@mrclrchtr/supi-consulting 11.1.0 → 11.3.0

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## [11.3.0]
+
+- Added package-specific release notes for bounded agent consultations.
+- Consultations now use an explicit read-only Antigravity tool selection for web search, direct URL reading, and workspace inspection, with structured completion and observed source evidence.
+- Follow-ups that ask the agent not to use tools no longer fail with an unverifiable answer.
+- Reading cached web pages no longer reports workspace use or a misleading workspace warning.
+- Requires Antigravity CLI `1.4.9` or newer. Start a new Consultation after upgrading: existing default-agent Conversation Handles cannot gain the new tools; they are rejected before process startup, retired, and recorded as `info`-level `consultation.rejected` Debug events instead of errors.

package/CLAUDE.md

@@ -9,7 +9,7 @@
 - Keep agent-specific models, authentication, process code, protocol parsing, and tool-activity classification in `src/agents/antigravity/`. Shared workflow uses the private interface in `src/agents/types.ts`.
 - Keep each Model Catalogue immutable until the next session start or reload. Register `consulting_run` only after agent discovery succeeds.
 - Require explicit agent, model, and Workspace Access for a new Consultation. Keep `new` and `continue` exact-one; follow-ups inherit all selections and their working directory.
-- Acquire a handle before process work. Report process start, including hook probes, through the adapter interface. Reject overlap before startup; retire only after a started follow-up fails or is canceled.
+- Acquire a handle before process work. Report process start, including hook probes, through the adapter interface. Reject overlap before startup; retire after a started follow-up fails or is canceled, or when the adapter rejects incompatible continuation state (which can never succeed).
 - Keep raw conversation IDs opaque to shared policy. Persist only new consulting handle records and results; old Antigravity state has no migration or legacy read path.
 - Use `<PI agent dir>/supi/consulting/antigravity/` for Antigravity state. Leave the old `supi/antigravity/` tree untouched.
 - Use the Isolated Antigravity Home for every `agy` process. On macOS, create and unlock its private keychain, exposed as the login keychain, before startup. Do not copy the normal profile, credentials, or PI provider environment.

package/README.md

@@ -44,7 +44,7 @@ cd "<consultation-workspace>" &&
 HOME="<isolated-home>" AGY_CLI_DISABLE_AUTO_UPDATE=true agy
 ```
 
-On macOS, the adapter creates and unlocks a private keychain inside the Isolated Antigravity Home. It exposes that keychain as the login keychain without prompting for the normal keychain password. Run the displayed command, sign in, exit Antigravity, and reload Pi. The installed `agy` version must be at least `1.1.24`.
+On macOS, the adapter creates and unlocks a private keychain inside the Isolated Antigravity Home. It exposes that keychain as the login keychain without prompting for the normal keychain password. Run the displayed command, sign in, exit Antigravity, and reload Pi. The installed `agy` version must be at least `1.4.9`.
 
 If macOS displays `antigravity.` in a warning, the final `.` is sentence punctuation, not part of a keychain name.
 
@@ -65,7 +65,7 @@ A new Consultation requires the agent, an available model, and Workspace Access:
 
 The Model Catalogue is the intersection of the curated Antigravity models and the models available to the signed-in account. It stays fixed until the next session start or reload. There is no default model or automatic agent fallback.
 
-Set `workspace` to `true` only when the Consultation needs repository evidence. This exposes the current PI workspace. Set it to `false` to use the empty Consultation Workspace.
+Set `workspace` to `true` only when the Consultation needs repository evidence. This exposes the current PI workspace. Set it to `false` to use the empty Consultation Workspace. Explicitly configured additional read-only directories remain accessible with either selection.
 
 A follow-up supplies only a returned Conversation Handle:
 
@@ -76,38 +76,92 @@ A follow-up supplies only a returned Conversation Handle:
 }
 ```
 
-Supply exactly one of `new` and `continue`. Follow-ups retain the original agent, model, working directory, and Workspace Access. A handle is opaque and branch-aware. It is retired if a follow-up fails or is canceled after process work starts. Overlapping follow-ups on the same handle are rejected.
+Supply exactly one of `new` and `continue`. Follow-ups retain the original agent, model, working directory, and Workspace Access. A handle is opaque and branch-aware. It is retired if a follow-up fails or is canceled after process work starts, or if its continuation state is incompatible. Overlapping follow-ups on the same handle are rejected.
 
 Results report web use, workspace use, observed and claimed references, warnings, token use, and the Conversation Handle. An answer can claim a reference without matching tool activity; SuPi labels that reference as claimed, not observed.
 
