Integrate ACP permission roundtrip

[simple-agent-manager]

Problem and result

PRs #2200 and #2201 implement the browser and runtime halves of ACP permission interaction separately. This PR integrates the exact parent-reviewed heads into a current-main branch and prepares one pinned staging validation through browser → Worker InteractionStore → live VM/Instant runtime → ACP callback.

Exact source heads:

• UI feat(web): add ACP permission cards to project chat #2200: e13a166b5b14860b99922211927dc1e0941087a4
• Runtime feat(acp): bridge runtime permission requests #2201: 96df904f7f847b84a2cb86df98439a19634a8612

The production default remains disabled. Forms and URL elicitation remain unadvertised. The parent reviewed the integration changes and Raphaël authorized release on September 30. This PR ships the runtime/UI code with creation disabled; activation follows a separate verified rollout.

Integration-only changes

• Forward six typed ACP runtime limits through both reusable deployment phases and Wrangler synchronization.
• Forward three typed ACP browser polling controls into the Vite build and synchronize the public configuration reference.
• Classify Instant RUNTIME_STOPPED as a terminal interrupted delivery after one no-wake probe instead of retrying an ambiguous outcome.
• Stabilize the Playwright jump-control geometry wait and restore the validated card position before screenshot capture. These are test synchronization/capture changes only.
• Make the Instant local launcher resolve ACP adapters from absolute directories in the merged profile runtime PATH, matching explicit VM runtime selection while preserving Go ErrDot protection; create the workdir before resolution and include checked-in Claude/Codex fixture aliases.
• Remove four redundant checked-in task-reconciliation timing vars after pinned deploy 36718788997 failed closed at 344 generated text bindings versus the 340 guard. Their environment override paths remain and shared typed fallbacks are identical; the guard was not raised.

No production default changed.

Validation

• focused API: 125 tests plus 29 delivery/no-wake regression tests
• Worker vertical slice: 1 test
• focused web: 148 tests
• deployment/fixture: 48 tests; post-failure deploy/sync regression rerun: 92/92
• full Go go test ./...
• final Instant launcher tests: absolute runtime PATH, relative PATH=. rejection, missing-workdir creation, plus focused race run
• integrated Playwright audit: 48/48; post-review 375×667 + 1280×800 rerun: 24/24
• root lint, typecheck, and build

The root aggregate test run had one unrelated cloud-init test exceed its 5-second timeout under concurrent load (5.7 seconds); its package rerun passed 176/176.

Staging Verification

Exact candidate bb853a04eb8247718b5b2ea1f5deacecbe57c955 passed CI 36719533047, E2E Smoke 36719533017, and CodSpeed 36719532995. Final evidence head aecaf205f405442eaabfbb5b98503e5901219128 passed CI 36736970003, E2E Smoke 36736969713, and CodSpeed 36736969918. Candidate deploy 36722105512 succeeded with temporary staging-only permission overrides; production was read-only and its ACP override remained unset.

The real project-chat UI completed the reversed-option fixture through Worker InteractionStore and the live runtime callback on both runtimes:

Runtime	Session	Workspace / node	Results
Instant	6104086e-f1da-4119-b9f5-d1675265b7ec	01M3SAZK3CF6FRBM035ZY272H1 / 01M3SAZJWS9WH9SNPZPFT0MVZS	allow, then reject; both delivery_confirmed
VM	79b4bd52-22db-4a62-bef0-9dbe380ad6a5	01M3SDJSPPBSYKW5DQ5WZF95Q7 / 01M3SDAM8H6C58YWG91S43JWTK	allow, then reject; both delivery_confirmed

Each runtime received its second permission request on the same ACP prompt/connection. The browser page was closed and recreated while that request was pending, then recovered it from InteractionStore. A later live VM generation d0009375-56af-473a-bcd7-27757b690fb2 proved same-key/same-body replay returns 200 and a conflicting answer returns 409. Noncreator list/detail/answer returned 200 structural-only/403/403, cross-project detail returned 404, and 5,957 bytes of bounded creator/secondary snapshots plus transcript contained no raw request canary.

All owned workspaces, nodes, and profiles were deleted; the authoritative D1 query returned zero live owned nodes. The five temporary staging overrides were removed. Restoration deploy 36736535610 and its smoke tests passed at the same SHA with the checked-in creation flag false; staging and production environment listings contain no ACP overrides.

Staged screenshots: .codex/tmp/acp-cf-container-muo74b3k-{desktop,mobile}.png and .codex/tmp/acp-vm-muo8qksb-{desktop,mobile}.png. Fixture behavior is not presented as actual provider-account emission. Actual Codex and Claude account emission remain unproven rollout gaps.

