Register omp acp as an opt-in structured ACP agent behind the availability gate #68

Summary

Add the OMP ACP launch spec and a thin OMP dialect, made launchable only when a host opt-in is on and a bounded omp acp handshake succeeds, so OMP runs over the shared ACP client for opted-in users and everyone else keeps today's path.

Context

• 44madfire/orca#20 Phase A. Launch specs are data: fields src/main/acp/acp-launch-specs.ts:13-36, Grok row :38-56, list :58 (@76d1b7b).
• OMP initialize advertises loadSession: true, image: true, session list/fork/resume/close (packages/coding-agent/src/modes/acp/acp-agent.ts:636-658 @53f253f); session/new returns the persisted session id (:673-680).
• Store identity: launch resolution force-sets [spec.accountHomeVariable] over the inherited environment and rejects records whose variable differs (src/main/acp/acp-structured-launch-resolution.ts:85-96 @76d1b7b). OMP has no single account-home variable: its store follows --session-dir/PI_CODING_AGENT_SESSION_DIR (packages/coding-agent/src/cli/args.ts:214), then OMP_PROFILE ≻ PI_PROFILE (packages/utils/src/dirs.ts:83-95), default-profile PI_CODING_AGENT_DIR (ignored under named profiles, dirs.ts:452-481), PI_CONFIG_DIR (dirs.ts:306-308), XDG, and a launch-cwd .env (@53f253f). OMP_CODING_AGENT_DIR is never read by OMP; it is an Orca read-side override only (src/main/ai-vault/omp-session-root.ts:46-47, docs/reference/omp-session-roots.md @76d1b7b).
• Probes on real omp acp 18.6.3 (docs/plans/omp-acp-migration/v2/risk-findings/account-home.md): pinning a wrong PI_CODING_AGENT_DIR moved sessions and the auth store; a named profile ignores it; an invalid OMP_PROFILE kills the child at initialize; a workspace .env with OMP_PROFILE redirects the store. Terminal OMP sets no agent-dir variable, so the ACP child must match that pass-through posture.
• Windows install shapes (docs/plans/omp-acp-migration/v2/risk-findings/windows-spawn.md): bun global ~/.bun/bin/omp.exe is bun's launcher (needs bun on PATH, spawns a bun.exe child) and standalone %LOCALAPPDATA%\omp\omp.exe both spawn directly; npm/pnpm shims of OMP are bun-interpreter variants that parseWindowsCmdShim refuses (node-only patterns, src/shared/child-process/windows-cmd-shim-resolution.ts:36-60 @76d1b7b), so they fall back to cmd.exe /c (handshake works, EDR-visible hop returns); %LOCALAPPDATA%\omp is not among the resolver's fallback dirs (src/shared/node-cli-command-resolution.ts). OMP's cli.js fails under node (bun: imports), so a bun shim must never resolve to node.
• ACP children drop pane/hook env so the structured session is the single status producer (src/main/acp/acp-launch-specs.ts:64-76 @76d1b7b); spawn goes through spawnManagedProviderProcess → spawnProcess (AGENTS.md Windows child-process rule); win32 teardown is a /T tree kill, which the launcher → bun.exe tree needs.
• Minimum version cannot be derived (coding-agent changelog starts at 18.2.2; packages/utils/CHANGELOG.md:450,503 @53f253f only date the in-house ACP module and headless hosts), so availability is a capability handshake, not a version string.

