brindle 0.3.1__tar.gz → 0.3.2__tar.gz

{brindle-0.3.1 → brindle-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.3.1
+Version: 0.3.2
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -89,7 +89,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.1`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.2`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -539,6 +539,7 @@ Autopilot, merge gates and cleanup:
 | `merge_into` | none | branch that worker branches are cut from and merge into, whatever branch the supervisor is on |
 | `auto_merge_default_branch` | `false` | let the pipeline merge into the repo's default branch (origin HEAD, else `main`/`master`) on its own; by default it sends a "needs you" message instead, and you run `merge_workspace` yourself (manual merges are never gated) |
 | `permission_policy` | `"off"` | `"on"`: brindle answers Claude Code workers' permission prompts from its rules (see "Permission policy" below); off, the prompts behave as they always did |
+| `agy_approvals` | `"prompt"` | `"brindle"`: with the policy on, Antigravity workers run without approval prompts and brindle's hook allows or denies every call (see "Antigravity" under "Permission policy") |
 | `rules` | `[]` | standing rules for the supervisor, e.g. `["Fix review findings without asking", "Validate options before offering them"]`; added to every supervisor's brief. Rules in `~/.brindle/config.json`, the repo's config and `config.local.json` are all kept, so a team's rules and your own add up |
 | `plan_first` | `false` | workers propose a plan (`submit_plan`) and wait for `approve_plan` before editing |
 | `overlap` | `"block"` | a task whose `files` overlap a running task's is refused (`"warn"` starts it with a warning) |
@@ -726,6 +727,21 @@ does it by hand. To undo, turn `permission_policy` off and run `sync-agy`: brind
 removes exactly its own entries. brindle doesn't learn from agy approvals (its
 hook runs for every tool call, so a tool running doesn't mean you approved it).
 
+With `"agy_approvals": "brindle"` (and the policy on), brindle's hook is the
+only gate instead: agy workers start with `--dangerously-skip-permissions`,
+under which agy still honors a hook's deny, and the hook runs on every tool,
+subagents' calls included. It allows what a rule allows (a repo's checks
+included), the shell commands in the profile's `allowed_tools` (what a Claude
+Code worker on it runs without asking), files inside the workspace given as one
+absolute path (writes under `.agents/`, `.git/` and
+`.brindle/` only by a rule, since those hold the hook, git's hooks and the
+repo's checks), brindle's own tools and agy's tools that act only on the
+conversation, and denies everything else, telling the agent to
+ask its supervisor; you allow it with `brindle permissions allow`. Any failure
+in the hook is a deny, and a tool brindle doesn't know is denied. Nobody can
+approve a prompt in the agent's pane in this mode. The default, `"prompt"`,
+leaves agy asking as described above.
+
 ## brindle Pro and Team
 
 brindle is complete on its own. brindle Pro adds hosted learning (which profile

{brindle-0.3.1 → brindle-0.3.2}/README.md

@@ -59,7 +59,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.1`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.2`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -509,6 +509,7 @@ Autopilot, merge gates and cleanup:
 | `merge_into` | none | branch that worker branches are cut from and merge into, whatever branch the supervisor is on |
 | `auto_merge_default_branch` | `false` | let the pipeline merge into the repo's default branch (origin HEAD, else `main`/`master`) on its own; by default it sends a "needs you" message instead, and you run `merge_workspace` yourself (manual merges are never gated) |
 | `permission_policy` | `"off"` | `"on"`: brindle answers Claude Code workers' permission prompts from its rules (see "Permission policy" below); off, the prompts behave as they always did |
+| `agy_approvals` | `"prompt"` | `"brindle"`: with the policy on, Antigravity workers run without approval prompts and brindle's hook allows or denies every call (see "Antigravity" under "Permission policy") |
 | `rules` | `[]` | standing rules for the supervisor, e.g. `["Fix review findings without asking", "Validate options before offering them"]`; added to every supervisor's brief. Rules in `~/.brindle/config.json`, the repo's config and `config.local.json` are all kept, so a team's rules and your own add up |
 | `plan_first` | `false` | workers propose a plan (`submit_plan`) and wait for `approve_plan` before editing |
 | `overlap` | `"block"` | a task whose `files` overlap a running task's is refused (`"warn"` starts it with a warning) |
@@ -696,6 +697,21 @@ does it by hand. To undo, turn `permission_policy` off and run `sync-agy`: brind
 removes exactly its own entries. brindle doesn't learn from agy approvals (its
 hook runs for every tool call, so a tool running doesn't mean you approved it).
 
