@mrclrchtr/supi-consulting 11.1.0 → 11.3.0

package/src/agents/antigravity/inspection-agent.ts

@@ -0,0 +1,53 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+// The generated name is deliberately excluded: it prevents workspace-name collisions,
+// but is not part of the saved conversation's behavior or compatibility contract.
+const DEFINITION = `description: Bounded read-only consultations with observed evidence.
+mainAgent: true
+subagent: false
+tools:
+  - search_web
+  - read_url_content
+  - view_file
+  - list_dir
+  - find_by_name
+  - grep_search
+  - finish
+---
+Provide bounded, read-only consultations using the available inspection tools.
+Do not run commands, modify files, automate browsers, or delegate work.
+For web research, use search_web to discover sources and read_url_content to verify relevant pages before citing them. Report limitations instead of claiming unperformed reads.
+Return workspace evidence as workspace-relative paths; omit references outside the selected workspace.
+Complete each request with finish using the current output schema.
+`;
+
+/** Compatibility marker for the static profile, not an attestation from Antigravity. */
+export const INSPECTION_AGENT_FINGERPRINT = createHash("sha256").update(DEFINITION).digest("hex");
+
+/**
+ * Create an exclusively owned profile for a new conversation. Antigravity retains
+ * its definition in conversation state, so callers remove it after the process ends.
+ * Keep this out of general home preparation: discovery and follow-ups need no profile.
+ */
+export async function createInspectionAgent(
+  homeDir: string,
+): Promise<{ name: string; dispose: () => Promise<void> }> {
+  const parent = join(homeDir, ".gemini", "config", "agents");
+  await mkdir(parent, { recursive: true, mode: 0o700 });
+  const name = `supi-consulting-${randomUUID()}`;
+  const directory = join(parent, name);
+  await mkdir(directory, { mode: 0o700 });
+  const dispose = () => rm(directory, { recursive: true, force: true });
+  try {
+    await writeFile(join(directory, "agent.md"), `---\nname: ${name}\n${DEFINITION}`, {
+      mode: 0o600,
+      flag: "wx",
+    });
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+  return { name, dispose };
+}

package/src/agents/antigravity/isolated-home.ts

@@ -67,13 +67,7 @@ export const INSPECTION_PERMISSION_SET = Object.freeze({
   allowNonWorkspaceAccess: false,
   permissions: Object.freeze({
     allow: Object.freeze(["read_url(*)"]),
-    deny: Object.freeze([
-      "write_file(*)",
-      "command(*)",
-      "unsandboxed(*)",
-      "mcp(*)",
-      "execute_url(*)",
-    ]),
+    deny: Object.freeze(["write_file(*)", "command(*)", "mcp(*)", "execute_url(*)"]),
   }),
 });
 

package/src/agents/antigravity/process/event-values.ts

@@ -171,24 +171,42 @@ export function extractUrl(value: unknown): string | undefined {
   );
 }
 
-export function extractWorkspacePath(value: unknown): string | undefined {
-  return readBoundedField(value, [
-    "path",
-    "file",
-    "file_path",
-    "relative_path",
-    "directory_path",
-    "search_path",
-    "search_directory",
-    "absolute_path",
-    "directory",
-  ]);
+const WORKSPACE_PATH_FIELDS = [
+  "path",
+  "file",
+  "file_path",
+  "relative_path",
+  "directory_path",
+  "search_path",
+  "search_directory",
+  "absolute_path",
+  "directory",
+] as const;
+
+/** Distinguish an omitted path parameter from an explicitly supplied but invalid target. */
+export function structuredWorkspacePath(value: unknown): { value: unknown } | undefined {
+  if (!isRecord(value)) return undefined;
+  for (const name of WORKSPACE_PATH_FIELDS) {
+    for (const [key, field] of Object.entries(value)) {
+      if (normalizeFieldName(key) === normalizeFieldName(name)) return { value: field };
+    }
+  }
+  return undefined;
+}
+
+/** Read a structured path; requested-target diagnostics preserve significant filename whitespace. */
+export function extractWorkspacePath(
+  value: unknown,
+  options: { preserveWhitespace?: boolean } = {},
+): string | undefined {
+  return readBoundedField(value, WORKSPACE_PATH_FIELDS, () => true, options.preserveWhitespace);
 }
 
