@miraland-labs/conduit-bridge 0.16.30 → 0.16.37

package/dist/attempt-worktree.js

@@ -7,6 +7,7 @@ import { constants } from "node:fs";
 import { join, resolve } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { headCommitOrNull } from "./git.js";
 const execFileAsync = promisify(execFile);
 export function attemptWorktreePath(sourceWorkspace, attemptId) {
     return join(sourceWorkspace, ".conduit", "attempts", attemptId);
@@ -82,14 +83,18 @@ export async function ensureWorktreeGitIdentity(worktree, sourceWorkspace) {
         await git("config", key, inherited || fallback);
     }
 }
+/** Removes the worktree; answers whether one was there to remove. */
 export async function removeAttemptWorktree(sourceWorkspace, worktreePath) {
-    // Settled repair releases are returned on every assignment poll until the local tree is gone.
-    // Make that at-least-once signal cheap and idempotent instead of invoking Git on a missing path.
+    // The control plane names every settled repair on every assignment poll, because it holds no
+    // record of what this computer still has on disk. That is a statement of fact to reconcile
+    // against, not a queue to drain, so the caller asks whether anything actually went -- a release
+    // nobody performed is not an event, and logging one made the same eleven paths scroll past every
+    // fifteen seconds. It also keeps Git off a path that is already gone.
     try {
         await access(worktreePath, constants.F_OK);
     }
     catch {
-        return;
+        return false;
     }
     try {
         await execFileAsync("git", ["-C", sourceWorkspace, "worktree", "remove", "--force", worktreePath], { timeout: 60_000, maxBuffer: 2_000_000 });
@@ -101,6 +106,7 @@ export async function removeAttemptWorktree(sourceWorkspace, worktreePath) {
             maxBuffer: 1_000_000,
         }).catch(() => undefined);
     }
+    return true;
 }
 /**
  * F-07 safe resume: prove the interrupted attempt still owns this worktree path.
@@ -114,11 +120,7 @@ export async function proveResumeWorktree(sourceWorkspace, attemptId, worktreePa
         return false;
     try {
         await access(worktreePath, constants.F_OK);
-        const { stdout } = await execFileAsync("git", ["-C", worktreePath, "rev-parse", "HEAD"], {
-            timeout: 15_000,
-            maxBuffer: 1_000_000,
-        });
-        return /^[0-9a-f]{40,64}$/i.test(stdout.trim());
+        return (await headCommitOrNull(worktreePath)) !== null;
     }
     catch {
         return false;

