fix(acp): handle acp-next permission events (#29656)

packages/opencode/src/acp-next/event.ts

@@ -11,6 +11,7 @@ import type {
 } from "@opencode-ai/sdk/v2"
 import { Effect } from "effect"
 import { ACPNextSession } from "./session"
+import { ACPNextPermission } from "./permission"
 import {
   duplicateRunningToolUpdate,
   errorToolUpdate,
@@ -22,7 +23,8 @@ import {
 
 const log = Log.create({ service: "acp-next-event" })
 
-type Connection = Pick<AgentSideConnection, "sessionUpdate">
+type Connection = Pick<AgentSideConnection, "sessionUpdate"> &
+  Partial<Pick<AgentSideConnection, "requestPermission" | "writeTextFile">>
 type GlobalEventEnvelope = {
   payload?: Event
 }
@@ -40,6 +42,7 @@ export class Subscription {
   private readonly abort = new AbortController()
   private readonly shellSnapshots = new Map<string, string>()
   private readonly toolStarts = new Set<string>()
+  private readonly permission: ACPNextPermission.Handler
   private started = false
 
   constructor(
@@ -48,7 +51,9 @@ export class Subscription {
       connection: Connection
       session: ACPNextSession.Interface
     },
-  ) {}
+  ) {
+    this.permission = new ACPNextPermission.Handler(input)
+  }
 
   start() {
     if (this.started) return
@@ -65,6 +70,9 @@ export class Subscription {
 
   async handle(event: Event) {
     switch (event.type) {
+      case "permission.asked":
+        this.permission.handle(event)
+        return
       case "message.part.updated":
         return this.handlePartUpdated(event)
       case "message.part.delta":

packages/opencode/src/acp-next/permission.ts

@@ -0,0 +1,149 @@
+import type {
+  AgentSideConnection,
+  PermissionOption,
+  RequestPermissionResponse,
+} from "@agentclientprotocol/sdk"
+import * as Log from "@opencode-ai/core/util/log"
+import type { Event, OpencodeClient } from "@opencode-ai/sdk/v2"
+import { applyPatch } from "diff"
+import { exists, readText } from "@/util/filesystem"
+import type { ACPNextSession } from "./session"
+import { toLocations, toToolKind, type ToolInput } from "./tool"
+import { Effect } from "effect"
+
+const log = Log.create({ service: "acp-next-permission" })
+
+type PermissionEvent = Extract<Event, { type: "permission.asked" }>
+type Reply = "once" | "always" | "reject"
+type Connection = Partial<Pick<AgentSideConnection, "requestPermission" | "writeTextFile">>
+
+const permissionOptions: PermissionOption[] = [
+  { optionId: "once", kind: "allow_once", name: "Allow once" },
+  { optionId: "always", kind: "allow_always", name: "Always allow" },
+  { optionId: "reject", kind: "reject_once", name: "Reject" },
+]
+
+export class Handler {
+  private readonly queues = new Map<string, Promise<void>>()
+
+  constructor(
+    private readonly input: {
+      sdk: OpencodeClient
+      connection: Connection
+      session: ACPNextSession.Interface
+    },
+  ) {}
+
+  handle(event: PermissionEvent) {
+    const permission = event.properties
+    const previous = this.queues.get(permission.sessionID) ?? Promise.resolve()
+    const next = previous
+      .then(() => this.process(event))
+      .catch((error: unknown) => {
+        log.error("failed to handle permission", { error, permissionID: permission.id })
+      })
+      .finally(() => {
+        if (this.queues.get(permission.sessionID) === next) {
+          this.queues.delete(permission.sessionID)
+        }
+      })
+    this.queues.set(permission.sessionID, next)
+  }
+
+  private async process(event: PermissionEvent) {
+    const permission = event.properties
+    const session = await Effect.runPromise(this.input.session.tryGet(permission.sessionID))
+    if (!session) return
+
+    if (!this.input.connection.requestPermission) {
+      log.error("ACP connection cannot request permission", {
+        permissionID: permission.id,
+        sessionID: permission.sessionID,
+      })
+      await this.reply(permission.id, "reject", session.cwd)
+      return
+    }
+
+    const result = await this.input.connection
+      .requestPermission({
+        sessionId: permission.sessionID,
+        toolCall: {
+          toolCallId: permission.tool?.callID ?? permission.id,
+          status: "pending",
+          title: permission.permission,
+          rawInput: permission.metadata,
+          kind: toToolKind(permission.permission),
+          locations: toLocations(permission.permission, permission.metadata),
+        },
+        options: permissionOptions,
+      })
+      .catch(async (error: unknown) => {
+        log.error("failed to request permission from ACP", {
+          error,
+          permissionID: permission.id,
+          sessionID: permission.sessionID,
+        })
+        await this.reply(permission.id, "reject", session.cwd)
+        return undefined
+      })
+
+    if (!result) return
+
+    const reply = selectedReply(result)
+    if (reply !== "once" && reply !== "always") {
+      await this.reply(permission.id, "reject", session.cwd)
+      return
+    }
+
+    if (permission.permission === "edit") {
+      await this.writeProposedEdit(session.id, permission.metadata).catch((error: unknown) => {
+        log.error("failed to write proposed edit through ACP", {
+          error,
+          permissionID: permission.id,
+          sessionID: permission.sessionID,
+        })
+      })
+    }
+
+    await this.reply(permission.id, reply, session.cwd)
+  }
+
+  private async reply(requestID: string, reply: Reply, directory: string) {
+    await this.input.sdk.permission.reply({
+      requestID,
+      reply,
+      directory,
+    })
+  }
+
+  private async writeProposedEdit(sessionId: string, metadata: ToolInput) {
+    const filepath = stringValue(metadata.filepath)
+    const diff = stringValue(metadata.diff)
+    if (!filepath || !diff || !this.input.connection.writeTextFile) return
+
+    const content = (await exists(filepath)) ? await readText(filepath) : ""
+    const next = applyPatch(content, diff)
+    if (next === false) {
+      log.error("Failed to apply unified diff (context mismatch)")
+      return
+    }
+
+    void this.input.connection.writeTextFile({
+      sessionId,
+      path: filepath,
+      content: next,
+    })
+  }
+}
+
+function selectedReply(result: RequestPermissionResponse): Reply {
+  if (result.outcome.outcome !== "selected") return "reject"
+  if (result.outcome.optionId === "once" || result.outcome.optionId === "always") return result.outcome.optionId
+  return "reject"
+}
+
+function stringValue(value: unknown) {
+  return typeof value === "string" ? value : undefined
+}
+
+export * as ACPNextPermission from "./permission"

packages/opencode/src/acp-next/service.ts

@@ -69,7 +69,8 @@ export class Service extends Context.Service<Service, Interface>()("@opencode/AC
 
 export function make(input: {
   sdk: OpencodeClient
-  connection?: Pick<AgentSideConnection, "sessionUpdate">
+  connection?: Pick<AgentSideConnection, "sessionUpdate"> &
+    Partial<Pick<AgentSideConnection, "requestPermission" | "writeTextFile">>
   directory?: Directory.Interface
   session?: ACPNextSession.Interface
   eventSubscription?: (subscription: ACPNextEvent.Subscription) => void

packages/opencode/src/acp-next/tool.ts

@@ -74,7 +74,7 @@ export function toLocations(toolName: string, input: ToolInput): ToolCallLocatio
     case "read":
     case "edit":
     case "write":
-      return locationFrom(input.filePath)
+      return locationFrom(input.filePath ?? input.filepath)
 
     case "grep":
     case "glob":