 function readBoundedField(
   value: unknown,
   names: readonly string[],
   predicate: (candidate: string) => boolean = () => true,
+  preserveWhitespace = false,
 ): string | undefined {
   if (!isRecord(value)) return undefined;
   const fields = Object.entries(value);
@@ -196,13 +214,20 @@ function readBoundedField(
     const normalizedName = normalizeFieldName(name);
     for (const [key, field] of fields) {
       if (normalizeFieldName(key) !== normalizedName) continue;
-      const candidate = safeString(field, 4_096);
+      const candidate = boundedFieldText(field, preserveWhitespace);
       if (candidate && predicate(candidate)) return candidate;
     }
   }
   return undefined;
 }
 
+function boundedFieldText(value: unknown, preserveWhitespace: boolean): string | undefined {
+  if (preserveWhitespace && typeof value === "string") {
+    return value.length > 0 && value.length <= 4_096 ? value : undefined;
+  }
+  return safeString(value, 4_096);
+}
+
 function normalizeFieldName(value: string): string {
   return value.toLowerCase().replace(/[-_]/g, "");
 }
@@ -246,6 +271,7 @@ function selectAnswerFields(value: Record<string, unknown>): Record<string, unkn
     answer: value.answer,
     sources: value.sources,
     workspaceEvidence: value.workspaceEvidence,
+    ...(Object.hasOwn(value, "responseToken") ? { responseToken: value.responseToken } : {}),
   };
 }
 

package/src/agents/antigravity/process/events.ts

@@ -1,6 +1,7 @@
 import { isAbsolute, normalize as normalizePath, relative } from "node:path";
 import { hashEvidence } from "../../../evidence-hash.ts";
 import type { ConsultationUsage } from "../../../types.ts";
+import type { ConsultingDeniedOperation, ConsultingFailureDiagnostics } from "../../errors.ts";
 import { isWebToolName, isWorkspaceToolName } from "../activity.ts";
 import { validateAntigravityAnswer } from "../structured-output.ts";
 import type { AntigravityExecutionFacts } from "../types.ts";
@@ -13,20 +14,34 @@ import {
   extractUrl,
   extractWorkspacePath,
   isErrorStatus,
-  isRecord,
-  isSuccessStatus,
   isTerminalEvent,
   isToolResultEvent,
   isToolStartEvent,
-  safeString,
   toolInput,
   toolName,
 } from "./event-values.ts";
-import { normalizeProtocolEvent } from "./protocol.ts";
+import {
+  classifyDeniedOperation,
+  classifyToolResult,
+  type DiagnosticReadScope,
+  FileResources,
+  type FileTargetObservation,
+  fileTargetUpdate,
+  isAgentInternalFileActivity,
+  isPermissionDenial,
+  terminalDeniedOperations,
+} from "./permission-diagnostics.ts";
+import {
+  hasExplicitSuccess,
+  isNonToolStepUpdate,
+  isSuccessfulActivity,
+  nestedToolEvents,
+  normalizeProtocolEvent,
+} from "./protocol.ts";
 import { AntigravityResponseError } from "./response-error.ts";
 import { mergeUsage, readUsage } from "./usage.ts";
 
-interface PendingTool {
+interface PendingTool extends FileTargetObservation {
   name: string;
   urlHash?: string;
   pathHash?: string;
@@ -34,19 +49,16 @@ interface PendingTool {
   denied?: boolean;
 }
 
-interface ToolResultClassification {
-  kind: "pending" | "failure" | "success";
-  denied: boolean;
-}
-
 const MAX_COMPLETED_TOOL_IDS = 4_096;
 
 /**
  * Reduces parsed events to bounded execution facts. Raw events and tool payloads
- * are not retained after each event is processed.
+ * are not retained; only bounded structured requested file targets survive pending calls.
  */
 export class AntigravityEventAccumulator {
   readonly #workspaceDirectory: string | undefined;
+  readonly #readScope: DiagnosticReadScope;
+  readonly #expectedResponseToken: string | undefined;
   #pendingTools = new Map<string, PendingTool>();
   #completedToolIds = new Set<string>();
   #conversationId: string | undefined;
@@ -58,12 +70,17 @@ export class AntigravityEventAccumulator {
   #toolCounts = new Map<string, number>();
   #successfulToolNames = new Set<string>();
   #permissionDenials = 0;
+  #permissionDenialsByOperation: Partial<Record<ConsultingDeniedOperation, number>> = {};
+  #deniedFileAccessOutsideReadRoots = 0;
+  #deniedFileResources = new FileResources();
   #unattributedPermissionDenialSeen = false;
   #sourceHashes = new Set<string>();
   #workspacePathHashes = new Set<string>();
 
