agy-mcp-bridge 0.1.20 → 0.1.21

package/config/workspaces.example.json

@@ -13,5 +13,9 @@
   "agents": {
     "priority": ["antigravity", "codex"],
     "enabled": ["antigravity", "codex"]
+  },
+  "tree_watch": {
+    "enabled": true,
+    "delays_ms": [500, 1000, 2000, 4000, 10000]
   }
 }

package/dist/src/agents/antigravity.js

@@ -58,6 +58,6 @@ export function legacyAntigravityAgent(runtime, transport) {
         version: null, executable: runtime.executable || null, capabilities: CAPABILITIES,
         warnings: runtime.supported ? [] : ['Requires agy 1.4.x and all required print/output/timeout flags']
     };
-    return { adapter: antigravityAdapter(runtime.executable, transport), status, enabled: true, launch: runtime.launch };
+    return { adapter: antigravityAdapter(runtime.executable, transport), status, enabled: true, prefixArgs: runtime.prefixArgs, launch: runtime.launch };
 }
 //# sourceMappingURL=antigravity.js.map

package/dist/src/agents/registry.js

@@ -23,7 +23,7 @@ export async function createAgentRegistry(config, antigravity) {
     };
     agents.push({
         adapter: antigravityAdapter(antigravity.executable, config.prompt_transport),
-        status: antigravityStatus, enabled: antigravityEnabled
+        status: antigravityStatus, enabled: antigravityEnabled, prefixArgs: antigravity.prefixArgs
     });
     const codexEnabled = enabled.includes('codex');
     let codexStatus = {

package/dist/src/antigravity/process.js

@@ -129,9 +129,11 @@ async function terminate(child) {
         }
     }
 }
-export async function inspectCli(executable, cwd, run = startProcess, requireStdin = false) {
+/** Probes a resolved command. The whole command goes in, not just its executable: a Windows shim runs as
+ * `node <script>` and asking `node --version` would report Node's version instead of the CLI's. */
+export async function inspectCli(command, cwd, run = startProcess, requireStdin = false) {
     const capture = (args) => new Promise((resolve, reject) => {
-        const child = run(executable, args, cwd);
+        const child = run(command.executable, [...command.prefixArgs, ...args], cwd);
         let text = '';
         let exceeded = false;
         const timer = setTimeout(() => { exceeded = true; void terminateOwned(child).catch(reject); }, 10000);
@@ -150,6 +152,6 @@ export async function inspectCli(executable, cwd, run = startProcess, requireStd
         ['--print', '--output-format', '--print-timeout', '--disable-slash-commands', ...(requireStdin ? ['--input-format'] : [])].every(flag => new RegExp(`(?:^|\\s)${flag}(?=\\s|$)`).test(help.text));
     const verified = VERIFIED_AGY_VERSIONS.includes(actual);
     const warnings = supported && !verified ? [`agy ${actual} is compatible by 1.4.x version/help checks, but only ${VERIFIED_AGY_VERSIONS.join(' and ')} have been verified with real agent execution`] : [];
-    return { version: actual, supported, executable, warnings };
+    return { version: actual, supported, executable: command.executable, prefixArgs: command.prefixArgs, warnings };
 }
 //# sourceMappingURL=process.js.map

package/dist/src/config.js

@@ -19,6 +19,15 @@ const schema = z.object({
     max_parallel_worktrees: z.number().int().min(1).max(8).optional(),
     default_autonomy: z.enum(['suggest', 'auto', 'full']).optional(),
     agents: agentsSchema.optional(),
+    /**
+     * The process-tree watcher that runs while a task is live. One poll costs a full process-table query (about half a
+     * second on the reference machine), so the cadence is owner-tunable and the whole watch can be turned off; without
+     * it, a subtree whose intermediate shell exited before the agent did becomes invisible to the release.
+     */
+    tree_watch: z.object({
+        enabled: z.boolean().optional(),
+        delays_ms: z.array(z.number().int().min(100).max(60000)).min(1).max(20).optional()
+    }).strict().optional(),
     extra_env_passthrough: z.array(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/)).max(100).default([]),
     prompt_transport: z.enum(['stdin', 'argv']).default('argv'),
     /** Longest single antigravity_task_wait call (default 55). Keep it below the MCP client's tool timeout. */

