fix(agy-acp)!: default prompt timeout to twenty minutes - #1534

Addressed F1 and F2 in commit 0152390:

• F1: Changed the AGY_EXTRA_ARGS table description from “prepended” to “added to”, matching its position after --add-dir and before session/prompt arguments.
• F2: Extracted DEFAULT_PRINT_TIMEOUT: &str = "20m" and use it when adding the default. Tests deliberately retain literal 20m expectations so they independently enforce the documented contract instead of changing automatically with the implementation constant. Documentation still states the same 20-minute value.

Validation on this commit:

• cargo check --manifest-path agy-acp/Cargo.toml: passed (three existing dead-code warnings).
• cargo test --manifest-path agy-acp/Cargo.toml: 32 passed, 0 failed, 6 existing ignored tests.
• git diff --check: passed.
• Strict Clippy: the same six diagnostics as untouched baseline; no additional diagnostics. Existing formatting limitations remain as disclosed in the PR.

Regarding the three motivation questions:

1. A deployment override is a valid immediate workaround, but a shared adapter default is the intended outcome so each deployment does not need to rediscover this failure.
2. Twenty minutes is the proposed finite default from the incident, not a workload-derived guarantee; explicit operator overrides remain authoritative.
3. The reported failure is enforced inside agy's print execution. Supplying its own supported timeout option targets that layer directly. Cancellation, outer timeouts, and workloads exceeding the chosen budget remain explicit non-goals/residual risks.

Please re-check F1/F2 and regressions against the existing acceptance criteria. No contract scope or runtime behavior changed in this follow-up.

Round-2 response at 446facf:

F1 — fixed. The table now says “Extra arguments added to every agy prompt invocation”, accurately excluding agy models.

F2 — proposed scope change; maintainer disposition requested. The current PR contract explicitly says “Invalid explicit timeout values remain subject to CLI validation.” Missing/empty values are operator configuration errors under that policy, and the follow-up const/doc edit did not introduce this behavior. The pre-PR adapter likewise passed these arguments through to agy.

Simply appending the default does not repair the malformed argument: --print-timeout= would remain in argv, and a standalone --print-timeout would precede another option rather than its duration. Reliably recovering would require removing or rewriting the explicit option and defining behavior for empty quoted tokens, a following option, invalid non-empty durations, and duplicate flags. That would change the proposed override/error policy, rather than just correct the default guard.

I therefore retained CLI validation and added invalid_explicit_timeouts_are_left_for_cli_validation, covering standalone, empty equals, empty quoted, following-option, and invalid-duration cases. This records the existing policy instead of silently replacing operator input. I recommend keeping recovery as a follow-up. The contract is still proposed, not maintainer-frozen; if maintainers want automatic recovery in this PR, please explicitly select that policy and revise the applicable contract clause. F2 is not being claimed as fixed or accepted by maintainers.

Validation:

• cargo test --manifest-path agy-acp/Cargo.toml: 33 passed, 0 failed, 6 existing ignored tests.
• cargo check --manifest-path agy-acp/Cargo.toml: passed with the same three existing dead-code warnings.
• git diff --check: passed.
• No production Rust behavior changed in this follow-up. Previously disclosed baseline fmt/strict-Clippy limitations remain; those checks were not rerun for this doc/test-only increment.

Please verify F1 and provide disposition on F2 against the proposed contract before further implementation changes.

What This PR Does

Long Antigravity turns were failing with Error: timeout waiting for response (surfaced as ACP JSON-RPC -32000) because agy-acp supplied no --print-timeout, so agy used its short built-in default (reported as 5 minutes). This PR injects --print-timeout 20m on every prompt invocation unless the operator has already set a print timeout via AGY_EXTRA_ARGS.

How It Works

A helper prompt_extra_args(extra: &str) -> Vec<String> parses AGY_EXTRA_ARGS with shell_words::split, preserving the prior warn-and-ignore behavior on malformed input. It appends --print-timeout 20m (from the DEFAULT_PRINT_TIMEOUT const) only when neither an exact --print-timeout token nor a --print-timeout= prefix is already present. The helper is called from prepare_prompt_state, the single argument-building path used for both initial and resumed prompt turns; the separate agy models metadata spawn is intentionally unaffected. Operator configuration remains authoritative: an explicit --print-timeout <d> or --print-timeout=<d> is always preserved.

Findings

Addressing All Reviewer Feedback

This is the single self-contained record for the PR. It resolves every prior thread; earlier review summaries are superseded and minimized. There are no inline (line-level) review threads on this PR; all feedback was exchanged as top-level comments, addressed below.

Round 1 -> Round 2 (contributor follow-up on commit 01523906)

Addressed the "prepended" wording and extracted a DEFAULT_PRINT_TIMEOUT constant.

✅ Confirmed: the constant is present and the stale "prepended" wording was removed.

Round 2 -> Round 3 (contributor follow-up on commit 446facfe)

Fixed the doc scope to "every agy prompt invocation", and retained CLI validation for value-less/invalid timeout tokens, adding a regression test rather than silently rewriting operator input; requested maintainer disposition.

✅ Doc scope confirmed at docs/antigravity.md:30.
ℹ Value-less-flag behavior accepted: leaving invalid explicit tokens to CLI validation matches the pre-existing pass-through policy and the contract's "Accepted Residual Risks", and is now pinned by invalid_explicit_timeouts_are_left_for_cli_validation. Appending a default would not repair a malformed token already in argv, and full recovery would expand the override/error policy beyond this fix. Non-blocking; maintainers may still elect stricter recovery as a follow-up.

Group review (multiple independent reviewers, head 446facfe)

Independent passes on correctness/logic, security/docs/UX, and baseline/CI/scope.

✅ All reviewers reached LGTM with no Critical/Important findings. The group additionally verified that agy models does not receive the default, that repository CI runs build/tests (no separate fmt/clippy gate, so the disclosed lint differences are not a pipeline regression), and that the change introduces no new dependency or lockfile scope. The only shared limitation is that this review environment has no Rust toolchain, so cargo test/clippy were not independently re-run; verification was by static analysis of the current checkout, and the author reports 33 tests passing.

5. Three Reasons We Might Not Need This PR

1. Deployment-only override is enough — setting AGY_EXTRA_ARGS = "--print-timeout 20m" in config achieves the same effect without a code-level breaking change. Rebuttal: a shared adapter default avoids each deployment rediscovering the failure.
2. 20 minutes is an unvalidated constant — it comes from an incident handoff, not a measured turn-duration distribution. Rebuttal: it is an explicit finite default, overridable per operator.
3. It treats a symptom, not the root cause — it raises one timeout layer without addressing cancellation or other layers; tasks over 20 minutes still fail. Rebuttal: targeting the specific failing print-timeout layer is intentional and scoped, with other layers listed as explicit non-goals.