hilos-agent 0.7.0 → 0.9.0

package/src/config.mjs

@@ -57,6 +57,12 @@ const DEFAULTS = {
   // it still won't run arbitrary commands. Override in hilos-agent.json if you
   // want a stricter (or `--dangerously-skip-permissions`) command.
   codingCmd: "claude -p --permission-mode acceptEdits",
+  // ACP transport opt-in (0759): drive the coding CLI over the Agent Client
+  // Protocol (JSON-RPC on stdio) instead of argv + stdout scraping. Covers
+  // opencode (`opencode acp`) and cursor (`cursor-agent acp`), and only for
+  // runs the workspace already gates with runtime permissions; every other
+  // run keeps the existing paths. Also enabled by HILOS_ACP=1.
+  acpTransport: false,
   // Environment handed to the coding/chat CLI. hilos's own token (HILOS_*) is
   // ALWAYS stripped either way. "inherit" (default) passes the rest of your
   // shell env so the coding tool behaves exactly as if you ran it yourself.
@@ -124,6 +130,7 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
     chatTimeoutMs: process.env.HILOS_CHAT_TIMEOUT_MS ? Number(process.env.HILOS_CHAT_TIMEOUT_MS) : undefined,
     backfill: process.env.HILOS_BACKFILL === "1" ? true : undefined,
     once: process.env.HILOS_ONCE === "1" ? true : undefined,
+    acpTransport: process.env.HILOS_ACP === "1" ? true : undefined,
   };
   const merged = { ...DEFAULTS, ...file };
   for (const [k, v] of Object.entries(env)) if (v !== undefined && v !== "") merged[k] = v;
@@ -155,6 +162,7 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
 // edited file can NEVER drop the daemon's connection.
 const LIVE_FIELDS = [
   "codingCmd",
+  "acpTransport",
   "codingModel",
   "chatCmd",
   "codingEnv",

package/src/daemon.mjs

@@ -16,6 +16,29 @@ export function branchSlug(text, suffix) {
   return `hilos/${base}-${suffix}`;
 }
 
+/**
+ * How to push work when the coding child committed instead of leaving a diff.
+ *
+ * The daemon owns `intendedBranch`. A child that changes branches must not also
+ * change the PR head: if it switches to the configured base branch, using the
+ * child's current branch would ask GitHub to open `main` against `main`. Push
+ * the current HEAD commit under the daemon-owned branch name instead. Omitting
+ * `-u` on recovery also avoids rewriting the accidental branch's upstream.
+ */
+export function selfDrivenShipPlan(currentBranch, intendedBranch) {
+  const current = String(currentBranch || "").trim();
+  const intended = String(intendedBranch || "").trim();
+  if (!intended) throw new Error("An intended task branch is required");
+  const recovered = !current || current !== intended;
+  return {
+    headBranch: intended,
+    pushArgs: recovered
+      ? ["push", "origin", `HEAD:refs/heads/${intended}`]
+      : ["push", "-u", "origin", intended],
+    recoveredFrom: recovered ? current || "detached HEAD" : null,
+  };
+}
+
 /** Truncate a diff to a byte budget at a line boundary. */
 export function truncateDiff(diff, maxBytes = 12000) {
   if (diff.length <= maxBytes) return { text: diff, truncated: false, omittedLines: 0 };

package/src/handler.mjs

@@ -25,6 +25,7 @@ import {
   prTitleBody,
   mentionHandle,
   detectPrContinuation,
+  selfDrivenShipPlan,
 } from "./daemon.mjs";
 import {
   runCli,
@@ -47,6 +48,13 @@ import {
   fastChatCmd,
 } from "./progress-emitter.mjs";
 import { resolveFollowupMode, classifyFollowupCue, normalizeSignal } from "./followup.mjs";
+import {
+  anchorIterateDecision,
+  confirmAnchorOpen,
+  prActionRelayDecision,
+  prActionReply,
+  staleAnchorNote,
+} from "./thread-pr.mjs";
 import { buildResumeArgs, resumeDecision, readStateEntry, writeState, HILOS_DIR } from "./resume.mjs";
 import { createModelArgsResolver } from "./model-resolve.mjs";
 import {
@@ -58,6 +66,7 @@ import {
 import { buildMemoryBlock } from "./memory.mjs";
 import { deployFolder, resolveDeployTarget } from "./deploy.mjs";
 import { runOpenCodeHttpSession } from "./opencode-session.mjs";
+import { runAcpSession } from "./acp-session.mjs";
 
