diff --git a/docs/acp.md b/docs/acp.md
new file mode 100644
index 0000000..050516d
--- /dev/null
+++ b/docs/acp.md
@@ -0,0 +1,102 @@
+# ACP backend (Agent Client Protocol)
+
+The desktop can drive any agent CLI that speaks the
+[Agent Client Protocol](https://agentclientprotocol.com) (JSON-RPC 2.0 over
+stdio, protocol v1) as a fourth engine backend, next to the native `jucode`,
+`codex` and `claude` adapters. `jucode acp` works out of the box; other agents
+(e.g. `gemini --experimental-acp`) can be registered in Settings.
+
+## Where the pieces live
+
+| piece | file |
+|---|---|
+| Agent registry (Rust-owned, validated) | `src-tauri/src/acp_registry.rs` → `~app-config/acp-agents.json` |
+| Spawn plumbing (`BackendKind::Acp`) | `src-tauri/src/backend.rs`, `src-tauri/src/lib.rs` |
+| Webview adapter (JSON-RPC ↔ AgentEvents) | `src/lib/backends/acp.ts` (+ `acp-types.ts`) |
+| Settings UI (add / edit / remove agents) | `src/lib/settings/AcpSection.svelte` |
+| New-session picker rows | `src/lib/Composer.svelte` (below the native engines) |
+
+## Launch model: registry, not argv
+
+The frontend never sends a command line. A registered agent is
+`{ id, name, command, args, env }`; the webview passes only the allowlisted
+`agent: "<id>"` spawn option and the Rust side looks the entry up, resolves
+`command` (PATH + well-known install dirs; explicit paths kept as-is) and
+spawns `command args…` with `env` applied on top of the shell-env snapshot.
+Every entry is re-validated on **every read and write** of the registry file,
+so a hand-edited `acp-agents.json` cannot smuggle malformed entries into a
+spawn. `bin_override`, raw args and argv-shaped options are rejected for the
+`acp` backend kind.
+
+The JSON-RPC transport reuses the existing per-session stdio pipe
+(`create_session` / `send_line` / one event per stdout line) — no tokio, no
+extra runtime in Tauri, no SDK in the webview bundle (hand-rolled frames like
+`backends/codex.ts`).
+
+## Protocol mapping
+
+Handshake per child process (initial spawn and every crash restart):
+`initialize` (protocol v1, client advertises **no** fs/terminal capability) →
+`session/new` (project cwd, no MCP servers) → ready. Then one
+`session/prompt` per user turn; the turn is over when the prompt request
+answers with a `stopReason`.
+
+### What maps
+
+| ACP | desktop surface |
+|---|---|
+| `session/update: agent_message_chunk` | assistant text stream |
+| `session/update: agent_thought_chunk` | reasoning stream (thinking block) |
+| `session/update: tool_call` / `tool_call_update` | ToolCard (start / progress / done), `content` + `locations` folded into the card body |
+| tool-call `diff` content | ToolCard diff view (rendered as a unified diff) |
+| `session/update: plan` | Plan panel in the right dock (entries + status) |
+| `session/request_permission` | ApprovalCard; allow / always / deny picks the matching advertised option (`allow_once` / `allow_always` / `reject_once` / `reject_always`), no usable option ⇒ `cancelled` |
+| stop button | `session/cancel` (outstanding permission requests are answered `cancelled` first, per spec) |
+| `stopReason: refusal` / `max_tokens` / `max_turn_requests` | info notice in the transcript |
+| `session/new` model info (when the agent reports it) | model label (read-only) |
+| image attachments | `image` content blocks with `file://` uris, only when the agent advertised `promptCapabilities.image` — agents that require inline base64 data won't see them |
+| agent stderr | dimmed `[acp]` info lines (ANSI stripped) |
+
+ACP has no turn-started notification, so the busy indicator flips on the first
+frame the agent sends after a prompt goes out. While a turn is in flight,
+further user messages queue adapter-side and run as their own turns once the
+current one settles (same UX as claude's stdin queue).
+
+### What deliberately does NOT map (conservative caps)
+
+- **Approval modes** — ACP session modes are agent-defined ids with no provable
+  mapping onto the desktop's ask / auto-edit / full-auto trio. The picker is
+  hidden; the desktop's startup mode sync is swallowed.
+- **Steer** — no mid-turn injection in ACP; messages sent while busy become
+  the next turn instead.
+- **Hunk-subset approvals** — permission responses are whole-call option
+  picks; there is no per-hunk protocol.
+- **Resume / transcript replay** — `session/load` is optional (jucode acp
+  does not advertise it), so ACP conversations are not persisted as
+  restorable tabs (`startup.session_id` stays empty on purpose).
+- **Model picker** — `session/set_model` is optional; off until provable.
+- **MCP live management** — `session/new` accepts an MCP server list, but
+  there is no runtime add/remove/reconnect RPC; the desktop passes none and
+  hides the management UI.
+- **Skills, checkpoints, branch tree, goals tab, sub-agents, context/usage
+  telemetry, /compact** — no ACP v1 equivalent.
+- **Slash commands** — `available_commands_update` is received but there is no
+  invocation RPC (commands are plain prompt text), so no command surface.
+- **Client fs / terminal services** — the client advertises neither;
+  `fs/read_text_file`, `fs/write_text_file` and `terminal/*` requests are
+  declined with a JSON-RPC error so the agent falls back to its own tools
+  instead of hanging.
+
+## Adding an agent
+
+Settings → Behavior → ACP agents → *Add agent*: a display name, a command
+(name or absolute path), optional fixed arguments (quoted tokens supported)
+and optional per-agent `KEY=VALUE` env lines. Registered agents appear at the
+bottom of the engine picker on new (virgin) sessions; each project remembers
+its last choice. Bounds: ≤ 32 agents, ≤ 32 args, names/commands/args length-
+and control-character-checked, env names/values validated like custom backend
+env (dangerous variables rejected).
+
+Tests: `src/lib/backends/acp.test.ts` (adapter, fake agent frames),
+`src/lib/backends/acp-agents.test.ts` (settings-form helpers), and the
+registry/spawn tests in `src-tauri/src/acp_registry.rs` / `backend.rs`.
diff --git a/src-tauri/src/acp_registry.rs b/src-tauri/src/acp_registry.rs
new file mode 100644
index 0000000..d5418fc
--- /dev/null
+++ b/src-tauri/src/acp_registry.rs
@@ -0,0 +1,315 @@
+//! ACP agent registry: which external Agent Client Protocol agents the
+//! desktop may launch, and with what fixed command line.
+//!
+//! Safety model: mirrors `backend.rs` — the frontend NEVER passes argv to
+//! `create_session`. Users register agents (id, name, command, args, env)
+//! through the dedicated registry commands below, where every field is
+//! validated; a session then only references a registry *id*, and the command
+//! line is looked up here at spawn time. Registered args are fixed
+//! configuration (they may legitimately start with `-`, e.g.
+//! `--experimental-acp`), but they can never be extended or reordered by a
+//! session request.
+//!
+//! The registry persists as `acp-agents.json` in the per-app config dir
+//! (same directory as the other desktop app-data files).
+
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+use tauri::{AppHandle, Manager};
+
+use crate::backend;
+
+/// One launchable ACP agent. `env` is applied on top of the shell-env
+/// snapshot / custom backend env when the child is spawned.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct AcpAgent {
+    pub id: String,
+    pub name: String,
+    pub command: String,
+    #[serde(default)]
+    pub args: Vec<String>,
+    #[serde(default)]
+    pub env: BTreeMap<String, String>,
+}
+
+#[derive(Serialize, Deserialize, Default)]
+struct RegistryFile {
+    agents: Vec<AcpAgent>,
+}
+
+const FILE_NAME: &str = "acp-agents.json";
+const MAX_AGENTS: usize = 32;
+const MAX_ARGS: usize = 32;
+const MAX_ARG_LEN: usize = 300;
+const MAX_NAME_LEN: usize = 100;
+const MAX_COMMAND_LEN: usize = 300;
+
+fn valid_text(s: &str, max: usize) -> bool {
+    !s.is_empty() && s.len() <= max && !s.chars().any(|c| c.is_control())
+}
+
+/// Validates one registry entry. Applied on every write AND on every read, so
+/// a hand-edited registry file can't smuggle malformed entries into a spawn.
+pub fn validate_agent(agent: &AcpAgent) -> Result<(), String> {
+    if !backend::is_valid_acp_agent_id(&agent.id) {
+        return Err(format!(
+            "invalid agent id: {} (lowercase letters, digits, - and _ only)",
+            agent.id
+        ));
+    }
+    if !valid_text(&agent.name, MAX_NAME_LEN) {
+        return Err("agent name must be 1-100 characters without control characters".to_string());
+    }
+    if !valid_text(&agent.command, MAX_COMMAND_LEN) || agent.command.starts_with('-') {
+        return Err("agent command must be a program name or path (not a flag)".to_string());
+    }
+    if agent.args.len() > MAX_ARGS {
+        return Err(format!("agent accepts at most {MAX_ARGS} arguments"));
+    }
+    for arg in &agent.args {
+        if arg.is_empty() || arg.len() > MAX_ARG_LEN || arg.chars().any(|c| c.is_control()) {
+            return Err(format!("invalid agent argument: {arg:?}"));
+        }
+    }
+    if agent.env.len() > backend::MAX_CUSTOM_ENV_VARS {
+        return Err(format!(
+            "agent env accepts at most {} variables",
+            backend::MAX_CUSTOM_ENV_VARS
+        ));
+    }
+    for (name, value) in &agent.env {
+        if !backend::is_valid_env_name(name) {
+            return Err(format!("invalid env variable name: {name}"));
+        }
+        if value.len() > backend::MAX_CUSTOM_ENV_VALUE_LEN || value.contains('\0') {
+            return Err(format!("invalid env value for {name}"));
+        }
+    }
+    Ok(())
+}
+
+/// First-run default: the native engine's own ACP surface, so the picker has
+/// a working ACP option out of the box.
+fn default_agents() -> Vec<AcpAgent> {
+    vec![AcpAgent {
+        id: "jucode-acp".to_string(),
+        name: "JuCode (ACP)".to_string(),
+        command: "jucode".to_string(),
+        args: vec!["acp".to_string()],
+        env: BTreeMap::new(),
+    }]
+}
+
+/// Parses the registry file contents, validating every entry.
+fn parse_registry(text: &str) -> Result<Vec<AcpAgent>, String> {
+    let file: RegistryFile =
+        serde_json::from_str(text).map_err(|e| format!("acp registry is malformed: {e}"))?;
+    for agent in &file.agents {
+        validate_agent(agent)?;
+    }
+    Ok(file.agents)
+}
+
+fn registry_path(app: &AppHandle) -> Result<PathBuf, String> {
+    let dir = app
+        .path()
+        .app_config_dir()
+        .map_err(|e| format!("app config dir unavailable: {e}"))?;
+    Ok(dir.join(FILE_NAME))
+}
+
+/// Loads the registry; a missing file seeds the defaults (an existing but
+/// EMPTY registry stays empty — deleting the default entry is respected).
+pub fn load(app: &AppHandle) -> Result<Vec<AcpAgent>, String> {
+    let path = registry_path(app)?;
+    match std::fs::read_to_string(&path) {
+        Ok(text) => parse_registry(&text),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(default_agents()),
+        Err(e) => Err(format!("failed to read {}: {e}", path.display())),
+    }
+}
+
+/// Write-then-rename so a crash mid-write can't truncate the registry.
+fn save(app: &AppHandle, agents: &[AcpAgent]) -> Result<(), String> {
+    let path = registry_path(app)?;
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).map_err(|e| e.to_string())?;
+    }
+    let text = serde_json::to_string_pretty(&RegistryFile {
+        agents: agents.to_vec(),
+    })
+    .map_err(|e| e.to_string())?;
+    let mut tmp = path.clone();
+    tmp.set_file_name(format!("{FILE_NAME}.tmp"));
+    std::fs::write(&tmp, text.as_bytes())
+        .map_err(|e| format!("failed to write {}: {e}", tmp.display()))?;
+    std::fs::rename(&tmp, &path).map_err(|e| format!("failed to write {}: {e}", path.display()))
+}
+
+/// Looks up (and re-validates) one agent for spawning.
+pub fn find_agent(app: &AppHandle, id: &str) -> Result<AcpAgent, String> {
+    load(app)?
+        .into_iter()
+        .find(|a| a.id == id)
+        .ok_or_else(|| format!("unknown acp agent: {id}"))
+}
+
+/// Lists the registered ACP agents (settings UI + new-session picker).
+#[tauri::command]
+pub fn acp_agents_list(app: AppHandle) -> Result<Vec<AcpAgent>, String> {
+    load(&app)
+}
+
+/// Adds or replaces one agent (matched by id). Returns the updated list.
+#[tauri::command]
+pub fn acp_agent_upsert(app: AppHandle, agent: AcpAgent) -> Result<Vec<AcpAgent>, String> {
+    validate_agent(&agent)?;
+    let mut agents = load(&app)?;
+    if let Some(existing) = agents.iter_mut().find(|a| a.id == agent.id) {
+        *existing = agent;
+    } else {
+        if agents.len() >= MAX_AGENTS {
+            return Err(format!("at most {MAX_AGENTS} acp agents can be registered"));
+        }
+        agents.push(agent);
+    }
+    save(&app, &agents)?;
+    Ok(agents)
+}
+
+/// Removes one agent by id. Returns the updated list.
+#[tauri::command]
+pub fn acp_agent_remove(app: AppHandle, id: String) -> Result<Vec<AcpAgent>, String> {
+    let mut agents = load(&app)?;
+    agents.retain(|a| a.id != id);
+    save(&app, &agents)?;
+    Ok(agents)
+}
+
+/// Availability probe for one registered agent: resolves its command and runs
+/// `<command> --version` best-effort (mirrors `check_backend`).
+#[tauri::command(async)]
+pub fn acp_agent_check(app: AppHandle, id: String) -> Result<crate::BackendStatus, String> {
+    let agent = find_agent(&app, &id)?;
+    let bin = backend::resolve_acp_program(&agent.command);
+    let path = if bin.components().count() == 1 {
+        crate::which(&bin.to_string_lossy())
+    } else if bin.is_file() {
+        Some(bin)
+    } else {
+        None
+    };
+    let Some(path) = path else {
+        return Ok(crate::BackendStatus {
+            found: false,
+            path: None,
+            version: None,
+        });
+    };
+    let mut cmd = std::process::Command::new(&path);
+    crate::no_window(&mut cmd);
+    cmd.arg("--version");
+    let version = crate::run_with_timeout(cmd, std::time::Duration::from_secs(15))
+        .ok()
+        .filter(|out| out.status.success())
+        .map(|out| String::from_utf8_lossy(&out.stdout).trim().to_string())
+        .filter(|v| !v.is_empty());
+    Ok(crate::BackendStatus {
+        found: true,
+        path: Some(path.display().to_string()),
+        version,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn agent(id: &str) -> AcpAgent {
+        AcpAgent {
+            id: id.to_string(),
+            name: "Test Agent".to_string(),
+            command: "test-agent".to_string(),
+            args: vec!["--experimental-acp".to_string()],
+            env: BTreeMap::new(),
+        }
+    }
+
+    #[test]
+    fn default_registry_launches_jucode_acp() {
+        let agents = default_agents();
+        assert_eq!(agents.len(), 1);
+        assert_eq!(agents[0].id, "jucode-acp");
+        assert_eq!(agents[0].command, "jucode");
+        assert_eq!(agents[0].args, vec!["acp"]);
+        validate_agent(&agents[0]).unwrap();
+    }
+
+    #[test]
+    fn registered_args_may_be_flags_but_stay_bounded() {
+        // Fixed config flags like --experimental-acp are legitimate.
+        validate_agent(&agent("gemini")).unwrap();
+        let mut too_many = agent("gemini");
+        too_many.args = vec!["x".to_string(); MAX_ARGS + 1];
+        assert!(validate_agent(&too_many).is_err());
+        let mut newline = agent("gemini");
+        newline.args = vec!["a\nb".to_string()];
+        assert!(validate_agent(&newline).is_err());
+        let mut empty = agent("gemini");
+        empty.args = vec![String::new()];
+        assert!(validate_agent(&empty).is_err());
+    }
+
+    #[test]
+    fn ids_names_and_commands_are_validated() {
+        for bad in ["", "UPPER", "a b", "--x", "a/b"] {
+            assert!(validate_agent(&agent(bad)).is_err(), "{bad:?}");
+        }
+        let mut flag_cmd = agent("ok");
+        flag_cmd.command = "--rm".to_string();
+        assert!(validate_agent(&flag_cmd).is_err());
+        let mut no_name = agent("ok");
+        no_name.name = String::new();
+        assert!(validate_agent(&no_name).is_err());
+        // Paths (with spaces) are fine as commands.
+        let mut path_cmd = agent("ok");
+        path_cmd.command = "/opt/agents/my agent/bin/agent".to_string();
+        validate_agent(&path_cmd).unwrap();
+    }
+
+    #[test]
+    fn env_entries_are_validated_like_backend_env() {
+        let mut bad_env = agent("ok");
+        bad_env
+            .env
+            .insert("DYLD_INSERT_LIBRARIES".to_string(), "/evil".to_string());
+        assert!(validate_agent(&bad_env).is_err());
+        let mut bad_name = agent("ok");
+        bad_name.env.insert("1BAD".to_string(), "x".to_string());
+        assert!(validate_agent(&bad_name).is_err());
+        let mut ok_env = agent("ok");
+        ok_env
+            .env
+            .insert("GEMINI_API_KEY".to_string(), "k".to_string());
+        validate_agent(&ok_env).unwrap();
+    }
+
+    #[test]
+    fn parse_registry_validates_every_entry() {
+        let ok = r#"{"agents":[{"id":"gemini","name":"Gemini CLI","command":"gemini","args":["--experimental-acp"]}]}"#;
+        let agents = parse_registry(ok).unwrap();
+        assert_eq!(agents[0].id, "gemini");
+        assert_eq!(agents[0].args, vec!["--experimental-acp"]);
+        assert!(agents[0].env.is_empty());
+        // A hand-edited file with a smuggled entry is rejected wholesale.
+        let bad = r#"{"agents":[{"id":"OK?","name":"x","command":"sh"}]}"#;
+        assert!(parse_registry(bad).is_err());
+        assert!(parse_registry("not json").is_err());
+        // An explicitly emptied registry stays empty (no re-seeding).
+        assert_eq!(
+            parse_registry(r#"{"agents":[]}"#).unwrap(),
+            Vec::<AcpAgent>::new()
+        );
+    }
+}
diff --git a/src-tauri/src/backend.rs b/src-tauri/src/backend.rs
index ada88d3..58a6476 100644
--- a/src-tauri/src/backend.rs
+++ b/src-tauri/src/backend.rs
@@ -18,6 +18,10 @@ pub enum BackendKind {
     Codex,
     /// Claude Code CLI in stream-json print mode.
     Claude,
+    /// Any Agent Client Protocol agent (JSON-RPC over stdio). The command
+    /// line comes from the user-managed ACP registry (`acp_registry.rs`) —
+    /// the frontend only ever passes a registry entry id.
+    Acp,
 }
 
 impl BackendKind {
@@ -26,25 +30,30 @@ impl BackendKind {
             "jucode" => Ok(Self::Jucode),
             "codex" => Ok(Self::Codex),
             "claude" => Ok(Self::Claude),
+            "acp" => Ok(Self::Acp),
             other => Err(format!("unknown backend: {other}")),
         }
     }
 
-    /// Binary base name (without the Windows `.exe` suffix).
+    /// Binary base name (without the Windows `.exe` suffix). For `Acp` this is
+    /// only used in error messages — the actual command comes from the registry.
     pub fn bin_name(self) -> &'static str {
         match self {
             Self::Jucode => "jucode",
             Self::Codex => "codex",
             Self::Claude => "claude",
+            Self::Acp => "acp",
         }
     }
 
-    /// Environment variable that force-overrides binary resolution.
+    /// Environment variable that force-overrides binary resolution. Never
+    /// consulted for `Acp` (its binary resolution goes through the registry).
     pub fn env_override(self) -> &'static str {
         match self {
             Self::Jucode => "JUCODE_BIN",
             Self::Codex => "CODEX_BIN",
             Self::Claude => "CLAUDE_BIN",
+            Self::Acp => "JUCODE_ACP_BIN_UNUSED",
         }
     }
 
@@ -65,6 +74,9 @@ impl BackendKind {
                 "use_shell_env",
                 "env",
             ],
+            // ACP sessions select a registry entry — never a binary path or
+            // argv. Everything else about the spawn is fixed by the registry.
+            Self::Acp => &["agent", "use_shell_env", "env"],
         }
     }
 }
@@ -86,6 +98,8 @@ pub struct BackendOpts {
     pub session_id: Option<String>,
     /// claude: `--model <name>`.
     pub model: Option<String>,
+    /// acp: registry entry id of the agent to launch (`acp_registry.rs`).
+    pub agent: Option<String>,
     /// Build the child env from the login-shell snapshot (default true; see
     /// `shell_env`). Off = inherit the GUI environment as before.
     pub use_shell_env: bool,
@@ -102,6 +116,7 @@ impl Default for BackendOpts {
             resume_session_at: None,
             session_id: None,
             model: None,
+            agent: None,
             use_shell_env: true,
             env: Vec::new(),
         }
@@ -110,7 +125,7 @@ impl Default for BackendOpts {
 
 /// Custom env var names: POSIX-style identifiers only, with dangerous
 /// dynamic-linker prefixes rejected outright.
-fn is_valid_env_name(name: &str) -> bool {
+pub(crate) fn is_valid_env_name(name: &str) -> bool {
     !name.is_empty()
         && name.len() <= 128
         && !name.starts_with("DYLD_")
@@ -123,12 +138,27 @@ fn is_valid_env_name(name: &str) -> bool {
         && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')
 }
 
-const MAX_CUSTOM_ENV_VARS: usize = 50;
-const MAX_CUSTOM_ENV_VALUE_LEN: usize = 4096;
+pub(crate) const MAX_CUSTOM_ENV_VARS: usize = 50;
+pub(crate) const MAX_CUSTOM_ENV_VALUE_LEN: usize = 4096;
+
+/// ACP registry entry ids: short lowercase slugs, so an id can never look
+/// like a flag, a path or contain whitespace tricks.
+pub(crate) fn is_valid_acp_agent_id(s: &str) -> bool {
+    !s.is_empty()
+        && s.len() <= 64
+        && !s.starts_with('-')
+        && s.chars()
+            .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-' || c == '_')
+}
 