-  constructor(options: { workspaceDirectory?: string } = {}) {
+  constructor(options: DiagnosticReadScope & { expectedResponseToken?: string } = {}) {
     this.#workspaceDirectory = options.workspaceDirectory;
+    this.#readScope = options;
+    this.#expectedResponseToken = options.expectedResponseToken;
   }
 
   /** Consume one already-parsed event. */
@@ -74,8 +91,9 @@ export class AntigravityEventAccumulator {
       conversationId(event) ?? conversationId(normalizedEvent) ?? this.#conversationId;
     this.#usage = mergeUsage(this.#usage, mergeUsage(readUsage(event), readUsage(normalizedEvent)));
     const terminal = isTerminalEvent(normalizedEvent);
-    const nestedTools = consumeNestedToolBlocks(this, normalizedEvent);
-    if (nestedTools && !terminal) return;
+    const nestedTools = nestedToolEvents(normalizedEvent);
+    for (const toolEvent of nestedTools) this.consume(toolEvent);
+    if (nestedTools.length && !terminal) return;
 
     if (isToolStartEvent(normalizedEvent)) {
       this.#rememberToolStart(normalizedEvent);
@@ -90,27 +108,28 @@ export class AntigravityEventAccumulator {
       return;
     }
 
-    const directName = toolName(normalizedEvent);
-    if (directName && isSuccessfulActivity(normalizedEvent)) {
-      this.#recordSuccessfulTool(directName, normalizedEvent);
-    }
-    const denied = isPermissionDenial(normalizedEvent);
-    if (denied && !isNonToolStepUpdate(normalizedEvent)) {
-      const counted = directName
-        ? this.#recordPermissionDenial(directName, normalizedEvent)
-        : this.#recordUnattributedPermissionDenial();
-      if (counted) this.#permissionDenials += 1;
-    }
+    this.#consumeActivity(normalizedEvent);
   }
 
   /** Return safe execution facts even when the response is incomplete. */
-  get diagnostics(): {
-    permissionDenials: number;
-    terminalSeen: boolean;
-    terminalSucceeded: boolean;
-  } {
+  get diagnostics(): ConsultingFailureDiagnostics {
+    const denied = this.#deniedFileResources.snapshot;
+    const unfinished = new FileResources();
+    for (const pending of this.#pendingTools.values()) {
+      if (!pending.denied)
+        unfinished.record(classifyDeniedOperation(pending.name), pending.requestedResource);
+    }
+    const pending = unfinished.snapshot;
     return {
       permissionDenials: this.#permissionDenials,
+      permissionDenialsByOperation: { ...this.#permissionDenialsByOperation },
+      deniedFileAccessOutsideReadRoots: this.#deniedFileAccessOutsideReadRoots,
+      deniedResources: denied.resources,
+      deniedResourcesOmitted: denied.omitted,
+      deniedResourcePathsUnavailable: denied.unavailable,
+      unfinishedResources: pending.resources,
+      unfinishedResourcesOmitted: pending.omitted,
+      unfinishedResourcePathsUnavailable: pending.unavailable,
       terminalSeen: this.#terminalSeen,
       terminalSucceeded: this.#terminalSucceeded,
     };
@@ -122,8 +141,16 @@ export class AntigravityEventAccumulator {
     if (!this.#terminalSucceeded) throw new AntigravityResponseError("terminal-failed");
     if (!this.#candidate) throw new AntigravityResponseError("missing-answer");
     if (!this.#conversationId) throw new AntigravityResponseError("missing-conversation");
+    const { responseToken, ...candidate } = this.#candidate;
+    const answer = validateAntigravityAnswer(candidate);
+    if (
+      this.#expectedResponseToken !== undefined &&
+      responseToken !== this.#expectedResponseToken
+    ) {
+      throw new AntigravityResponseError("unbound-answer");
+    }
     return {
-      answer: validateAntigravityAnswer(this.#candidate),
+      answer,
       conversationId: this.#conversationId,
       ...(this.#usage ? { usage: this.#usage } : {}),
       observedToolNames: [...this.#toolNames],
@@ -135,6 +162,44 @@ export class AntigravityEventAccumulator {
     };
   }
 
