Summary

ACP prompt handling currently swaps tools.terminal_tool._approval_callback globally during a session run.

Verified current behavior

• acp_adapter/server.py installs a per-session ACP approval callback into the process-global terminal callback before running the agent and restores it afterward.
• The callback itself correctly fails closed for unknown/timeout/error outcomes (acp_adapter/permissions.py), but the installation model is still global.

Why this matters

• Overlapping ACP sessions can interfere with each other.
• Global callback swapping is hard to reason about and difficult to test under concurrency.
• This is a design-hardening problem, not a simple one-line bugfix.

Scope

• Make approval routing session-local or task-local instead of process-global.
• Preserve existing single-session ACP behavior.
• Add explicit concurrency coverage.

Non-goals

• Do not change the approval UX or outcome mapping in the same change.
• Do not bundle unrelated ACP/MCP work into this issue.

Acceptance criteria

• Concurrent ACP sessions do not bleed approval callbacks across runs.
• Single-session behavior remains compatible with existing ACP clients.
• Regression tests cover at least two overlapping approval flows.