Merge remote-tracking branch 'origin/master' into codex/skill-system

# Conflicts: # docs/rfc/INDEX.md # examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl # examples/acp-agent/tests/snapshots/code-mode-turn/session.jsonl # examples/acp-agent/tests/snapshots/text-turn/session.jsonl # packages/README.md
2026-07-11 22:31:28 +08:00
parent 28f7fa0969 9b4ce4f301
commit 3baaecc078
135 changed files with 8507 additions and 294 deletions
@@ -89,8 +89,9 @@ function spawnAcpAgent(cwd: string, env: NodeJS.ProcessEnv = process.env): Spawn
      return Promise.resolve()
    },
    requestPermission(_params: RequestPermissionRequest): Promise<RequestPermissionResponse> {
-      // Permission gate is deferred (TODO(rfc010-permission-gate)); the bridge
-      // never requests permission yet, so just allow if it ever does.
+      // This example composes no ask-producing policy (no hooks), so the
+      // bridge never prompts here; answer cancelled (fail closed) if it ever
+      // does — an unexpected prompt must not grant anything.
      return Promise.resolve({ outcome: { outcome: 'cancelled' } })
    },
  })