From d6e3ff2ebe750aa0c0f17077ea9f207a675f0a63 Mon Sep 17 00:00:00 2001
From: Brett Chien <brettchien@users.noreply.github.com>
Date: Sat, 29 Aug 2026 16:49:11 +0800
Subject: [PATCH] feat(console,studio-cp,oab-mcp,src-tauri): New Fleet wizard
 Step 2 rewrite (studio#128)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the Template/Overlay compose-library step (empty on every fresh
install by design, blocking the whole deploy flow — the original #119
screenshot that started this) with the vendor + chat platform + ACP flow
confirmed with Brett across #128's design thread.

## Console (items 1-5 of the runbook, shipped together — all fields live
on the same new Step 2 screen)

- Vendor <select>: Claude/codex/agy/cursor/kiro. "agy" is only the display
  label — the option value is "antigravity" (the GHCR image variant /
  Dockerfile.package build-target name resolve_vendor_image_tags expects).
- Image tag: pre-filled from resolve_vendor_image_tags (#131) — Stable if
  GHCR confirms it exists, else Beta (pre-beta-<vendor>), else left for
  manual entry. Always editable — no lookup failure blocks the field.
- API key (optional): captured, stored as a secret server-side; not yet
  wired into config.toml (documented gap from #129, unchanged here).
- Chat platform (optional, default none — "use ACP directly"):
  Discord/Telegram/LINE, reveals the right token field(s) per platform.
  k8s deploys refuse a non-empty selection both client-side (clean
  validation message) and server-side (#129's existing refusal) — config.toml
  secret resolution needs AWS credentials a k8s pod doesn't have.
- Enable ACP checkbox: default checked, forced off + disabled for
  vendor=agy (its bridge bypasses openab-gateway's /acp route entirely).
- Agent name: pre-filled with a random Greek god name, shuffle button to
  re-roll, still freely editable.
- No separate "Preview bundle" step anymore — fill in the fields, Deploy.

## Backend: acp_enabled made caller-controlled (was hardcoded true in #127)

#127 hardcoded `acp_enabled: Some(true)` inside build_default_manifest /
build_default_k8s_manifest with no way for a caller to turn it off — fine
when nothing exposed a toggle, not fine once the wizard has an actual
checkbox (needed for the agy case above). Both functions, and
AgentWizardInput, now take `acp_enabled: bool` explicitly:
- studio-cp: build_default_manifest/build_default_k8s_manifest gained an
  `acp_enabled: bool` param — only generates the ACP auth secret when true.
  provision_from_library[_k8s] (the older compose-library path, unrelated
  to this wizard) pass `true` at their call sites, preserving #127's
  original unconditional-on behavior there unchanged.
- oab-mcp: deploy_provision_agent's schema gained `acp_enabled: boolean`,
  defaulting to true when the caller omits it (same default #127 had,
  now explicit and overridable instead of baked in).
- src-tauri: bridge command threads the new param through.

Ref #128.
---
 console/index.html          |  69 ++++++++---
 console/src/deploy.ts       | 236 ++++++++++++++++++++++--------------
 console/src/styles.css      |  12 ++
 crates/oab-mcp/src/lib.rs   |   5 +
 crates/studio-cp/src/lib.rs |  63 ++++++++--
 src-tauri/src/lib.rs        |   4 +
 6 files changed, 265 insertions(+), 124 deletions(-)