UI Screenshot Evidence

Surface: Project chat ACP permission cards

• Desktop evidence: Playwright captures reviewed by the parent in feat(web): add ACP permission cards to project chat #2200 (comment)
• Mobile evidence: Playwright captures reviewed by the parent in feat(web): add ACP permission cards to project chat #2200 (comment)
• Mock/stress data used: owner and noncreator roles; anchored and unanchored requests; 30+ lifecycle rows; long title, description, URL-like text, special characters, long reversed option labels; detail error and revoked-access states; lost receipt; two-tab conflict.
• Screenshot quality review: the parent and implementation reviewers inspected the Playwright desktop, 375px, 320px, retry, and clearance captures for layout quality, overflow, clipping, readability, hit-target clearance, and responsive behavior. The source review found no remaining visual issue. Integration review then restored the validated anchored-card position before capture and reran both required viewports successfully.

End-to-End Verification

Live VM and Instant runs prove browser → Worker InteractionStore → runtime → ACP callback delivery, exact reversed options, a second request without reconnecting the runtime, browser reconnect, replay/conflict, authorization, and bounded transcript privacy. A separate fixture session proved ordinary message transport.

Fresh deterministic reruns passed 50 API route/config cases, 9 Worker/InteractionStore vertical cases, 24 web card cases, and the focused Go race suite. These cover the full 64 KiB response contract, feature-off/version behavior, encrypted purge, deliberately lost receipts, cancellation/deadline/Stop/process loss, recreated-generation fencing, and VM/Instant stopped or stale-running no-wake behavior. Those fault cases remain labeled deterministic rather than staged fault injection.

Specialist Review Evidence

• All local reviewers completed and findings addressed before staging
• Parent integration-delta review passed: Integrate ACP permission roundtrip #2202 (comment)

Reviewer	Status	Outcome
task-completion-validator	PASS	Implementation and staged matrix complete; closure evidence refreshed after restoration deploy and final-head CI passed
go-specialist	PASS	Final 0cb2265c2 launcher re-review passed: absolute runtime PATH, ErrDot preservation, workdir ordering, and focused race tests
security-auditor	PASS	Final 0cb2265c2 absolute-path launcher re-review passed with no findings
cloudflare-specialist	PASS	RUNTIME_STOPPED now terminalizes without wake or retry
ui-ux-specialist	PASS	Capture-position fix and refreshed mobile/desktop images passed
env-validator	PASS	Runtime deploy mappings added and tested
constitution-validator	PASS	Frontend Vite mappings match typed defaults and are contract-tested
doc-sync-validator	PASS	Public env reference and rollout wording synchronized
test-engineer	PASS	Meaningful local vertical coverage; actual process loss remains for staging

CodeRabbit Review Evidence

Parent release review passed at aecaf205f. The trusted label-triggered workflow 36740928176 requested review at 15:59:50 UTC on September 30. CodeRabbit replied “Review rate limited” at 16:00:15 UTC. At the 16:15+ UTC checkpoint, no reviews or inline findings had arrived. The required ~15-minute wait is complete; per the standing best-effort policy, release proceeds on the other passing gates without claiming a CodeRabbit review occurred. No repeated trigger was sent.

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: this integration uses the approved internal v2 idea 01M3P2E0JJNQRXX020P65ZRKEJ and the exact parent-reviewed source heads. It adds no external API.

Codebase Impact Analysis

• apps/web: project-chat permission rendering, exact-option submission, reconnect/recovery polling, and Playwright evidence.
• apps/api: Cloudflare interaction authority, delivery, no-wake VM/Instant routing, and deploy configuration.
• packages/vm-agent: live ACP callback bridge, waiter lifecycle, generation and receipt fencing.
• packages/shared: versioned ACP interaction contracts and defaults.
• scripts/ and .github/: deployment-variable forwarding and contract tests.
• apps/www/: public configuration reference.

Documentation & Specs

The active integration task records the exact pins, data flow, rollout, security boundaries, narrow integration fixes, validation matrix, and pending staged evidence. Public configuration documentation now includes the added Worker/runtime and browser controls.

Constitution & Risk Check

Reviewed Principles IV and XI plus Cloudflare, VM agent, UI, environment, security, request-budget, and no-wake rules. Production creation remains false. Deadlines and bounds use typed configurable defaults, browser answers use exact option IDs, decrypted detail stays creator-only and no-store, and browser delivery remains Cloudflare-only. Staging is isolated to one authorized candidate after live contention checks.