 /// Claude Code permission modes the desktop is allowed to request.
-const CLAUDE_PERMISSION_MODES: &[&str] =
-    &["default", "plan", "auto", "acceptEdits", "bypassPermissions"];
+const CLAUDE_PERMISSION_MODES: &[&str] = &[
+    "default",
+    "plan",
+    "auto",
+    "acceptEdits",
+    "bypassPermissions",
+];
 
 fn expect_string(key: &str, v: &serde_json::Value) -> Result<String, String> {
     v.as_str()
@@ -190,7 +220,9 @@ pub fn validate_opts(
                     .as_object()
                     .ok_or_else(|| "env must be an object of string values".to_string())?;
                 if obj.len() > MAX_CUSTOM_ENV_VARS {
-                    return Err(format!("env accepts at most {MAX_CUSTOM_ENV_VARS} variables"));
+                    return Err(format!(
+                        "env accepts at most {MAX_CUSTOM_ENV_VARS} variables"
+                    ));
                 }
                 let mut vars = Vec::with_capacity(obj.len());
                 for (name, val) in obj {
@@ -249,6 +281,12 @@ pub fn validate_opts(
                 }
                 opts.model = Some(s);
             }
+            "agent" => {
+                if !is_valid_acp_agent_id(&s) {
+                    return Err(format!("invalid acp agent id: {s}"));
+                }
+                opts.agent = Some(s);
+            }
             _ => unreachable!("key was checked against the allowlist"),
         }
     }
@@ -267,6 +305,9 @@ pub fn build_args(kind: BackendKind, opts: &BackendOpts) -> Vec<String> {
     match kind {
         BackendKind::Jucode => vec!["serve".to_string()],
         BackendKind::Codex => vec!["app-server".to_string()],
+        // ACP argv comes from the registry entry, not from options —
+        // create_session never calls build_args for this kind.
+        BackendKind::Acp => Vec::new(),
         BackendKind::Claude => {
             let yolo = opts.permission_mode.as_deref() == Some("bypassPermissions");
             let mut args: Vec<String> = [
@@ -325,19 +366,39 @@ pub fn build_args(kind: BackendKind, opts: &BackendOpts) -> Vec<String> {
 /// Well-known install locations probed after PATH (a packaged app inherits a
 /// minimal PATH from launchd / the desktop session).
 fn well_known_paths(kind: BackendKind) -> Vec<PathBuf> {
-    let name = kind.bin_name();
-    let exe = if cfg!(windows) {
+    let mut paths = well_known_candidates(kind.bin_name(), kind == BackendKind::Jucode);
+    if kind == BackendKind::Claude {
+        let exe = exe_name("claude");
+        let home = home_dir();
+        // Claude Code's native installer keeps a launcher here too.
+        paths.push(home.join(".claude").join("local").join(&exe));
+    }
+    paths
+}
+
+fn exe_name(name: &str) -> String {
+    if cfg!(windows) {
         format!("{name}.exe")
     } else {
         name.to_string()
-    };
-    let home = std::env::var_os("HOME")
+    }
+}
+
+fn home_dir() -> PathBuf {
+    std::env::var_os("HOME")
         .or_else(|| std::env::var_os("USERPROFILE"))
         .map(PathBuf::from)
-        .unwrap_or_default();
+        .unwrap_or_default()
+}
+
+/// Well-known install dirs for an arbitrary program name (shared by the fixed
+/// backends and the ACP registry's command resolution).
+fn well_known_candidates(name: &str, jucode_installer_dir: bool) -> Vec<PathBuf> {
+    let exe = exe_name(name);
+    let home = home_dir();
     let mut paths: Vec<PathBuf> = Vec::new();
     if cfg!(windows) {
-        if kind == BackendKind::Jucode {
+        if jucode_installer_dir {
             // Per-user installer dir and the npm global prefix.
             if let Some(la) = std::env::var_os("LOCALAPPDATA") {
                 paths.push(PathBuf::from(la).join("Programs").join("jucode").join(&exe));
@@ -354,17 +415,42 @@ fn well_known_paths(kind: BackendKind) -> Vec<PathBuf> {
         paths.push(home.join(".cargo/bin").join(&exe));
         paths.push(home.join(".local/bin").join(&exe)); // per-user installs (incl. Claude Code native)
     }
-    if kind == BackendKind::Claude {
-        // Claude Code's native installer keeps a launcher here too.
-        paths.push(home.join(".claude").join("local").join(&exe));
-    }
     paths
 }
 
+/// Resolves an ACP registry entry's command to a program path. A command with
+/// a path separator is used as-is; the engine binaries reuse the full backend
+/// resolution (env override → PATH → well-known dirs → dev builds); anything
+/// else goes PATH → well-known dirs → bare name (PATH-spawn at run time).
+pub fn resolve_acp_program(command: &str) -> PathBuf {
+    for kind in [BackendKind::Jucode, BackendKind::Codex, BackendKind::Claude] {
+        if command == kind.bin_name() {
+            return resolve_backend_bin(kind, None);
+        }
+    }
+    let p = Path::new(command);
+    if p.components().count() > 1 || p.is_absolute() {
+        return p.to_path_buf();
+    }
+    if let Some(found) = crate::which(command) {
+        return found;
+    }
+    for candidate in well_known_candidates(command, false) {
+        if candidate.is_file() {
+            return candidate;
+        }
+    }
+    PathBuf::from(command)
+}
+
 /// Dev fallback for the native engine only: the freshly-built binary from the
 /// sibling `JuCode-CLI` checkout (mirrors the pre-multi-backend behavior).
 fn jucode_dev_candidates() -> Vec<PathBuf> {
-    let exe = if cfg!(windows) { "jucode.exe" } else { "jucode" };
+    let exe = if cfg!(windows) {
+        "jucode.exe"
+    } else {
+        "jucode"
+    };
     let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR")); // <repo>/src-tauri
     [
         format!("../../JuCode-CLI/target/debug/{exe}"),
@@ -434,10 +520,54 @@ mod tests {
         assert_eq!(BackendKind::parse("jucode").unwrap(), BackendKind::Jucode);
         assert_eq!(BackendKind::parse("codex").unwrap(), BackendKind::Codex);
         assert_eq!(BackendKind::parse("claude").unwrap(), BackendKind::Claude);
+        assert_eq!(BackendKind::parse("acp").unwrap(), BackendKind::Acp);
         assert!(BackendKind::parse("bash").is_err());
         assert!(BackendKind::parse("").is_err());
     }
 
+    // --- acp options ---
+
+    #[test]
+    fn acp_accepts_only_a_registry_agent_id() {
+        let opts =
+            validate_opts(BackendKind::Acp, Some(&json!({ "agent": "gemini-cli" }))).unwrap();
+        assert_eq!(opts.agent.as_deref(), Some("gemini-cli"));
+        // No binary override, no argv-shaped anything.
+        assert!(validate_opts(
+            BackendKind::Acp,
+            Some(&json!({ "bin_override": "/bin/sh" }))
+        )
+        .is_err());
+        assert!(validate_opts(BackendKind::Acp, Some(&json!({ "args": ["-x"] }))).is_err());
+        assert!(validate_opts(BackendKind::Acp, Some(&json!({ "command": "sh" }))).is_err());
+        // Ids are slugs: no flags, spaces, dots or uppercase.
+        for bad in ["--help", "a b", "../etc", "UPPER", ""] {
+            assert!(
+                validate_opts(BackendKind::Acp, Some(&json!({ "agent": bad }))).is_err(),
+                "{bad:?} must be rejected"
+            );
+        }
+        // Other backends don't take `agent`.
+        assert!(validate_opts(BackendKind::Jucode, Some(&json!({ "agent": "x" }))).is_err());
+        assert!(validate_opts(BackendKind::Claude, Some(&json!({ "agent": "x" }))).is_err());
+    }
+
+    #[test]
+    fn acp_build_args_is_empty_registry_supplies_argv() {
+        assert!(build_args(BackendKind::Acp, &BackendOpts::default()).is_empty());
+    }
+
+    #[test]
+    fn acp_program_resolution_keeps_explicit_paths_and_reuses_engine_resolution() {
+        // A path with separators is used exactly as configured.
+        let p = resolve_acp_program("/usr/local/bin/my-agent");
+        assert_eq!(p, PathBuf::from("/usr/local/bin/my-agent"));
+        // The engine binaries route through the shared backend resolution
+        // (worst case they fall back to the bare name, never to an empty path).
+        let ju = resolve_acp_program("jucode");
+        assert!(!ju.as_os_str().is_empty());
+    }
+
     // --- arg templates ---
 
     #[test]
@@ -538,7 +668,10 @@ mod tests {
         let args = build_args(BackendKind::Claude, &opts);
         let ri = args.iter().position(|a| a == "--resume").unwrap();
         assert_eq!(args[ri + 1], "0f3d7a1c-9e2b-4b7e-9d4d-2a1b3c4d5e6f");
-        let ai = args.iter().position(|a| a == "--resume-session-at").unwrap();
+        let ai = args
+            .iter()
+            .position(|a| a == "--resume-session-at")
+            .unwrap();
         assert_eq!(args[ai + 1], "aa11bb22-cc33-dd44-ee55-ff6677889900");
         // resume_session_at without resume is rejected.
         assert!(validate_opts(
@@ -573,7 +706,11 @@ mod tests {
             assert!(err.is_err(), "{kind:?} must reject permission_mode");
         }
         assert!(validate_opts(BackendKind::Claude, Some(&json!({ "argv": ["-x"] }))).is_err());
-        assert!(validate_opts(BackendKind::Claude, Some(&json!({ "extra_flag": "--yolo" }))).is_err());
+        assert!(validate_opts(
+            BackendKind::Claude,
+            Some(&json!({ "extra_flag": "--yolo" }))
+        )
+        .is_err());
     }
 
     #[test]
@@ -583,31 +720,29 @@ mod tests {
             Some(&json!({ "model": "--dangerously-skip-permissions" }))
         )
         .is_err());
-        assert!(validate_opts(
-            BackendKind::Claude,
-            Some(&json!({ "resume": "--help" }))
-        )
-        .is_err());
-        assert!(validate_opts(
-            BackendKind::Jucode,
-            Some(&json!({ "bin_override": "-rf" }))
-        )
-        .is_err());
+        assert!(validate_opts(BackendKind::Claude, Some(&json!({ "resume": "--help" }))).is_err());
+        assert!(
+            validate_opts(BackendKind::Jucode, Some(&json!({ "bin_override": "-rf" }))).is_err()
+        );
     }
 
     #[test]
     fn permission_mode_is_a_fixed_enum() {
         for ok in CLAUDE_PERMISSION_MODES {
-            assert!(validate_opts(BackendKind::Claude, Some(&json!({ "permission_mode": ok }))).is_ok());
+            assert!(
+                validate_opts(BackendKind::Claude, Some(&json!({ "permission_mode": ok }))).is_ok()
+            );
         }
         assert!(validate_opts(
             BackendKind::Claude,
             Some(&json!({ "permission_mode": "bypassPermissions --verbose" }))
         )
         .is_err());
-        assert!(
-            validate_opts(BackendKind::Claude, Some(&json!({ "permission_mode": "yolo" }))).is_err()
-        );
+        assert!(validate_opts(
+            BackendKind::Claude,
+            Some(&json!({ "permission_mode": "yolo" }))
+        )
+        .is_err());
     }
 
     #[test]
@@ -648,7 +783,10 @@ mod tests {
 
     #[test]
     fn null_or_missing_opts_mean_defaults() {
-        assert_eq!(validate_opts(BackendKind::Jucode, None).unwrap(), BackendOpts::default());
+        assert_eq!(
+            validate_opts(BackendKind::Jucode, None).unwrap(),
+            BackendOpts::default()
+        );
         assert_eq!(
             validate_opts(BackendKind::Codex, Some(&serde_json::Value::Null)).unwrap(),
             BackendOpts::default()
@@ -665,11 +803,17 @@ mod tests {
     fn use_shell_env_defaults_true_and_accepts_bool_only() {
         for kind in [BackendKind::Jucode, BackendKind::Codex, BackendKind::Claude] {
             assert!(validate_opts(kind, None).unwrap().use_shell_env);
-            assert!(!validate_opts(kind, Some(&json!({ "use_shell_env": false })))
-                .unwrap()
-                .use_shell_env);
+            assert!(
+                !validate_opts(kind, Some(&json!({ "use_shell_env": false })))
+                    .unwrap()
+                    .use_shell_env
+            );
         }
-        assert!(validate_opts(BackendKind::Jucode, Some(&json!({ "use_shell_env": "yes" }))).is_err());
+        assert!(validate_opts(
+            BackendKind::Jucode,
+            Some(&json!({ "use_shell_env": "yes" }))
+        )
+        .is_err());
     }
 
     #[test]
@@ -688,7 +832,10 @@ mod tests {
             json!({ "env": { "A": 42 } }),
             json!({ "env": "PATH=/x" }),
         ] {
-            assert!(validate_opts(BackendKind::Claude, Some(&bad)).is_err(), "{bad}");
+            assert!(
+                validate_opts(BackendKind::Claude, Some(&bad)).is_err(),
+                "{bad}"
+            );
         }
     }
 
@@ -763,7 +910,9 @@ mod tests {
         assert_eq!(p, PathBuf::from("claude"));
         let probed = hits.lock().unwrap();
         assert!(!probed.is_empty());
-        assert!(probed.iter().any(|c| c.ends_with(".local/bin/claude") || c.ends_with(".local\\bin\\claude.exe")));
+        assert!(probed
+            .iter()
+            .any(|c| c.ends_with(".local/bin/claude") || c.ends_with(".local\\bin\\claude.exe")));
     }
 
     #[test]
@@ -772,7 +921,13 @@ mod tests {
             c.to_string_lossy().contains("JuCode-CLI/target/debug")
         });
         assert!(p.to_string_lossy().contains("JuCode-CLI/target/debug"));
-        let none = resolve_with(BackendKind::Jucode, None, &no_env, &no_which, &nothing_exists);
+        let none = resolve_with(
+            BackendKind::Jucode,
+            None,
+            &no_env,
+            &no_which,
+            &nothing_exists,
+        );
         assert_eq!(none, PathBuf::from("jucode"));
     }
 }
diff --git a/src-tauri/src/browser.rs b/src-tauri/src/browser.rs
index fb65566..1cdd77d 100644
--- a/src-tauri/src/browser.rs
+++ b/src-tauri/src/browser.rs
@@ -148,7 +148,9 @@ pub fn browser_open(
 #[tauri::command]
 pub fn browser_navigate(app: AppHandle, url: String) -> Result<(), String> {
     let target = normalize_url(&url)?;
-    get_browser(&app)?.navigate(target).map_err(|e| e.to_string())
+    get_browser(&app)?
+        .navigate(target)
+        .map_err(|e| e.to_string())
 }
 
 #[tauri::command]
diff --git a/src-tauri/src/capture.rs b/src-tauri/src/capture.rs
index 2cbe18d..ea2a710 100644
--- a/src-tauri/src/capture.rs
+++ b/src-tauri/src/capture.rs
@@ -94,7 +94,9 @@ fn pick_shot_backend(
         "windows" => Ok(ShotBackend::WinSnip),
         "linux" => {
             if wayland && has("grim") {
-                return Ok(ShotBackend::Grim { slurp: has("slurp") });
+                return Ok(ShotBackend::Grim {
+                    slurp: has("slurp"),
+                });
             }
             if has("gnome-screenshot") {
                 return Ok(ShotBackend::GnomeScreenshot);
@@ -329,7 +331,10 @@ fn win_capture_fullscreen(path: &Path) -> Result<String, String> {
 #[tauri::command]
 pub fn start_screen_recording(rec: tauri::State<Recorder>) -> Result<(), String> {
     let backend = pick_rec_backend(std::env::consts::OS, is_wayland(), &has_tool)?;
-    let mut guard = rec.inner.lock().map_err(|e| format!("lock poisoned: {e}"))?;
+    let mut guard = rec
+        .inner
+        .lock()
+        .map_err(|e| format!("lock poisoned: {e}"))?;
     if guard.is_some() {
         return Err("已有录屏进行中 / A screen recording is already in progress".to_string());
     }
@@ -402,8 +407,8 @@ pub fn stop_screen_recording(rec: tauri::State<'_, Recorder>) -> Result<String,
         .lock()
         .map_err(|e| format!("lock poisoned: {e}"))?
         .take();
-    let (mut child, path, stop) =
-        taken.ok_or_else(|| "当前没有进行中的录屏 / No screen recording in progress".to_string())?;
+    let (mut child, path, stop) = taken
+        .ok_or_else(|| "当前没有进行中的录屏 / No screen recording in progress".to_string())?;
     match stop {
         StopMethod::SigInt => {
             let _ = Command::new("kill")
@@ -456,7 +461,12 @@ fn find_tool(name: &str) -> Result<PathBuf, String> {
         let mut dirs: Vec<PathBuf> = Vec::new();
         if let Some(la) = std::env::var_os("LOCALAPPDATA") {
             // winget (Gyan.FFmpeg) shim directory.
-            dirs.push(PathBuf::from(la).join("Microsoft").join("WinGet").join("Links"));
+            dirs.push(
+                PathBuf::from(la)
+                    .join("Microsoft")
+                    .join("WinGet")
+                    .join("Links"),
+            );
         }
         dirs.push(PathBuf::from("C:\\ffmpeg\\bin"));
         for dir in dirs {
@@ -466,7 +476,12 @@ fn find_tool(name: &str) -> Result<PathBuf, String> {
             }
         }
     } else {
-        for dir in ["/opt/homebrew/bin", "/usr/local/bin", "/opt/local/bin", "/usr/bin"] {
+        for dir in [
+            "/opt/homebrew/bin",
+            "/usr/local/bin",
+            "/opt/local/bin",
+            "/usr/bin",
+        ] {
             let candidate = Path::new(dir).join(name);
             if candidate.is_file() {
                 return Ok(candidate);
@@ -623,9 +638,12 @@ mod tests {
 
     #[test]
     fn wayland_prefers_grim_with_slurp() {
-        let got =
-            pick_shot_backend("linux", true, &avail(&["grim", "slurp", "gnome-screenshot"]))
-                .unwrap();
+        let got = pick_shot_backend(
+            "linux",
+            true,
+            &avail(&["grim", "slurp", "gnome-screenshot"]),
+        )
+        .unwrap();
         assert_eq!(got, ShotBackend::Grim { slurp: true });
     }
 
@@ -645,8 +663,8 @@ mod tests {
     #[test]
     fn x11_ignores_grim_and_probes_in_order() {
         // grim is wayland-only: never picked on X11 even if installed.
-        let got = pick_shot_backend("linux", false, &avail(&["grim", "spectacle", "scrot"]))
-            .unwrap();
+        let got =
+            pick_shot_backend("linux", false, &avail(&["grim", "spectacle", "scrot"])).unwrap();
         assert_eq!(got, ShotBackend::Spectacle);
         let got = pick_shot_backend("linux", false, &avail(&["grim", "scrot"])).unwrap();
         assert_eq!(got, ShotBackend::Scrot);
diff --git a/src-tauri/src/claude_history.rs b/src-tauri/src/claude_history.rs
index d0c3838..50b44dd 100644
--- a/src-tauri/src/claude_history.rs
+++ b/src-tauri/src/claude_history.rs
@@ -297,7 +297,9 @@ mod tests {
             &home,
             cwd,
             "aaaaaaaa-1111-4111-8111-111111111111",
-            &[r#"{"type":"user","message":{"role":"user","content":[{"type":"text","text":"fix the login bug"}]}}"#],
+            &[
+                r#"{"type":"user","message":{"role":"user","content":[{"type":"text","text":"fix the login bug"}]}}"#,
+            ],
         );
         let newer = write_session(
             &home,
@@ -375,9 +377,18 @@ mod tests {
         assert_eq!(
             rows,
             vec![
-                ClaudeTranscriptRow { role: "user".into(), content: "run a command".into() },
-                ClaudeTranscriptRow { role: "assistant".into(), content: "on it".into() },
-                ClaudeTranscriptRow { role: "assistant".into(), content: "done".into() },
+                ClaudeTranscriptRow {
+                    role: "user".into(),
+                    content: "run a command".into()
+                },
+                ClaudeTranscriptRow {
+                    role: "assistant".into(),
+                    content: "on it".into()
+                },
+                ClaudeTranscriptRow {
+                    role: "assistant".into(),
+                    content: "done".into()
+                },
             ]
         );
     }
@@ -431,6 +442,9 @@ mod tests {
         assert_eq!(rows.len(), MAX_TRANSCRIPT_ROWS);
         // The oldest rows were dropped, the newest kept.
         assert_eq!(rows.last().unwrap().role, "assistant");
-        assert_eq!(rows.last().unwrap().content.chars().count(), MAX_ROW_CHARS + 1); // +1 = ellipsis
+        assert_eq!(
+            rows.last().unwrap().content.chars().count(),
+            MAX_ROW_CHARS + 1
+        ); // +1 = ellipsis
     }
 }
diff --git a/src-tauri/src/installer.rs b/src-tauri/src/installer.rs
index 48bb2a5..f4d651f 100644
--- a/src-tauri/src/installer.rs
+++ b/src-tauri/src/installer.rs
@@ -142,21 +142,29 @@ fn system_plan(
             if has("winget") {
                 winget(winget_id)
             } else {
-                Plan::OpenUrl { url: url.to_string() }
+                Plan::OpenUrl {
+                    url: url.to_string(),
+                }
             }
         }
         "macos" => {
             if has("brew") {
                 brew(brew_pkg)
             } else {
-                Plan::OpenUrl { url: url.to_string() }
+                Plan::OpenUrl {
+                    url: url.to_string(),
+                }
             }
         }
         "linux" => match linux_pkg_command(linux_pkgs, has) {
             Some(command) => Plan::Manual { command },
-            None => Plan::OpenUrl { url: url.to_string() },
+            None => Plan::OpenUrl {
+                url: url.to_string(),
+            },
+        },
+        _ => Plan::OpenUrl {
+            url: url.to_string(),
         },
-        _ => Plan::OpenUrl { url: url.to_string() },
     }
 }
 