 /**
  * The environment for a coding/chat CLI run. runCli always strips HILOS_* on top
@@ -152,6 +161,7 @@ function defaultDeps() {
     // selected trust boundary without spawning a real model process.
     runCli: (opts) => runCli(opts),
     runOpenCodeHttpSession: (opts) => runOpenCodeHttpSession(opts),
+    runAcpSession: (opts) => runAcpSession(opts),
     // Does a path exist on disk? Injectable so folder mode's "missing folder"
     // guard is unit-testable without touching the real filesystem.
     pathExists: (p) => existsSync(p),
@@ -164,7 +174,7 @@ function defaultDeps() {
         { cwd, env: cwdEnv(cwd), encoding: "utf8" },
       );
       const url = (r.stdout || "").trim().split("\n").filter(Boolean).pop() || null;
-      return { ok: r.status === 0, url, stderr: r.stderr || "" };
+      return { ok: r.status === 0, url, stdout: r.stdout || "", stderr: r.stderr || "" };
     },
     // The open PR for a branch, if one already exists — so when the CLI opened a
     // PR itself we report THAT instead of opening a duplicate.
@@ -189,6 +199,37 @@ function defaultDeps() {
       const out = (r.stdout || "").trim();
       return r.status === 0 && out ? out : null;
     },
+    // The live state of a PR (0704): is it still OPEN, what is its head branch,
+    // and does that head live in the base repo? The staleness guard for adopting
+    // the thread's pull request — a merged/closed anchor must never take a push,
+    // and a fork head is another repository's branch. Returns null when `gh`
+    // can't answer, which the caller reads as "no proof, no adoption".
+    prState: (cwd, ref) => {
+      const r = spawnSync(
+        "gh",
+        [
+          "pr",
+          "view",
+          String(ref),
+          "--json",
+          "state,headRefName,headRepository,headRepositoryOwner",
+        ],
+        { cwd, env: cwdEnv(cwd), encoding: "utf8" },
+      );
+      if (r.status !== 0) return null;
+      try {
+        const j = JSON.parse(r.stdout || "{}");
+        const owner = j.headRepositoryOwner?.login || j.headRepositoryOwner?.name || null;
+        const repo = j.headRepository?.name || null;
+        return {
+          state: typeof j.state === "string" ? j.state : "",
+          headRefName: typeof j.headRefName === "string" ? j.headRefName : null,
+          headRepoFullName: owner && repo ? `${owner}/${repo}` : null,
+        };
+      } catch {
+        return null;
+      }
+    },
     sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
     now: () => Date.now(),
   };
@@ -199,7 +240,13 @@ function defaultDeps() {
  * Both repo and direct-folder runs use this exact callback contract so neither
  * path can accidentally become the ungated exception.
  */
-function openCodePermissionCallbacks({ tool, channelId, threadRoot, runId = null }) {
+function openCodePermissionCallbacks({
+  tool,
+  channelId,
+  threadRoot,
+  runId = null,
+  provider = "opencode",
+}) {
   return {
     requestPermission: async (request) => {
       const detail =
@@ -216,7 +263,7 @@ function openCodePermissionCallbacks({ tool, channelId, threadRoot, runId = null
         channelId,
         threadRootId: threadRoot,
         ...(runId ? { runId } : {}),
-        provider: "opencode",
+        provider,
         vendorSessionId: request.sessionId,
         vendorRequestId: request.vendorRequestId,
         action: request.action,
@@ -241,7 +288,7 @@ function openCodePermissionCallbacks({ tool, channelId, threadRoot, runId = null
       }
       return tool("get_permission_decision", {
         requestId,
-        provider: "opencode",
+        provider,
         vendorSessionId: request.sessionId,
         vendorRequestId: request.vendorRequestId,
         ...(failClosed ? { failClosed: true } : {}),
@@ -268,6 +315,39 @@ export function shouldUseRuntimePermissionBridge({
   );
 }
 
