chore(acp): bump codebuddy, dirac, grok, kilo and sigit registry pins to probed versions - #971
Merged
Merged
Conversation
… to probed versions
kaizhou-lab
added a commit
that referenced
this pull request
Sep 7, 2026
) ## Summary Scheduled ACP Registry version sync. Two npx pins drifted since #971, each backed by a fresh serial ACP probe of the exact pinned version. This is a single-file diff: neither outgoing version appears in any test assertion, and codebuddy — the only package whose version is embedded in one — did not drift. | backend | package | old → new | initialize | session/new | |---|---|---|---|---| | dimcode | `dimcode` | 0.3.28 → **0.3.29** | ok (agentInfo version 0.3.29) | auth required (`-32000`, "Provider credentials are required") | | grok | `@xai-official/grok` | 1.0.21 → **1.0.22** | ok (protocolVersion 1) | auth required (`-32000`, "no auth method id provided") | Both meet the release-lock criterion: `initialize` succeeds and `session/new` returns a clearly classified authentication requirement. Probes ran serially with no inherited HOME or credentials. dimcode still self-reports `agentInfo.title` as "DimAgent" against a public listing of "DimCode" — a standing vendor quirk, not an AionCore defect. **Snapshot structural diff:** the previous snapshot (`v2026.09.07-50f99cd`, audited earlier the same day) was still on disk, so the per-agent comparison ran. Across all 39 agents the only changes are these two npx package versions — no distribution type added or removed, no `args`/`env` change anywhere, and no binary artifact movement this window. Nothing outside the lock needed reporting. **Derived-assertion scan:** both outgoing versions (`0.3.28`, `1.0.21`) were scanned across `crates/**/*.rs` with fixed-string matching before staging; neither has a single hit. `registry_npx_lock.rs` still pins codebuddy at `2.146.0`, which is correct for this snapshot. `npx_cache_repair.rs` keeps its own version literals: those are cache-path hash fixtures, not lock assertions. The other 9 Registry-pinned packages (autohand, codebuddy, deepagents, dirac, glm-acp-agent, kilo, nova, pi, sigit) match the snapshot exactly. Drifted but not upgraded: none. `mimo-code` remains the one non-Registry builtin (no `registry_json_id`), excluded from drift reconciliation. **Standing watch (unchanged, no action in this PR):** sigit's ACP probe announced an npm scope rename (`@smbcloud/sigit` → `@getsigit/sigit`) on 2026-09-07. The Registry still declares the old scope, so the pin is untouched; the eventual switch needs a metadata migration alongside the lock, because `agent_metadata` seeds the launch args as `["-y","@smbcloud/sigit"]` (migration 025). That will be a human-reviewed PR. ## Registry snapshot - Audit pinned to release tag [`v2026.09.07-aafb17a`](https://cdn.agentclientprotocol.com/registry/v1/v2026.09.07-aafb17a/registry.json) of `agentclientprotocol/registry`, fetched via the versioned CDN path for reproducibility. - 39 ids in the raw snapshot: no newly listed and no delisted agents versus the baseline. (`antigravity-acp` remains listed and deferred as binary-only since 2026-08-21; `fast-agent` and `minion-code` remain listed but uvx-only and therefore out of scope.) ## Validation - `just migration-check` — pass - `just lint-fix` (`cargo fix` + `clippy --fix --workspace -D warnings`) — clean - `just fmt` — clean - **Local `cargo nextest` intentionally skipped, by standing policy for lock-only bumps** (established 2026-08-11). The Test check on this PR is the authority for this change: the merge decision depends on CI rather than the local run, and this host's load only manufactures timeout-shaped test failures, which nothing in the local steps above is subject to. ## Logging No logging changes: this is a lock version bump only; existing startup/session error paths already identify a failing agent by backend. Co-authored-by: zk <>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Scheduled ACP Registry version sync, covering three days of drift (the 2026-09-05 and 09-06 runs did not execute; the state file's last checked tag was
v2026.09.03-3006ae2). Five npx pins drifted since #966, each backed by a fresh serial ACP probe of the exact pinned version. The diff is the lock file plus the one lock-derived test assertion that embeds codebuddy's version.@tencent-ai/codebuddy-code-32000,data.category: auth)dirac-cli@xai-official/grok-32000, "no auth method id provided")@kilocode/cli@smbcloud/sigitAll five meet the release-lock criterion:
initializesucceeds, andsession/neweither succeeds or returns a clearly classified authentication requirement. Probes ran serially with no inherited HOME or credentials. sigit carriesskip_version_probe: true, which exempts only the runtime--versionsubprocess — it was still ACP-probed here, and that probe is what justifies the bump.Watch item — sigit is renaming its npm scope. The probe's stderr carries a vendor deprecation notice:
@smbcloud/sigit is the old name for @getsigit/sigit. Both names get the same release for now. Both names currently publish 1.5.7, and the Registry snapshot still declares@smbcloud/sigit, so this PR keeps the pinned package exactly as the Registry states and changes only the version. Recording it because the eventual switch is not a lock-only change:agent_metadataseeds the launch args as["-y","@smbcloud/sigit"](migration 025), so moving to the new scope will need a metadata migration alongside the lock, and that PR must go to a human.Snapshot structural diff (against the 2026-09-03 snapshot, the most recent one still on disk): the id set holds at 39 and every change is version churn — no distribution type was added or removed, and
args/envare byte-identical for every npx entry. Non-lock movement is report-only: claude-acp 0.75.1, codex-acp 1.10.0, factory-droid 0.213.0, github-copilot-cli 1.0.83, plus new binary artifacts for cursor, goose, harn, junie, opencode, kilo's binary channel, sigit's binary channel, andantigravity-acp(a newagy_acp_serverbuild — the deferred agent, still binary-only).Derived assertion updated:
registry_npx_lock.rspins codebuddy's exact version inside a--package-form argument list, so it moves with the lock —2.143.1→2.146.0. All five outgoing versions were scanned acrosscrates/**/*.rswith fixed-string matching before staging; codebuddy's is the only real assertion and the other four have no hits.npx_cache_repair.rskeeps its own version literals: those are cache-path hash fixtures, not lock assertions.The other 6 Registry-pinned packages (autohand, deepagents, dimcode, glm-acp-agent, nova, pi) match the snapshot exactly. Drifted but not upgraded: none.
mimo-coderemains the one non-Registry builtin (noregistry_json_id), excluded from drift reconciliation.Registry snapshot
v2026.09.07-50f99cdofagentclientprotocol/registry, fetched via the versioned CDN path for reproducibility.antigravity-acpremains listed and deferred as binary-only since 2026-08-21;fast-agentandminion-coderemain listed but uvx-only and therefore out of scope.)Validation
just migration-check— passjust lint-fix(cargo fix+clippy --fix --workspace -D warnings) — cleanjust fmt— cleancargo nextestintentionally skipped, by standing policy for lock-only bumps (established 2026-08-11). The Test check on this PR is the authority for this change: the merge decision depends on CI rather than the local run, and this host's load only manufactures timeout-shaped test failures, which nothing in the local steps above is subject to.Logging
No logging changes: lock version bumps plus one test assertion; existing startup/session error paths already identify a failing agent by backend.