package/dist/src/isolation/orphans.js

@@ -65,6 +65,18 @@ function parseTable(text) {
 export async function listProcesses() {
     return parseTable(await powershell(tableQuery()));
 }
+/**
+ * The same rows, but only for the pids about to be killed. Every id is validated first because it is spliced into a
+ * WQL filter string.
+ */
+export async function listProcessesById(pids) {
+    if (!pids.length)
+        return [];
+    if (!pids.every(pid => Number.isInteger(pid) && pid > 1))
+        throw new Error('A process id to verify must be a positive integer');
+    const filter = pids.map(pid => `ProcessId=${pid}`).join(' OR ');
+    return parseTable(await powershell(tableQuery().replace('Win32_Process -Property', `Win32_Process -Filter '${filter}' -Property`)));
+}
 /** Every row below `root`, nearest first, without the root itself. */
 export function descendants(table, root) {
     const childrenOf = new Map();
@@ -126,9 +138,14 @@ export function startTreeWatch(pid, options = {}) {
     };
     wait(0);
     return {
-        stop() {
+        async stop() {
             stopped = true;
             cancel?.();
+            try {
+                for (const info of descendants(await list(), pid))
+                    observed.set(info.pid, info);
+            }
+            catch { /* the release still has everything the polls recorded */ }
             return [...observed.values()];
         }
     };
@@ -220,7 +237,26 @@ export async function reapOwnedTree(pid, options) {
     const reaped = [];
     const skipped = [];
     const kill = options.kill ?? killTree;
-    for (const child of tops) {
+    // Enumeration and termination are not one atomic act: every kill is awaited, so a pid can be reissued while the
+    // loop runs. Re-reading just the targets costs one filtered query instead of a second full table.
+    let targets = tops;
+    if (tops.length) {
+        try {
+            const fresh = new Map((await (options.verify ?? listProcessesById)(tops.map(row => row.pid))).map(row => [row.pid, row]));
+            targets = [];
+            for (const candidate of tops) {
+                const now = fresh.get(candidate.pid);
+                if (!now)
+                    continue;
+                if (recycled(candidate, now))
+                    skipped.push({ pid: candidate.pid, name: candidate.name, guard: 'pid was reissued to another process after the tree query' });
+                else
+                    targets.push(now);
+            }
+        }
+        catch { /* the second read is an extra guard; the checks already made against the tree query still stand */ }
+    }
+    for (const child of targets) {
         const info = observed.get(child.pid);
         if (info && recycled(info, child)) {
             skipped.push({ pid: child.pid, name: child.name, guard: 'pid was recycled for an unrelated process after the task ended' });