+/** ACP transport opt-in (0759; slice 1 opencode, slice 2 cursor). Only runs
+ * the workspace already gates with runtime permissions qualify, PLUS the
+ * operator's explicit acpTransport flag, and only when the vendor's own
+ * auto-allow escape hatches are absent — over ACP, hilos must be the one
+ * answering asks, so a run configured to never ask has nothing to gate here.
+ * Resumed runs stay on the existing paths: their session continuity contract
+ * is argv/HTTP-shaped and the ACP path does not carry it yet. */
+export function shouldUseAcpTransport({
+  vendor,
+  acpTransport,
+  runtimePermissions,
+  codeArgs,
+  codingCmd,
+  resumeSessionId = /** @type {string | null} */ (null),
+}) {
+  if (acpTransport !== true || resumeSessionId != null) return false;
+  if (runtimePermissions !== true) return false;
+  if (vendor === "opencode") {
+    return shouldUseRuntimePermissionBridge({
+      vendor,
+      runtimePermissions,
+      codeArgs,
+      codingCmd,
+    });
+  }
+  if (vendor === "cursor") {
+    // -f/--force is cursor's "allow everything" switch — the exact analog of
+    // opencode's --auto.
+    return !codeArgs.includes("-f") && !codeArgs.includes("--force");
+  }
+  return false;
+}
+
 async function awaitDecision({ tool, channelId, reportMessageId, cfg, deps, parentId, signal }) {
   if (!reportMessageId) return { kind: "timeout" };
   const deadline = deps.now() + cfg.decisionTimeoutMs;
@@ -431,37 +511,63 @@ async function applyDecision({ decision, repoPath, branch, task, requester, cfg,
  * The coding CLI committed the work itself (autonomous run with skip-permissions
  * in a repo whose docs prescribe a commit+PR flow), so the working tree is clean
  * and the daemon's diff is empty. Don't claim "no changes": adopt what it did —
- * push the branch it's on (no-op if already pushed), reuse the PR it opened or
- * open one, and report it. Used only when NOT gated (bias-to-action).
+ * push its HEAD under the daemon-owned task branch, reuse the PR it opened or
+ * open one, and report it. Keeping the intended head matters: a child that
+ * switched to `main` would otherwise make `gh` try to open main → main. Used
+ * only when NOT gated (bias-to-action).
  */
 async function shipSelfDriven({ repoPath, branch, task, requester, cfg, tool, channelId, deps, parentId, settleId, runId }) {
   const tag = requesterTag(requester);
   const lead = tag ? `${tag} — ` : "";
-  // The agent may have committed on the daemon's branch or switched to one of its
-  // own — push whatever HEAD is on now.
-  const cur =
-    (deps.git(repoPath, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout || "").trim() || branch;
-  const push = deps.git(repoPath, ["push", "-u", "origin", cur]);
-  let prUrl = deps.findPR ? deps.findPR(repoPath, cur) : null;
+  const currentBranch =
+    (deps.git(repoPath, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout || "").trim();
+  const ship = selfDrivenShipPlan(currentBranch, branch);
+  const push = deps.git(repoPath, ship.pushArgs);
+  let prUrl = deps.findPR ? deps.findPR(repoPath, ship.headBranch) : null;
+  let prAttempt = null;
   if (!prUrl && push.status === 0) {
-    const { title, body } = prTitleBody(task, cur);
-    const pr = deps.openPR(repoPath, { title, body, branch: cur, base: cfg.defaultBranch });
-    prUrl = pr.ok && pr.url ? pr.url : null;
+    const { title, body } = prTitleBody(task, ship.headBranch);
+    prAttempt = deps.openPR(repoPath, {
+      title,
+      body,
+      branch: ship.headBranch,
+      base: cfg.defaultBranch,
+    });
+    prUrl = prAttempt.ok && prAttempt.url ? prAttempt.url : null;
   }
-  const { title } = prTitleBody(task, cur);
+  const { title } = prTitleBody(task, ship.headBranch);
+  const recoveredNote = ship.recoveredFrom
+    ? ` The child had switched to \`${ship.recoveredFrom}\`; hilos recovered its HEAD onto \`${ship.headBranch}\`.`
+    : "";
+  const prFailure =
+    prAttempt && !prUrl
+      ? oneLine(
+          (prAttempt.stderr || prAttempt.stdout || "gh did not return a pull request URL").trim(),
+          200,
+        )
+      : "";
   // Seamless single card (0289): settle onto the live status message when one was
   // streaming this run; the workspace setting decides channel visibility.
   // Otherwise post a fresh final report.
   const reportArgs = {
     channelId,
-    title: `Shipped: ${title}`,
+    title: prUrl
+      ? `Shipped: ${title}`
+      : push.status === 0
+        ? `PR failed: ${title}`
+        : `Push failed: ${title}`,
     summary: prUrl
-      ? `${lead}the coding agent committed on \`${cur}\` and opened a pull request.`
+      ? `${lead}the coding agent committed the work itself and opened a pull request from \`${ship.headBranch}\`.${recoveredNote}`
       : push.status === 0
-        ? `${lead}the coding agent committed and pushed \`${cur}\`. Open a PR manually — \`gh\` didn't return one.`
-        : `${lead}the coding agent committed on \`${cur}\` locally, but pushing it failed.`,
+        ? `${lead}the coding agent committed and pushed \`${ship.headBranch}\`, but GitHub rejected PR creation.${recoveredNote}`
+        : `${lead}the coding agent committed locally, but pushing \`${ship.headBranch}\` failed.${recoveredNote}`,
     prUrl: prUrl || undefined,
-    caveats: push.status === 0 ? [] : [`git push failed: ${(push.stderr || "").trim().slice(0, 200)}`],
+    caveats:
+      push.status !== 0
+        ? [`git push failed: ${(push.stderr || "").trim().slice(0, 200)}`]
+        : prFailure
+          ? [`gh pr create failed: ${prFailure}`]
+          : [],
   };
   await tool(
     "post_report",
@@ -475,11 +581,25 @@ async function shipSelfDriven({ repoPath, branch, task, requester, cfg, tool, ch
     await tool("update_run", {
       runId,
       ...(prUrl ? { prUrl } : {}),
-      status: "awaiting_review",
+      status: prUrl ? "awaiting_review" : "failed",
+      ...(!prUrl
+        ? {
+            reason:
+              push.status !== 0
+                ? oneLine((push.stderr || "git push failed").trim(), 300)
+                : prFailure || "GitHub did not return a pull request URL",
+          }
+        : {}),
       ...(settleId ? { reportMsgId: settleId } : {}),
     }).catch(() => {});
   }
-  return { status: push.status === 0 ? "pushed" : "commit-local", branch: cur, prUrl };
+  const status =
+    push.status !== 0 ? "commit-local" : prUrl ? "pushed" : "pr-failed";
+  return {
+    status,
+    branch: ship.headBranch,
+    prUrl,
+  };
 }
 