package/dist/brief.js

@@ -1,8 +1,9 @@
-import { readdir, readFile, stat } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { isBoundedVerificationCommand } from "./execution-class.js";
+import { gitOriginUrl, headCommitOrNull } from "./git.js";
 const execFileAsync = promisify(execFile);
 const MANIFESTS = [
     "package.json", "wrangler.jsonc", "wrangler.toml", "tsconfig.json",
@@ -20,14 +21,22 @@ export async function buildWorkspaceBrief(workspace) {
         .map((entry) => entry.name).sort().slice(0, 30);
     const files = new Set(entries.filter((entry) => entry.isFile()).map((entry) => entry.name));
     const manifests = MANIFESTS.filter((name) => files.has(name));
+    const declared = await readDeclaredVerification(workspace);
     return {
-        repository: await gitRemoteUrl(workspace),
-        base_commit: await gitHeadCommit(workspace),
+        repository: await gitOriginUrl(workspace),
+        base_commit: await headCommitOrNull(workspace),
         modules,
         manifests,
         verification: await discoverVerificationCommands(workspace, files),
+        declared_verification: declared,
     };
 }
+/**
+ * Mirror of `src/conductor/repository.ts`. The server fingerprints the initiative URL and the Bridge
+ * fingerprints the workspace remote; dispatch requires the two to be equal, so a divergence stops
+ * matching silently. The Bridge is a published package and cannot import server code, so
+ * `test/matcher.test.ts` ("repository fingerprint agreement") holds the two spellings together.
+ */
 export function normalizeRepositoryUrl(url) {
     let value = url.trim().replace(/\.git$/, "").replace(/\/+$/, "").toLowerCase();
     const ssh = value.match(/^git@([^:]+):(.+)$/);
@@ -143,61 +152,6 @@ export async function resolveAttemptStartCommit(workspace, requestedBase, claime
         return base;
     return null;
 }
-async function gitRemoteUrl(workspace) {
-    try {
-        const { common } = await gitDirectories(workspace);
-        const config = await readFile(join(common, "config"), "utf8");
-        const remote = config.match(/\[remote "origin"\][^[]*?url\s*=\s*(\S+)/);
-        return remote?.[1] ?? null;
-    }
-    catch {
-        return null;
-    }
-}
-async function gitHeadCommit(workspace) {
-    try {
-        const { worktree, common } = await gitDirectories(workspace);
-        let head = String(await readFile(join(worktree, "HEAD"), "utf8")).trim();
-        // Follow one level of symbolic refs (HEAD → refs/heads/main, or a nested ref file).
-        for (let hop = 0; hop < 3; hop++) {
-            if (/^[0-9a-f]{40,64}$/i.test(head))
-                return head.toLowerCase();
-            const ref = head.match(/^ref:\s*(\S+)$/)?.[1];
-            if (!ref)
-                return null;
-            try {
-                head = String(await readFile(join(common, ref), "utf8")).trim();
-            }
-            catch {
-                const packed = String(await readFile(join(common, "packed-refs"), "utf8"));
-                const line = packed.split("\n").find((entry) => {
-                    const trimmed = entry.trim();
-                    return trimmed.length > 0 && !trimmed.startsWith("#") && !trimmed.startsWith("^") && trimmed.endsWith(` ${ref}`);
-                });
-                const sha = line?.split(/\s+/)[0]?.trim() ?? null;
-                return sha && /^[0-9a-f]{40,64}$/i.test(sha) ? sha.toLowerCase() : null;
-            }
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-async function gitDirectories(workspace) {
-    const dotGit = join(workspace, ".git");
-    const info = await stat(dotGit);
-    const pointer = info.isDirectory() ? null : (await readFile(dotGit, "utf8")).trim().match(/^gitdir:\s*(.+)$/)?.[1];
-    if (!info.isDirectory() && !pointer)
-        throw new Error("Invalid Git worktree metadata");
-    const worktree = info.isDirectory() ? dotGit : resolve(workspace, pointer);
-    try {
-        return { worktree, common: resolve(worktree, (await readFile(join(worktree, "commondir"), "utf8")).trim()) };
-    }
-    catch {
-        return { worktree, common: worktree };
-    }
-}
 /** Exported for tests — discovers bounded verification commands from workspace manifests. */
 /**
  * Commands a project declares for itself, in `.conduit/verification` — one per line, `#` comments
@@ -227,12 +181,17 @@ export function parseDeclaredVerification(text) {
     }
     return declared;
 }
-export async function discoverVerificationCommands(workspace, files) {
-    const commands = [];
+export async function readDeclaredVerification(workspace) {
     try {
-        commands.push(...parseDeclaredVerification(await readFile(join(workspace, ".conduit", "verification"), "utf8")));
+        return parseDeclaredVerification(await readFile(join(workspace, ".conduit", "verification"), "utf8"));
     }
-    catch { /* no declaration, or unreadable: discovery below still applies */ }
+    catch {
+        return []; // no declaration, or unreadable: discovery still applies
+    }
+}
+export async function discoverVerificationCommands(workspace, files) {
+    // Declared first: the order is a preference order for every reader that takes one command.
+    const commands = await readDeclaredVerification(workspace);
     if (files.has("package.json")) {
         try {
             const manifest = JSON.parse(await readFile(join(workspace, "package.json"), "utf8"));

