[ymichael]

Human comments

What was wrong

After the runtime delegated permission reconciliation to providers in #1640, ACP retained its launch-time write policy on follow-ups and ignored changed execution options on steers. A thread started in Full could still write outside the workspace after switching to Accept-edits.

What changed

Reconcile ACP permissions before follow-up prompts and steered re-prompts. Update bridge-owned policy in place when launch arguments stay the same; rebuild and use existing session/load support when permission arguments differ. Preserve queued inputs across rebuilds and report failed reconstruction. Keep the unchanged-mode path synchronous to preserve concurrent-start rejection.

Add a shared permission-change contract covering ACP, Codex, and Claude, include Claude’s dependencies in the Windows foundation job’s filtered install, and correct ACP fixtures that accidentally changed modes. No server/daemon wire changes or new public API/CLI surface.

How you verified

• Turbo lint, typecheck, and tests for @bb/provider-bridge-acp and @bb/provider-bridge-protocol: 367 ACP and 299 protocol tests passed, including 40 permission transitions. Four unrelated ACP operation tests skipped.
• After CI exposed the missing Claude install in the Windows foundation job, corrected its package filter; the targeted local shared contract rerun passes all 24 cases, and the corrected hosted Windows foundation job passes, including all 24 contract cases (296 protocol tests passed, 3 unrelated platform skips; 371 ACP tests passed).
• Historical bridges fail the relevant contract: all 16 ACP transitions; all 6 pre-Apply Codex permission changes when steering active turns #4794 Codex steers; all 12 pre-Apply Claude permission changes to follow-ups and steers #4789 Claude transitions.
• Real OpenCode v2.0.22 with live opencode/fledge-alpha-free through the source ACP bridge (model/token provenance confirmed by session export): base reproduces the outside write after tightening; head passes tightening/loosening on follow-ups and active-tool steers. Accept-edits forwards approval, denial leaves the file absent; Full writes the file.
• Real OpenCode environment-triggered rebuilds change PIDs, retain the session, and recover a random token from earlier conversation history without reading files. OpenCode ACP rejects --auto, so permission-CLI argument changes, queued steer ordering, and reconstruction failure retain deterministic harness coverage.
• Strict recorded ACP parity: 10 passed, 0 failed, 1 skipped with an empty temporary allowlist. Default full parity reports 9 stale allowlist failures, with no event/row/grammar differences; a representative failure reproduces in an untouched baseline-versus-baseline control.

Real ACP checks invoke the bridge worker directly, not the full BB UI/server/daemon path. Codex/Claude contract adapters use real bridges with provider fakes; native-provider evidence for those unchanged bridges predates this commit. Background tools and Linux sandboxes are outside this verification.

Fixes #4806.

Partially addresses #4797: permission refresh on follow-ups and steers, conditional rebuilds, and session restoration are covered. Its single-logical-turn requirement across native-flag restarts remains outstanding: this implementation emits a cancelled turn boundary and opens a replacement turn. The earlier alternative PR #4795 is closed and was not merged.

AGENT GENERATED