diff --git a/console/index.html b/console/index.html
index e1dada7..0802a80 100644
--- a/console/index.html
+++ b/console/index.html
@@ -139,33 +139,62 @@
               </div>
             </form>
             <div id="deploy-compose" class="deploy-compose" hidden>
-              <div class="deploy-compose-head" id="deploy-compose-heading">Compose</div>
-              <form id="deploy-form" class="compose-form" autocomplete="off">
+              <div class="deploy-compose-head" id="deploy-compose-heading">Step 2 — first instance</div>
+              <form id="deploy-agent-form" class="compose-form" autocomplete="off">
                 <label
-                  >Template
-                  <select id="deploy-template" class="compose-select"></select>
+                  >Vendor
+                  <select id="deploy-vendor" class="compose-select">
+                    <option value="claude">Claude</option>
+                    <option value="codex">codex</option>
+                    <!-- "antigravity" is the GHCR image variant / resolve_vendor_image_tags
+                         key (Dockerfile.package's build target name) — "agy" is only the
+                         display label here, per Brett's vendor naming. -->
+                    <option value="antigravity">agy</option>
+                    <option value="cursor">cursor</option>
+                    <option value="kiro">kiro</option>
+                  </select>
                 </label>
                 <label
-                  >Overlay
-                  <select id="deploy-overlay" class="compose-select">
-                    <option value="">— none (bare template) —</option>
-                  </select>
+                  >Image tag
+                  <input id="deploy-image" class="compose-input" type="text" placeholder="resolving…" spellcheck="false" />
                 </label>
-                <div class="compose-actions">
-                  <button type="submit" id="deploy-preview-btn">Preview bundle</button>
-                  <span class="compose-status" id="deploy-status"></span>
-                </div>
-              </form>
-              <div id="deploy-preview" class="compose-preview"></div>
-              <form id="deploy-deploy-form" class="compose-deploy" autocomplete="off" hidden>
-                <div class="compose-deploy-head">Deploy to ECS</div>
                 <label
-                  >Agent name
-                  <input id="deploy-name" class="compose-input" type="text" placeholder="e.g. agent-3" spellcheck="false" />
+                  >API key (optional)
+                  <input id="deploy-api-key" class="compose-input" type="password" placeholder="vendor API key" spellcheck="false" autocomplete="off" />
                 </label>
+                <p class="config-hint" id="deploy-device-auth-hint" hidden>
+                  This vendor uses device-auth login — finish it after the agent is up.
+                </p>
                 <label
-                  >Image tag
-                  <input id="deploy-image" class="compose-input" type="text" placeholder="(bundle default)" spellcheck="false" />
+                  >Chat platform (optional)
+                  <select id="deploy-chat-platform" class="compose-select">
+                    <option value="">— none (use ACP directly) —</option>
+                    <option value="discord">Discord</option>
+                    <option value="telegram">Telegram</option>
+                    <option value="line">LINE</option>
+                  </select>
+                </label>
+                <label id="deploy-chat-token-wrap" hidden
+                  >Bot token
+                  <input id="deploy-chat-token" class="compose-input" type="password" spellcheck="false" autocomplete="off" />
+                </label>
+                <label id="deploy-chat-secret-wrap" hidden
+                  >Channel secret
+                  <input id="deploy-chat-secret" class="compose-input" type="password" spellcheck="false" autocomplete="off" />
+                </label>
+                <label class="compose-checkbox-row"
+                  ><input id="deploy-acp-enabled" type="checkbox" checked />
+                  Enable ACP
+                </label>
+                <p class="config-hint" id="deploy-acp-agy-hint" hidden>
+                  agy doesn't support ACP — disabled for this vendor.
+                </p>
+                <label
+                  >Agent name
+                  <span class="compose-name-row">
+                    <input id="deploy-name" class="compose-input" type="text" spellcheck="false" />
+                    <button type="button" id="deploy-name-shuffle" class="cfg-btn cfg-btn-ghost" title="Shuffle name">🔀</button>
+                  </span>
                 </label>
                 <div class="compose-actions">
                   <button type="submit" id="deploy-deploy-btn">Deploy</button>
diff --git a/console/src/deploy.ts b/console/src/deploy.ts
index bea90f0..e87710e 100644
--- a/console/src/deploy.ts
+++ b/console/src/deploy.ts
@@ -1,15 +1,18 @@
-// The deploy action panel (ADR #83 §7.5): `[+ New fleet]` (7.2) and `[+ Add
-// instance]` (7.3) both land here — the same compose→preview→deploy engine
-// (agent-deployment-templates.md, reused via `compose.ts`'s exported pure
-// helpers), differing only in whether a fleet-identity step runs first.
+// The deploy action panel (ADR #83 §7.5, redesigned per studio#128):
+// `[+ New fleet]` (7.2) and `[+ Add instance]` (7.3) both land here —
+// vendor + optional API key + optional chat platform + ACP toggle compose
+// config.toml server-side (`deploy_provision_agent`, studio-cp's
+// `generate_agent_config`) — differing only in whether a fleet-identity
+// step runs first. No compose library / template ⊕ overlay involved
+// anymore (that path — `compose.ts`, `deploy_provision` — still exists for
+// anything still using it, just not this wizard).
 //
-// After a successful `deploy_provision`, this module computes the updated
-// `fleets.toml` text (`fleetToml.ts`, pure) and persists it via
+// After a successful `deploy_provision_agent`, this module computes the
+// updated `fleets.toml` text (`fleetToml.ts`, pure) and persists it via
 // `source.writeFleetConfig` — per the ADR, `fleets.toml` is only ever mutated
 // after a confirmed successful provision, never before or speculatively.
 