@@ -169,14 +177,18 @@ pub fn plan(dep: Dep, os: &str, has: &dyn Fn(&str) -> bool) -> Plan {
             if has("npm") {
                 npm_global("@openai/codex")
             } else {
-                Plan::NeedsPrereq { prereq: "node".to_string() }
+                Plan::NeedsPrereq {
+                    prereq: "node".to_string(),
+                }
             }
         }
         Dep::Jucode => {
             if has("npm") {
                 npm_global("@jucode/cli")
             } else {
-                Plan::NeedsPrereq { prereq: "node".to_string() }
+                Plan::NeedsPrereq {
+                    prereq: "node".to_string(),
+                }
             }
         }
         Dep::Claude => {
@@ -248,10 +260,15 @@ mod tests {
         // Linux with apt → copyable sudo command (nodejs + npm).
         assert_eq!(
             plan(Dep::Node, "linux", &avail(&["apt-get"])),
-            Plan::Manual { command: "sudo apt-get install -y nodejs npm".to_string() }
+            Plan::Manual {
+                command: "sudo apt-get install -y nodejs npm".to_string()
+            }
         );
         // Linux without a known manager → download page.
-        assert!(matches!(plan(Dep::Node, "linux", &avail(&[])), Plan::OpenUrl { .. }));
+        assert!(matches!(
+            plan(Dep::Node, "linux", &avail(&[])),
+            Plan::OpenUrl { .. }
+        ));
     }
 
     #[test]
@@ -260,10 +277,15 @@ mod tests {
             plan(Dep::Ffmpeg, "windows", &avail(&["winget"])),
             winget("Gyan.FFmpeg")
         );
-        assert_eq!(plan(Dep::Ffmpeg, "macos", &avail(&["brew"])), brew("ffmpeg"));
+        assert_eq!(
+            plan(Dep::Ffmpeg, "macos", &avail(&["brew"])),
+            brew("ffmpeg")
+        );
         assert_eq!(
             plan(Dep::Ffmpeg, "linux", &avail(&["dnf"])),
-            Plan::Manual { command: "sudo dnf install -y ffmpeg".to_string() }
+            Plan::Manual {
+                command: "sudo dnf install -y ffmpeg".to_string()
+            }
         );
     }
 
@@ -272,16 +294,29 @@ mod tests {
         // No npm → prereq.
         assert_eq!(
             plan(Dep::Codex, "windows", &avail(&[])),
-            Plan::NeedsPrereq { prereq: "node".to_string() }
+            Plan::NeedsPrereq {
+                prereq: "node".to_string()
+            }
         );
         assert_eq!(
             plan(Dep::Jucode, "linux", &avail(&[])),
-            Plan::NeedsPrereq { prereq: "node".to_string() }
+            Plan::NeedsPrereq {
+                prereq: "node".to_string()
+            }
         );
         // With npm → npm i -g <pkg>, identical across platforms.
-        assert_eq!(plan(Dep::Codex, "windows", &avail(&["npm"])), npm_global("@openai/codex"));
-        assert_eq!(plan(Dep::Codex, "macos", &avail(&["npm"])), npm_global("@openai/codex"));
-        assert_eq!(plan(Dep::Jucode, "linux", &avail(&["npm"])), npm_global("@jucode/cli"));
+        assert_eq!(
+            plan(Dep::Codex, "windows", &avail(&["npm"])),
+            npm_global("@openai/codex")
+        );
+        assert_eq!(
+            plan(Dep::Codex, "macos", &avail(&["npm"])),
+            npm_global("@openai/codex")
+        );
+        assert_eq!(
+            plan(Dep::Jucode, "linux", &avail(&["npm"])),
+            npm_global("@jucode/cli")
+        );
     }
 
     #[test]
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 8c5d53e..42fe654 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1,12 +1,13 @@
+use serde::Serialize;
 use std::collections::HashMap;
 use std::io::{BufRead, BufReader, Read, Write};
 use std::path::{Path, PathBuf};
 use std::process::{Child, ChildStdin, Command, Stdio};
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex};
-use serde::Serialize;
 use tauri::{AppHandle, Emitter, Manager};
 
+mod acp_registry;
 mod backend;
 mod browser;
 mod capture;
@@ -130,8 +131,31 @@ fn create_session(
 ) -> Result<(), String> {
     let kind = BackendKind::parse(backend.as_deref().unwrap_or("jucode"))?;
     let opts = backend::validate_opts(kind, backend_opts.as_ref())?;
-    let bin = backend::resolve_backend_bin(kind, opts.bin_override.as_deref());
-    let args = backend::build_args(kind, &opts);
+    // ACP sessions spawn a registered agent: the command line is looked up in
+    // the validated registry by id — never composed from request data.
+    let (bin, args, agent_env) = if kind == BackendKind::Acp {
+        let agent_id = opts
+            .agent
+            .as_deref()
+            .ok_or_else(|| "acp backend requires an `agent` registry id".to_string())?;
+        let agent = acp_registry::find_agent(&app, agent_id)?;
+        let env: Vec<(String, String)> = agent
+            .env
+            .iter()
+            .map(|(k, v)| (k.clone(), v.clone()))
+            .collect();
+        (
+            backend::resolve_acp_program(&agent.command),
+            agent.args,
+            env,
+        )
+    } else {
+        (
+            backend::resolve_backend_bin(kind, opts.bin_override.as_deref()),
+            backend::build_args(kind, &opts),
+            Vec::new(),
+        )
+    };
     let dir = cwd
         .map(PathBuf::from)
         .filter(|p| p.is_dir())
@@ -159,7 +183,11 @@ fn create_session(
     } else {
         &[]
     };
-    shell_env::apply_to_command(&mut cmd, opts.use_shell_env, explicit, &opts.env);
+    // Per-backend custom env first, then the registry entry's per-agent env
+    // (the more specific configuration wins).
+    let mut custom_env = opts.env.clone();
+    custom_env.extend(agent_env);
+    shell_env::apply_to_command(&mut cmd, opts.use_shell_env, explicit, &custom_env);
     let mut child = cmd.spawn().map_err(|error| match kind {
         BackendKind::Jucode => format!("failed to start jucode serve: {error}"),
         _ => format!("failed to start {} backend: {error}", kind.bin_name()),
@@ -267,11 +295,7 @@ fn send_op(
 /// own protocol frame (JSON-RPC for codex, stream-json for claude) and sends it
 /// as one line. Embedded newlines are rejected — one call, one frame.
 #[tauri::command]
-fn send_line(
-    session: String,
-    line: String,
-    engines: tauri::State<Engines>,
-) -> Result<(), String> {
+fn send_line(session: String, line: String, engines: tauri::State<Engines>) -> Result<(), String> {
     if line.contains('\n') || line.contains('\r') {
         return Err("line must be a single frame (no embedded newlines)".to_string());
     }
@@ -280,10 +304,10 @@ fn send_line(
 
 /// Availability report for one backend binary (settings / new-session UI).
 #[derive(Serialize)]
-struct BackendStatus {
-    found: bool,
-    path: Option<String>,
-    version: Option<String>,
+pub(crate) struct BackendStatus {
+    pub(crate) found: bool,
+    pub(crate) path: Option<String>,
+    pub(crate) version: Option<String>,
 }
 
 /// Probes a backend binary: resolves it (honoring `bin_override`) and runs
@@ -292,6 +316,10 @@ struct BackendStatus {
 #[tauri::command(async)]
 fn check_backend(backend: String, bin_override: Option<String>) -> Result<BackendStatus, String> {
     let kind = BackendKind::parse(&backend)?;
+    if kind == BackendKind::Acp {
+        // ACP has no single binary — probe a specific agent with acp_agent_check.
+        return Err("use acp_agent_check to probe a registered ACP agent".to_string());
+    }
     let bin = backend::resolve_backend_bin(kind, bin_override.as_deref());
     // A bare name means "nothing found, hope PATH has it at spawn time" —
     // resolve it through PATH for the report (None when truly absent).
@@ -343,8 +371,12 @@ fn read_json(path: &std::path::Path) -> serde_json::Value {
 fn read_json_strict(path: &std::path::Path) -> Result<serde_json::Value, String> {
     match std::fs::read_to_string(path) {
         Ok(text) if text.trim().is_empty() => Ok(serde_json::json!({})),
-        Ok(text) => serde_json::from_str(&text)
-            .map_err(|e| format!("{} 解析失败，已中止写入以免覆盖现有内容：{e}", path.display())),
+        Ok(text) => serde_json::from_str(&text).map_err(|e| {
+            format!(
+                "{} 解析失败，已中止写入以免覆盖现有内容：{e}",
+                path.display()
+            )
+        }),
         Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(serde_json::json!({})),
         Err(e) => Err(format!("读取 {} 失败：{e}", path.display())),
     }
@@ -556,10 +588,7 @@ fn remove_auth_key(provider: String) -> Result<(), String> {
             root.remove("jucode");
         }
     }
-    if let Some(map) = current
-        .get_mut("providers")
-        .and_then(|v| v.as_object_mut())
-    {
+    if let Some(map) = current.get_mut("providers").and_then(|v| v.as_object_mut()) {
         map.remove(&provider);
     }
     write_auth(&mut current)
@@ -589,7 +618,10 @@ fn unix_now() -> u64 {
 /// only keeps the Desktop's own API calls authenticated between logins.
 fn jucode_access_token() -> Result<String, String> {
     let auth = read_auth();
-    let jucode = auth.get("jucode").cloned().unwrap_or_else(|| serde_json::json!({}));
+    let jucode = auth
+        .get("jucode")
+        .cloned()
+        .unwrap_or_else(|| serde_json::json!({}));
     let access = jucode
         .get("access_token")
         .and_then(|v| v.as_str())
@@ -600,7 +632,10 @@ fn jucode_access_token() -> Result<String, String> {
         .and_then(|v| v.as_str())
         .unwrap_or("")
         .to_string();
-    let access_exp = jucode.get("access_expires_at").and_then(|v| v.as_u64()).unwrap_or(0);
+    let access_exp = jucode
+        .get("access_expires_at")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0);
     if refresh.is_empty() {
         return Err("not logged in to JuCode".to_string());
     }
@@ -617,7 +652,10 @@ fn jucode_access_token() -> Result<String, String> {
         .map_err(|e| format!("lock poisoned: {e}"))?;
     // Re-read after acquiring the lock: another thread may have just refreshed.
     let fresh = read_auth();
-    let fresh_jucode = fresh.get("jucode").cloned().unwrap_or_else(|| serde_json::json!({}));
+    let fresh_jucode = fresh
+        .get("jucode")
+        .cloned()
+        .unwrap_or_else(|| serde_json::json!({}));
     let fresh_access = fresh_jucode
         .get("access_token")
         .and_then(|v| v.as_str())
@@ -652,12 +690,23 @@ fn jucode_access_token() -> Result<String, String> {
         .map_err(|e| e.to_string())?
         .into_json()
         .map_err(|e| e.to_string())?;
-    let new_access = resp.get("access_token").and_then(|v| v.as_str()).unwrap_or("").to_string();
-    let new_refresh = resp.get("refresh_token").and_then(|v| v.as_str()).unwrap_or("").to_string();
+    let new_access = resp
+        .get("access_token")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+    let new_refresh = resp
+        .get("refresh_token")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
     if new_access.is_empty() || new_refresh.is_empty() {
         return Err("JuCode session expired; please sign in again".to_string());
     }
-    let expires_in = resp.get("expires_in").and_then(|v| v.as_u64()).unwrap_or(3600);
+    let expires_in = resp
+        .get("expires_in")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(3600);
     let refresh_expires_in = resp
         .get("refresh_expires_in")
         .and_then(|v| v.as_u64())
@@ -843,7 +892,11 @@ fn resolve_asr_config(config: &serde_json::Value) -> Result<AsrConfig, String> {
         .filter(|value| !value.is_empty())
         .unwrap_or(provider.model)
         .to_string();
-    Ok(AsrConfig { provider, base_url, model })
+    Ok(AsrConfig {
+        provider,
+        base_url,
+        model,
+    })
 }
 
 fn append_multipart_field(body: &mut Vec<u8>, boundary: &str, name: &str, value: &str) {
@@ -926,7 +979,10 @@ fn build_asr_request(
                 url: format!("{}/audio/transcriptions", config.base_url),
                 headers: vec![
                     ("Authorization", format!("Bearer {key}")),
-                    ("Content-Type", format!("multipart/form-data; boundary={boundary}")),
+                    (
+                        "Content-Type",
+                        format!("multipart/form-data; boundary={boundary}"),
+                    ),
                 ],
                 body,
             })
@@ -995,10 +1051,12 @@ fn transcribe_audio(
         .and_then(|value| value.as_str())
         .map(|value| value.trim().to_string())
         .filter(|value| !value.is_empty())
-        .ok_or_else(|| format!(
-            "No API key configured for {} (Settings → Account → Speech recognition)",
-            config.provider.name
-        ))?;
+        .ok_or_else(|| {
+            format!(
+                "No API key configured for {} (Settings → Account → Speech recognition)",
+                config.provider.name
+            )
+        })?;
     let audio = base64::engine::general_purpose::STANDARD
         .decode(audio_base64)
         .map_err(|error| format!("Invalid base64 audio: {error}"))?;
@@ -1093,8 +1151,8 @@ fn generate_text(
         ],
         "temperature": 0.3,
     });
-    let mut req = ureq::post(&format!("{base}/chat/completions"))
-        .timeout(std::time::Duration::from_secs(90));
+    let mut req =
+        ureq::post(&format!("{base}/chat/completions")).timeout(std::time::Duration::from_secs(90));
     if !key.is_empty() {
         req = req.set("Authorization", &format!("Bearer {key}"));
     }
@@ -1335,7 +1393,9 @@ fn check_environment() -> EnvReport {
     };
     let engine = DepStatus {
         present: engine_path.is_some(),
-        detail: engine_path.map(|p| p.display().to_string()).unwrap_or_default(),
+        detail: engine_path
+            .map(|p| p.display().to_string())
+            .unwrap_or_default(),
     };
 
     EnvReport {
@@ -1550,9 +1610,7 @@ fn run_install(name: String, app: AppHandle) -> Result<InstallStart, String> {
     let (program, args) = match plan {
         installer::Plan::Manual { command } => return Ok(InstallStart::ManualCommand { command }),
         installer::Plan::OpenUrl { url } => return Ok(InstallStart::OpenUrl { url }),
-        installer::Plan::NeedsPrereq { prereq } => {
-            return Ok(InstallStart::NeedsPrereq { prereq })
-        }
+        installer::Plan::NeedsPrereq { prereq } => return Ok(InstallStart::NeedsPrereq { prereq }),
         installer::Plan::Run { program, args } => (program, args),
     };
     // Resolve the logical program name through PATH (e.g. `npm` → `npm.cmd`).
@@ -1616,7 +1674,11 @@ fn list_dir(path: Option<String>, root: Option<String>) -> Result<Vec<FsEntry>,
             is_dir,
         });
     }
-    entries.sort_by(|a, b| b.is_dir.cmp(&a.is_dir).then(a.name.to_lowercase().cmp(&b.name.to_lowercase())));
+    entries.sort_by(|a, b| {
+        b.is_dir
+            .cmp(&a.is_dir)
+            .then(a.name.to_lowercase().cmp(&b.name.to_lowercase()))
+    });
     Ok(entries)
 }
 
@@ -1625,10 +1687,7 @@ fn list_dir(path: Option<String>, root: Option<String>) -> Result<Vec<FsEntry>,
 fn list_providers() -> Result<serde_json::Value, String> {
     let mut cmd = Command::new(resolve_bin());
     no_window(&mut cmd);
-    let out = cmd
-        .arg("providers")
-        .output()
-        .map_err(|e| e.to_string())?;
+    let out = cmd.arg("providers").output().map_err(|e| e.to_string())?;
     if !out.status.success() {
         return Err(String::from_utf8_lossy(&out.stderr).to_string());
     }
@@ -1877,7 +1936,10 @@ fn git_head_text(path: String, cwd: Option<String>) -> Result<String, String> {
         return Err(String::from_utf8_lossy(&out.stderr).into_owned());
     }
     if out.stdout.len() as u64 > MAX_TEXT_READ {
-        return Err(format!("file too large to diff ({} bytes)", out.stdout.len()));
+        return Err(format!(
+            "file too large to diff ({} bytes)",
+            out.stdout.len()
+        ));
     }
     String::from_utf8(out.stdout).map_err(|_| "not a UTF-8 text file".to_string())
 }
@@ -1887,9 +1949,27 @@ fn git_head_text(path: String, cwd: Option<String>) -> Result<String, String> {
 /// argument-validated set of remote operations (fetch / pull / push / remote -v).
 /// Anything that can run arbitrary programs is intentionally excluded.
 const GIT_SUBCOMMANDS: &[&str] = &[
-    "status", "log", "diff", "add", "reset", "restore", "commit", "stash", "show",
-    "rev-parse", "branch", "checkout", "switch", "ls-files", "clean", "fetch", "pull",
-    "push", "remote", "merge", "rev-list",
+    "status",
+    "log",
+    "diff",
+    "add",
+    "reset",
+    "restore",
+    "commit",
+    "stash",
+    "show",
+    "rev-parse",
+    "branch",
+    "checkout",
+    "switch",
+    "ls-files",
+    "clean",
+    "fetch",
+    "pull",
+    "push",
+    "remote",
+    "merge",
+    "rev-list",
 ];
 
 /// 需要访问网络的子命令：禁用凭据交互提示、限时执行（防止卡在等待输入上）。
@@ -1935,16 +2015,52 @@ fn is_valid_ref_name(s: &str) -> bool {
 fn git_flag_allowed(sub: &str, arg: &str) -> bool {
     let base = arg.split_once('=').map(|(k, _)| k).unwrap_or(arg);
     let allowed: &[&str] = match sub {
-        "status" => &["--porcelain", "-s", "-b", "-sb", "--short", "--branch", "--no-color"],
-        "log" => &["--oneline", "-n", "-1", "--no-color", "--pretty", "--format", "--max-count"],
-        "diff" => &["--cached", "--staged", "--no-color", "--stat", "--numstat", "--name-only"],
+        "status" => &[
+            "--porcelain",
+            "-s",
+            "-b",
+            "-sb",
+            "--short",
+            "--branch",
+            "--no-color",
+        ],
+        "log" => &[
+            "--oneline",
+            "-n",
+            "-1",
+            "--no-color",
+            "--pretty",
+            "--format",
+            "--max-count",
+        ],
+        "diff" => &[
+            "--cached",
+            "--staged",
+            "--no-color",
+            "--stat",
+            "--numstat",
+            "--name-only",
+        ],
         "add" => &["-A", "--all"],
         "restore" => &["--staged", "--worktree"],
         "commit" => &["-m"],
         "stash" => &["-m", "-u", "--include-untracked"],
         "show" => &["--no-color", "--stat", "--pretty", "--format", "-s"],
-        "rev-parse" => &["--abbrev-ref", "--symbolic-full-name", "--short", "--verify"],
-        "branch" => &["--show-current", "--format", "--list", "--no-color", "-d", "-D", "--delete"],
+        "rev-parse" => &[
+            "--abbrev-ref",
+            "--symbolic-full-name",
+            "--short",
+            "--verify",
+        ],
+        "branch" => &[
+            "--show-current",
+            "--format",
+            "--list",
+            "--no-color",
+            "-d",
+            "-D",
+            "--delete",
+        ],
         "checkout" => &["-b"],
         // 注意：不放行 `-c`（与全局禁用的 config 短参撞名），创建分支用
         // `switch --create` 或 `checkout -b`。
@@ -2222,7 +2338,7 @@ fn worktree_base(cwd: String) -> Result<String, String> {
 /// Runs a spawned command to completion with a hard deadline: stdout/stderr are
 /// drained on threads, and the child is killed if it outlives `timeout` (e.g. a
 /// remote op stuck on the network even with prompts disabled).
-fn run_with_timeout(
+pub(crate) fn run_with_timeout(
     mut cmd: Command,
     timeout: std::time::Duration,
 ) -> Result<std::process::Output, String> {
@@ -2262,7 +2378,11 @@ fn run_with_timeout(
     };
     let stdout = out_thread.join().unwrap_or_default();
     let stderr = err_thread.join().unwrap_or_default();
-    Ok(std::process::Output { status, stdout, stderr })
+    Ok(std::process::Output {
+        status,
+        stdout,
+        stderr,
+    })
 }
 
 /// Runs a git command in the project root and returns stdout (or stderr on failure).
@@ -2293,7 +2413,8 @@ fn git(args: Vec<String>, cwd: Option<String>) -> Result<String, String> {
     let output = if is_remote {
         run_with_timeout(cmd, REMOTE_OP_TIMEOUT)?
     } else {
-        cmd.output().map_err(|e| format!("failed to run git: {e}"))?
+        cmd.output()
+            .map_err(|e| format!("failed to run git: {e}"))?
     };
     if output.status.success() {
         Ok(String::from_utf8_lossy(&output.stdout).into_owned())
@@ -2363,7 +2484,11 @@ fn git_checkpoint_capture(cwd: String) -> Result<String, String> {
             &["commit-tree", &tree, "-p", &head, "-m", "jucode-checkpoint"],
         )?
     } else {
-        git_plumb(&dir, None, &["commit-tree", &tree, "-m", "jucode-checkpoint"])?
+        git_plumb(
+            &dir,
+            None,
+            &["commit-tree", &tree, "-m", "jucode-checkpoint"],
+        )?
     };
     Ok(commit)
 }
@@ -2519,7 +2644,10 @@ fn pty_write(id: String, data: String, ptys: tauri::State<Ptys>) -> Result<(), S
         .get(&id)
         .cloned();
     let pty = pty.ok_or_else(|| "unknown terminal".to_string())?;
-    let mut writer = pty.writer.lock().map_err(|e| format!("lock poisoned: {e}"))?;
+    let mut writer = pty
+        .writer
+        .lock()
+        .map_err(|e| format!("lock poisoned: {e}"))?;
     writer.write_all(data.as_bytes()).map_err(|e| e.to_string())
 }
 
