Sign up
View stargazersSign up

ACP ID-only command approvals lose context and leave terminal execution blocked#26620

opened1d agobyTtrahane

Area

ACP provider adapter / command approvals

Reproduction

Tested in the unmodified T3 Code 0.1.3 app on macOS arm64, with a fresh isolated T3 profile and Devin 3000.11.228 installed through ACP Registry (acpRegistry_devin).

  1. Add Devin through ACP Registry and select SWE-1.6 Slow.
  2. Set T3 access to Supervised and Devin's native mode to Code.
  3. In a disposable workspace, ask Devin to execute python3 -c "from pathlib import Path; Path('approval-probe.txt').write_text('ACP_APPROVAL_OK\n')" with its terminal tool.
  4. Click Approve on the resulting command request.

Actual result

The approval prompt shows Session second-clef instead of the command. After approval, the persisted command output is Failed to create terminal. Please try again. and the file is not created. Devin then asks for approval again on retry.

As a control, the same kind of command under T3 Full access and Devin Bypass Permissions exits 0 and writes the expected file. Devin's injected orchestrator_capabilities MCP call also succeeds, so this is not a general login, executable, or MCP connectivity failure.

Expected result

The approval names the tracked command, and accepting that execute request authorizes its client terminal. An unknown tool must still not acquire an execute grant.

Current-main regression

On 9e09926d97824179d97311d1a810c6b5bb60d2d1, the ACP handler parses the ID-only session/request_permission payload without the title, kind and raw input already received in the active turn's tool_call event. The missing kind also prevents clientPolicyGrants.recordApproval from recording an execution grant.

An extension of the existing adapter permission regression fails with expected 'Session mock-session-1' to equal 'git status'. Recovering omitted fields from that turn's tracked tool fixes the prompt and terminal grant; the unknown-kind and explicit-native-read cases continue to deny terminal execution.

The runtime evidence is text, persisted tool outcomes and filesystem checks. Browser screenshot capture timed out; no screenshot is claimed.