code-puppy-core-plugins 0.0.104__tar.gz → 0.0.106__tar.gz

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-puppy-core-plugins
-Version: 0.0.104
+Version: 0.0.106
 Summary: Official plugin bundle for Code Puppy
 Project-URL: Repository, https://github.com/mpfaffenberger/code_puppy_core_plugins
 Project-URL: Homepage, https://github.com/mpfaffenberger/code_puppy_core_plugins

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/code_puppy_core_plugins/acp/README.md

@@ -86,27 +86,31 @@ plugin's protocol layer changed.
 |----------|--------|
 | **Protocol layer** | **Official `acp` SDK.** We implement its `Agent` interface; `acp.run_agent` owns stdio + framing. |
 | **Who does I/O** | **Delegated to the client when the client supports it.** Workspace file reads/writes go through the client's `fs/read_text_file` / `fs/write_text_file` (edits land in the client's diff UI; reads see unsaved buffers), and shell commands run via the client's `terminal/*`. This rides two small, general **I/O-backend seams** in core (`code_puppy/tools/io_backends.py`): a sync `FileSystemBackend` and an async `CommandExecutor`, both `None` by default (local I/O) and installed by this plugin, capability-gated, after `initialize`. Internal writes (config, session state, agent metadata) deliberately stay local — only *workspace* edits reroute (via `common.write_project_file`). |
-| **Permissions** | **the client is the authority (non-yolo).** Every approval — file writes and shell commands — is surfaced in the client's own allow/deny dialog via `session/request_permission`. No yolo forcing, no terminal prompts. |
+| **Permissions** | **the client is the authority (non-yolo).** Core runs one approval path for file writes and shell commands; ACP supplies the backend that asks the client via `session/request_permission`. No yolo forcing, no terminal prompts. |
 | **Entry point** | A `--acp` CLI flag contributed via the `register_cli_args` hook; `handle_cli_args` boots the agent (on its own loop, in a thread) and short-circuits normal TUI startup. |
 | **Core footprint** | Small, general, additive core seams — **no monkeypatching**: (1) a pluggable *approval backend* (`common.set_approval_backend`), (2) a *workspace write* wrapper (`common.write_project_file`) + backend-aware `_read_file`, and (3) `FileSystemBackend` / `CommandExecutor` registries (`tools/io_backends.py`). Each is useful to any non-terminal embedder, not ACP-specific. Everything else is this plugin + existing public hooks + the SDK. |
 
 ### Permissions in non-yolo mode (the important part)
 
-Code Puppy has two approval edges. In a headless ACP server there is no TTY, so
-the built-in stdin prompt would **fail closed** (auto-deny every file op — a
-latent bug this integration also fixes). We route both edges to the client *without*
-forcing yolo and *without* patching tool logic:
-
-* **File operations** use the **approval-backend seam** in `tools.common`. Sync
-  file tools run in Code Puppy's tool threadpool, so the backend
-  (`permissions.py`) bridges to the ACP event loop with
-  `run_coroutine_threadsafe` to ask the client via the SDK's `request_permission`,
-  then blocks the worker thread for the answer. The loop is free to service the
-  round-trip → no deadlock (guarded against being called on the loop itself).
-* **Shell commands** use the async `run_shell_command` hook (it runs on the ACP
-  loop and can `await` the client directly).
-
-Both edges **fail closed** if the connection drops or the client errors.
+Headless ACP has no TTY, so the built-in stdin prompt would fail closed. Instead,
+the approval decision lives in core and ACP only supplies the prompting backend,
+*without* forcing yolo or patching tool logic:
+
+* **One shared path in core:** yolo check, then sub-agent check, then queueing.
+  Sub-agents never prompt.
+* **ACP's backend** (`permissions.py`) asks the client via the SDK's
+  `request_permission`. Sync file tools run in the tool threadpool, so that path
+  bridges to the ACP loop with `run_coroutine_threadsafe` and blocks the worker
+  for the answer; it refuses to run on the loop itself (deadlock guard). Shell
+  commands go through core's same gate, which calls this backend (from a worker
+  thread, so the same bridge applies).
+* **No timeout:** like the terminal, the request waits. It ends on the client's
+  answer, on `session/cancel`, or when the connection closes. Cancel and
+  disconnect deny (fail closed).
