ACP agent: umbrella for protocol features Kit does not yet support

Tracking issue for Agent Client Protocol features that kit serve / kit acp does not implement or advertise, audited against agent-client-protocol-schema 1.7.0 (fork rev 6e7e044, v1 + v2) at Kit v0.1.134 (e75629c). Scope is Kit as ACP agent only. Client-side behavior (Kit driving child harnesses) is out of scope here.

Each item is intended to become its own issue or PR. Check off as they land.

1. Capability and stop-reason fixes

• v1 additionalDirectories capability mismatch. capabilities() in src/protocols/acp.rs advertises sessionCapabilities.additionalDirectories, but every non-empty value is rejected on session/new, load, and fork. Drop the capability until item 9 lands.
• v2 capabilities.auth never populated. auth/logout is handled in src/protocols/acp/v2.rs but not advertised. v2 also suppresses all auth methods unless logout is supported; those should be independent.
• Stop reason parity. v1 maps an error finish to a JSON-RPC internal error instead of a stop reason. max_turn_requests is never returned in either version.
• v2 usage_update.cost. v1 sets cost, v2 sends only used and size.

2. Project compose inner calls onto ACP tool calls

Kit exposes one model tool, compose. Over ACP that becomes a single tool_call whose title is the literal string compose, kind unset (clients render other), no locations, rawInput = the Runlet program, rawOutput = the result. Inner calls (shell, edit, read_file, subagent, tool_search, tool, docs, ...) are only visible through the stderr runlet progress transport (src/runlet_progress/), which the TUI consumes and no ACP client sees.

• Decide the projection. Two options: (a) one child tool_call per Runlet call node keyed by owner + node id, created on NodeAdded, updated on NodeUpdated, with the compose card as parent; or (b) keep one compose card and stream inner-call state into its content, aggregating kind and locations. Option (a) matches how editors render tool activity; option (b) is closer to the current transport model.
• Per-call kind. shell → execute, edit → edit, read_file → read, tool_search → search, docs → fetch, subagent/prompt/fork → other or think. The outer compose card stays execute.
• locations. Populate from edit and read_file paths (plus line for hunk edits) so editors can follow the agent.
• title vs name. Emit a human-readable title per call and carry the raw tool name in name (unstable_tool_call_name). Today title is the raw name in both versions (agentkit-acp tool_call() / v2 emitter).
• Bound it. Runlet progress already caps nodes and source size; the ACP projection must respect the same bounds and never block execution.

3. Rich tool content

• Diff content for edit. Emit ToolCallContent::Diff from hunk edit results. v1: path, oldText, newText. v2: changes with add/delete/modify/move plus optional git_patch. Never produced today in kit or agentkit-acp.
• Terminal content for shell. v2 only: terminal_update and terminal_output_chunk streamed from the local shell runner, plus ToolCallContent::Terminal on the call. v1 needs client-owned terminals, skip.

4. Session state broadcasting

• session_info_update. Never emitted. Send title and updatedAt so session pickers and session/list show something useful.
• config_option_update. Never pushed; new options are only returned in the set_config_option response. A model or effort change from one attachment leaves co-attached clients stale.
• plan_update / plan. Never emitted. Map runlet progress or task-manager state to plan entries.
• notice beyond one case. Today only Response interrupted; replacement follows in v1, nothing in v2. Candidates: provider rate limits, context nearing limit, background compose completion, tool failures. Overlaps with #45.

5. Config surface

• Modes. No mode category option and session/set_mode unhandled in v1. Expose whichever session-level switches make sense as mode options.
• Boolean options. None exposed; the v1 client session.configOptions.boolean capability is never read. Candidates: native voice, auto-compaction.
• model_config category. Reasoning effort is thought_level today, which is right, but any provider-specific knobs belong under model_config.

6. Multi-root and MCP transports

• Multi-root sessions. Accept additionalDirectories on session/new, load, resume, fork, and report them in SessionInfo. Depends on the runtime root model; today cwd must equal the runtime root.
• HTTP MCP servers from clients. src/tools/mcp.rs and v2 reject anything but stdio (session MCP servers support only stdio transport). Add http with headers (v1 also sse) and advertise session.mcp.http in v2.

7. Elicitation

• Use elicitation/create (stable since schema 1.7.0) when the client advertises elicitation.form or elicitation.url. URL mode can replace the out-of-process terminal auth flow; form mode enables a structured ask-user tool. Kit never issues this request today.

8. Lifecycle completeness

• session/delete in both versions.
• session/fork in v2 (v1 handles it, v2 has no handler).
• session/resume cursors. v2 only accepts replayFrom: start; anything else returns Unsupported.
• In-band auth. authenticate / auth/login always return invalid_params; only terminal auth methods are offered. Consider an agent auth method where a provider allows it.

9. Slash commands

• Real command surface. Only compact is advertised, it has no input hint, and it is dispatched by matching the literal prompt prefix /compact in src/compaction.rs. Give commands a proper dispatch path and advertise skills as commands with hints.

10. Unstable protocol extras

• Compaction updates. Emit compaction_update and compaction_summary_chunk (unstable_session_compaction) instead of replaying summaries as agent_message_chunk. Gate on the v1 client session.compaction capability.
• End-turn token usage. Set Usage on v1 PromptResponse.usage and v2 idle state_update.usage (unstable_end_turn_token_usage).
• Providers. providers/list|set|disable (unstable_llm_providers) so clients switch between openai, openrouter, and speakeasy.
• Trace context in _meta. Honor the reserved traceparent, tracestate, and baggage keys and attach them to Kit telemetry spans.
• HTTP transport hardening. Health endpoint and CORS are disabled on both routers in src/protocols/http.rs. Track the Active streamable-HTTP RFD for v2 reconnection and Last-Event-ID resumption.
• Agent registry manifest. Publish an agent.json so ACP editors list Kit as installable.

Explicitly out of scope

• session/request_permission: Kit has no approval path, so there is nothing to forward.
• Client fs/read_text_file / fs/write_text_file: not a feature Kit intends to support.
• Client terminal/* (v1): Kit runs shell locally.

Related: #25 (upstream inject dependencies), #36 (background compose activity view), #45 (provider retry progress to ACP parents).

This is a broad ACP tracking issue rather than one implementation task. Start by reading the relevant entry points in src/protocols/acp.rs, src/protocols/acp/v2.rs, src/runlet_progress/, src/tools/mcp.rs, src/compaction.rs, and src/protocols/http.rs, then split one unchecked item into a scoped issue or PR. Done means the selected ACP behavior is implemented, advertised consistently, and its checklist item is checked.