Skip to content

feat(acp): experimental ACP agent mode (Codex) via the Agent Client Protocol #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pjdoland wants to merge 6 commits into
base: main
Choose a base branch
from
Open

feat(acp): experimental ACP agent mode (Codex) via the Agent Client Protocol #380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f842fdf
feat(codex): experimental Codex agent mode via the Agent Client Proto…
pjdoland Jun 22, 2026
e3b63e7
Merge remote-tracking branch 'upstream/main' into feat/378-codex-acp-…
pjdoland Jul 10, 2026
cc4ac80
feat(acp): rename to ACP mode, fix streaming and context, add session…
pjdoland Jul 10, 2026
e1ce874
fix(acp): strip the joined-form context preamble from session previews
pjdoland Jul 11, 2026
2f0d70e
Merge remote-tracking branch 'upstream/main' into feat/378-codex-acp-…
pjdoland Jul 19, 2026
9872749
fix(acp): track Claude mode's slash-command join semantics
pjdoland Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 24 additions & 19 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ Bypass Permissions never persists: starting a **New chat session** (or `/clear`)

Choosing **Bypass Permissions** does not arm it immediately. It opens a confirmation step; only after you confirm does bypass take effect, and while it is active the shield turns into a red warning icon as a persistent indicator. Bypass must be re-armed each session: starting a new chat or restarting the Claude client drops back to Default. And because the server re-checks the requested mode on every message, an armed bypass can never outlive a policy that an administrator has since turned off.

**Admin gating.** Bypass Permissions is **off by default** and hidden from the selector unless an administrator enables it: it is governed by the `claude_bypass_permissions` policy (`NBI_CLAUDE_BYPASS_PERMISSIONS_POLICY`), the only admin policy whose default is `force-off` rather than `user-choice`. The requested mode is also clamped on the server for every message, so the gate can't be bypassed by a hand-crafted request. Independently, NBI honors Claude Code's enterprise [managed settings](https://code.claude.com/docs/en/settings): `permissions.disableBypassPermissionsMode` removes the option regardless of the NBI policy, and `permissions.defaultMode` sets the selector's starting mode (Bypass excepted, since it never auto-arms). See [Allowing Bypass Permissions](docs/admin-guide.md#allowing-bypass-permissions-in-the-claude-permission-mode-selector) in the admin guide.
**Admin gating.** Bypass Permissions is **off by default** and hidden from the selector unless an administrator enables it: it is governed by the `claude_bypass_permissions` policy (`NBI_CLAUDE_BYPASS_PERMISSIONS_POLICY`), one of three admin policies that default to `force-off` rather than `user-choice` (the others gate the experimental ACP agent mode and ACP full access). The requested mode is also clamped on the server for every message, so the gate can't be bypassed by a hand-crafted request. Independently, NBI honors Claude Code's enterprise [managed settings](https://code.claude.com/docs/en/settings): `permissions.disableBypassPermissionsMode` removes the option regardless of the NBI policy, and `permissions.defaultMode` sets the selector's starting mode (Bypass excepted, since it never auto-arms). See [Allowing Bypass Permissions](docs/admin-guide.md#allowing-bypass-permissions-in-the-claude-permission-mode-selector) in the admin guide.

The `/enter-plan-mode` and `/exit-plan-mode` slash commands still work if typed but are no longer offered in autocomplete; the selector replaces them and will retire the commands in a future release.

Expand Down Expand Up @@ -202,24 +202,26 @@ Most settings panel toggles can be locked by org administrators. Two shapes:

**Boolean policies** use the `*_POLICY` suffix and accept three values: `user-choice` (default — user toggles freely), `force-on` (locked enabled), `force-off` (locked disabled). When forced, the panel control is disabled with a "Locked by your administrator" tooltip and any client-side write is ignored.

