@estebanforge/pi-antigravity-bridge 1.9.3 → 1.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.9.3",
+  "version": "1.10.0",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/connection.ts

@@ -1,16 +1,10 @@
-// ACP connection: owns the agy_acp_server process, the JSON-RPC session over
-// its stdio, and the protocol methods the driver needs. One connection hosts
-// one session at a time (the driver's model), but the transport supports more.
+// ACP connection: owns the agy acp process, the JSON-RPC session over its
+// stdio, and the protocol methods the driver needs.
 //
-// Protocol facts encoded here were verified live against
-// agy_acp_server_20260818_01_RC01 (docs/ACP-PROTOCOL-REFERENCE.md):
+// Verified live against agy 1.5.3:
 //   - initialize: {protocolVersion:1, clientCapabilities{fs:false,terminal:false}}
-//   - authenticate takes `methodId`; auth errors are -32000 with remediation in
-//     data.message; the token persists in ~/.gemini/antigravity-acp/acp_token.json
-//   - session/set_config_option takes `configId` (model value = FULL slug with
-//     the effort tier baked in, e.g. gemini-3.8-flash-low)
-//   - session/cancel returns -32601 on RC01 (not implemented) — the driver
-//     treats that as "cancel unsupported" and falls back to teardown+kill
+//   - model and thought_level are separate session config options
+//   - session/cancel is a notification; the prompt settles with stopReason cancelled
 //   - session/request_permission: skipPermissions turns answer the first
 //     allow option synchronously; otherwise a wired human handler PARKS the
 //     request (the JSON-RPC reply waits for the decision), and everything
@@ -21,14 +15,11 @@
 //     LIST; a dead URL is accepted at session time (lazy connect)
 
 import { spawn, type ChildProcess } from "node:child_process";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { parseAuthPort, readLastUrl } from "./browser-capture.js";
 import { frameCarriesUsage } from "./events.js";
 import type { AgyUsage } from "../driver-types.js";
 import { redactText } from "../redact.js";
 import { JsonRpcResponseError, JsonRpcSession } from "./jsonrpc.js";
+import { removeStagedAcpHome, stageAcpHome } from "./home.js";
 
 export interface AcpMcpServer {
 	name: string;
@@ -50,16 +41,6 @@ export class AcpAuthError extends Error {
 	}
 }
 
-/** Fired exactly when the SERVER reports an auth failure (-32000 family).
- *  The extension entry wires this to clearAcpAuthVerified(): a verified
- *  marker must never outlive the server disagreeing with it. Kept as a hook
- *  so the low-level connection stays decoupled from bridge file paths. */
-let authInvalidatedHook: (() => void) | null = null;
-
-export function setAuthInvalidatedHook(fn: (() => void) | null): void {
-	authInvalidatedHook = fn;
-}
-
 export interface AcpConnectionOptions {
 	/** Process working directory for the spawned server. */
 	cwd: string;
@@ -67,6 +48,8 @@ export interface AcpConnectionOptions {
 	 *  fake-server script for tests). */
 	bin: string;
 	binArgs?: string[];
+	/** Native agy only: filter per-pid bridges out of inherited global MCP. */
+	isolateHome?: boolean | { geminiHome?: string; parentDir?: string };
 	extraEnv?: Record<string, string>;
 	log: (msg: string, data?: unknown) => void;
 	/** Verified `session/update` payloads (post-suppression). */
@@ -87,11 +70,6 @@ export interface AcpConnectionOptions {
 	onPermissionRequest?: AcpPermissionHandler;
 	/** Park budget for one permission dialog. Tests shrink it. */
 	permissionParkMs?: number;
-	/** Record file for BROWSER-captured OAuth URLs (src/acp/browser-capture.ts).
-	 *  The server hands the login URL only to the browser-open call, so the
-	 *  wrapper records it there; the connection watches the file and logs
-	 *  "auth-url" {url, port} for every new URL. */
-	authUrlFile?: string;
 }
 
