.woodpecker/build-agent-runtime.yml

@@ -32,6 +32,8 @@ steps:
   - name: build-agent-runtime
     image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
     directory: ci/images
+    # Context is ci/images (not the variant dir) so both Containerfiles can
+    # COPY the shared agent-runtime-common/ files.
     # One pod, both images one after the other (kaniko --cleanup between
     # builds), at 1 CPU so it still fits if it overlaps another pipeline.
     backend_options:
@@ -56,7 +58,7 @@ steps:
         for VARIANT in go ops; do
           /kaniko/executor \
             --cleanup \
-            --context "agent-runtime-$VARIANT" \
+            --context . \
             --dockerfile "agent-runtime-$VARIANT/Containerfile" \
             --destination "gitea.renner.uno/konairius/agent-runtime-$VARIANT/agent-runtime-claude:$TAG" \
             --destination "gitea.renner.uno/konairius/agent-runtime-$VARIANT/agent-runtime-claude:v1" \

README.md

@@ -54,7 +54,11 @@ Pod images for the Paperclip Kubernetes sandbox (REN-284). Each is the stock
 set. Base user (1000, non-root), entrypoint and cmd are unchanged; the
 images run with a read-only root FS. Source in `ci/images/agent-runtime-*`,
 built by `.woodpecker/build-agent-runtime.yml` (re-run alone: deployment to
-target `build-agent-runtime`), versions bumped by Renovate.
+target `build-agent-runtime`), versions bumped by Renovate. Both also
+carry `claude-agent-acp` for the ACP engine, pinned and patched like
+Paperclip ships it, SDK override included
+(`ci/images/agent-runtime-common/`); bump it by hand
+together with Paperclip. All tools are on the default `PATH`.
 
 | Image | `imageRegistry` | Adds |
 |---|---|---|

ci/images/agent-runtime-common/claude-agent-acp-0.73.0.patch

@@ -0,0 +1,66 @@
+diff --git a/dist/acp-agent.js b/dist/acp-agent.js
+index 0214a509eb5e7b777a69e4e34637941c275d27b1..403be02df66e25eee29e7d5bef14627011e02b30 100644
+--- a/dist/acp-agent.js
++++ b/dist/acp-agent.js
+@@ -2922,9 +2922,19 @@ export class ClaudeAcpAgent {
+                                             amount: message.total_cost_usd,
+                                             currency: "USD",
+                                         },
+-                                        ...(message.origin && {
+-                                            _meta: { "_claude/origin": message.origin },
+-                                        }),
++                                        _meta: {
++                                            ...(message.origin && { "_claude/origin": message.origin }),
++                                            // ACP's core Usage shape exposes context occupancy and
++                                            // cost, but not the billable input/output split. Keep the
++                                            // SDK's bounded aggregate in extension metadata so ACPX can
++                                            // normalize it without persisting a raw provider message.
++                                            usage: {
++                                                input_tokens: message.usage.input_tokens,
++                                                output_tokens: message.usage.output_tokens,
++                                                cache_read_input_tokens: message.usage.cache_read_input_tokens,
++                                                cache_creation_input_tokens: message.usage.cache_creation_input_tokens,
++                                            },
++                                        },
+                                     },
+                                 });
+                             }
+@@ -5311,6 +5321,10 @@ export class ClaudeAcpAgent {
+             settingSources: ["user", "project", "local"],
+             ...(thinking !== undefined && { thinking }),
+             ...userProvidedOptions,
++            // Paperclip Runner owns the complete session context. Its isolated
++            // user root contains only assigned skills; project/local settings
++            // would reintroduce host prompts, plugins, skills, and MCP servers.
++            ...(process.env.PAPERCLIP_ACPX_ISOLATED_CONTEXT === "1" && { settingSources: ["user"] }),
+             ...(settings && { settings }),
+             env,
+             // Override certain fields that must be controlled by ACP
+@@ -5318,7 +5332,9 @@ export class ClaudeAcpAgent {
+             includePartialMessages: true,
+             forwardSubagentText,
+             mcpServers: {
+-                ...(userProvidedOptions?.mcpServers || {}),
++                ...(process.env.PAPERCLIP_ACPX_ISOLATED_CONTEXT === "1"
++                    ? {}
++                    : (userProvidedOptions?.mcpServers || {})),
+                 ...mcpServers,
+                 ...(fileChangeAuditSupport
+                     ? { [FILE_CHANGE_AUDIT_SERVER_NAME]: fileChangeAuditSupport.mcpServer }
+@@ -5329,6 +5345,16 @@ export class ClaudeAcpAgent {
+             allowDangerouslySkipPermissions: ALLOW_BYPASS,
+             permissionMode: initialPermissionMode,
+             canUseTool: this.canUseTool(sessionId),
++            // The runner pins this actual MCP endpoint before provider launch.
++            // Exempt only task delivery/control tools at the SDK dispatch boundary,
++            // not arbitrary provider permission metadata or MCP name prefixes.
++            ...(process.env.PAPERCLIP_ACPX_ISOLATED_CONTEXT === "1" && {
++                allowedTools: mcpServers.paperclip?.type === "http"
++                    && mcpServers.paperclip.url === process.env.PAPERCLIP_ACPX_TASK_TOOL_BRIDGE_URL
++                    ? ["paperclip_finish", "paperclip_block", "read_current_wake_comments", "request_human_input"]
++                        .map((tool) => `mcp__paperclip__${tool}`)
++                    : [],
++            }),
+             // Forward MCP elicitation requests onto ACP elicitation. Only attached
+             // when the client advertised support, so non-supporting clients keep the
+             // SDK's default (auto-decline) behavior. (AskUserQuestion is handled in

ci/images/agent-runtime-common/claude-agent-acp.package.json

@@ -0,0 +1,9 @@
+{
+  "private": true,
+  "dependencies": {
+    "@agentclientprotocol/claude-agent-acp": "0.73.0"
+  },
+  "overrides": {
+    "@anthropic-ai/claude-agent-sdk": "0.3.280"
+  }
+}

ci/images/agent-runtime-go/Containerfile

@@ -15,6 +15,33 @@ FROM ghcr.io/paperclipai/agent-runtime-claude:git-38d8f371722b315d2fb3bbaa512518
 