 import type { Source } from "./source";
-import { libraryNames, renderPreviewHtml, type Library, type BundlePreview } from "./compose";
 import { appendMember, appendFleetBlock } from "./fleetToml";
 import { appendK8sFleetBlock } from "./fleetsK8sToml";
 
@@ -32,12 +35,6 @@ function escapeHtml(s: string): string {
     .replace(/"/g, "&quot;");
 }
 
-function fillOptions(sel: HTMLSelectElement, names: string[], keepNoneFirst: boolean): void {
-  const opts = keepNoneFirst ? ['<option value="">— none (bare template) —</option>'] : [];
-  for (const n of names) opts.push(`<option value="${escapeHtml(n)}">${escapeHtml(n)}</option>`);
-  sel.innerHTML = opts.join("");
-}
-
 // list_k8s_contexts / list_namespaces response shapes (oab-mcp, studio#104) —
 // kept minimal (just what this panel reads), not the tools' full contract.
 interface K8sContextsResponse {
@@ -50,6 +47,25 @@ interface K8sNamespacesResponse {
 interface K8sServiceAccountsResponse {
   service_accounts: string[];
 }
+interface VendorImageTagsResponse {
+  beta: string | null;
+  stable: string | null;
+}
+
+// Vendors known to use an interactive device-auth login (`<cli> login
+// --device-auth`/`--use-device-flow`) rather than a static API key — can't
+// be completed from this wizard, has to happen after the agent is up.
+const DEVICE_AUTH_VENDORS = new Set(["codex", "kiro"]);
+
+// studio#128: pre-fills the Agent name field; still freely editable.
+const GREEK_GODS = [
+  "Zeus", "Hera", "Poseidon", "Demeter", "Athena", "Apollo", "Artemis", "Ares",
+  "Aphrodite", "Hephaestus", "Hermes", "Dionysus", "Hades", "Hestia", "Persephone",
+  "Hypnos", "Nike", "Iris", "Eros", "Pan",
+];
+function randomGreekName(): string {
+  return GREEK_GODS[Math.floor(Math.random() * GREEK_GODS.length)];
+}
 
 export type DeployMode = { kind: "new-fleet" } | { kind: "add-instance"; fleetName: string };
 
@@ -112,14 +128,20 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
   const identityStatusEl = document.getElementById("deploy-identity-status");
   const composeSection = document.getElementById("deploy-compose");
   const composeHeading = document.getElementById("deploy-compose-heading");
-  const tmplSel = document.getElementById("deploy-template") as HTMLSelectElement | null;
-  const ovlSel = document.getElementById("deploy-overlay") as HTMLSelectElement | null;
-  const previewForm = document.getElementById("deploy-form") as HTMLFormElement | null;
-  const previewOut = document.getElementById("deploy-preview");
-  const previewStatusEl = document.getElementById("deploy-status");
-  const deployForm = document.getElementById("deploy-deploy-form") as HTMLFormElement | null;
-  const agentNameInput = document.getElementById("deploy-name") as HTMLInputElement | null;
+  const deployForm = document.getElementById("deploy-agent-form") as HTMLFormElement | null;
+  const vendorSel = document.getElementById("deploy-vendor") as HTMLSelectElement | null;
   const imageInput = document.getElementById("deploy-image") as HTMLInputElement | null;
+  const apiKeyInput = document.getElementById("deploy-api-key") as HTMLInputElement | null;
+  const deviceAuthHint = document.getElementById("deploy-device-auth-hint");
+  const chatPlatformSel = document.getElementById("deploy-chat-platform") as HTMLSelectElement | null;
+  const chatTokenWrap = document.getElementById("deploy-chat-token-wrap");
+  const chatTokenInput = document.getElementById("deploy-chat-token") as HTMLInputElement | null;
+  const chatSecretWrap = document.getElementById("deploy-chat-secret-wrap");
+  const chatSecretInput = document.getElementById("deploy-chat-secret") as HTMLInputElement | null;
+  const acpCheckbox = document.getElementById("deploy-acp-enabled") as HTMLInputElement | null;
+  const acpAgyHint = document.getElementById("deploy-acp-agy-hint");
+  const agentNameInput = document.getElementById("deploy-name") as HTMLInputElement | null;
+  const agentNameShuffleBtn = document.getElementById("deploy-name-shuffle") as HTMLButtonElement | null;
   const deployBtn = document.getElementById("deploy-deploy-btn") as HTMLButtonElement | null;
   const deployStatusEl = document.getElementById("deploy-deploy-status");
 