@@ -2533,7 +2661,10 @@ fn pty_resize(id: String, cols: u16, rows: u16, ptys: tauri::State<Ptys>) -> Res
         .get(&id)
         .cloned();
     let pty = pty.ok_or_else(|| "unknown terminal".to_string())?;
-    let master = pty.master.lock().map_err(|e| format!("lock poisoned: {e}"))?;
+    let master = pty
+        .master
+        .lock()
+        .map_err(|e| format!("lock poisoned: {e}"))?;
     master
         .resize(PtySize {
             rows,
@@ -2641,7 +2772,9 @@ pub fn run() {
             // 不透明、只让侧栏半透明，于是磨砂只在侧栏透出（见 app.css 的 [data-vibrancy]）。
             #[cfg(target_os = "macos")]
             if let Some(win) = app.get_webview_window("main") {
-                use window_vibrancy::{apply_vibrancy, NSVisualEffectMaterial, NSVisualEffectState};
+                use window_vibrancy::{
+                    apply_vibrancy, NSVisualEffectMaterial, NSVisualEffectState,
+                };
                 let _ = apply_vibrancy(
                     &win,
                     NSVisualEffectMaterial::Sidebar,
@@ -2659,7 +2792,8 @@ pub fn run() {
                 let _ = app.deep_link().register_all();
                 // 深链到达时先把窗口带到前台，具体路由由前端解析处理。
                 let handle = app.handle().clone();
-                app.deep_link().on_open_url(move |_| show_main_window(&handle));
+                app.deep_link()
+                    .on_open_url(move |_| show_main_window(&handle));
             }
             Ok(())
         })
@@ -2681,6 +2815,10 @@ pub fn run() {
             send_op,
             send_line,
             check_backend,
+            acp_registry::acp_agents_list,
+            acp_registry::acp_agent_upsert,
+            acp_registry::acp_agent_remove,
+            acp_registry::acp_agent_check,
             shell_env::shell_env_status,
             shell_env::refresh_shell_env,
             close_session,
@@ -2782,9 +2920,8 @@ mod tests {
         assert_eq!(mimo.provider.protocol, AsrProtocol::Mimo);
         assert_eq!(mimo.model, "mimo-v2.5-asr");
 
-        let groq = resolve_asr_config(
-            &serde_json::json!({ "asr": { "provider": "groq" } })
-        ).unwrap();
+        let groq =
+            resolve_asr_config(&serde_json::json!({ "asr": { "provider": "groq" } })).unwrap();
         assert_eq!(groq.provider.protocol, AsrProtocol::OpenAiWhisper);
         assert_eq!(groq.base_url, "https://api.groq.com/openai/v1");
         assert_eq!(groq.model, "whisper-large-v3-turbo");
@@ -2796,7 +2933,8 @@ mod tests {
                 "base_url": "https://speech.example/v1/",
                 "model": "custom-model"
             }
-        })).unwrap();
+        }))
+        .unwrap();
         assert_eq!(deepgram.provider.protocol, AsrProtocol::Deepgram);
         assert_eq!(deepgram.base_url, "https://speech.example/v1");
         assert_eq!(deepgram.model, "custom-model");
@@ -2808,43 +2946,53 @@ mod tests {
 
         let audio = b"wav bytes";
         let mimo = resolve_asr_config(&serde_json::json!({})).unwrap();
-        let request = build_asr_request(
-            &mimo, "mimo-key", audio, "audio/wav", "auto", "boundary"
-        ).unwrap();
-        assert_eq!(request.url, "https://api.xiaomimimo.com/v1/chat/completions");
-        assert!(request.headers.contains(&("api-key", "mimo-key".to_string())));
+        let request =
+            build_asr_request(&mimo, "mimo-key", audio, "audio/wav", "auto", "boundary").unwrap();
+        assert_eq!(
+            request.url,
+            "https://api.xiaomimimo.com/v1/chat/completions"
+        );
+        assert!(request
+            .headers
+            .contains(&("api-key", "mimo-key".to_string())));
         let json: serde_json::Value = serde_json::from_slice(&request.body).unwrap();
         assert_eq!(json["model"], "mimo-v2.5-asr");
         assert!(json["messages"][0]["content"][0]["input_audio"]["data"]
-            .as_str().unwrap().starts_with("data:audio/wav;base64,"));
-
-        let openai = resolve_asr_config(
-            &serde_json::json!({ "asr": { "provider": "openai" } })
-        ).unwrap();
-        let request = build_asr_request(
-            &openai, "openai-key", audio, "audio/wav", "en", "boundary"
-        ).unwrap();
-        assert_eq!(request.url, "https://api.openai.com/v1/audio/transcriptions");
-        assert!(request.headers.contains(
-            &("Authorization", "Bearer openai-key".to_string())
-        ));
+            .as_str()
+            .unwrap()
+            .starts_with("data:audio/wav;base64,"));
+
+        let openai =
+            resolve_asr_config(&serde_json::json!({ "asr": { "provider": "openai" } })).unwrap();
+        let request =
+            build_asr_request(&openai, "openai-key", audio, "audio/wav", "en", "boundary").unwrap();
+        assert_eq!(
+            request.url,
+            "https://api.openai.com/v1/audio/transcriptions"
+        );
+        assert!(request
+            .headers
+            .contains(&("Authorization", "Bearer openai-key".to_string())));
         let body = String::from_utf8_lossy(&request.body);
         assert!(body.contains("name=\"model\"\r\n\r\nwhisper-1"));
         assert!(body.contains("name=\"language\"\r\n\r\nen"));
         assert!(body.contains("filename=\"recording.wav\""));
-        assert!(request.body.windows(audio.len()).any(|window| window == audio));
-
-        let deepgram = resolve_asr_config(
-            &serde_json::json!({ "asr": { "provider": "deepgram" } })
-        ).unwrap();
-        let request = build_asr_request(
-            &deepgram, "dg-key", audio, "audio/wav", "zh", "boundary"
-        ).unwrap();
+        assert!(request
+            .body
+            .windows(audio.len())
+            .any(|window| window == audio));
+
+        let deepgram =
+            resolve_asr_config(&serde_json::json!({ "asr": { "provider": "deepgram" } })).unwrap();
+        let request =
+            build_asr_request(&deepgram, "dg-key", audio, "audio/wav", "zh", "boundary").unwrap();
         assert_eq!(
             request.url,
             "https://api.deepgram.com/v1/listen?model=nova-3&smart_format=true&language=zh"
         );
-        assert!(request.headers.contains(&("Authorization", "Token dg-key".to_string())));
+        assert!(request
+            .headers
+            .contains(&("Authorization", "Token dg-key".to_string())));
         assert_eq!(request.body, audio);
     }
 
@@ -2935,8 +3083,8 @@ mod tests {
 
     /// An `AuthStore` over throwaway paths, with the switch preset.
     fn auth_store(name: &str, encrypt: bool) -> (super::AuthStore, std::path::PathBuf) {
-        let dir = std::env::temp_dir()
-            .join(format!("jucode-authstore-{}-{name}", std::process::id()));
+        let dir =
+            std::env::temp_dir().join(format!("jucode-authstore-{}-{name}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
         std::fs::write(
@@ -2984,7 +3132,10 @@ mod tests {
         assert!(on_disk.contains("\"access_expires_at\": 9"), "{on_disk}");
 
         let back = store.read();
-        assert_eq!(back["providers"]["deepseek"], serde_json::json!("sk-legacy"));
+        assert_eq!(
+            back["providers"]["deepseek"],
+            serde_json::json!("sk-legacy")
+        );
         assert_eq!(back["providers"]["mimo"], serde_json::json!("sk-mimo"));
         assert_eq!(back["jucode"]["refresh_token"], serde_json::json!("rt-1"));
 
@@ -2996,7 +3147,9 @@ mod tests {
         let (store, dir) = auth_store("disable", true);
         let mut current = plaintext_auth();
         store.write(&mut current).unwrap();
-        assert!(!std::fs::read_to_string(&store.auth).unwrap().contains("sk-legacy"));
+        assert!(!std::fs::read_to_string(&store.auth)
+            .unwrap()
+            .contains("sk-legacy"));
 
         let mut current = store.read_strict().unwrap();
         std::fs::write(&store.config, r#"{"encrypt_secrets":false}"#).unwrap();
@@ -3105,7 +3258,10 @@ mod tests {
     fn windows_advice_depends_on_winget() {
         let advice = git_install_advice("windows", &avail(&["winget"]));
         assert_eq!(advice.kind, "auto");
-        assert!(advice.command.unwrap().contains("winget install --id Git.Git"));
+        assert!(advice
+            .command
+            .unwrap()
+            .contains("winget install --id Git.Git"));
         let advice = git_install_advice("windows", &avail(&[]));
         assert_eq!(advice.kind, "open-url");
         assert_eq!(advice.url, "https://git-scm.com/download/win");
@@ -3150,7 +3306,10 @@ mod tests {
             vec!["checkout", "main"],
             vec!["remote", "-v"],
         ] {
-            assert!(validate_git_args(&args(&cmd)).is_ok(), "should allow: {cmd:?}");
+            assert!(
+                validate_git_args(&args(&cmd)).is_ok(),
+                "should allow: {cmd:?}"
+            );
         }
     }
 
@@ -3162,7 +3321,10 @@ mod tests {
             vec!["push"],
             vec!["push", "-u", "origin", "feature/new-ui"],
         ] {
-            assert!(validate_git_args(&args(&cmd)).is_ok(), "should allow: {cmd:?}");
+            assert!(
+                validate_git_args(&args(&cmd)).is_ok(),
+                "should allow: {cmd:?}"
+            );
         }
     }
 
@@ -3195,7 +3357,10 @@ mod tests {
             // 远端子命令禁止 `--` 逃逸
             vec!["push", "--", "origin"],
         ] {
-            assert!(validate_git_args(&args(&cmd)).is_err(), "should reject: {cmd:?}");
+            assert!(
+                validate_git_args(&args(&cmd)).is_err(),
+                "should reject: {cmd:?}"
+            );
         }
     }
 
@@ -3267,11 +3432,8 @@ mod tests {
 
     /// Creates <tmp>/<name>/repo and returns (tmp_root, repo_root).
     fn tmp_repo(name: &str) -> (std::path::PathBuf, std::path::PathBuf) {
-        let root = std::env::temp_dir().join(format!(
-            "jucode-wt-test-{}-{}",
-            std::process::id(),
-            name
-        ));
+        let root =
+            std::env::temp_dir().join(format!("jucode-wt-test-{}-{}", std::process::id(), name));
         let repo = root.join("repo");
         let _ = std::fs::remove_dir_all(&root);
         std::fs::create_dir_all(&repo).unwrap();
@@ -3284,7 +3446,10 @@ mod tests {
         let base = worktree_base_dir(&repo).unwrap();
         assert_eq!(
             base,
-            root.canonicalize().unwrap().join(".jucode-worktrees").join("repo")
+            root.canonicalize()
+                .unwrap()
+                .join(".jucode-worktrees")
+                .join("repo")
         );
         let _ = std::fs::remove_dir_all(&root);
     }
@@ -3312,8 +3477,14 @@ mod tests {
             &repo
         )
         .is_ok());
-        assert!(validate_worktree_args(&args(&["worktree", "add", &ok, "-b", "task/my-task"]), &repo).is_ok());
-        assert!(validate_worktree_args(&args(&["worktree", "add", &ok, "task/my-task"]), &repo).is_ok());
+        assert!(validate_worktree_args(
+            &args(&["worktree", "add", &ok, "-b", "task/my-task"]),
+            &repo
+        )
+        .is_ok());
+        assert!(
+            validate_worktree_args(&args(&["worktree", "add", &ok, "task/my-task"]), &repo).is_ok()
+        );
 
         // 容器外 / 穿越 / 非法 slug / 非法分支名 / 非法 flag 一律拒绝。
         let escape = base.join("../evil").display().to_string();
@@ -3346,7 +3517,9 @@ mod tests {
         std::fs::create_dir_all(base.join("done-task")).unwrap();
         let ok = base.join("done-task").display().to_string();
         assert!(validate_worktree_args(&args(&["worktree", "remove", &ok]), &repo).is_ok());
-        assert!(validate_worktree_args(&args(&["worktree", "remove", &ok, "--force"]), &repo).is_ok());
+        assert!(
+            validate_worktree_args(&args(&["worktree", "remove", &ok, "--force"]), &repo).is_ok()
+        );
         assert!(validate_worktree_args(&args(&["worktree", "list", "--porcelain"]), &repo).is_ok());
         assert!(validate_worktree_args(&args(&["worktree", "prune"]), &repo).is_ok());
 
@@ -3386,15 +3559,26 @@ mod tests {
         assert!(in_root_or_task_container(&inside_repo, &canon_repo));
         assert!(in_root_or_task_container(&inside_container, &canon_repo));
         assert!(!in_root_or_task_container(&outside, &canon_repo));
-        assert!(!in_root_or_task_container(std::path::Path::new("/etc"), &canon_repo));
+        assert!(!in_root_or_task_container(
+            std::path::Path::new("/etc"),
+            &canon_repo
+        ));
         let _ = std::fs::remove_dir_all(&root);
     }
 
     #[test]
     fn merge_and_revlist_whitelist() {
-        assert!(validate_git_args(&args(&["merge", "--no-ff", "--no-edit", "task/fix-login"])).is_ok());
+        assert!(
+            validate_git_args(&args(&["merge", "--no-ff", "--no-edit", "task/fix-login"])).is_ok()
+        );
         assert!(validate_git_args(&args(&["merge", "--abort"])).is_ok());
-        assert!(validate_git_args(&args(&["rev-list", "--left-right", "--count", "main...task/x"])).is_ok());
+        assert!(validate_git_args(&args(&[
+            "rev-list",
+            "--left-right",
+            "--count",
+            "main...task/x"
+        ]))
+        .is_ok());
 
         assert!(validate_git_args(&args(&["merge", "--squash", "task/x"])).is_err());
         assert!(validate_git_args(&args(&["merge", "--no-ff", "-evil"])).is_err());
@@ -3402,5 +3586,4 @@ mod tests {
         // worktree 不走通用校验入口。
         assert!(validate_git_args(&args(&["worktree", "list", "--porcelain"])).is_err());
     }
-
 }
diff --git a/src-tauri/src/shell_env.rs b/src-tauri/src/shell_env.rs
index 6b55876..e42bec9 100644
--- a/src-tauri/src/shell_env.rs
+++ b/src-tauri/src/shell_env.rs
@@ -53,9 +53,7 @@ fn is_denied(name: &str) -> bool {
 /// 从捕获输出里解析 NUL 分隔的 KEY=VALUE（值可含换行）。
 /// 若整段找不到 NUL 分隔（env 不支持 -0 的降级情形），退回按行解析。
 pub(crate) fn parse_env_output(bytes: &[u8]) -> Option<HashMap<String, String>> {
-    let pos = bytes
-        .windows(MARKER.len())
-        .position(|w| w == MARKER)?;
+    let pos = bytes.windows(MARKER.len()).position(|w| w == MARKER)?;
     let rest = &bytes[pos + MARKER.len()..];
     let mut vars = parse_entries(rest.split(|b| *b == 0));
     if vars.len() <= 1 {
@@ -84,13 +82,16 @@ fn parse_entries<'a>(entries: impl Iterator<Item = &'a [u8]>) -> HashMap<String,
 }
 
 fn default_shell() -> String {
-    std::env::var("SHELL").ok().filter(|s| !s.trim().is_empty()).unwrap_or_else(|| {
-        if cfg!(target_os = "macos") {
-            "/bin/zsh".to_string()
-        } else {
-            "/bin/bash".to_string()
-        }
-    })
+    std::env::var("SHELL")
+        .ok()
+        .filter(|s| !s.trim().is_empty())
+        .unwrap_or_else(|| {
+            if cfg!(target_os = "macos") {
+                "/bin/zsh".to_string()
+            } else {
+                "/bin/bash".to_string()
+            }
+        })
 }
 
 /// 用指定 shell 捕获一次环境。测试用假 shell 脚本注入即可覆盖全链路。
@@ -178,7 +179,11 @@ pub fn status() -> ShellEnvStatus {
 
 /// 快照的 PATH（供二进制解析优先使用）。
 pub fn snapshot_path() -> Option<String> {
-    state().read().unwrap().as_ref().and_then(|e| e.vars.get("PATH").cloned())
+    state()
+        .read()
+        .unwrap()
+        .as_ref()
+        .and_then(|e| e.vars.get("PATH").cloned())
 }
 
 /// 在不清空现有环境的前提下合并快照（git/gh 这类命令用：既要终端 PATH/
@@ -304,7 +309,10 @@ mod tests {
         std::fs::set_permissions(&fake, std::fs::Permissions::from_mode(0o755)).unwrap();
 
         let env = capture_with(fake.to_str().unwrap()).expect("capture should succeed");
-        assert_eq!(env.vars.get("SNAP_TEST_VAR").map(String::as_str), Some("hello"));
+        assert_eq!(
+            env.vars.get("SNAP_TEST_VAR").map(String::as_str),
+            Some("hello")
+        );
         assert!(env.vars.contains_key("PATH"));
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -336,7 +344,12 @@ mod tests {
         );
         let envs: HashMap<_, _> = cmd
             .get_envs()
-            .filter_map(|(k, v)| Some((k.to_string_lossy().to_string(), v?.to_string_lossy().to_string())))
+            .filter_map(|(k, v)| {
+                Some((
+                    k.to_string_lossy().to_string(),
+                    v?.to_string_lossy().to_string(),
+                ))
+            })
             .collect();
         assert_eq!(envs["PATH"], "/snap/bin");
         assert_eq!(envs["SHARED"], "from-custom");
diff --git a/src/lib/BackendIcon.svelte b/src/lib/BackendIcon.svelte
index d141af3..238f472 100644
--- a/src/lib/BackendIcon.svelte
+++ b/src/lib/BackendIcon.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
-	// Engine-backend mark: vendor SVGs for codex (OpenAI) / claude, and the
-	// JuCode wordmark initial for the native engine.
+	// Engine-backend mark: vendor SVGs for codex (OpenAI) / claude, a generic
+	// plug for ACP agents, and the JuCode wordmark initial for the native engine.
 	import openai from '@lobehub/icons-static-svg/icons/openai.svg?raw';
 	import claude from '@lobehub/icons-static-svg/icons/claude.svg?raw';
+	import { Plug } from 'lucide-svelte';
 	import type { BackendId } from '$lib/backends';
 
 	let { backend, size = 14 }: { backend: BackendId; size?: number } = $props();
@@ -12,6 +13,8 @@
 	<span class="mark" style:font-size="{size}px" aria-hidden="true">{@html openai}</span>
 {:else if backend === 'claude'}
 	<span class="mark claude" style:font-size="{size}px" aria-hidden="true">{@html claude}</span>
+{:else if backend === 'acp'}
+	<span class="mark acp" style:font-size="{size}px" aria-hidden="true"><Plug size={size} /></span>
 {:else}
 	<span class="mark ju" style:font-size="{size}px" style:width="{size}px" style:height="{size}px" aria-hidden="true">Ju</span>
 {/if}
@@ -28,6 +31,9 @@
 	.mark.claude {
 		color: #d97757;
 	}
+	.mark.acp {
+		color: var(--dim);
+	}
 	.mark :global(svg) {
 		width: 1em;
 		height: 1em;
diff --git a/src/lib/Composer.svelte b/src/lib/Composer.svelte
index 969ba70..98672bc 100644
--- a/src/lib/Composer.svelte
+++ b/src/lib/Composer.svelte
@@ -6,7 +6,7 @@
 	import BackendIcon from '$lib/BackendIcon.svelte';
 	import Segmented from '$lib/ui/Segmented.svelte';
 	import EffortSlider from '$lib/ui/EffortSlider.svelte';
-	import { checkBackend, listFiles, saveTempImage, transcribeAudio } from '$lib/protocol';
+	import { acpAgentsList, checkBackend, listFiles, saveTempImage, transcribeAudio, type AcpAgent } from '$lib/protocol';
 	import { VoiceRecorder } from '$lib/audio';
 	import { buildEntries, mentionMatches, type AtEntry } from '$lib/mention';
 	import { t } from '$lib/i18n';
@@ -17,7 +17,7 @@
 	import Picker from '$lib/shell/Picker.svelte';
 	import type { ChatState } from '$lib/chat.svelte';
 	import type { ApprovalMode } from '$lib/approval';
-	import { caps, BACKEND_IDS, BACKEND_LABELS, type BackendId } from '$lib/backends';
+	import { caps, NATIVE_BACKEND_IDS, BACKEND_LABELS, type BackendId } from '$lib/backends';
 	import { loadBackendSettings, versionLabel } from '$lib/backends/settings';
 
 	type PickerRow = {
@@ -73,7 +73,7 @@
 		/** False only while the session is still virgin (no user turn) — the
 		 *  backend selector is interactive then and a fixed label afterwards. */
 		backendLocked?: boolean;
-		onBackend?: (b: BackendId) => void;
+		onBackend?: (b: BackendId, acpAgent?: { id: string; name: string }) => void;
 		onSubmit: () => void;
 		onStop: () => void;
 		onSteer: () => void;
@@ -96,22 +96,37 @@
 	// Availability is probed best-effort on first open, same as the old modal.
 	let showBackend = $state(false);
 	let backendProbe = $state<Partial<Record<BackendId, { found: boolean; version: string }>>>({});
+	// Registered ACP agents (one picker row each, below the native engines).
+	let acpAgents = $state<AcpAgent[]>([]);
 	let probed = false;
 	function toggleBackend() {
 		showBackend = !showBackend;
 		if (!showBackend || probed) return;
 		probed = true;
 		const settings = loadBackendSettings();
-		for (const id of BACKEND_IDS) {
+		for (const id of NATIVE_BACKEND_IDS) {
 			checkBackend(id, settings.paths[id])
 				.then((s) => (backendProbe[id] = { found: s.found, version: versionLabel(s) }))
 				.catch(() => {});
 		}
+		acpAgentsList()
+			.then((agents) => (acpAgents = agents))
+			.catch(() => {});
 	}
 	function pickBackend(id: BackendId) {
 		showBackend = false;
 		if (id !== chat.backendId) onBackend?.(id);
 	}
+	function pickAcpAgent(agent: AcpAgent) {
+		showBackend = false;
+		if (chat.backendId !== 'acp' || chat.acpAgentId !== agent.id)
+			onBackend?.('acp', { id: agent.id, name: agent.name });
+	}
+	// The label on the backend button: the ACP agent's registered name when an
+	// ACP agent drives the session, else the engine's brand name.
+	const backendLabel = $derived(
+		chat.backendId === 'acp' ? chat.acpAgentName || BACKEND_LABELS.acp : BACKEND_LABELS[chat.backendId]
+	);
 