 const INIT_TIMEOUT_MS = 30_000;
@@ -126,6 +104,7 @@ export class AcpConnection {
 	#child: ChildProcess | undefined;
 	#rpc: JsonRpcSession | undefined;
 	#stderrTail = "";
+	#stagedHome: string | undefined;
 	#usageSeen = false;
 	/** Set ONLY by a parsed PromptResponse.usage; this gates estimate
 	 *  suppression. #usageSeen stays diagnostic: any usage-shaped frame trips
@@ -138,11 +117,8 @@ export class AcpConnection {
 	agentInfo: Record<string, unknown> | undefined;
 	/** Last known mode/model config echo from set_config_option results. */
 	lastConfigOptions: unknown = undefined;
-	#authUrlWatcher: fs.FSWatcher | undefined;
-	#lastAuthUrl: string | null = null;
-	/** Parked permission dialogs: each entry settles its own request with a
-	 *  deny. #finish drains the set so a dying connection never leaves the
-	 *  server's request hanging. */
+	/** Parked permission dialogs: each entry settles its own request as
+	 *  cancelled. Cancellation and connection death drain the set. */
 	#permissionPending = new Set<() => void>();
 	/** allow_always / reject_always answers, keyed by toolCall kind|title for
 	 *  the life of this connection: identical requests skip the dialog. */
@@ -190,15 +166,24 @@ export class AcpConnection {
 	async start(): Promise<void> {
 		if (this.#child) return;
 		const args = [...(this.#opts.binArgs ?? [])];
-		const child = spawn(this.#opts.bin, args, {
-			cwd: this.#opts.cwd,
-			stdio: ["pipe", "pipe", "pipe"],
-			detached: process.platform !== "win32",
-			windowsHide: true,
-			...(this.#opts.extraEnv ? { env: { ...process.env, ...this.#opts.extraEnv } } : {}),
-		});
+		if (this.#opts.isolateHome) {
+			this.#stagedHome = stageAcpHome(typeof this.#opts.isolateHome === "object" ? this.#opts.isolateHome : {});
+			args.push("--gemini-dir", this.#stagedHome);
+		}
+		let child: ChildProcess;
+		try {
+			child = spawn(this.#opts.bin, args, {
+				cwd: this.#opts.cwd,
+				stdio: ["pipe", "pipe", "pipe"],
+				detached: process.platform !== "win32",
+				windowsHide: true,
+				...(this.#opts.extraEnv ? { env: { ...process.env, ...this.#opts.extraEnv } } : {}),
+			});
+		} catch (err) {
+			this.#releaseHome();
+			throw err;
+		}
 		this.#child = child;
-		if (this.#opts.authUrlFile) this.#watchAuthUrl();
 		child.stdout?.setEncoding("utf8");
 		child.stderr?.setEncoding("utf8");
 		// Pipe failures arrive asynchronously as stream 'error' events; the sync
@@ -273,10 +258,6 @@ export class AcpConnection {
 		return typeof v === "string" ? v : undefined;
 	}
 
-	/** True once the server answered -32601 for session/cancel on THIS
-	 *  process (probed lazily by the driver; never assumed). */
-	cancelSupported: boolean | null = null;
-
 	async newSession(cwd: string): Promise<AcpSessionInfo> {
 		const result = (await this.guarded(
 			"session/new",
@@ -352,9 +333,8 @@ export class AcpConnection {
 		if (typeof stopReason !== "string") {
 			throw new Error("ACP session/prompt returned no stopReason");
 		}
-		// Optional, unstable ACP PromptResponse.usage: absent on 1.1.1 but
-		// parsed for the day the server forwards its SDK usage_metadata. Never
-		// infer exact counts from a context-window usage_update ({used,size}).
+		// Exact PromptResponse.usage is distinct from context-window occupancy
+		// updates; never infer token counts from {used,size}.
 		const usage = parseAcpTurnUsage(result?.usage);
 		if (usage) {
 			this.#usageSeen = true;
@@ -363,17 +343,10 @@ export class AcpConnection {
 		return { stopReason, ...(usage ? { usage } : {}) };
 	}
 
