ACP agents
Gitwright can connect to an agent that speaks the Agent Client Protocol (ACP). The agent is a separate process that you install and configure; the application is the client. Nothing is enabled until you add a profile and turn the assistant on.
The assistant is deliberately narrow. It reads and suggests. It cannot write files, stage, commit, push or run a terminal through the application.
Configuring a profile
A profile is a name plus a launch command:
| Field | Meaning |
|---|---|
| Name | Label shown in the profile picker |
| Command | Executable to launch, for example an agent binary on PATH |
| Arguments | Arguments passed to the command |
| Model | Optional model name passed to the agent; empty means the agent’s default |
| Environment variables | Variable names only. Values are stored in the OS keychain, not in settings.json. |
Several profiles can coexist, with one active at a time. An agent that requires a sign-in advertises its auth methods; the assistant panel offers them, including a copyable terminal command for CLI sign-in and the environment variable names for env_var methods.
The agent process inherits the application’s environment plus the configured variables. It runs with your user permissions.
What the agent can do
| Action | What it produces |
|---|---|
| Draft a commit message | Text for the message field, from the staged diff |
| Explain a diff | A plain-language walkthrough of the selected change |
| Review selected changes | A list of findings over the selected files |
| Review a branch | Findings over base...HEAD |
Commit messages follow a style setting: plain or Conventional Commits.
A draft only fills the message box. The commit runs when you press Cmd/Ctrl + Enter, like any other commit.
Send scope
Every request shows the scope before it is sent:
- The prompt text.
- The list of files, hunks or commits included.
- For a branch review, the base and head refs.
Nothing is sent until you confirm. Cancelling closes the request without launching the agent.
During a session, fs/readTextFile is restricted to the paths in the scope. Writes, terminal creation and terminal output are rejected by the client, and permission requests that would grant a write default to deny.
Receipts
When a review finishes, a receipt records what was sent and what came back: the scope, the commit range, the model, the time and the findings. Receipts are local and exist so that a review can be audited later, including by someone who was not sitting at the machine.
The trust boundary
The agent process is not an OS sandbox. It is a program you chose to run, with your account’s permissions. The application restricts what it exposes through ACP — no writes, no terminal — but it cannot stop the agent from doing anything its own process is otherwise able to do, including reading files it can already open and making network requests.
Practical consequences:
- Install agents you trust, from sources you trust.
- Prefer running agents inside a container or a dedicated user account if the code you review is sensitive.
- Read the send-scope list before confirming a request that includes proprietary code.
- Treat agent output as a suggestion written by an untrusted process, not as a verified change.
Disabling
Turn the assistant off in Settings, or remove the profile. Removing a profile deletes its keychain entries; it does not uninstall the agent binary.
Next
- MCP server — the other optional integration, for local automation.
- Changes — where a drafted message is used.
- Privacy — the network side of an agent request.