feat: tole acp — Agent Client Protocol host (Phase D2)

[ajianaz]

What problem does this solve?

tole is CLI-only. Editors and ACP-capable clients (Zed and anything speaking the Agent Client Protocol) cannot drive tole, even though tole's model maps almost 1:1 onto ACP: durable JSONL sessions, a resumable turn loop, and a risk-tiered approval gate that already exists precisely to ask a human before acting.

Proposed solution

A tole acp subcommand: tole presents itself as an ACP agent over stdio (JSON-RPC).

Mapping (the reason this is a natural fit, not a bolt-on):

ACP	tole
session/new	new durable JSONL session
session/prompt	run_turn
session/update (streaming)	turn-loop events (tool call started/finished, agent text)
session/request_permission	the approval gate — the y/N prompt becomes ACP permission options
session/cancel	abort turn (park resumable — already implemented)
editor restart, session continue	--resume / JSONL replay

• Memory loop keeps working per session (recall before first turn, remember on settle).
• Tools exposed to the editor mirror the CLI registry (same risk tiers).

Acceptance criteria

• Zed (or any ACP client) can start tole acp, run a prompt, see streaming updates and tool calls.
• Write/Destructive calls surface as ACP permission requests; a denial parks the turn resumably (durable record — no silent drop).
• Session survives an editor restart: reconnect with the same session id continues with full context.
• Destructive tools are never auto-approved by client settings alone.

Alternatives considered

• MCP-only (agents already work via feat: tole mcp — expose tole's tools as an MCP server (Phase D1) #94) — but editors are not MCP clients; ACP is the editor-facing protocol and reuses the same tole-core engine, just a different host shim.
• Building a full IDE extension — out of scope; ACP gives editor integration without per-editor work.

Notes

• Depends on D1 only for shared transport/utilities learnings; the engine work (turn-in-background-thread + event bridging to async host) is the meat. The turn loop is synchronous today — the host shim bridges durable events to ACP notifications; the state machine stays untouched.
• Tracks the approved D2 of the integration-surfaces plan (2026-09-18). Estimate: M.