+* **`approval_mode` config option:** read-only, reports `ask` or `auto` from yolo
+  mode. `apply_config_option` never writes config; client writes are ignored.
+* **Older cores** without `can_prompt_for_approval` get a fallback shell hook in
+  the plugin.
 
 ---
 
@@ -126,10 +130,11 @@ Every file stays well under the 600-line cap and owns one concern.
 | `persistence.py` | Pickle each session's history under `AUTOSAVE_DIR/acp` keyed by session id, plus an ACP metadata sidecar (`cwd` + `additionalDirectories` + title). Rehydrate on `load`/`resume`/`fork`; enumerate for `session/list` (`list_persisted`); tombstone on `session/close` (`delete`). |
 | `replay.py` | On `load`/`resume`, stream the rehydrated history back to the client as ordered `session/update`s (user / agent text / thinking / past tool calls) so the client rebuilds the thread UI. |
 | `mcp_config.py` | Translate client-injected ACP MCP server specs → pydantic-ai servers on the session agent. |
-| `session_config.py` | Build the model list (surfaced as ACP *modes*) + safe config options; apply `set_mode` / `set_config_option`. |
+| `session_config.py` | Build the model list (surfaced as ACP *modes*) + safe config options (including the read-only `approval_mode`); apply `set_mode` / `set_config_option`. |
 | `bridge.py` | `EventBridge`: registers `stream_event` / `pre_tool_call` / `post_tool_call` hooks and translates them into SDK `session/update`s via `connection.session_update`. (Hooks, **not** MessageBus — see *Event source*.) |
-| `permissions.py` | Wires Code Puppy's two approval edges to the client via the SDK's `request_permission`: the `tools.common` approval backend (files, cross-thread) and the `run_shell_command` hook (shell). Fails closed. |
+| `permissions.py` | The ACP approval backend (`tools.common` seam, cross-thread bridge to `request_permission`) for file and shell approvals, `cancel_pending` for cancel/close, and a legacy `run_shell_command` fallback hook for cores without `can_prompt_for_approval`. No timeout; fails closed. |
 | `io_delegation.py` | `DelegatedFileSystemBackend` (sync, cross-thread) + `DelegatedCommandExecutor` (async terminal lifecycle) that plug into the core I/O seams, capability-gated. |
+| `themes.py` | Read-only theme catalog: the `_code_puppy/themes/list` ext method, the `codePuppy/theme` session `_meta`, and the `_code_puppy/themes/changed` poll (`ThemeWatcher`). |
 | `state.py` | Process-wide run context: the SDK connection + its loop, the active session id, and the open-tool-call stack — so the permission/I/O seams (plain module functions) can reach the running connection and correlate events. |
 
 ```
@@ -319,6 +324,73 @@ change.
 
 ---
 
+## Theme catalog (`_code_puppy/themes/*`)
+
+You can list Code Puppy's color themes and track the active one without reading
+its config. The catalog is read-only: there is no setter.
+
+### `_code_puppy/themes/list`
+
+Send this request before or after `session/new`. It needs no session. Send
+`{}` or omit `params`; extra keys are ignored.
+
+The result has this shape:
+
+```jsonc
+{
+  "schemaVersion": 1,
+  "active": "ocean",          // or null
+  "themes": [
+    {
+      "id": "ocean",
+      "label": "Ocean",
+      "icon": "...",
+      "blurb": "...",
+      "appearance": "dark",   // "dark" or "light"
+      "palette": { "bg": "#rrggbb", "fg": "#rrggbb", "ansi": ["#rrggbb", "...16 entries"] },
+      "roles": { "background": "#rrggbb", "surface": "#rrggbb", "text": "#rrggbb",
+                 "mutedText": "#rrggbb", "accent": "#rrggbb", "success": "#rrggbb",
+                 "error": "#rrggbb", "warning": "#rrggbb", "running": "#rrggbb",
+                 "diffAdd": "#rrggbb", "diffRemove": "#rrggbb" }
+    }
+    // ...more themes
+  ]
+}
+```
+
+Themes appear in this order: curated themes in menu order, then `default`. The `surprise`
+theme is excluded. The `default` entry has `null` for `appearance`, `palette`,
+and `roles`, because it restores the terminal's own colors.