@@ -140,19 +162,26 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     !k8sNamespaceNewInput ||
     !k8sServiceAccountSel ||
     !composeSection ||
-    !tmplSel ||
-    !ovlSel ||
-    !previewForm ||
     !deployForm ||
-    !agentNameInput ||
+    !vendorSel ||
     !imageInput ||
+    !apiKeyInput ||
+    !deviceAuthHint ||
+    !chatPlatformSel ||
+    !chatTokenWrap ||
+    !chatTokenInput ||
+    !chatSecretWrap ||
+    !chatSecretInput ||
+    !acpCheckbox ||
+    !acpAgyHint ||
+    !agentNameInput ||
+    !agentNameShuffleBtn ||
     !deployBtn
   ) {
     return null;
   }
 
   let mode: DeployMode | null = null;
-  let library: Library | null = null;
 
   const setStatus = (el: HTMLElement | null, msg: string, cls = ""): void => {
     if (!el) return;
@@ -160,20 +189,70 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     el.className = cls ? `compose-status ${cls}` : "compose-status";
   };
 
+  // studio#128: which chat-token field(s) apply depends on the platform —
+  // Discord/Telegram need just a bot token, LINE needs both a channel
+  // access token *and* a channel secret. "— none —" needs neither (ACP is
+  // the connection path).
+  const applyChatPlatformMode = (): void => {
+    const platform = chatPlatformSel.value;
+    chatTokenWrap.hidden = platform === "";
+    chatSecretWrap.hidden = platform !== "line";
+    if (platform === "") {
+      chatTokenInput.value = "";
+      chatSecretInput.value = "";
+    }
+  };
+
+  // studio#128: agy's bridge bypasses openab-gateway's /acp route entirely
+  // (confirmed by reading agy-acp/src/main.rs) — forced off, not just
+  // defaulted off, so a leftover checked state from a previous vendor can't
+  // silently carry through to a vendor that can't honor it. Device-auth
+  // vendors (codex/kiro) get an inline note since the API key field can't
+  // help them — that login has to happen after the agent is up.
+  const applyVendorMode = (): void => {
+    const vendor = vendorSel.value;
+    const isAgy = vendor === "antigravity";
+    acpCheckbox.disabled = isAgy;
+    acpAgyHint.hidden = !isAgy;
+    if (isAgy) acpCheckbox.checked = false;
+    deviceAuthHint.hidden = !DEVICE_AUTH_VENDORS.has(vendor);
+  };
+
+  // studio#128: pre-fills Image tag from GHCR's actually-published tags for
+  // the selected vendor — prefers Stable, falls back to Beta, and leaves
+  // the field for manual entry if neither resolved (a failed GHCR/GitHub
+  // call, or a vendor with no published image yet — never blocks the
+  // field, per Brett: "Image tag is allow to be manually input by user").
+  const loadVendorImage = async (): Promise<void> => {
+    const invoke = tauriInvoke();
+    if (!invoke) return;
+    const vendor = vendorSel.value;
+    imageInput.placeholder = "resolving…";
+    try {
+      const res = await invoke<VendorImageTagsResponse>("resolve_vendor_image_tags", { vendor });
+      const resolved = res.stable ?? res.beta;
+      if (resolved) imageInput.value = resolved;
+      imageInput.placeholder = resolved ?? "e.g. pre-beta-" + vendor;
+    } catch (e) {
+      imageInput.placeholder = "e.g. pre-beta-" + vendor;
+      setStatus(deployStatusEl, `image tag lookup unavailable: ${errText(e)}`, "err");
+    }
+  };
+
   const reset = (): void => {
     identityForm.reset();
-    previewForm.reset();
     deployForm.reset();
-    deployForm.hidden = true;
-    if (previewOut) previewOut.innerHTML = "";
     setStatus(identityStatusEl, "");
-    setStatus(previewStatusEl, "");
     setStatus(deployStatusEl, "");
     // identityForm.reset() puts <select id="deploy-provider"> back to its
     // `selected` default ("aws"), but doesn't touch the field-group `hidden`
     // attributes this panel manages by hand — sync those too.
     showProviderFields(providerSel.value);
     applyNamespaceMode();
+    applyChatPlatformMode();
+    applyVendorMode();
+    agentNameInput.value = randomGreekName();
+    void loadVendorImage();
   };
 