-	/** Probe-and-cancel. Returns supported:false when the server does not
-	 *  implement session/cancel (-32601 on RC01); other errors propagate as
-	 *  translated Errors. Protocol probing stays inside the connection layer. */
-	async cancel(sessionId: string): Promise<{ supported: boolean }> {
-		try {
-			await this.request("session/cancel", { sessionId }, SESSION_OP_TIMEOUT_MS);
-			return { supported: true };
-		} catch (err) {
-			if (err instanceof JsonRpcResponseError && err.code === -32601) return { supported: false };
-			throw translateError("session/cancel", err);
-		}
+	cancel(sessionId: string): void {
+		if (!this.#rpc || !this.alive) throw new Error("ACP connection is not running");
+		this.#rpc.notify("session/cancel", { sessionId });
+		for (const cancel of [...this.#permissionPending]) cancel();
 	}
 
 	async closeSession(sessionId: string): Promise<void> {
@@ -436,7 +409,7 @@ export class AcpConnection {
 				if (settled) return;
 				settled = true;
 				if (timer) clearTimeout(timer);
-				this.#permissionPending.delete(settleDeny);
+				this.#permissionPending.delete(settleCancel);
 				this.#opts.log("permission", { optionId, policy: why });
 				// undefined optionId (no reject option on the table) cancels
 				// instead of selecting nothing.
@@ -447,11 +420,12 @@ export class AcpConnection {
 				);
 			};
 			const settleDeny = (): void => settle(denyId, "dialog-deny");
+			const settleCancel = (): void => settle(undefined, "cancel");
 			timer = setTimeout(() => {
 				this.#opts.log("permission-timeout", { parkMs });
 				settleDeny();
 			}, parkMs);
-			this.#permissionPending.add(settleDeny);
+			this.#permissionPending.add(settleCancel);
 			Promise.resolve()
 				.then(() => handler(params))
 				.then((picked) => {
@@ -562,44 +536,23 @@ export class AcpConnection {
 		}
 	}
 
-	/** Surface OAuth login URLs captured by the BROWSER wrapper: every new
-	 *  URL in the record file is logged once as "auth-url" {url, port}. Best
-	 *  effort only - a broken watch never affects turns. */
-	#watchAuthUrl(): void {
-		const file = this.#opts.authUrlFile!;
-		try {
-			const watcher = fs.watch(file, () => this.#emitAuthUrl());
-			// Without a listener, a watch 'error' event escapes as uncaught.
-			watcher.on("error", () => {
-				/* record file gone: login URL surfacing is off until respawn */
-			});
-			this.#authUrlWatcher = watcher;
-		} catch {
-			/* no watch; the one-shot check below still covers earlier writes */
-		}
-		this.#emitAuthUrl(); // URLs recorded before the watch started
-	}
-
-	#emitAuthUrl(): void {
-		const url = readLastUrl(this.#opts.authUrlFile!);
-		if (!url || url === this.#lastAuthUrl) return;
-		this.#lastAuthUrl = url;
-		this.#opts.log("auth-url", { url, port: parseAuthPort(url) });
-	}
-
 	#finish(reason: string, code: number | null = null, signal: NodeJS.Signals | null = null): void {
 		if (this.#exited) return;
 		this.#exited = true;
-		this.#authUrlWatcher?.close();
-		this.#authUrlWatcher = undefined;
-		// Pending permission dialogs must not outlive the connection: deny them
+		// Pending permission dialogs must not outlive the connection: cancel them
 		// so their replies race the teardown instead of hanging the server.
 		const pendings = [...this.#permissionPending];
 		this.#permissionPending.clear();
 		for (const deny of pendings) deny();
 		this.abortAll(`connection exited: ${reason || "process gone"}`);
+		this.#releaseHome();
 		this.#opts.onExit({ code, signal, stderrTail: redactText(this.#stderrTail) });
 	}
+
+	#releaseHome(): void {
+		if (this.#stagedHome) removeStagedAcpHome(this.#stagedHome);
+		this.#stagedHome = undefined;
+	}
 }
 
