@miraland-labs/conduit-bridge 0.16.32 → 0.16.38

package/dist/driver.js

@@ -3,9 +3,9 @@ import { boundedTail } from "./ensure-test-evidence.js";
 import { resolveAgentTimeout } from "./execution-budget.js";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { z } from "zod";
-import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
+import { allowsExternalFetch, deniedCommands, executionClassPromptRules, isRunnableVerificationCommand, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
 /**
  * The bound for this turn.
  *
@@ -995,10 +995,16 @@ export const kiroDriver = {
     },
 };
 /**
- * Antigravity's `agy` CLI (verified against agy 1.1.3): non-interactive runs use
- * `-p`/`--print` with `--mode plan` (read-only) or `--mode accept-edits`. Its
- * enforcement is mode-level, not per-tool — coarser than Claude, the Cursor tier.
- * Write mode adds `--sandbox` for terminal restrictions. Output is plain text.
+ * Antigravity's `agy` CLI (verified against agy 1.1.24): non-interactive runs use
+ * `--mode plan` (read-only) or `--mode accept-edits`. `-p`/`--print` is a Go-style
+ * flag that consumes its value from the next argument, so the prompt must be the
+ * last argument attached to `-p` — putting other flags after it (as earlier builds
+ * of this driver did) makes agy swallow one of them as the prompt and silently
+ * drop the real prompt. `--print-timeout` is set from the turn budget so agy's
+ * 5-minute default cannot cut a longer turn short. Its enforcement is mode-level,
+ * not per-tool — coarser than Claude, the Cursor tier. Write mode adds `--sandbox`
+ * for terminal restrictions. `--output-format json` returns one envelope, parsed by
+ * parseAntigravityOutput.
  */
 export function antigravityModeForGrants(grants, executionClass) {
     if (!hasMappedRepoAccess(grants))
@@ -1011,15 +1017,207 @@ export function antigravityModeForGrants(grants, executionClass) {
         return "plan";
     return null;
 }
-export function antigravityRunArgs(input, mode) {
-    const args = ["-p", "--mode", mode];
+/** agy's `--print-timeout` takes a Go duration; ceil to whole minutes (agy's own default floor is 5m). */
+export function antigravityPrintTimeout(timeoutMs) {
+    return `${Math.max(5, Math.ceil(timeoutMs / 60_000))}m0s`;
+}
+/**
+ * Class + grants → agy permission allow-rules (probed against agy 1.1.24).
+ *
+ * Headless `agy -p` soft-denies every tool it was not granted: the run returns an empty response
+ * with a stderr notice and nothing is written. Only wildcard rules ever matched in the probes —
+ * bounded ones (`command(git add)`, `command(git *)`, and in the field `unsandboxed(git push)`)
+ * were auto-denied, because the agent picks its own shell spellings and stops at the first denial.
+ * So the enforceable unit is the coarse rule plus `--sandbox`, the same boundary the Codex driver
+ * leans on with `--sandbox workspace-write`. The grammar agy accepts is `command(<cmd>)`,
+ * `unsandboxed(<cmd>)`, `write_file(<glob>)`, `read_file(<glob>)`, `read_url(<target>)`.
+ *
+ * `deniedCommands` cannot be expressed here: agy has no deny grammar. Antigravity is the coarse
+ * tier the product spec already assigns it — enforcement is the sandbox, the prompt rule that names
+ * the hard-denied commands (executionClassPromptRules), and the delivery gate.
+ */
+export function antigravityPermissionProjection(executionClass, grants, options = {}) {
+    const allow = ["read_file(*)"];
+    // Live HTTP is the assignment's capability, read the one way every driver reads it. agy aborts the
+    // whole turn on a denial rather than skipping the tool, so an assignment that may fetch must carry
+    // the rule; one that may not never gets it.
+    if (allowsExternalFetch(executionClass, options.capabilities))
+        allow.push("read_url(*)");
+    const runnable = (options.verificationCommands ?? []).some(isRunnableVerificationCommand);
+    if (executionClass === "observe" || executionClass === "observe_network" || options.diagnosis) {
+        // Diagnosis has to run its bounded checks; a plain observe class gets no shell at all.
