489a287d6f
Wires the ACP runtime plugin into the published CLI (RUNTIME_PLUGIN_IDS in tsup.config) and the on-demand BUILTIN_PLUGINS catalog (experimental), matching the untrusted-subprocess security posture. Adds the Risk S1 default-policy safety: an acpAllowUnrestricted acknowledgement (default false) — without it, a blanket allow on a sensitive category is escalated to approval rather than auto-approved under the allow-all default policy, applied in both the permission floor and fs write gating. Adds docs/acp-contract.md (launch/readiness + failure taxonomy), a README with the AGENTS.md-required upstream evidence (SDK repo/docs/release/integrity), a bundle-output test for the staged plugin, and a @runfusion/fusion minor changeset. Package green at 179 tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
911 B
@runfusion/fusion
| @runfusion/fusion |
|---|
| minor |
Add an ACP (Agent Client Protocol) client runtime plugin (runtimeId: "acp")
that drives any external ACP-compatible agent over JSON-RPC/stdio, built on the
official @agentclientprotocol/sdk. Installed on demand (experimental).
The agent runs as an untrusted subprocess that calls back into Fusion, so the
integration ships a defense-in-depth security floor: per-category permission
gating against the live policy (never a preset shortcut; allow_once only;
unmappable kinds and missing policy default-deny), an unrestricted-risk
acknowledgement that escalates blanket allows to approval under the allow-all
default, an opt-in filesystem capability behind a real symlink-resolving cwd jail
(realpath + O_NOFOLLOW, secret/.git deny-list, writes gated through the
permission policy), untrusted-output sanitization and bounds, and an env
allow-list for the subprocess.