package/dist/checkout.js

@@ -11,6 +11,7 @@ import { dirname } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { normalizeRepositoryUrl } from "./brief.js";
+import { gitOriginUrl } from "./git.js";
 const execFileAsync = promisify(execFile);
 async function pathExists(path, accessFn) {
     try {
@@ -21,19 +22,6 @@ async function pathExists(path, accessFn) {
         return false;
     }
 }
-async function gitOriginUrl(workspace, exec) {
-    try {
-        const { stdout } = await exec("git", ["-C", workspace, "config", "--get", "remote.origin.url"], {
-            timeout: 15_000,
-            maxBuffer: 1_000_000,
-        });
-        const value = stdout.trim();
-        return value.length > 0 ? value : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** A control-plane repository fingerprint needs a transport before Git can clone it. */
 function cloneRepositoryUrls(repositoryUrl) {
     const value = repositoryUrl.trim();

package/dist/cli.js

@@ -612,19 +612,22 @@ async function runner() {
                 progressed = await executeNextInvestigation(client, config, workspace, brief, timeoutMs) || progressed;
             }
             if (workspace && onlineDriverIds(config).length) {
+                // Read the workspace again, then publish it. The last brief stands if the read fails.
+                const publishWorkspaceState = async (options = {}) => {
+                    const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
+                    const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined }, options);
+                    const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
+                    return { preflight, hb };
+                };
                 progressed = await pumpExecutionSlots(client, config, workspace, brief, timeoutMs, {
                     heartbeat: async () => {
-                        const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
-                        const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined });
-                        await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
+                        await publishWorkspaceState();
                     },
                     beforeClaim: async (driverId) => {
                         // Never let the five-minute heartbeat cache span a CLI upgrade into a certified claim.
                         // Publish the fresh probe first; the Control Plane then remains the authority for the
                         // exact version frozen onto the claim response and event.
-                        const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
-                        const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined }, { force: true });
-                        const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
+                        const { preflight, hb } = await publishWorkspaceState({ force: true });
                         if (hb.staleBridge)
                             return false;
                         const lane = preflight.drivers.find((candidate) => candidate.id === driverId);

package/dist/config.js

@@ -262,6 +262,23 @@ export async function saveConfigPrefs(config) {
  * nothing without one.
  */
 export async function saveDriverQuota(driverId, quota) {
+    await updateDriverLane(driverId, (lane) => {
+        if (quota)
+            lane.quota = quota;
+        else
+            delete lane.quota;
+    });
+}
+/** Persist one lane's execution outcome without overwriting operator preferences or quota state. */
+export async function saveDriverOutcome(driverId, outcome) {
+    await updateDriverLane(driverId, (lane) => {
+        if (outcome)
+            lane.outcome = outcome;
+        else
+            delete lane.outcome;
+    });
+}
+async function updateDriverLane(driverId, update) {
     const run = async () => {
         await withConfigLock(async () => {
             let prefs;
@@ -269,15 +286,12 @@ export async function saveDriverQuota(driverId, quota) {
                 prefs = JSON.parse(await readFile(path, "utf8"));
             }
             catch {
-                return; // No prefs on disk yet: nothing to attach a quota to.
+                return; // No prefs on disk yet: nothing to attach lane state to.
             }
             const lane = prefs.drivers?.[driverId];
             if (!lane || typeof lane !== "object")
                 return;
-            if (quota)
-                lane.quota = quota;
-            else
-                delete lane.quota;
+            update(lane);
             await writeJsonAtomic(path, { ...prefs, activeAttempts: {}, sessions: undefined });
         });
     };