+        if (runnable && (options.diagnosis || grants.includes("test_run")))
+            allow.push("command(*)");
+        return allow;
+    }
+    if (executionClass === "verify") {
+        allow.push("command(*)");
+        return allow;
+    }
+    allow.push("write_file(*)", "command(*)");
+    // Land work needs the sandbox escape hatch, and only a wildcard reaches it: a real mutate_repo
+    // assignment carrying `pr_create` was auto-denied on exact `unsandboxed(git push)` with
+    // "a tool required the \"unsandboxed\" permission that headless mode cannot prompt for". So for
+    // the land class the sandbox boundary no longer covers the escape hatch, and enforcement there is
+    // the prompt's hard-deny list, the delivery gate (one PR, a scoped diff, Bridge-witnessed
+    // commands) and the project's grants — the coarse tier. Without `pr_create` no `unsandboxed(...)`
+    // rule is emitted at all, and `--sandbox` stays on either way.
+    if (grants.includes("pr_create"))
+        allow.push("unsandboxed(*)");
+    return allow;
+}
+/**
+ * The one driver note agy needs beside the class rules. It aborts the whole turn on any denied tool
+ * — Claude Code merely skips one — and a run that had already committed died opening its own PR URL
+ * with `read_url`, which no assignment without external_network may hold.
+ */
+export const antigravityPromptRule = "Antigravity: do not use read_url, browser, or web tools unless this assignment lists external_network; do not open the pull request URL after creating it — report the URL from the `gh pr create` output. A denied tool ends the whole run, so use only the tools this assignment allows.";
+export function antigravityRunArgs(input, mode, timeoutMs) {
+    const args = ["--mode", mode];
     if (mode === "accept-edits")
         args.push("--sandbox");
-    args.push(input.prompt);
+    args.push("--output-format", "json");
+    args.push("--print-timeout", antigravityPrintTimeout(timeoutMs));
+    // agy's CLI default model is one account lane among several; `--model` selects the lane this
+    // machine's tier mapping names, which is how a spent Gemini window stops the whole driver.
+    if (input.model)
+        args.push("--model", input.model);
+    if (input.resumeSessionId)
+        args.push("--conversation", input.resumeSessionId);
+    args.push("-p", input.prompt);
     return args;
 }
+/**
+ * Parse `agy models`: one model per line, the id first and the display name after it
+ * ("claude-sonnet-4-6         Claude Sonnet 4.6 (Thinking)"). Two or more spaces separate the two
+ * columns, which is what tells a model line from a banner line ("Available models:").
+ */
+export function parseAntigravityModelList(stdout) {
+    const models = new Set();
+    for (const line of stdout.split("\n")) {
+        // A terminal shows the two columns padded with spaces; a pipe gets one tab between them.
+        const match = /^\s*([A-Za-z0-9][A-Za-z0-9._/-]*)(?:\t+| {2,})\S/.exec(line);
+        if (match)
+            models.add(match[1]);
+    }
+    return models;
+}
+/**
+ * `agy --output-format json` prints one envelope:
+ * `{"conversation_id","status","response","duration_seconds","num_turns","usage"}`.
+ * Tolerant like the Cursor parser: a build that answers in plain text still delivers its report.
+ *
+ * A refused run keeps the same envelope with `status: "ERROR"`, an empty `response`, and the reason
+ * in `error` ("Individual quota reached ... Resets in 165h48m43s."), and prints **nothing** on
+ * stderr. Reading only `response` reported that run as "agy exited with code 1", which says nothing
+ * the owner can act on — so `status` and `error` are parsed here and named by the driver.
+ */
+export function parseAntigravityOutput(stdout) {
+    try {
+        const parsed = JSON.parse(stdout.trim());
+        return {
+            resultText: typeof parsed.response === "string" ? parsed.response : null,
+            sessionId: typeof parsed.conversation_id === "string" ? parsed.conversation_id : null,
+            status: typeof parsed.status === "string" ? parsed.status : null,
+            error: typeof parsed.error === "string" && parsed.error.trim() ? parsed.error : null,
+        };
+    }
+    catch {
+        return { resultText: stdout || null, sessionId: null, status: null, error: null };
+    }
+}
+/**
+ * The stderr line agy prints when a permission it was not granted ended the turn. An empty response
+ * beside such a line is a denial, not an agent with nothing to say, and the control plane has to see
+ * the difference.
+ */
+export function antigravityDenialNotice(stderr) {
+    for (const line of stderr.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed && /no output produced|permission/i.test(trimmed))
+            return trimmed;
+    }
+    return null;
+}
+/** agy reads one global settings file, so concurrent runs are serialized rather than racing on it. */
+let antigravitySettingsLock = Promise.resolve();
+/**
+ * Write the run's permission contract to agy's global settings file, restoring it byte-exactly after.