   // studio#119: the namespace <select>'s "+ Create new namespace…" sentinel
@@ -299,21 +378,14 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
   // tool call per character typed into the new-namespace field.
   k8sNamespaceNewInput.addEventListener("change", () => void loadK8sServiceAccounts());
 
-  const loadLibraryAndPickers = async (): Promise<void> => {
-    const invoke = tauriInvoke();
-    if (!invoke) {
-      setStatus(previewStatusEl, "browser build — deploy unavailable");
-      return;
-    }
-    try {
-      library = await invoke<Library>("compose_library_get");
-      const { templates, overlays } = libraryNames(library);
-      fillOptions(tmplSel, templates, false);
-      fillOptions(ovlSel, overlays, true);
-    } catch (e) {
-      setStatus(previewStatusEl, `library load failed: ${errText(e)}`, "err");
-    }
-  };
+  vendorSel.addEventListener("change", () => {
+    applyVendorMode();
+    void loadVendorImage();
+  });
+  chatPlatformSel.addEventListener("change", applyChatPlatformMode);
+  agentNameShuffleBtn.addEventListener("click", () => {
+    agentNameInput.value = randomGreekName();
+  });
 
   const open = (m: DeployMode): void => {
     mode = m;
@@ -331,7 +403,6 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     if (configEl) configEl.hidden = true;
     if (fleetDetailEl) fleetDetailEl.hidden = true;
     wrap.hidden = false;
-    void loadLibraryAndPickers();
   };
 
   const close = (): void => {
@@ -356,55 +427,25 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     if (composeHeading) composeHeading.textContent = "Step 2 — first instance";
   });
 