 /** ACP's optional (unstable) per-turn PromptResponse.usage, not the
@@ -628,26 +581,15 @@ export function translateError(method: string, err: unknown): Error {
 	if (err instanceof AcpAuthError) return err;
 	if (err instanceof JsonRpcResponseError) {
 		if (err.code === -32000) {
-			authInvalidatedHook?.();
 			const detail = typeof err.data === "object" && err.data !== null ? (err.data as { message?: unknown }).message : undefined;
 			const detailText = typeof detail === "string" ? `: ${detail}` : `: ${err.message}`;
-			return new AcpAuthError(`ACP authentication required for ${method}${detailText}. Run /agy auth to sign in; /agy auth-manual has manual steps.`);
+			return new AcpAuthError(`ACP authentication required for ${method}${detailText}. Run agy in your terminal and complete Google sign-in, then restart pi.`);
 		}
-		// Typed protocol errors survive: callers probe .code (-32601 cancel-
-		// unsupported, -32602 param shape). The method prefix is lost — describe()
+		// Typed protocol errors survive: callers inspect .code for parameter
+		// and capability failures. The method prefix is lost — describe()
 		// callers that need it log the method at the call site.
 		return err;
 	}
 	if (err instanceof Error) return err;
 	return new Error(`ACP ${method} failed: ${String(err)}`);
 }
-
-/** Resolve the server binary: env > config > PATH. Resolution failure is a
- *  visible turn error naming what was tried (plan §9.5). */
-/** Resolve the server binary: env > config > PATH. `~` expands to the home
- *  directory (spawn does not expand it). Resolution failure is a visible turn
- *  error naming what was tried (plan §9.5). */
-export function resolveAcpBinary(configBin: string): string {
-	const raw = process.env.AGY_ACP_BIN || (configBin.length > 0 ? configBin : "agy_acp_server.par");
-	return raw === "~" || raw.startsWith("~/") ? path.join(os.homedir(), raw.slice(1)) : raw;
-}

package/src/acp/driver.ts

@@ -5,14 +5,11 @@
 // Engine differences vs stream-json, all verified live (docs/ACP-PROTOCOL-REFERENCE.md):
 //   - no process recycle on profile drift: one server process, sessions
 //     selected per turn via session/new / session/load
-//   - model/effort via session/set_config_option (configId "model", FULL slug
-//     with the effort tier baked in); mode via configId "mode"
+//   - model and thought_level are separate session/set_config_option calls
 //   - config does NOT persist across server restarts: re-applied every turn
 //   - session/load replays history as full-text notification pairs BEFORE its
 //     response; the connection suppresses updates while loading
-//   - session/cancel is unimplemented on RC01 (-32601): abort = abortAll()
-//     teardown + kill, then session/load on the next turn. The method is
-//     probed once per connection; when upstream ships it, abort goes graceful
+//   - session/cancel is a notification; teardown remains the safety net
 //   - overall-timer pause uses remaining-budget semantics on G9 parks (never a
 //     fresh cap); every park carries its own timeout (BRIDGE_TIMEOUT_MS)
 //   - request_permission: skipPermissions turns answer the first allow option
@@ -23,7 +20,7 @@
 
 import { randomUUID } from "node:crypto";
 import type { UsageEstimate } from "../config.js";
-import { AcpConnection, resolveAcpBinary, type AcpMcpServer, type AcpPermissionRequest } from "./connection.js";
+import { AcpConnection, type AcpMcpServer, type AcpPermissionRequest } from "./connection.js";
 import type { AcpPermissionHandler } from "./connection.js";
 import { mapStopReason, mapUpdate, TextAccumulator, type AcpEditDiff } from "./events.js";
 import { estimateTokens, synthesizeUsage } from "./usage-estimate.js";
@@ -41,18 +38,13 @@ import type {
 const LIFECYCLE_LIMIT = 24;
 