package/dist/src/isolation/worktree.js

@@ -88,6 +88,7 @@ const exists = async (target) => {
 };
 const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 const TASK_ID = /^[0-9a-f]{8}-[0-9a-f-]+$/;
+const TASK_RECORD = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json$/;
 /**
  * Drops worktree directories that a previous run could not remove because a process the bridge no longer owned
  * was holding them open. Only genuinely empty directories go: anything with content is a diff someone may still
@@ -95,7 +96,7 @@ const TASK_ID = /^[0-9a-f]{8}-[0-9a-f-]+$/;
  */
 export async function sweepStaleWorktrees(stateDirectory, options = {}) {
     const directory = path.join(stateDirectory, 'worktrees');
-    const report = { scanned: 0, removed: [], retained: [] };
+    const report = { scanned: 0, removed: [], retained: [], prunable: [] };
     let names;
     try {
         names = await readdir(directory);
@@ -103,16 +104,30 @@ export async function sweepStaleWorktrees(stateDirectory, options = {}) {
     catch {
         return report;
     }
-    const readStatus = options.readStatus ?? (async (taskId) => {
+    const readRecord = options.readRecord ?? (async (taskId) => {
         try {
             const parsed = JSON.parse(await readFile(path.join(stateDirectory, 'tasks', `${taskId}.json`), 'utf8'));
-            return parsed.task?.status ?? parsed.status ?? null;
+            return { status: parsed.task?.status ?? parsed.status ?? null, repo: parsed.task?.worktree_toplevel ?? null, worktree: parsed.task?.worktree ?? null };
         }
         catch {
-            return null;
+            return { status: null, repo: null, worktree: null };
         }
     });
-    const remove = options.remove ?? ((target) => rmdir(target));
+    const queuePrune = (repo) => { if (!report.prunable.includes(repo))
+        report.prunable.push(repo); };
+    // Removing through git also drops the admin record under <repo>/.git/worktrees, which a plain rmdir leaves behind as
+    // a stale entry that then makes every later `git worktree` command in that repository complain.
+    const remove = options.remove ?? (async (target, repo) => {
+        if (repo) {
+            try {
+                await git(repo, ['worktree', 'remove', '--force', target]);
+                return 'git';
+            }
+            catch { /* the directory may be gone already */ }
+        }
+        await rmdir(target);
+        return 'rmdir';
+    });
     for (const name of names) {
         const candidate = path.join(directory, name);
         report.scanned += 1;
@@ -120,16 +135,16 @@ export async function sweepStaleWorktrees(stateDirectory, options = {}) {
             report.retained.push({ path: candidate, reason: 'not a task worktree directory' });
             continue;
         }
-        let status;
+        let record;
         try {
-            status = await readStatus(name);
+            record = await readRecord(name);
         }
         catch {
             report.retained.push({ path: candidate, reason: 'its task record could not be read' });
             continue;
         }
-        if (status === 'queued' || status === 'running') {
-            report.retained.push({ path: candidate, reason: `task is ${status}` });
+        if (record.status === 'queued' || record.status === 'running') {
+            report.retained.push({ path: candidate, reason: `task is ${record.status}` });
             continue;
         }
         let entries;
@@ -137,6 +152,12 @@ export async function sweepStaleWorktrees(stateDirectory, options = {}) {
             entries = await readdir(candidate);
         }
         catch (error) {
+            // The directory is already gone — deleted without git, which is exactly what leaves a stale admin record behind.
+            if (error.code === 'ENOENT') {
+                if (record.repo)
+                    queuePrune(record.repo);
+                continue;
+            }
             report.retained.push({ path: candidate, reason: error instanceof Error ? error.message : 'directory could not be read' });
             continue;
         }
@@ -145,11 +166,12 @@ export async function sweepStaleWorktrees(stateDirectory, options = {}) {
             continue;
         }
         let reason = '';
+        let how = 'rmdir';
         for (const delay of options.retryDelayMs ?? [0, 200, 600]) {
             if (delay)
                 await sleep(delay);
             try {
-                await remove(candidate);
+                how = await remove(candidate, record.repo);
                 reason = '';
                 break;
             }
@@ -159,11 +181,72 @@ export async function sweepStaleWorktrees(stateDirectory, options = {}) {
         }
         if (reason)
             report.retained.push({ path: candidate, reason });
-        else
+        else {
             report.removed.push(candidate);
+            // A git removal took the admin record with it; anything else that cleared the directory left the record behind.
+            if (how === 'rmdir' && record.repo)
+                queuePrune(record.repo);
+        }
+    }
+    // A directory deleted by hand never shows up in the listing above, so the task records are read as well: a finished
+    // task naming a worktree that is no longer on disk is the other way a repository ends up holding a dead entry.
+    let records;
+    try {
+        records = await readdir(path.join(stateDirectory, 'tasks'));
+    }
+    catch {
+        return report;
+    }
+    for (const file of records) {
+        if (!TASK_RECORD.test(file))
+            continue;
+        let record;
+        try {
+            record = await readRecord(file.slice(0, -'.json'.length));
+        }
+        catch {
+            continue;
+        }
+        if (record.status === 'queued' || record.status === 'running')
+            continue;
+        if (!record.repo || !record.worktree || await exists(record.worktree))
+            continue;
+        queuePrune(record.repo);
     }
     return report;
 }
+/** Worktree paths the repository still has a record for, including the ones whose directory is already gone. */
+async function listedWorktrees(repo) {
+    const text = await git(repo, ['worktree', 'list', '--porcelain']);
+    return text.split('\n').filter(line => line.startsWith('worktree ')).map(line => line.slice('worktree '.length).trim()).filter(Boolean);
+}
+/**
+ * Clears the `<repo>/.git/worktrees/<name>` entries left behind when a worktree directory went away without git.
+ * Git only prunes records whose directory is already missing, so this is called for the repositories whose
+ * directories the sweep itself deleted — a worktree someone is still using is never in scope. `--expire=now` is
+ * required because the default grace is three months, which would leave a record the bridge just orphaned in place.
+ * Any other missing-directory record in that repository goes with it; that costs an admin entry, not files, and a
+ * checkout that is merely unmounted is restored with `git worktree repair`.
+ */
+export async function pruneWorktrees(repo) {
+    try {
+        const missing = [];
+        for (const target of await listedWorktrees(repo)) {
+            if (!await exists(target))
+                missing.push(target);
+        }
+        if (!missing.length)
+            return { pruned: 0, reason: '' };
+        // The count comes from the record list, not from what `prune -v` prints: that goes to stderr, and a report of
+        // "0 pruned" after a record was in fact cleared would be the worse kind of wrong.
+        await git(repo, ['worktree', 'prune', '-v', '--expire=now']);
+        const remaining = new Set(await listedWorktrees(repo));
+        return { pruned: missing.filter(target => !remaining.has(target)).length, reason: '' };
+    }
+    catch (error) {
+        return { pruned: 0, reason: error instanceof Error ? error.message : 'git worktree prune failed' };
+    }
+}
 function normalizeOwn(own) {
     return path.posix.normalize(own.replace(/\\/g, '/')).replace(/^\.\//, '').replace(/\/+$/, '');
 }

package/dist/src/models.js

@@ -21,9 +21,9 @@ export function parseModels(text) {
     return models;
 }
 /** Runs `agy models`; rejects when the command fails, times out or prints nothing recognizable. */
-export function listModels(executable, cwd, extraEnvPassthrough = []) {
+export function listModels(executable, cwd, extraEnvPassthrough = [], prefixArgs = []) {
     return new Promise((resolve, reject) => {
-        const child = startProcess(executable, ['models'], cwd, { extraEnvPassthrough });
+        const child = startProcess(executable, [...prefixArgs, 'models'], cwd, { extraEnvPassthrough });
         let text = '';
         let errors = '';
         let timedOut = false;

package/dist/src/runtime.js

@@ -3,16 +3,16 @@ import { helperDirectory, paths } from './paths.js';
 import { inspectCli, resolveCommand, startProcess, VERIFIED_AGY_VERSIONS } from './antigravity/process.js';
 import { createAgentRegistry, publicAgents } from './agents/registry.js';
 import { TaskManager } from './tasks/manager.js';
-import { sweepStaleWorktrees } from './isolation/worktree.js';
+import { sweepStaleWorktrees, pruneWorktrees } from './isolation/worktree.js';
 import { startTreeWatch } from './isolation/orphans.js';
 import { recoverExecutionLock } from './tasks/execution-lock.js';
 export async function createRuntime() {
     const config = await loadConfig();
-    let cli = { version: 'unavailable', executable: '', supported: false, warnings: [] };
+    let cli = { version: 'unavailable', executable: '', prefixArgs: [], supported: false, warnings: [] };
     let antigravity = { version: 'unavailable', executable: '', supported: false, warnings: [] };
     try {
         const command = await resolveCommand(config.executable);
-        cli = await inspectCli(command.executable, helperDirectory(), (executable, args, cwd) => startProcess(executable, args, cwd, { extraEnvPassthrough: config.extra_env_passthrough }), config.prompt_transport === 'stdin');
+        cli = await inspectCli(command, helperDirectory(), (executable, args, cwd) => startProcess(executable, args, cwd, { extraEnvPassthrough: config.extra_env_passthrough }), config.prompt_transport === 'stdin');
         antigravity = { ...cli, executable: cli.executable || command.source };
     }
     catch {
@@ -29,12 +29,16 @@ export async function createRuntime() {
         console.error(`[bridge] Agent ${agent.adapter.id}: ${state}`);
     }
     const maxParallelWorktrees = config.max_parallel_worktrees ?? 2;
+    const treeWatch = config.tree_watch ?? {};
+    const treeWatchEnabled = treeWatch.enabled !== false;
+    if (!treeWatchEnabled)
+        console.error('[bridge] WARNING: tree_watch is off; a process tree the agent leaves behind will not be released');
     const manager = new TaskManager(config, {
-        executable: antigravity.executable, supported: antigravity.supported, stateDirectory: paths.stateDirectory,
+        executable: antigravity.executable, prefixArgs: antigravity.prefixArgs, supported: antigravity.supported, stateDirectory: paths.stateDirectory,
         agents: registry.agents, defaultAgent: registry.defaultAgent,
         // Without the watch the release can only name the processes that still hang below the agent at the moment it
         // exits, which is exactly the case that left the worktree pinned in a live run.
-        watchTree: startTreeWatch
+        watchTree: treeWatchEnabled ? pid => startTreeWatch(pid, { delays: treeWatch.delays_ms }) : undefined
     });
     await recoverExecutionLock(paths.stateDirectory);
     const sweep = await sweepStaleWorktrees(paths.stateDirectory);
@@ -42,6 +46,13 @@ export async function createRuntime() {
         console.error(`[bridge] Removed a stale empty worktree directory: ${removed}`);
     for (const kept of sweep.retained)
         console.error(`[bridge] Kept worktree directory ${kept.path}: ${kept.reason}`);
+    for (const repo of sweep.prunable) {
+        const prune = await pruneWorktrees(repo);
+        if (prune.pruned)
+            console.error(`[bridge] Pruned ${prune.pruned} stale worktree record(s) in ${repo}`);
+        else if (prune.reason)
+            console.error(`[bridge] WARNING: stale worktree records in ${repo} could not be pruned: ${prune.reason}`);
+    }
     const restored = await manager.restore();
     if (restored)
         console.error(`[bridge] Restored ${restored} finished task record(s) from .bridge-state/tasks`);
@@ -74,8 +85,8 @@ export async function createRuntime() {
             'Existing agent permissions, hooks, MCP and credential access remain governed by each CLI configuration.',
             'Antigravity permission flags are off unless the bridge owner raises the level in the web UI (a client cannot change it). At the default level, actions that need approval are denied (see denied_actions).',
             'No permission bypass flags. Dangerous actions require separate interactive approval.',
-            'After an agent process exits, the bridge releases the process trees it left behind (Windows: taskkill on every subtree still hanging below the agent or below a process recorded while it ran; POSIX: the exited process group). A bridge killed abruptly can still orphan processes.',
-            'Worktree directories of finished tasks are kept for review. Only empty leftovers are removed at startup, and a directory a live process still holds is reported instead of forced.',
+            `After an agent process exits, the bridge releases the process trees it left behind (Windows: taskkill on every subtree still hanging below the agent or below a process recorded while it ran, after re-checking that each pid still names the same process; POSIX: the exited process group). The outcome is published as the task's cleanup field, and a graceful shutdown waits for it. A bridge killed abruptly, or tree_watch disabled in config, can still orphan processes.`,
+            'Worktree directories of finished tasks are kept for review. Only empty leftovers are removed at startup, a directory a live process still holds is reported instead of forced, and a repository left holding a record whose directory is gone is pruned.',
             'Redaction recognizes known patterns only. Never include credentials in task data.'
         ]
     };

package/dist/src/tasks/manager.js

@@ -32,6 +32,8 @@ export class TaskManager {
     queue = [];
     admission = Promise.resolve();
     closing = false;
+    /** Tree releases still running after their task published its status; shutdown waits for these. */
+    pendingRelease = new Set();
     agents;
     defaultAgent;
     constructor(config, runtime) {
@@ -216,6 +218,7 @@ export class TaskManager {
                 execWorkspace = worktree.workspace;
                 task.worktree = worktree.root;
                 task.branch = worktree.branch;
+                task.worktree_toplevel = worktree.toplevel;
                 // Keep the regenerated prompt equal to the one the agent received (the worktree workspace, not the original one).
                 if (entry.request) {
                     entry.request.worktree = worktree.workspace;
@@ -491,8 +494,9 @@ export class TaskManager {
                 // worktree, and on Windows they outlive it and pin the directory. Releasing them needs a process query, so
                 // it runs after the status is visible: no client waits on it, and the record is patched when it finishes.
                 const held = { request: entry.request ?? null, stats: entry.stats ?? null };
-                const observed = watch.stop();
-                void this.releaseOwnedTree(child.pid ?? null, started, observed).then(async (cleanup) => {
+                // The last watch reading is part of the release, not of the publish chain: a wedged process query must not
+                // hold the lane that the next queued task is waiting on.
+                const release = Promise.resolve().then(() => watch.stop()).then(observed => this.releaseOwnedTree(child.pid ?? null, started, observed)).then(async (cleanup) => {
                     task.cleanup = cleanup;
                     // A report that reaped nothing and failed for no reason says nothing worth a second write: this one runs
                     // detached from the status publish, so a reader of the tasks directory can catch its swap mid-flight.
@@ -503,6 +507,10 @@ export class TaskManager {
                     if (this.entries.has(task.task_id))
                         await this.persist(task, held);
                 }).catch(() => { });
+                // Shutdown waits for whatever is still in flight here, so stopping the bridge right after the last agent
+                // exits cannot drop the only record of which processes were left running.
+                this.pendingRelease.add(release);
+                void release.finally(() => { this.pendingRelease.delete(release); });
                 await appendUsage(this.runtime.stateDirectory, {
                     at: task.ended_at ?? new Date().toISOString(), status: task.status, model: entry.request?.model ?? null, effort: entry.request?.effort ?? null,
                     permission: entry.request?.permission ?? null, duration_ms: task.duration_ms, agy_duration_seconds: entry.stats?.agy_duration_seconds ?? null,
@@ -601,7 +609,7 @@ export class TaskManager {
     }
     /** Models offered by the installed Antigravity CLI (read on demand, never at startup). */
     availableModels() {
-        return this.runtime.models ? this.runtime.models() : listModels(this.runtime.executable, helperDirectory(), this.config.extra_env_passthrough);
+        return this.runtime.models ? this.runtime.models() : listModels(this.runtime.executable, helperDirectory(), this.config.extra_env_passthrough, this.runtime.prefixArgs ?? []);
     }
     currentModel() { return readModel(this.runtime.stateDirectory); }
     /** Full record for the web UI: the request, the exact prompt shape sent to the CLI (redacted), and the task with logs. */
@@ -727,6 +735,15 @@ export class TaskManager {
     async shutdown() {
         this.stopAccepting();
         await Promise.all([...this.entries.keys()].map(id => this.cancel(id)));
+        const pending = [...this.pendingRelease];
+        if (!pending.length)
+            return;
+        // Bounded by the same budget the release answers with, plus the record write: a wedged process query must turn
+        // into a lost report, never into a shutdown that hangs.
+        await Promise.race([
+            Promise.all(pending),
+            new Promise(resolve => { const timer = setTimeout(resolve, REAP_BUDGET_MS + 2000); timer.unref?.(); })
+        ]);
     }
     stopAccepting() { this.closing = true; }
     get stateDirectory() { return this.runtime.stateDirectory; }

package/docs/VERIFICATION.md

@@ -52,6 +52,8 @@ Bridge chỉ dùng --version/--help và print/json/print-timeout/disable-slash-c
 5. Smoke chỉ phản hồi và hủy process thật: `npm run test:live` đạt ngày khảo sát. MCP client nhận `BRIDGE_SMOKE_OK` với completed/exit 0 (khoảng 13.5 giây); sentinel không đổi; task tiếp theo được hủy, status canceled/process_running false. Bằng chứng ở `test-results/live-report.json`. Đọc trường `success`, task.status, response_verified, workspace_unchanged và cancellation.status để biết lần chạy mới nhất.
 6. Dọn cây tiến trình và sweep worktree (2026-10-26, `agy` 1.4.7, scratch trong `%TEMP%`, repo git giả): bridge khởi động với một thư mục worktree rỗng còn sót và một thư mục còn file → log báo xóa đúng cái rỗng, giữ đúng cái có file. Task worktree thật trả `completed`, `scope.checked=true`, `changed=1`, `out_of_scope=[]`, `cleanup={checked:true, reaped:[30768,24304], skipped:[], tracked:14}` và log `[bridge] Task tree release: 2 process tree(s) reaped, 0 left running`. Probe đọc cwd của mọi process (PEB) trả `HITS 0`, `rm -rf` toàn bộ scratch thành công không cần force, `note.txt` trong worktree là `REAP_OK`, workspace gốc chỉ còn `[.git, a.txt]`, shutdown confirm trả 202 và server exit 0. Lần chạy **trước** bản sửa cho `HITS 3` với đúng chuỗi `agy → cmd (chết) → npx open-figma-mcp → cmd → node`, `cleanup.reaped` chỉ có 1 PID — đó là bằng chứng vì sao phải ghi cây tiến trình trong lúc task chạy. Bằng chứng: `test-results/reap-report.json` (gitignored), cách chạy lại ở `docs/HANDOFF.md`.
 
+7. Chạy lại đúng kịch bản trên với bản đã bịt lỗ hổng đợt 2 (2026-10-27, `agy` 1.4.7, scratch `%TEMP%`): task worktree `completed`, `scope={checked:true, changed:1, out_of_scope:[], truncated:false}`, `cleanup={checked:true, reaped:[28256,29124,23416], skipped:[], tracked:15}`, log `3 process tree(s) reaped, 0 left running`, probe cwd `HITS 0`, `note.txt` = `REAP_OK`, workspace gốc `[.git, a.txt]`, home + repo scratch xóa sạch, shutdown 202 và exit 0. `skipped` rỗng nghĩa là phép đọc-lại-pid trước khi giết không đổi quyết định trên đường thường; `tracked: 15` so với 3 gốc bị giết xác nhận phần ghi cây lúc chạy vẫn đang làm việc. Một bridge **riêng** (script `ui-cleanup-check.mjs`, task `2f8a65f8`, `cleanup={reaped:[35600,19716], tracked:10}`) được mở bằng Chrome DevTools thật: trang chi tiết task hiển thị đúng dòng `Tiến trình agent để lại: đã giải phóng 2 cây tiến trình (35600, 19716) · đã ghi danh 10 tiến trình trong lúc agent chạy`, nằm dưới dòng scope và không phải kiểu cảnh báo vì `skipped` rỗng; shutdown lịch sự trả 202, pid biến mất, scratch xóa được ngay. Unit: Windows `npm test` **220 test / 214 pass / 0 fail / 6 skipped** (234,1 s) và Linux (WSL, Node 20.20.2) **220 / 219 / 0 fail / 1 skipped** (195,0 s) — Linux là nền để sáu test nhóm POSIX signal chạy thật, trong đó vòng `SIGTERM → 8 s → SIGKILL` với survivor thật chưa từng chạy trước đây. Mỗi fix kèm một phép thử ngược: tháo `verify` → test pid-cấp-lại đỏ; tháo `Promise.race` trong `shutdown()` → test verdict-khi-tắt đỏ; tháo nhịp cuối của `stop()` → test watch đỏ.
+
 Unit/integration dùng mock nằm ở `tests/bridge.test.ts`, được tách khỏi script live. Bao gồm validation, boundary/traversal/junction, lock, lifecycle, retention, timeout, cancel cây process và giữ process khác, exit 7, JSON lỗi, partial SUCCESS timeout, permission denial, output cap, redaction, unsupported/spawn failure và protocol stdout sạch.
 
 ## Giới hạn đã xác minh và phần chưa xác minh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agy-mcp-bridge",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Local loopback HTTP MCP bridge that delegates bounded coding tasks to multiple agent CLIs (Antigravity, Codex) with optional parallel git worktrees",
   "license": "MIT",
   "keywords": [
@@ -33,6 +33,7 @@
     "ui/",
     "skills/",
     "docs/",
+    "!docs/HANDOFF.md",
     "config/workspaces.example.json",
     "README.md",
     "!**/*.map"

package/ui/app.css

@@ -59,7 +59,7 @@ button { cursor: pointer; }
 .page-head p { margin: 2px 0 0; color: var(--muted); }
 
 /* Stats */
-.stats { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 14px; margin-bottom: 20px; }
+.stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(190px, 1fr)); gap: 14px; margin-bottom: 20px; }
 .card { background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius); box-shadow: var(--shadow); }
 .stat { padding: 16px 18px; display: grid; gap: 4px; }
 .stat .label { color: var(--muted); font-size: 12.5px; font-weight: 600; text-transform: uppercase; letter-spacing: .04em; }
@@ -137,6 +137,14 @@ details > summary::-webkit-details-marker { display: none; }
 details > summary::after { content: "+"; color: var(--muted); font-weight: 400; font-size: 18px; line-height: 1; }
 details[open] > summary::after { content: "–"; }
 details .body { padding: 0 14px 14px; display: grid; gap: 10px; }
+/* Secondary text: quiet until opened, so the decisions on screen stay the loudest thing. */
+details.more { background: var(--surface-2); }
+details.more > summary { padding: 7px 12px; font-size: 12.5px; font-weight: 650; color: var(--muted); }
+details.more:hover > summary { color: var(--text); }
+details.more[open] > summary { border-bottom: 1px solid var(--border); }
+details.more .body { padding: 10px 12px 12px; }
+.meta-line { font-size: 12.5px; color: var(--muted); overflow-wrap: anywhere; }
+.detail-head .meta-line { margin-top: 2px; }
 .change-head { display: flex; justify-content: space-between; align-items: center; gap: 10px; flex-wrap: wrap; }
 .change-list { margin: 0; padding: 0; list-style: none; display: grid; max-height: 360px; overflow: auto; border: 1px solid var(--border); border-radius: 10px; }
 .change-row { display: grid; grid-template-columns: 64px minmax(0, 1fr) auto; gap: 10px; align-items: center; padding: 7px 12px; border-top: 1px solid var(--border); font-size: 13px; }
@@ -198,7 +206,7 @@ pre.log { margin: 0; padding: 12px; border-radius: 10px; background: #0b0e14; co
 .progress { display: grid; gap: 6px; margin: 4px 0 12px; }
 .bar { height: 6px; border-radius: 999px; background: var(--surface-2); overflow: hidden; border: 1px solid var(--border); }
 .bar > span { display: block; height: 100%; width: 0; background: var(--accent); transition: width .9s linear; }
-.perm-list { display: grid; gap: 8px; margin: 12px 0; }
+.perm-list { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 8px; margin: 12px 0; }
 .perm-row { display: flex; gap: 12px; align-items: flex-start; padding: 12px; border: 1px solid var(--border); border-radius: 10px; cursor: pointer; }
 .perm-row.on { border-color: var(--accent); background: var(--surface-2); }
 .perm-row.danger.on { border-color: var(--bad); }