/acp-status, /acp-enforce and per-tool rule commands via UserPromptExpansion (0.18.0)

[davidcrowe]

What

/acp-status, /acp-enforce, /acp-audit, /acp-allow <tool>, /acp-ask <tool>, /acp-deny <tool>, /acp-apply <proposal> — the workspace policy from the terminal. Version 0.18.0. Pairs with gatewaystack-connect feat/terminal-intents (rollout key terminal_intents, internal).

A command the human types reaches the hook on UserPromptExpansion before it expands. The hook files it with the gateway (POST /plugin/intents), prints the signed confirm link the gateway hands back, and blocks the expansion — the model never sees the command, its body, or the link as a prompt. The human's tap on that link is what changes the workspace; the key on this machine never writes policy. Nothing fires inside subagents (agent_id).

Probe (Claude Code 2.1.270, recorded in the gateway PR): UserPromptExpansion fires only for a human‑typed slash command and can be blocked; hook systemMessage is written to the transcript, which is why no secret rides on it — the link executes only the intent the human already typed, as that human, once.

Also

• The no‑credential and local‑mode early exits no longer swallow UserPromptExpansion — the handler owns its own "Not connected — run /acp-connect first" line (found while testing; the generic floor was intercepting the event).
• SessionStart prints the gateway's once‑a‑day offer on the human channel.
• The session receipt adds /acp-status shows what enforcement would have held after a shadow notice.
• README "Commands" section; skills/acp/SKILL.md tells the model to offer the commands instead of only the console.

Tests

node --test test/*.test.mjs → 200 passed. New test/terminal-intents.test.mjs (8): POST body for enforce/allow, GET for status with a proposal line, non‑ACP command passthrough, subagent passthrough, no‑credentials block, not-rolled-out 404, unreachable gateway — exit 0 in every case. Manifest validation green; all three version sites at 0.18.0.

Order

Gateway PR first, promote, then this. Against an old gateway /acp-* prints "Terminal commands aren't on for this workspace yet" and points at the console.