+
+`active` is the ID of the catalog theme stored in the `theme_active_theme`
+config key. It is `null` when the key is unset, and also when the key holds
+`legacy-custom` or `surprise`.
+
+For the mapping from palette to roles, see
+[`theme/README.md`](../theme/README.md). This page does not repeat it.
+
+### `_meta` on session responses
+
+`session/new`, `session/load`, and `session/resume` results include
+`_meta["codePuppy/theme"] = {"active": <id or null>}`. Use it to paint the first
+frame without waiting for the list request.
+
+### `_code_puppy/themes/changed`
+
+When the active theme changes, the agent sends this notification with params
+`{"active": <id or null>}`. It sends one notification per change. The agent
+reads the config value every 2 seconds from the moment the client connects.
+The first reading is a baseline, so no notification is sent for it.
+
+### Unknown methods and older CLIs
+
+Any other `_code_puppy/*` method, such as `_code_puppy/themes/set`, returns
+JSON-RPC error `-32601` (method not found). Older Code Puppy CLIs omit the
+`_meta` key and return `-32601` for the list request. Clients should fall back
+to a bundled copy of the catalog when either happens.
+
+---
+
 ## Testing
 
 `tests/test_acp_plugin.py` drives `CodePuppyAgent` directly against a fake SDK

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/code_puppy_core_plugins/acp/agent.py

@@ -49,6 +49,7 @@ from code_puppy_core_plugins.acp import (
     replay,
     session_config,
     state,
+    themes,
 )
 from code_puppy_core_plugins.acp.bridge import EventBridge
 from code_puppy_core_plugins.acp.session import ACPSession
@@ -77,6 +78,7 @@ class CodePuppyAgent(Agent):
         self._sessions: Dict[str, ACPSession] = {}
         self._bridge = EventBridge()
         self._client_caps: Optional[ClientCapabilities] = None
+        self._theme_watcher = themes.ThemeWatcher()
 
     # ---- Connection lifecycle ---------------------------------------------
     def on_connect(self, conn: Any) -> None:
@@ -89,6 +91,11 @@ class CodePuppyAgent(Agent):
         state.set_connection(conn, asyncio.get_running_loop())
         self._bridge.register()
         permissions.install()
+        try:
+            self._theme_watcher.start()
+        except Exception as error:  # noqa: BLE001
+            # Startup must never fail on the theme watcher; log the class only.
+            logger.debug("ACP theme watcher not started: %s", type(error).__name__)
 
     def shutdown(self) -> None:
         """Unwire this agent's event hooks. Call once the connection ends.
@@ -98,6 +105,7 @@ class CodePuppyAgent(Agent):
         connection leaves the global callback registry clean.
         """
         self._bridge.unregister()
+        self._theme_watcher.stop()
 
     # ---- Handshake --------------------------------------------------------
     async def initialize(
@@ -159,6 +167,7 @@ class CodePuppyAgent(Agent):
         return NewSessionResponse(
             session_id=session_id,
             config_options=session_config.config_options() or None,
+            field_meta=themes.session_meta(),
         )
 
     async def load_session(
@@ -185,6 +194,7 @@ class CodePuppyAgent(Agent):
         self._announce_commands_soon(session_id)
         return LoadSessionResponse(
             config_options=session_config.config_options() or None,
+            field_meta=themes.session_meta(),
         )
 
     async def resume_session(
@@ -205,6 +215,7 @@ class CodePuppyAgent(Agent):
         self._announce_commands_soon(session_id)
         return ResumeSessionResponse(
             config_options=session_config.config_options() or None,
+            field_meta=themes.session_meta(),
         )
 
     async def fork_session(
@@ -366,6 +377,7 @@ class CodePuppyAgent(Agent):
         """
         from code_puppy.agents._builder import reset_model_fallback_warnings
 
+        permissions.cancel_pending(session_id)
         session = self._sessions.pop(session_id, None)
         if session is not None:
             await session.cancel_and_wait()
@@ -373,6 +385,10 @@ class CodePuppyAgent(Agent):
         reset_model_fallback_warnings(scope=session_id)
         return CloseSessionResponse()
 
+    async def ext_method(self, method: str, params: dict[str, Any]) -> dict[str, Any]:
+        """Route ext requests (currently only themes) to the theme catalog."""
