@wrongstack/acp 0.292.1 → 0.293.0

package/dist/index.js

@@ -1916,7 +1916,7 @@ var ACPSession = class _ACPSession {
       termOpts.outputByteLimit = opts.terminalOutputByteLimit;
     }
     this.terminalServer = new TerminalServer(termOpts);
-    this.permissionPolicy = opts.permissionPolicy ?? defaultPermissionPolicy;
+    this.permissionPolicy = opts.permissionPolicy ?? readOnlyPermissionPolicy;
   }
   // ──────────────────────────────────────────────────────────────────────
   // Public accessors
@@ -2731,11 +2731,12 @@ var ACPSession = class _ACPSession {
    * closing the gap where the agent simply skips the voluntary permission
    * request and sends the privileged callback directly.
    *
-   * Uses the session's permission policy. The default policy
-   * (`defaultPermissionPolicy`) auto-approves everything — this is correct
-   * for trusted local agents (CLI `acp spawn`, Director fan-out). For
-   * untrusted/remote agents, the host should inject
-   * `readOnlyPermissionPolicy` or an interactive policy.
+   * Uses the session's permission policy. The default
+   * (`readOnlyPermissionPolicy`) auto-approves only side-effect-free tool
+   * calls (read/search/fetch/think) and rejects everything else — this is
+   * the safe-by-default posture. For trusted local agents (CLI `acp spawn`,
+   * Director fan-out), inject `defaultPermissionPolicy` to grant
+   * write/execute access.
    *
    * Returns true if the callback is authorized, false if denied.
    */
@@ -2747,7 +2748,8 @@ var ACPSession = class _ACPSession {
           toolCallId: partial.toolCallId,
           title: partial.title,
           kind: partial.kind,
-          status: "pending"
+          status: "pending",
+          ...partial.rawInput ? { rawInput: partial.rawInput } : {}
         },
         options: [
           { optionId: "allow", name: "Allow", kind: "allow_once" },
@@ -2772,7 +2774,8 @@ var ACPSession = class _ACPSession {
       const allowed = await this.authorizeCallback({
         toolCallId: `acp-fs-write-${id}`,
         title: `Write file: ${params.path}`,
-        kind: "edit"
+        kind: "edit",
+        rawInput: { path: params.path, sessionId: params.sessionId }
       });
       if (!allowed) {
         await this.sendErrorResponse(id, -32602, "filesystem write denied by permission policy");
@@ -2810,7 +2813,8 @@ var ACPSession = class _ACPSession {
           const allowed = await this.authorizeCallback({
             toolCallId: `acp-terminal-create-${id}`,
             title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
-            kind: "execute"
+            kind: "execute",
+            rawInput: { command: params.command, args: params.args, cwd: params.cwd, sessionId: params.sessionId }
           });
           if (!allowed) {
             await this.sendErrorResponse(id, -32602, "terminal create denied by permission policy");
@@ -3768,6 +3772,9 @@ async function runOne(agentId, cmd, task, timeoutMs, signal, onProgress) {
     const { runner, stop } = await makeACPSubagentRunnerWithStop({
       ...cmd,
       timeoutMs,
+      // CLI /acp parallel and Director fan-out are trusted local agents — grant write/execute access.
+      // The session default is read-only for untrusted agents (acp-session.ts:221).
+      permissionPolicy: defaultPermissionPolicy,
       ...onProgress ? { onProgress: (event) => onProgress(agentId, event) } : {}
     });
     try {