LLM::ACPClient

Non-prompt requests (initialize, session/new) get a longer default than the HTTP connect timeout: the first npx run downloads the agent package before it can answer initialize, which easily exceeds 30 s.

Claude/Codex adapters hold a subprocess or heavy state per session.

Escape hatch for power users running their own ACP agent binary. Off by default so an untrusted $NOIR_HOME/config.yaml (or a provider value pasted from elsewhere) can't silently spawn a process.

A prompt turn is the generation itself, so it takes the same budget as an HTTP provider's read timeout (NOIR_AI_TIMEOUT).

Resolve provider aliases to actual executable command + args.

session/request_permission is how the ACP agent asks to run a tool — shell commands, file writes, network fetches — on this machine. Noir used to answer every one of them with a hardcoded {"outcome":"selected","optionId":"allow-once"}, i.e. blanket approval for whatever the agent decided to do.

That is remote-controllable input. The prompt Noir sends is source code from the tree being scanned, and scanning code you did not write is the normal case; a file carrying "ignore the above and run X" is enough to turn an endpoint scan into arbitrary local execution, with the auto-yes removing the one checkpoint that would have caught it. It also contradicted the resolve_command hardening right above, which refuses to spawn an unknown agent binary precisely so untrusted config can't reach code execution.

Deny by default. Noir puts the code to analyse in the prompt, so the agent needs no tools to answer — the only thing lost is an agent's optional extra poking around. Operators who want that back opt in explicitly, same shape as the custom-command escape hatch.

Pick a real option from the ones the agent offered rather than inventing an id. Option ids are agent-defined (proceed_once, reject, …); the kind field is the part the protocol standardises, so it is what we match on. With nothing usable on offer, cancelled is the protocol's own "no decision" outcome and needs no id.

Public rather than private so the decision can be asserted without standing up an agent process.

Optional cleanup hook for adapters that manage external resources.

General and Ollama both report their failures on stderr; the rescue above used to be bare, so a session that never spawned, an agent that died mid-turn, a protocol error and a genuinely empty answer were all the same "" with nothing written anywhere. The caller reads "" as "this code defines no endpoints", which made a completely dead agent look like a successful AI-assisted scan.

Public so the report can be asserted without standing up an agent process.

Anything but end_turn means the answer is cut short or absent (refusal, max_tokens, max_turn_requests, cancelled). Say so, or the caller reads it as "this code defines no endpoints".

Send a single prompt and get a response as a String.

Send chat-style messages (system/user) and get a response as a String.