| Env var | Locks the Settings panel control for |
| ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `NBI_EXPLAIN_ERROR_POLICY` | "Explain cell errors" |
| `NBI_OUTPUT_FOLLOWUP_POLICY` | "Ask about cell outputs" |
| `NBI_OUTPUT_TOOLBAR_POLICY` | "Show output toolbar" |
| `NBI_CLAUDE_MODE_POLICY` | "Enable Claude mode" |
| `NBI_CLAUDE_CONTINUE_CONVERSATION_POLICY` | "Remember conversation history" |
| `NBI_CLAUDE_CODE_TOOLS_POLICY` | "Claude Code tools" |
| `NBI_CLAUDE_JUPYTER_UI_TOOLS_POLICY` | "Jupyter UI tools" |
| `NBI_CLAUDE_SETTING_SOURCE_USER_POLICY` | Setting source: User |
| `NBI_CLAUDE_SETTING_SOURCE_PROJECT_POLICY` | Setting source: Project |
| `NBI_STORE_GITHUB_ACCESS_TOKEN_POLICY` | "Remember my GitHub Copilot access token" |
| `NBI_SKILLS_MANAGEMENT_POLICY` | The Skills tab (force-off hides it and 403s the API; also disables the managed-skills reconciler) |
| `NBI_CLAUDE_MCP_MANAGEMENT_POLICY` | The Claude-mode MCP Servers tab (force-off hides it and 403s `/claude-mcp/*`; independent of the non-Claude MCP Servers tab) |
| `NBI_CLAUDE_PLUGINS_MANAGEMENT_POLICY` | The Claude-mode Plugins tab (force-off hides it and 403s `/plugins/*`) |
| `NBI_CLAUDE_BYPASS_PERMISSIONS_POLICY` | "Bypass Permissions" in the Claude permission-mode selector (defaults to `force-off`, the only policy that does; `user-choice` exposes the option, which the user still arms per session) |
| `NBI_TERMINAL_DRAG_DROP_POLICY` | Terminal drag-drop file attach feature |
| `NBI_REFRESH_OPEN_FILES_ON_DISK_CHANGE_POLICY` | "Refresh open files when changed on disk" |
| Env var | Locks the Settings panel control for |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `NBI_EXPLAIN_ERROR_POLICY` | "Explain cell errors" |
| `NBI_OUTPUT_FOLLOWUP_POLICY` | "Ask about cell outputs" |
| `NBI_OUTPUT_TOOLBAR_POLICY` | "Show output toolbar" |
| `NBI_CLAUDE_MODE_POLICY` | "Enable Claude mode" |
| `NBI_ACP_MODE_POLICY` | "Enable ACP mode" (experimental agent mode over the Agent Client Protocol, with Codex as the first agent type; defaults to `force-off`, set `user-choice` to allow it) |
| `NBI_ACP_FULL_ACCESS_POLICY` | "Full access" for the ACP agent: run tools without asking (defaults to `force-off`, so the agent asks before anything beyond trusted read-only commands; `user-choice` lets users opt into unattended runs) |
| `NBI_CLAUDE_CONTINUE_CONVERSATION_POLICY` | "Remember conversation history" |
| `NBI_CLAUDE_CODE_TOOLS_POLICY` | "Claude Code tools" |
| `NBI_CLAUDE_JUPYTER_UI_TOOLS_POLICY` | "Jupyter UI tools" |
| `NBI_CLAUDE_SETTING_SOURCE_USER_POLICY` | Setting source: User |
| `NBI_CLAUDE_SETTING_SOURCE_PROJECT_POLICY` | Setting source: Project |
| `NBI_STORE_GITHUB_ACCESS_TOKEN_POLICY` | "Remember my GitHub Copilot access token" |
| `NBI_SKILLS_MANAGEMENT_POLICY` | The Skills tab (force-off hides it and 403s the API; also disables the managed-skills reconciler) |
| `NBI_CLAUDE_MCP_MANAGEMENT_POLICY` | The Claude-mode MCP Servers tab (force-off hides it and 403s `/claude-mcp/*`; independent of the non-Claude MCP Servers tab) |
| `NBI_CLAUDE_PLUGINS_MANAGEMENT_POLICY` | The Claude-mode Plugins tab (force-off hides it and 403s `/plugins/*`) |
| `NBI_CLAUDE_BYPASS_PERMISSIONS_POLICY` | "Bypass Permissions" in the Claude permission-mode selector (defaults to `force-off`, as do `NBI_ACP_MODE_POLICY` and `NBI_ACP_FULL_ACCESS_POLICY`; `user-choice` exposes the option, which the user still arms per session) |
| `NBI_TERMINAL_DRAG_DROP_POLICY` | Terminal drag-drop file attach feature |
| `NBI_REFRESH_OPEN_FILES_ON_DISK_CHANGE_POLICY` | "Refresh open files when changed on disk" |

The first three also have matching traitlets on `NotebookIntelligence` (`explain_error_policy`, `output_followup_policy`, `output_toolbar_policy`); add the others as needed in the same shape:

Expand All @@ -244,6 +246,9 @@ Per-user preferences (default on for the cell-output features) live in `config.j
| `NBI_CLAUDE_INLINE_COMPLETION_MODEL` | Claude → Auto-complete model |
| `ANTHROPIC_API_KEY` | Claude → API Key (input is locked + blanked; the SDK reads the env directly) |
| `ANTHROPIC_BASE_URL` | Claude → Base URL |
| `NBI_ACP_CHAT_MODEL` | ACP → Chat model |
| `OPENAI_API_KEY` | ACP → API Key (input is locked + blanked; the agent reads the env directly) |
| `OPENAI_BASE_URL` | ACP → Base URL |

Provider IDs: `github-copilot`, `openai-compatible`, `litellm-compatible`, `ollama`, `none`. The `*_MODEL_ID` value is whatever the chosen provider exposes (e.g. `gpt-4o`, `llama3:latest`). Claude model IDs are the literal IDs from the Anthropic API (e.g. `claude-opus-4-7`, `claude-sonnet-4-6`); empty string = "Default (recommended)"; `NBI_CLAUDE_INLINE_COMPLETION_MODEL` also accepts `none` (no inline completion in Claude mode) or `inherit` (use the General-tab Auto-complete model).

Expand Down
Loading
Loading