feat(acp): serve /acp from the embedded openab run gateway

#1260 mounted the ACP endpoint only on the standalone `openab-gateway`
binary (`serve()`). Fleet deployments run the unified binary's embedded
gateway (`openab run`, main.rs) instead, which never called `serve()` — so
`/acp` was unreachable there.

Mount `/acp` on the embedded gateway too (gated by `OPENAB_ACP_ENABLED`),
and route ACP replies back through the unified adapter's `dispatch_reply`
(`platform == "acp"`). Also start the embedded HTTP server when ACP is
enabled even if only non-webhook platforms (e.g. Discord, which the core
connects to directly) are configured — otherwise the listener never binds.

Seed the `acp` platform into the gateway trust registry so its identity
gating honours `GATEWAY_ALLOW_ALL_USERS` / `GATEWAY_ALLOWED_USERS` (the
ACP sender id is `acp_client`); without this the acp platform defaulted to
deny-all and every prompt was rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: brettchien

docs/acp-official-methods.md

@@ -47,7 +47,7 @@ Directions use the ACP roles: the **Agent** answers prompts (here, OpenAB); the
 | Method | Direction | Purpose | OpenAB Phase 1 |
 |---|---|---|---|
 | `session/cancel` | Client → Agent | Cancel in-flight work (one-way, no response) | ✅ conformant (notification; prompt ends `stopReason:"cancelled"`) |
-| `session/update` | Agent → Client | Stream session events | ✅ `agent_message_chunk` (text). Other variants (`tool_call`, `tool_call_update`, `plan`, …) are Phase 2 |
+| `session/update` | Agent → Client | Stream session events | ✅ `agent_message_chunk` (text). Other variants (`agent_thought_chunk`, `tool_call`, `tool_call_update`, `plan`, `available_commands_update`, `usage_update`, …) are Phase 2 / not forwarded |
 | `$/cancel_request` | Bidirectional | Cancel an in-flight JSON-RPC request | ⛔ |
 
 ## Client methods (Agent → Client, request/response)
@@ -80,8 +80,13 @@ The chat subset is **wire-conformant** with ACP Schema v1.19.0:
   `request_permission`, fs/terminal, session admin (`list`/`delete`/config/mode)** —
   deferred to later phases per the roadmap.
 
-### To verify against a live client
+### Live verification status
 
-- Field-level exactness of `agentCapabilities` / `clientCapabilities` sub-objects and
-  the `ContentBlock` variants beyond `text`, by connecting a real ACP client (e.g.
-  Zed) and diffing the `initialize` + `session/prompt` exchange against the schema.
+- **Verified end-to-end (2026-07-17)** — the chat subset (`initialize` → `session/new`
+  / `session/resume` → `session/prompt` → streamed `session/update` `agent_message_chunk`
+  → `{stopReason}`, plus `session/cancel`) drives a real backend (cursor-agent) and
+  streams replies to a WebSocket client (a Chrome side-panel extension + a raw
+  `ws` client).
+- **Still unverified** — field-level exactness of `agentCapabilities` /
+  `clientCapabilities` sub-objects against a *third-party* ACP client (e.g. Zed), and
+  `ContentBlock` variants beyond `text` (image / audio / resource).

docs/adr/acp-server-websocket-phase1.md

@@ -25,9 +25,28 @@ third-party ACP clients (Zed, JetBrains, …) interoperate — no custom method
 
