Add ACP permission mode support to the SDK (#224)

* chore: recover hamburg workspace state

* chore: drop workspace context files

* refactor: generalize permissions example

* refactor: parse permissions example flags

* docs: clarify why fs and terminal stay native

* feat: add interactive permission prompt UI to Inspector

Add permission request handling to the Inspector UI so users can
Allow, Always Allow, or Reject tool calls that require permissions
instead of having them auto-cancelled. Wires up SDK
onPermissionRequest/respondPermission through App → ChatPanel →
ChatMessages with proper toolCallId-to-pendingId mapping.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: prevent permission reply from silently escalating "once" to "always"

Remove allow_always from the fallback chain when the user replies "once",
aligning with the ACP spec which says "map by option kind first" with no
fallback for allow_once. Also fix Inspector to use rawSend, revert
hydration guard to accept empty configOptions, and handle respondPermission
errors by rejecting the pending promise.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

factory/CLAUDE.md

@@ -81,11 +81,12 @@ For all Rivet/RivetKit implementation:
    - Do not add `workspaceId`/`repoId`/`handoffId` columns just to "namespace" rows for a given actor instance; use actor state and/or the actor key instead.
    - Example: the `handoff` actor instance already represents `(workspaceId, repoId, handoffId)`, so its SQLite tables should not need those columns for primary keys.
 3. Do not use backend-global SQLite singletons; database access must go through actor `db` providers (`c.db`).
-4. Do not use published RivetKit npm packages.
-5. RivetKit is linked via pnpm `link:` protocol to `../rivet/rivetkit-typescript/packages/rivetkit`. Sub-packages (`@rivetkit/sqlite-vfs`, etc.) resolve transitively from the rivet workspace.
+4. The default dependency source for RivetKit is the published `rivetkit` package so workspace installs and CI remain self-contained.
+5. When working on coordinated RivetKit changes, you may temporarily relink to a local checkout instead of the published package.
    - Dedicated local checkout for this workspace: `/Users/nathan/conductor/workspaces/handoff/rivet-checkout`
-   - Dev worktree note: when working on RivetKit fixes for this repo, prefer the dedicated local checkout above and link to `../rivet-checkout/rivetkit-typescript/packages/rivetkit`.
-6. Before using, build RivetKit in the rivet repo:
+   - Preferred local link target: `../rivet-checkout/rivetkit-typescript/packages/rivetkit`
+   - Sub-packages (`@rivetkit/sqlite-vfs`, etc.) resolve transitively from the RivetKit workspace when using the local checkout.
+6. Before using a local checkout, build RivetKit in the rivet repo:
    ```bash
    cd ../rivet-checkout/rivetkit-typescript
    pnpm install

factory/packages/backend/package.json

@@ -22,7 +22,7 @@
     "drizzle-orm": "^0.44.5",
     "hono": "^4.11.9",
     "pino": "^10.3.1",
-    "rivetkit": "link:../../../../../handoff/rivet-checkout/rivetkit-typescript/packages/rivetkit",
+    "rivetkit": "2.1.6",
     "sandbox-agent": "workspace:*",
     "uuid": "^13.0.0",
     "zod": "^4.1.5"

factory/packages/client/package.json

@@ -15,7 +15,7 @@
   },
   "dependencies": {
     "@openhandoff/shared": "workspace:*",
-    "rivetkit": "link:../../../../../handoff/rivet-checkout/rivetkit-typescript/packages/rivetkit"
+    "rivetkit": "2.1.6"
   },
   "devDependencies": {
     "tsup": "^8.5.0"