+        return await themes.handle_ext_method(method, params)
+
     # ---- Prompt turn ------------------------------------------------------
     async def prompt(
         self, prompt: List[Any], session_id: str, **kwargs: Any
@@ -385,7 +401,8 @@ class CodePuppyAgent(Agent):
         return PromptResponse(stop_reason=outcome.stop_reason, usage=outcome.usage)
 
     async def cancel(self, session_id: str, **kwargs: Any) -> None:
-        """Cancel the in-flight run for a session (notification)."""
+        """Cancel the in-flight run and any pending approval (file or shell) for a session."""
+        permissions.cancel_pending(session_id)
         session = self._sessions.get(session_id)
         if session is not None:
             session.cancel()

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/code_puppy_core_plugins/acp/permissions.py

@@ -9,21 +9,27 @@ logic or forcing yolo mode:
   threadpool, so the backend bridges to the ACP event loop via
   ``run_coroutine_threadsafe`` to ask the client, then blocks the worker thread for
   the answer. The loop stays free to service the round-trip — no deadlock.
-* **Shell commands** go through the ``run_shell_command`` hook, which is async
-  and already runs on the ACP loop, so it can ``await`` the client directly.
-
-Both edges fail **closed** (deny) if the connection is gone or the client errors.
-A denial nobody chose -- a cancelled, failed or timed-out request, or an option
-we do not recognize -- is reported as ``PermissionNotDecided`` rather than as the
-user rejecting the operation, so the model is not told the user said no.
+* **Shell commands** go through core's shared shell gate
+  (``get_user_approval_async`` -> the same approval backend), so yolo mode and
+  sub-agent handling stay in core. Cores older than ``can_prompt_for_approval``
+  lack that gate, so a ``run_shell_command`` fallback hook is registered for them
+  only.
+
+Neither edge has a timeout: a dialog waits for a person. Both fail **closed**
+(deny) if the connection is gone, the client errors, or the session is cancelled
+or closed (``cancel_pending``). A denial nobody chose is reported as
+``PermissionNotDecided`` rather than as the user rejecting the operation, so the
+model is not told the user said no.
 """
 
 from __future__ import annotations
 
 import asyncio
+import concurrent.futures
 import logging
+import threading
 import uuid
-from typing import Any, Dict, Optional, Tuple
+from typing import Any, Dict, Optional, Set, Tuple
 
 from acp.schema import PermissionOption, ToolCallUpdate
 
@@ -40,9 +46,10 @@ except ImportError:  # pragma: no cover - code_puppy without the marker type
 
 logger = logging.getLogger(__name__)
 
-# How long to wait for a human in the client to answer a permission dialog. Dialogs
-# can sit for a while; deny (fail closed) if it's truly abandoned.
-_PERMISSION_TIMEOUT_S = 600
+# In-flight approval bridges (file and shell) per session, so ``cancel_pending`` can unblock
+# the tool threads waiting on them.
+_PENDING: Dict[str, Set[concurrent.futures.Future]] = {}
+_PENDING_LOCK = threading.Lock()
 
 # The allow/deny options we present. The client echoes back the chosen ``option_id``.
 _OPTIONS = [
@@ -73,25 +80,19 @@ async def _ask_client_outcome(
     """Show an allow/deny dialog in the client.
 
     Returns ``(True, None)`` when allowed and ``(False, None)`` when a person
-    selected Reject. Every other denial -- no connection, a failed or
-    timed-out request, a cancelled dialog, an unknown option -- returns
+    selected Reject. Every other denial -- no connection, a failed request, a
+    cancelled dialog, an unknown option -- returns
     ``(False, PermissionNotDecided(reason))``.