package/dist/driver.js

@@ -3,9 +3,9 @@ import { boundedTail } from "./ensure-test-evidence.js";
 import { resolveAgentTimeout } from "./execution-budget.js";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { z } from "zod";
-import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
+import { allowsExternalFetch, deniedCommands, executionClassPromptRules, isRunnableVerificationCommand, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
 /**
  * The bound for this turn.
  *
@@ -995,10 +995,16 @@ export const kiroDriver = {
     },
 };
 /**
- * Antigravity's `agy` CLI (verified against agy 1.1.3): non-interactive runs use
- * `-p`/`--print` with `--mode plan` (read-only) or `--mode accept-edits`. Its
- * enforcement is mode-level, not per-tool — coarser than Claude, the Cursor tier.
- * Write mode adds `--sandbox` for terminal restrictions. Output is plain text.
+ * Antigravity's `agy` CLI (verified against agy 1.1.24): non-interactive runs use
+ * `--mode plan` (read-only) or `--mode accept-edits`. `-p`/`--print` is a Go-style
+ * flag that consumes its value from the next argument, so the prompt must be the
+ * last argument attached to `-p` — putting other flags after it (as earlier builds
+ * of this driver did) makes agy swallow one of them as the prompt and silently
+ * drop the real prompt. `--print-timeout` is set from the turn budget so agy's
+ * 5-minute default cannot cut a longer turn short. Its enforcement is mode-level,
+ * not per-tool — coarser than Claude, the Cursor tier. Write mode adds `--sandbox`
+ * for terminal restrictions. `--output-format json` returns one envelope, parsed by
+ * parseAntigravityOutput.
  */
 export function antigravityModeForGrants(grants, executionClass) {
     if (!hasMappedRepoAccess(grants))
@@ -1011,15 +1017,206 @@ export function antigravityModeForGrants(grants, executionClass) {
         return "plan";
     return null;
 }
-export function antigravityRunArgs(input, mode) {
-    const args = ["-p", "--mode", mode];
+/** agy's `--print-timeout` takes a Go duration; ceil to whole minutes (agy's own default floor is 5m). */
+export function antigravityPrintTimeout(timeoutMs) {
+    return `${Math.max(5, Math.ceil(timeoutMs / 60_000))}m0s`;
+}
+/**
+ * Class + grants → agy permission allow-rules (probed against agy 1.1.24).
+ *
+ * Headless `agy -p` soft-denies every tool it was not granted: the run returns an empty response
+ * with a stderr notice and nothing is written. Only wildcard rules ever matched in the probes —
+ * bounded ones (`command(git add)`, `command(git *)`, and in the field `unsandboxed(git push)`)
+ * were auto-denied, because the agent picks its own shell spellings and stops at the first denial.
+ * So the enforceable unit is the coarse rule plus `--sandbox`, the same boundary the Codex driver
+ * leans on with `--sandbox workspace-write`. The grammar agy accepts is `command(<cmd>)`,
+ * `unsandboxed(<cmd>)`, `write_file(<glob>)`, `read_file(<glob>)`, `read_url(<target>)`.
+ *
+ * `deniedCommands` cannot be expressed here: agy has no deny grammar. Antigravity is the coarse
+ * tier the product spec already assigns it — enforcement is the sandbox, the prompt rule that names
+ * the hard-denied commands (executionClassPromptRules), and the delivery gate.
+ */
+export function antigravityPermissionProjection(executionClass, grants, options = {}) {
+    const allow = ["read_file(*)"];
+    // Live HTTP is the assignment's capability, read the one way every driver reads it. agy aborts the
+    // whole turn on a denial rather than skipping the tool, so an assignment that may fetch must carry
+    // the rule; one that may not never gets it.
+    if (allowsExternalFetch(executionClass, options.capabilities))
+        allow.push("read_url(*)");
+    const runnable = (options.verificationCommands ?? []).some(isRunnableVerificationCommand);
+    if (executionClass === "observe" || executionClass === "observe_network" || options.diagnosis) {
+        // Diagnosis has to run its bounded checks; a plain observe class gets no shell at all.
+        if (runnable && (options.diagnosis || grants.includes("test_run")))
+            allow.push("command(*)");
+        return allow;
+    }
+    if (executionClass === "verify") {
+        allow.push("command(*)");
+        return allow;
+    }
+    allow.push("write_file(*)", "command(*)");
+    // Land work needs the sandbox escape hatch, and only a wildcard reaches it: a real mutate_repo
+    // assignment carrying `pr_create` was auto-denied on exact `unsandboxed(git push)` with
+    // "a tool required the \"unsandboxed\" permission that headless mode cannot prompt for". So for
+    // the land class the sandbox boundary no longer covers the escape hatch, and enforcement there is
+    // the prompt's hard-deny list, the delivery gate (one PR, a scoped diff, Bridge-witnessed
+    // commands) and the project's grants — the coarse tier. Without `pr_create` no `unsandboxed(...)`
+    // rule is emitted at all, and `--sandbox` stays on either way.
+    if (grants.includes("pr_create"))
+        allow.push("unsandboxed(*)");
+    return allow;
+}
+/**
+ * The one driver note agy needs beside the class rules. It aborts the whole turn on any denied tool
+ * — Claude Code merely skips one — and a run that had already committed died opening its own PR URL
+ * with `read_url`, which no assignment without external_network may hold.
+ */
+export const antigravityPromptRule = "Antigravity: do not use read_url, browser, or web tools unless this assignment lists external_network; do not open the pull request URL after creating it — report the URL from the `gh pr create` output. A denied tool ends the whole run, so use only the tools this assignment allows.";
+export function antigravityRunArgs(input, mode, timeoutMs) {
+    const args = ["--mode", mode];
     if (mode === "accept-edits")
         args.push("--sandbox");
-    args.push(input.prompt);
+    args.push("--output-format", "json");
+    args.push("--print-timeout", antigravityPrintTimeout(timeoutMs));
+    // agy's CLI default model is one account lane among several; `--model` selects the lane this
+    // machine's tier mapping names, which is how a spent Gemini window stops the whole driver.
+    if (input.model)
+        args.push("--model", input.model);
+    if (input.resumeSessionId)
+        args.push("--conversation", input.resumeSessionId);
+    args.push("-p", input.prompt);
     return args;
 }
+/**
+ * Parse `agy models`: one model per line, the id first and the display name after it
+ * ("claude-sonnet-4-6         Claude Sonnet 4.6 (Thinking)"). Two or more spaces separate the two
+ * columns, which is what tells a model line from a banner line ("Available models:").
+ */
+export function parseAntigravityModelList(stdout) {
+    const models = new Set();
+    for (const line of stdout.split("\n")) {
+        const match = /^\s*([A-Za-z0-9][A-Za-z0-9._/-]*)\s{2,}\S/.exec(line);
+        if (match)
+            models.add(match[1]);
+    }
+    return models;
+}
+/**
+ * `agy --output-format json` prints one envelope:
+ * `{"conversation_id","status","response","duration_seconds","num_turns","usage"}`.
+ * Tolerant like the Cursor parser: a build that answers in plain text still delivers its report.
+ *
+ * A refused run keeps the same envelope with `status: "ERROR"`, an empty `response`, and the reason
+ * in `error` ("Individual quota reached ... Resets in 165h48m43s."), and prints **nothing** on
+ * stderr. Reading only `response` reported that run as "agy exited with code 1", which says nothing
+ * the owner can act on — so `status` and `error` are parsed here and named by the driver.
+ */
+export function parseAntigravityOutput(stdout) {
