Summary

• Add DEFAULT_GATEWAY_HTTP_TOOL_DENY to block dangerous tools (sessions_spawn, sessions_send, gateway, whatsapp_login) from HTTP /tools/invoke endpoint
• Fix ACP client requestPermission callback to require interactive confirmation for dangerous tools instead of auto-approving everything
• Add gateway.tools.{allow,deny} config override for gateway deny list customization

Security Impact

OC-02 Critical RCE (CWE-78, CVSS 9.8) — Two attack vectors remediated:

1. HTTP POST to /tools/invoke with tool=sessions_spawn could spawn agent sessions with full exec access
2. ACP client auto-approved all permission requests including exec, fs_write, etc.

Changes

Test plan

• sessions_spawn returns 404 via HTTP gateway
• sessions_send returns 404 via HTTP gateway
• gateway tool returns 404 via HTTP gateway
• agents_list still returns 200 (not denied)
• ACP dangerous tools constant includes exec, sessions_spawn
• ACP empty options returns deny
• ACP permission logging uses stderr
• ACP 30s timeout exists
• All existing tests pass (12 gateway + 4 ACP = 16 total)

Greptile Overview

Greptile Summary

This PR hardens two security-sensitive surfaces:

• Gateway HTTP POST /tools/invoke: adds a default deny list (sessions_spawn, sessions_send, gateway, whatsapp_login) that is applied after the existing multi-stage tool policy cascade, plus a gateway.tools.{deny,allow} config override for customizing that deny list.
• ACP client: replaces unconditional auto-approval in requestPermission with a “dangerous tool” classifier and an interactive confirmation prompt (30s timeout), and moves permission-related logging to stderr to avoid protocol corruption.

Tests were added for the gateway deny behavior and for presence of the ACP permission logic (structural source checks).

Confidence Score: 4/5

• This PR appears safe to merge and meaningfully reduces two high-impact security risks.
• Code changes are narrow and targeted (HTTP deny list + ACP permission prompt) and include new tests around the gateway deny behavior. I did not find any definite functional regressions in the changed files. Confidence is reduced because this environment lacks node_modules/pnpm, so I could not verify ACP SDK semantics for hard-coded optionId fallbacks at runtime (only structural tests cover ACP changes).
• src/acp/client.ts

_{Last reviewed commit: 1fd902d}

_{(3/5) Reply to the agent's comments like "Can you suggest a fix for this @greptileai?" or ask follow-up questions!}