+With `"agy_approvals": "brindle"` (and the policy on), brindle's hook is the
+only gate instead: agy workers start with `--dangerously-skip-permissions`,
+under which agy still honors a hook's deny, and the hook runs on every tool,
+subagents' calls included. It allows what a rule allows (a repo's checks
+included), the shell commands in the profile's `allowed_tools` (what a Claude
+Code worker on it runs without asking), files inside the workspace given as one
+absolute path (writes under `.agents/`, `.git/` and
+`.brindle/` only by a rule, since those hold the hook, git's hooks and the
+repo's checks), brindle's own tools and agy's tools that act only on the
+conversation, and denies everything else, telling the agent to
+ask its supervisor; you allow it with `brindle permissions allow`. Any failure
+in the hook is a deny, and a tool brindle doesn't know is denied. Nobody can
+approve a prompt in the agent's pane in this mode. The default, `"prompt"`,
+leaves agy asking as described above.
+
 ## brindle Pro and Team
 
 brindle is complete on its own. brindle Pro adds hosted learning (which profile

{brindle-0.3.1 → brindle-0.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.3.1"
+version = "0.3.2"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/agents.py

@@ -1114,7 +1114,7 @@ def format_message(db: DB, body: str, sender_id: str | None) -> str:
         return body
     sender = db.get_agent(sender_id)
     who = f"{sender.profile} agent {sender_id}" if sender else f"agent {sender_id}"
-    return f"[Message from {who}. Reply with the brindle send_message tool, to_agent_id={sender_id}]\n\n{body}"
+    return f"<details><summary>Message from {who}</summary>\n\nReply with the brindle send_message tool, to_agent_id={sender_id}\n\n{body}\n</details>"
 
 
 def message_lead(db: DB, agent: Agent, sender_id: str | None) -> str | None:
@@ -1161,8 +1161,8 @@ def render_unread(db: DB, messages: list) -> str:
         if m.sender_id:
             parts.append(m.body)  # stored through format_message: sender and reply hint
         else:
-            parts.append(f"[Message from brindle]\n\n{m.body}")
-    return "\n\n---\n\n".join(parts)
+            parts.append(f"<details><summary>Message from brindle</summary>\n\n{m.body}\n</details>")
+    return "\n\n".join(parts)
 
 
 def send_message(db: DB, to_id: str, body: str, sender_id: str | None = None,
@@ -1203,6 +1203,9 @@ def _send_message(db: DB, agent: Agent, body: str, sender_id: str | None) -> str
         raise AgentError(f"agent {agent.id} is not running")
     provider = get_provider(agent.provider)
     text = format_message(db, body, sender_id)
+    if agent.provider == "antigravity":
+        from brindle.antigravity import format_delivered_message
+        text = format_delivered_message(text)
     if agent.headless:
         # Its runner starts the next turn with this, or the Stop hook hands it
         # over if a turn is still running.

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/antigravity.py

@@ -60,6 +60,10 @@ EVENTS = {
     "PostToolUse": "agy-post-tool",
     "PreToolUse": "agy-pre-tool",
 }
+# PreToolUse under agy_approvals "brindle" (agy started with
+# --dangerously-skip-permissions): allow or deny only, and deny on any failure.
+STRICT_EVENT = "agy-pre-tool-strict"
+SKIP_FLAG = "--dangerously-skip-permissions"
 # The tools brindle's policy has an opinion on (brindle.permissions.from_agy);
 # others never reach its hook. The hook must answer something (nothing is a
 # deny), and agy's "ask" prompts unless an Always Allow rule covers the call,
@@ -84,7 +88,17 @@ WARMUP_END = "Reply with just the word: ready. Your task, if any, comes in the n
 
 
 def warmup(instructions: str | None) -> str:
-    return "\n\n".join(p for p in (TOOLS_NOTE, instructions, WARMUP_END) if p)
+    parts = [p for p in (TOOLS_NOTE, instructions) if p]
+    body = "\n\n".join(parts)
+    if body:
+        body = f"<details><summary>brindle instructions</summary>\n\n{body}\n\n</details>"
+    return f"{body}\n\n{WARMUP_END}" if body else WARMUP_END
+
+
+def format_delivered_message(body: str) -> str:
+    if not body:
+        return body
+    return f"<details><summary>brindle instructions</summary>\n\n{body}\n\n</details>"
 
 
 class AntigravityError(RuntimeError):
@@ -166,9 +180,10 @@ def _hook_command(event: str) -> str:
     return assigns + " ".join(shlex.quote(a) for a in [*brindle_invocation(), "_hook", event])
 
