v0.16.2

Added

• ServeAcpConfig takes additional_directories, so an agent can keep each session to cwd. An agent always advertised sessionCapabilities.additionalDirectories and took every directory that a client sent with session/new, so an agent whose tools and checks look at cwd alone had to narrow the session itself, and a narrowed copy of the session lost the diffs, the terminals, and the "always" that 0.16.0 gave its cards and prompts. With additional_directories: false, initialize leaves the capability out, so a client that follows the protocol sends no additional directories. A session/new that sends some anyway is refused with invalid params that carry the list as it was sent, before the agent resolves a root or builds a flow, and an empty list counts as none. Every session then has cwd as its one root, and the file tools, the prompts, and the cards follow from the session with no change. A config that leaves the option out, or sets true, behaves as it did.

• ServeAcpConfig takes modes, so an agent that runs on the host can leave Auto out. Every session offered Manual, Accept edits, and Auto, and both setters took any of the three, so an agent that runs outside a container had to replace run_command's approval check to keep a command from running unasked in Auto, and a prompt from the replaced check came out plain, with no command line and no "always" to grant. modes: ['manual', 'accept_edits'] lists only those two in session/new, in modes and in the mode config option alike, and session/set_mode and session/set_config_option refuse Auto as they refuse a mode they don't know, with invalid params that list the modes on offer, nothing sent to the client, and the mode left as it was. Every command then asks through the check that it already has. An edit's prompt offers Allow all edits this session only when the agent offers Accept edits, since that's the mode the grant switches to, and otherwise offers Allow and Reject. The offered modes keep the order Manual, Accept edits, Auto whatever order modes lists them in, a mode listed twice counts once, and a session starts in default_mode, or in the first mode offered when the config sets none. An empty modes, an entry that isn't a mode, and a default_mode that the agent doesn't offer each reject acp_agent with an error that names the problem, before it loads the SDK, so serve_acp fails at launch. That last check is new for a config that leaves modes out as well, so a default_mode outside the three modes, which a caller with no types could pass before and which failed only at the first gated tool call, now fails as the agent is built. A config that sets neither field behaves as it did.

Internal

• docs/acp.md, docs/api-reference.md, and SECURITY.md cover both options. Each passage says what every ACP client gets before it says what Zed does, and it names the Zed commit that the Zed behavior was read from. Three checks by hand in Zed 1.24.3 confirmed it.