 // Sentinel the router model emits when the latest message is a request to change
@@ -1406,13 +1526,39 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
       }
     };
     try {
-      const useRuntimePermissionBridge = shouldUseRuntimePermissionBridge({
+      const useAcpTransport = shouldUseAcpTransport({
         vendor,
+        acpTransport: cfg.acpTransport,
         runtimePermissions: caps.runtimePermissions,
         codeArgs,
         codingCmd: cfg.codingCmd,
       });
-      if (useRuntimePermissionBridge) {
+      const useRuntimePermissionBridge =
+        !useAcpTransport &&
+        shouldUseRuntimePermissionBridge({
+          vendor,
+          runtimePermissions: caps.runtimePermissions,
+          codeArgs,
+          codingCmd: cfg.codingCmd,
+        });
+      if (useAcpTransport) {
+        run = await deps.runAcpSession({
+          cmd: parts[0],
+          vendor,
+          cwd: folderPath,
+          prompt: memoryPreamble(workspaceMemory) + promptText,
+          timeoutMs: cfg.runTimeoutMs,
+          signal,
+          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          onData: handleCliData,
+          ...openCodePermissionCallbacks({
+            tool,
+            channelId,
+            threadRoot,
+            provider: vendor,
+          }),
+        });
+      } else if (useRuntimePermissionBridge) {
         run = await deps.runOpenCodeHttpSession({
           cmd: parts[0],
           args: codeArgs,
@@ -1738,6 +1884,43 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     }
   }
 
