ACP: request user permission before potentially destructive RLM operations

[hubsx]

Summary

Prime Agent 0.9.1 does not send ACP session/request_permission requests before potentially destructive operations. As a result, ACP clients such as Paseo cannot ask the user to approve or reject an operation before it starts, even when the client has automatic approval disabled.

This is a feature request rather than a vulnerability report: ACP is a trusted-code boundary and Prime Agent does not currently claim to sandbox execution. The goal is to add a useful human-in-the-loop safety layer for interactive ACP clients.

Environment

• Prime Agent: 0.9.1
• Paseo: 0.6.1
• macOS: 26.5.2 (25F84)
• Prime Agent launched by Paseo through prime-agent --mode acp
• Paseo Prime Agent provider feature auto_accept: false

Current behavior

1. Start a Prime Agent session from Paseo with auto_accept disabled.
2. Ask the agent to perform an operation that should require confirmation. A safe disposable example is deleting a temporary test directory through RLM bash().
3. Prime Agent publishes ACP tool_call / tool_call_update events for the IPython cell and nested shell work.
4. The operation starts without an ACP permission round trip, so Paseo has no opportunity to show Allow once / Always allow / Reject.

Setting auto_accept=false only controls how Paseo responds if the agent sends a permission request. It cannot create a request that Prime Agent never sends.

Source-level observation

ACP itself supports the client method:

session/request_permission

The ACP SDK bundled with Prime Agent includes client.requestPermission(...). However, Prime Agent's ACP adapter currently does not call it. The adapter initializes sessions and maps session events to session/update, but sensitive operations are not paused for client authorization.

Prime Agent's single-tool architecture makes this more subtle than approving a top-level shell tool. ACP sees the model's outer tool as an IPython execution, while the actual command is started later inside the persistent RLM kernel:

await bash("some command")

The command can also be built dynamically, so classifying only the outer IPython source is not a reliable enforcement point.

Expected behavior

When an interactive ACP client is attached and automatic approval is disabled, Prime Agent should be able to:

1. pause a sensitive operation before its external effect begins;
2. send session/request_permission with useful context and options;
3. wait for Allow once / Always allow / Reject / Cancel;
4. continue or fail the operation according to the response; and
5. cancel pending permission requests safely when the ACP prompt turn is cancelled or the connection closes.

For non-interactive clients, the fallback behavior should be explicit and configurable rather than silently assuming approval.

Suggested implementation direction

A practical first integration point may be the RLM bash() process-spawn boundary:

RLM bash() prepares command
  -> permission hook
  -> ACP client.requestPermission(...)
  -> wait for decision
  -> spawn or reject

This needs a kernel-to-host permission event because the ACP adapter cannot reliably infer nested commands from the outer IPython tool call.

Shell interception alone would not be a complete security boundary: Python code can mutate files or start processes directly. Longer term, scoped capabilities or sandboxing would provide stronger enforcement. Still, bridging bash() to ACP permissions would cover a common and visible class of destructive operations.

Related reports

• Feature Request: ACP features completion #1040 tracks other ACP feature gaps, but not permission requests.
• [RLM] Support scoped execution and caller-granted capabilities #896 discusses scoped RLM execution and caller-granted capabilities.
• Add security/sandboxing guidance for long-running autonomous runs #1120 requests security and sandboxing guidance.

I searched all current and closed Issues and the repository's existing Discussions and did not find a report specifically covering ACP session/request_permission for Prime Agent tool execution.