 	// Capability gating for the session's engine backend (jucode = everything).
 	const bcaps = $derived(caps(chat));
@@ -552,17 +567,17 @@
 			<div class="effortsel">
 				{#if backendLocked}
 					<span class="flatbtn bkd static" title={t('chat.backendLocked')}>
-						<BackendIcon backend={chat.backendId} size={14} /><span>{BACKEND_LABELS[chat.backendId]}</span>
+						<BackendIcon backend={chat.backendId} size={14} /><span>{backendLabel}</span>
 					</span>
 				{:else}
 					<button class="flatbtn bkd" onclick={toggleBackend} title={t('chat.switchBackend')}>
-						<BackendIcon backend={chat.backendId} size={14} /><span>{BACKEND_LABELS[chat.backendId]}</span>
+						<BackendIcon backend={chat.backendId} size={14} /><span>{backendLabel}</span>
 						<span class="bkd-chev"><ChevronDown size={12} /></span>
 					</button>
 					{#if showBackend}
 						<button class="pop-backdrop" aria-label="close" onclick={() => (showBackend = false)}></button>
 						<div class="effort-pop bkd-pop">
-							{#each BACKEND_IDS as id (id)}
+							{#each NATIVE_BACKEND_IDS as id (id)}
 								{@const probe = backendProbe[id]}
 								<button class="bkd-row" class:on={id === chat.backendId} onclick={() => pickBackend(id)}>
 									<BackendIcon backend={id} size={14} />
@@ -575,6 +590,18 @@
 									{#if id === chat.backendId}<span class="bkd-check"><Check size={13} /></span>{/if}
 								</button>
 							{/each}
+							{#if acpAgents.length}
+								<div class="bkd-sep">{t('chat.acpAgents')}</div>
+								{#each acpAgents as agent (agent.id)}
+									{@const on = chat.backendId === 'acp' && chat.acpAgentId === agent.id}
+									<button class="bkd-row" class:on onclick={() => pickAcpAgent(agent)}>
+										<BackendIcon backend="acp" size={14} />
+										<span class="bkd-name">{agent.name}</span>
+										<span class="bkd-ver">{agent.command}</span>
+										{#if on}<span class="bkd-check"><Check size={13} /></span>{/if}
+									</button>
+								{/each}
+							{/if}
 						</div>
 					{/if}
 				{/if}
@@ -796,6 +823,17 @@
 		color: var(--accent-bright);
 		flex-shrink: 0;
 	}
+	/* Section divider between the native engines and the ACP agent rows. */
+	.bkd-sep {
+		margin-top: 4px;
+		padding: 5px 9px 2px;
+		border-top: 1px solid var(--hairline);
+		font-size: 10px;
+		font-weight: 600;
+		letter-spacing: 0.05em;
+		text-transform: uppercase;
+		color: var(--dim2);
+	}
 	/* read-only model label for backends without an in-chat model picker */
 	.flatbtn.static {
 		cursor: default;
diff --git a/src/lib/Settings.svelte b/src/lib/Settings.svelte
index fd63084..8dd417a 100644
--- a/src/lib/Settings.svelte
+++ b/src/lib/Settings.svelte
@@ -7,6 +7,7 @@
 	import { prefs, vibrancySupported } from '$lib/prefs.svelte';
 	import { themeState, setTheme, type ThemePref } from '$lib/theme.svelte';
 	import BackendSection from '$lib/settings/BackendSection.svelte';
+	import AcpSection from '$lib/settings/AcpSection.svelte';
 	import Dependencies from '$lib/Dependencies.svelte';
 	import type { ChatState } from '$lib/chat.svelte';
 	import Vendor from '$lib/Vendor.svelte';
@@ -517,6 +518,8 @@
 
 					<BackendSection />
 
+					<AcpSection />
+
 					<div class="group">
 						<div class="glabel">{t('settings.behavior.defaultModel')}</div>
 						<Select bind:value={modelKey} onChange={applyModel} options={allModelOpts} placeholder={t('settings.behavior.selectModel')}>
diff --git a/src/lib/backends/README.md b/src/lib/backends/README.md
index e210ef4..d2d7dd2 100644
--- a/src/lib/backends/README.md
+++ b/src/lib/backends/README.md
@@ -7,6 +7,7 @@ The desktop drives three agent backends through one abstraction:
 | `jucode` | `jucode serve` (env `JUCODE_DESKTOP=1`)                                       | jucode Ops (JSON lines) | jucode AgentEvents   |
 | `codex`  | `codex app-server`                                                            | JSON-RPC requests       | JSON-RPC responses/notifications |
 | `claude` | `claude --print --input-format stream-json --output-format stream-json --include-partial-messages --verbose --replay-user-messages --permission-prompt-tool stdio [--permission-mode m] [--resume sid \| --session-id uuid] [--model m]` | stream-json + control frames | stream-json events |
+| `acp`    | any registered ACP agent (`jucode acp`, `gemini --experimental-acp`, …) — command/args/env from the Rust-side registry, see `docs/acp.md` | JSON-RPC 2.0 requests/responses | JSON-RPC responses/notifications |
 