     """
     connection = state.get_connection()
     if connection is None:
         return False, PermissionNotDecided("The client connection is unavailable.")
     try:
-        response = await asyncio.wait_for(
-            connection.request_permission(
-                options=list(_OPTIONS),
-                session_id=session_id,
-                tool_call=_tool_call_ref(title),
-            ),
-            timeout=_PERMISSION_TIMEOUT_S,
+        response = await connection.request_permission(
+            options=list(_OPTIONS),
+            session_id=session_id,
+            tool_call=_tool_call_ref(title),
         )
-    except asyncio.TimeoutError:
-        logger.warning("session/request_permission timed out; denying")
-        return False, PermissionNotDecided("The permission request timed out.")
     except Exception:  # noqa: BLE001
         logger.exception("session/request_permission failed; denying")
         return False, PermissionNotDecided(
@@ -118,6 +119,37 @@ async def _ask_client(session_id: str, title: str) -> bool:
     return allowed
 
 
+def _track_pending(session_id: str, future: concurrent.futures.Future) -> None:
+    with _PENDING_LOCK:
+        _PENDING.setdefault(session_id, set()).add(future)
+
+
+def _untrack_pending(session_id: str, future: concurrent.futures.Future) -> None:
+    with _PENDING_LOCK:
+        futures = _PENDING.get(session_id)
+        if futures is None:
+            return
+        futures.discard(future)
+        if not futures:
+            del _PENDING[session_id]
+
+
+def cancel_pending(session_id: Optional[str] = None) -> None:
+    """Cancel in-flight approvals (file and shell) for one session, or all when ``None``.
+
+    Each cancelled wait returns ``PermissionNotDecided``, so the blocked tool
+    thread unwinds instead of waiting on a dialog nobody will answer.
+    """
+    with _PENDING_LOCK:
+        if session_id is None:
+            futures = [f for group in _PENDING.values() for f in group]
+        else:
+            futures = list(_PENDING.get(session_id, ()))
+    # Cancel outside the lock: cancelling runs callbacks that may re-enter tracking.
+    for future in futures:
+        future.cancel()
+
+
 def _approval_backend(
     title: str, message: str, preview: Optional[str]
 ) -> Tuple[bool, Optional[str]]:
@@ -148,41 +180,40 @@ def _approval_backend(
     future = asyncio.run_coroutine_threadsafe(
         _ask_client_outcome(session_id, title), loop
     )
+    _track_pending(session_id, future)
     try:
-        # A little longer than the request's own timeout, which answers first.
-        allowed, not_decided = future.result(_PERMISSION_TIMEOUT_S + 5)
-    except Exception:  # noqa: BLE001 - includes TimeoutError
+        allowed, not_decided = future.result()
+    except concurrent.futures.CancelledError:
+        return False, PermissionNotDecided("The permission request was cancelled.")
+    except Exception:  # noqa: BLE001
         # Abandon the in-flight request so it doesn't linger on the loop.
         future.cancel()
         logger.exception("ACP approval bridge failed; denying")
         return False, PermissionNotDecided(
             "The permission request could not be completed."
         )
+    finally:
+        _untrack_pending(session_id, future)
     return bool(allowed), not_decided
 
 
-async def _on_run_shell_command(
+async def _legacy_shell_hook(
     context: Any, command: str, cwd: Optional[str] = None, timeout: int = 60
 ) -> Optional[Dict[str, Any]]:
-    """``run_shell_command`` hook: gate shell execution through the client.
+    """``run_shell_command`` fallback for cores without core's shell approval gate.
 
-    Returns ``None`` to allow (the hook's "no objection"), or a
+    Mirrors that gate's yolo and sub-agent skips. Returns ``None`` to allow, or a
     ``{"blocked": True, ...}`` dict to deny. Inert outside ACP mode.
-
-    Honors yolo mode: when the user has opted out of approvals we do *not*
-    surface a client dialog, matching Code Puppy's file-permission edge (which
-    skips its prompt in yolo mode). Otherwise ACP + yolo would silently
-    auto-approve file writes yet still prompt for every shell command.
     """
-    session_id = state.get_active_session_id()
-    if session_id is None:
+    if state.get_active_session_id() is None:
         return None
     from code_puppy.config import get_yolo_mode
+    from code_puppy.tools.subagent_context import is_subagent
 
-    if get_yolo_mode():
+    if get_yolo_mode() or is_subagent():
         return None
-    allowed, not_decided = await _ask_client_outcome(
-        session_id, f"Run shell command: {command}"
+    allowed, not_decided = await asyncio.to_thread(
+        _approval_backend, "Shell Command", f"Run shell command: {command}", None
     )
     if allowed:
         return None
@@ -202,21 +233,37 @@ async def _on_run_shell_command(
     }
 
 
+# Kept so existing importers/tests of the pre-rename name keep working; core's
+# tests/test_acp_plugin.py still calls it.