-  previewForm.addEventListener("submit", async (ev) => {
-    ev.preventDefault();
-    const invoke = tauriInvoke();
-    if (!invoke || !library) {
-      setStatus(previewStatusEl, "deploy unavailable", "err");
-      return;
-    }
-    const template = tmplSel.value;
-    if (!template) {
-      setStatus(previewStatusEl, "pick a template to preview", "err");
-      return;
-    }
-    const overlay = ovlSel.value || null;
-    setStatus(previewStatusEl, "composing…");
-    try {
-      const preview = await invoke<BundlePreview>("compose_preview", { library, template, overlay });
-      if (previewOut) previewOut.innerHTML = renderPreviewHtml(preview);
-      setStatus(previewStatusEl, `composed — ${preview.files.length} files`, "ok");
-      deployForm.hidden = false;
-      if (!agentNameInput.value) agentNameInput.value = overlay ?? template;
-      imageInput.placeholder = preview.image_tag;
-      setStatus(deployStatusEl, "");
-    } catch (e) {
-      if (previewOut) previewOut.innerHTML = "";
-      deployForm.hidden = true;
-      setStatus(previewStatusEl, `compose failed: ${errText(e)}`, "err");
-    }
-  });
-
-  // The failure rule from 7.5.1/7.5.2: if `deploy_provision` fails, stop — no
-  // `fleet_config_write` call, `fleets.toml` is untouched.
+  // The failure rule from 7.5.1/7.5.2: if `deploy_provision_agent` fails,
+  // stop — no `fleet_config_write` call, `fleets.toml` is untouched.
   deployForm.addEventListener("submit", async (ev) => {
     ev.preventDefault();
     const invoke = tauriInvoke();
-    if (!invoke || !library || !mode) {
+    if (!invoke || !mode) {
       setStatus(deployStatusEl, "deploy unavailable", "err");
       return;
     }
-    const template = tmplSel.value;
     const name = agentNameInput.value.trim();
-    if (!template) {
-      setStatus(deployStatusEl, "preview a template first", "err");
-      return;
-    }
     if (!name) {
       setStatus(deployStatusEl, "agent name is required", "err");
       return;
     }
-    const overlay = ovlSel.value || null;
+    const image = imageInput.value.trim();
+    if (!image) {
+      setStatus(deployStatusEl, "image tag is required", "err");
+      return;
+    }
     // Only "new-fleet" ever reaches provider "k8s" — identityForm (where the
     // provider <select> lives) is skipped for "add-instance", and reset()
     // (run on every open()) puts the <select> back to its "aws" default, so
@@ -415,24 +456,37 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     const namespace = isK8s ? currentNamespace() || "default" : "default";
     const context = isK8s ? k8sContextSel.value || undefined : undefined;
     const serviceAccount = isK8s ? k8sServiceAccountSel.value : "";
-    // studio-cp's provision_from_library_k8s expects the full
+    // studio-cp's provision_agent_k8s expects the full
     // `system:serviceaccount:<ns>:<name>` form (it extracts the bare name
     // itself) — same shape as K8sFleetBinding.expected_principal.
     const expectedPrincipal = serviceAccount
       ? `system:serviceaccount:${namespace}:${serviceAccount}`
       : undefined;
-    const image = imageInput.value.trim() || null;
+    const chatPlatform = chatPlatformSel.value || undefined;
+    // k8s deploys refuse a chat platform server-side (config.toml secret
+    // resolution needs AWS credentials a k8s pod doesn't have) — check here
+    // too so the failure reads as a validation message, not a deploy error.
+    if (isK8s && chatPlatform) {
+      setStatus(
+        deployStatusEl,
+        "chat platform integration isn't available for k8s deploys yet — use ACP, or switch Provider to AWS",
+        "err",
+      );
+      return;
+    }
     deployBtn.disabled = true;
     setStatus(deployStatusEl, "deploying…");
     let res: { image?: string; digest?: string; objects?: number };
     try {
-      res = await invoke("deploy_provision", {
-        library,
-        template,
-        overlay,
+      res = await invoke("deploy_provision_agent", {
+        image,
         name,
         namespace,
-        image,
+        api_key: apiKeyInput.value.trim() || undefined,
+        chat_platform: chatPlatform,
+        chat_bot_token: chatTokenInput.value.trim() || undefined,
+        chat_channel_secret: chatSecretInput.value.trim() || undefined,
+        acp_enabled: acpCheckbox.checked,
         ...(isK8s ? { provider: "k8s", context, expected_principal: expectedPrincipal } : {}),
       });
     } catch (e) {
@@ -477,7 +531,7 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
       return;
     }
     deployBtn.disabled = false;
-    const info: DeployedInfo = { fleetName, service, image: res.image ?? image ?? template };
+    const info: DeployedInfo = { fleetName, service, image: res.image ?? image };
     close();
     await deps.onDeployed(info);
   });
diff --git a/console/src/styles.css b/console/src/styles.css
index 03ec2d3..0af8a95 100644
--- a/console/src/styles.css
+++ b/console/src/styles.css
@@ -1305,6 +1305,18 @@ button.act:disabled {
   color: var(--text);
   font: inherit;
 }
+.compose-form label.compose-checkbox-row {
+  flex-direction: row;
+  align-items: center;
+  gap: 6px;
+}
+.compose-name-row {
+  display: flex;
+  gap: 8px;
+}
+.compose-name-row .compose-input {
+  flex: 1;
+}
 .compose-actions button {
   padding: 6px 12px;
   border: 1px solid var(--border);
diff --git a/crates/oab-mcp/src/lib.rs b/crates/oab-mcp/src/lib.rs
index e08ae05..87e0c04 100644
--- a/crates/oab-mcp/src/lib.rs
+++ b/crates/oab-mcp/src/lib.rs
@@ -178,6 +178,7 @@ pub fn tools() -> Vec<Tool> {
                     "chat_platform": { "type": "string", "description": "Optional: \"discord\" | \"telegram\" | \"line\". Omit for no chat platform (connect via ACP directly). AWS only — refused for k8s deploys." },
                     "chat_bot_token": { "type": "string", "description": "Discord/Telegram bot token, or LINE's channel access token." },
                     "chat_channel_secret": { "type": "string", "description": "LINE only." },
+                    "acp_enabled": { "type": "boolean", "description": "Enable the reverse-MCP-over-ACP tunnel on this agent. Defaults to true when omitted (studio#119: Studio-deployed agents default to ACP on). Not honorable for every vendor — the caller is responsible for not setting this true for a vendor that can't support it (e.g. agy, whose bridge bypasses /acp entirely)." },
                     "provider": { "type": "string", "description": "\"aws\" (default) or \"k8s\" — which driver applies the result." },
                     "fleet": { "type": "string", "description": "AWS only. Fleet name (see fleet_config): targets the fleet's cluster and managing credential; a write to a service outside the fleet's members is refused. Overrides the cluster arg." },
                     "cluster": { "type": "string", "description": "AWS only. ECS cluster (defaults to the server's configured cluster)." },
@@ -731,6 +732,10 @@ impl OabMcp {
                 .get("chat_channel_secret")
                 .and_then(Value::as_str)
                 .map(str::to_string),
+            // studio#119: default on when the caller doesn't say — matches
+            // build_default_manifest's original hardcoded behavior before
+            // studio#128 made it caller-controlled.
+            acp_enabled: args.get("acp_enabled").and_then(Value::as_bool).unwrap_or(true),
         };
 
