muse-acp

muse-acp is a bridge that allows editors supporting the Agent Client Protocol (ACP) to use an existing Muse Code subscription. It communicates with Muse over its native Muse Session Protocol (MSP), preserving Muse's session engine, tools, authentication, and approval flow. The adapter is a single Rust binary with no runtime dependencies, supports ACP v1 and v2, and runs on macOS, Linux, and Windows. It is an independent community project, not affiliated with Meta Platforms, Inc.

The adapter provides a per-session Auto-review feature that sends permission requests to a reviewer agent instead of the user. The reviewer is a second Muse model session on a memory-only, read-only host, ensuring reviews are not saved and do not access files. It receives a safety policy, trusted instructions, recent evidence, and the approval request, then responds with strict JSON containing risk level, user authorization, outcome, and rationale. Low and medium risk actions proceed; critical risk is denied; high risk proceeds only if authorized by instructions. A reviewer failure or unusable answer denies the action. Every decision is logged to stderr with its rationale.

Auto-review is off by default and can be enabled per session via a selector in clients that render ACP configOptions. The adapter also supports read-only and plan modes, which are enforced by Muse through a separate muse serve instance with write and shell disabled. The adapter remembers each session's mode in a state file, so sessions resume in the same mode. It handles approval-profile compatibility by providing a private temporary settings view when Muse is saved with the :auto-review profile, ensuring approvals come to the editor without altering saved settings.