Release scope

This merge deploys the reviewed permission runtime/UI with ACP_INTERACTIONS_ENABLED=false. Activation remains a separate reviewed rollout owned by task 01M3SGW0R90DNABPXMNPHZ6041, including old-runtime continuation safety. C1 forms are in task 01M3SGWNFG7NGAY788GA465P25; C2 URLs and D diagnostics remain pending. Existing active workspaces will not be forcibly stopped for rollout.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 13 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: raphaeltm/simple-agent-manager/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 052ebd46-cfdb-4c24-ac0b-c7d7aa1c9884

📥 Commits

Reviewing files that changed from the base of the PR and between 762a97c and aecaf20.

📒 Files selected for processing (72)

• .claude/skills/env-reference/SKILL.md
• .github/workflows/deploy-reusable.yml
• apps/api/.env.example
• apps/api/src/durable-objects/vm-agent-container.ts
• apps/api/src/env.ts
• apps/api/src/routes/projects/acp-interaction-callback.ts
• apps/api/src/services/acp-interaction-config.ts
• apps/api/src/services/acp-interaction-delivery.ts
• apps/api/src/services/acp-interaction-runtime-config.ts
• apps/api/src/services/node-agent.ts
• apps/api/src/services/vm-agent-container.ts
• apps/api/src/services/vm-prompt-delivery-adapter-schemas.ts
• apps/api/tests/acp-interaction-delivery.test.ts
• apps/api/tests/acp-interaction-runtime-config.test.ts
• apps/api/tests/unit/durable-objects/vm-agent-container-wake-state.test.ts
• apps/api/tests/unit/routes/acp-interaction-callback.test.ts
• apps/api/tests/unit/services/vm-agent-container-guard.test.ts
• apps/api/tests/unit/services/vm-prompt-delivery-adapter.test.ts
• apps/api/tests/unit/vm-agent-cross-boundary-contract.test.ts
• apps/api/tests/workers/acp-interaction-vertical-slice.test.ts
• apps/api/wrangler.toml
• apps/web/.env.example
• apps/web/src/components/project-message-view/AcpPermissionCard.tsx
• apps/web/src/components/project-message-view/ConversationPane.tsx
• apps/web/src/components/project-message-view/FloatingHeader.tsx
• apps/web/src/components/project-message-view/MessageListScaffold.tsx
• apps/web/src/components/project-message-view/SessionMessageView.tsx
• apps/web/src/components/project-message-view/comments/CommentableConversationItem.tsx
• apps/web/src/components/project-message-view/useAcpPermissionCard.ts
• apps/web/src/components/project-message-view/useAcpPermissionPlacement.tsx
• apps/web/src/hooks/useAcpPermissionInteractions.ts
• apps/web/src/lib/api/acp-interactions.ts
• apps/web/src/lib/api/index.ts
• apps/web/src/lib/poll-intervals.ts
• apps/web/src/pages/project-chat/index.tsx
• apps/web/src/vite-env.d.ts
• apps/web/tests/playwright/acp-permission-chat-audit.spec.ts
• apps/web/tests/unit/components/acp-permission-card.test.tsx
• apps/web/tests/unit/components/project-message-view.test.tsx
• apps/web/tests/unit/hooks/useAcpPermissionInteractions.test.tsx
• apps/web/tests/unit/pages/project-chat.test.tsx
• apps/www/src/content/docs/docs/reference/configuration.md
• packages/acp-client/src/components/PermissionDialog.tsx
• packages/acp-client/src/index.ts
• packages/shared/src/acp-interactions.ts
• packages/vm-agent/internal/acp/gateway.go
• packages/vm-agent/internal/acp/process.go
• packages/vm-agent/internal/acp/process_test.go
• packages/vm-agent/internal/acp/session_host.go
• packages/vm-agent/internal/acp/session_host_attempt.go
• packages/vm-agent/internal/acp/session_host_client.go
• packages/vm-agent/internal/acp/session_host_interaction_transport.go
• packages/vm-agent/internal/acp/session_host_interactions.go
• packages/vm-agent/internal/acp/session_host_interactions_sdk_test.go
• packages/vm-agent/internal/acp/session_host_interactions_test.go
• packages/vm-agent/internal/acp/session_host_prompt.go
• packages/vm-agent/internal/acp/session_host_prompt_state.go
• packages/vm-agent/internal/acp/session_host_startup.go
• packages/vm-agent/internal/server/execution_protocol_test.go
• packages/vm-agent/internal/server/server.go
• packages/vm-agent/internal/server/workspaces.go
• scripts/deploy/sync-wrangler-config.ts
• scripts/e2e/workspace-mock/claude-agent-acp
• scripts/e2e/workspace-mock/codex-acp
• scripts/e2e/workspace-mock/mock-acp-agent.sh
• scripts/quality/deploy-reusable-workflow.test.ts
• scripts/quality/mock-acp-agent.test.ts
• specs/001-mvp/contracts/api.md
• tasks/active/2026-09-30-acp-permission-chat-ui.md
• tasks/active/2026-09-30-acp-runtime-permission-bridge.md
• tasks/active/2026-09-30-integrate-acp-permissions.md
• tests/fixtures/durable-execution-protocol-v1.json