+_on_run_shell_command = _legacy_shell_hook
+
+
+_legacy_shell_hook_registered = False
+
+
 def install() -> None:
-    """Install the file approval backend + the shell permission hook."""
-    from code_puppy.tools.common import set_approval_backend
+    """Install the file approval backend, plus the legacy shell hook on old cores."""
+    from code_puppy.tools import common
 
-    set_approval_backend(_approval_backend)
-    register_callback("run_shell_command", _on_run_shell_command)
+    global _legacy_shell_hook_registered
+    common.set_approval_backend(_approval_backend)
+    # Remove once the minimum supported core ships can_prompt_for_approval: until
+    # then an older core would run shell commands without asking the client.
+    if not hasattr(common, "can_prompt_for_approval"):
+        register_callback("run_shell_command", _legacy_shell_hook)
+        _legacy_shell_hook_registered = True
 
 
 def uninstall() -> None:
-    """Remove the approval backend + shell hook so normal stdin prompting resumes."""
+    """Remove the approval backend and legacy hook so normal stdin prompting resumes."""
     from code_puppy.callbacks import unregister_callback
-    from code_puppy.tools.common import set_approval_backend
-
-    set_approval_backend(None)
-    try:
-        unregister_callback("run_shell_command", _on_run_shell_command)
-    except Exception:  # noqa: BLE001
-        logger.debug("ACP: run_shell_command unregister failed", exc_info=True)
+    from code_puppy.tools import common
+
+    global _legacy_shell_hook_registered
+    common.set_approval_backend(None)
+    if _legacy_shell_hook_registered:
+        _legacy_shell_hook_registered = False
+        try:
+            unregister_callback("run_shell_command", _legacy_shell_hook)
+        except Exception:  # noqa: BLE001
+            logger.debug("ACP: run_shell_command unregister failed", exc_info=True)

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/code_puppy_core_plugins/acp/register_callbacks.py

@@ -94,6 +94,7 @@ async def _serve() -> int:
         await run_agent(agent)
     finally:
         agent.shutdown()
+        permissions.cancel_pending()
         permissions.uninstall()
         io_delegation.uninstall()
         state.set_connection(None, None)

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/code_puppy_core_plugins/acp/session.py

@@ -65,6 +65,8 @@ class ACPSession:
         # Set while a ``session/prompt`` is in flight so ``cancel`` has a task
         # to cancel. ``None`` means idle.
         self._task: Optional["asyncio.Task[Any]"] = None
+        # Set only when cancel() cancels a live task; see cancel().
+        self._cancel_requested = False
 
     async def prompt(self, blocks: List[Any]) -> PromptResult:
         """Run the agent on a user turn and return the stop reason + usage.
@@ -117,6 +119,7 @@ class ACPSession:
         state.begin_run(self.session_id)
         result: Any = None
         error: Optional[BaseException] = None
+        self._cancel_requested = False
         try:
             self._task = asyncio.ensure_future(
                 self.agent.run_with_mcp(
@@ -126,8 +129,13 @@ class ACPSession:
                 )
             )
             result = await self._task
+            # Core swallows cancellation, so the handler's own cancel would be lost;
+            # the SDK response send then hangs after the connection closes.
+            current = asyncio.current_task()
+            if current is not None and current.cancelling() > 0:
+                raise asyncio.CancelledError
             self._absorb_history(result)
-            stop_reason = STOP_END_TURN
+            stop_reason = STOP_CANCELLED if self._cancel_requested else STOP_END_TURN
         except asyncio.CancelledError:
             # Two ways here: our own cancel cancelled the inner task (report
             # ``cancelled``), or THIS coroutine was cancelled (SDK teardown) while the
@@ -195,7 +203,9 @@ class ACPSession:
 
         Besides cancelling the asyncio task, force-kill any local shell
         processes the run spawned so they don't orphan. (Shells delegated to
-        the client run client-side and are unaffected.)
