feat(acp): update agent-client-protocol 0.10.2→0.10.3, schema 0.11.2→0.11.3#2423
Merged
feat(acp): update agent-client-protocol 0.10.2→0.10.3, schema 0.11.2→0.11.3#2423
Conversation
…0.11.3 - Bump agent-client-protocol to 0.10.3 (schema 0.11.3 transitive) - Add unstable-logout capability: no-op handler for vault-based auth sessions, advertise auth.logout in initialize() capabilities - Add unstable-elicitation feature gate (schema types only, no SDK methods in 0.10.3) - Fix discovery endpoint: replace hardcoded "protocol_version": "0.9" string with acp::ProtocolVersion::LATEST (integer 1, correct ACP v1 wire format) - Fix Cargo feature antipattern: unstable features now use [features] passthrough only, removing hardcoded activation from [dependencies] - Add integration tests: logout capability advertisement, logout handler, discovery protocol_version field assertion - Fix tokio-tungstenite dev-dep missing "connect" feature (pre-existing regression) Closes #2411
github-actions
bot
added
documentation
bug-ops
added a commit
that referenced
this pull request
Mar 30, 2026
…PI duplication
- Populate InitializeResponse.auth_methods with [{type: agent, id: zeph}] using
the typed builder; previously returned authMethods: [] which blocked ACP Registry
inclusion (#2422)
- Serve GET /agent.json with agent identity manifest (id, name, version, description,
distribution) for ACP Registry discovery; gated on discovery_enabled (#2422)
- Extract apply_three_class_classifier_with_cfg and apply_causal_analyzer_with_cfg
helpers in agent_setup.rs; acp.rs now delegates instead of inlining construction
eliminating the DRY gap from #2369 (#2370)
- discovery.rs already reflects ProtocolVersion::LATEST since PR #2423 (#2412)
Closes #2422, closes #2370
4 tasks
bug-ops
added a commit
that referenced
this pull request
Mar 30, 2026
…PI duplication (#2431) - Populate InitializeResponse.auth_methods with [{type: agent, id: zeph}] using the typed builder; previously returned authMethods: [] which blocked ACP Registry inclusion (#2422) - Serve GET /agent.json with agent identity manifest (id, name, version, description, distribution) for ACP Registry discovery; gated on discovery_enabled (#2422) - Extract apply_three_class_classifier_with_cfg and apply_causal_analyzer_with_cfg helpers in agent_setup.rs; acp.rs now delegates instead of inlining construction eliminating the DRY gap from #2369 (#2370) - discovery.rs already reflects ProtocolVersion::LATEST since PR #2423 (#2412) Closes #2422, closes #2370
bug-ops
added a commit
that referenced
this pull request
Mar 30, 2026
…nt drop Closes #2437, closes #2438. - Extend `is_dangerous_env_var()` in `mcp_bridge.rs` to block PATH (path hijacking), HTTP_PROXY/HTTPS_PROXY/ALL_PROXY/NO_PROXY (proxy interception), BASH_ENV/ENV (shell startup injection), and PYTHONPATH/NODE_PATH/RUBYLIB (runtime module injection). These vars were not filtered by PR #2436. - Replace silent `return` in `AuditLogger::log()` with `tracing::error!("audit entry serialization failed: {err}")` so serialization failures are observable in logs instead of silently dropped. - Update and extend tests for both changes. Note: #2412 was already resolved in PR #2423 (ProtocolVersion::LATEST in discovery handler); CHANGELOG entry added only.
4 tasks
bug-ops
added a commit
that referenced
this pull request
Mar 30, 2026
…nt drop (#2446) Closes #2437, closes #2438. - Extend `is_dangerous_env_var()` in `mcp_bridge.rs` to block PATH (path hijacking), HTTP_PROXY/HTTPS_PROXY/ALL_PROXY/NO_PROXY (proxy interception), BASH_ENV/ENV (shell startup injection), and PYTHONPATH/NODE_PATH/RUBYLIB (runtime module injection). These vars were not filtered by PR #2436. - Replace silent `return` in `AuditLogger::log()` with `tracing::error!("audit entry serialization failed: {err}")` so serialization failures are observable in logs instead of silently dropped. - Update and extend tests for both changes. Note: #2412 was already resolved in PR #2423 (ProtocolVersion::LATEST in discovery handler); CHANGELOG entry added only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
agent-client-protocol0.10.2→0.10.3 (pullsagent-client-protocol-schema0.11.3 transitively)unstable-logoutfeature: no-oplogouthandler for vault-based stateless auth;auth.logoutcapability advertised ininitialize()unstable-elicitationfeature gate (schema types exposed; no SDK methods wired in 0.10.3 — documented in README)protocol_versionchanged from hardcoded string"0.9"toacp::ProtocolVersion::LATEST(integer1, correct ACP v1 wire format)zeph-acp: unstable features now flow exclusively through[features]passthrough, not hardcoded in[dependencies]protocol_versionfieldtokio-tungstenitedev-dep missingfeatures = ["connect"](pre-existing compilation regression with--all-features)Test plan
cargo +nightly fmt --check— passcargo clippy --workspace --features full -- -D warnings— pass (0 warnings)cargo nextest run --config-file .github/nextest.toml --workspace --features full --lib --bins— 7262 passed (4 new tests added)cargo check --all-features -p zeph-acp— passunstable-logoutdisabled path compiles (trait has default impl)Notes
protocol_versionJSON type change ("0.9"string →1integer) is a breaking wire-format fix aligning with ACP v1 specsession/listwas already stable in zeph-acp — no code change needed, README updatedadditional_directories(schema 0.11.4) deferred; schema 0.11.3 is what 0.10.3 pinsCloses #2411