[dependabot]

Bumps @agentclientprotocol/sdk from 1.9.0 to 2.0.2.

Release notes

Sourced from @​agentclientprotocol/sdk's releases.

v2.0.2

2.0.2 (2026-10-23)

Bug Fixes

• http: handle CR line endings in SSE streams (#306) (fd86335)
• isolate request-scoped HTTP POST failures (#307) (d9db04d)

v2.0.1

2.0.1 (2026-10-22)

Bug Fixes

• http: Isolate session stream conflicts from shared transport (#303) (ad220c7)

v2.0.0

2.0.0 (2026-10-19)

⚠ BREAKING CHANGES

• AgentSideConnection, ClientSideConnection, Agent, Client, LegacyAgentFactory, createLegacyAgent, and their extension aliases and connector helper have been removed. Use agent()/client() apps and peer-context request()/notify() calls. Compiled tests, fixtures, and examples are no longer published. See MIGRATION_STABLE_UNSTABLE.md for migration instructions.
• Default v1 and experimental v2 imports now expose only stable-feature schemas. Unstable v1 features require @​agentclientprotocol/sdk/unstable; unstable v2 features require @​agentclientprotocol/sdk/experimental/v2/unstable. Both v2 entrypoints remain experimental. SDK 2.0 does not switch the default protocol from ACP v1. The unversioned JSON schema export is removed; use the versioned schema/v1 or schema/v2 exports. All legacy v1 integrations must migrate to agent()/client() apps regardless of feature profile; opting into /unstable does not restore the removed connection classes or connector helper. See https://github.com/agentclientprotocol/typescript-sdk/blob/main/MIGRATION_STABLE_UNSTABLE.md for migration instructions.

Features

• make stable protocol bindings the default (6caf469)
• retire legacy connection APIs and publish production-only builds (#294) (52edc15)

Bug Fixes

• enforce supported Zod floor and patch generator YAML parser (#296) (f0cab19)
• import zod as a namespace so bundlers can tree-shake it (#291) (60619a4)

Changelog

Sourced from @​agentclientprotocol/sdk's changelog.

2.0.2 (2026-10-23)

Bug Fixes

• http: handle CR line endings in SSE streams (#306) (fd86335)
• isolate request-scoped HTTP POST failures (#307) (d9db04d)

2.0.1 (2026-10-22)

Bug Fixes

• http: Isolate session stream conflicts from shared transport (#303) (ad220c7)

2.0.0 (2026-10-19)

⚠ BREAKING CHANGES

• AgentSideConnection, ClientSideConnection, Agent, Client, LegacyAgentFactory, createLegacyAgent, and their extension aliases and connector helper have been removed. Use agent()/client() apps and peer-context request()/notify() calls. Compiled tests, fixtures, and examples are no longer published. See MIGRATION_STABLE_UNSTABLE.md for migration instructions.
• Default v1 and experimental v2 imports now expose only stable-feature schemas. Unstable v1 features require @​agentclientprotocol/sdk/unstable; unstable v2 features require @​agentclientprotocol/sdk/experimental/v2/unstable. Both v2 entrypoints remain experimental. SDK 2.0 does not switch the default protocol from ACP v1. The unversioned JSON schema export is removed; use the versioned schema/v1 or schema/v2 exports. All legacy v1 integrations must migrate to agent()/client() apps regardless of feature profile; opting into /unstable does not restore the removed connection classes or connector helper. See https://github.com/agentclientprotocol/typescript-sdk/blob/main/MIGRATION_STABLE_UNSTABLE.md for migration instructions.

Features

• make stable protocol bindings the default (6caf469)
• retire legacy connection APIs and publish production-only builds (#294) (52edc15)

Bug Fixes

• enforce supported Zod floor and patch generator YAML parser (#296) (f0cab19)
• import zod as a namespace so bundlers can tree-shake it (#291) (60619a4)

Commits

• f2f218d chore(main): release 2.0.2 (#309)
• d9db04d fix: isolate request-scoped HTTP POST failures (#307)
• fd86335 fix(http): handle CR line endings in SSE streams (#306)
• 46d6197 ci: resolve latest Node LTS patches before using runner cache (#308)
• 2ab6151 chore(main): release 2.0.1 (#305)
• ad220c7 fix(http): Isolate session stream conflicts from shared transport (#303)
• 810f46a chore(deps): bump markdown-it and vitest for security advisories (#304)
• c2b1a86 chore(main): release 2.0.0 (#302)
• a37f0dd ci: use manifest-driven release configuration (#301)
• 8129b47 chore: restore the last published release baseline (#299)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR upgrades the runtime ACP SDK dependency from 1.9.0 to 2.0.2.

Example: Run pnpm run test with the updated lockfile.

• Before: SDK 1.9.0 provides the legacy connection exports used by repository fixtures.
• After: Test compilation fails because SDK 2.0.2 removes AgentSideConnection, ClientSideConnection, Agent, and Client.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Source and exact-head CI establish two migration defects; the dependency-only approach also conflicts with recorded owner direction.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot maintenance PR is outside the ordinary contributor proof gate; inspected evidence establishes migration failures rather than successful CLI behavior.
Patch quality	🦪 silver shellfish (2/6)	2 actionable review findings remain.

Product

Kind: Maintenance · Worth it: No
User problem: No current acpx user failure is identified; this updates the central runtime protocol dependency.
Reason: The dependency-only change repeats an approach the recorded area owner rejected; useful SDK maintenance requires the coordinated migration already requested.

Merge readiness

⛔ Blocked before merge - 4 items remain

This PR needs changes: SDK 2 removes APIs still used by the test fixtures and conformance runner, and moves schema files used by four tests; repository policy does not permit closing this unimplemented update.

Priority: P2
Reviewed head: 90f79acd2ce0ec056cbb10caa7d5d26967317fb5

Before merge

• Migrate legacy SDK consumers before raising the dependency (P2) - SDK 2.0.2 removes AgentSideConnection, ClientSideConnection, Agent, and Client, but test/mock-agent.ts, test/fixtures/control-authority-agent.ts, and the conformance runner still use them. Installing this dependency makes test compilation fail, as exact-head CI annotations confirm on Node 22, 24, and 26, and prevents the conformance runner from importing its connection class. Migrate these consumers to agent()/client() apps and peer-context calls before retaining this bump; selecting /unstable does not restore the removed APIs.
• Update schema consumers for the new SDK entrypoint layout (P2) - test/opaque-config.test.ts, test/runtime-tool-kinds.test.ts, test/prompt-null-title.test.ts, and test/prompt-resource-validation.test.ts resolve ./schema/zod.gen.js relative to import.meta.resolve('@agentclientprotocol/sdk'). SDK 2.0.2 moves the entrypoint to dist/v1/stable/acp.js while validators reside in dist/v1/schema/zod.gen.js, so those imports target nonexistent dist/v1/stable/schema/zod.gen.js. After compilation is repaired, these test modules will fail to load. Update the schema access paths as part of the migration.
• Product: not worth merging - The dependency-only change repeats an approach the recorded area owner rejected; useful SDK maintenance requires the coordinated migration already requested.
• Explain or restore the original intent of SDK dependency range and lockfile - 26849fd: build(deps): refresh runtime tooling and patch URI advisories #910 explicitly retained SDK 1.x, consistent with the migration requirement recorded in build(deps): bump @agentclientprotocol/sdk from 1.9.0 to 2.0.0 #905 (comment).

Findings

• [P2] Migrate legacy SDK consumers before raising the dependency — package.json:84
• [P2] Update schema consumers for the new SDK entrypoint layout — package.json:84

Provenance

• SDK dependency range and lockfile changes intended behavior without addressing why it exists (26849fd: build(deps): refresh runtime tooling and patch URI advisories #910 explicitly retained SDK 1.x, consistent with the migration requirement recorded in build(deps): bump @agentclientprotocol/sdk from 1.9.0 to 2.0.0 #905 (comment).)

Tests

• Missing end-to-end proof: No shipped-CLI session and prompt run with SDK 2.0.2 is supplied; existing CI stops at migration failures.

Agent review details

How this fits together

The SDK connects acpx's ACP client to agent processes over JSON-RPC streams and supplies protocol APIs and validators to fixtures and the conformance runner.

flowchart LR
  CLI[acpx CLI] --> Client[ACP client]
  Client --> SDK[ACP SDK]
  SDK --> Agent[Agent process]
  Fixtures[Test fixtures] --> SDK
  Runner[Conformance runner] --> SDK

Loading

Technical review

Best possible solution:

Retain SDK 1.x until a coordinated migration updates the existing fixtures, conformance runner, and schema consumers together.

Do we have a high-confidence way to reproduce the issue?

Exact-head CI annotations demonstrate the missing-export failures on all three supported Node test versions; source and upstream package layout independently establish the schema-path failure, without executing target code.

Is this the best way to solve the issue?

A dependency-only upgrade is incomplete because its consumers still require removed APIs and file locations, and the recorded maintainer direction already calls for a coordinated migration.

Full review comments:

• [P2] Migrate legacy SDK consumers before raising the dependency — package.json:84
  SDK 2.0.2 removes AgentSideConnection, ClientSideConnection, Agent, and Client, but test/mock-agent.ts, test/fixtures/control-authority-agent.ts, and the conformance runner still use them. Installing this dependency makes test compilation fail, as exact-head CI annotations confirm on Node 22, 24, and 26, and prevents the conformance runner from importing its connection class. Migrate these consumers to agent()/client() apps and peer-context calls before retaining this bump; selecting /unstable does not restore the removed APIs.
  Confidence: 1
• [P2] Update schema consumers for the new SDK entrypoint layout — package.json:84
  test/opaque-config.test.ts, test/runtime-tool-kinds.test.ts, test/prompt-null-title.test.ts, and test/prompt-resource-validation.test.ts resolve ./schema/zod.gen.js relative to import.meta.resolve('@agentclientprotocol/sdk'). SDK 2.0.2 moves the entrypoint to dist/v1/stable/acp.js while validators reside in dist/v1/schema/zod.gen.js, so those imports target nonexistent dist/v1/stable/schema/zod.gen.js. After compilation is repaired, these test modules will fail to load. Update the schema access paths as part of the migration.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 26849fd33785.

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned diff changes only the SDK range and corresponding lockfile records; current main still specifies ^1.9.0. (package.json:84, 90f79acd2ce0)
• Diff-caused CI failures: Exact-head Test annotations on Node 22, 24, and 26 report removed SDK exports in fixtures and conformance code; Conformance Smoke also fails, although its detailed log redirects to a blocked artifact host. (conformance/runner/run.ts:10, 90f79acd2ce0)
• Existing maintainer direction: In build(deps): bump @agentclientprotocol/sdk from 1.9.0 to 2.0.0 #905 (comment), steipete explicitly retained SDK 1.x and required coordinated fixture and conformance migration instead of a dependency-only major bump; build(deps): refresh runtime tooling and patch URI advisories #910 preserved that choice. (package.json:84, 26849fd33785)
• Direct dependency migration contract: acpx directly imports and executes this SDK, making its migration contract applicable: v2 removes legacy connection APIs from both v1 entrypoints and requires app builders and peer-context calls. (MIGRATION_STABLE_UNSTABLE.md, f2f218d314ee)
• Changed schema layout: The package entrypoint is dist/v1/stable/acp.js; its source imports validators from ../schema/zod.gen.js, whereas acpx's four tests resolve ./schema/zod.gen.js relative to that entrypoint. (src/v1/stable/acp.ts:4, f2f218d314ee)
• Feature history and inspection limits: History across src/client.ts and src/acp/client.ts shows shared integration ownership; steipete authored the merged SDK API refactor refactor: use the SDK connection API directly #597 and recent dependency maintenance. Some historical blobs needed by blame and content searches are unavailable locally, so no original-introduction claim is made. (src/acp/client.ts:1025, 26849fd33785)

Labels

Label changes:

• add P2: This maintenance update introduces verified validation failures without an established current-main user outage.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: This maintenance update introduces verified validation failures without an established current-main user outage.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 26, 2026, 9:41 AM ET / 13:41 UTC.

[steipete]

Closing this dependency-only major update. SDK 2 removes AgentSideConnection, ClientSideConnection, Agent, and Client, which the conformance runner and test adapters still import; the exact-head CI run fails with TS2724 missing-export errors on Node 22, 24, and 26. Four schema consumers also rely on the SDK 1.x layout.

This needs a coordinated fixtures/conformance/schema migration, as already recorded in #905 (comment). Keeping the supported SDK 1.x line for this maintenance round.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.