+  // MERGE / CLOSE RELAY (0704): "merge it" in a PR thread used to get an answer
+  // describing the button a human should press. Now it is executed — through the
+  // server, which is the authority: merge_pr / close_pr take the id of the human
+  // message that asked, re-classify that text with a forced-tool model call, and
+  // check the author's workspace role before spending the App's write token. The
+  // daemon carries no new trust; it only stops swallowing the request.
+  //
+  // Runs BEFORE the chat/code split for the same reason the server runs it before
+  // the coding gates: a merge instruction must never be read as a request to
+  // start a new run. Every "no" here falls through to today's behavior.
+  {
+    const relay = prActionRelayDecision({
+      body: message.body,
+      threadPr: message.threadPr,
+      mode,
+      // A manager-routed dispatch is a brief to implement, not an instruction to
+      // land something — its body is assembled text, never a person's sentence.
+      canRelay: Boolean(caps.prActions) && !message.dispatch,
+    });
+    if (relay.relay) {
+      const verb = relay.action;
+      console.log(`  ${verb} → relaying PR #${relay.anchor.prNumber} to the server (it decides)`);
+      const result = await tool(verb === "merge" ? "merge_pr" : "close_pr", {
+        channelId,
+        // The mention itself is the instruction on record. The server verifies
+        // it is a human's message, in this channel, from an owner or admin, and
+        // that it really asks for THIS action — citing anything else fails.
+        instructionMessageId: message.id,
+      }).catch((e) => ({ ok: false, error: `I couldn't reach hilos to ${verb} that pull request: ${e?.message || e}` }));
+      const reply = prActionReply(result);
+      if (reply.post) {
+        await tool("post_message", { channelId, parentId, body: reply.post }).catch(() => {});
+      }
+      return { status: reply.ok ? `pr-${verb}d` : "pr-action-refused", action: verb };
+    }
+  }
+
   // No repo linked → either FOLDER mode (0322: a channel mapped to a plain local
   // folder can still get coding work done) or, failing that, just reply. A linked
   // repo always wins — the folder map is only consulted when there's no repo link.
@@ -2034,22 +2217,65 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   git(repoPath, ["fetch", "origin", cfg.defaultBranch]);
 