+    try {
+        const parsed = JSON.parse(stdout.trim());
+        return {
+            resultText: typeof parsed.response === "string" ? parsed.response : null,
+            sessionId: typeof parsed.conversation_id === "string" ? parsed.conversation_id : null,
+            status: typeof parsed.status === "string" ? parsed.status : null,
+            error: typeof parsed.error === "string" && parsed.error.trim() ? parsed.error : null,
+        };
+    }
+    catch {
+        return { resultText: stdout || null, sessionId: null, status: null, error: null };
+    }
+}
+/**
+ * The stderr line agy prints when a permission it was not granted ended the turn. An empty response
+ * beside such a line is a denial, not an agent with nothing to say, and the control plane has to see
+ * the difference.
+ */
+export function antigravityDenialNotice(stderr) {
+    for (const line of stderr.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed && /no output produced|permission/i.test(trimmed))
+            return trimmed;
+    }
+    return null;
+}
+/** agy reads one global settings file, so concurrent runs are serialized rather than racing on it. */
+let antigravitySettingsLock = Promise.resolve();
+/**
+ * Write the run's permission contract to agy's global settings file, restoring it byte-exactly after.
+ *
+ * Probed against agy 1.1.24: this is the only placement a headless run honours — a workspace-local
+ * `.antigravity/settings.json` and `~/.gemini/config/projects/<uuid>.json` `permissionGrants` were
+ * both ignored, and without `trustedWorkspaces` naming the workspace every tool is soft-denied. The
+ * file belongs to the machine owner and is global, so the original bytes are held in memory and
+ * beside it as `settings.json.conduit-backup` for the length of the run, unparsable JSON fails the
+ * run instead of being overwritten, and every other key is preserved.
+ */
+async function withAntigravityPermissions(workspace, allow, run) {
+    const previousRun = antigravitySettingsLock;
+    let release = () => undefined;
+    antigravitySettingsLock = new Promise((settle) => { release = settle; });
+    await previousRun.catch(() => undefined);
+    try {
+        const home = process.env.HOME;
+        if (!home)
+            throw new Error("antigravity needs HOME to write ~/.gemini/antigravity-cli/settings.json");
+        const settingsDir = join(home, ".gemini", "antigravity-cli");
+        const settingsPath = join(settingsDir, "settings.json");
+        const backupPath = `${settingsPath}.conduit-backup`;
+        const settingsDirExisted = existsSync(settingsDir);
+        let previous = null;
+        try {
+            previous = await readFile(settingsPath, "utf8");
+        }
+        catch {
+            previous = null;
+        }
+        let settings = {};
+        if (previous !== null) {
+            try {
+                settings = { ...JSON.parse(previous) };
+            }
+            catch {
+                throw new Error(`antigravity settings at ${settingsPath} are not valid JSON; refusing to overwrite them`);
+            }
+            await writeFile(backupPath, previous, "utf8");
+        }
+        const existingPermissions = (settings.permissions && typeof settings.permissions === "object" && !Array.isArray(settings.permissions))
+            ? { ...settings.permissions }
+            : {};
+        const trusted = Array.isArray(settings.trustedWorkspaces)
+            ? settings.trustedWorkspaces.filter((entry) => typeof entry === "string")
+            : [];
+        const absolute = resolve(workspace);
+        settings.permissions = { ...existingPermissions, allow };
+        settings.trustedWorkspaces = trusted.includes(absolute) ? trusted : [...trusted, absolute];
+        await mkdir(settingsDir, { recursive: true });
+        await writeFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, "utf8");
