exit code/signal as a
+		// clue; surface it so the failure is not a bare "exited unexpectedly".
+		const where = info.signal ? ` (signal ${info.signal})` : info.code !== null ? ` (code ${info.code})` : "";
+		this.#failTurn(turn, `Antigravity session exited unexpectedly${where}; it restarts on the next turn`);
 	}
 
 	#ensureConnection(request: DriverTurnRequest): Promise<AcpConnection> {
@@ -511,7 +521,7 @@ export class AcpDriver implements TurnDriver {
 		this.#stats.spawns += 1;
 		const conn = new AcpConnection({
 			bin: resolveAcpBinary(typeof this.#opts.bin === "function" ? this.#opts.bin() : this.#opts.bin),
-			binArgs: this.#opts.binArgs,
+			binArgs: typeof this.#opts.binArgs === "function" ? this.#opts.binArgs() : this.#opts.binArgs,
 			extraEnv: this.#opts.extraEnv,
 			authUrlFile: this.#opts.authUrlFile,
 			cwd: request.cwd,

package/src/acp/setup.ts

@@ -52,6 +52,8 @@ export type AcpSetupStatus =
 			ok: true;
 			bin: string;
 			binarySource: "env" | "config" | "installed" | "existing";
+			/** Registry argv for the managed binary; empty for env/config overrides. */
+			args: string[];
 			auth: string;
 			/** True when auth was just set to oauth-personal: /agy auth opens
 			 *  the Google login in the browser. */
@@ -121,6 +123,15 @@ export function executableFile(p: string): boolean {
 interface RegistryBinary {
 	archive: string;
 	cmd?: string;
+	/** Platform-specific argv the server needs to boot (e.g. linux `--uid=`).
+	 *  Untrusted registry data: validated as a string array before use. */
+	args?: unknown;
+}
+
+/** Registry args are untrusted; accept only a flat string array. */
+function normalizeRegistryArgs(raw: unknown): string[] {
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((a): a is string => typeof a === "string");
 }
 
 async function fetchRegistryBinary(opts: SetupOptions, key: string): Promise<RegistryBinary> {
@@ -180,6 +191,8 @@ export interface InstallResult {
 	build: string;
 	sha256: string;
 	downloaded: boolean;
+	/** Registry-declared argv for the managed binary (may be empty). */
+	args: string[];
 }
 
 /** Fetch the pinned registry build for this platform and install it under
@@ -193,8 +206,11 @@ export async function installAcpBinary(opts: SetupOptions = {}): Promise<Install
 	const cmd = (entry.cmd ?? "./agy_acp_server.par").replace(/^\.\//, "");
 	const dir = path.join(root, build);
 	const bin = path.join(dir, cmd);
+	const args = normalizeRegistryArgs(entry.args);
 	if (executableFile(bin)) {
-		return { bin, build, sha256: readRecordedSha(dir), downloaded: false };
+		// Already installed: recover any recorded args so the early-return
+		// path does not silently drop them.
+		return { bin, build, sha256: readRecordedSha(dir), downloaded: false, args: readRecordedArgs(dir) };
 	}
 
 	fs.mkdirSync(root, { recursive: true });
@@ -209,13 +225,14 @@ export async function installAcpBinary(opts: SetupOptions = {}): Promise<Install
 	if (!executableFile(bin)) throw new Error(`${cmd} not found in the archive after unpacking`);
 	fs.chmodSync(bin, 0o755);
 	fs.writeFileSync(path.join(dir, "zip.sha256"), `${sha}  ${path.basename(entry.archive)}\n`);
+	if (args.length > 0) fs.writeFileSync(path.join(dir, "args.json"), JSON.stringify(args));
 