 `ChatState` (the reducer behind the whole chat UI) only understands the jucode
 event dialect. Adapters translate INTO that dialect and encode OUT of the
@@ -16,7 +17,7 @@ desktop `Op` union — ChatState and the UI stay backend-agnostic.
 
 ```ts
 interface EngineAdapter {
-  readonly id: BackendId;          // 'jucode' | 'codex' | 'claude'
+  readonly id: BackendId;          // 'jucode' | 'codex' | 'claude' | 'acp'
   readonly caps: BackendCaps;      // static capability flags, see below
   onStart(io: AdapterIO, ctx: SessionCtx): void;
   translate(raw: unknown): NormalizedEvent[];   // NormalizedEvent = jucode AgentEvent
diff --git a/src/lib/backends/acp-agents.test.ts b/src/lib/backends/acp-agents.test.ts
new file mode 100644
index 0000000..e81bb9b
--- /dev/null
+++ b/src/lib/backends/acp-agents.test.ts
@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest';
+import { tokenizeArgs, formatArgs, slugifyAgentId } from './acp-agents';
+
+describe('tokenizeArgs', () => {
+	it('splits on whitespace and honors quotes', () => {
+		expect(tokenizeArgs('--experimental-acp')).toEqual(['--experimental-acp']);
+		expect(tokenizeArgs('acp  --verbose')).toEqual(['acp', '--verbose']);
+		expect(tokenizeArgs('--flag "a b" \'c d\'')).toEqual(['--flag', 'a b', 'c d']);
+		expect(tokenizeArgs('')).toEqual([]);
+		expect(tokenizeArgs('   ')).toEqual([]);
+	});
+
+	it('round-trips through formatArgs', () => {
+		const args = ['acp', '--model', 'gemini 3 pro'];
+		expect(tokenizeArgs(formatArgs(args))).toEqual(args);
+		expect(formatArgs(args)).toBe('acp --model "gemini 3 pro"');
+	});
+});
+
+describe('slugifyAgentId', () => {
+	it('lowercases, strips punctuation and never returns empty', () => {
+		expect(slugifyAgentId('Gemini CLI')).toBe('gemini-cli');
+		expect(slugifyAgentId('  JuCode (ACP)!  ')).toBe('jucode-acp');
+		expect(slugifyAgentId('日本語')).toBe('agent');
+	});
+
+	it('deduplicates against taken ids with a numeric suffix', () => {
+		const taken = new Set(['gemini-cli', 'gemini-cli-2']);
+		expect(slugifyAgentId('Gemini CLI', taken)).toBe('gemini-cli-3');
+	});
+});
diff --git a/src/lib/backends/acp-agents.ts b/src/lib/backends/acp-agents.ts
new file mode 100644
index 0000000..67ef401
--- /dev/null
+++ b/src/lib/backends/acp-agents.ts
@@ -0,0 +1,51 @@
+// Pure helpers for the ACP agent settings UI (kept DOM-free for unit tests).
+// The registry itself lives Rust-side (acp_registry.rs) — these only shape
+// the form fields.
+
+/** Splits an argument line into argv entries, honoring single/double quotes
+ *  (`--flag "a b"` → ['--flag', 'a b']). No escapes, no expansion — this is a
+ *  form-field convenience, not a shell. */
+export function tokenizeArgs(line: string): string[] {
+	const out: string[] = [];
+	let cur = '';
+	let quote: '"' | "'" | null = null;
+	let started = false;
+	for (const ch of line) {
+		if (quote) {
+			if (ch === quote) quote = null;
+			else cur += ch;
+		} else if (ch === '"' || ch === "'") {
+			quote = ch;
+			started = true;
+		} else if (ch === ' ' || ch === '\t') {
+			if (started || cur) out.push(cur);
+			cur = '';
+			started = false;
+		} else {
+			cur += ch;
+		}
+	}
+	if (started || cur) out.push(cur);
+	return out.filter((a) => a.length > 0);
+}
+
+/** argv entries → an editable argument line (quotes entries with spaces). */
+export function formatArgs(args: string[]): string {
+	return args.map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(' ');
+}
+
+/** A registry id from a display name: lowercase slug, deduplicated against
+ *  `taken` with a numeric suffix. */
+export function slugifyAgentId(name: string, taken: Set<string> = new Set()): string {
+	const base =
+		name
+			.toLowerCase()
+			.replace(/[^a-z0-9]+/g, '-')
+			.replace(/^-+|-+$/g, '')
+			.slice(0, 48) || 'agent';
+	if (!taken.has(base)) return base;
+	for (let n = 2; ; n++) {
+		const candidate = `${base}-${n}`;
+		if (!taken.has(candidate)) return candidate;
+	}
+}
diff --git a/src/lib/backends/acp-types.ts b/src/lib/backends/acp-types.ts
new file mode 100644
index 0000000..64286ea
--- /dev/null
+++ b/src/lib/backends/acp-types.ts
@@ -0,0 +1,143 @@
+// Wire types for the Agent Client Protocol (ACP) v1, JSON-RPC 2.0 over stdio
+// lines — the subset the desktop's client-side adapter actually touches.
+// Hand-written (like codex-types.ts) so the webview bundle stays free of the
+// official SDK; shapes follow https://agentclientprotocol.com/protocol/schema.
+
+export type RequestId = number | string;
+
+export interface JsonRpcErrorShape {
+	code: number;
+	message: string;
+	data?: unknown;
+}
+
+// --- initialize ------------------------------------------------------------
+
+export interface AcpPromptCapabilities {
+	image?: boolean;
+	audio?: boolean;
+	embeddedContext?: boolean;
+}
+
+export interface AcpAgentCapabilities {
+	loadSession?: boolean;
+	promptCapabilities?: AcpPromptCapabilities;
+}
+
+export interface InitializeResponse {
+	protocolVersion?: number;
+	agentCapabilities?: AcpAgentCapabilities;
+	authMethods?: { id?: string; name?: string; description?: string }[];
+}
+
+// --- session/new -----------------------------------------------------------
+
+export interface AcpModelInfo {
+	modelId?: string;
+	name?: string;
+	description?: string;
+}
+
+export interface NewSessionResponse {
+	sessionId?: string;
+	/** Optional session-mode state (agent-defined mode ids). */
+	modes?: {
+		currentModeId?: string;
+		availableModes?: { id?: string; name?: string }[];
+	};
+	/** Optional model state (newer spec revisions). */
+	models?: {
+		currentModelId?: string;
+		availableModels?: AcpModelInfo[];
+	};
+}
+
+// --- content blocks ---------------------------------------------------------
+
+export interface AcpContentBlock {
+	type?: string; // text | image | audio | resource_link | resource
+	text?: string;
+	data?: string;
+	mimeType?: string;
+	uri?: string;
+	resource?: { uri?: string; text?: string };
+}
+
+// --- session/update ---------------------------------------------------------
+
+export type AcpToolCallStatus = 'pending' | 'in_progress' | 'completed' | 'failed';
+
+export interface AcpToolCallContent {
+	type?: string; // content | diff | terminal
+	content?: AcpContentBlock;
+	path?: string;
+	oldText?: string | null;
+	newText?: string;
+	terminalId?: string;
+}
+
+export interface AcpToolCallLocation {
+	path?: string;
+	line?: number;
+}
+
+export interface AcpSessionUpdate {
+	sessionUpdate?: string;
+	// *_message_chunk / agent_thought_chunk
+	content?: AcpContentBlock;
+	// tool_call / tool_call_update
+	toolCallId?: string;
+	title?: string;
+	kind?: string; // read|edit|delete|move|search|execute|think|fetch|switch_mode|other
+	status?: AcpToolCallStatus;
+	locations?: AcpToolCallLocation[];
+	rawInput?: unknown;
+	rawOutput?: unknown;
+	// tool content items ride a different field name than message chunks
+	// (both are called `content` in the spec; tool calls carry an array).
+	// plan
+	entries?: { content?: string; priority?: string; status?: string }[];
+	// available_commands_update
+	availableCommands?: { name?: string; description?: string }[];
+	// current_mode_update
+	currentModeId?: string;
+}
+
+export interface SessionUpdateParams {
+	sessionId?: string;
+	update?: AcpSessionUpdate & { content?: AcpContentBlock | AcpToolCallContent[] };
+}
+
+// --- session/prompt ----------------------------------------------------------
+
+export type AcpStopReason =
+	| 'end_turn'
+	| 'max_tokens'
+	| 'max_turn_requests'
+	| 'refusal'
+	| 'cancelled';
+
+export interface PromptResponse {
+	stopReason?: AcpStopReason | string;
+}
+
+// --- session/request_permission ----------------------------------------------
+
+export interface AcpPermissionOption {
+	optionId?: string;
+	name?: string;
+	kind?: string; // allow_once | allow_always | reject_once | reject_always
+}
+
+export interface RequestPermissionParams {
+	sessionId?: string;
+	toolCall?: {
+		toolCallId?: string;
+		title?: string;
+		kind?: string;
+		status?: string;
+		content?: AcpToolCallContent[];
+		locations?: AcpToolCallLocation[];
+	};
+	options?: AcpPermissionOption[];
+}
diff --git a/src/lib/backends/acp.test.ts b/src/lib/backends/acp.test.ts
new file mode 100644
index 0000000..5ce22f8
--- /dev/null
+++ b/src/lib/backends/acp.test.ts
@@ -0,0 +1,543 @@
+import { describe, it, expect } from 'vitest';
+import { createAcpAdapter, ACP_CAPS, ACP_PROTOCOL_VERSION, imageMime, diffText } from './acp';
+import type { EngineAdapter, SessionCtx } from './types';
+
+// Fake agent frames modeled on ACP v1 (agentclientprotocol.com) as spoken by
+// `jucode acp` and gemini-cli --experimental-acp: initialize → session/new →
+// session/prompt, session/update notifications, session/request_permission
+// server→client requests.
+
+const CTX: SessionCtx = { cwd: '/proj', approvalMode: 'ask', sessionId: 'desktop-1' };
+
+const parse = (line: string) => JSON.parse(line) as Record<string, any>;
+
+function makeAdapter(ctx: SessionCtx = CTX) {
+	const lines: string[] = [];
+	const adapter = createAcpAdapter();
+	adapter.onStart({ sendLine: (l: string) => lines.push(l) }, ctx);
+	return { adapter, lines };
+}
+
+/** Drives initialize + session/new to completion. Returns the events emitted
+ *  by the session/new response. */
+function handshake(
+	adapter: EngineAdapter,
+	opts: { image?: boolean; models?: Record<string, any> } = {}
+) {
+	adapter.translate({
+		jsonrpc: '2.0',
+		id: 1,
+		result: {
+			protocolVersion: 1,
+			agentCapabilities: { loadSession: false, promptCapabilities: { image: opts.image ?? false } }
+		}
+	});
+	return adapter.translate({
+		jsonrpc: '2.0',
+		id: 2,
+		result: { sessionId: 'agent-sess-1', ...(opts.models ? { models: opts.models } : {}) }
+	});
+}
+
+describe('acp adapter: caps', () => {
+	it('advertises the conservative cap set', () => {
+		const adapter = createAcpAdapter();
+		expect(adapter.id).toBe('acp');
+		expect(adapter.caps).toEqual(ACP_CAPS);
+		// The only proven mappings: session/cancel and plan rendering data.
+		expect(adapter.caps.interrupt).toBe(true);
+		// Everything without a provable ACP mapping stays off.
+		expect(adapter.caps.approvalModes).toBe(false);
+		expect(adapter.caps.hunkApproval).toBe(false);
+		expect(adapter.caps.steer).toBe(false);
+		expect(adapter.caps.modelPicker).toBe(false);
+		expect(adapter.caps.resume).toBe(false);
+		expect(adapter.caps.skills).toBe(false);
+		expect(adapter.caps.mcpManage).toBe(false);
+		expect(adapter.caps.checkpoints).toBe(false);
+		expect(adapter.caps.branchTree).toBe(false);
+		expect(adapter.caps.contextUsage).toBe(false);
+		expect(adapter.caps.slashCommands).toBe(false);
+	});
+});
+
+describe('acp adapter: handshake', () => {
+	it('onStart sends initialize with protocol v1 and no client fs/terminal', () => {
+		const { lines } = makeAdapter();
+		expect(lines).toHaveLength(1);
+		expect(parse(lines[0])).toEqual({
+			jsonrpc: '2.0',
+			id: 1,
+			method: 'initialize',
+			params: {
+				protocolVersion: ACP_PROTOCOL_VERSION,
+				clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false }
+			}
+		});
+	});
+
+	it('initialize response triggers session/new with the project cwd', () => {
+		const { adapter, lines } = makeAdapter();
+		adapter.translate({ jsonrpc: '2.0', id: 1, result: { protocolVersion: 1 } });
+		expect(parse(lines[1])).toMatchObject({
+			id: 2,
+			method: 'session/new',
+			params: { cwd: '/proj', mcpServers: [] }
+		});
+	});
+
+	it('session/new marks the session ready and NOT resumable (empty session_id)', () => {
+		const { adapter } = makeAdapter();
+		const events = handshake(adapter);
+		expect(events[0]).toMatchObject({ type: 'startup', session_id: '', cwd: '/proj' });
+		expect(events.at(-1)).toEqual({ type: 'status', message: 'ready' });
+	});
+
+	it('surfaces the agent model when session/new reports one', () => {
+		const { adapter } = makeAdapter();
+		const events = handshake(adapter, {
+			models: {
+				currentModelId: 'g-3',
+				availableModels: [{ modelId: 'g-3', name: 'Gemini 3 Pro' }]
+			}
+		});
+		expect(events[0]).toMatchObject({ type: 'startup', model: 'Gemini 3 Pro' });
+		expect(events[1]).toMatchObject({ type: 'model_status', model: 'Gemini 3 Pro', provider: 'acp' });
+	});
+
+	it('a failed initialize / session/new reports the error and stays ready', () => {
+		const { adapter } = makeAdapter();
+		const events = adapter.translate({
+			jsonrpc: '2.0',
+			id: 1,
+			error: { code: -32000, message: 'agent not authenticated' }
+		});
+		expect(events[0]).toMatchObject({ type: 'error', message: '[acp] agent not authenticated' });
+		expect(events[1]).toEqual({ type: 'status', message: 'ready' });
+	});
+});
+
+describe('acp adapter: prompt turns', () => {
+	it('user_message becomes one session/prompt with a text block', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const frames = adapter.encodeOp({ op: 'user_message', content: 'hello agent' });
+		expect(frames).toHaveLength(1);
+		expect(parse(frames![0])).toMatchObject({
+			method: 'session/prompt',
+			params: { sessionId: 'agent-sess-1', prompt: [{ type: 'text', text: 'hello agent' }] }
+		});
+	});
+
+	it('flips busy on the first agent frame after a prompt (no turn-started in ACP)', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		adapter.encodeOp({ op: 'user_message', content: 'hi' });
+		const first = adapter.translate({
+			jsonrpc: '2.0',
+			method: 'session/update',
+			params: {
+				sessionId: 'agent-sess-1',
+				update: { sessionUpdate: 'agent_message_chunk', content: { type: 'text', text: 'Hey' } }
+			}
+		});
+		expect(first[0]).toEqual({ type: 'connecting' });
+		expect(first[1]).toEqual({ type: 'assistant_delta', delta: 'Hey' });
+		// Busy is announced once per turn only.
+		const second = adapter.translate({
+			jsonrpc: '2.0',
+			method: 'session/update',
+			params: {
+				sessionId: 'agent-sess-1',
+				update: { sessionUpdate: 'agent_message_chunk', content: { type: 'text', text: '!' } }
+			}
+		});
+		expect(second).toEqual([{ type: 'assistant_delta', delta: '!' }]);
+	});
+
+	it('maps thought chunks to reasoning deltas', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const events = adapter.translate({
+			jsonrpc: '2.0',
+			method: 'session/update',
+			params: {
+				sessionId: 'agent-sess-1',
+				update: { sessionUpdate: 'agent_thought_chunk', content: { type: 'text', text: 'hmm' } }
+			}
+		});
+		expect(events).toEqual([{ type: 'reasoning_delta', delta: 'hmm' }]);
+	});
+
+	it('the prompt response settles the turn back to ready', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const frames = adapter.encodeOp({ op: 'user_message', content: 'hi' });
+		const promptId = parse(frames![0]).id;
+		const events = adapter.translate({ jsonrpc: '2.0', id: promptId, result: { stopReason: 'end_turn' } });
+		expect(events.at(-1)).toEqual({ type: 'status', message: 'ready' });
+	});
+
+	it('surfaces refusal and turn-limit stop reasons as info', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const frames = adapter.encodeOp({ op: 'user_message', content: 'hi' });
+		const promptId = parse(frames![0]).id;
+		// The response is the FIRST frame after the prompt here, so the batch
+		// opens with the busy flip and still settles back to ready.
+		const events = adapter.translate({ jsonrpc: '2.0', id: promptId, result: { stopReason: 'refusal' } });
+		expect(events[0]).toEqual({ type: 'connecting' });
+		expect(events[1].type).toBe('info');
+		expect(events.at(-1)).toEqual({ type: 'status', message: 'ready' });
+	});
+
+	it('a failed prompt reports the error AND unsticks the busy state', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const frames = adapter.encodeOp({ op: 'user_message', content: 'hi' });
+		const promptId = parse(frames![0]).id;
+		const events = adapter.translate({
+			jsonrpc: '2.0',
+			id: promptId,
+			error: { code: -32603, message: 'model overloaded' }
+		});
+		expect(events[0]).toEqual({ type: 'connecting' });
+		expect(events[1]).toMatchObject({ type: 'error', message: '[acp] model overloaded' });
+		expect(events.at(-1)).toEqual({ type: 'status', message: 'ready' });
+	});
+});
+
+describe('acp adapter: prompt queueing (one turn at a time)', () => {
+	it('queues messages sent before session/new resolves and flushes on open', () => {
+		const { adapter, lines } = makeAdapter();
+		// User types while the handshake is still in flight.
+		expect(adapter.encodeOp({ op: 'user_message', content: 'early bird' })).toEqual([]);
+		const events = handshake(adapter);
+		// The queued prompt went out as part of the session/new handling.
+		const prompt = parse(lines.at(-1)!);
+		expect(prompt).toMatchObject({
+			method: 'session/prompt',
+			params: { prompt: [{ type: 'text', text: 'early bird' }] }
+		});
+		expect(events.at(-1)).toEqual({ type: 'connecting' });
+	});
+
+	it('queues a second message while a prompt is in flight, then submits it as its own turn', () => {
+		const { adapter, lines } = makeAdapter();
+		handshake(adapter);
+		const first = adapter.encodeOp({ op: 'user_message', content: 'one' });
+		const firstId = parse(first![0]).id;
+		// Second message while busy: swallowed into the queue, no frame yet.
+		expect(adapter.encodeOp({ op: 'user_message', content: 'two' })).toEqual([]);
+		lines.length = 0;
+		// The first turn settles → the queued prompt is submitted, still busy.
+		const events = adapter.translate({ jsonrpc: '2.0', id: firstId, result: { stopReason: 'end_turn' } });
+		expect(events.at(-1)).toEqual({ type: 'connecting' });
+		expect(parse(lines[0])).toMatchObject({
+			method: 'session/prompt',
+			params: { prompt: [{ type: 'text', text: 'two' }] }
+		});
+	});
+});
+
+describe('acp adapter: tool calls → ToolCard events', () => {
+	const toolCall = (update: Record<string, unknown>) => ({
+		jsonrpc: '2.0',
+		method: 'session/update',
+		params: { sessionId: 'agent-sess-1', update }
+	});
+
+	it('tool_call starts a card; a completed tool_call_update closes it', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const started = adapter.translate(
+			toolCall({
+				sessionUpdate: 'tool_call',
+				toolCallId: 'call-1',
+				title: 'Reading config.toml',
+				kind: 'read',
+				status: 'in_progress',
+				locations: [{ path: '/proj/config.toml' }]
+			})
+		);
+		expect(started[0]).toEqual({ type: 'tool_start', call_id: 'call-1', name: 'Reading config.toml' });
+		expect(started[1]).toMatchObject({ type: 'tool_update', call_id: 'call-1' });
+		const done = adapter.translate(
+			toolCall({
+				sessionUpdate: 'tool_call_update',
+				toolCallId: 'call-1',
+				status: 'completed',
+				content: [{ type: 'content', content: { type: 'text', text: 'key = "value"' } }]
+			})
+		);
+		expect(done).toHaveLength(1);
+		expect(done[0]).toMatchObject({ type: 'tool_output', call_id: 'call-1', is_error: false });
+		const payload = JSON.parse((done[0] as unknown as { output: string }).output);
+		expect(payload).toMatchObject({ kind: 'read', path: '/proj/config.toml', content: 'key = "value"' });
+	});
+
+	it('a failed update flags the output as an error', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		adapter.translate(
+			toolCall({ sessionUpdate: 'tool_call', toolCallId: 'call-2', kind: 'execute', status: 'in_progress' })
+		);
+		const done = adapter.translate(
+			toolCall({ sessionUpdate: 'tool_call_update', toolCallId: 'call-2', status: 'failed' })
+		);
+		expect(done[0]).toMatchObject({ type: 'tool_output', call_id: 'call-2', is_error: true });
+	});
+
+	it('diff content renders as a unified-diff payload the card can color', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const events = adapter.translate(
+			toolCall({
+				sessionUpdate: 'tool_call',
+				toolCallId: 'call-3',
+				title: 'Edit main.rs',
+				kind: 'edit',
+				status: 'completed',
+				content: [{ type: 'diff', path: '/proj/main.rs', oldText: 'old line', newText: 'new line' }]
+			})
+		);
+		const out = JSON.parse((events.at(-1) as unknown as { output: string }).output);
+		expect(out.diff).toBe('--- /proj/main.rs\n+++ /proj/main.rs\n-old line\n+new line');
+		expect(out.path).toBe('/proj/main.rs');
+	});
+
+	it('an update for an unknown call id is dropped, not crashed on', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		expect(
+			adapter.translate(
+				toolCall({ sessionUpdate: 'tool_call_update', toolCallId: 'ghost', status: 'completed' })
+			)
+		).toEqual([]);
+	});
+});
+
+describe('acp adapter: plan updates', () => {
+	it('maps plan entries onto the desktop plan event', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const events = adapter.translate({
+			jsonrpc: '2.0',
+			method: 'session/update',
+			params: {
+				sessionId: 'agent-sess-1',
+				update: {
+					sessionUpdate: 'plan',
+					entries: [
+						{ content: 'Find the bug', priority: 'high', status: 'completed' },
+						{ content: 'Fix it', priority: 'high', status: 'in_progress' },
+						{ content: 'Add a test', priority: 'medium' }
+					]
+				}
+			}
+		});
+		expect(events).toEqual([
+			{
+				type: 'plan',
+				plan: [
+					{ step: 'Find the bug', status: 'completed' },
+					{ step: 'Fix it', status: 'in_progress' },
+					{ step: 'Add a test', status: 'pending' }
+				]
+			}
+		]);
+	});
+});
+
+describe('acp adapter: permission requests → ApprovalCard', () => {
+	const OPTIONS = [
+		{ optionId: 'allow', name: 'Allow', kind: 'allow_once' },
+		{ optionId: 'always', name: 'Always allow', kind: 'allow_always' },
+		{ optionId: 'deny', name: 'Deny', kind: 'reject_once' }
+	];
+
+	function requestPermission(adapter: EngineAdapter, id = 77) {
+		return adapter.translate({
+			jsonrpc: '2.0',
+			id,
+			method: 'session/request_permission',
+			params: {
+				sessionId: 'agent-sess-1',
+				toolCall: {
+					toolCallId: 'call-9',
+					title: 'rm -rf ./build',
+					kind: 'execute',
+					content: [{ type: 'diff', path: '/proj/a.txt', oldText: 'x', newText: 'y' }]
+				},
+				options: OPTIONS
+			}
+		});
+	}
+
+	it('bridges the server request to an approval_request with a synthetic call id', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const events = requestPermission(adapter);
+		expect(events).toHaveLength(1);
+		const ev = events[0] as Record<string, any>;
+		expect(ev).toMatchObject({ type: 'approval_request', name: 'execute', hunks: null });
+		expect(ev.call_id).toMatch(/^acp-approval-/);
+		// The card summary shows the title plus the pending diff.
+		expect(ev.summary).toContain('rm -rf ./build');
+		expect(ev.summary).toContain('+y');
+	});
+
+	it('approve/deny/always pick the matching advertised option id', () => {
+		const cases: { op: { decision: 'allow' | 'deny'; always?: boolean }; optionId: string }[] = [
+			{ op: { decision: 'allow' }, optionId: 'allow' },
+			{ op: { decision: 'allow', always: true }, optionId: 'always' },
+			{ op: { decision: 'deny' }, optionId: 'deny' }
+		];
+		for (const { op, optionId } of cases) {
+			const { adapter } = makeAdapter();
+			handshake(adapter);
+			const [ev] = requestPermission(adapter) as Record<string, any>[];
+			const frames = adapter.encodeOp({ op: 'approve', call_id: ev.call_id, ...op });
+			expect(parse(frames![0])).toEqual({
+				jsonrpc: '2.0',
+				id: 77,
+				result: { outcome: { outcome: 'selected', optionId } }
+			});
+		}
+	});
+
+	it('a stale approval (unknown call id) is unsupported → null', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		expect(adapter.encodeOp({ op: 'approve', call_id: 'nope', decision: 'allow' })).toBeNull();
+	});
+
+	it('answers cancelled when the agent offers no usable option', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		const events = adapter.translate({
+			jsonrpc: '2.0',
+			id: 5,
+			method: 'session/request_permission',
+			params: { toolCall: { title: 'x' }, options: [] }
+		});
+		const callId = (events[0] as Record<string, any>).call_id;
+		const frames = adapter.encodeOp({ op: 'approve', call_id: callId, decision: 'allow' });
+		expect(parse(frames![0])).toMatchObject({ id: 5, result: { outcome: { outcome: 'cancelled' } } });
+	});
+});
+
+describe('acp adapter: interrupt', () => {
+	it('cancels outstanding permission requests, drops the queue, then session/cancel', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		adapter.encodeOp({ op: 'user_message', content: 'go' });
+		adapter.encodeOp({ op: 'user_message', content: 'queued' });
+		const [ev] = adapter.translate({
+			jsonrpc: '2.0',
+			id: 9,
+			method: 'session/request_permission',
+			params: { toolCall: { title: 'x' }, options: [{ optionId: 'a', kind: 'allow_once' }] }
+		}) as Record<string, any>[];
+		const frames = adapter.encodeOp({ op: 'interrupt' });
+		expect(frames).toHaveLength(2);
+		expect(parse(frames![0])).toMatchObject({ id: 9, result: { outcome: { outcome: 'cancelled' } } });
+		expect(parse(frames![1])).toEqual({
+			jsonrpc: '2.0',
+			method: 'session/cancel',
+			params: { sessionId: 'agent-sess-1' }
+		});
+		// The approval entry is gone; the queued turn was dropped too.
+		expect(adapter.encodeOp({ op: 'approve', call_id: ev.call_id, decision: 'allow' })).toBeNull();
+	});
+});
+
+describe('acp adapter: client-capability refusals and noise', () => {
+	it('declines fs/terminal requests we never advertised (so the agent can move on)', () => {
+		const { adapter, lines } = makeAdapter();
+		handshake(adapter);
+		lines.length = 0;
+		const events = adapter.translate({
+			jsonrpc: '2.0',
+			id: 12,
+			method: 'fs/read_text_file',
+			params: { path: '/etc/passwd' }
+		});
+		expect(parse(lines[0])).toMatchObject({
+			id: 12,
+			error: { code: -32601, message: 'unsupported by client: fs/read_text_file' }
+		});
+		expect(events[0].type).toBe('info');
+	});
+
+	it('forwards stderr lines as info with ANSI stripped', () => {
+		const { adapter } = makeAdapter();
+		const events = adapter.translate({ __stderr: '\u001b[31mboom\u001b[0m' });
+		expect(events).toEqual([{ type: 'info', message: '[acp] boom' }]);