+  #consumeActivity(event: Record<string, unknown>): void {
+    if (isNonToolStepUpdate(event)) return;
+    const id = eventId(event);
+    if (id && this.#completedToolIds.has(id)) return;
+    let pending = this.#pendingTools.get(id ?? "");
+    const name = toolName(event) ?? pending?.name;
+    if (name && eventType(event) === "step_update") {
+      pending = this.#recordPendingToolResult(id, name, event, pending);
+    }
+    if (isPermissionDenial(event)) {
+      this.#observeDeniedActivity(name, event, pending);
+    } else if (name) {
+      this.#observeExplicitOutcome(name, event, pending);
+    }
+  }
+
+  #observeDeniedActivity(
+    name: string | undefined,
+    event: Record<string, unknown>,
+    pending?: PendingTool,
+  ): void {
+    const counted = name
+      ? this.#recordPermissionDenial(name, event, pending)
+      : this.#recordUnattributedPermissionDenial();
+    if (counted) this.#countPermissionDenial(name, event, pending);
+    if (isErrorStatus(eventStatus(event))) this.#completeToolResult(eventId(event));
+  }
+
+  #observeExplicitOutcome(
+    name: string,
+    event: Record<string, unknown>,
+    pending?: PendingTool,
+  ): void {
+    const successful = isSuccessfulActivity(event);
+    if (successful) this.#recordSuccessfulTool(name, event, pending);
+    if (successful || isErrorStatus(eventStatus(event))) this.#completeToolResult(eventId(event));
+  }
+
   #rememberToolStart(event: Record<string, unknown>): void {
     const name = toolName(event);
     if (!name) return;
@@ -152,14 +217,15 @@ export class AntigravityEventAccumulator {
         observed: true,
         ...(urlHash ? { urlHash } : {}),
         ...(pathHash ? { pathHash } : {}),
+        ...fileTargetUpdate(name, event, this.#readScope, previous),
         ...(denied ? { denied: true } : {}),
       },
       previous,
     );
     if (!previous) this.#recordObservedTool(name);
     if (id) this.#pendingTools.set(id, pending);
-    if (isSuccessfulActivity(event)) this.#recordSuccessfulTool(name, event, pending);
-    if (denied && !previous?.denied) this.#permissionDenials += 1;
+    if (denied && !previous?.denied) this.#countPermissionDenial(name, event, pending);
+    if (!denied) this.#observeExplicitOutcome(name, event, pending);
   }
 
   #consumeToolResult(event: Record<string, unknown>): void {
@@ -171,12 +237,14 @@ export class AntigravityEventAccumulator {
     if (!name) return;
     const classification = classifyToolResult(event);
     if (classification.kind === "pending") {
-      this.#recordPendingToolResult(id, name, pending);
+      this.#recordPendingToolResult(id, name, event, pending);
       return;
     }
     if (id) this.#completeToolResult(id);
     if (classification.kind === "failure") {
-      this.#recordFailedToolResult(name, pending, classification.denied);
+      if (classification.denied && !pending?.denied)
+        this.#countPermissionDenial(name, event, pending);
+      if (!pending?.observed) this.#recordObservedTool(name);
       return;
     }
     this.#recordSuccessfulTool(name, event, pending);
@@ -185,20 +253,41 @@ export class AntigravityEventAccumulator {
   #recordPendingToolResult(
     id: string | undefined,
     name: string,
+    event: Record<string, unknown>,
     pending: PendingTool | undefined,
-  ): void {
+  ): PendingTool {
     if (!pending?.observed) this.#recordObservedTool(name);
-    if (id && !pending) this.#pendingTools.set(id, { name, observed: true });
+    const updated = {
+      ...pending,
+      name,
+      observed: true,
+      ...fileTargetUpdate(name, event, this.#readScope, pending),
+    };
+    if (id) this.#pendingTools.set(id, updated);
+    return updated;
   }
 
-  #completeToolResult(id: string): void {
+  #completeToolResult(id: string | undefined): void {
+    if (!id) return;
     this.#pendingTools.delete(id);
     this.#rememberCompletedToolId(id);
   }
 