 
-def install(workspace: str, permission_policy: bool = False) -> None:
+def install(workspace: str, permission_policy: bool = False, strict: bool = False) -> None:
     """Give the checkout brindle's MCP server, hooks and rule for agy (and,
-    with ``permission_policy``, the PreToolUse hook that applies it)."""
+    with ``permission_policy``, the PreToolUse hook that applies it; with
+    ``strict``, the one for agy_approvals "brindle", on every tool)."""
     from brindle.providers import brindle_invocation
 
     cmd = brindle_invocation()
@@ -180,7 +195,11 @@ def install(workspace: str, permission_policy: bool = False) -> None:
     handler = lambda ev: [{"type": "command", "command": _hook_command(EVENTS[ev]), "timeout": 60}]  # noqa: E731
     hooks = {"PreInvocation": handler("PreInvocation"), "Stop": handler("Stop"),
              "PostToolUse": [{"matcher": "*", "hooks": handler("PostToolUse")}]}
-    if permission_policy:
+    if strict:
+        # agy runs every call this hook doesn't deny, so it sees every tool.
+        hooks["PreToolUse"] = [{"matcher": "*", "hooks": [
+            {"type": "command", "command": _hook_command(STRICT_EVENT), "timeout": 60}]}]
+    elif permission_policy:
         hooks["PreToolUse"] = [{"matcher": PRE_TOOL_MATCHER, "hooks": handler("PreToolUse")}]
     _merge_json(workspace, AGENTS_DIR / "hooks.json", "", "brindle", hooks)
     rule = Path(workspace) / AGENTS_DIR / "rules" / "brindle.md"
@@ -298,56 +317,116 @@ def _flush_soon(agent_id: str, delay: float = 1.5) -> None:
                      start_new_session=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
 
-def pre_tool_decision(db, agent_id: str | None, payload: object) -> dict:
-    """agy's PreToolUse: brindle's permission policy as deny or ask."""
+def pre_tool_decision(db, agent_id: str | None, payload: object, strict: bool = False) -> dict:
+    """agy's PreToolUse: brindle's permission policy as deny or ask (with
+    ``strict``, agy_approvals "brindle": allow or deny; see
+    permissions.agy_strict_output)."""
     from brindle import permissions
     from brindle.agents import _record_permission
     from brindle.config import load_repo_config
     from brindle.profiles import profile_rules_for
 
+    output = permissions.agy_strict_output if strict else permissions.agy_output
     agent = db.get_agent(agent_id) if agent_id else None
     ws = db.get_workspace(agent.workspace_id) if agent else None
     if ws is None or not isinstance(payload, dict):
-        return permissions.agy_output(None)
+        return output(None)
     cfg = load_repo_config(ws.repo_root)
-    if cfg.permission_policy != "on":
-        return permissions.agy_output(None)
+    if cfg.permission_policy != "on" and not strict:
+        return output(None)
     req = permissions.from_agy(payload, worktree=ws.path, repo_root=ws.repo_root)
     rules = [*permissions.all_rules(ws.repo_root), *profile_rules_for(agent.profile, ws.repo_root)]
+    if strict:
+        # What a Claude Code worker on this profile runs without asking
+        # (its allowed_tools); a deny still wins, since decide() checks those first.
+        from brindle.profiles import load_profile
+
+        try:
+            rules += permissions.profile_bash_allows(load_profile(agent.profile, ws.repo_root))
+        except KeyError:
+            pass
     decision = permissions.decide(req, checks=cfg.checks, rules=rules)
-    if req is not None and decision.decision == "deny":
-        # Only denies are worth a history row here: agy runs this for every
-        # tool call, and brindle's allow is only advisory (agy decides).
-        _record_permission(db, agent, ws, req.summary(), f"deny: {decision.reason}")
     spaces = payload.get("workspacePaths")
     spaces = [s for s in spaces if isinstance(s, str) and s] if isinstance(spaces, list) else []
-    return permissions.agy_output(decision, req, spaces)
+    if strict:
+        # Only what brindle knows, not the payload's word: the worktree, and
+        # agy's folder for this conversation's plans and task lists.
+        spaces = [ws.path]
+        artifacts = payload.get("artifactDirectoryPath")
+        brain = os.path.realpath(Path.home() / ".gemini" / "antigravity-cli" / "brain")
+        if isinstance(artifacts, str) and os.path.realpath(artifacts).startswith(brain + os.sep):
+            spaces.append(os.path.realpath(artifacts))
+        ambiguous = permissions.agy_strict_ambiguity(payload, ws.path) if req is not None else None
+        if ambiguous and decision.decision != "deny":
+            out = {"decision": "deny", "reason": f"brindle: {ambiguous}, so it can't be checked; "
+                                                 "use one absolute path inside your worktree"}
+        else:
+            out = output(decision, req, spaces, protected_roots=[ws.path, ws.repo_root])
+    else:
+        out = output(decision, req, spaces)
+    if req is not None and out["decision"] == "deny":
+        # Only denies are worth a history row here: agy runs this for every
+        # tool call.
+        _record_permission(db, agent, ws, req.summary(), f"deny: {out['reason']}")
+    return out
 
 
 PRE_TOOL_FALLBACK = json.dumps({"decision": "ask", "reason": "brindle: no decision"})
+STRICT_FALLBACK = json.dumps({"decision": "deny", "reason": "brindle: couldn't check this call, so it's denied"})
 
