Add a packaged Claude ACP reference harness

[rgarcia]

Summary

• Package Claude ACP 0.75.1 and native Agent SDK 0.3.257 in both images with frozen dependency resolution.
• Add an independent declarative Claude preparer, native shared settings and stdio MCP defaults with credential bindings; retain existing revision/concurrency and connection lifetime machinery.
• Keep native state outside revisions and conversations entirely in ACP. Document supported native features, unsupported extensions/transports and reconnect limitations.

Validation

• All non-e2e Go packages pass under go test -race; go vet ./... passes.
• Native JS argument/environment tests and actual pinned ACP initialize/list/disconnect tests pass.
• Both image runtime stages and full headless image built locally.
• Bounded Haiku 4.5 gate passed on the final headless image: initial turn, shared/session-overridden MCP, independent processes, activation without restarting connections, stale writes, failed-preparation retention, disconnect termination, and fresh exact-ID list/load/history/model recall. Native model selection restored as haiku; shared MCP updated on load. The fixture verifies shared MCP does not inherit provider credentials.

Limitations

• Full headful image, ARM64, interactive OAuth, media, HTTP/SSE MCP, session/resume, cancellation during tool side effects, and platform gateway/TLS integration were not tested.
• Upstream session/list returns one terminal page; multi-page cursor handling is not implemented in 0.75.1.
• No live connection-owned processes remain after disconnect, but the image wrapper retains terminated native children as zombies; this shared reaping limitation is not changed here.
• Shared stdio bindings isolate environment inheritance; ACP-supplied native servers remain trusted code with upstream credential access.
• Existing CI workflow only automatically runs for PRs targeting main.

Integration surface

Shared-file changes are limited to Config/Handler registration, catalog, both Dockerfiles, CI runtime installation and README links. No shared API/transport/revision redesign or other harness adapter changes.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​anthropic-ai/​claude-agent-sdk@​0.3.257
	npm/​@​agentclientprotocol/​claude-agent-acp@​0.75.1
	npm/​@​agentclientprotocol/​sdk@​1.4.0

View full report