feat: add guarded TTY ACP bridge

[yattdev]

Overview

Add a narrow, versioned ACP extension that lets an authorized Kandev integration request a one-shot TTY command through the already-running Codex App Server process.

This closes the upstream ACP bridge gap only. Deployment authorization, audit persistence, and model-tool registration remain owned by Kandev; the deployment-only non-TTY repair is unchanged.

Changes

• Advertise guarded-TTY capability version 1 and register:
  • _kandev/guarded_tty/capability
  • _kandev/guarded_tty/exec
• Accept only { sessionId, argv } with strict count, per-argument, total-byte, and NUL bounds.
• Derive cwd and sandboxPolicy from the active trusted ACP session.
• Generate the process ID inside the bridge and dispatch App Server command/exec with tty: true, streaming enabled, and fixed timeout/output caps.
• Correlate output by process ID, validate base64, preserve split UTF-8 output, and enforce a 64 KiB aggregate cap.
• Return a stable, non-leaking receipt with capability/session/process/cwd/TTY/output/exit/timestamp evidence.
• Terminate dispatched processes best-effort and idempotently on cancellation, stale session, timeout, overflow, invalid output, or App Server rejection.
• Keep ordinary model commandExecution mapping and non-TTY output behavior unchanged.

Security boundaries

The extension does not accept caller-controlled cwd, sandbox policy, permission profile, process ID, TTY flags, environment, stdin/write/resize/attach, or interactive lifecycle controls. It does not create a host-side executor, mutate CODEX_CONFIG, enable unified_exec, or alter mounts or credentials.

Testing

• npx vitest run src/__tests__/CodexACPAgent/guarded-tty-exec.test.ts src/__tests__/CodexACPAgent/terminal-output-events.test.ts --no-file-parallelism — 28 passed
• npm run typecheck — passed
• npm run build — passed
• npm test — 495 passed, 26 skipped
• git diff --check origin/main...HEAD — passed

Credentialed npm run test:e2e was not rerun because CODEX_API_KEY and OPENAI_API_KEY are unavailable. Prior ChatGPT-authenticated App Server probes verified TTY stdin/stdout, stty, the trusted worktree pwd, and exit code 0. Bun-only release bundling was not run because Bun is unavailable; the normal production build passed.

Breaking changes

None. This adds versioned underscore extension methods and does not change existing ACP command behavior.

Screenshots

N/A — no UI-visible changes.

[yattdev]

@nikita-ashihmin This first-time fork PR is ready to run CI at exact head 1a5d8b9cf1f70a8677ead500088a8e022cdc65bb, but GitHub stopped both workflows at the fork-approval gate with zero jobs: CI run 33305349645 and Conventional PRs run 33305349647. Could you approve those workflow runs? This is only a workflow-approval request; I will wait for terminal green checks before requesting code review.

[yattdev]

@nikita-ashihmin Could you approve the two GitHub Actions workflows for PR #451 at exact head 0bd0f8fb74a0dfec93eb3a8e586dc0d7c0e8488d? CI: https://github.com/agentclientprotocol/codex-acp/actions/runs/33910495905 and Conventional PRs: https://github.com/agentclientprotocol/codex-acp/actions/runs/33910495965. This is only a workflow-approval request so jobs can materialize; the PR remains draft and code review will wait for exact-head terminal-green CI.