-  #recordFailedToolResult(name: string, pending: PendingTool | undefined, denied: boolean): void {
-    if (denied && !pending?.denied) this.#permissionDenials += 1;
-    if (!pending?.observed) this.#recordObservedTool(name);
+  #countPermissionDenial(
+    name: string | undefined,
+    event: Record<string, unknown>,
+    pending?: PendingTool,
+  ): void {
+    this.#permissionDenials += 1;
+    const operation = classifyDeniedOperation(name);
+    this.#permissionDenialsByOperation[operation] =
+      (this.#permissionDenialsByOperation[operation] ?? 0) + 1;
+    const started = pending ?? this.#pendingTools.get(eventId(event) ?? "");
+    const target = fileTargetUpdate(name, event, this.#readScope, started);
+    this.#deniedFileResources.record(operation, target.requestedResource);
+    if (target.outsideReadRoots) {
+      this.#deniedFileAccessOutsideReadRoots += 1;
+    }
   }
 
   #rememberCompletedToolId(id: string): void {
@@ -219,10 +308,14 @@ export class AntigravityEventAccumulator {
     return true;
   }
 
-  #recordPermissionDenial(name: string, event: Record<string, unknown>): boolean {
+  #recordPermissionDenial(
+    name: string,
+    event: Record<string, unknown>,
+    observation?: PendingTool,
+  ): boolean {
     const id = eventId(event);
     if (id && this.#completedToolIds.has(id)) return false;
-    const pending = id ? this.#pendingTools.get(id) : undefined;
+    const pending = observation ?? (id ? this.#pendingTools.get(id) : undefined);
     if (pending?.denied) return false;
     if (!pending?.observed) this.#recordObservedTool(name);
     if (id) {
@@ -234,6 +327,7 @@ export class AntigravityEventAccumulator {
 
   #recordSuccessfulTool(name: string, event: Record<string, unknown>, pending?: PendingTool): void {
     if (!pending?.observed) this.#recordObservedTool(name);
+    if (isAgentInternalFileActivity(name, event, this.#readScope, pending)) return;
     this.#successfulToolNames.add(name);
     const input = toolInput(event) ?? event;
     const sourceHash = pending?.urlHash ?? hashValue(extractUrl(input));
@@ -261,8 +355,27 @@ export class AntigravityEventAccumulator {
     return normalizeWorkspacePath(normalized);
   }
 
+  /** Terminal summaries prove an operation was denied, but supply no call IDs or targets. */
+  #consumeTerminalDenials(event: Record<string, unknown>): void {
+    const operations = terminalDeniedOperations(event);
+    // The generic notice may describe the same denial as the terminal summary.
+    // Keep a conservative lower bound without attributing it to a particular call.
+    if (operations.size && this.#unattributedPermissionDenialSeen) {
+      this.#permissionDenials -= 1;
+      const other = (this.#permissionDenialsByOperation.other ?? 1) - 1;
+      if (other) this.#permissionDenialsByOperation.other = other;
+      else delete this.#permissionDenialsByOperation.other;
+    }
+    for (const [operation, name] of operations) {
+      if (!this.#permissionDenialsByOperation[operation]) {
+        this.#countPermissionDenial(name, {});
+      }
+    }
+  }
+
   #consumeTerminal(event: Record<string, unknown>): void {
     this.#terminalSeen = true;
+    this.#consumeTerminalDenials(event);
     const status = eventStatus(event);
     if (isErrorStatus(status) || !hasExplicitSuccess(event, status)) {
       throw new AntigravityResponseError("terminal-failed");
@@ -273,94 +386,6 @@ export class AntigravityEventAccumulator {
   }
 }
 