 export interface AcpDriverOptions {
-	/** Config acp.bin value (may be empty). Env AGY_ACP_BIN wins. A function
-	 *  is resolved per connection: setup can install the binary and update
-	 *  config mid-session, and the next turn picks it up without a restart. */
+	/** agy CLI binary. Tests may substitute node with a fake-server script. */
 	bin: string | (() => string);
-	/** Extra argv for the binary (tests: node + fake-server script). A
-	 *  function is resolved per connection, like bin, so registry args from a
-	 *  mid-session managed install apply without a restart. */
+	/** Extra argv (production: ["acp"]; tests: fake-server script). */
 	binArgs?: string[] | (() => string[]);
+	/** Native agy only: isolate inherited global MCP from other pi sessions. */
+	isolateHome?: boolean;
 	extraEnv?: Record<string, string>;
-	/** Record file for BROWSER-captured OAuth URLs; passed to the connection,
-	 *  which logs "auth-url" when the server tries to open a login. */
-	authUrlFile?: string;
 	/** Bridge registration for session/new AND session/load. */
 	mcpServers?: () => AcpMcpServer[];
 	/** Gate B stopgap: how ACP turns synthesize usage while the server sends
@@ -110,24 +102,13 @@ interface ActiveTurn {
 	toolCalls: Map<string, { name: string; args: Record<string, unknown>; diff?: AcpEditDiff; mcpServer?: string }>;
 }
 
-/** Recombine the provider's (base slug, effort) into the FULL ACP model slug.
- *  Fixed families (no effort) pass through unchanged. Verified against the
- *  run-5 catalog: session/set_config_option wants "gemini-3.8-flash-low"-style
- *  full slugs. */
-export function acpModelSlug(model: string, effort?: string): string {
-	if (!effort) return model;
-	if (/(?:^|-)(?:high|medium|low)$/.test(model)) return model;
-	return `${model}-${effort}`;
-}
-
 /** Map our config knobs onto ACP session modes. skipPermissions=false also
  *  fail-closes the in-connection permission handler (reject options), so the
- *  modes keep their server-side meaning. Known gap: the CLI's `--mode plan`
- *  has no ACP equivalent (review 4, finding 4) — plan + acp is refused at the
- *  command level and fails the turn visibly. */
+ *  modes keep their server-side meaning. Provider plan turns are refused
+ *  because agy does not enforce review-only writes. */
 export function acpMode(mode: string, skipPermissions: boolean): string {
-	if (skipPermissions) return "yolo";
-	return mode === "plan" ? "default" : "auto_edit";
+	if (skipPermissions) return "accept-edits";
+	return mode === "plan" ? "plan" : mode === "accept-edits" ? "accept-edits" : "default";
 }
 
 export class AcpDriver implements TurnDriver {
@@ -148,12 +129,11 @@ export class AcpDriver implements TurnDriver {
 	};
 	#serverVersion: string | undefined;
 	#lastSessionId: string | undefined;
-	#lastCancelSupported: boolean | null = null;
 	#agentInfo: { name?: string; title?: string } | undefined;
 
 	constructor(opts: AcpDriverOptions) {
 		this.#opts = opts;
-		this.#log("driver-created", { bin: typeof opts.bin === "function" ? "(resolved per turn)" : resolveAcpBinary(opts.bin) });
+		this.#log("driver-created", { bin: typeof opts.bin === "function" ? "(resolved per turn)" : opts.bin });
 	}
 