+        try {
+            return await run();
+        }
+        finally {
+            if (previous === null)
+                await rm(settingsPath, { force: true });
+            else
+                await writeFile(settingsPath, previous, "utf8");
+            await rm(backupPath, { force: true });
+            if (!settingsDirExisted)
+                await rmdir(settingsDir).catch(() => undefined);
+        }
+    }
+    finally {
+        release();
+    }
+}
 export const antigravityDriver = {
     name: "antigravity",
+    async listModels(executable = "agy", workspace = process.cwd()) {
+        const result = await execute(executable, ["models"], workspace, 30_000, undefined, "local");
+        if (result.code !== 0)
+            return null;
+        const models = parseAntigravityModelList(result.stdout);
+        return models.size ? models : null;
+    },
     async run(input) {
         const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
         // Antigravity authenticates with a Google login / GEMINI_API_KEY — not Conduit /v1 shims.
@@ -1034,12 +1231,33 @@ export const antigravityDriver = {
         if (!mode) {
             return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped Antigravity mode for active grants; refusing to start agent" };
         }
-        // agy print mode emits plain text and does not surface a resumable id, so rework resume is not wired.
-        const { code, stdout, stderr } = await execute(input.executable ?? "agy", antigravityRunArgs({ prompt: input.prompt, grants: input.grants }, mode), input.workspace, agentTurnTimeoutMs(input), undefined, "local");
-        if (code !== 0) {
-            return { status: "failed", resultText: stdout || null, sessionId: null, error: boundedTail(stderr || stdout || `agy exited with code ${code}`, 20_000) };
+        const allow = antigravityPermissionProjection(executionClass, input.grants, {
+            verificationCommands: input.verificationCommands,
+            capabilities: input.capabilities ?? [],
+            diagnosis: input.workRole === "diagnose",
+        });
+        const timeoutMs = agentTurnTimeoutMs(input);
+        let executed;
+        try {
+            executed = await withAntigravityPermissions(input.workspace, allow, () => execute(input.executable ?? "agy", antigravityRunArgs({ prompt: `${input.prompt}\n\n${antigravityPromptRule}`, grants: input.grants, resumeSessionId: input.resumeSessionId, model: input.model }, mode, timeoutMs), input.workspace, timeoutMs, undefined, "local"));
         }
-        return { status: "completed", resultText: stdout, sessionId: null };
+        catch (error) {
+            return { status: "failed", resultText: null, sessionId: null, error: error instanceof Error ? error.message : String(error) };
+        }
+        const { code, stdout, stderr } = executed;
+        const parsed = parseAntigravityOutput(stdout);
+        // A refused run says so in the envelope, not on stderr. Take the envelope's own reason first —
+        // it is the only text that names the cause (a spent allowance and when it refills).
+        const refused = code !== 0 || (parsed.status !== null && parsed.status.toUpperCase() !== "SUCCESS");
+        if (refused) {
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(parsed.error || stderr || parsed.resultText || `agy exited with code ${code}`, 20_000) };
+        }
+        // An empty response with a denial on stderr is a refused run: report it instead of an empty reply.
+        const denial = parsed.resultText?.trim() ? null : antigravityDenialNotice(stderr);
+        if (denial) {
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(`agy returned no response: ${denial}`, 20_000) };
+        }
+        return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
     },
 };
 /**