 	// Re-point `current` at the new build. The link is ours (managed layout).
 	const link = path.join(root, "current");
 	fs.rmSync(link, { force: true });
 	fs.symlinkSync(build, link);
 	opts.onProgress?.("ACP server installed.");
-	return { bin, build, sha256: sha, downloaded: true };
+	return { bin, build, sha256: sha, downloaded: true, args };
 }
 
 function readRecordedSha(dir: string): string {
@@ -226,6 +243,14 @@ function readRecordedSha(dir: string): string {
 	}
 }
 
+function readRecordedArgs(dir: string): string[] {
+	try {
+		return normalizeRegistryArgs(JSON.parse(fs.readFileSync(path.join(dir, "args.json"), "utf8")));
+	} catch {
+		return [];
+	}
+}
+
 export interface AuthState {
 	configured: boolean;
 	/** settings.json auth.type, "token" (acp_token.json present), or undefined. */
@@ -343,6 +368,25 @@ export function resolveInstalledBinary(opts: SetupOptions = {}): BinaryResolutio
 	return { bin: null, source: null };
 }
 
+/** Registry argv for the managed install only. Env/config overrides (a user
+ *  shim like `agy acp`, or AGY_ACP_BIN) own their argv, so they get none.
+ *  Identity is by PATH, not by which candidate won: setup persists the managed
+ *  path into acp.bin, so after install the config candidate resolves to the
+ *  managed binary too. Compare realpaths against `<root>/current/...` (the
+ *  symlink target carries the args.json sidecar). Empty when not managed. */
+export function resolveInstalledArgs(opts: SetupOptions = {}): string[] {
+	const binary = resolveInstalledBinary(opts);
+	if (!binary.bin) return [];
+	const root = opts.installRoot ?? defaultInstallRoot();
+	const managed = path.join(root, "current", "agy_acp_server.par");
+	try {
+		if (fs.realpathSync(binary.bin) !== fs.realpathSync(managed)) return [];
+	} catch {
+		return [];
+	}
+	return readRecordedArgs(path.dirname(fs.realpathSync(managed)));
+}
+
 /** Read-only setup state (for /agy doctor): no installs, no writes. */
 export function inspectAcpSetup(opts: SetupOptions = {}): { bin: string | null; source: string | null; auth: string | null } {
 	const binary = resolveInstalledBinary(opts);
@@ -367,6 +411,7 @@ export async function ensureAcpReady(opts: SetupOptions = {}): Promise<AcpSetupS
 
 	// 1. Binary.
 	let binary = resolveInstalledBinary(opts);
+	let args = resolveInstalledArgs(opts);
 	if (!binary.bin) {
 		if (opts.install === false) {
 			return { ok: false, stage: "install", error: "no ACP server binary found", manual: MANUAL_SETUP };
@@ -374,6 +419,7 @@ export async function ensureAcpReady(opts: SetupOptions = {}): Promise<AcpSetupS
 		try {
 			const installed = await installAcpBinary(opts);
 			binary = { bin: installed.bin, source: "installed" };
+			args = installed.args;
 			actions.push(installed.downloaded ? `installed ACP server build ${installed.build}` : `found installed ACP server build ${installed.build}`);
 		} catch (err) {
 			return {
@@ -397,7 +443,7 @@ export async function ensureAcpReady(opts: SetupOptions = {}): Promise<AcpSetupS
 		try {
 			writeAuthType("oauth-personal", gdir);
 			actions.push("configured oauth-personal auth (your Antigravity subscription login)");
-			return { ok: true, bin: binary.bin!, binarySource: binary.source!, auth: "oauth-personal", needsLogin: true, actions };
+			return { ok: true, bin: binary.bin!, binarySource: binary.source!, args, auth: "oauth-personal", needsLogin: true, actions };
 		} catch (err) {
 			return {
 				ok: false,
@@ -419,6 +465,7 @@ export async function ensureAcpReady(opts: SetupOptions = {}): Promise<AcpSetupS
 		ok: true,
 		bin: binary.bin!,
 		binarySource: binary.source!,
+		args,
 		auth: auth.type ?? "token",
 		needsLogin,
 		actions,