 
-def pre_tool_main(stdin_text: str, db_factory=None) -> str:
+def _launched_with_skip_flag(max_depth: int = 4) -> bool | None:
+    """Whether the agy process that ran this hook was started with
+    --dangerously-skip-permissions: True, False, or None when that can't be
+    told (then the caller assumes it was)."""
+    pid: int | None = os.getppid()
+    try:
+        for _ in range(max_depth):
+            if not pid or pid <= 1:
+                return None
+            argv = subprocess.run(["ps", "-o", "command=", "-p", str(pid)],
+                                  capture_output=True, text=True).stdout.split()
+            if SKIP_FLAG in argv:
+                return True
+            if argv and os.path.basename(argv[0]) == "agy":
+                return False
+            pid = _parent(pid)
+    except (OSError, ValueError):
+        return None
+    return None
+
+
+def pre_tool_main(stdin_text: str, db_factory=None, strict: bool = False) -> str:
     """``brindle _hook agy-pre-tool``: always a JSON answer (deny, ask, or allow
     for a file in the workspace); any failure (no agent, bad input, a broken
-    DB) is ask, since agy reads no answer as deny."""
+    DB) is ask, since agy reads no answer as deny.
+
+    ``strict`` (``agy-pre-tool-strict``, agy_approvals "brindle"): agy runs
+    whatever isn't denied, so a failure is a deny. The one exception is an agy
+    that plainly wasn't started with the skip flag and isn't a brindle agent
+    (the person's own session in a checkout brindle set up): that one prompts
+    as usual, so it gets ask."""
+    fallback = STRICT_FALLBACK if strict else PRE_TOOL_FALLBACK
     try:
         try:
             payload = json.loads(stdin_text) if stdin_text.strip() else {}
         except ValueError:
-            payload = None  # unreadable: ask
+            payload = None  # unreadable: the fallback
         agent_id = os.environ.get("BRINDLE_AGENT_ID") or agent_from_parent()
+        if strict and not agent_id:
+            return PRE_TOOL_FALLBACK if _launched_with_skip_flag() is False else STRICT_FALLBACK
         if db_factory is None:
             from brindle.db import DB as db_factory
-        out = pre_tool_decision(db_factory(), agent_id, payload)
-        if isinstance(out, dict) and out.get("decision") in ("deny", "ask", "allow"):
+        out = pre_tool_decision(db_factory(), agent_id, payload, strict=strict)
+        allowed = ("deny", "allow") if strict else ("deny", "ask", "allow")
+        if isinstance(out, dict) and out.get("decision") in allowed:
             return json.dumps(out)
     except Exception as e:  # noqa: BLE001
         try:
             print(f"brindle hook agy-pre-tool: {e}", file=sys.stderr)
         except Exception:  # noqa: BLE001
             pass
-    return PRE_TOOL_FALLBACK
+    return fallback
 
 
 def hook_main(db, event: str, stdin_text: str) -> str:
@@ -541,6 +620,18 @@ def policy_on(workspace: str) -> list[str] | None:
     return list(cfg.checks or []) if cfg.permission_policy == "on" else None
 
 
+def strict_on(workspace: str) -> bool:
+    """agy_approvals "brindle" with the permission policy on: agy runs with
+    --dangerously-skip-permissions and brindle's hook decides every call."""
+    from brindle.config import load_repo_config
+
+    try:
+        cfg = load_repo_config(workspace)
+    except Exception:  # noqa: BLE001
+        return False
+    return cfg.permission_policy == "on" and cfg.agy_approvals == "brindle"
+
+
 def sync_for_launch(workspace: str, checks: list[str] | None) -> None:
     """An agy worker is starting in ``workspace``: bring agy's settings in
     line with the repo's policy (``checks`` is None when it's off). Never

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/autopilot.py

@@ -145,7 +145,10 @@ Acting on what you find:
   verify each finding (a reviewer can be wrong), fix the real ones, and report
   what you fixed and which findings weren't real. Don't ask first. Ask only
   before outward-facing or hard-to-reverse actions (posting, merging into a
-  shared branch, deleting) and for decisions that are the user's to make."""
+  shared branch, deleting) and for decisions that are the user's to make.
+- Format your own verbose outputs or message transcripts in collapsible
+  `<details><summary>Title</summary>...</details>` blocks so they are not
+  sprawling in the chat UI."""
 
 
 def supervisor_rules(cfg: RepoConfig) -> str:

