feat(acp): the bridge approval answerer + scripted permission answers

The ACP bridge registers the first real approval answerer: an ask for an agent it owns becomes session/request_permission attached to the already- streamed tool call (one-shot allow_once/reject_once only), outcomes map conservatively (unknown optionId never grants, client cancel → cancelled), and foreign or call-less requests delegate down the waterfall. The snapshot harness accepts scripted permissionAnswers (FIFO; an unscripted prompt answers cancelled, fail closed) so recorded scenarios can drive the wire keylessly.
2026-07-09 15:36:08 +08:00
parent ef35007d75
commit 80d8726601
18 changed files with 302 additions and 30 deletions
@@ -80,8 +80,9 @@ function spawnAcpAgent(cwd: string, env: NodeJS.ProcessEnv = process.env): Spawn
      return Promise.resolve()
    },
    requestPermission(_params: RequestPermissionRequest): Promise<RequestPermissionResponse> {
-      // Permission gate is deferred (TODO(rfc010-permission-gate)); the bridge
-      // never requests permission yet, so just allow if it ever does.
+      // This example composes no ask-producing policy (no hooks), so the
+      // bridge never prompts here; answer cancelled (fail closed) if it ever
+      // does — an unexpected prompt must not grant anything.
      return Promise.resolve({ outcome: { outcome: 'cancelled' } })
    },
  })