   // Same-branch iteration: continue an existing PR on its own branch and push
-  // onto it, so the PR updates in place instead of a duplicate opening. Two ways
+  // onto it, so the PR updates in place instead of a duplicate opening. Three ways
   // in, and an explicit token WINS when both apply (they agree — same PR):
   //   1. detectPrContinuation — an explicit "PR <url>" in the text (the server's
   //      "request changes" rework ping, or a person naming a PR). The fallback.
   //   2. the run resolver's 'iterate' (0281) — a plain follow-up reply in a thread
   //      whose run already owns an OPEN PR. The PRIMARY path.
+  //   3. the THREAD ANCHOR (0704) — no active run owns this thread, but the server
+  //      says (on list_mentions, as `threadPr`) that the thread is about a pull
+  //      request: a second agent asked here, or a reply long after the first run
+  //      settled, still amends THAT PR. Same shape as the server's own anchor
+  //      fallback, and it never overrides 1 or 2.
   // Otherwise, a fresh branch off the default (today's behavior).
   const cont = detectPrContinuation(message.body, repoFullName);
-  const iterateUrl = cont?.url || (followupMode === "iterate" && activeRun?.prUrl) || null;
+  const runIterateUrl = (followupMode === "iterate" && activeRun?.prUrl) || null;
+  // The anchor is a HYPOTHESIS (its recorded state may be stale or unknown);
+  // `gh` is the proof. No proof, no adoption — the run cuts a fresh branch and
+  // says so on the status card rather than pushing onto a merged PR.
+  let anchorAdopt = null;
+  let anchorNote = "";
+  if (!cont?.url && !runIterateUrl) {
+    const decision = anchorIterateDecision({
+      threadPr: message.threadPr,
+      repoFullName,
+      signal: followupSignal,
+    });
+    if (decision.adopt && deps.prState) {
+      const live = deps.prState(repoPath, decision.anchor.prUrl);
+      const confirmed = confirmAnchorOpen({ live, anchor: decision.anchor });
+      if (confirmed.ok) {
+        anchorAdopt = {
+          prUrl: decision.anchor.prUrl,
+          prNumber: decision.anchor.prNumber,
+          branch: confirmed.branch,
+        };
+        console.log(
+          `  code → thread anchor: PR #${decision.anchor.prNumber} is open on \`${confirmed.branch}\` — adopting it`,
+        );
+      } else {
+        anchorNote = staleAnchorNote({ reason: confirmed.reason, anchor: decision.anchor });
+        console.log(
+          `  ! thread anchor PR #${decision.anchor.prNumber} not adopted (${confirmed.reason}) — new branch`,
+        );
+      }
+    } else if (decision.adopt) {
+      anchorNote = staleAnchorNote({ reason: "unverified", anchor: decision.anchor });
+    } else if (decision.reason === "anchor-merged" || decision.reason === "anchor-closed") {
+      anchorNote = staleAnchorNote({ reason: decision.reason, anchor: decision.anchor });
+    }
+  }
+  const iterateUrl = cont?.url || runIterateUrl || anchorAdopt?.prUrl || null;
   let branch = null;
   let continuingPrUrl = null;
-  if (iterateUrl && deps.prHeadRef) {
+  if (iterateUrl && (deps.prHeadRef || anchorAdopt)) {
     // Resolve the PR's head branch (source of truth); for a run-based iterate the
-    // run's recorded branch is a fallback if gh can't view the PR.
+    // run's recorded branch is a fallback if gh can't view the PR. An adopted
+    // anchor already has its head branch straight from the live PR.
     const headRef =
-      deps.prHeadRef(repoPath, iterateUrl) ||
+      (anchorAdopt?.prUrl === iterateUrl ? anchorAdopt.branch : null) ||
+      deps.prHeadRef?.(repoPath, iterateUrl) ||
       (followupMode === "iterate" ? activeRun?.branch || null : null);
     if (headRef) {
       // Fetch the PR branch, then point a local branch at its tip via FETCH_HEAD
@@ -2067,6 +2293,12 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
         console.log(
           `  ! couldn't check out PR branch \`${headRef}\` (falling back to a new branch): ${(sw.stderr || "").trim().slice(0, 200)}`,
         );
+        // An adopted anchor that can't be checked out is the same broken promise
+        // as a stale one — the thread asked about a PR and gets a new branch, so
+        // the status card has to say it.
+        if (anchorAdopt?.prUrl === iterateUrl) {
+          anchorNote = staleAnchorNote({ reason: "checkout-failed", anchor: anchorAdopt });
+        }
       }
     }
   }
@@ -2118,6 +2350,12 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   } else if (effectiveMode === "redirect") {
     const n = activeRun?.prNumber || prNumberFromUrl(activeRun?.prUrl);
     ackBody = `Starting a new PR${n ? ` (separate from #${n})` : ""} on \`${branch}\`.`;
+  } else if (anchorNote) {
+    // The thread is about a pull request this run could NOT adopt (0704). Say it
+    // on the status card itself — silence here would read as "pushing to my PR"
+    // while a fresh branch is being cut. Still one card, per the run-output
+    // contract: no extra chat message.
+    ackBody = `${anchorNote} ${ackBody}`;
   }
   const ack = await tool("post_message", { channelId, parentId, body: ackBody });
   const ackId = ack?.messageId ?? null;
@@ -2186,7 +2424,14 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   }
   // Keep the inspectable continuation/redirect statement (don't overwrite it with
   // an LLM plan) so a human can correct the routing before code lands.
-  if (ackId && caps.editMessage && chatCmdFor(cfg) && !continuingPrUrl && effectiveMode !== "redirect") {
+  if (
+    ackId &&
+    caps.editMessage &&
+    chatCmdFor(cfg) &&
+    !continuingPrUrl &&
+    !anchorNote &&
+    effectiveMode !== "redirect"
+  ) {
     // Feed the ack the router's distilled brief AND the conversation — not the raw
     // mention — so it states a real plan instead of "what's the task?".
     const plan = await proposePlanAck({
@@ -2392,13 +2637,41 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
       // unless --auto is present. For the gated tiers, bypass that responder
       // and own the authenticated HTTP session + SSE stream directly so hilos
       // is the sole authority answering the paused tool call (0593).
-      const useRuntimePermissionBridge = shouldUseRuntimePermissionBridge({
+      const useAcpTransport = shouldUseAcpTransport({
         vendor,
+        acpTransport: cfg.acpTransport,
         runtimePermissions: caps.runtimePermissions,
         codeArgs,
         codingCmd: cfg.codingCmd,
+        resumeSessionId: resume ? resumeSessionId : null,
       });
-      if (useRuntimePermissionBridge) {
+      const useRuntimePermissionBridge =
+        !useAcpTransport &&
+        shouldUseRuntimePermissionBridge({
+          vendor,
+          runtimePermissions: caps.runtimePermissions,
+          codeArgs,
+          codingCmd: cfg.codingCmd,
+        });
+      if (useAcpTransport) {
+        run = await deps.runAcpSession({
+          cmd: parts[0],
+          vendor,
+          cwd: repoPath,
+          prompt: memoryPreamble(workspaceMemory) + promptText,
+          timeoutMs: cfg.runTimeoutMs,
+          signal,
+          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          onData: handleCliData,
+          ...openCodePermissionCallbacks({
+            tool,
+            channelId,
+            threadRoot,
+            runId,
+            provider: vendor,
+          }),
+        });
+      } else if (useRuntimePermissionBridge) {
         run = await deps.runOpenCodeHttpSession({
           cmd: parts[0],
           args: codeArgs,

package/src/progress-emitter.mjs

@@ -16,7 +16,7 @@
 //   - Defense-in-depth: every string is re-sanitized here (the parser already
 //     redacts, the server will redact again) and arrays are clamped.
 
-import { createStepRing, sanitizeText } from "./agent-events.mjs";
+import { createActivityFold, createStepRing, sanitizeText } from "./agent-events.mjs";
 
 /**
  * Which parser/stream-flags a coding command wants, from its FIRST token.
@@ -225,6 +225,9 @@ export function createProgressEmitter({
   clearTimer = defaultClearTimer,
 } = {}) {
   const ring = createStepRing(stepLimit);
+  // The ring's richer sibling (0750): structured rows for the activity feed.
+  // Older servers drop the unknown field; newer ones render it (0537).
+  const activity = createActivityFold();
   const files = [];
   const fileSet = new Set();
   const startedAt = now();
@@ -250,6 +253,7 @@ export function createProgressEmitter({
   function fold(ev) {
     if (!ev || typeof ev !== "object") return;
     ring.push(ev); // steps[] (coalesces same-file edits + dup labels)
+    activity.push(ev); // feed rows (tense follows status; server re-validates)
     switch (ev.t) {
       case "session":
         if (ev.sessionId) sessionId = ev.sessionId;
@@ -275,6 +279,7 @@ export function createProgressEmitter({
   /**
    * The current live progress payload (also what `send` receives).
    * @returns {{ state: string, phase?: string, step?: string, steps: string[],
+   *   activity?: {kind: string, text: string, status: string, n?: number}[],
    *   filesTouched: string[], lastLine?: string, elapsedMs: number, sessionId?: string }}
    */
   function snapshot() {
@@ -287,6 +292,8 @@ export function createProgressEmitter({
     };
     if (phase) snap.phase = sanitizeText(phase);
     if (step) snap.step = sanitizeText(step);
+    const rows = activity.list();
+    if (rows.length) snap.activity = rows;
     const ll = sanitizeText(lastLine);
     if (ll) snap.lastLine = ll;
     if (sessionId) snap.sessionId = sanitizeText(sessionId); // for 0282 (server drops it today)
@@ -373,6 +380,9 @@ export function createProgressEmitter({
       }
       for (const ev of tail) fold(ev);
       state = finalState === "error" ? "error" : "done";
+      // Settle the in-flight row instead of leaving "Editing…" forever; only
+      // an error finish marks it failed (mirrors lib/hosted-progress.ts).
+      activity.settle(state === "error" ? "failed" : "done");
       if (state === "error") {
         const r = sanitizeText(reason);
         if (r) errorMessage = r;

package/src/run.mjs

@@ -99,6 +99,11 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
     // Semantic local-folder intent (0515): the server guarantees a forced-tool
     // ask/ship/deploy decision. Older servers fall back to the local router.
     agentIntent: toolNames.includes("classify_agent_intent"),
+    // Relaying a human's merge/close instruction (0701/0704). Both tools are
+    // required; on an older server the daemon simply never relays and behaves
+    // exactly as before. The authority is the server's either way — the daemon
+    // only passes along the id of the message that asked.
+    prActions: toolNames.includes("merge_pr") && toolNames.includes("close_pr"),
     // Harness-enforced runtime permission bridge (0593). Both tools are
     // required: a request without a durable reply path must fail closed.
     runtimePermissions: