@estebanforge/pi-ask-antigravity 1.2.6 → 1.2.7

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.7] - 2026-09-25
+
+### Fixed
+
+- **Plan mode never receives `--dangerously-skip-permissions`.** agy's plan-mode no-write gate IS a permission request ("File creation requires plan approval"), and the skip flag auto-approves every permission request — so a `mode: "plan"` delegation could edit the workspace inside the `--add-dir` grant despite the review-only contract. The default `skipPermissions` knob made this the out-of-the-box behavior. Probe evidence transfers directly (same binary, same `-p` path): with the flag a plan run wrote files; without it, file-write and run_command attempts end exit 0 in ~20-30 s with a "confirm plan" message — fail-visible, never the upstream #318 prompt-hang. Plan runs now never receive the flag, and the tool description and README state the enforcement instead of the aspirational claim.
+
+Version 1.2.6 was a fleet-wide version stamp with no package changes.
+
 ## [1.2.5] - 2026-09-18
 
 ### Added

package/README.md

@@ -1,10 +1,8 @@
 # @estebanforge/pi-ask-antigravity
 
-A [Pi](https://github.com/earendil-works/pi-coding-agent) extension that exposes the **`AskAntigravity`** tool: delegate a self-contained sub-task to Google Antigravity's `agy` CLI and stream its response back into the Pi session.
+A [Pi](https://github.com/earendil-works/pi) extension that exposes the **`AskAntigravity`** tool: delegate a self-contained sub-task to Google Antigravity's `agy` CLI and stream its response back into the Pi session.
 
-It is the `AskClaude`-style delegation pattern (from pi-claude-bride extension), pointed at Gemini via `agy`. The tool answers to three names the CLI is known by — **gemini**, **antigravity**, and **agy** — surfaced in its description so the model maps any of them to this single tool.
-
-<img width="1512" height="845" alt="image" src="https://github.com/user-attachments/assets/3e1a8f19-64d2-43ab-a30f-47f39daa151d" />
+It is the `AskClaude`-style delegation pattern (from pi-claude-bridge extension), pointed at Gemini via `agy`. The tool answers to three names the CLI is known by — **gemini**, **antigravity**, and **agy** — surfaced in its description so the model maps any of them to this single tool.
 
 ## Install
 
@@ -65,7 +63,7 @@ Verbose `agy models` strings (`Gemini 3.5 Flash (Medium)`) are hostile to natura
 
 | Mode | Flag | Use when |
 | --- | --- | --- |
-| `plan` | `--mode plan` | agy reviews and plans without writing. Use for cross-review and read-only tasks. |
+| `plan` | `--mode plan` | agy reviews and plans without writing. Use for cross-review and read-only tasks. Enforced: the skip-permissions flag is never passed in plan mode, so write and command attempts fail visibly at plan approval instead of executing. |
 | `accept-edits` (default) | `--mode accept-edits` | agy applies edits directly inside the workspace. |
 
 For agy's orthogonal `--sandbox` shell-containment flag, set `AGY_EXTRA_ARGS=--sandbox` in your environment. The extension does not expose it as a `mode` value because `--sandbox` controls command containment, not edit persistence.
@@ -113,7 +111,7 @@ Interactive picker for the default model and default thinking. If the project co
 | `prompt` | yes | Self-contained task. agy cannot see the Pi conversation. |
 | `cwd` | no | Workspace agy runs in. Defaults to the project root. |
 | `model` | no | Alias or exact id. Omit for the configured default. |
-| `mode` | no | `plan` (review-only) or `accept-edits` (agy applies edits, default). |
+| `mode` | no | `plan` (review-only; enforced via plan approval) or `accept-edits` (agy applies edits, default). |
 | `digest` | no | Prefix the prompt with `(Use compact digests, not full file contents.)`. Defaults on for `plan`, off for `accept-edits`. |
 | `conversationId` | no | Omit for a one-shot (agy starts fresh). Pass the id from a prior call's result (`details.conversationId`) to resume that agy conversation with full context. See [Two modes](#two-modes-one-shot-vs-continued-conversation). |
 | `timeoutMinutes` | no | Hard cap on the run. Default 10. |