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/cli.py

@@ -1164,11 +1164,14 @@ _KIND_HELP = "read, write, edit, bash, fetch, mcp or other."
 @permissions_app.command("allow")
 def permissions_allow(
     kind: str = typer.Argument(..., help=_KIND_HELP),
-    match: str = typer.Argument(..., help="The command, path, URL or tool name (exact unless --prefix/--glob)."),
+    match: Optional[str] = typer.Argument(None, help="The command, path, URL or tool name (exact unless --prefix/--glob)."),
     prefix: bool = typer.Option(False, "--prefix", help="Match anything starting with MATCH."),
     glob: bool = typer.Option(False, "--glob", help="MATCH is a shell-style glob (* also crosses /)."),
 ) -> None:
     """Allow requests that match. A bash allow never covers a command with shell metacharacters."""
+    if match is None:
+        match = kind
+        kind = "bash"
     _add_permission_rule("allow", kind, match, prefix, glob)
 
 
@@ -2428,15 +2431,16 @@ def ci_init(
 @app.command("_hook", hidden=True)
 def hook(event: str, agent: Optional[str] = typer.Option(None, "--agent"),
          payload: Optional[str] = typer.Argument(None)) -> None:
-    if event == "agy-pre-tool":
-        # agy reads no answer as deny, so this always prints one (ask on any failure).
+    if event in ("agy-pre-tool", "agy-pre-tool-strict"):
+        # agy reads no answer as deny, so this always prints one (ask on any
+        # failure; deny under agy_approvals "brindle", where ask would run it).
         from brindle import antigravity
 
         try:
             text = sys.stdin.read()
         except Exception:  # noqa: BLE001
             text = ""
-        typer.echo(antigravity.pre_tool_main(text))
+        typer.echo(antigravity.pre_tool_main(text, strict=event == "agy-pre-tool-strict"))
         return
     if event.startswith("agy-"):
         from brindle import antigravity

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/config.py

@@ -74,7 +74,7 @@ class RepoConfig:
     # the pipeline merges only when both approve. Empty: one review (see brindle.pipeline).
     second_review: dict[str, str] = field(default_factory=dict)
     pre_commit: bool = True            # run pre-commit (the framework) over a branch before merging
-    max_agents: int = 4                # workers running at once per session; 0 means no cap
+    max_agents: int = 5                # workers running at once per session; 0 means no cap
     check_timeout: int = 900           # seconds allowed for each check command
     check_concurrency: int = 2         # check runs at once on this machine, across branches; the rest queue (0: no cap)
     usage_limit: int = 90              # autopilot stops pushing on at this % of the Claude usage limit
@@ -95,6 +95,10 @@ class RepoConfig:
     # "on": brindle answers workers' permission requests by its rules (see
     # brindle.permissions). Unset, it's "on" for Pro and up and "off" on Free.
     permission_policy: str = "off"
+    # "brindle": with the policy on, agy workers run with
+    # --dangerously-skip-permissions and brindle's hook allows or denies every
+    # call (see brindle.antigravity). "prompt" (default): agy asks as usual.
+    agy_approvals: str = "prompt"
     overlap: str = "block"           # a task whose files overlap a running one: "block" or "warn"
     # Paths/globs whose merge conflicts brindle never hands to a worker to
     # resolve (migrations, lockfiles, generated code): they go to the person.
@@ -209,7 +213,7 @@ def load_repo_config(repo_root: str | Path) -> RepoConfig:
                 "usage_limit", "pool_size", "graphify", "stale_after", "pipeline",
                 "review_rounds", "fable_escalation", "goal_audit", "overlap", "local_models", "merge_into",
                 "auto_merge_default_branch", "delete_merged_branches", "delegation", "sidebar", "pr_footer", "plan_first", "learning",
-                "learning_candidates", "limit_cooldown_minutes", "message_delivery", "permission_policy",
+                "learning_candidates", "limit_cooldown_minutes", "message_delivery", "permission_policy", "agy_approvals",
                 "learned_rules_repeats", "learned_rules_profile"):
         for source in (local, shared, user):
             if key in source:

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/permissions.py

@@ -169,6 +169,20 @@ def _default(id_: str, kind: str, match: str, match_type: str, decision: str) ->
     return Rule(kind, match, match_type, decision, "default", 0.0, id_)
 
 
+def _preset(kind: str, match: str, match_type: str, decision: str) -> Rule:
+    return Rule(kind, match, match_type, decision, "user", time.time(), "")
+
+
+PRESET_COMMANDS = ("aws", "uv", "pytest", "python", "npm", "pnpm", "yarn", "docker", "cargo", "go", "make", "gh")
+PRESET_RULES = tuple(
+    rule
+    for cmd in PRESET_COMMANDS
+    for rule in (
+        _preset("bash", cmd, "exact", "allow"),
+        _preset("bash", f"{cmd} ", "prefix", "allow"),
+    )
+)
+
 DEFAULT_RULES: tuple[Rule, ...] = (
     _default("d-tracked", "read", "a file git tracks in the worktree or repo root", "tracked", "allow"),
     _default("d-checks", "bash", "exactly one of the repo's `checks` commands", "check", "allow"),
@@ -415,6 +429,144 @@ def agy_output(decision: Decision | None, req: Request | None = None,
     return {"decision": "ask", "reason": f"brindle: {why}"}
 