package/dist/drivers.js

@@ -67,6 +67,8 @@ function normalizeOutcome(raw) {
     const value = raw;
     if (!Number.isFinite(value.consecutive_timeouts) || typeof value.last_timeout_at !== "string")
         return undefined;
+    if (!Number.isFinite(Date.parse(value.last_timeout_at)))
+        return undefined;
     const count = Math.max(0, Math.floor(value.consecutive_timeouts));
     return { consecutive_timeouts: count, last_timeout_at: value.last_timeout_at };
 }
@@ -237,7 +239,7 @@ export function laneTimedOutRecently(config, driverId, now = Date.now()) {
     if (!outcome || outcome.consecutive_timeouts < TIMEOUT_SUPPRESSION_THRESHOLD)
         return false;
     const seen = Date.parse(outcome.last_timeout_at);
-    return !Number.isFinite(seen) || now - seen <= TIMEOUT_SUPPRESSION_MS;
+    return now >= seen && now - seen <= TIMEOUT_SUPPRESSION_MS;
 }
 export function onlineDriverIds(config) {
     const drivers = normalizeDrivers(config.drivers);

package/dist/ensure-land-commit.js

@@ -4,18 +4,9 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { commitsAheadOfBase } from "./ensure-pull-request.js";
+import { readHeadCommit } from "./git.js";
 import { AgentNoLandCommitError, filterPathsInScope, requiresLandCommit, } from "./land-contract.js";
 const execFileAsync = promisify(execFile);
-async function workspaceHeadCommit(workspace) {
-    const { stdout } = await execFileAsync("git", ["-C", workspace, "rev-parse", "HEAD"], {
-        timeout: 30_000,
-        maxBuffer: 1_000_000,
-    });
-    const head = stdout.trim();
-    if (!head)
-        throw new Error("Could not read workspace HEAD");
-    return head;
-}
 async function uncommittedPaths(workspace) {
     const { stdout } = await execFileAsync("git", ["-C", workspace, "status", "--porcelain"], {
         timeout: 30_000,
@@ -64,7 +55,7 @@ export async function ensureLandCommit(input) {
     if (!base)
         return { kind: "skipped" };
     const countAhead = input.countCommitsAhead ?? commitsAheadOfBase;
-    const readHead = input.readHeadCommit ?? workspaceHeadCommit;
+    const readHead = input.readHeadCommit ?? readHeadCommit;
     const listPending = input.listUncommittedPaths ?? uncommittedPaths;
     const commitPaths = input.commitPaths ?? commitScopedPaths;
     const ahead = await countAhead(input.workspace, base);

package/dist/ensure-pull-request.js

@@ -6,10 +6,10 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { normalizeRepositoryUrl } from "./brief.js";
+import { readHeadCommit } from "./git.js";
+import { forgeTransportFailure } from "./transport-fault.js";
 import { agentNoLandCommitMessage } from "./land-contract.js";
 const execFileAsync = promisify(execFile);
-/** Mirror execution.ts FORGE_TRANSPORT_PATTERN — keep local to avoid import cycles. */
-const FORGE_TRANSPORT_PATTERN = /unable to access '?https?:\/\/|error in the http2 framing layer|could not resolve host|connection (?:reset|timed out|refused)|\bcurl\b.*\b(?:52|55|56|92)\b|remote end hung up unexpectedly|\brpc failed\b|tls handshake|network is unreachable|operation timed out/i;
 /**
  * Commits the attempt branch has and the base does not.
  * Returns null when this checkout does not know the base. An unverifiable precondition must not
@@ -103,16 +103,6 @@ export function adoptPullRequestUrlFromEvidence(report, repositoryFingerprint) {
     }
     return report;
 }
-async function workspaceHeadCommit(workspace) {
-    const { stdout } = await execFileAsync("git", ["-C", workspace, "rev-parse", "HEAD"], {
-        timeout: 30_000,
-        maxBuffer: 1_000_000,
-    });
-    const head = stdout.trim().toLowerCase();
-    if (!/^[0-9a-f]{7,64}$/.test(head))
-        throw new Error("Could not determine workspace HEAD commit");
-    return head;
-}
 function execErrorMessage(error) {
     if (!(error instanceof Error))
         return String(error);
@@ -157,7 +147,7 @@ export async function pushOriginHead(workspace, options = {}) {
             catch {
                 // fall through to retry / throw
             }
-            if (attempt < attempts && FORGE_TRANSPORT_PATTERN.test(lastMessage)) {
+            if (attempt < attempts && forgeTransportFailure(lastMessage)) {
                 await sleep(750 * attempt);
                 continue;
             }
@@ -179,7 +169,7 @@ export async function pushOriginHead(workspace, options = {}) {
  * Agent-supplied PR URLs skip creation but still require HEAD identity.
  */
 export async function ensureDeliveryPullRequest(input) {
-    const readHead = input.readHeadCommit ?? workspaceHeadCommit;
+    const readHead = input.readHeadCommit ?? readHeadCommit;
     const push = input.pushOriginHead ?? pushOriginHead;
     const countAhead = input.countCommitsAhead ?? commitsAheadOfBase;
     let report = adoptPullRequestUrlFromEvidence(input.report, input.repositoryFingerprint);