         if args.get("provider").and_then(Value::as_str) == Some("k8s") {
diff --git a/crates/studio-cp/src/lib.rs b/crates/studio-cp/src/lib.rs
index 36e7529..ba71823 100644
--- a/crates/studio-cp/src/lib.rs
+++ b/crates/studio-cp/src/lib.rs
@@ -1086,21 +1086,26 @@ async fn provision_acp_auth_secret(
 /// networking from `oabctl::create::default_networking` (same discovery
 /// `oabctl create`'s CLI wizard uses, minus the interactive prompts),
 /// resources 256/512 (the CLI wizard's own default), `FARGATE`/`X86_64`
-/// (the schema's own `#[serde(default)]` values), no ingress. ACP defaults
-/// to enabled (studio#119 follow-up) — `secrets` carries the generated
-/// `OPENAB_ACP_AUTH_KEY` this needs, so it's no longer always empty.
+/// (the schema's own `#[serde(default)]` values), no ingress. `acp_enabled`
+/// (studio#119 follow-up, studio#128 made it caller-controlled instead of
+/// hardcoded — agy can't honor it) — when true, `secrets` carries the
+/// generated `OPENAB_ACP_AUTH_KEY` this needs; when false, no ACP secret is
+/// generated at all, nothing to clean up.
 async fn build_default_manifest(
     aws_config: &aws_config::SdkConfig,
     namespace: &str,
     name: &str,
     image: &str,
     bucket: &str,
+    acp_enabled: bool,
 ) -> anyhow::Result<oabctl::manifest::OABServiceManifest> {
     let net = oabctl::create::default_networking(aws_config, name).await?;
     let config_from = default_config_from_uri(bucket, namespace, name);
-    let acp_auth_ref = provision_acp_auth_secret(aws_config, namespace, name).await?;
     let mut secrets = std::collections::HashMap::new();
-    secrets.insert("OPENAB_ACP_AUTH_KEY".to_string(), acp_auth_ref);
+    if acp_enabled {
+        let acp_auth_ref = provision_acp_auth_secret(aws_config, namespace, name).await?;
+        secrets.insert("OPENAB_ACP_AUTH_KEY".to_string(), acp_auth_ref);
+    }
     Ok(oabctl::manifest::OABServiceManifest {
         api_version: "oab.dev/v2".to_string(),
         kind: "OABService".to_string(),
@@ -1130,7 +1135,7 @@ async fn build_default_manifest(
                 },
             }),
             ingress: None,
-            acp_enabled: Some(true),
+            acp_enabled: Some(acp_enabled),
         },
     })
 }
@@ -1210,7 +1215,11 @@ pub async fn provision_from_library(
             .await?
         }
         None => {
-            let mut manifest = build_default_manifest(aws_config, namespace, name, &image, &bucket).await?;
+            // studio#119's original default — always on — unchanged for this
+            // (compose-library) path; the caller-controlled toggle is
+            // studio#128's wizard-only `provision_agent`.
+            let mut manifest =
+                build_default_manifest(aws_config, namespace, name, &image, &bucket, true).await?;
             manifest.spec.bundle_from = Some(oabctl::studio_api::bundle_from_uri(&bucket, namespace, name));
             oabctl::studio_api::provision_manifest(aws_config, cluster, &manifest, &objects, Some(&bucket))
                 .await?
@@ -1253,6 +1262,13 @@ pub struct AgentWizardInput {
     pub chat_bot_token: Option<String>,
     /// LINE only.
     pub chat_channel_secret: Option<String>,
+    /// studio#128: caller-controlled, no reliance on `#[derive(Default)]`'s
+    /// `false` — the MCP tool layer defaults this to `true` when absent
+    /// from the caller's args (Brett: enable ACP by default), this struct
+    /// itself has no opinion. `provision_agent_k8s` still refuses a
+    /// non-empty `chat_platform` regardless of this field — unrelated
+    /// constraints.
+    pub acp_enabled: bool,
 }
 