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/integrate-reviewed-acp-permission-y13mkt (aecaf20) with main (762a97c)}

[sonarqubecloud]

Quality Gate passed

Issues
21 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.2% Duplication on New Code

See analysis details on SonarQube Cloud

[simple-agent-manager]

Parent review handoff (task 01M3RT1PBZNM57EMC00B7ZXAEK was cancelled before direct SAM delivery):

• Final evidence head: aecaf205f405442eaabfbb5b98503e5901219128; CI 36736970003, E2E Smoke 36736969713, and CodSpeed 36736969918 all passed.
• Exact source ancestors: runtime 96df904f7f847b84a2cb86df98439a19634a8612, UI e13a166b5b14860b99922211927dc1e0941087a4.
• Pinned candidate bb853a04eb8247718b5b2ea1f5deacecbe57c955: CI 36719533047 and staging deploy 36722105512 passed.
• Live Instant session 6104086e-f1da-4119-b9f5-d1675265b7ec and VM session 79b4bd52-22db-4a62-bef0-9dbe380ad6a5 proved the real browser → Worker InteractionStore → live runtime → ACP callback path twice per connection with reversed options, browser reconnect, and delivery_confirmed results. VM generation d0009375-56af-473a-bcd7-27757b690fb2 also proved replay/conflict/auth/privacy behavior.
• All owned workspaces/nodes/profiles were deleted; authoritative D1 query returned zero live nodes. All five temporary staging overrides were removed. Restoration deploy 36736535610, including smoke tests, passed with checked-in ACP_INTERACTIONS_ENABLED=false. Production was never mutated.
• The PR body separates integration-only fixes, live evidence, deterministic-only fault evidence, and the remaining unproven actual Codex/Claude account-emission gaps.

PR intentionally remains draft/open. No readiness, CodeRabbit, merge, or production action was taken.

[simple-agent-manager]

Parent release review at aecaf205f405442eaabfbb5b98503e5901219128:

Raphaël explicitly authorized readiness, merge and production rollout after satisfactory testing and review on September 30. This supersedes the previous parent release hold; it does not waive quality gates.

I personally reviewed the integration-only delta from 399883884 through the final head: runtime/frontend deployment mappings, terminal stopped-runtime classification, absolute-path Instant adapter resolution with relative-path protection, identical typed reconciliation defaults replacing redundant text bindings, and screenshot synchronization. I found no blocking issue in that delta. Both exact previously reviewed source heads remain ancestors, and the final head has no code changes beyond staged candidate bb853a04e (only task evidence). Final CI and recorded specialist gates pass.

The live VM/Instant fixture evidence proves permission transport, reconnect, repeat requests, and exact-option behavior; it does not prove actual provider-account permission emission. Before activation, Sol task 01M3SGEF9XHDY61ZJXDV784DCJ is closing pinned-wrapper behavior, old-runtime compatibility, and intentional activation/rollback evidence. Production remains disabled meanwhile. Forms (C1), remote URL elicitation (C2), and auth diagnostics (D) remain separate pending delivery; this PR must not be described as the whole feature.

Current coordinating parent: 01M3SG06CFJYF7F6HVJXHTFTN1. C1 implementation: 01M3SGFABN677MVFFCQ47FCPAF. CodeRabbit has not yet been requested for the final release-ready state.

[raphaeltm]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[simple-agent-manager]

Production deployment verified for #2202:

• Merge 86e6c5b75439cb2f495cc87f3b245fcd04d6c3f2; main CI 36742994154 passed.
• Deploy Production 36744720219 completed successfully, including deployment marker.
• Independent Cloudflare read-back: VM_AGENT_REQUIRED_VERSION is the exact merge SHA; ACP_INTERACTIONS_ENABLED=false.
• API health returned 200/healthy and app returned 200 at 16:48:32 UTC on September 30.

This is the dormant permission runtime/UI release. Activation, forms, remote URL elicitation, and auth diagnostics remain in the coordinated workflow. Existing active workspaces are preserved. Source UI PR #2200 has a later test-only clearance improvement (fca210a90) absent from this integration; parent reviewed it and assigned preservation in the C1 follow-up. No application-code delta was omitted.