+		expect(adapter.translate({ __stderr: '   ' })).toEqual([]);
+	});
+
+	it('ignores unknown notifications and non-object frames', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		expect(adapter.translate({ jsonrpc: '2.0', method: 'session/whatever', params: {} })).toEqual([]);
+		expect(adapter.translate('garbage')).toEqual([]);
+		expect(adapter.translate(null)).toEqual([]);
+	});
+
+	it('unsupported ops (steer, mcp, commands) return null so the UI can notify', () => {
+		const { adapter } = makeAdapter();
+		handshake(adapter);
+		expect(adapter.encodeOp({ op: 'steer', content: 'x' } as never)).toBeNull();
+		expect(adapter.encodeOp({ op: 'command', input: '/compact' } as never)).toBeNull();
+		// But the desktop's automatic approval-mode sync is swallowed silently.
+		expect(adapter.encodeOp({ op: 'set_approval_mode', mode: 'auto-edit' } as never)).toEqual([]);
+	});
+});
+
+describe('acp adapter: images', () => {
+	it('attaches images only when the agent advertised the image capability', () => {
+		const withImages = makeAdapter();
+		handshake(withImages.adapter, { image: true });
+		const frames = withImages.adapter.encodeOp({
+			op: 'user_message',
+			content: 'see this',
+			images: ['/tmp/shot.png']
+		});
+		const prompt = parse(frames![0]).params.prompt;
+		expect(prompt).toHaveLength(2);
+		expect(prompt[1]).toMatchObject({ type: 'image', mimeType: 'image/png', uri: 'file:///tmp/shot.png' });
+
+		const noImages = makeAdapter();
+		handshake(noImages.adapter, { image: false });
+		const frames2 = noImages.adapter.encodeOp({
+			op: 'user_message',
+			content: 'see this',
+			images: ['/tmp/shot.png']
+		});
+		expect(parse(frames2![0]).params.prompt).toHaveLength(1);
+	});
+
+	it('imageMime guesses from the extension with a png fallback', () => {
+		expect(imageMime('/a/b.jpg')).toBe('image/jpeg');
+		expect(imageMime('/a/b.webp')).toBe('image/webp');
+		expect(imageMime('/a/b.unknown')).toBe('image/png');
+	});
+});
+
+describe('acp adapter: restart resets per-process state', () => {
+	it('onStart clears the previous process session and re-initializes', () => {
+		const { adapter, lines } = makeAdapter();
+		handshake(adapter);
+		adapter.encodeOp({ op: 'user_message', content: 'pre-crash' });
+		// The child died and was restarted: fresh io, fresh handshake.
+		const lines2: string[] = [];
+		adapter.onStart({ sendLine: (l: string) => lines2.push(l) }, CTX);
+		expect(parse(lines2[0])).toMatchObject({ id: 1, method: 'initialize' });
+		// The stale agent session is gone — messages queue until session/new.
+		expect(adapter.encodeOp({ op: 'user_message', content: 'post-crash' })).toEqual([]);
+		expect(lines2).toHaveLength(1);
+		// diffText stays pure (no adapter state involved).
+		expect(diffText({ type: 'diff', path: 'f', newText: 'a' })).toBe('--- f\n+++ f\n+a');
+	});
+});
diff --git a/src/lib/backends/acp.ts b/src/lib/backends/acp.ts
new file mode 100644
index 0000000..428e36a
--- /dev/null
+++ b/src/lib/backends/acp.ts
@@ -0,0 +1,517 @@
+// Adapter for Agent Client Protocol agents (JSON-RPC 2.0 over stdio lines,
+// protocol v1 — https://agentclientprotocol.com). One child process per
+// desktop session, launched from the Rust-side ACP registry (`acp_registry.rs`);
+// works against any registered agent (`jucode acp`, gemini-cli with
+// --experimental-acp, …).
+//
+// Handshake:
+//   → {id:1, method:"initialize", params:{protocolVersion:1, clientCapabilities}}
+//   ← {id:1, result:{protocolVersion, agentCapabilities, authMethods}}
+//   → {id:2, method:"session/new", params:{cwd, mcpServers:[]}}
+//   ← {id:2, result:{sessionId, modes?, models?}}
+//   → {id:3, method:"session/prompt", params:{sessionId, prompt:[blocks]}}
+//   ← notifications: session/update (agent_message_chunk, agent_thought_chunk,
+//     tool_call, tool_call_update, plan, …)
+//   ← {id:3, result:{stopReason}}          — the turn is over
+//
+// Permission prompts arrive as `session/request_permission` server→client
+// requests; they are bridged to jucode-style `approval_request` events via a
+// synthetic call_id registry (README "Approval bridging") and answered with
+// the picked option id ({outcome:{outcome:"selected", optionId}}). The
+// desktop's allow/deny/always trio is mapped onto the agent's advertised
+// option kinds (allow_once / allow_always / reject_once / reject_always).
+//
+// ACP has no turn-started notification: `session/prompt` is answered only when
+// the turn settles. The busy indicator therefore flips on the first frame the
+// agent sends after a prompt goes out (chunk, tool call or permission request)
+// — see the `translate` wrapper.
+//
+// Deliberately NOT mapped (conservative caps, see docs/acp.md): session modes
+// (agent-defined ids — no provable mapping onto the desktop's approval trio),
+// session/set_model, session/load (resume), steer, hunk-subset approvals,
+// MCP management, checkpoints, context/usage telemetry, slash commands.
+//
+// One prompt per turn: while a prompt is in flight, further user messages are
+// queued adapter-side and submitted as their own turns once the current
+// response settles (same UX as claude's native stdin queue).
+
+import type { Op } from '$lib/protocol';
+import { t } from '$lib/i18n';
+import type { AdapterIO, BackendCaps, EngineAdapter, NormalizedEvent, SessionCtx } from './types';
+import { isStderrPayload } from './types';
+import type {
+	AcpContentBlock,
+	AcpPermissionOption,
+	AcpPromptCapabilities,
+	AcpSessionUpdate,
+	AcpToolCallContent,
+	InitializeResponse,
+	JsonRpcErrorShape,
+	NewSessionResponse,
+	PromptResponse,
+	RequestId,
+	RequestPermissionParams,
+	SessionUpdateParams
+} from './acp-types';
+
+export const ACP_PROTOCOL_VERSION = 1;
+
+export const ACP_CAPS: BackendCaps = {
+	approvalModes: false, // ACP session modes are agent-defined ids — no safe mapping
+	extendedApprovalModes: false,
+	hunkApproval: false, // permission responses are whole-call option picks
+	steer: false, // no mid-turn injection; queued messages run as the next turn
+	interrupt: true, // session/cancel (core protocol, all agents)
+	branchTree: false,
+	goals: false, // plan updates still render (RightDock shows plan when present)
+	skills: false,
+	mcpManage: false,
+	checkpoints: false,
+	contextUsage: false, // no usage/context telemetry in ACP v1
+	compact: false,
+	modelPicker: false, // session/set_model is optional; kept off until provable
+	resume: false, // session/load is optional (jucode acp: loadSession false)
+	subagents: false,
+	transcriptReplay: false,
+	slashCommands: false // available_commands have no invocation RPC (prompt text only)
+};
+
+const str = (v: unknown) => (typeof v === 'string' ? v : '');
+const rec = (v: unknown): Record<string, unknown> | null =>
+	typeof v === 'object' && v !== null ? (v as Record<string, unknown>) : null;
+
+/** Best-effort mime type for an attached image path. */
+export function imageMime(path: string): string {
+	const ext = path.split('.').pop()?.toLowerCase() ?? '';
+	return (
+		{ png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp' }[
+			ext
+		] ?? 'image/png'
+	);
+}
+
+/** Text carried by one ACP content block (non-text blocks best-effort). */
+function blockText(block: AcpContentBlock | undefined): string {
+	if (!block) return '';
+	if (block.type === 'text') return str(block.text);
+	if (block.type === 'resource_link') return str(block.uri);
+	if (block.type === 'resource') return str(block.resource?.uri);
+	return '';
+}
+
+/** Renders a tool-call `diff` content item as a unified-diff-ish string the
+ *  ToolCard's diff view can color. */
+export function diffText(item: AcpToolCallContent): string {
+	const path = str(item.path);
+	const out: string[] = [`--- ${path}`, `+++ ${path}`];
+	const old = typeof item.oldText === 'string' ? item.oldText : '';
+	if (old) for (const line of old.split('\n')) out.push(`-${line}`);
+	for (const line of str(item.newText).split('\n')) out.push(`+${line}`);
+	return out.join('\n');
+}
+
+/** Strip ANSI escapes from an agent stderr line. */
+function cleanStderr(line: string): string {
+	// eslint-disable-next-line no-control-regex
+	return line.replace(/\u001b\[[0-9;]*m/g, '').trim();
+}
+
+interface ToolMeta {
+	name: string;
+	kind: string;
+	path: string;
+	text: string;
+	diff: string;
+}
+
+export function createAcpAdapter(): EngineAdapter {
+	// --- per-session, per-process state (fully reset in onStart) --------------
+	let io: AdapterIO | null = null;
+	let ctx: SessionCtx | null = null;
+	let nextId = 0;
+	/** Our outstanding JSON-RPC requests: id → method (response routing). */
+	let pending = new Map<RequestId, { method: string }>();
+	/** The AGENT's session id (session/new response) — not the desktop's. */
+	let agentSessionId: string | null = null;
+	let promptCaps: AcpPromptCapabilities = {};
+	/** A session/prompt awaiting its response (one turn at a time). */
+	let promptInFlight = false;
+	/** `connecting` already emitted for the in-flight prompt. */
+	let busyAnnounced = false;
+	/** Prompts submitted while busy / before the session opened. */
+	let queued: AcpContentBlock[][] = [];
+	/** Synthetic approval call_id → the server request awaiting our response. */
+	let approvals = new Map<string, { requestId: RequestId; options: AcpPermissionOption[] }>();
+	let approvalSeq = 0;
+	/** Live tool-call bookkeeping (tool cards accumulate across updates). */
+	let tools = new Map<string, ToolMeta>();
+	let model = '';
+
+	const frame = (msg: Record<string, unknown>) => JSON.stringify({ jsonrpc: '2.0', ...msg });
+	const request = (method: string, params?: unknown): string => {
+		const id = ++nextId;
+		pending.set(id, { method });
+		return frame({ id, method, params });
+	};
+	const send = (line: string) => io?.sendLine(line);
+
+	const promptFrame = (blocks: AcpContentBlock[]): string => {
+		promptInFlight = true;
+		busyAnnounced = false;
+		return request('session/prompt', { sessionId: agentSessionId, prompt: blocks });
+	};
+
+	/** Turn settled: run the next queued prompt (stay busy) or go ready. */
+	const settleTurn = (): NormalizedEvent[] => {
+		promptInFlight = false;
+		busyAnnounced = false;
+		const next = queued.shift();
+		if (next && agentSessionId) {
+			send(promptFrame(next));
+			return [{ type: 'connecting' }];
+		}
+		return [{ type: 'status', message: 'ready' }];
+	};
+
+	const toolOutput = (meta: ToolMeta): string =>
+		JSON.stringify({
+			kind: meta.kind,
+			...(meta.path ? { path: meta.path } : {}),
+			...(meta.text ? { content: meta.text } : {}),
+			...(meta.diff ? { diff: meta.diff } : {})
+		});
+
+	/** Folds a tool_call / tool_call_update's content items into the meta. */
+	function absorbToolContent(meta: ToolMeta, content: unknown): void {
+		if (!Array.isArray(content)) return;
+		for (const item of content as AcpToolCallContent[]) {
+			if (item?.type === 'content') {
+				const text = blockText(item.content);
+				if (text) meta.text += (meta.text ? '\n' : '') + text;
+			} else if (item?.type === 'diff') {
+				if (!meta.path) meta.path = str(item.path);
+				meta.diff += (meta.diff ? '\n' : '') + diffText(item);
+			}
+			// terminal items need the (unadvertised) terminal capability — skipped.
+		}
+	}
+
+	// --- session/update → jucode events ----------------------------------------
+
+	function onSessionUpdate(params: SessionUpdateParams): NormalizedEvent[] {
+		const update = (params.update ?? {}) as AcpSessionUpdate & {
+			content?: AcpContentBlock | AcpToolCallContent[];
+		};
+		switch (str(update.sessionUpdate)) {
+			case 'agent_message_chunk': {
+				const text = blockText(update.content as AcpContentBlock);
+				return text ? [{ type: 'assistant_delta', delta: text }] : [];
+			}
+			case 'agent_thought_chunk': {
+				const text = blockText(update.content as AcpContentBlock);
+				return text ? [{ type: 'reasoning_delta', delta: text }] : [];
+			}
+			case 'user_message_chunk':
+				// The desktop already rendered the message optimistically.
+				return [];
+			case 'tool_call': {
+				const id = str(update.toolCallId);
+				if (!id) return [];
+				const meta: ToolMeta = {
+					name: str(update.title) || str(update.kind) || 'tool',
+					kind: str(update.kind) || 'other',
+					path: str(update.locations?.[0]?.path),
+					text: '',
+					diff: ''
+				};
+				absorbToolContent(meta, update.content);
+				tools.set(id, meta);
+				const events: NormalizedEvent[] = [
+					{ type: 'tool_start', call_id: id, name: meta.name },
+					{ type: 'tool_update', call_id: id, output: toolOutput(meta) }
+				];
+				// Some agents announce tool calls already settled.
+				const status = str(update.status);
+				if (status === 'completed' || status === 'failed') {
+					tools.delete(id);
+					events.push({
+						type: 'tool_output',
+						call_id: id,
+						name: meta.name,
+						output: toolOutput(meta),
+						is_error: status === 'failed'
+					});
+				}
+				return events;
+			}
+			case 'tool_call_update': {
+				const id = str(update.toolCallId);
+				const meta = tools.get(id);
+				if (!meta) return [];
+				if (str(update.title)) meta.name = str(update.title);
+				if (str(update.locations?.[0]?.path)) meta.path = str(update.locations?.[0]?.path);
+				absorbToolContent(meta, update.content);
+				const status = str(update.status);
+				if (status === 'completed' || status === 'failed') {
+					tools.delete(id);
+					return [
+						{
+							type: 'tool_output',
+							call_id: id,
+							name: meta.name,
+							output: toolOutput(meta),
+							is_error: status === 'failed'
+						}
+					];
+				}
+				return [{ type: 'tool_update', call_id: id, output: toolOutput(meta) }];
+			}
+			case 'plan': {
+				const entries = Array.isArray(update.entries) ? update.entries : [];
+				return [
+					{
+						type: 'plan',
+						plan: entries.map((e) => ({ step: str(e?.content), status: str(e?.status) || 'pending' }))
+					}
+				];
+			}
+			default:
+				// available_commands_update, current_mode_update, … — no surface yet.
+				return [];
+		}
+	}
+
+	// --- responses / server requests -------------------------------------------
+
+	function onResponse(
+		id: RequestId,
+		result: unknown,
+		error: JsonRpcErrorShape | null
+	): NormalizedEvent[] {
+		const entry = pending.get(id);
+		if (!entry) return [];
+		pending.delete(id);
+		const { method } = entry;
+		if (error) {
+			const message = str(error.message) || `JSON-RPC error ${error.code}`;
+			const events: NormalizedEvent[] = [{ type: 'error', message: `[acp] ${message}` }];
+			// A failed prompt must unstick the busy indicator (and run the queue).
+			if (method === 'session/prompt') events.push(...settleTurn());
+			if (method === 'session/new' || method === 'initialize')
+				events.push({ type: 'status', message: 'ready' });
+			return events;
+		}
+		switch (method) {
+			case 'initialize': {
+				const r = (result ?? {}) as InitializeResponse;
+				promptCaps = r.agentCapabilities?.promptCapabilities ?? {};
+				send(request('session/new', { cwd: ctx?.cwd || '', mcpServers: [] }));
+				return [];
+			}
+			case 'session/new': {
+				const r = (result ?? {}) as NewSessionResponse;
+				agentSessionId = str(r.sessionId) || null;
+				const current = r.models?.currentModelId;
+				model =
+					str(r.models?.availableModels?.find((m) => m.modelId === current)?.name) ||
+					str(current);
+				const events: NormalizedEvent[] = [
+					// session_id stays empty on purpose: ACP has no session/load
+					// guarantee, so these conversations are not resumable and the
+					// desktop must not persist them as restorable tabs.
+					{ type: 'startup', model, cwd: ctx?.cwd ?? '', session_id: '', context_window: 0 }
+				];
+				if (model) {
+					events.push({
+						type: 'model_status',
+						provider: 'acp',
+						model,
+						reasoning_effort: '',
+						reasoning_efforts: [],
+						context_window: 0,
+						context_limit: 0
+					});
+				}
+				events.push({ type: 'status', message: 'ready' });
+				const next = queued.shift();
+				if (next && agentSessionId) {
+					send(promptFrame(next));
+					events.push({ type: 'connecting' });
+				}
+				return events;
+			}
+			case 'session/prompt': {
+				const stop = str((result as PromptResponse)?.stopReason);
+				const events: NormalizedEvent[] = [];
+				if (stop === 'refusal') events.push({ type: 'info', message: t('shell.backend.acpRefusal') });
+				else if (stop === 'max_tokens' || stop === 'max_turn_requests')
+					events.push({ type: 'info', message: t('shell.backend.acpTurnLimit', { reason: stop }) });
+				events.push(...settleTurn());
+				return events;
+			}
+			default:
+				return [];
+		}
+	}
+
+	function onServerRequest(id: RequestId, method: string, params: unknown): NormalizedEvent[] {
+		if (method === 'session/request_permission') {
+			const p = (params ?? {}) as RequestPermissionParams;
+			const callId = `acp-approval-${++approvalSeq}`;
+			approvals.set(callId, { requestId: id, options: p.options ?? [] });
+			// Title + any diff the tool call carries — the approval card renders
+			// the summary as the thing being approved.
+			let summary = str(p.toolCall?.title);
+			for (const item of p.toolCall?.content ?? []) {
+				if (item?.type === 'diff') summary += `\n${diffText(item)}`;
+			}
+			return [
+				{
+					type: 'approval_request',
+					call_id: callId,
+					// ACP tool kinds double as familiar names ('execute' renders
+					// like a shell approval).
+					name: str(p.toolCall?.kind) || 'tool',
+					summary: summary || str(p.toolCall?.kind) || method,
+					subagent_id: null,
+					hunks: null
+				}
+			];
+		}
+		// fs/read_text_file, fs/write_text_file, terminal/* …: we advertise
+		// neither capability — refuse so the agent can resolve instead of hanging.
+		send(frame({ id, error: { code: -32601, message: `unsupported by client: ${method}` } }));
+		return [{ type: 'info', message: `[acp] ${t('shell.backend.acpUnsupportedRequest', { method })}` }];
+	}
+
+	return {
+		id: 'acp',
+		caps: ACP_CAPS,
+		onStart(io_: AdapterIO, ctx_: SessionCtx) {
+			// Full per-process reset: pending requests / approvals / queued turns
+			// died with the child.
+			io = io_;
+			ctx = ctx_;
+			nextId = 0;
+			pending = new Map();
+			agentSessionId = null;
+			promptCaps = {};
+			promptInFlight = false;
+			busyAnnounced = false;
+			queued = [];
+			approvals = new Map();
+			approvalSeq = 0;
+			tools = new Map();
+			model = '';
+			send(
+				request('initialize', {
+					protocolVersion: ACP_PROTOCOL_VERSION,
+					clientCapabilities: {
+						fs: { readTextFile: false, writeTextFile: false },
+						terminal: false
+					}
+				})
+			);
+		},
+		translate(raw: unknown): NormalizedEvent[] {
+			if (isStderrPayload(raw)) {
+				const clean = cleanStderr(raw.__stderr);
+				return clean ? [{ type: 'info', message: `[acp] ${clean}` }] : [];
+			}
+			const msg = rec(raw);
+			if (!msg) return [];
+			// ACP has no turn-started notification — flip the busy indicator on
+			// the first protocol frame the agent sends after a prompt went out.
+			const announceBusy = promptInFlight && !busyAnnounced;
+			if (announceBusy) busyAnnounced = true;
+			let events: NormalizedEvent[] = [];
+			try {
+				const hasId = typeof msg.id === 'number' || typeof msg.id === 'string';
+				if (typeof msg.method === 'string') {
+					events = hasId
+						? onServerRequest(msg.id as RequestId, msg.method, msg.params)
+						: msg.method === 'session/update'
+							? onSessionUpdate((msg.params ?? {}) as SessionUpdateParams)
+							: [];
+				} else if (hasId) {
+					events = onResponse(
+						msg.id as RequestId,
+						msg.result,
+						(msg.error as JsonRpcErrorShape) ?? null
+					);
+				}
+			} catch (e) {
+				console.warn('[acp] translate failed', e, raw);
+			}
+			return announceBusy ? [{ type: 'connecting' }, ...events] : events;
+		},
+		encodeOp(op: Op): string[] | null {
+			switch (op.op) {
+				case 'user_message': {
+					const blocks: AcpContentBlock[] = [{ type: 'text', text: op.content }];
+					if (promptCaps.image) {
+						// Attachments are local temp files; point the agent at them by
+						// uri (jucode acp reads file:// uris; agents that require inline
+						// base64 data won't see these — documented in docs/acp.md).
+						for (const path of op.images ?? []) {
+							blocks.push({ type: 'image', mimeType: imageMime(path), data: '', uri: `file://${path}` });
+						}
+					}
+					if (!agentSessionId || promptInFlight) {
+						// Handshake still running or a turn is active: queue; flushed by
+						// session/new (handshake) or settleTurn (turn end).
+						queued.push(blocks);
+						return [];
+					}
+					return [promptFrame(blocks)];
+				}
+				case 'approve': {
+					const entry = approvals.get(op.call_id);
+					if (!entry) return null; // stale (restart / cancelled turn)
+					approvals.delete(op.call_id);
+					// Preference order matters: try each kind in turn (an agent's
+					// option ORDER is presentation, not priority).
+					const pick = (kinds: string[]) => {
+						for (const kind of kinds) {
+							const o = entry.options.find((x) => str(x.kind) === kind && str(x.optionId));
+							if (o) return o;
+						}
+						return undefined;
+					};
+					const option =
+						op.decision === 'deny'
+							? pick(['reject_once', 'reject_always'])
+							: op.always
+								? pick(['allow_always', 'allow_once'])
+								: pick(['allow_once', 'allow_always']);
+					const outcome = option
+						? { outcome: 'selected', optionId: str(option.optionId) }
+						: { outcome: 'cancelled' };
+					return [frame({ id: entry.requestId, result: { outcome } })];
+				}
+				case 'interrupt': {
+					if (!agentSessionId) return [];
+					const frames: string[] = [];
+					// Per spec: settle outstanding permission requests as cancelled,
+					// then notify the agent; the in-flight prompt answers with
+					// stopReason "cancelled".
+					for (const [callId, entry] of approvals) {
+						frames.push(frame({ id: entry.requestId, result: { outcome: { outcome: 'cancelled' } } }));
+						approvals.delete(callId);
+					}
+					queued = [];
+					frames.push(frame({ method: 'session/cancel', params: { sessionId: agentSessionId } }));
+					return frames;
+				}
+				case 'set_approval_mode':
+					// No safe mapping onto agent-defined session modes; the picker is
+					// hidden (caps.approvalModes) — swallow the desktop's startup sync.
+					return [];
+				case 'shutdown':
+					return []; // no protocol-level shutdown; the router kills the child
+				default:
+					return null; // command / steer / mcp_* — unsupported, UI notifies
+			}
+		}
+	};
+}
diff --git a/src/lib/backends/index.ts b/src/lib/backends/index.ts
index 8e2bc9a..7bd5144 100644
--- a/src/lib/backends/index.ts
+++ b/src/lib/backends/index.ts
@@ -4,15 +4,17 @@ import type { BackendCaps, BackendId, EngineAdapter } from './types';
 import { createJucodeAdapter, JUCODE_CAPS } from './jucode';
 import { createCodexAdapter, CODEX_CAPS } from './codex';
 import { createClaudeAdapter, CLAUDE_CAPS } from './claude';
+import { createAcpAdapter, ACP_CAPS } from './acp';
 
 export type { BackendCaps, BackendId, EngineAdapter, AdapterIO, SessionCtx, NormalizedEvent } from './types';
-export { BACKEND_IDS, BACKEND_LABELS, isBackendId, normalizeBackendId } from './types';
+export { BACKEND_IDS, NATIVE_BACKEND_IDS, BACKEND_LABELS, isBackendId, normalizeBackendId } from './types';
 
 /** Static capability table (adapters declare the same object). */
 export const CAPS: Record<BackendId, BackendCaps> = {
 	jucode: JUCODE_CAPS,
 	codex: CODEX_CAPS,
-	claude: CLAUDE_CAPS
+	claude: CLAUDE_CAPS,
+	acp: ACP_CAPS
 };
 
 /** New adapter instance for a session (adapters are per-session stateful). */
@@ -22,6 +24,8 @@ export function createAdapter(id: BackendId): EngineAdapter {
 			return createCodexAdapter();
 		case 'claude':
 			return createClaudeAdapter();
+		case 'acp':
+			return createAcpAdapter();
 		default:
 			return createJucodeAdapter();
 	}
diff --git a/src/lib/backends/settings.ts b/src/lib/backends/settings.ts
index 3eb472a..52f8ee6 100644
--- a/src/lib/backends/settings.ts
+++ b/src/lib/backends/settings.ts
@@ -133,7 +133,9 @@ export function buildBackendOpts(
 	settings: BackendSettings = loadBackendSettings()
 ): SpawnBackendOpts | undefined {
 	const opts: SpawnBackendOpts = {};
-	const path = settings.paths[id];
+	// ACP sessions have no bin_override — the command comes from the Rust-side
+	// agent registry (per-agent), never from a per-backend path setting.
+	const path = id === 'acp' ? undefined : settings.paths[id];
 	if (path) opts.bin_override = path;
 	if (!settings.useShellEnv) opts.use_shell_env = false;
 	const env = settings.env[id];
diff --git a/src/lib/backends/types.ts b/src/lib/backends/types.ts
index b64645d..bf1e7a5 100644
--- a/src/lib/backends/types.ts
+++ b/src/lib/backends/types.ts
@@ -5,19 +5,25 @@
 
 import type { Op, AgentEvent } from '$lib/protocol';
 
-export type BackendId = 'jucode' | 'codex' | 'claude';
+export type BackendId = 'jucode' | 'codex' | 'claude' | 'acp';
 
-export const BACKEND_IDS: BackendId[] = ['jucode', 'codex', 'claude'];
+export const BACKEND_IDS: BackendId[] = ['jucode', 'codex', 'claude', 'acp'];
 
-/** Display names (brand names — not localized). */
+/** The backends with a single well-known binary (probe rows, path overrides).
+ *  'acp' is excluded: it launches whichever agent the registry entry names. */
+export const NATIVE_BACKEND_IDS: BackendId[] = ['jucode', 'codex', 'claude'];
+
+/** Display names (brand names — not localized). The 'acp' label is a generic
+ *  fallback; sessions display their registry entry's name instead. */
 export const BACKEND_LABELS: Record<BackendId, string> = {
 	jucode: 'JuCode',
 	codex: 'Codex',
-	claude: 'Claude Code'
+	claude: 'Claude Code',
+	acp: 'ACP'
 };
 