 	get state(): DriverState {
@@ -334,7 +314,8 @@ export class AcpDriver implements TurnDriver {
 		// are a parity break); mode failure is best-effort (auto policy makes
 		// the modes converge anyway).
 		try {
-			await conn.setConfigOption(turn.sessionId, "model", acpModelSlug(request.model, request.effort));
+			await conn.setConfigOption(turn.sessionId, "model", request.model);
+			if (request.effort) await conn.setConfigOption(turn.sessionId, "thought_level", request.effort);
 		} catch (err) {
 			this.#failTurn(turn, `ACP model selection failed: ${describe(err)}`);
 			return;
@@ -349,9 +330,8 @@ export class AcpDriver implements TurnDriver {
 		// Timers: overall (turn deadline, pause-aware) + idle (inactivity).
 		this.#armOverall(turn);
 		this.#armIdle(turn);
-		// Live usage is explicitly an estimate: ACP 1.1.1 does not forward the
-		// SDK's exact usage_metadata onto the ACP wire. Emit input first; output
-		// estimates advance with each text/thought delta below.
+		// Estimates cover servers without exact PromptResponse.usage. Native
+		// agy replaces them with exact counts when the prompt completes.
 		this.#emitLiveEstimate(turn);
 
 		// Prompt. Updates stream through the connection's onUpdate callback.
@@ -476,9 +456,8 @@ export class AcpDriver implements TurnDriver {
 
 	#onConnectionExit(conn: AcpConnection, info: { code: number | null; signal: string | null; stderrTail: string }): void {
 		if (this.#conn !== conn) {
-			// A replaced connection reporting its death late (RC01's signal
-			// handler intercepts SIGTERM and can outlive its replacement by
-			// seconds): its turn is long gone and the new connection owns the
+			// A replaced connection can report its death after the replacement
+			// spawns: its turn is long gone and the new connection owns the
 			// driver state. Clobbering #conn here would orphan the live one.
 			this.#log("stale-connection-exited", { tail: info.stderrTail.slice(-200) });
 			return;
@@ -520,10 +499,10 @@ export class AcpDriver implements TurnDriver {
 		this.#state = "starting";
 		this.#stats.spawns += 1;
 		const conn = new AcpConnection({
-			bin: resolveAcpBinary(typeof this.#opts.bin === "function" ? this.#opts.bin() : this.#opts.bin),
+			bin: typeof this.#opts.bin === "function" ? this.#opts.bin() : this.#opts.bin,
 			binArgs: typeof this.#opts.binArgs === "function" ? this.#opts.binArgs() : this.#opts.binArgs,
+			isolateHome: this.#opts.isolateHome,
 			extraEnv: this.#opts.extraEnv,
-			authUrlFile: this.#opts.authUrlFile,
 			cwd: request.cwd,
 			mcpServers: this.#opts.mcpServers,
 			log: (msg, data) => this.#log(msg, data),
@@ -542,7 +521,7 @@ export class AcpDriver implements TurnDriver {
 			onExit: (info) => this.#onConnectionExit(conn, info),
 		});
 		this.#conn = conn;
-		this.#log("spawn", { bin: resolveAcpBinary(typeof this.#opts.bin === "function" ? this.#opts.bin() : this.#opts.bin) });
+		this.#log("spawn", { bin: typeof this.#opts.bin === "function" ? this.#opts.bin() : this.#opts.bin });
 		return conn
 			.start()
 			.then(() => {
@@ -566,8 +545,7 @@ export class AcpDriver implements TurnDriver {
 			});
 	}
 