+### Inspection tools and existing handles
+
+New Antigravity conversations use a package-owned temporary agent definition with explicit web search (`search_web`), direct URL reading (`read_url_content`), read-only file inspection (`view_file`, `list_dir`, `find_by_name`, `grep_search`), and structured completion (`finish`). The default Antigravity agent's tool selection is not used. A permission such as `read_url(*)` authorizes access; it does not itself make a URL-reading tool available.
+
+The definition lives in the Isolated Antigravity Home under a random name to avoid workspace-agent name collisions. SuPi removes it after the process, including ordinary failures, timeouts, and cancellation. A hard process crash can leave a temporary definition behind. Follow-ups resume the saved conversation without a new agent override; Antigravity retains the original definition even after its file is removed.
+
+**Start a new Consultation after upgrading from the default-agent integration.** Old Conversation Handles cannot acquire the inspection tools by resuming. SuPi rejects legacy or incompatible profile continuations before starting any Antigravity process, retires the handle, and asks for a new Consultation. Profile compatibility is tracked privately; the calling tool's input shape is unchanged.
+
+Follow-up prompts get one fixed line asking the agent to end with `finish` using the current schema. Without it, a follow-up such as "do not use any tools" can skip `finish`, and Antigravity then replays the previous turn's answer, which SuPi rejects as unbound.
+
+Antigravity caches fetched pages inside its own conversation state and may read them back with `view_file`. File activity whose path resolves outside the selected workspace and configured read-only directories is treated as agent-internal: it does not count as workspace use or workspace evidence. File calls without a classifiable path remain counted.
+
+Web activity alone does not prove a cited page was read. For research, the agent is instructed to search for sources and directly read relevant pages before citing them. SuPi still classifies references from observed activity, not from the agent's claims. The CLI's startup tool inventory is not treated as proof that a tool is active for the selected agent.
+
 Use `/supi-settings` → **Consulting** to disable the tool. Disabling it skips availability checks and removes `consulting_run` from the active tool list.
 
+## Additional read-only directories
+
+Use `/supi-settings` → **Consulting** → **Additional read-only directories** to enter comma-separated absolute directory paths. The default is an empty list. No shell expansion or glob matching is performed. For paths containing commas, edit the JSON configuration instead.
+
+Global configuration lives at `~/.pi/agent/supi/config.json`; project configuration lives at `.pi/supi/config.json`:
+
+```json
+{
+  "consulting": {
+    "additionalReadOnlyDirectories": ["/tmp/octalog-filter-previews"]
+  }
+}
+```
+
+- Project values replace the global list, rather than extending it. An explicit `[]` removes inherited grants; Inherit/Reset deletes the scoped key. Untrusted project configuration cannot grant access; global grants still apply.
+- Directories must exist and be accessible when a Consultation starts. Symlinks are resolved and duplicate roots are removed, so `/tmp` resolves to `/private/tmp` on macOS without needing both entries.
+- Settings are read from the current Pi workspace before each new Consultation and follow-up. Changes apply to the next invocation without reloading. They do not modify an already-running process.
+- The directories are registered with Antigravity per process using `--add-dir`, not persisted as permission grants in the shared profile. The fixed write, command, MCP, and URL-execution denials remain in force; `allowNonWorkspaceAccess` stays `false`.
+- Configured directories are available even with `workspace: false`. Prefer task-specific artifact folders over all of `/tmp`, which may contain unrelated sensitive files. This setting does not authorize shell-based browser automation.
+- Reads from extra directories can contribute inspection activity, but references outside the selected workspace are not reported as validated workspace-relative evidence.
+
+Directory registration and deny-rule precedence follow Antigravity's [CLI reference](https://antigravity.google/docs/cli/reference/) and [permissions reference](https://antigravity.google/docs/permissions/). These are Antigravity policy restrictions, not a new operating-system security boundary.
+
 ## Failure diagnostics
 
 Execution failures report a fixed reason when the adapter can identify it:
 
-- Missing final result, missing structured answer, or answer schema mismatch.
+- Missing final result, missing structured answer, answer schema mismatch, or an answer not bound to the current request.
 - Unsuccessful final result or data received after the final result.
 - Malformed JSON, a non-object event, or an output limit exceeded.
 - Missing conversation identifier, process failure, timeout, or cancellation.
 
