Bug: RequestPermissionResponse missing outcome wrapper — Claude Code tool calls universally rejected

[chengli]

Summary

openab's auto-reply for session/request_permission (in src/acp/connection.rs) sends a JSON-RPC response body with the wrong shape — missing the required outcome wrapper. The response works for Kiro CLI (loose parsing) but is rejected by claude-agent-acp (strict ACP SDK validation), causing every tool call from Claude Code to fail with "User refused permission to run tool", even though openab logs auto-allow permission.

This is also the upstream root cause for the symptom reported in #127 (Cursor's Cannot read properties of undefined (reading 'outcome') error) — the Cursor SDK is trying to read response.outcome.optionId and crashing because response.outcome is undefined.

Current vs spec response shape

src/acp/connection.rs line 99:

let reply = JsonRpcResponse::new(id, json!({"optionId": "allow_always"}));

Per the official ACP TypeScript SDK schema (@agentclientprotocol/sdk types.gen.d.ts):

export type RequestPermissionResponse = {
    _meta?: { ... } | null;
    /** The user's decision on the permission request. */
    outcome: RequestPermissionOutcome;
};

export type RequestPermissionOutcome =
    | { outcome: "cancelled"; }
    | (SelectedPermissionOutcome & { outcome: "selected"; });

The valid response shape is:

{
  "outcome": {
    "outcome": "selected",
    "optionId": "allow_always"
  }
}

openab is sending the inner object's optionId field at the top level, with no outcome wrapper.

Repro

1. Run openab configured with claude-agent-acp backend (any Claude Code agent)
2. From Discord, ask the agent to do anything that requires a tool call (e.g. git pull, read a file, run ls)
3. openab log shows: INFO openab::acp::connection: auto-allow permission title="..."
4. claude-agent-acp log shows: tool_call_update status=failed rawOutput="User refused permission to run tool"
5. The agent gives up or works around it without ever executing the tool

Trace from a real session (agent-broker:claude running claude-agent-acp@0.25.0 + Claude Code):

18:54:32.071  request_permission for git -C ~/work/trips pull --ff-only
18:54:32.071  auto-allow permission title="git -C ~/work/trips pull --ff-only"
18:54:32.079  tool_call_update status=failed rawOutput="User refused permission to run tool"

8 ms between auto-allow and the failure — claude-agent-acp is parsing openab's reply, finding no outcome field, and treating it as a refusal.

Why Kiro doesn't see this

Kiro CLI's ACP implementation parses the response loosely and accepts {"optionId": "allow_always"} as if it were already inside the outcome wrapper. So this bug is invisible when running the kiro-cli backend, but every Claude Code or Cursor user is hitting it on every tool call.

Suggested fix

Wrap the response correctly:

let reply = JsonRpcResponse::new(id, json!({
    "outcome": {
        "outcome": "selected",
        "optionId": "allow_always"
    }
}));

I've patched my local fork with this change and all Claude Code tool calls now succeed end-to-end: Discord mention → claude-agent-acp spawned → request_permission → openab auto-allow → tool executes → result streams back. Verified with a git pull + file edit + git commit -m ... + git push flow.

Also fixes / relates to

• Docs/FR: Cursor ACP terminal failures (outcome undefined) + macOS launchd notes #127 Cursor Cannot read properties of undefined (reading 'outcome') — same root cause; the Cursor SDK is reading response.outcome.optionId, crashes because response.outcome is undefined. The !sh shell escape workaround in Docs/FR: Cursor ACP terminal failures (outcome undefined) + macOS launchd notes #127 should no longer be needed after this fix.
• fix: ExitPlanMode permission rejected — auto-reply sends invalid optionId #111 ExitPlanMode permission rejected — DIFFERENT bug (wrong optionId selected). Even with fix: ExitPlanMode permission rejected — auto-reply sends invalid optionId #111's proposed fix landed, the outcome wrapper bug remains. Both fixes need to land. A combined fix would (a) wrap the response correctly, and (b) select the right optionId from the options array based on kind priority (allow_always > allow_once > first non-reject_once).

Happy to send a PR for the wrap fix alone, or a combined wrap + optionId-selection fix that also closes #111. Just say which scope you prefer.

[chaodu-agent]

Thanks for the thorough write-up and the trace — this is confirmed as a spec-compliance bug on our side.

Issue at a Glance

Discord User ──► openab ──► Claude Code / Cursor agent
                   │
                   ▼
          session/request_permission
          (agent asks: "can I run this tool?")
                   │
                   ▼
          openab auto-reply (WRONG shape):
          ┌─────────────────────────────────┐
          │ { "optionId": "allow_always" }  │  ← flat, no wrapper
          └─────────────────────────────────┘
                   │
                   ▼
          Claude Code / Cursor SDK expects:
          ┌─────────────────────────────────────────┐
          │ { "outcome": {                          │
          │     "outcome": "selected",              │
          │     "optionId": "allow_always"          │
          │ }}                                      │
          └─────────────────────────────────────────┘
                   │
                   ▼
          SDK cannot find `outcome` field
          → treats as REFUSAL
          → "User refused permission to run tool"
          → every tool call fails ❌

          Kiro CLI: works (loose parsing, ignores missing wrapper)
          Claude Code: broken ❌
          Cursor: broken ❌

Root Cause

Our RequestPermissionResponse in src/acp/connection.rs line 99 is missing the required outcome wrapper.

ACP Spec References

• RequestPermissionResponse schema — outcome field is required
• RequestPermissionOutcome schema — must be { outcome: "selected", optionId: "..." } or { outcome: "cancelled" }
• Permission Requests implementation guide — SDK examples confirm the expected shape
• Requesting Permission protocol docs

Next Steps

We'd welcome a combined PR that:

1. Wraps the response correctly with the outcome envelope
2. Selects the right optionId from the options array based on kind priority (allow_always > allow_once > first non-reject_once), which also addresses fix: ExitPlanMode permission rejected — auto-reply sends invalid optionId #111

That way we land both fixes in one shot. Please go ahead and send the PR!