Conversation
tole as an ACP agent over stdio: editors and ACP-capable clients (Zed et al.) drive durable tole sessions via line-delimited JSON-RPC, with no new dependencies. - initialize / session/new / session/load / session/prompt: ACP sessions map to the durable JSONL store (session jail = the client's cwd; load replays the existing log). - session/prompt runs one full tole turn and delivers the final answer as an agent_message_chunk update before responding (v1: no intra-turn streaming — the synchronous turn loop is untouched). - Approval bridge: Write/Destructive tool calls surface as session/request_permission requests to the EDITOR — the human in the client is the approver, which is why Destructive tools CAN be registered here with genuine per-call consent (unlike MCP server mode), without weakening anything. - Prompt accepts the ACP content-block array form (and plain strings). - run_command/git/gh-detect operate on the SESSION cwd, not the process cwd (CodeCora review finding on this PR). - Provider config is only required when a prompt actually runs. - CI-safe integration test spawns the real binary: initialize, session lifecycle, unknown-method error; live E2E covered permission flow, streaming chunk, and stop reasons. Closes #95 (Phase D2).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
🔍 Cora AI Code Review❌ Blocked — critical issues found. 🔴 Error (1)
Review powered by cora-code · BYOK · MIT |
…ardening CodeCora review on the ACP PR caught a real architectural bug: the prompt arm wrapped a FRESH empty map per prompt (share_sessions used mem::replace), so every session vanished after its first turn and session/load could open a divergent second handle mid-turn. - The session map now lives for the whole server lifetime (Arc clone per prompt thread); the map lock is held for the duration of a turn, which serializes a busy session instead of allowing divergent appends. - Poisoning-tolerant locking: one panicking turn no longer bricks the ACP server. - sessionId validation (charset, length, no separators/parent refs) blocks path traversal via session/load before ids touch the filesystem; regression tests cover multi-session persistence and traversal rejection.
| conn.clone(), | ||
| ) { | ||
| Ok(state) => { | ||
| lock_sessions(&sessions) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
tole acp: tole presents itself as an Agent Client Protocol agent over line-delimited JSON-RPC stdio — editors (Zed et al.) drive durable tole sessions; tool approvals surface as permission requests in the editor.Closes #95 (Phase D2).
Why
Editors are not MCP clients. ACP is the editor-facing protocol, and tole's model maps to it almost 1:1: ACP sessions ↔ durable JSONL sessions, the approval gate ↔ permission requests, session continuation ↔ crash-safe replay.
Changes
tole-cli/src/acp.rs: initialize / session-new / session-load / session-prompt; the final answer streams as anagent_message_chunkupdate; Write/Destructive calls surfacesession/request_permissionto the editor human (Destructive consent is a genuine per-call decision — structurally stronger than MCP server mode's blanket absence); prompt accepts the ACP content-block array (and plain strings); run_command/git/gh operate on the SESSION cwd.Testing