feat(acp): browser control via MCP-over-ACP + stdio bridge (Phase 2)

.dockerignore

@@ -0,0 +1,4 @@
+target/
+.git/
+data/
+*.tgz

.github/workflows/ci.yml

@@ -56,6 +56,41 @@ jobs:
       # `-p openab-gateway` to avoid the workspace hooks::tests parallel flake.
       - name: cargo test (acp gateway)
         run: cargo test -p openab-gateway --features acp
+      # Same default-features gap on the core side: `mcp_proxy` is the only `acp-mcp`-gated module,
+      # so its tunnel-trait, tools-cache and bridge-dispatch tests never compile above either.
+      # Filtered to `acp_mcp::` for the same reason the gateway step is scoped to one package —
+      # it keeps the flaky hooks::tests out of this job.
+      - name: cargo test (acp-mcp core)
+        # `cargo test` exits 0 when a filter selects NOTHING, so "selected nothing" and "everything
+        # passed" are indistinguishable — that is precisely how a compiled-but-never-selected test
+        # shipped here before. Count the selection first and fail on zero.
+        #
+        # The filter lives in a variable inside a block scalar: written inline after `run:`, its
+        # trailing `::` reads as a YAML mapping indicator and makes the whole file unparseable.
+        run: |
+          set -euo pipefail
+          FILTER='acp_mcp::'
+          n=$(cargo test -p openab-core --features acp-mcp "$FILTER" -- --list | grep -c ': test$' || true)
+          echo "filter '$FILTER' selected $n test(s)"
+          [ "$n" -gt 0 ] || { echo "::error::filter '$FILTER' selected ZERO tests — stale or mistyped"; exit 1; }
+          cargo test -p openab-core --features acp-mcp "$FILTER"
+      # The pool's facade-session tests are `acp-mcp`-gated too but live outside `acp_mcp::`, so
+      # the filter above compiled them and then selected them away. Naming the module runs them
+      # while still leaving the flaky hooks::tests out.
+      - name: cargo test (acp-mcp pool)
+        # Same zero-match guard as above, and the same reason for the block scalar.
+        run: |
+          set -euo pipefail
+          FILTER='acp::pool::'
+          n=$(cargo test -p openab-core --features acp-mcp "$FILTER" -- --list | grep -c ': test$' || true)
+          echo "filter '$FILTER' selected $n test(s)"
+          [ "$n" -gt 0 ] || { echo "::error::filter '$FILTER' selected ZERO tests — stale or mistyped"; exit 1; }
+          cargo test -p openab-core --features acp-mcp "$FILTER"
+      # And the root package's own tests — the ACP-tunnel capability source (acp_tunnel_source.rs) and
+      # are `acp`-gated, so `--workspace` above skips
+      # them too. This is where the source's routing and trust-gate coverage lives.
+      - name: cargo test (acp root)
+        run: cargo test --features acp
       - name: cargo build (unified)
         run: cargo build --features unified
 

Cargo.toml

@@ -51,7 +51,7 @@ feishu = ["dep:openab-gateway", "dep:axum", "openab-gateway/feishu"]
 googlechat = ["dep:openab-gateway", "dep:axum", "openab-gateway/googlechat"]
 wecom = ["dep:openab-gateway", "dep:axum", "openab-gateway/wecom"]
 teams = ["dep:openab-gateway", "dep:axum", "openab-gateway/teams"]
-acp = ["dep:openab-gateway", "dep:axum", "openab-gateway/acp"]
+acp = ["dep:openab-gateway", "dep:axum", "openab-gateway/acp", "openab-core/acp-mcp"]
 lineworks = ["dep:openab-gateway", "dep:axum", "openab-gateway/lineworks"]
 
 [dev-dependencies]

crates/openab-core/Cargo.toml

@@ -49,6 +49,11 @@ aws-credential-types = { version = "1", optional = true }
 urlencoding = { version = "2", optional = true }
 hex = { version = "0.4", optional = true }
 http = { version = "1", optional = true }
+# Browser tool definitions for the facade's capability source. Only `rmcp::model` is used now —
+# the loopback MCP server that needed the server + streamable-http transport features (and its own
+# axum listener) was removed with the per-session proxy.
+rmcp = { version = "1.7", default-features = false, optional = true }
+tokio-util = { version = "0.7", optional = true }
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
@@ -65,3 +70,6 @@ config-s3 = ["dep:aws-sdk-s3", "dep:aws-config"]
 pre-seed = ["dep:aws-sdk-s3", "dep:aws-config", "dep:zip", "dep:hex", "dep:flate2", "dep:tar"]
 filestore = ["dep:aws-sdk-s3", "dep:aws-config"]
 agentcore = ["dep:aws-config", "dep:aws-sigv4", "dep:aws-credential-types", "dep:urlencoding", "dep:hex", "dep:http", "dep:rustls", "dep:tokio-rustls", "dep:webpki-roots"]
+# Core-side wiring for MCP-over-ACP browser control (enabled by the root `acp`): the browser tool
+# definitions and the agent's facade MCP config. Core hosts no MCP server of its own any more.
+acp-mcp = ["dep:rmcp", "dep:tokio-util"]

crates/openab-core/src/acp/connection.rs

@@ -189,6 +189,14 @@ pub struct AcpConnection {
     pub session_reset: bool,
     _reader_handle: JoinHandle<()>,
     _stderr_handle: Option<JoinHandle<()>>,
+    /// Revokes this session's facade token when the connection is dropped, on any evict path.
+    /// Held only for its `Drop` side effect (never read).
+    ///
+    /// It used to cancel a per-session MCP proxy server; that server is gone and the guard now
+    /// carries the minted token instead.
+    #[cfg(feature = "acp-mcp")]
+    #[allow(dead_code)]
+    facade_token_guard: Option<tokio_util::sync::DropGuard>,
 }
 
 /// Build the final set of env vars for the agent subprocess.
@@ -485,9 +493,17 @@ impl AcpConnection {
             session_reset: false,
             _reader_handle: reader_handle,
             _stderr_handle: stderr_handle,
+            #[cfg(feature = "acp-mcp")]
+            facade_token_guard: None,
         })
     }
 
+    /// Attach the guard that revokes this session's facade token when the connection drops.
+    #[cfg(feature = "acp-mcp")]
+    pub fn set_facade_token_guard(&mut self, guard: Option<tokio_util::sync::DropGuard>) {
+        self.facade_token_guard = guard;
+    }
+
     fn next_id(&self) -> u64 {
         self.next_id.fetch_add(1, Ordering::Relaxed)
     }