-An observed tool permission denial is reported separately. It does not prove the cause of a later failure. A denial does not fail a Consultation that returns a valid answer. Workspace Access does not grant access to files outside the selected workspace.
+Each invocation adds a unique response token to its private answer schema and validates the returned token locally before accepting the answer. The token is removed from public results and excluded from failure diagnostics. This prevents a resumed Antigravity conversation's previous structured answer from being accepted as the current result. Missing or mismatched tokens fail with `unbound-answer`; plain-text answers are not substituted for the structured contract. A started follow-up that fails retires its Conversation Handle; start a new Consultation.
 
-When SuPi Debug is enabled, failed executions emit one `consulting/consultation.failed` event at `error` level. Cancellations emit `consulting/consultation.cancelled` at `info` level. Use the `debug` tool:
+An observed tool permission denial is reported separately. It does not prove the cause of a later failure. A denial does not fail a Consultation that returns a valid answer. Workspace Access alone does not grant access to files outside the selected workspace; configure additional read-only directories explicitly.
+
+Failure messages returned to the calling agent include the observed terminal status and denial counts by fixed operation category (`command`, `file-read`, `file-write`, `web-read`, `browser`, `mcp`, or `other`). They distinguish a successful agent terminal status from a usable final answer and recommend permitted inspection or a limited/blocked report rather than repeating denied actions unchanged. This feedback remains available when Debug is disabled.
+
+When SuPi Debug is enabled, failed executions emit one `consulting/consultation.failed` event at `error` level. Cancellations emit `consulting/consultation.cancelled` at `info` level. Rejected incompatible Conversation Handles emit `consulting/consultation.rejected` at `info` level; no process was started for them. Use the `debug` tool:
 
 ```json
 { "source": "consulting", "level": "error", "limit": 10 }
 ```
 
-Omit `level` to include cancellations. Add `sessionFile` to inspect events persisted in a saved PI session. A response aborted before the adapter starts has no Consulting event.
+Omit `level` to include cancellations and rejected handles. Add `sessionFile` to inspect events persisted in a saved PI session. A response aborted before the adapter starts has no Consulting event.
+
+Events contain the execution phase, timing, selected model, workspace-access and follow-up flags, failure category and reason, and available event counts, terminal-state flags, permission-denial count, and exit code. `permissionDenialsByOperation` breaks down deduplicated denials by fixed category; unknown tool names become `other`. `deniedFileAccessOutsideReadRoots` counts denied file operations whose requested paths resolve outside the selected directory and configured additional read-only directories, following symlinks and existing parents of missing targets. Unavailable path information, dangling symlink destinations, and paths containing parent traversal (`..`) remain unclassified rather than risking an incorrect outside-root claim. This location observation does not identify which rule caused a denial.
+
+Antigravity's terminal `denied_actions` summary can establish a denial even when its detailed tool-error update is absent. It establishes a minimum of one observation per operation category, not additional calls on top of already-correlated denials. Summary entries have no tool-call IDs or file parameters, so the adapter does not attribute them to nearby or unfinished file requests.
+
+Failures also include bounded requested file-target metadata in both Debug and caller-visible feedback:
+
+- `deniedResources` lists at most eight distinct `{ operation, requestedPath }` references for known file operations observed as denied. Targets come from structured parameters on the denied event or earlier updates correlated by tool-call ID, never from error text, command parsing, nearby calls, or transcripts.
+- `requestedPath` preserves the supplied path, including significant whitespace. It is not a canonical filesystem path or the permission checker's resolved target, and does not identify a permanent path blacklist or the denying rule. Paths are limited to 1,024 UTF-16 characters; longer paths are unavailable rather than silently shortened.
+- `deniedResourcesOmitted` counts file-denial observations whose known targets were omitted because the list was full, not unique omitted paths. Repeated denials for listed targets do not duplicate entries.
+- `deniedResourcePathsUnavailable` counts known file-denial observations without an available, bounded structured target. Missing correlation or parameters remain unknown; the adapter does not infer a path from prose. Explicit replacement targets supersede earlier metadata, including when the replacement is invalid or overlong; only omitted path parameters preserve an earlier target.
+- `unfinishedResources` separately lists at most eight distinct requested targets from ID-correlated file calls with no observed terminal outcome. These are **unknown outcomes, not confirmed denials**, even if a terminal summary reports the same operation category. Successful and already-denied calls are excluded. `unfinishedResourcesOmitted` counts capacity-omitted observations; `unfinishedResourcePathsUnavailable` counts observations lacking a usable target. The same path limits, replacement semantics, and deduplication rules apply as for denied resources.
+- Caller-visible references are JSON-quoted, with terminal control characters and line separators escaped. **Denied and unfinished requested paths can contain sensitive metadata and are exposed to the calling agent and persisted with enabled Debug events.**
 