package/extensions/index.ts

@@ -96,7 +96,9 @@ function levelToTier(level: string): ThinkingTier {
 }
 
 // Mode = which agy tool-loop policy to apply. Distinct from the alias layer.
-//   "plan"         → --mode plan     (no edits; review-only)
+//   "plan"         → --mode plan     (no edits; review-only — the skip-
+//                                      permissions flag is withheld in plan
+//                                      mode so the plan-approval gate holds)
 //   "accept-edits" → --mode accept-edits (agy applies edits)
 //
 // Note: agy's --sandbox flag is an orthogonal shell-containment setting
@@ -154,7 +156,7 @@ TWO MODES (you choose):
 - **Continued conversation**: pass the conversationId returned in the PREVIOUS call's details (details.conversationId). agy resumes that conversation with full context intact — use for follow-ups, multi-turn refinement, or when the user says "ask agy to follow up / continue / now do X based on what you just did". Thread the id from each result into the next call.
 
 EXECUTION MODES (param: mode):
-- **plan**: agy reviews and plans without writing. Use for cross-review and read-only tasks.
+- **plan**: agy reviews and plans without writing. Use for cross-review and read-only tasks. Enforced: plan runs never receive the skip-permissions flag, so a write or command attempt ends the run quickly with a "confirm plan" message instead of executing.
 - **accept-edits** (default): agy applies edits directly inside the workspace.
 - For agy's orthogonal \`--sandbox\` shell-containment flag, set the \`AGY_EXTRA_ARGS=--sandbox\` env var.
 
@@ -949,7 +951,7 @@ export default async function (pi: ExtensionAPI) {
 					],
 					{
 						description:
-							"agy execution mode. 'plan' = review-only, no edits (--mode plan). 'accept-edits' = agy applies edits directly (--mode accept-edits, default). For agy's orthogonal --sandbox shell-containment flag, set the AGY_EXTRA_ARGS env var.",
+							"agy execution mode. 'plan' = review-only, no edits (--mode plan; the skip-permissions flag is never passed, so write and command attempts fail visibly at plan approval). 'accept-edits' = agy applies edits directly (--mode accept-edits, default). For agy's orthogonal --sandbox shell-containment flag, set the AGY_EXTRA_ARGS env var.",
 						default: "accept-edits",
 					},
 				),
@@ -1199,7 +1201,16 @@ export default async function (pi: ExtensionAPI) {
 			// accept-edits auto-approves file edits but NOT shell commands, so a
 			// run_command would hang on an unanswerable y/n prompt in non-interactive
 			// -p mode. Honor the shared permissions setting (same knob as the bridge).
-			if (config.skipPermissions) args.push("--dangerously-skip-permissions");
+			// Plan mode never gets the flag even when the knob is on: the flag
+			// auto-approves ALL permission requests including plan mode's own
+			// approval gate, which would silently turn "review-only" into full
+			// write access inside --add-dir (probed 2026-09-25: with the flag a
+			// plan run wrote files; without it, file and command attempts end
+			// exit 0 in ~20-30s with a "confirm plan" message - fail-visible,
+			// never a hang). Same fix as the bridge's ask-tool and driver.
+			if (mode !== "plan" && config.skipPermissions) {
+				args.push("--dangerously-skip-permissions");
+			}
 			if (isContinuation) args.push("--conversation", rawConvId as string);
 			args.push("--print-timeout", `${timeoutMin}m`);
 			if (contextFile) args.push("--add-dir", askContextDir());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-ask-antigravity",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "description": "Pi tool that delegates a self-contained sub-task to Google Antigravity's agy CLI (the CLI for Gemini). Friendly model aliases (flash/pro/gemini), configurable default model + thinking, and the AskAntigravity delegation tool.",
   "keywords": [
     "pi-package",