 /// Stores [`AgentWizardInput`]'s secret-bearing fields in the same
@@ -1457,7 +1473,8 @@ pub async fn provision_agent(
             .await?
         }
         None => {
-            let mut manifest = build_default_manifest(aws_config, namespace, name, image, &bucket).await?;
+            let mut manifest =
+                build_default_manifest(aws_config, namespace, name, image, &bucket, input.acp_enabled).await?;
             manifest.spec.bundle_from = Some(oabctl::studio_api::bundle_from_uri(&bucket, namespace, name));
             oabctl::studio_api::provision_manifest(aws_config, cluster, &manifest, &objects, Some(&bucket))
                 .await?
@@ -1541,7 +1558,18 @@ pub async fn provision_agent_k8s(
             stored.spec.image = image.to_string();
             stored
         }
-        None => build_default_k8s_manifest(context, namespace, name, image, &bucket, expected_principal).await?,
+        None => {
+            build_default_k8s_manifest(
+                context,
+                namespace,
+                name,
+                image,
+                &bucket,
+                expected_principal,
+                input.acp_enabled,
+            )
+            .await?
+        }
     };
     manifest.spec.bundle_from = Some(oabctl::studio_api::bundle_from_uri(&bucket, namespace, name));
 
@@ -1635,11 +1663,14 @@ async fn build_default_k8s_manifest(
     image: &str,
     bucket: &str,
     expected_principal: Option<&str>,
+    acp_enabled: bool,
 ) -> anyhow::Result<oabctl::manifest::OABServiceManifest> {
     let config_from = default_config_from_uri(bucket, namespace, name);
-    let acp_auth_ref = provision_acp_auth_k8s_secret(context, namespace, name).await?;
     let mut secrets = std::collections::HashMap::new();
-    secrets.insert("OPENAB_ACP_AUTH_KEY".to_string(), acp_auth_ref);
+    if acp_enabled {
+        let acp_auth_ref = provision_acp_auth_k8s_secret(context, namespace, name).await?;
+        secrets.insert("OPENAB_ACP_AUTH_KEY".to_string(), acp_auth_ref);
+    }
     Ok(oabctl::manifest::OABServiceManifest {
         api_version: "oab.dev/v2".to_string(),
         kind: "OABService".to_string(),
@@ -1664,7 +1695,7 @@ async fn build_default_k8s_manifest(
                 tolerations: Vec::new(),
             }),
             ingress: None,
-            acp_enabled: Some(true),
+            acp_enabled: Some(acp_enabled),
         },
     })
 }
@@ -1729,7 +1760,13 @@ pub async fn provision_from_library_k8s(
             stored.spec.image = image.clone();
             stored
         }
-        None => build_default_k8s_manifest(context, namespace, name, &image, &bucket, expected_principal).await?,
+        // studio#119's original default — always on — unchanged for this
+        // (compose-library) path; the caller-controlled toggle is
+        // studio#128's wizard-only `provision_agent_k8s`.
+        None => {
+            build_default_k8s_manifest(context, namespace, name, &image, &bucket, expected_principal, true)
+                .await?
+        }
     };
     manifest.spec.bundle_from = Some(oabctl::studio_api::bundle_from_uri(&bucket, namespace, name));
 
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index a66c807..c5ef653 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -192,6 +192,7 @@ async fn deploy_provision_agent(
     chat_platform: Option<String>,
     chat_bot_token: Option<String>,
     chat_channel_secret: Option<String>,
+    acp_enabled: Option<bool>,
     cluster: Option<String>,
     provider: Option<String>,
     context: Option<String>,
@@ -225,6 +226,9 @@ async fn deploy_provision_agent(
     if let Some(s) = chat_channel_secret.filter(|s| !s.is_empty()) {
         params["chat_channel_secret"] = json!(s);
     }
+    if let Some(a) = acp_enabled {
+        params["acp_enabled"] = json!(a);
+    }
     if let Some(p) = provider.filter(|s| !s.is_empty()) {
         params["provider"] = json!(p);
     }