-Events contain the execution phase, timing, selected model, workspace-access and follow-up flags, failure category and reason, and available event counts, terminal-state flags, permission-denial count, and exit code. They exclude prompts, answers, resource paths, conversation IDs, raw stdout, stderr, tool payloads, and error causes, even when raw Debug access is enabled. The event's `cwd` identifies the selected working directory. Failure messages remain specific when Debug is disabled.
+Events otherwise exclude prompts, answers, arbitrary tool names, raw stdout, stderr, complete tool payloads, and error causes, even when raw Debug access is enabled. The event's `cwd` identifies the selected working directory. Successful Consultations do not gain a failure event merely because an action was denied.
 
 ## Security limits
 
-The Antigravity adapter enforces its Inspection Permission Set in the Isolated Antigravity Home. It allows `read_url(*)` and denies known file writes, commands, unsandboxed actions, MCP, and URL execution. These rules are **not an operating-system sandbox**.
+The Antigravity adapter enforces its Inspection Permission Set in the Isolated Antigravity Home. It allows `read_url(*)` and denies known file writes, commands, MCP, and URL execution. The `command(*)` rule covers commands inside and outside Antigravity's terminal sandbox; the obsolete, ignored `unsandboxed(*)` rule is not emitted. These rules are **not an operating-system sandbox**.
 
-For workspace Consultations, project-local hooks can run commands, read the Antigravity transcript, and cause side effects outside these permission rules. The adapter probes hook state before the paid process and warns when hooks are active or unknown.
+For Consultations with Workspace Access or additional read-only directories, project-local hooks can run commands, read the Antigravity transcript, and cause side effects outside these permission rules. The adapter probes hook state with the additional roots before the paid process and warns when hooks are active or unknown. Directory grants are intended for inspection artifacts, not untrusted project customizations.
 
 `read_url(*)` can reach local, private-network, and link-local endpoints that Antigravity accepts. It does not enforce public-internet-only access.
 
