ACP 与 Core 的职责边界

    pub(super) fn prompt_text(prompt: &[acp::ContentBlock]) -> acp::Result<String> {
        let unsupported = |kind: &str| {
            acp::Error::invalid_params().data(format!(
                "unsupported prompt content block `{kind}`; this agent accepts text only and did not send the request to the model"
            ))
        };
        let mut text = Vec::new();
        for block in prompt {
            match block {
                acp::ContentBlock::Text(content) => text.push(content.text.as_str()),
                acp::ContentBlock::Image(_) => return Err(unsupported("image")),
                acp::ContentBlock::Audio(_) => return Err(unsupported("audio")),
                acp::ContentBlock::Resource(_) => return Err(unsupported("resource")),
                acp::ContentBlock::ResourceLink(_) => return Err(unsupported("resource_link")),
                _ => return Err(unsupported("unknown")),
            }
        }
        Ok(text.join("\n"))
    }

    pub(super) async fn handle_event(
        &self,
        session_id: &acp::SessionId,
        session: &AgentSession,
        state: &mut TurnState,

    pub(super) async fn handle_event(
        &self,
        session_id: &acp::SessionId,
        session: &AgentSession,
        state: &mut TurnState,
        event: AgentEvent,
    ) {
        let observation = state
            .observer
            .as_mut()
            .and_then(|observer| observer.event(&event));
        self.emit_run_observation(observation).await;
        match event {
            AgentEvent::TextDelta { text } => {
                if !text.is_empty() {
                    state.saw_text = true;
                }
                state.delta_text.push_str(&text);
                self.emit_text(session_id, &text).await;
            }
            AgentEvent::ReasoningDelta { text } => {
                self.emit_thought(session_id, &text).await;
            }
            AgentEvent::ToolStart { .. } => {
                // Streaming and the fact runner both announce a call before its
                // arguments exist. Painting that announcement opens a second
                // Run row for one execution, and it also paints a twin that
                // the same-response collapse never runs.
            }

            AgentEvent::ToolStart { .. } => {
                // Streaming and the fact runner both announce a call before its
                // arguments exist. Painting that announcement opens a second
                // Run row for one execution, and it also paints a twin that
                // the same-response collapse never runs.
            }
            AgentEvent::ToolExecutionStart {
                id,
                name,
                args: tool_args,
            } => match note_tool_row(&mut state.painted_tools, &id) {
                ToolRowPaint::Open => {
                    self.emit_tool_call(session_id, &id, &name, Some(&tool_args))
                        .await;
                }
                ToolRowPaint::Update => {
                    self.emit_tool_call_started(session_id, &id, &name, &tool_args)
                        .await;
                }
            },
            AgentEvent::ToolOutputDelta { id, name, delta } => {
                self.emit_tool_call_output_delta(session_id, &id, &name, &delta)
                    .await;
            }
            AgentEvent::ToolEnd {
                id,
                name,

pub(super) fn tool_permission_ask(
    session_id: &acp::SessionId,
    tool_id: &str,
    tool_name: &str,
    args: &serde_json::Value,
    workspace: Option<&Path>,
) -> acp::RequestPermissionRequest {
    let raw_input = prepared_raw_input(tool_name, args);
    let why = approval_reason(&assess(tool_name, args, workspace));
    let mut fields = acp::ToolCallUpdateFields::new()
        .title(tool_title(tool_name))
        .kind(tool_kind_for(tool_name))
        .status(acp::ToolCallStatus::Pending)
        .content(vec![acp::ToolCallContent::from(acp::ContentBlock::Text(
            acp::TextContent::new(why),
        ))]);
    if let Some(raw_input) = raw_input {
        fields = fields.raw_input(raw_input);
    }
    let mut options = vec![acp::PermissionOption::new(
        acp::PermissionOptionId::new("allow-once"),
        "Yes, proceed",
        acp::PermissionOptionKind::AllowOnce,
    )];
    let learnable = (tool_name == "bash")
        .then(|| args.get("command").and_then(serde_json::Value::as_str))
        .flatten()
        .and_then(crate::approval_learning::learnable_rule);
    if let Some(rule) = learnable {
        options.push(acp::PermissionOption::new(
            acp::PermissionOptionId::new("allow-always"),
            format!("Yes, and don't ask again for `{rule}` in this workspace"),

        if failure.is_none() && !progress.has_action_evidence() {
            progress.mark_evidence_missing();
            failure = Some(anyhow::anyhow!(
                "A3S Code agent ended without a successful tool execution"
            ));
        }
        let (outcome, reason) = match &failure {
            None => (
                ExecutionResultOutcomeV1::Succeeded,
                TerminalReason::AgentEnd,
            ),
            Some(error) => classify_failure(&progress, error),
        };
        if let Some(path) = &unattended.result_file {
            if let Err(error) = persist_result(path, &progress.report(outcome, reason)).await {
                tracing::error!(path = %path.display(), "could not write the result record: {error:#}");
                failure.get_or_insert(error);
            }
        }
        match failure {
            None => Ok(acp::PromptResponse::new(acp::StopReason::EndTurn)),
            // These outcomes are recorded in the result file. Returning a
            // JSON-RPC internal error makes Harbor's summary say only
            // "Internal error" and hides the reason.
            Some(_)
                if matches!(