fix(daemon): stop auto-approving every ACP permission request

[btagritech]

Why

I hit this myself while wiring a real external integration through Open Design's ACP backend: a human-approval gate for destructive Hostinger API calls, driven through Hermes as the ACP agent. Hermes already has a pre_tool_call hook that flags a tool call for approval and routes it through whatever human-approval channel is available — when driven through Open Design, that channel is ACP's session/request_permission. Testing that gate live, every gated call was silently approved with no pause and no way to deny, even though Hermes' own plugin had explicitly asked for approval.

The root cause is in apps/daemon/src/acp.ts, not on the Hermes side: choosePermissionOutcome() picked an allow_* option the instant a session/request_permission request arrived, with no human involved and no deny path anywhere in its own logic — it only ever returns an allow option or null. Concretely, ACP has no session-scoped permission kind, so Hermes' "allow for this session" option (optionId: allow_session) is sent with kind: "allow_always" — the same kind as the real "allow always" option. choosePermissionOutcome's first-match .find() on kind picked whichever came first and returned it, silently approving. This isn't scoped to my one plugin's rule — it affects every ACP agent (Hermes, Kimi, Kilo, Kiro, Vibe, Devin) and every kind of gated action any of them escalate through ACP, including Hermes' own pre-existing dangerous-shell-command gate (rm -rf, sudo, force-push, etc). A safety gate that always says yes is worse than no gate, since it looks like protection while providing none.

What users will see

• ACP-backed agents (Hermes, Kimi, Kilo, Kiro, Vibe, Devin) that request permission for a gated action now actually pause the run instead of being silently auto-approved.
• The run's SSE stream (GET /api/runs/:id/events) emits a new permission_request agent event (title, description, and the specific choices the agent offered) when this happens, and a permission_resolved event once it's answered.
• A new endpoint, POST /api/runs/:id/permission with { "choice": string }, answers a pending request for that run.
• If nothing answers within 55s, the request is denied (fail-closed), never approved.
• Known gap, disclosed rather than hidden: apps/web does not yet render a UI card for permission_request, so a user driving the browser UI today will see the run pause for up to 55s with no visible prompt before it reports blocked/denied. That's a real UX gap, but it's strictly safer than the previous behavior (instant, invisible auto-approval), and a dedicated UI card is natural, separate follow-up work — flagged here rather than bundled into this fix.

Surface area

• UI — new page / dialog / panel / menu item / setting / empty state in apps/web or apps/desktop (including Electron menu bar)
• Keyboard shortcut — new or changed
• CLI / env var — new od subcommand or flag, new tools-dev / tools-pack / tools-pr flag, or new OD_* env var
• API / contract — new /api/* endpoint, new SSE event, or changed shape in packages/contracts
• Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
• i18n keys — added new translation keys (see TRANSLATIONS.md for the locale workflow)
• New top-level dependency — adding any new entry to the root package.json (dependencies or devDependencies); workspace-package package.json files are out of scope. Include a paragraph on what we get vs. what bytes we ship (see CONTRIBUTING.md → Code style)
• Default behavior change — changes what existing users experience without opting in (default model, default setting, file/SQLite schema, auto-network on startup, auto-install)
• None — internal refactor, docs, tests, or translation update only

POST /api/runs/:id/permission and the permission_request/permission_resolved SSE events are new surface, not yet reflected in packages/contracts — happy to add typed contract entries for them if maintainers want that in this PR rather than a fast-follow.

Screenshots

N/A — no apps/web/apps/desktop UI surface touched. The observable change is on the daemon's HTTP/SSE API (see "API / contract" above and "Bug fix verification" below for how I actually watched it happen).

Bug fix verification

• No automated red-spec test accompanies this fix. Encoding it as a falsifiable test means driving a real (or realistically mocked) ACP session/request_permission round-trip end-to-end through attachAcpSession, which is more scope than I could responsibly take on tonight on top of the fix itself — I didn't want to let an imperfect test gate a real safety fix, and I'd rather be upfront about the gap than fake coverage. I'd welcome guidance on the right harness for this (possibly the mocks/ ACP-family fixtures already in this repo) and can follow up with one.
• What I did instead: live-verified both outcome paths against a real, running daemon and a real Hermes ACP session (not mocked) — a plugin-gated MCP tool call, driven through od run start, produced the new permission_request SSE event with the exact tool name/arguments Hermes sent; a real POST /api/runs/:id/permission call resolved it and the tool executed for real; and two separate unanswered requests correctly denied on the 55s timeout instead of defaulting to allow, which is exactly the failure mode this PR closes.

Validation

• pnpm typecheck — clean
• pnpm guard — clean (60/60)
• pnpm --filter @open-design/daemon test — compared against main in two fresh, isolated git worktree checkouts (this commit vs. its immediate parent) to avoid both node_modules cross-contamination and machine load skewing results. Baseline: 23 failed test files / 152 failed tests, all pre-existing (missing Composio/Codex/Cursor/vela credentials and CLIs in this sandbox, unrelated to ACP). This commit: 24 failed files / 150 failed tests. The one-file difference, tests/routes/handoff.test.ts, is a beforeAll startServer hook timeout (10s) that reproduces identically on both commits when that file is run in isolation — a pre-existing timing flake, not a regression from this change. No ACP- or permission-related test ever appears in either failure list.
• Live manual verification against a real running daemon + real Hermes ACP session, described above under "Bug fix verification"

[lefarcen]

Thanks @btagritech — good catch on a safety gate that was effectively auto-allowing dangerous ACP tool calls. I’m routing this for reviewer/product/QA triage now.

💡 To drive this PR to merge hands-free, paste this to your AI coding agent (Claude Code / Codex / opencode / Cursor …):
Take over nexu-io/open-design#6135 until it merges — read https://raw.githubusercontent.com/nexu-io/looper/main/skills/pr-takeover/SKILL.md and follow it.

[nettee]

@btagritech I'm holding off on generating review comments for #6135 because this pull request has merge conflicts right now.

Please resolve the conflicts with main and push the updated branch. Once that's done, request or wait for the review to run again and I'll take another look.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

🧪 Queued for QA validation — this PR changes a live agent-run permission path, so it should get a manual QA pass before merge. Nothing needed from you right now; we’ll update here once it’s validated. Thanks for the contribution! 🙏

[nettee]

@btagritech I'm holding off on generating review comments for #6135 because this pull request has merge conflicts right now.

Please resolve the conflicts with main and push the updated branch. Once that's done, request or wait for the review to run again and I'll take another look.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[nettee]

@btagritech I'm holding off on generating review comments for #6135 because this pull request has merge conflicts right now.

Please resolve the conflicts with main and push the updated branch. Once that's done, request or wait for the review to run again and I'll take another look.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

Thanks @xiaoche-hub — I checked the current UI diff and agree these permission-card states are the key remaining design input.

@btagritech, could you add either a short recording or labelled screenshots from the current head covering the pending state, one approved outcome, one denied outcome, and the timeout state? Once those visuals are in the thread, design should have what it needs to finish this pass.