 export function isBackendId(v: unknown): v is BackendId {
-	return v === 'jucode' || v === 'codex' || v === 'claude';
+	return v === 'jucode' || v === 'codex' || v === 'claude' || v === 'acp';
 }
 
 /** Restore path: unknown / missing backend ids collapse to 'jucode'. */
diff --git a/src/lib/chat.svelte.ts b/src/lib/chat.svelte.ts
index cca925e..c14296a 100644
--- a/src/lib/chat.svelte.ts
+++ b/src/lib/chat.svelte.ts
@@ -114,6 +114,11 @@ export class ChatState {
 	 *  session creation; the `caps()` helper gates UI surfaces off it. */
 	backendId: BackendId = 'jucode';
 
+	/** For 'acp' sessions: which registry agent backs it, and its display name
+	 *  (shown instead of the generic ACP label). Set once at session creation. */
+	acpAgentId = '';
+	acpAgentName = '';
+
 	messages = $state<Msg[]>([]);
 	provider = $state('');
 	model = $state('');
diff --git a/src/lib/i18n/messages/chat.ts b/src/lib/i18n/messages/chat.ts
index 088620f..173dcdd 100644
--- a/src/lib/i18n/messages/chat.ts
+++ b/src/lib/i18n/messages/chat.ts
@@ -32,6 +32,7 @@ const chat = {
 		switchModel: '切换模型',
 		switchBackend: '切换后端',
 		backendLocked: '已发送首条消息，后端已固定',
+		acpAgents: 'ACP 智能体',
 		effortTitle: '思考强度',
 		effortFaster: '更快',
 		effortSmarter: '更聪明',
@@ -94,6 +95,7 @@ const chat = {
 		switchModel: 'Switch model',
 		switchBackend: 'Switch backend',
 		backendLocked: 'Backend is locked after the first message',
+		acpAgents: 'ACP agents',
 		effortTitle: 'Thinking effort',
 		effortFaster: 'Faster',
 		effortSmarter: 'Smarter',
diff --git a/src/lib/i18n/messages/settings.ts b/src/lib/i18n/messages/settings.ts
index 3d41050..90913fc 100644
--- a/src/lib/i18n/messages/settings.ts
+++ b/src/lib/i18n/messages/settings.ts
@@ -94,6 +94,30 @@ const settings = {
 			envPlaceholder: 'KEY=VALUE，每行一条（在终端环境快照之上追加）',
 			envInvalid: '以下行无效已忽略：{lines}'
 		},
+		acp: {
+			groupLabel: 'ACP 智能体',
+			hint: '注册通过 Agent Client Protocol 通信的智能体 CLI（如 jucode acp、gemini --experimental-acp）。注册后可在新会话的引擎选择器中选用。',
+			checking: '检测中…',
+			found: '已安装',
+			notFound: '未检测到命令',
+			recheck: '重新检测',
+			remove: '移除',
+			edit: '编辑',
+			empty: '尚未注册 ACP 智能体。',
+			add: '添加智能体',
+			save: '保存',
+			cancel: '取消',
+			name: '名称',
+			namePlaceholder: '例如 Gemini CLI',
+			command: '命令',
+			commandPlaceholder: '例如 gemini（或可执行文件的完整路径）',
+			args: '参数',
+			argsPlaceholder: '例如 --experimental-acp（空格分隔，可用引号）',
+			env: '环境变量',
+			envPlaceholder: 'KEY=VALUE，每行一条（仅对该智能体生效）',
+			envInvalid: '以下行无效：{lines}',
+			needNameCommand: '名称和命令不能为空'
+		},
 		behavior: {
 			defaultModel: '默认模型',
 			selectModel: '选择模型',
@@ -346,6 +370,30 @@ const settings = {
 			envPlaceholder: 'KEY=VALUE, one per line (applied on top of the snapshot)',
 			envInvalid: 'Invalid lines ignored: {lines}'
 		},
+		acp: {
+			groupLabel: 'ACP agents',
+			hint: 'Register agent CLIs that speak the Agent Client Protocol (e.g. jucode acp, gemini --experimental-acp). Registered agents appear in the engine picker for new sessions.',
+			checking: 'Checking…',
+			found: 'Installed',
+			notFound: 'Command not found',
+			recheck: 'Re-check',
+			remove: 'Remove',
+			edit: 'Edit',
+			empty: 'No ACP agents registered yet.',
+			add: 'Add agent',
+			save: 'Save',
+			cancel: 'Cancel',
+			name: 'Name',
+			namePlaceholder: 'e.g. Gemini CLI',
+			command: 'Command',
+			commandPlaceholder: 'e.g. gemini (or a full path to the executable)',
+			args: 'Arguments',
+			argsPlaceholder: 'e.g. --experimental-acp (space-separated, quotes allowed)',
+			env: 'Environment variables',
+			envPlaceholder: 'KEY=VALUE, one per line (applied to this agent only)',
+			envInvalid: 'Invalid lines: {lines}',
+			needNameCommand: 'Name and command are required'
+		},
 		behavior: {
 			defaultModel: 'Default model',
 			selectModel: 'Select a model',
diff --git a/src/lib/i18n/messages/shell.ts b/src/lib/i18n/messages/shell.ts
index a5b5718..d0ca5d6 100644
--- a/src/lib/i18n/messages/shell.ts
+++ b/src/lib/i18n/messages/shell.ts
@@ -204,6 +204,9 @@ const shell = {
 			opUnsupported: '当前引擎后端不支持该操作：{op}',
 			codexAuthHint: 'Codex 认证已失效：请在终端运行 `codex login` 重新登录后重试。',
 			codexUnsupportedRequest: '已拒绝引擎的一个不支持的请求：{method}',
+			acpRefusal: '智能体拒绝了这个请求，本轮已结束。',
+			acpTurnLimit: '本轮达到上限（{reason}），已提前结束。',
+			acpUnsupportedRequest: '已拒绝智能体的一个不支持的请求：{method}',
 			codexCmdGoal: '设置或查看会话目标（/goal <目标>，/goal clear 清除）',
 			claudeAuthHint:
 				'Claude Code 认证已失效：请在终端运行 `claude` 并执行 /login 重新登录（或运行 `claude setup-token`）后重试。',
@@ -420,6 +423,9 @@ const shell = {
 			opUnsupported: 'The current engine backend does not support this action: {op}',
 			codexAuthHint: 'Codex authentication is invalid: run `codex login` in a terminal, then retry.',
 			codexUnsupportedRequest: 'Declined an unsupported engine request: {method}',
+			acpRefusal: 'The agent declined this request and ended the turn.',
+			acpTurnLimit: 'The turn hit a limit ({reason}) and stopped early.',
+			acpUnsupportedRequest: 'Declined an unsupported agent request: {method}',
 			codexCmdGoal: 'Set or view the session goal (/goal <objective>, /goal clear)',
 			claudeAuthHint:
 				'Claude Code authentication is invalid: run `claude` in a terminal and sign in with /login (or run `claude setup-token`), then retry.',
diff --git a/src/lib/protocol.ts b/src/lib/protocol.ts
index 1fb6756..be30f89 100644
--- a/src/lib/protocol.ts
+++ b/src/lib/protocol.ts
@@ -57,6 +57,30 @@ export function checkBackend(backend: string, binOverride?: string): Promise<Bac
 	return invoke('check_backend', { backend, binOverride });
 }
 
+// ACP agent registry (Rust-owned: ~app-config/acp-agents.json). The frontend
+// only ever references agents by id; command/args/env are validated Rust-side
+// on every read and write, and create_session looks the entry up by id.
+export interface AcpAgent {
+	id: string;
+	name: string;
+	command: string;
+	args: string[];
+	env: Record<string, string>;
+}
+export function acpAgentsList(): Promise<AcpAgent[]> {
+	return invoke('acp_agents_list');
+}
+export function acpAgentUpsert(agent: AcpAgent): Promise<AcpAgent[]> {
+	return invoke('acp_agent_upsert', { agent });
+}
+export function acpAgentRemove(id: string): Promise<AcpAgent[]> {
+	return invoke('acp_agent_remove', { id });
+}
+/** Availability probe for one registered ACP agent (`<command> --version`). */
+export function acpAgentCheck(id: string): Promise<BackendStatus> {
+	return invoke('acp_agent_check', { id });
+}
+
 /** Login-shell environment snapshot state (see src-tauri/src/shell_env.rs). */
 export interface ShellEnvStatus {
 	supported: boolean;
diff --git a/src/lib/session.svelte.ts b/src/lib/session.svelte.ts
index 8f6de8e..2878e13 100644
--- a/src/lib/session.svelte.ts
+++ b/src/lib/session.svelte.ts
@@ -18,6 +18,8 @@ export interface SavedProject {
 	worktree?: WorktreeMeta;
 	/** 本项目最近一次新建会话所用的引擎后端（缺省 = jucode）。 */
 	lastBackend?: string;
+	/** lastBackend 为 'acp' 时：上次选择的 ACP agent。 */
+	lastAcpAgent?: { id: string; name: string };
 }
 
 const base = (p: string) => p.replace(/\/+$/, '').split('/').pop() || p;
@@ -72,14 +74,19 @@ export class SessionStore {
 	}
 
 	/** Builds a session record (chat + per-session adapter) and registers the
-	 *  adapter with the op router. */
-	#newSession(backendId: BackendId): Session {
+	 *  adapter with the op router. `acpAgent` (acp backend only) records which
+	 *  registry agent backs the session, for spawn opts and display. */
+	#newSession(backendId: BackendId, acpAgent?: { id: string; name: string }): Session {
 		const id = this.uid();
 		const chat = new ChatState();
 		chat.backendId = backendId;
+		if (acpAgent) {
+			chat.acpAgentId = acpAgent.id;
+			chat.acpAgentName = acpAgent.name;
+		}
 		const adapter = createAdapter(backendId);
 		registerAdapter(id, adapter);
-		return { id, chat, backendId, adapter };
+		return { id, chat, backendId, adapter, ...(acpAgent ? { acpAgent } : {}) };
 	}
 
 	/** Spawns the engine child for `s`, invokes the adapter's onStart hook once
@@ -100,7 +107,11 @@ export class SessionStore {
 		resume?: string
 	) {
 		const base = buildBackendOpts(s.backendId);
-		const opts = extraOpts ? { ...(base ?? {}), ...extraOpts } : base;
+		// ACP sessions always pass their registry agent id (initial spawn and
+		// every crash auto-restart alike) — the Rust side looks the command up.
+		const agentOpt = s.backendId === 'acp' && s.acpAgent ? { agent: s.acpAgent.id } : undefined;
+		const opts =
+			agentOpt || extraOpts ? { ...(base ?? {}), ...(agentOpt ?? {}), ...(extraOpts ?? {}) } : base;
 		const spawned =
 			s.backendId === 'jucode' && !opts
 				? createSession(s.id, cwd)
@@ -121,12 +132,25 @@ export class SessionStore {
 	/** Spawn a fresh session in `project` and make it active. `firstMessage`
 	 *  (e.g. a parallel task's 任务描述) is sent as the opening user turn once
 	 *  the engine is up. `backend` overrides the project's last-used backend
-	 *  (which itself falls back to the settings default). */
-	addSession(project: Project, firstMessage?: string, backend?: BackendId) {
-		const backendId = backend ?? defaultBackendFor(project.lastBackend);
-		const s = this.#newSession(backendId);
+	 *  (which itself falls back to the settings default). `acpAgent` picks the
+	 *  registry agent for 'acp' sessions (defaults to the project's last one;
+	 *  without any, the session falls back to the native engine). */
+	addSession(
+		project: Project,
+		firstMessage?: string,
+		backend?: BackendId,
+		acpAgent?: { id: string; name: string }
+	) {
+		let backendId = backend ?? defaultBackendFor(project.lastBackend);
+		let agent = backendId === 'acp' ? (acpAgent ?? project.lastAcpAgent) : undefined;
+		if (backendId === 'acp' && !agent) {
+			backendId = 'jucode'; // no agent to launch — never spawn a bare 'acp'
+			agent = undefined;
+		}
+		const s = this.#newSession(backendId, agent);
 		project.sessions.push(s);
 		project.lastBackend = backendId;
+		if (backendId === 'acp' && agent) project.lastAcpAgent = agent;
 		this.activeId = s.id;
 		// Pin a session id we control for claude (via --session-id) so the
 		// conversation persists under a known uuid and --resume can restore its
@@ -151,10 +175,12 @@ export class SessionStore {
 	 * (model catalog, commands, session id…). No-op once the first user message
 	 * has been sent — the conversation can't move engines.
 	 */
-	async switchBackend(id: string, backend: BackendId) {
+	async switchBackend(id: string, backend: BackendId, acpAgent?: { id: string; name: string }) {
 		const s = this.allSessions.find((x) => x.id === id);
-		if (!s || s.backendId === backend) return;
+		if (!s) return;
+		if (s.backendId === backend && (backend !== 'acp' || s.acpAgent?.id === acpAgent?.id)) return;
 		if (s.chat.userTurns > 0 || s.restored) return;
+		if (backend === 'acp' && !acpAgent) return; // nothing to launch
 		const project = this.projects.find((pr) => pr.sessions.some((x) => x.id === id));
 		// Swap the projection + adapter BEFORE the old child exits, so the exit
 		// event lands on the new ChatState with `switching` set and isn't treated
@@ -168,6 +194,14 @@ export class SessionStore {
 		s.chat = chat;
 		s.backendId = backend;
 		s.adapter = adapter;
+		if (backend === 'acp' && acpAgent) {
+			s.acpAgent = acpAgent;
+			chat.acpAgentId = acpAgent.id;
+			chat.acpAgentName = acpAgent.name;
+			if (project) project.lastAcpAgent = acpAgent;
+		} else {
+			s.acpAgent = undefined;
+		}
 		if (project) project.lastBackend = backend;
 		try {
 			await closeSession(id);
@@ -463,6 +497,7 @@ export class SessionStore {
 			path: p.path,
 			...(p.worktree ? { worktree: p.worktree } : {}),
 			...(p.lastBackend && p.lastBackend !== 'jucode' ? { lastBackend: p.lastBackend } : {}),
+			...(p.lastBackend === 'acp' && p.lastAcpAgent ? { lastAcpAgent: p.lastAcpAgent } : {}),
 			tabs: p.sessions
 				.filter((s) => s.chat.resumable)
 				.map((s) => ({
@@ -485,6 +520,14 @@ export class SessionStore {
 			for (const p of saved) {
 				const proj: Project = { id: p.id, name: p.name, path: p.path, sessions: [] };
 				if (p.lastBackend) proj.lastBackend = normalizeBackendId(p.lastBackend);
+				if (
+					proj.lastBackend === 'acp' &&
+					p.lastAcpAgent &&
+					typeof p.lastAcpAgent.id === 'string' &&
+					typeof p.lastAcpAgent.name === 'string'
+				) {
+					proj.lastAcpAgent = { id: p.lastAcpAgent.id, name: p.lastAcpAgent.name };
+				}
 				if (p.worktree) {
 					proj.worktree = p.worktree;
 					try {
diff --git a/src/lib/settings/AcpSection.svelte b/src/lib/settings/AcpSection.svelte
new file mode 100644
index 0000000..6573e5d
--- /dev/null
+++ b/src/lib/settings/AcpSection.svelte
@@ -0,0 +1,392 @@
+<script lang="ts">
+	// Settings → 行为 → ACP agents: manage the registry of Agent Client
+	// Protocol agents the desktop may launch (id, name, command, args, env).
+	// The registry itself is owned and validated by the Rust side
+	// (acp_registry.rs) — this UI only reads it and submits whole entries.
+	import { onMount } from 'svelte';
+	import { Plus, Trash2, RotateCw, CircleCheck, CircleAlert, ChevronRight } from 'lucide-svelte';
+	import {
+		acpAgentCheck,
+		acpAgentRemove,
+		acpAgentUpsert,
+		acpAgentsList,
+		type AcpAgent,
+		type BackendStatus
+	} from '$lib/protocol';
+	import { formatArgs, slugifyAgentId, tokenizeArgs } from '$lib/backends/acp-agents';
+	import { formatEnvLines, parseEnvLines, versionLabel } from '$lib/backends/settings';
+	import BackendIcon from '$lib/BackendIcon.svelte';
+	import IconButton from '$lib/ui/IconButton.svelte';
+	import Button from '$lib/ui/Button.svelte';
+	import { t } from '$lib/i18n';
+
+	let agents = $state<AcpAgent[]>([]);
+	let status = $state<Record<string, BackendStatus | 'checking'>>({});
+	let open = $state<Record<string, boolean>>({});
+	// Editable projections of each agent's args / env (parsed on change).
+	let argsText = $state<Record<string, string>>({});
+	let envText = $state<Record<string, string>>({});
+	let rowError = $state<Record<string, string>>({});
+	let listError = $state('');
+
+	// Add-agent draft form.
+	let adding = $state(false);
+	let draft = $state({ name: '', command: '', args: '', env: '' });
+	let draftError = $state('');
+
+	function syncTexts() {
+		for (const a of agents) {
+			argsText[a.id] = formatArgs(a.args);
+			envText[a.id] = formatEnvLines(a.env);
+		}
+	}
+
+	function load() {
+		acpAgentsList()
+			.then((list) => {
+				agents = list;
+				listError = '';
+				syncTexts();
+				for (const a of list) check(a.id);
+			})
+			.catch((e) => (listError = String(e)));
+	}
+
+	function check(id: string) {
+		status[id] = 'checking';
+		acpAgentCheck(id)
+			.then((s) => (status[id] = s))
+			.catch(() => (status[id] = { found: false }));
+	}
+
+	function persist(agent: AcpAgent) {
+		acpAgentUpsert(agent)
+			.then((list) => {
+				agents = list;
+				rowError[agent.id] = '';
+				syncTexts();
+				check(agent.id);
+			})
+			.catch((e) => (rowError[agent.id] = String(e)));
+	}
+
+	function onFieldChange(agent: AcpAgent) {
+		const { env, invalid } = parseEnvLines(envText[agent.id] ?? '');
+		if (invalid.length) {
+			rowError[agent.id] = t('settings.acp.envInvalid', { lines: invalid.join(', ') });
+			return;
+		}
+		persist({ ...agent, args: tokenizeArgs(argsText[agent.id] ?? ''), env });
+	}
+
+	function remove(id: string) {
+		acpAgentRemove(id)
+			.then((list) => {
+				agents = list;
+				listError = '';
+				syncTexts();
+			})
+			.catch((e) => (listError = String(e)));
+	}
+
+	function saveDraft() {
+		const name = draft.name.trim();
+		const command = draft.command.trim();
+		if (!name || !command) {
+			draftError = t('settings.acp.needNameCommand');
+			return;
+		}
+		const { env, invalid } = parseEnvLines(draft.env);
+		if (invalid.length) {
+			draftError = t('settings.acp.envInvalid', { lines: invalid.join(', ') });
+			return;
+		}
+		const id = slugifyAgentId(name, new Set(agents.map((a) => a.id)));
+		acpAgentUpsert({ id, name, command, args: tokenizeArgs(draft.args), env })
+			.then((list) => {
+				agents = list;
+				draftError = '';
+				adding = false;
+				draft = { name: '', command: '', args: '', env: '' };
+				syncTexts();
+				check(id);
+			})
+			.catch((e) => (draftError = String(e)));
+	}
+
+	onMount(load);
+</script>
+
+<div class="group">
+	<div class="glabel">{t('settings.acp.groupLabel')}</div>
+	<p class="hint">{t('settings.acp.hint')}</p>
+	{#if listError}
+		<p class="err">{listError}</p>
+	{/if}
+
+	<div class="alist">
+		{#each agents as agent (agent.id)}
+			{@const st = status[agent.id]}
+			<div class="arow">
+				<span class="atile"><BackendIcon backend="acp" size={16} /></span>
+				<div class="amain">
+					<div class="ahead">
+						<span class="aname">{agent.name}</span>
+						{#if st === 'checking'}
+							<span class="astate dim">{t('settings.acp.checking')}</span>
+						{:else if st && st.found}
+							<span class="astate ok"><CircleCheck size={12} /> {versionLabel(st) || t('settings.acp.found')}</span>
+						{:else if st}
+							<span class="astate warn"><CircleAlert size={12} /> {t('settings.acp.notFound')}</span>
+						{/if}
+					</div>
+					<span class="acmd" title="{agent.command} {formatArgs(agent.args)}">
+						{agent.command} {formatArgs(agent.args)}
+					</span>
+					<button class="edithead" onclick={() => (open[agent.id] = !open[agent.id])}>
+						<span class="chev" class:open={open[agent.id]}><ChevronRight size={12} /></span>
+						{t('settings.acp.edit')}
+					</button>
+					{#if open[agent.id]}
+						<div class="editbox">
+							<label class="fl">
+								<span>{t('settings.acp.command')}</span>
+								<input class="tf" bind:value={agent.command} onchange={() => onFieldChange(agent)} placeholder={t('settings.acp.commandPlaceholder')} />
+							</label>
+							<label class="fl">
+								<span>{t('settings.acp.args')}</span>
+								<input class="tf" bind:value={argsText[agent.id]} onchange={() => onFieldChange(agent)} placeholder={t('settings.acp.argsPlaceholder')} />
+							</label>
+							<label class="fl">
+								<span>{t('settings.acp.env')}</span>
+								<textarea class="tf envta" rows="2" bind:value={envText[agent.id]} onchange={() => onFieldChange(agent)} placeholder={t('settings.acp.envPlaceholder')}></textarea>
+							</label>
+							{#if rowError[agent.id]}
+								<span class="err">{rowError[agent.id]}</span>
+							{/if}
+						</div>
+					{/if}
+				</div>
+				<IconButton onclick={() => check(agent.id)} label="re-check agent" title={t('settings.acp.recheck')}>
+					<RotateCw size={14} />
+				</IconButton>
+				<IconButton onclick={() => remove(agent.id)} label="remove agent" title={t('settings.acp.remove')}>
+					<Trash2 size={14} />
+				</IconButton>
+			</div>
+		{/each}
+		{#if !agents.length && !listError}
+			<p class="empty">{t('settings.acp.empty')}</p>
+		{/if}
+	</div>
+
+	{#if adding}
+		<div class="draft">
+			<label class="fl">
+				<span>{t('settings.acp.name')}</span>
+				<input class="tf" bind:value={draft.name} placeholder={t('settings.acp.namePlaceholder')} />
+			</label>
+			<label class="fl">
+				<span>{t('settings.acp.command')}</span>
+				<input class="tf" bind:value={draft.command} placeholder={t('settings.acp.commandPlaceholder')} />
+			</label>
+			<label class="fl">
+				<span>{t('settings.acp.args')}</span>
+				<input class="tf" bind:value={draft.args} placeholder={t('settings.acp.argsPlaceholder')} />
+			</label>
+			<label class="fl">
+				<span>{t('settings.acp.env')}</span>
+				<textarea class="tf envta" rows="2" bind:value={draft.env} placeholder={t('settings.acp.envPlaceholder')}></textarea>
+			</label>
+			{#if draftError}
+				<span class="err">{draftError}</span>
+			{/if}
+			<div class="draftbtns">
+				<Button variant="primary" size="sm" onclick={saveDraft}>{t('settings.acp.save')}</Button>
+				<Button variant="ghost" size="sm" onclick={() => { adding = false; draftError = ''; }}>{t('settings.acp.cancel')}</Button>
+			</div>
+		</div>
+	{:else}
+		<Button variant="secondary" size="sm" onclick={() => (adding = true)}>
+			<Plus size={14} />
+			{t('settings.acp.add')}
+		</Button>
+	{/if}
+</div>
+
+<style>
+	.group {
+		margin-top: 22px;
+	}
+	.glabel {
+		display: flex;
+		align-items: center;
+		gap: 6px;
+		font-size: 11px;
+		font-weight: 600;
+		letter-spacing: 0.05em;
+		text-transform: uppercase;
+		color: var(--dim2);
+		margin-bottom: 10px;
+	}
+	.hint {
+		margin: 0 0 10px;
+		font-size: 12px;
+		color: var(--dim);
+	}
+	.alist {
+		display: flex;
+		flex-direction: column;
+		border: 1px solid var(--hairline);
+		border-radius: var(--r-md);
+		background: var(--surface);
+		overflow: hidden;
+		margin-bottom: 10px;
+	}
+	.arow {
+		display: flex;
+		align-items: flex-start;
+		gap: 12px;
+		padding: 12px 14px;
+	}
+	.arow + .arow {
+		border-top: 1px solid var(--hairline);
+	}
+	.atile {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 30px;
+		height: 30px;
+		border-radius: var(--r-sm);
+		background: var(--surface2);
+		border: 1px solid var(--hairline);
+		flex-shrink: 0;
+		margin-top: 2px;
+	}
+	.amain {
+		flex: 1;
+		min-width: 0;
+		display: flex;
+		flex-direction: column;
+		gap: 5px;
+	}
+	.ahead {
+		display: flex;
+		align-items: center;
+		gap: 9px;
+		min-width: 0;
+	}
+	.aname {
+		font-size: 13px;
+		font-weight: 500;
+	}
+	.astate {
+		display: inline-flex;
+		align-items: center;
+		gap: 4px;
+		font-size: 11px;
+		font-family: var(--font-mono);
+	}
+	.astate.ok {
+		color: var(--ok);
+	}
+	.astate.warn {
+		color: var(--warn);
+	}
+	.astate.dim {
+		color: var(--dim2);
+	}
+	.acmd {
+		font-size: 11px;
+		font-family: var(--font-mono);
+		color: var(--dim2);
+		white-space: nowrap;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+	.edithead {
+		display: inline-flex;
+		align-items: center;
+		gap: 5px;
+		align-self: flex-start;
+		background: none;
+		border: none;
+		padding: 2px 0;
+		font-size: 11px;
+		color: var(--dim);
+		cursor: pointer;
+	}
+	.edithead:hover {
+		color: var(--text);
+	}
+	.chev {
+		display: inline-flex;
+		transition: transform var(--t-med) var(--ease-spring);
+	}
+	.chev.open {
+		transform: rotate(90deg);
+	}
+	.editbox,
+	.draft {
+		display: flex;
+		flex-direction: column;
+		gap: 8px;
+		max-width: 420px;
+	}
+	.draft {
+		border: 1px solid var(--hairline);
+		border-radius: var(--r-md);
+		background: var(--surface);
+		padding: 12px 14px;
+		margin-bottom: 10px;
+	}
+	.fl {
+		display: flex;
+		flex-direction: column;
+		gap: 3px;
+	}
+	.fl > span {
+		font-size: 11px;
+		color: var(--dim);
+	}
+	.tf {
+		width: 100%;
+		min-width: 0;
+		background: var(--surface2);
+		border: 1px solid var(--border);
+		border-radius: var(--r-sm);
+		color: var(--text);
+		padding: 8px 10px;
+		font-size: 12px;
+		font-family: var(--font-mono);
+		outline: none;
+		transition: border-color var(--t-fast) var(--ease-out);
+	}
+	.tf::placeholder {
+		color: var(--dim2);
+		font-family: var(--font-sans);
+	}
+	.tf:focus {
+		border-color: color-mix(in oklab, var(--accent) 45%, var(--border));
+	}
+	.envta {
+		resize: vertical;
+		min-height: 44px;
+		line-height: 1.5;
+	}
+	.err {
+		font-size: 11px;
+		color: var(--warn);
+	}
+	.empty {
+		margin: 0;
+		padding: 12px 14px;
+		font-size: 12px;
+		color: var(--dim2);
+	}
+	.draftbtns {
+		display: flex;
+		gap: 8px;
+	}
+</style>
diff --git a/src/lib/settings/BackendSection.svelte b/src/lib/settings/BackendSection.svelte
index f3110ca..7e9c8ac 100644
--- a/src/lib/settings/BackendSection.svelte
+++ b/src/lib/settings/BackendSection.svelte
@@ -12,7 +12,7 @@
 		type BackendStatus,
 		type ShellEnvStatus
 	} from '$lib/protocol';
-	import { BACKEND_IDS, BACKEND_LABELS, type BackendId } from '$lib/backends';
+	import { NATIVE_BACKEND_IDS, BACKEND_LABELS, type BackendId } from '$lib/backends';
 	import {
 		loadBackendSettings,
 		saveBackendSettings,
@@ -91,7 +91,7 @@
 	}
 
 	onMount(() => {
-		for (const id of BACKEND_IDS) {
+		for (const id of NATIVE_BACKEND_IDS) {
 			check(id);
 			envText[id] = formatEnvLines(settings.env[id]);
 		}
@@ -100,7 +100,7 @@
 			.catch(() => {});
 	});
 
-	const defaultOpts = $derived(BACKEND_IDS.map((id) => ({ value: id, label: BACKEND_LABELS[id] })));
+	const defaultOpts = $derived(NATIVE_BACKEND_IDS.map((id) => ({ value: id, label: BACKEND_LABELS[id] })));
 </script>
 
 <div class="group">
@@ -135,7 +135,7 @@
 	{/if}
 
 	<div class="blist">
-		{#each BACKEND_IDS as id (id)}
+		{#each NATIVE_BACKEND_IDS as id (id)}
 			{@const st = status[id]}
 			<div class="brow">
 				<span class="btile"><BackendIcon backend={id} size={16} /></span>
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 856e7e1..f0a5906 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -6,6 +6,9 @@ export interface Session {
 	chat: ChatState;
 	/** Engine backend driving this session (persisted; 'jucode' default). */
 	backendId: BackendId;
+	/** For 'acp' sessions: the registry id + display name of the launched agent
+	 *  (passed as the allowlisted `agent` spawn option on every (re)spawn). */
+	acpAgent?: { id: string; name: string };
 	/** Per-session adapter instance (stateful for codex/claude; not persisted). */
 	adapter: EngineAdapter;
 	/** Archived threads are hidden from the sidebar by default (persisted); the
@@ -39,4 +42,6 @@ export interface Project {
 	stale?: boolean;
 	/** 本项目最近一次新建会话所用的引擎后端（新建会话的默认值）。 */
 	lastBackend?: BackendId;
+	/** lastBackend 为 'acp' 时：上次选择的 ACP agent（注册表 id + 名称）。 */
+	lastAcpAgent?: { id: string; name: string };
 }
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index 17b2208..aa31999 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -1363,7 +1363,7 @@
 				modelTitle={pickerTitle}
 				modelSearch={showPickerSearch}
 				{backendLocked}
-				onBackend={(b) => store.switchBackend(activeId, b)}
+				onBackend={(b, acpAgent) => store.switchBackend(activeId, b, acpAgent)}
 				bind:pickerQuery
 				bind:pickerSelIdx={selIdx}
 				onEffort={chooseEffort}