-	/** Gate D abort. RC01 has no session/cancel: probe it once per connection,
-	 *  then either wait for the cancelled result or tear down. */
+	/** Send native cancellation, then wait for the prompt or tear down. */
 	async #abortTurn(turn: ActiveTurn): Promise<void> {
 		if (turn.closed) return;
 		turn.aborted = true;
@@ -575,19 +553,12 @@ export class AcpDriver implements TurnDriver {
 		const conn = this.#conn;
 		// No session yet (killed during setup), no live connection, or a server
 		// already known not to implement cancel: teardown directly.
-		if (!conn?.alive || turn.sessionId === "" || !turn.promptStarted || this.#cancelUnsupported()) {
+		if (!conn?.alive || turn.sessionId === "" || !turn.promptStarted) {
 			this.#teardownAbort(turn);
 			return;
 		}
 		try {
-			const probe = await conn.cancel(turn.sessionId);
-			conn.cancelSupported = probe.supported;
-			this.#lastCancelSupported = probe.supported;
-			if (!probe.supported) {
-				this.#log("cancel-unsupported", { build: this.#serverVersion });
-				this.#teardownAbort(turn);
-				return;
-			}
+			conn.cancel(turn.sessionId);
 			// Cancel accepted: the prompt result (stopReason cancelled) settles
 			// the turn through the normal path. Safety net below in case the
 			// server never answers.
@@ -608,10 +579,6 @@ export class AcpDriver implements TurnDriver {
 		}
 	}
 
-	#cancelUnsupported(): boolean {
-		return this.#conn?.cancelSupported === false;
-	}
-
 	/** Gate D teardown: reject everything pending, kill the process. The turn
 	 *  settles through the connection-exit path as aborted. */
 	#teardownAbort(turn: ActiveTurn): void {
@@ -810,7 +777,7 @@ export class AcpDriver implements TurnDriver {
 		// Superseded only by EXACT PromptResponse.usage. Diagnostic usage-shaped
 		// frames (context windows, occupancy) must not silence the estimates:
 		// the connection outlives turns and no exact data ever replaces them
-		// on ACP 1.1.1 (peer review 2026-09-23).
+		// on servers without PromptResponse.usage.
 		if (this.#conn?.exactUsageSeen) return undefined;
 		return synthesizeUsage({
 			mode,
@@ -873,7 +840,6 @@ export class AcpDriver implements TurnDriver {
 				sessionsCreated: this.#stats.sessionsCreated,
 				sessionsLoaded: this.#stats.sessionsLoaded,
 				kills: this.#stats.kills,
-				cancelSupported: this.#conn?.cancelSupported ?? this.#lastCancelSupported,
 				serverVersion: this.#serverVersion,
 				// Connections beyond the first are server restarts (Gate D kills,
 				// stale-exit replacements) = reconnects.

package/src/acp/events.ts

@@ -3,7 +3,7 @@
 // Pure functions, no I/O: unit-tested against the captured probe transcripts
 // (probe-logs/acp-traffic-run5.jsonl, run6-restart-load-tools.jsonl).
 //
-// Shapes verified live against agy_acp_server 20260818_01_RC01:
+// Shapes verified against native agy ACP and captured legacy frames:
 //   session/update params = { sessionId, update: { sessionUpdate: <discriminator>, ... } }
 //   - agent_message_chunk  { content: { type: "text", text } }         (pure deltas)
 //   - agent_thought_chunk  { content: { type: "text", text } }          (thought TEXT)
@@ -12,7 +12,7 @@
 //   - tool_call_update     { toolCallId, status: completed|failed, rawOutput? }
 //   - plan                 { entries: [...] }
 //   - available_commands_update { availableCommands: [...] }
-// Usage: ABSENT on RC01 (Gate B) — mapped defensively should a future build add it.
+// Exact turn usage is read from PromptResponse by the connection.
 
 import { StreamSanitizer, sanitizeSystemMessage } from "../stream-sanitizer.js";
 