 ## 2. Decision — Phase 1 primitive surface (ACP-conformant)
 
-Transport: `GET /acp`, feature-gated `acp` + runtime `OPENAB_ACP_ENABLED`. Token auth
-on the WS upgrade via timing-safe compare (`subtle::ConstantTimeEq`,
-`OPENAB_ACP_AUTH_KEY`). JSON-RPC 2.0; non-`"2.0"` rejected with `-32600`.
+Transport: `GET /acp`, feature-gated `acp` + runtime `OPENAB_ACP_ENABLED`. Mounted on
+**both** the standalone `openab-gateway` binary (`serve()`) **and** the embedded
+gateway of `openab run` (the unified binary) — so fleet deployments that run
+`openab run` (not the standalone gateway) serve ACP too. The embedded HTTP server
+starts whenever `OPENAB_ACP_ENABLED` is set (or any platform / `[gateway]` is
+configured) — so an ACP-only deployment, or one whose only platform is Discord (which
+the core connects to directly, without the webhook server), still binds the listener.
+ACP replies are routed back via the unified adapter's `dispatch_reply`
+(`platform == "acp"`).
+
+**Two independent auth layers:**
+
+1. **Transport** — token on the WS upgrade, timing-safe compare (`OPENAB_ACP_AUTH_KEY`;
+   unset ⇒ unauthenticated).
+2. **Identity** — ACP events carry a fixed synthetic sender id `acp_client` and pass
+   through the gateway trust registry (the `acp` platform is seeded there alongside
+   telegram/line/…). Admit the sender with `GATEWAY_ALLOW_ALL_USERS=true` or
+   `GATEWAY_ALLOWED_USERS=acp_client`; otherwise every prompt is denied with a
+   "request-access" echo. (These must be **process** env on the broker, not
+   `[agent].env`.)
+
+JSON-RPC 2.0; non-`"2.0"` rejected with `-32600`.
 
 ### Client → Agent (requests)
 

src/main.rs

@@ -419,7 +419,7 @@ async fn main() -> anyhow::Result<()> {
         let allow_all_users = env_bool("GATEWAY_ALLOW_ALL_USERS", false);
         let allowed_users = env_set("GATEWAY_ALLOWED_USERS");
         let mut reg = PlatformTrustConfigs::new();
-        for platform in ["telegram", "line", "feishu", "wecom", "googlechat", "teams"] {
+        for platform in ["telegram", "line", "feishu", "wecom", "googlechat", "teams", "acp"] {
             reg.insert(
                 platform,
                 TrustConfig::new(
@@ -910,7 +910,14 @@ async fn main() -> anyhow::Result<()> {
     let (_unified_handle, shared_unified_adapter) = {
         use openab_core::gateway::{process_gateway_event, GatewayEventContext};
 
-        if unified_platform_enabled || cfg.telegram.is_some() {
+        // The ACP endpoint (mounted below) needs this embedded HTTP server too —
+        // start it even when only non-webhook platforms (e.g. Discord, which the
+        // core connects to directly) are configured.
+        let acp_enabled = cfg!(feature = "acp")
+            && std::env::var("OPENAB_ACP_ENABLED")
+                .map(|v| v == "true" || v == "1")
+                .unwrap_or(false);
+        if unified_platform_enabled || cfg.telegram.is_some() || acp_enabled {
             let listen_addr =
                 std::env::var("GATEWAY_LISTEN").unwrap_or_else(|_| "0.0.0.0:8080".into());
 
@@ -1113,6 +1120,20 @@ async fn main() -> anyhow::Result<()> {
                 );
             }
 
+            // ACP server endpoint — mount on the embedded gateway so `openab run`
+            // (not just the standalone gateway binary) serves ACP over WebSocket.
+            #[cfg(feature = "acp")]
+            if std::env::var("OPENAB_ACP_ENABLED")
+                .map(|v| v == "true" || v == "1")
+                .unwrap_or(false)
+            {
+                info!("unified: ACP server endpoint enabled at /acp");
+                app = app.route(
+                    "/acp",
+                    axum::routing::get(openab_gateway::adapters::acp_server::ws_upgrade),
+                );
+            }
+
             let app = app.with_state(gw_state.clone());
 
             // Bridge task: receive events from adapters via event_tx, dispatch to core

src/unified_adapter.rs

@@ -89,6 +89,12 @@ impl UnifiedGatewayAdapter {
                     .await;
                 }
             }
+            #[cfg(feature = "acp")]
+            "acp" => {
+                if let Some(ref registry) = self.gw_state.acp_reply_registry {
+                    openab_gateway::adapters::acp_server::handle_reply(reply, registry).await;
+                }
+            }
             other => {
                 tracing::warn!(platform = other, "unified adapter: unknown platform, cannot route reply");
             }