 COPY --from=go /usr/local/go /usr/local/go
 COPY --from=golangci-lint /usr/bin/golangci-lint /usr/local/bin/golangci-lint
+# go and gofmt also in /usr/local/bin: a process started with the default PATH
+# (not the image ENV) still finds them.
+USER root
+RUN ln -s /usr/local/go/bin/go /usr/local/bin/go \
+    && ln -s /usr/local/go/bin/gofmt /usr/local/bin/gofmt
+USER 1000:1000
+
+# ACP server the Paperclip ACP engine starts in the pod (REN-302). Version and
+# patch match what Paperclip ships: packages/adapters/claude-local/package.json
+# pins 0.73.0 and applies patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch
+# (isolated context, task-tool allow-list, usage metadata). Not bumped by
+# Renovate on purpose: bump only together with Paperclip, and replace the patch.
+# Paperclip also overrides the SDK (package.json pnpm overrides:
+# claude-agent-sdk 0.3.280); a plain `npm install -g` ignores that and pulls an
+# older SDK. So install from a package.json with the same override into a
+# fixed prefix, and link the binary into /usr/local/bin.
+COPY agent-runtime-common/claude-agent-acp.package.json /opt/claude-agent-acp/package.json
+COPY agent-runtime-common/claude-agent-acp-0.73.0.patch /tmp/claude-agent-acp.patch
+USER root
+RUN cd /opt/claude-agent-acp \
+    && npm install --omit=dev --no-audit --no-fund \
+    && git -C node_modules/@agentclientprotocol/claude-agent-acp apply /tmp/claude-agent-acp.patch \
+    && npm ls @anthropic-ai/claude-agent-sdk | grep -q 'claude-agent-sdk@0.3.280' \
+    && ln -s /opt/claude-agent-acp/node_modules/.bin/claude-agent-acp /usr/local/bin/claude-agent-acp \
+    && rm /tmp/claude-agent-acp.patch \
+    && npm cache clean --force
+USER 1000:1000
 
 # The sandbox pod has a read-only root FS. Writable mounts: $HOME
 # (/home/paperclip, 1Gi), $HOME/.cache (1Gi), /tmp (2Gi), /workspace.
@@ -27,4 +54,7 @@ ENV PATH=/usr/local/go/bin:$PATH \
     GOTOOLCHAIN=local
 
 # Base user (1000:1000), entrypoint (tini) and cmd (agent shim) are inherited.
-RUN go version && golangci-lint version
+# The PATH check uses the base image's default PATH, not the ENV above.
+RUN go version && golangci-lint version \
+    && env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+       sh -ec 'for t in go gofmt golangci-lint claude-agent-acp; do command -v "$t"; done'

ci/images/agent-runtime-ops/Containerfile

@@ -21,8 +21,31 @@ COPY --from=flux /usr/local/bin/flux /usr/local/bin/flux
 COPY --from=kustomize /app/kustomize /usr/local/bin/kustomize
 COPY --from=helm /usr/bin/helm /usr/local/bin/helm
 
+# ACP server the Paperclip ACP engine starts in the pod (REN-302). Version and
+# patch match what Paperclip ships: packages/adapters/claude-local/package.json
+# pins 0.73.0 and applies patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch
+# (isolated context, task-tool allow-list, usage metadata). Not bumped by
+# Renovate on purpose: bump only together with Paperclip, and replace the patch.
+# Paperclip also overrides the SDK (package.json pnpm overrides:
+# claude-agent-sdk 0.3.280); a plain `npm install -g` ignores that and pulls an
+# older SDK. So install from a package.json with the same override into a
+# fixed prefix, and link the binary into /usr/local/bin.
+COPY agent-runtime-common/claude-agent-acp.package.json /opt/claude-agent-acp/package.json
+COPY agent-runtime-common/claude-agent-acp-0.73.0.patch /tmp/claude-agent-acp.patch
+USER root
+RUN cd /opt/claude-agent-acp \
+    && npm install --omit=dev --no-audit --no-fund \
+    && git -C node_modules/@agentclientprotocol/claude-agent-acp apply /tmp/claude-agent-acp.patch \
+    && npm ls @anthropic-ai/claude-agent-sdk | grep -q 'claude-agent-sdk@0.3.280' \
+    && ln -s /opt/claude-agent-acp/node_modules/.bin/claude-agent-acp /usr/local/bin/claude-agent-acp \
+    && rm /tmp/claude-agent-acp.patch \
+    && npm cache clean --force
+USER 1000:1000
+
 # Read-only root FS: kubectl (~/.kube/cache) and helm (~/.cache, ~/.config)
 # write only under $HOME, which the sandbox pod mounts writable. No ENV needed.
 
 # Base user (1000:1000), entrypoint (tini) and cmd (agent shim) are inherited.
-RUN kubectl version --client && flux version --client && kustomize version && helm version
+RUN kubectl version --client && flux version --client && kustomize version && helm version \
+    && env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+       sh -ec 'for t in kubectl flux kustomize helm claude-agent-acp; do command -v "$t"; done'