@@ -55,12 +55,13 @@ export function mapUpdate(update: unknown): MappedUpdate {
 		case "tool_call": {
 			const id = stringField(u.toolCallId);
 			if (!id) return null;
+			const nativeMcp = nativeMcpTool(u);
 			return {
 				kind: "tool_start",
 				toolCallId: id,
-				name: metaToolName(u._meta) ?? toolName(u.title, u.kind),
+				name: metaToolName(u._meta) ?? nativeMcp?.name ?? stringField(u.name) ?? toolName(u.title, u.kind),
 				args: rawArguments(u.rawInput),
-				mcpServer: stringField(recordField(recordField(u._meta).mcp).server),
+				mcpServer: stringField(recordField(recordField(u._meta).mcp).server) ?? nativeMcp?.server,
 				// Edits carry their native diff HERE, on the pending tool_call
 				// frame (run 6:10) — the completed update carries only display
 				// text. contentDiff on the update stays as a future-build
@@ -72,14 +73,14 @@ export function mapUpdate(update: unknown): MappedUpdate {
 			const id = stringField(u.toolCallId);
 			if (!id) return null;
 			if (u.status === "failed") {
-				// RC01 echo (run 6, finding 7): after an allow, the APPROVED call
+				// Legacy approved-echo: after an allow, the APPROVED call
 				// id reports failed with this sentinel while the real work runs
 				// under a different id that reports its own lifecycle. Track
 				// effects, not ids: drop the echo instead of rendering a bogus
 				// failure next to a successful edit.
 				const raw = stringField(u.rawOutput);
 				if (raw?.includes("approved but never executed")) return null;
-				const mcpServer = stringField(recordField(recordField(u._meta).mcp).server);
+				const mcpServer = stringField(recordField(recordField(u._meta).mcp).server) ?? nativeMcpTool(u)?.server;
 				return { kind: "tool_error", toolCallId: id, message: raw ?? "tool failed", ...(mcpServer ? { mcpServer } : {}) };
 			}
 			if (u.status === "completed") {
@@ -87,7 +88,7 @@ export function mapUpdate(update: unknown): MappedUpdate {
 				// often just the server's display title, not the result (probe
 				// 2026-09-03: completed MCP call, rawOutput "Call bridge_echo").
 				const diff = contentDiff(u.content);
-				const mcpServer = stringField(recordField(recordField(u._meta).mcp).server);
+				const mcpServer = stringField(recordField(recordField(u._meta).mcp).server) ?? nativeMcpTool(u)?.server;
 				return {
 					kind: "tool_done",
 					toolCallId: id,
@@ -116,6 +117,12 @@ function rawArguments(rawInput: unknown): Record<string, unknown> {
 		: rec;
 }
 
+/** Only our known server prefix is unambiguous without _meta. */
+function nativeMcpTool(update: Record<string, unknown>): { name: string; server: string } | undefined {
+	const match = /^mcp_(pi-bridge(?:-\d+)?)_(.+)$/.exec(stringField(update.name) ?? "");
+	return match ? { server: match[1]!, name: match[2]! } : undefined;
+}
+
 /** Clean tool name for MCP tools: the title is "<server>_<tool>" (e.g.
  *  "pi-bridge_bridge_echo") and the real name hides in _meta.mcp.tool. */
 function metaToolName(meta: unknown): string | undefined {
@@ -185,8 +192,7 @@ export function toolName(title: unknown, kind: unknown): string {
 
 /** Map a `session/prompt` result stopReason to a TurnOutcome shape.
  *  Verified live: `end_turn`. Schema enumerates cancelled / max_tokens /
- *  max_turn_requests / refusal. `cancelled` is unreachable on RC01 (no
- *  cancel method) but mapped for the day upstream ships it. */
+ *  max_turn_requests / refusal. Native cancellation returns `cancelled`. */
 export function mapStopReason(stopReason: unknown): {
 	status: "OK" | "ERROR";
 	aborted: boolean;
@@ -208,8 +214,8 @@ export function mapStopReason(stopReason: unknown): {
 	}
 }
 
-/** Defensive accumulation with the cumulative-resend port. RC01 streams pure
- *  deltas (verified: mid-token splits across the run-5 stress streams), so on
+/** Defensive accumulation with the cumulative-resend port. Native agy streams
+ *  deltas, so on
  *  a compliant server the resend branch stays inert; it exists because the
  *  same backend's private protocol exhibited exactly this failure mode.
  *