-function consumeNestedToolBlocks(
-  accumulator: AntigravityEventAccumulator,
-  event: Record<string, unknown>,
-): boolean {
-  const message = isRecord(event.message) ? event.message : undefined;
-  const content = message?.content;
-  if (!Array.isArray(content)) return false;
-  let consumed = false;
-  for (const block of content) {
-    if (!isRecord(block)) continue;
-    const normalizedBlock = normalizeProtocolEvent(block);
-    if (!isToolActivityBlock(normalizedBlock)) continue;
-    accumulator.consume(normalizedBlock);
-    consumed = true;
-  }
-  return consumed;
-}
-
-function isToolActivityBlock(event: Record<string, unknown>): boolean {
-  if (isToolStartEvent(event) || isToolResultEvent(event)) return true;
-  return eventType(event) === "step_update" && !isNonToolStepUpdate(event);
-}
-
-function hasExplicitSuccess(event: Record<string, unknown>, status: string | undefined): boolean {
-  return status !== undefined
-    ? isSuccessStatus(status)
-    : event.is_error === false || event.isError === false || event.success === true;
-}
-
-function isSuccessfulActivity(event: Record<string, unknown>): boolean {
-  const status = eventStatus(event);
-  return (
-    !isErrorStatus(status) &&
-    isSuccessStatus(status) &&
-    (status !== undefined || event.success === true || event.ok === true)
-  );
-}
-
-function isNonToolStepUpdate(event: Record<string, unknown>): boolean {
-  const type = eventType(event);
-  if (!["assistant", "step_update"].includes(type)) return false;
-  const declaredType = safeString(event.step_type ?? event.stepType, 40)?.toLowerCase();
-  if (declaredType) return declaredType !== "tool";
-  return toolName(event) === undefined && !isRecord(event.tool_info) && !isRecord(event.toolInfo);
-}
-
-function classifyToolResult(event: Record<string, unknown>): ToolResultClassification {
-  const status = eventStatus(event);
-  const denied = isPermissionDenial(event);
-  if (denied || isErrorStatus(status)) return { kind: "failure", denied };
-  return { kind: isSuccessStatus(status) ? "success" : "pending", denied };
-}
-
-function isPermissionDenial(event: Record<string, unknown>): boolean {
-  const status = eventStatus(event);
-  if (["denied", "permission_denied", "forbidden", "blocked"].includes(status ?? "")) return true;
-  const type = eventType(event);
-  if (type.includes("permission") || type.includes("denied") || type.includes("blocked"))
-    return true;
-  const hasExplicitFailure =
-    event.is_error === true ||
-    event.isError === true ||
-    isErrorStatus(status) ||
-    event.error !== undefined ||
-    event.reason !== undefined;
-  if (!hasExplicitFailure) return false;
-  const message = [event.error, event.reason, event.message, event.content]
-    .map((value) => safeDenialText(value))
-    .join(" ")
-    .toLowerCase();
-  return message.includes("permission") || message.includes("denied");
-}
-
-function safeDenialText(value: unknown, depth = 0): string {
-  if (depth > 3) return "";
-  if (typeof value === "string") return value.slice(0, 4_000);
-  if (Array.isArray(value)) {
-    return value
-      .slice(0, 20)
-      .map((item) => safeDenialText(item, depth + 1))
-      .join(" ");
-  }
-  if (!isRecord(value)) return "";
-  return ["text", "message", "content", "error", "reason"]
-    .map((key) => safeDenialText(value[key], depth + 1))
-    .join(" ");
-}
-
 function mergePendingTool(current: PendingTool, previous: PendingTool | undefined): PendingTool {
   if (previous?.urlHash && !current.urlHash) current.urlHash = previous.urlHash;
   if (previous?.pathHash && !current.pathHash) current.pathHash = previous.pathHash;

package/src/agents/antigravity/process/hooks.ts

@@ -14,6 +14,8 @@ export interface ProjectHookProbeResult {
 export async function probeProjectHooks(options: {
   paths: IsolatedAntigravityPaths;
   cwd: string;
+  /** Match the paid process's inspection roots when checking project hook state. */
+  additionalReadOnlyDirectories?: readonly string[];
   signal?: AbortSignal;
   onProcessStart?: () => void;
 }): Promise<ProjectHookProbeResult> {
@@ -21,7 +23,13 @@ export async function probeProjectHooks(options: {
     const result = await runAntigravityProbe({
       paths: options.paths,
       cwd: options.cwd,
-      args: [...PROJECT_HOOK_PROBE_ARGUMENTS],
+      args: [
+        ...PROJECT_HOOK_PROBE_ARGUMENTS,
+        ...(options.additionalReadOnlyDirectories ?? []).flatMap((directory) => [
+          "--add-dir",
+          directory,
+        ]),
+      ],
       signal: options.signal,
       timeoutMs: 15_000,
       onProcessStart: options.onProcessStart,