+ *
+ * Probed against agy 1.1.24: this is the only placement a headless run honours — a workspace-local
+ * `.antigravity/settings.json` and `~/.gemini/config/projects/<uuid>.json` `permissionGrants` were
+ * both ignored, and without `trustedWorkspaces` naming the workspace every tool is soft-denied. The
+ * file belongs to the machine owner and is global, so the original bytes are held in memory and
+ * beside it as `settings.json.conduit-backup` for the length of the run, unparsable JSON fails the
+ * run instead of being overwritten, and every other key is preserved.
+ */
+async function withAntigravityPermissions(workspace, allow, run) {
+    const previousRun = antigravitySettingsLock;
+    let release = () => undefined;
+    antigravitySettingsLock = new Promise((settle) => { release = settle; });
+    await previousRun.catch(() => undefined);
+    try {
+        const home = process.env.HOME;
+        if (!home)
+            throw new Error("antigravity needs HOME to write ~/.gemini/antigravity-cli/settings.json");
+        const settingsDir = join(home, ".gemini", "antigravity-cli");
+        const settingsPath = join(settingsDir, "settings.json");
+        const backupPath = `${settingsPath}.conduit-backup`;
+        const settingsDirExisted = existsSync(settingsDir);
+        let previous = null;
+        try {
+            previous = await readFile(settingsPath, "utf8");
+        }
+        catch {
+            previous = null;
+        }
+        let settings = {};
+        if (previous !== null) {
+            try {
+                settings = { ...JSON.parse(previous) };
+            }
+            catch {
+                throw new Error(`antigravity settings at ${settingsPath} are not valid JSON; refusing to overwrite them`);
+            }
+            await writeFile(backupPath, previous, "utf8");
+        }
+        const existingPermissions = (settings.permissions && typeof settings.permissions === "object" && !Array.isArray(settings.permissions))
+            ? { ...settings.permissions }
+            : {};
+        const trusted = Array.isArray(settings.trustedWorkspaces)
+            ? settings.trustedWorkspaces.filter((entry) => typeof entry === "string")
+            : [];
+        const absolute = resolve(workspace);
+        settings.permissions = { ...existingPermissions, allow };
+        settings.trustedWorkspaces = trusted.includes(absolute) ? trusted : [...trusted, absolute];
+        await mkdir(settingsDir, { recursive: true });
+        await writeFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, "utf8");
+        try {
+            return await run();
+        }
+        finally {
+            if (previous === null)
+                await rm(settingsPath, { force: true });
+            else
+                await writeFile(settingsPath, previous, "utf8");
+            await rm(backupPath, { force: true });
+            if (!settingsDirExisted)
+                await rmdir(settingsDir).catch(() => undefined);
+        }
+    }
+    finally {
+        release();
+    }
+}
 export const antigravityDriver = {
     name: "antigravity",
+    async listModels(executable = "agy", workspace = process.cwd()) {
+        const result = await execute(executable, ["models"], workspace, 30_000, undefined, "local");
+        if (result.code !== 0)
+            return null;
+        const models = parseAntigravityModelList(result.stdout);
+        return models.size ? models : null;
+    },
     async run(input) {
         const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
         // Antigravity authenticates with a Google login / GEMINI_API_KEY — not Conduit /v1 shims.
@@ -1034,12 +1232,33 @@ export const antigravityDriver = {
         if (!mode) {
             return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped Antigravity mode for active grants; refusing to start agent" };
         }
-        // agy print mode emits plain text and does not surface a resumable id, so rework resume is not wired.