+        the client run client-side and are unaffected.) Core may swallow the
+        cancel, so ``_cancel_requested`` is the authoritative signal that the
+        turn was cancelled.
 
         Only *requests* cancellation -- delivery happens at the task's next
         await point, whenever that is, not immediately. Callers that need
@@ -204,6 +214,8 @@ class ACPSession:
         """
         task = self._task
         if task is not None and not task.done():
+            # Live-task only, so an idle cancel can't mark the next turn cancelled.
+            self._cancel_requested = True
             task.cancel()
         try:
             from code_puppy.tools.command_runner import (

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/code_puppy_core_plugins/acp/session_config.py

@@ -17,8 +17,11 @@ option by its ``category``, so this is the shape that actually populates them:
 * **Streaming toggle** — an On/Off ``select`` option. (A boolean option would
   be more natural, but Zed 1.7.2 renders only ``select`` options in its bottom
   bar -- a boolean shows as "Unknown" -- so every control here is a select.) We
-  deliberately expose only this safe setting; we do **not** expose a
-  yolo/approval-bypass toggle (permissions must stay client-driven).
+  deliberately expose only this safe setting.
+
+* **Approvals** — a read-only ``select`` (``approval_mode``) reporting ``ask`` or
+  ``auto`` from the CLI's yolo setting. Clients cannot change it: writes fall
+  through like unknown ids, so permissions stay client-driven.
 
 All accessors are best-effort and degrade to "nothing to offer" on error.
 """
@@ -42,6 +45,13 @@ MODE_OPTION_ID = "mode"
 _STREAMING_ID = "enable_streaming"
 _STREAMING_ON = "on"
 _STREAMING_OFF = "off"
+_APPROVAL_ID = "approval_mode"
+_APPROVAL_ASK = "ask"
+_APPROVAL_AUTO = "auto"
+_APPROVAL_DESCRIPTIONS = {
+    _APPROVAL_ASK: "Ask before commands and edits",
+    _APPROVAL_AUTO: "Run without asking",
+}
 
 # Exactly one operating mode, but advertised as a category="mode" select so the
 # client's dropdown shows "Default" rather than an empty "Unknown" control.
@@ -105,6 +115,30 @@ def _model_option() -> Optional[SessionConfigOptionSelect]:
     )
 
 
+def _approval_option() -> SessionConfigOptionSelect:
+    """Report the CLI's approval mode as a read-only select (ask or auto).
+
+    Only the current value is listed, so the client has nothing to pick.
+    """
+    from code_puppy import config
+
+    current = _APPROVAL_AUTO if config.get_yolo_mode() else _APPROVAL_ASK
+    return SessionConfigOptionSelect(
+        id=_APPROVAL_ID,
+        name="Approvals",
+        type="select",
+        current_value=current,
+        options=[
+            SessionConfigSelectOption(
+                value=current,
+                name=current.capitalize(),
+                description=_APPROVAL_DESCRIPTIONS[current],
+            )
+        ],
+        description="Read-only: set by the CLI configuration.",
+    )
+
+
 def set_model(model_id: str) -> bool:
     """Switch the active model. Returns ``True`` on success."""
     try:
@@ -156,6 +190,10 @@ def config_options() -> List[Any]:
         )
     except Exception:  # noqa: BLE001
         logger.debug("ACP: could not build streaming option", exc_info=True)
+    try:
+        opts.append(_approval_option())
+    except Exception:  # noqa: BLE001
+        logger.debug("ACP: could not build approval option", exc_info=True)
     return opts
 
 

{code_puppy_core_plugins-0.0.104 → code_puppy_core_plugins-0.0.106}/code_puppy_core_plugins/acp/state.py

@@ -1,7 +1,7 @@
 """Run context for the active ACP connection.
 
-Code Puppy's approval and I/O seams live at its *edges* (the
-``run_shell_command`` hook, the ``tools.common`` approval backend, and the
+Code Puppy's approval and I/O seams live at its *edges* (the ``tools.common`` approval
+backend, the legacy ``run_shell_command`` hook on older cores, and the
 ``tools.io_backends`` filesystem/command backends). Those are plain module
 functions with no reference to the live ACP connection, so this module is the
 small, explicit bridge between them and the running agent.