@@ -123,4 +177,4 @@ The live probe requires separate approval and sign-in. It never runs in normal t
 SUPI_CONSULTING_LIVE=1 pnpm exec jiti packages/supi-consulting/scripts/live-probe.ts
 ```
 
-It uses the isolated profile and checks web evidence, follow-up context, workspace evidence, and byte-identical fixture state.
+It uses the isolated profile and requires successful web search and direct URL reading, an observed source matching the fetched URL, and a schema-validated follow-up that retains context and the URL reader after the temporary definition has been removed. It also checks observed workspace evidence and byte-identical fixture state. The direct-reader checks use the private process interface; workspace checks use the Consulting Agent adapter. No paid capability checks run during normal discovery.

package/node_modules/@mrclrchtr/supi-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrclrchtr/supi-core",
-  "version": "11.1.0",
+  "version": "11.3.0",
   "description": "Shared settings, configuration, reporting, and session infrastructure",
   "license": "MIT",
   "repository": {

package/node_modules/@mrclrchtr/supi-core/src/child-web-tools.ts

@@ -0,0 +1,110 @@
+// Session-provided Web tools for SuPi child sessions (Agent Runs and Reviewer Sessions).
+//
+// The loaded supi-web extension answers a synchronous request on the parent event bus.
+// Consumers never depend on supi-web; when it is absent or provides no tools, the
+// request returns undefined and the child simply lacks Web tools.
+
+import type { ExtensionAPI, ExtensionFactory } from "@earendil-works/pi-coding-agent";
+
+/** Web tools that child sessions may receive when the containing session provides them. */
+export const CHILD_WEB_TOOL_NAMES = [
+  "web_fetch_md",
+  "web_search",
+  "web_docs_search",
+  "web_docs_fetch",
+] as const;
+
+/** One session-provided Web tool name. */
+export type ChildWebToolName = (typeof CHILD_WEB_TOOL_NAMES)[number];
+
+/**
+ * Web tools currently callable in the containing session plus a child-only extension
+ * factory that registers them. The factory must not capture the parent session; it may
+ * capture plain data such as the containing session's configuration directory.
+ */
+export interface ChildWebToolProvision {
+  readonly toolNames: readonly ChildWebToolName[];
+  /** Register the requested subset of `toolNames` in a child session. */
+  readonly createFactory: (toolNames: readonly ChildWebToolName[]) => ExtensionFactory;
+}
+
+/** Plain containing-session data supplied with a child Web tool request. */
+export interface ChildWebToolsRequestContext {
+  /**
+   * Working directory whose SuPi configuration governs Web settings such as Firecrawl.
+   * Children with a different cwd (for example a frozen Review Workspace) keep this policy.
+   */
+  readonly configCwd: string;
+}
+
+type EventBusLike = Pick<ExtensionAPI["events"], "on" | "emit">;
+
+const REQUEST_CHANNEL = "supi:child-web-tools:request";
+const RESPONSE_CHANNEL = "supi:child-web-tools:response";
+
+interface ChildWebToolsRequest extends ChildWebToolsRequestContext {
+  readonly requestId: string;
+}
+
+interface ChildWebToolsResponse {
+  readonly requestId: string;
+  readonly provision: ChildWebToolProvision;
+}
+
+let nextRequestId = 0;
+
+/**
+ * Answer child Web tool requests on the parent event bus. The callback must be synchronous
+ * because Pi's event bus does not await listeners. Returns an unsubscribe function.
+ */
+export function provideChildWebTools(
+  events: EventBusLike,
+  resolve: (context: ChildWebToolsRequestContext) => ChildWebToolProvision | undefined,
+): () => void {
+  return events.on(REQUEST_CHANNEL, (data) => {
+    const request = data as Partial<ChildWebToolsRequest> | undefined;
+    if (typeof request?.requestId !== "string" || typeof request.configCwd !== "string") return;
+    const { requestId, configCwd } = request;
+    const provision = resolve({ configCwd });
+    if (!provision || provision.toolNames.length === 0) return;
+    events.emit(RESPONSE_CHANNEL, { requestId, provision } satisfies ChildWebToolsResponse);
+  });
+}
+
+/** Capture the Web tools the containing session currently provides, if any. */
+export function requestChildWebTools(
+  events: EventBusLike,
+  context: ChildWebToolsRequestContext,
+): ChildWebToolProvision | undefined {
+  const requestId = `child-web-${process.pid}-${++nextRequestId}`;
+  let provision: ChildWebToolProvision | undefined;
+  const unsubscribe = events.on(RESPONSE_CHANNEL, (data) => {
+    const response = data as Partial<ChildWebToolsResponse> | undefined;
+    if (response?.requestId === requestId && response.provision) provision = response.provision;
+  });
+  try {
+    events.emit(REQUEST_CHANNEL, { requestId, ...context } satisfies ChildWebToolsRequest);
+  } finally {
+    unsubscribe();
+  }
+  return provision;
+}
+
+/**
+ * Return the Web tools callable in a session under Pi's exposure rules: active `direct`
+ * tools, plus registered `codemode` and `deferred` tools. `model-only` and `hidden`
+ * tools are not callable.
+ */
+export function callableChildWebToolNames(
+  pi: Pick<ExtensionAPI, "getAllTools" | "getActiveTools">,
+): ChildWebToolName[] {
+  const active = new Set(pi.getActiveTools());
+  const exposures = new Map(
+    pi.getAllTools().map((tool) => [tool.name, tool.exposure ?? "direct"] as const),
+  );
+  return CHILD_WEB_TOOL_NAMES.filter((name) => {
+    const exposure = exposures.get(name);
+    if (exposure === "direct") return active.has(name);
+    return exposure === "codemode" || exposure === "deferred";
+  });
+}

package/node_modules/@mrclrchtr/supi-core/src/session.ts

@@ -1,5 +1,16 @@
 // supi-core session domain — session utilities and registries.
 
+export type {
+  ChildWebToolName,
+  ChildWebToolProvision,
+  ChildWebToolsRequestContext,
+} from "./child-web-tools.ts";
+export {
+  CHILD_WEB_TOOL_NAMES,
+  callableChildWebToolNames,
+  provideChildWebTools,
+  requestChildWebTools,
+} from "./child-web-tools.ts";
 export { createRegistry, createSessionStateRegistry } from "./registry-utils.ts";
 export type {
   SessionCapabilitySkill,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrclrchtr/supi-consulting",
-  "version": "11.1.0",
+  "version": "11.3.0",
   "description": "Bounded consultations with explicit agent and workspace selection and observed evidence",
   "license": "MIT",
   "repository": {
@@ -29,6 +29,7 @@
   ],
   "type": "module",
   "files": [
+    "CHANGELOG.md",
     "src/**/*.ts",
     "scripts/live-probe.ts",
     "README.md",
@@ -37,7 +38,7 @@
     "docs/adr/*.md"
   ],
   "dependencies": {
-    "@mrclrchtr/supi-core": "11.1.0"
+    "@mrclrchtr/supi-core": "11.3.0"
   },
   "bundledDependencies": [
     "@mrclrchtr/supi-core"

package/scripts/live-probe.ts

@@ -4,11 +4,20 @@ import { tmpdir } from "node:os";
 import { join, relative } from "node:path";
 import { createAntigravityAdapter } from "../src/agents/antigravity/adapter.ts";
 import { getIsolatedAntigravityPaths } from "../src/agents/antigravity/isolated-home.ts";
-import { isHttpUrl, isSafeWorkspacePath } from "../src/tool/consulting_run/evidence.ts";
+import { runAntigravityConversation } from "../src/agents/antigravity/process/runner.ts";
+import { ANTIGRAVITY_ANSWER_SCHEMA } from "../src/agents/antigravity/structured-output.ts";
+import type { AntigravityExecutionFacts } from "../src/agents/antigravity/types.ts";
+import {
+  classifyAnswerEvidence,
+  isHttpUrl,
+  isSafeWorkspacePath,
+} from "../src/tool/consulting_run/evidence.ts";
+import type { ConsultationExecutionFacts } from "../src/types.ts";
 
 const LIVE_ENVIRONMENT = "SUPI_CONSULTING_LIVE";
 const MODEL = "gemini-3.8-flash-low";
 const CONTEXT_TOKEN = "supi-consulting-context-token";
+const SOURCE_URL = "https://nodejs.org/api/child_process.html";
 
 async function main(): Promise<void> {
   if (process.env[LIVE_ENVIRONMENT] !== "1") {
@@ -21,23 +30,60 @@ async function main(): Promise<void> {
     throw new Error("The selected model is not available to the isolated Antigravity account.");
   }
   const consultationWorkspace = await realpath(paths.consultationWorkspace);
-  const first = await adapter.execute({
-    prompt: `Remember the exact token ${CONTEXT_TOKEN}. Name one current official Node.js documentation page about subprocess cancellation and cite it.`,
+  // The process interface exposes successful tool names without adding them to the
+  // public Consultation contract. Mere web activity or claimed URLs cannot pass.
+  const processOptions = {
+    paths,
     model: MODEL,
-    canonicalWorkingDirectory: consultationWorkspace,
-    workspaceAccess: false,
+    cwd: consultationWorkspace,
+    schema: ANTIGRAVITY_ANSWER_SCHEMA as Record<string, unknown>,
+  };
+  const first = await runAntigravityConversation({
+    ...processOptions,
+    prompt: `Remember the exact token ${CONTEXT_TOKEN}. Use search_web to find official Node.js subprocess cancellation documentation, then use read_url_content to read ${SOURCE_URL}. Explain cancellation briefly and cite that exact fetched URL.`,
   });
-  requireWebEvidence(first);
+  if (!first.successfulToolNames.includes("search_web")) {
+    throw new Error("The live probe did not observe a successful web search.");
+  }
+  requireDirectRead(first, consultationWorkspace);
 
-  const second = await adapter.execute({
-    prompt: `What exact context token did I give you? Answer in one sentence and include ${CONTEXT_TOKEN}.`,
+  // The first run has already removed its temporary profile. Resume only by ID,
+  // proving the CLI retains the reader and finish capability in conversation state.
+  const second = await runAntigravityConversation({
+    ...processOptions,
+    prompt: `Read ${SOURCE_URL} again using read_url_content and cite that exact URL. In the answer field return only the exact context token I gave you in the preceding request.`,
+    conversationId: first.conversationId,
+  });
+  if (second.conversationId !== first.conversationId) {
+    throw new Error("The live probe resumed a different conversation.");
+  }
+  requireDirectRead(second, consultationWorkspace);
+
+  // A tool-free follow-up used to skip finish and replay the previous answer.
+  const toolFree = await adapter.execute({
+    prompt: "Return only the exact context token I gave you earlier. Do not use any tools.",
     model: MODEL,
     canonicalWorkingDirectory: consultationWorkspace,
     workspaceAccess: false,
-    continuation: first.continuation,
+    continuation: (
+      await adapter.execute({
+        prompt: `Remember the exact token ${CONTEXT_TOKEN}. Use read_url_content to read ${SOURCE_URL} and cite it.`,
+        model: MODEL,
+        canonicalWorkingDirectory: consultationWorkspace,
+        workspaceAccess: false,
+      })
+    ).continuation,
   });
-  if (!second.answer.answer.includes(CONTEXT_TOKEN)) {
-    throw new Error("The follow-up did not retain the Conversation Handle context.");
+  if (toolFree.answer.answer.trim() !== CONTEXT_TOKEN) {
+    throw new Error("The tool-free follow-up did not return the current context token.");
+  }
+  if (toolFree.workspaceUsed) {
+    throw new Error("Cached page reads were misreported as workspace use.");
+  }
+  if (second.answer.answer.trim() !== CONTEXT_TOKEN) {
+    throw new Error(
+      "The follow-up did not return the requested current-turn answer from conversation context.",
+    );
   }
 
   const fixture = await realpath(await mkdtemp(join(tmpdir(), "supi-consulting-live-")));
@@ -53,7 +99,7 @@ async function main(): Promise<void> {
       canonicalWorkingDirectory: fixture,
       workspaceAccess: true,
     });
-    requireWebEvidence(workspace);
+    requireWebEvidence(workspace, fixture);
     requireWorkspaceEvidence(workspace, fixture);
     if (!workspace.workspaceUsed) {
       throw new Error("The workspace probe did not observe workspace activity.");
@@ -65,40 +111,42 @@ async function main(): Promise<void> {
   }
 }
 
-function requireWebEvidence(result: { webUsed: boolean; answer: { sources: unknown[] } }): void {
-  if (!result.webUsed || result.answer.sources.length === 0) {
+type EvidenceFacts = Pick<
+  ConsultationExecutionFacts,
+  "answer" | "observedSourceHashes" | "observedWorkspacePathHashes"
+>;
+
+function requireDirectRead(result: AntigravityExecutionFacts, workspace: string): void {
+  if (!result.successfulToolNames.includes("read_url_content")) {
+    throw new Error("The live probe did not observe a successful direct URL read.");
+  }
+  requireWebEvidence(result, workspace);
+  const evidence = classifyAnswerEvidence(result.answer, result, workspace);
+  if (!evidence.observedSources.some((source) => source.url === SOURCE_URL)) {
+    throw new Error("The live probe did not return the fetched URL as observed evidence.");
+  }
+}
+
+function requireWebEvidence(result: EvidenceFacts, workspace: string): void {
+  const evidence = classifyAnswerEvidence(result.answer, result, workspace);
+  if (evidence.observedSources.length === 0) {
     throw new Error("The live probe did not observe web evidence.");
   }
-  if (
-    !result.answer.sources.every(
-      (source) => isRecord(source) && typeof source.url === "string" && isHttpUrl(source.url),
-    )
-  ) {
+  if (!result.answer.sources.every((source) => isHttpUrl(source.url))) {
     throw new Error("The live probe returned an invalid source URL.");
   }
 }
 
-function requireWorkspaceEvidence(
-  result: { answer: { workspaceEvidence: unknown[] } },
-  workspace: string,
-): void {
+function requireWorkspaceEvidence(result: EvidenceFacts, workspace: string): void {
+  const evidence = classifyAnswerEvidence(result.answer, result, workspace);
   if (
-    result.answer.workspaceEvidence.length === 0 ||
-    !result.answer.workspaceEvidence.every(
-      (item) =>
-        isRecord(item) &&
-        typeof item.path === "string" &&
-        isSafeWorkspacePath(item.path, workspace),
-    )
+    evidence.observedWorkspaceEvidence.length === 0 ||
+    !result.answer.workspaceEvidence.every((item) => isSafeWorkspacePath(item.path, workspace))
   ) {
-    throw new Error("The live probe did not return valid workspace evidence.");
+    throw new Error("The live probe did not return observed, valid workspace evidence.");
   }
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 async function digestTree(directory: string): Promise<string> {
   const hash = createHash("sha256");
   await digestDirectory(directory, directory, hash);

package/src/agents/antigravity/adapter.ts

@@ -9,6 +9,7 @@ import type {
 } from "../types.ts";
 import { isWebToolName, isWorkspaceToolName } from "./activity.ts";
 import { discoverAntigravityAvailability } from "./availability.ts";
+import { INSPECTION_AGENT_FINGERPRINT } from "./inspection-agent.ts";
 import {
   getIsolatedAntigravityPaths,
   type IsolatedAntigravityPaths,
@@ -22,7 +23,12 @@ import { ANTIGRAVITY_ANSWER_SCHEMA } from "./structured-output.ts";
 const MAX_RETAINED_REFERENCE_HASHES = 512;
 const MAX_WARNING_COUNT = 24;
 const MAX_WARNING_CHARS = 500;
-const CONTINUATION_PREFIX = "agy1.";
+// A resumed CLI retains its original profile and ignores --agent overrides.
+// Reject pre-profile conversations and changed contracts before any process work.
+const CONTINUATION_PREFIX = `agy2.${INSPECTION_AGENT_FINGERPRINT}.`;
+// Follow-ups saying "do not use any tools" can skip finish; agy then replays the
+// previous turn's structured answer, which the response token rejects. Tested live.
+const FOLLOW_UP_RESPONSE_CONTRACT = "\n\n[Always end with finish using the current schema.]";
 
 type ExecutionPhase = "preparation" | "hook-probe" | "conversation" | "validation";
 
@@ -78,12 +84,12 @@ class AntigravityAdapter implements ConsultingAgentAdapter {
       });
     } catch (error) {
       const failure = safeExecutionFailure(error);
-      const canceled = failure.kind === "cancelled";
+      const outcome = failureOutcome(failure.kind);
       timer.finish(
         () => ({
           source: "consulting",
-          level: canceled ? "info" : "error",
-          category: canceled ? "consultation.cancelled" : "consultation.failed",
+          level: outcome.level,
+          category: outcome.category,
           message: failure.message,
           cwd: options.canonicalWorkingDirectory,
           data: {
@@ -111,18 +117,23 @@ class AntigravityAdapter implements ConsultingAgentAdapter {
       ? decodeContinuation(options.continuation)
       : undefined;
     await prepareIsolatedAntigravityHome(this.#paths);
-    if (options.workspaceAccess) onPhase("hook-probe");
-    const hookWarning = options.workspaceAccess
+    const inspectHooks =
+      options.workspaceAccess || (options.additionalReadOnlyDirectories?.length ?? 0) > 0;
+    if (inspectHooks) onPhase("hook-probe");
+    const hookWarning = inspectHooks
       ? await inspectProjectHooks(this.#paths, options, options.onWarning)
       : undefined;
     onPhase("conversation");
     const rawFacts = await runAntigravityConversation({
       paths: this.#paths,
       cwd: options.canonicalWorkingDirectory,
-      prompt: options.prompt,
+      prompt: expectedConversationId
+        ? `${options.prompt}${FOLLOW_UP_RESPONSE_CONTRACT}`
+        : options.prompt,
       model: options.model,
       ...(expectedConversationId ? { conversationId: expectedConversationId } : {}),
       ...(options.workspaceAccess ? { workspaceDirectory: options.canonicalWorkingDirectory } : {}),
+      additionalReadOnlyDirectories: options.additionalReadOnlyDirectories,
       schema: ANTIGRAVITY_ANSWER_SCHEMA as Record<string, unknown>,
       signal: options.signal,
       onActivity: options.onProgress,
@@ -161,6 +172,7 @@ async function inspectProjectHooks(
   const probe = await probeProjectHooks({
     paths,
     cwd: options.canonicalWorkingDirectory,
+    additionalReadOnlyDirectories: options.additionalReadOnlyDirectories,
     signal: options.signal,
     onProcessStart: options.onProcessStart,
   });
@@ -216,6 +228,19 @@ function decodeContinuation(value: string): string {
   return conversationId;
 }
 
+/**
+ * Cancellations and stale handles are expected outcomes, not execution failures:
+ * an incompatible continuation is rejected before any process starts.
+ */
+function failureOutcome(kind: ConsultingAgentFailureKind): {
+  level: "info" | "error";
+  category: string;
+} {
+  if (kind === "cancelled") return { level: "info", category: "consultation.cancelled" };
+  if (kind === "invalid-continuation") return { level: "info", category: "consultation.rejected" };
+  return { level: "error", category: "consultation.failed" };
+}
+
 /** Keep only fixed reasons and safe facts, including preparation and callback failures. */
 function safeExecutionFailure(error: unknown): ConsultingAgentError {
   if (error instanceof ConsultingAgentError) {

package/src/agents/antigravity/availability.ts

@@ -7,8 +7,8 @@ import { CURATED_MODELS, type CuratedModel, isCuratedModel } from "./models.ts";
 import type { AntigravityProbeResult } from "./process/runner.ts";
 import { AntigravityProcessError, runAntigravityProbe } from "./process/runner.ts";
 
-/** Minimum supported Antigravity CLI version. */
-export const MINIMUM_ANTIGRAVITY_VERSION = Object.freeze({ major: 1, minor: 1, patch: 24 });
+/** Minimum CLI qualified for explicit inspection profiles, finish, and profile-free resumes. */
+export const MINIMUM_ANTIGRAVITY_VERSION = Object.freeze({ major: 1, minor: 4, patch: 9 });
 const MAX_DISCOVERY_OUTPUT_BYTES = 128 * 1024;
 
 /** Parsed Antigravity CLI version. */