-        const { code, stdout, stderr } = await execute(input.executable ?? "agy", antigravityRunArgs({ prompt: input.prompt, grants: input.grants }, mode), input.workspace, agentTurnTimeoutMs(input), undefined, "local");
-        if (code !== 0) {
-            return { status: "failed", resultText: stdout || null, sessionId: null, error: boundedTail(stderr || stdout || `agy exited with code ${code}`, 20_000) };
+        const allow = antigravityPermissionProjection(executionClass, input.grants, {
+            verificationCommands: input.verificationCommands,
+            capabilities: input.capabilities ?? [],
+            diagnosis: input.workRole === "diagnose",
+        });
+        const timeoutMs = agentTurnTimeoutMs(input);
+        let executed;
+        try {
+            executed = await withAntigravityPermissions(input.workspace, allow, () => execute(input.executable ?? "agy", antigravityRunArgs({ prompt: `${input.prompt}\n\n${antigravityPromptRule}`, grants: input.grants, resumeSessionId: input.resumeSessionId, model: input.model }, mode, timeoutMs), input.workspace, timeoutMs, undefined, "local"));
         }
-        return { status: "completed", resultText: stdout, sessionId: null };
+        catch (error) {
+            return { status: "failed", resultText: null, sessionId: null, error: error instanceof Error ? error.message : String(error) };
+        }
+        const { code, stdout, stderr } = executed;
+        const parsed = parseAntigravityOutput(stdout);
+        // A refused run says so in the envelope, not on stderr. Take the envelope's own reason first —
+        // it is the only text that names the cause (a spent allowance and when it refills).
+        const refused = code !== 0 || (parsed.status !== null && parsed.status.toUpperCase() !== "SUCCESS");
+        if (refused) {
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(parsed.error || stderr || parsed.resultText || `agy exited with code ${code}`, 20_000) };
+        }
+        // An empty response with a denial on stderr is a refused run: report it instead of an empty reply.
+        const denial = parsed.resultText?.trim() ? null : antigravityDenialNotice(stderr);
+        if (denial) {
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: boundedTail(`agy returned no response: ${denial}`, 20_000) };
+        }
+        return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
     },
 };
 /**

package/dist/execution.js

@@ -74,6 +74,40 @@ function changesRequestedFeedback(summary) {
  * failure, which is exactly today's behaviour.
  */
 export const SUBSCRIPTION_EXHAUSTED_PATTERN = /\b(?:usage|rate|session)[ _-]?limit(?:ed|s)?\b|\b(?:daily|weekly|monthly) limit\b|\bquota (?:exceeded|exhausted|reached)\b|\b(?:http|status|code)\W{0,3}429\b|\b429\b(?=\W{0,3}too many)|too many requests|out of (?:credits|usage)/i;
+/**
+ * A vendor naming the account's own allowance as the reason it refused this run.
+ *
+ * Narrower and louder than SUBSCRIPTION_EXHAUSTED_PATTERN, which decides whether to dark a lane:
+ * this one decides what the owner is told. agy 1.1.24 returns `{"status":"ERROR","error":
+ * "Individual quota reached. Please upgrade your subscription ... Resets in 165h48m43s."}` with an
+ * empty stderr, which had no pattern at all and retried three times in a minute while the owner was
+ * told nothing. A spent allowance is a wait, never a retry.
+ *
+ * Kept identical to the control-plane copy in src/conductor/failures.ts, pinned by
+ * test/failure-classification.test.ts — the two ship on different clocks.
+ */
+export const PROVIDER_QUOTA_PATTERN = /individual quota reached|quota reached|upgrade your subscription|resets in \d/i;
+export function providerQuotaRefusal(message) {
+    return PROVIDER_QUOTA_PATTERN.test(message);
+}
+/**
+ * What the owner sees when the account's allowance, not Conduit, ended the run. The reset time is
+ * quoted from the vendor's own text when it gave one; nothing is invented when it did not.
+ */
+export function providerQuotaFailure(detail) {
+    const resets = /resets? in ([^.\n]{1,40})/i.exec(detail);
+    return {
+        code: "driver_quota_exhausted",
+        class: "environment",
+        disposition: "hold",
+        responsible_party: "computer_operator",
+        message: resets
+            ? `The agent lane on this computer has spent its subscription allowance. It refills in ${resets[1].trim()}.`
+            : "The agent lane on this computer has spent its subscription allowance.",
+        next_action: "Wait for the allowance to refill, bring another agent lane online to start sooner, or point this lane's model settings at a model that still has allowance.",
+        diagnostic_detail: detail,
+    };
+}
 /**
  * Does this failure mean the plan is spent, rather than the prompt being wrong?
  *
@@ -271,10 +305,20 @@ export function observeDriverFuel(config, driverId, fuelSource, result, now = Da
 }
 /** Failures that require an operator/configuration change must never burn the remaining attempts. */
 export function retryableAgentFailure(message) {
+    // A spent allowance is the account's window, not a flaky run: every retry inside it fails the
+    // same way and burns the attempt budget while the owner is told nothing.