 
+# agy's own tools that act only on the conversation (tasks, messages to its
+# subagents, questions to the person); a subagent's tool calls reach the hook
+# themselves (checked on agy 1.3.2). Anything not listed here or mapped in
+# AGY_KINDS is denied under agy_approvals "brindle", so a tool agy adds later
+# starts out blocked.
+AGY_CONVERSATION_TOOLS = frozenset({"manage_task", "send_message", "ask_question", "invoke_subagent"})
+# Inside a workspace, but not files the agent may write without a rule: what
+# brindle's hook and agy's settings are read from (.agents), what git runs
+# (.git/hooks, config), and brindle's repo config (checks, rules).
+AGY_PROTECTED_DIRS = (".agents", ".git", ".brindle")
+NEEDS_APPROVAL = ("brindle runs this agent without approval prompts, and no rule allows this "
+                  "({why}). Don't try another way to do the same thing: tell your supervisor "
+                  "with send_message what you need and why, so the person can allow it with "
+                  "`brindle permissions allow`.")
+
+
+def _lexically_within(literal: str, root: str) -> bool:
+    """``literal`` is ``root`` or under it as spelled, taking ``root`` as
+    given or resolved (macOS's /tmp is /private/tmp), with nothing resolved
+    in ``literal`` itself."""
+    for r in {os.path.normpath(root), os.path.realpath(root)}:
+        if literal == r or literal.startswith(r.rstrip(os.sep) + os.sep):
+            return True
+    return False
+
+
+def _through_symlink(literal: str, roots: list[str]) -> bool:
+    """Whether ``literal`` (absolute, normalized) passes through a symlink
+    below one of ``roots``, the file itself included. A root's own symlinks
+    (macOS's /tmp -> /private/tmp) don't count."""
+    for root in {f(r) for r in roots if r for f in (os.path.normpath, os.path.realpath)}:
+        rel = os.path.relpath(literal, root)
+        if rel == ".." or rel.startswith(".." + os.sep) or rel == ".":
+            continue
+        prefix = root
+        for part in rel.split(os.sep):
+            prefix = os.path.join(prefix, part)
+            if os.path.islink(prefix):
+                return True
+    return False
+
+
+def _agy_protected(literal: str, real: str, roots: list[str]) -> bool:
+    """Whether a write lands in a .agents/.git/.brindle folder under one of
+    ``roots``, at any depth, ignoring case (macOS and Windows file systems
+    do). Checked on the path as written and as resolved, and against each
+    top-level protected folder resolved, so a symlink either way (a
+    ``.agents`` that points elsewhere, or a path that points into one) is
+    still caught."""
+    names = {d.casefold() for d in AGY_PROTECTED_DIRS}
+    if _through_symlink(literal, roots):
+        return True  # where it really lands is not worth guessing at
+    for root in (r for r in roots if r):
+        for p, r in ((literal, os.path.normpath(root)), (real, os.path.realpath(root))):
+            rel = os.path.relpath(p, r)
+            if rel != ".." and not rel.startswith(".." + os.sep):
+                if names & {part.casefold() for part in rel.split(os.sep)}:
+                    return True
+        for d in AGY_PROTECTED_DIRS:
+            target = os.path.realpath(os.path.join(root, d))
+            if real == target or real.startswith(target + os.sep):
+                return True
+    return False
+
+
+def _brindle_tools() -> set[str]:
+    """brindle's MCP tools by both names agy gives them: mcp_brindle_<tool>
+    and, through call_mcp_tool, mcp__brindle__<tool>. Exact names, so another
+    server's tools (say a server named brindle_x) never count."""
+    from brindle.antigravity import tool_names
+
+    names = tool_names()
+    return {f"mcp_brindle_{n}" for n in names} | {f"mcp__brindle__{n}" for n in names}
+
+
+def agy_strict_ambiguity(payload: dict, worktree: str) -> str | None:
+    """Why brindle can't be sure it reads an agy call the way agy will, or
+    None. Under agy_approvals "brindle" such a call is denied rather than
+    guessed at: a JSON-encoded value (brindle decodes it, agy may not), a
+    relative or ~ path (agy may resolve it against something other than
+    Cwd), more than one path, or a command run outside the worktree."""
+    call = payload.get("toolCall") if isinstance(payload, dict) else None
+    args = call.get("args") if isinstance(call, dict) and isinstance(call.get("args"), dict) else {}
+    for name in (*AGY_PATH_ARGS, "Cwd", "CommandLine"):
+        raw = args.get(name)
+        if isinstance(raw, str) and raw and _agy_arg(args, name) != raw:
+            return f"{name} is JSON-encoded"
+    paths = {args[a] for a in AGY_PATH_ARGS if isinstance(args.get(a), str) and args[a]}
+    if len(paths) > 1:
+        return "the call names more than one path"
+    if any(not os.path.isabs(p) for p in paths):
+        return "the call names a relative path"
+    if any(".." in p.split("/") or ".." in p.split(os.sep) for p in paths):
+        return "the path has a .. in it"  # resolved after a symlink, not as written
+    cwd = args.get("Cwd")
+    if call.get("name") == "run_command" and isinstance(cwd, str) and cwd:
+        real, root = os.path.realpath(cwd), os.path.realpath(worktree)
+        if not os.path.isabs(cwd) or (real != root and not _inside(real, worktree)):
+            return "the command runs outside the worktree"
+    return None
+
+
+def agy_strict_output(decision: Decision | None, req: Request | None = None,
+                      workspaces: list[str] | None = None,
+                      protected_roots: list[str] | None = None) -> dict:
+    """agy's PreToolUse answer under ``agy_approvals: "brindle"``, where agy
+    runs with --dangerously-skip-permissions: a hook's "ask" then runs the
+    call without a prompt, so brindle answers allow or deny, never ask.
+    Allowed: what a rule allows, a file inside a workspace (or the
+    conversation's artifact folder, passed in ``workspaces``), brindle's own
+    tools, and agy's conversation-only tools. Everything else is denied with
+    a reason that tells the agent to ask its supervisor."""
+    if decision is not None and decision.decision == "deny":
+        return {"decision": "deny", "reason": f"brindle: {decision.reason}"}
+    if decision is not None and decision.decision == "allow":
+        return {"decision": "allow", "reason": f"brindle: {decision.reason}"}
+    if req is not None:
+        path = os.path.realpath(req.path) if req.kind in PATH_KINDS and req.path else None
+        # Protected wherever the workspaces list says the workspace is: the
+        # anchors are brindle's own worktree and repo root.
+        literal = os.path.normpath(req.path) if path else None
+        protected = (path and req.kind != "read"
+                     and _agy_protected(literal, path, protected_roots or []))
+        # In the workspace as written, not only once resolved: a path that
+        # gets there through a symlink outside it would skip the symlink walk.
+        if path and not protected and any(
+                w and _lexically_within(literal, w) and (path == os.path.realpath(w) or _inside(path, w))
+                for w in workspaces or []):
+            return {"decision": "allow", "reason": "brindle: a file in the workspace"}
+        if req.kind == "mcp" and req.tool in _brindle_tools():
+            return {"decision": "allow", "reason": "brindle: brindle's own tool"}
+        if req.kind == "other" and req.tool in AGY_CONVERSATION_TOOLS:
+            return {"decision": "allow", "reason": "brindle: acts only on the conversation"}
+    why = decision.reason if decision is not None else "brindle couldn't read the request"
+    why = why.removesuffix("; asking the user")  # nobody is asked here
+    return {"decision": "deny", "reason": "brindle: " + NEEDS_APPROVAL.format(why=why)}
+
+
 # -- matching ---------------------------------------------------------------------------------
 
 
@@ -592,6 +744,27 @@ def profile_rules(profile) -> list[Rule]:
     return out
 
 
+PROFILE_BASH = re.compile(r"Bash\(([^()*]+?)(:\*)?\)")
+
+
+def profile_bash_allows(profile) -> list[Rule]:
+    """The profile's ``allowed_tools`` shell entries as allow rules, for an
+    agy worker under agy_approvals "brindle", which Claude Code's
+    ``--allowedTools`` never reaches: ``Bash(git status)`` is that exact
+    command, ``Bash(uv run:*)`` it alone or followed by arguments. Like
+    every bash allow, a compound or quoted command never matches."""
+    out = []
+    for entry in getattr(profile, "allowed_tools", None) or []:
+        m = PROFILE_BASH.fullmatch(entry.strip())
+        if not m:
+            continue
+        command = m.group(1).strip()
+        out.append(Rule("bash", command, "exact", "allow", "profile"))
+        if m.group(2):
+            out.append(Rule("bash", command + " ", "prefix", "allow", "profile"))
+    return out
+
+
 def invalid_profile_rules(profile) -> list[str]:
     """Profile deny specs ignored by the policy because they are malformed."""
     invalid = list(getattr(profile, "permission_denies_errors", []))
@@ -674,8 +847,17 @@ class Store:
 
 
 def load_store() -> Store:
+    path = store_path()
+    if not path.exists():
+        store = Store(rules=list(PRESET_RULES))
+        try:
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(store.to_json(), encoding="utf-8")
+        except OSError:
+            pass
+        return store
     try:
-        data = json.loads(store_path().read_text(encoding="utf-8"))
+        data = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, ValueError):
         return Store()
     if not isinstance(data, dict):

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/pro/account.py

@@ -661,7 +661,12 @@ class ProAccount(_OrgCommands):
         client = auth.Client(base, transport=self.transport)
         browser = not device and loopback.can_open_browser(self.out)
         ent = auth.login(client, self.store, show=self._say, browser=browser)
-        self._say(f"Logged in as {ent.sub} ({ent.org_id}), plan {ent.plan}.")
+        try:
+            who = auth.me(client, self.store)
+        except auth.AuthError:
+            who = {}
+        display_name = who.get("name") or who.get("email") or ent.sub
+        self._say(f"Logged in as {display_name} ({ent.org_id}), plan {ent.plan}.")
         self._say("See what your plan includes: `brindle account`"
                   + ("" if ent.features else "; get brindle Pro: `brindle account upgrade`"))
         self._company_login(client)

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/pro/auth.py

@@ -663,7 +663,7 @@ def me(client: Client, store) -> dict:
     status, body = authed(client, store, "GET", "/me")
     if status != 200:
         raise _error(status, body)
-    return {k: _sanitize(body[k]) for k in ("sub", "email", "org_id", "plan", "status", "seats")
+    return {k: _sanitize(body[k]) for k in ("sub", "email", "name", "first_name", "last_name", "org_id", "plan", "status", "seats")
             if k in body}
 
 

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/providers.py

@@ -1085,6 +1085,8 @@ class Codex(Provider):
         argv += codex_hook.launch_flags(ctx.cwd)
         if ctx.profile.model:
             argv += ["--model", ctx.profile.model]
+        if ctx.profile.effort:
+            argv += ["-c", f"model_reasoning_effort={json.dumps(ctx.profile.effort)}"]
         # Codex has no system-prompt flag; lead the first message with the profile.
         first = "\n\n".join(p for p in (ctx.profile.prompt, ctx.initial_prompt) if p)
         if first:
@@ -1148,13 +1150,22 @@ class Antigravity(Provider):
     def command(self, ctx: LaunchContext) -> list[str]:
         from brindle import antigravity
 
+        strict = False
         if ctx.cwd:
             policy = antigravity.policy_on(ctx.cwd)
-            antigravity.install(ctx.cwd, permission_policy=bool(policy))
+            strict = policy is not None and antigravity.strict_on(ctx.cwd)
+            antigravity.install(ctx.cwd, permission_policy=policy is not None, strict=strict)
             antigravity.sync_for_launch(ctx.cwd, policy)
         argv = [antigravity.binary()]
+        if strict:
+            # agy ignores a hook's "allow" (google-antigravity/antigravity-cli#1053)
+            # but honors its "deny" with this flag, so brindle's hook, installed
+            # above on every tool, is the gate: see antigravity.pre_tool_main.
+            argv.append(antigravity.SKIP_FLAG)
         if ctx.profile.model:
             argv += ["--model", ctx.profile.model]
+        if ctx.profile.effort:
+            argv += ["--effort", ctx.profile.effort]
         if ctx.profile.permission_mode in ("acceptEdits", "accept-edits", "auto"):
             # agy has no classifier mode; accepting edits is the closest.
             argv += ["--mode", "accept-edits"]
@@ -1169,6 +1180,25 @@ class Antigravity(Provider):
     TRUST_DIALOG = re.compile(r"Do you trust the contents of this project\?", re.I)
     TRUST_SELECTED = re.compile(r">\s*Yes, I trust this folder")
     READY = re.compile(r"\? for shortcuts|esc to cancel")
+    INPUT_LINE = re.compile(r"^\s*>\s*(.*)$", re.M)
+    ANSI_SGR = re.compile(r"\x1b\[([0-9;]*)m")
+
+    @classmethod
+    def _strip_ansi(cls, text: str) -> str:
+        return cls.ANSI_SGR.sub("", text)
+
+    def paste_blocked(self, screen: str, interactive: bool) -> str | None:
+        if not interactive:
+            return None
+        styled_lines = screen.rstrip().splitlines()[-25:]
+        candidates = [ln for ln in styled_lines if self.INPUT_LINE.match(self._strip_ansi(ln))]
+        if not candidates:
+            return None
+        plain_line = self._strip_ansi(candidates[-1])
+        m = self.INPUT_LINE.match(plain_line)
+        if m and m.group(1).strip():
+            return "typing"
+        return None
 
     def after_launch(self, target: str) -> None:
         # A new worktree is a folder agy hasn't seen. brindle made it from the

{brindle-0.3.1 → brindle-0.3.2}/src/brindle/repos.py

@@ -23,7 +23,11 @@ from brindle import git, workspaces
 from brindle.db import DB, Workspace
 
 FEATURE = "multi_repo"
-PRO_MESSAGE = "Working across several repos in one session is part of brindle Pro."
+PRO_MESSAGE = (
+    "Working across multiple repositories is a restricted feature of brindle Pro. "
+    "The free tier is limited to a single repository per session. "
+    "To upgrade, run `brindle account upgrade` or visit https://pawdelta.com/brindle."
+)
 
 
 class RepoError(RuntimeError):