Scope

• OMP_LAUNCH_SPEC: command: 'omp', args: ['acp'], env: {}, no install directories under an account home; full-access mapping deferred to ACP elicitation forms and OMP approval-policy parity #81; sign-in guidance confirmed in-PR (--acp-terminal-auth exists).
• Pin nothing. Extend AcpLaunchSpec generically so a spec can omit the account-home pin (launch resolution then skips the force-set and the variable check); OMP's directory/profile variables reach the child exactly as the shell snapshot + per-agent env overlay provide, identical to a terminal OMP launch. Never pass --session-dir.
• Record identity. At create, resolve under the exact launch env what OMP will use — agent dir and active profile (omp config path, packages/coding-agent/src/cli/config-cli.ts:179 @53f253f) plus any session-dir override — and store it on the record. OMP ACP lifecycle: settlement, Stop, crash, restart, status, notifications #73 uses it to detect store drift on reattach; post-cutover Post-cutover migration: adopt existing legacy OMP sessions into ACP chat #69/Post-cutover migration: persisted ACP↔Terminal handoff for OMP chats #84 use it for adoption and handoff; the availability cache keys on it.
• Windows resolution (provider-neutral, own commit/PR): recognise npm %_prog% and pnpm branched shims whose interpreter is bun (sibling bun.exe, else PATH bun.exe, same all-or-nothing strictness as the node shapes; fixtures transcribed from the generated bodies in windows-spawn.md §4); add %LOCALAPPDATA%\omp to resolution coverage.
• Contract negotiation: add a provider-neutral dialect hook for client initialize _meta. Today the params are hardcoded at src/main/acp/acp-session-runtime.ts:105-109 @76d1b7b. The omp dialect (src/main/acp/acp-dialects/) requests clientCapabilities._meta["ohmypi.acp/contracts"]: ["orca-native-chat-v1"] and exposes whether agentCapabilities._meta["ohmypi.acp/contracts"] contains it (definition: ACP contract orca-native-chat-v1: define, test, and advertise oh-my-pi#17). It reads no granular OMP markers and consumes no extension payloads.
• Availability via Structured launch availability per registered agent, with legacy-chat fallback on decline #78: host setting opt-in (Experimental, default off) ∧ binary resolves ∧ initialize within a bound reports loadSession and sessionCapabilities.resume. The probe runs with the exact launch env; cache key = resolved binary path + size + mtime + resolved agent dir + profile + session-dir override.
• Declare only wired capabilities (imagePrompts: false, compact: false, rewind: false, steering: 'queue').

Non-goals

• No default-on (New OMP chats default to ACP when the provider satisfies orca-native-chat-v1 #74), legacy adoption (Post-cutover migration: adopt existing legacy OMP sessions into ACP chat #69, post-cutover), _omp/* consumption (OMP ACP dialect: classify and bound the extension surface #75), or omp --mode rpc transport.

Depends on

• Structured launch availability per registered agent, with legacy-chat fallback on decline #78

Parity rows owned

• P-DISC-03, P-TUI-01, P-AUTH-01.

Acceptance criteria

• With the opt-in off, every OMP launch on every surface routes exactly as today.
• With the opt-in on and a capable omp, a new OMP chat completes a text turn over omp acp; status reaches the sidebar only through the structured feed.
• Missing, failing or incapable omp, or an invalid OMP_PROFILE in the launch env → non-launchable with a named reason; the launch opens legacy chat with no error and never hangs or silently uses the default profile.
• Under every combination of OMP_PROFILE, PI_PROFILE, PI_CODING_AGENT_DIR, PI_CONFIG_DIR, PI_CODING_AGENT_SESSION_DIR and a workspace .env setting them, session/new writes its .jsonl to the directory a terminal omp launched from the same shell snapshot writes to, and the record names that agent dir + profile.
• Orca adds or alters no OMP directory/profile variable in the child env.
• On Windows, bun-global omp.exe, npm shim, pnpm shim and standalone omp.exe each start omp acp with no cmd.exe in the spawn; with ORCA_DISABLE_CMD_SHIM_RESOLUTION the shims still handshake via the fallback.
• Terminal OMP launches, omp --resume, AI Vault and shell-wrapper snapshots are unchanged.
• Signed-out OMP yields an actionable not-signed-in state, never a hang (confirm the legacy recovery path first).
• No omp --mode rpc anywhere.

Required tests

• Scripted omp acp stub: handshake success, missing capability, timeout, exit during initialize (proven teardown, no orphan); contract requested in client _meta; contract present/absent reported correctly.
• Store matrix against real omp acp in isolated HOME/agent dirs (never the user's real ~/.omp beyond a read-only default-path assertion): default; relocated PI_CODING_AGENT_DIR; OMP_PROFILE; PI_PROFILE; OMP_PROFILE='' + PI_PROFILE; PI_CONFIG_DIR; PI_CODING_AGENT_SESSION_DIR; named profile + PI_CODING_AGENT_DIR (override ignored); invalid profile (named reason); workspace .env with OMP_PROFILE. Assert child path = terminal path = recorded identity.
• Env pass-through: the resolved child env adds or alters none of the OMP directory/profile keys vs the shell snapshot; no ORCA_PANE_KEY/hook keys.
• .win32.test.ts mirroring windows-cmd-shim-resolution.win32.test.ts: npm and pnpm bun-shim fixtures resolve to bun.exe <script> and round-trip argv through runProcess; node shapes never resolve to bun and vice versa; a synthetic %LOCALAPPDATA%\omp is found when PATH misses; omp.cmd + omp.exe coexistence order.
• Availability cache invalidates after an omp upgrade or a profile / agent-dir change.

Base branch

acp-migration (44madfire/orca).