+    if (providerQuotaRefusal(message))
+        return false;
     // `cannot enforce` is a driver projection refusing a class it structurally cannot bound (Pi and
     // observe_network). No number of retries on that lane changes it, and retrying an immutable input
     // is how one assignment burned ~80 attempts. Fail closed; the message names the drivers that work.
-    return !/unknown (?:option|argument)|unrecognized (?:option|argument)|not logged in|no login|not authenticated|login required|\bENOENT\b|could not verify the installed CLI|requires local fuel|No Bridge-mapped|cannot enforce|preflight/i.test(message);
+    // `took "..." as its prompt` / `Usage of agy` is agy's Go-style flag-parsing refusal (e.g. a
+    // driver flag ordering bug feeding it the wrong prompt argument) — an identical arg list fails
+    // identically on every retry.
+    // `headless mode cannot prompt for` / `was auto-denied` is a soft denial: the CLI refused a tool
+    // the run's permission rules did not match. The same rules produce the same denial next time, so
+    // it is a driver/permission defect to surface, never a transient to burn attempts on.
+    return !/unknown (?:option|argument)|unrecognized (?:option|argument)|not logged in|no login|not authenticated|login required|\bENOENT\b|could not verify the installed CLI|requires local fuel|No Bridge-mapped|cannot enforce|preflight|took "[^"]*" as its prompt|Usage of agy|headless mode cannot prompt for|was auto-denied/i.test(message);
 }
 const assignmentSchema = z.object({
     id: z.string().uuid(),
@@ -1246,7 +1290,12 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             // Keep the tree until the replay-safe terminal response explicitly says whether diagnosis was
             // queued. A network fault here must not delete the evidence before Bridge can replay terminal.
             retainAttemptWorktree = true;
-            const response = await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable: retryableAgentFailure(agentMessage), idempotency_key: `bridge:fail:${active.attemptId}` } });
+            const response = await queueTerminal(client, taskId, { action: "fail", body: {
+                    error: message,
+                    retryable: retryableAgentFailure(agentMessage),
+                    ...(providerQuotaRefusal(agentMessage) ? { failure: providerQuotaFailure(agentMessage) } : {}),
+                    idempotency_key: `bridge:fail:${active.attemptId}`,
+                } });
             retainAttemptWorktree = response.retain_worktree === true;
             console.error(`Assignment ${taskId} failed: ${redactSecrets(message)}`);
             return;
@@ -1414,7 +1463,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                         const message = repairError instanceof Error ? repairError.message : "Delivery report repair failed";
                         const detail = `Delivery report repair failed: ${message}`;
                         const retryable = retryableAgentFailure(message);
-                        await queueTerminal(client, taskId, { action: "fail", body: { error: detail, retryable, failure: retryable ? undefined : deliveryReportRepairFailure(detail), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
+                        await queueTerminal(client, taskId, { action: "fail", body: { error: detail, retryable, failure: repairTurnFailure(detail, retryable), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
                         console.error(`Assignment ${taskId} report-only repair failed: ${redactSecrets(message)}`);
                         return;
                     }
@@ -1427,7 +1476,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                     if (repaired.status === "failed") {
                         const message = repaired.error ?? "Delivery report repair failed";
                         const retryable = retryableAgentFailure(message);
-                        await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable, failure: retryable ? undefined : deliveryReportRepairFailure(message), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
+                        await queueTerminal(client, taskId, { action: "fail", body: { error: message, retryable, failure: repairTurnFailure(message, retryable), idempotency_key: `bridge:delivery-repair-failed:${active.attemptId}` } });
                         console.error(`Assignment ${taskId} report-only repair failed: ${redactSecrets(message)}`);
                         return;
                     }
@@ -2083,6 +2132,15 @@ function retainDiagnosticWorktree(response) {
     // receive that decision, so fail safe by retaining the only copy of the failed code.
     return response.retain_worktree === true || response.status === "invalid_lease";
 }
+/**
+ * A repair turn that died on the account's allowance is not a delivery-report defect. Naming it one
+ * would send the owner to rework a report the agent never got to write.
+ */
+function repairTurnFailure(detail, retryable) {
+    if (providerQuotaRefusal(detail))
+        return providerQuotaFailure(detail);
+    return retryable ? undefined : deliveryReportRepairFailure(detail);
+}
 /**
  * The envelope for a delivery report the Bridge could not repair.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.32",
+  "version": "0.16.38",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {