What's New

​

0.80.0 (2026-10-08)

@AcpAgent(name = "echo-agent", version = "1.0.0")
class EchoAgent {
    @NewSession
    NewSessionResponse newSession() {
        return new NewSessionResponse(UUID.randomUUID().toString());
    }

    @Prompt
    PromptResponse prompt(PromptRequest req, SyncPromptContext ctx) {
        ctx.sendMessage("Echo: " + req.text());
        return PromptResponse.endTurn();
    }
}

AcpAgentSupport.create(new EchoAgent()).transport(new StdioAcpAgentTransport()).build().run();

​

Features

• Session config options replace session/set_model: an agent declares its own selectors (model choice is now just the one with category: "model"), plus a new boolean kind for simple on/off settings.
• Cancellation and $/cancel_request, in both directions, lets either side cancel a single in-flight request without ending the whole session; a prompt turn cancelled by session/cancel now always ends in stop reason cancelled, whatever the handler does.
• Extension methods (_-prefixed custom requests and notifications) are a first-class, typed feature on every client and agent builder, not just a raw escape hatch.
• Elicitation is stable, with explicit mode-checking: an agent can only ask for what the client actually advertised.
• Terminal authentication and logout: an agent can ask the client to run an interactive login, and advertise that it supports logging out.
• Streamable HTTP and WebSocket: a graceful shutdown window and clearer connection/session routing, on top of the remote-agent support described above. A WebSocket session gets its own idle timeout (30 minutes by default) and initialize deadline (30 seconds), the same on every host and configurable from your framework, so a quiet session isn’t cut off by ordinary HTTP keep-alive tuning and an abandoned connection doesn’t leak.
• Forward compatibility and _meta: former enums (StopReason, ToolCallStatus, and others) are open value types, several unions gained explicit Unknown* fallback variants, and every schema record carries _meta.
• Session list, close, resume and delete: the full session lifecycle from both sides, beyond the original create-and-prompt loop.

​

Tutorials

• 31: Elicitation (extended)
• 33: Session Config Options
• 34: Extension Methods
• 35: Cancellation and Timeouts
• 36: Terminal Auth and Logout
• 37: Streamable HTTP and WebSocket
• 38: Spring Boot over HTTP
• 39: Forward Compatibility and _meta
• 40: Micronaut
• 41: Quarkus

​

Quality

• Cross-SDK interop, over stdio, Streamable HTTP, and WebSocket:

  	stdio	HTTP	WebSocket
  TypeScript, Rust, Python	verified	verified	verified
  Kotlin	verified	n/a	verified
  Micronaut	verified	verified	verified
  Quarkus	verified	verified	verified
  Spring Boot (MVC)	verified	verified	verified
  Spring Boot (WebFlux)	n/a	verified	verified

  See Cross-SDK Compatibility for what each cell means and how this SDK’s feature set compares: it’s among the most complete ACP SDKs, by that comparison.
• Safe by default: local listeners bind to localhost, browser origins are checked, and logs at INFO and above carry no message content. See Transports for how to expose an agent deliberately and what each log level can carry.
• Load testing. Scenarios drive hundreds of concurrent clients, on their own connections and sharing one HTTP/2 connection, each running real prompt turns with streaming updates.
• Nearly 1,400 tests, model-checked concurrency, and mutation testing on the protocol core (below).
• Quality gates, every one enforced in ./mvnw verify and never baselined:

  Gate	What it guarantees
  	Every SDK package is @NullMarked; a possible null dereference is a compile error.
  	Error Prone’s default checks, plus unused Reactor results and stray System.out, fail compilation.
  	Each module’s layering is tested; no package cycles, and transports never reach session internals.
  	Methods stay below cognitive and cyclomatic complexity limits; copy-paste over 100 tokens fails.
  	Every bug at rank 9 or worse, and the multithreading bug patterns at any rank, fail the build.
  	Each module has line and branch coverage floors in its pom.xml; coverage cannot silently drop.
  	The concurrent core (prompt turns, pending responses, inbound requests, SSE streams) is model-checked for linearizability.
  	Mutation testing proves the protocol core’s tests catch at least 85% of injected bugs.
  	Resolved dependencies are scanned weekly and on every pom change; CVSS 7 or higher (or unscored) fails.

  See the SDK’s own README for the current badges and exact coverage numbers; they change between releases and are not repeated here.

​

Requirements

• Java 17+
• Spring Boot 4.1 (for acp-spring-boot-starter)
• Quarkus 3.40 (for acp-quarkus)
• Micronaut 4 (for acp-micronaut)

​

0.18.0 (2026-09-25)

• Streamable HTTP transport (RFD streamable-http-websocket-transport), contributed by @kamikaz1k (#7). StreamableHttpAcpClientTransport in acp-core talks to a remote agent over HTTP POST with SSE response streams. The new acp-streamable-http-jetty module provides StreamableHttpAcpAgentTransport, a Jetty listener that serves HTTP/SSE and a WebSocket upgrade on the same path and hosts one agent per remote connection through AcpAgentFactory. Header names and path match the TypeScript and Rust SDKs
• StreamableHttpAcpServlet is public and mountable in any Servlet 6 container (Spring Boot, Tomcat, Jetty, Undertow) at your own path; register it with async support. It serves the HTTP/SSE profile; the WebSocket upgrade needs StreamableHttpAcpAgentTransport
• Limits and keep-alive for the HTTP agent transport (StreamableHttpAcpAgentTransportOptions): POST bodies capped at 16 MiB by default, bounded WebSocket send queues and provisional session/load streams, a : keep-alive comment every 15 s on attached SSE streams, and 1,024 concurrent HTTP/2 streams per connection instead of Jetty’s default 128
• HTTP/2 over plain http://: the client sends a bodiless GET first so that, against a server that speaks h2c, every request runs on HTTP/2; otherwise it settles on HTTP/1.1
• The Streamable HTTP client reconnects a dropped SSE stream with a short backoff; it gives up on a 404 or after three reconnects in a row that delivered nothing
• AcpClientTransport.awaitTermination(), implemented by the Streamable HTTP and WebSocket client transports: when the transport dies, pending and later requests fail at once with the cause instead of waiting out the request timeout
• JSON modules (#12): the Jackson 2 mapper moved into acp-json-jackson2, and acp-json-jackson3 adds Jackson3AcpJsonMapper on Jackson 3 (3.1.5, the version Spring Boot 4.1 manages). Both write the same bytes on the wire. Proposed by @bengbengbalabalabeng
• Deterministic JSON mapper selection by AcpJsonMapperSupplier.priority(): with both modules present Jackson 3 wins, and an application’s own supplier wins over both. The system property acp.json.mapper.supplier names one explicitly
• CancelNotification carries _meta; AcpSyncClient(AcpAsyncClient) is public, so both APIs can share one session

• Breaking: acp-core depends on jackson-annotations only, not on jackson-databind or jackson-core (#12). JacksonAcpJsonMapper keeps its package and name
• Single-turn enforcement is per logical session (keyed by sessionId), because one HTTP connection carries many sessions. Stdio and WebSocket agents behave as before (#7, #9)
• Unknown-field policy moved from the schema records to the mapper (#10). The default mapper stays lenient and logs each ignored property at DEBUG; a strict mapper you pass in is now honored. Reported by @KallivdH
• Request timeouts run on one shared library-owned daemon timer instead of a thread pool per session

• WebSocketAcpAgentTransport (acp-websocket-jetty) is deprecated for removal. It serves a single WebSocket client; StreamableHttpAcpAgentTransport serves the WebSocket upgrade for any number of clients, and WebSocketAcpClientTransport clients connect to it unchanged

• A second AcpClient.async(transport) or AcpClient.sync(transport) on the same stdio transport started a second agent process whose requests could only time out. This was the Spring Boot autoconfiguration failure reported in June 2026. The stdio transport now refuses a second connect(), and sessions surface connect failures instead of dropping them
• A second prompt on a session could be rejected with -32000 or hang under CPU contention (#14): the prompt lock is now released before the response is published. Reported by @krickert
• WebSocketAcpAgentTransport wrote frames without waiting for the previous write, and could throw a NullPointerException on close
• The agent session reads sessionId from typed PromptRequest and CancelNotification params, so in-process transports match cancels correctly

​

0.17.0 (2026-08-28)

• Fix the duplicate discriminator on the wire: every polymorphic type wrote its type property twice, so new TextContent("hello") serialized to {"type":"text","type":"text","text":"hello"} and every session/prompt carried a duplicate JSON key. Jackson-based peers accept duplicates; a strict parser rejects the message. The type id is now written once and is populated on deserialization (previously null). 27 records across 6 hierarchies

​

0.16.1 (2026-08-24)

• Every module artifact publishes a CycloneDX 1.6 SBOM (classifier cyclonedx) covering that module’s compile and runtime scope
• Each vX.Y.Z tag now points at a commit whose POMs carry that version
• SLF4J 2.0.17 → 2.0.18

​

0.16.0 (2026-08-24)

• Security: Jackson 2.21.5 → 2.22.2, Jetty 12.0.37 → 12.1.12, Reactor 3.6.12 → 3.8.7
• SLF4J, Logback, JUnit 5, Mockito, Maven build plugins, Central publishing, JaCoCo and the optional OWASP dependency-check profile move to current compatible releases

​

0.15.0 (2026-08-21)

• Fix non-deterministic notification ordering — notifications are serialized through a sink drained by concatMap, preserving arrival order (thanks @ljiro)
• Drain queued notifications on graceful close instead of discarding them; closeGracefully() now waits for the drain, bounded by the session requestTimeout
• Distinguish expected from anomalous notification-sink emission failures in logging
• Security: Jackson 2.21.2 → 2.21.5 and Jetty 12.0.14 → 12.0.37, clearing 17 known advisories (5 high) in the published dependency closure
• Ship the verbatim Apache License 2.0, and package LICENSE and NOTICE under META-INF in every artifact
• Run the integration tests — three *IT classes existed but were never executed by mvn verify
• Pin GitHub Actions to commit SHAs; bound workflow jobs to 30 minutes

​

0.14.0 (2026-06-11)

• Docs: 0.14.0 release notes in README and CHANGELOG
• Add unstable providers/* methods
• Add messageId overloads to prompt context send methods
• Promote session config-option API to stable
• Deprecate the session-model API for removal
• Add logout and session/delete agent methods
• Add additionalDirectories and per-chunk messageId fields
• Add WebSocket edge case tests, increase max message size to 4MB
• Fix WebSocket client transport echoing agent requests back to agent
• Update version references to 0.12.0, add snapshot instructions
• Bump version to 0.13.0-SNAPSHOT

​

0.12.0 (2026-05-25)

• Add tutorial cross-references for module-20 and module-31 in release notes
• Add elicitation decline and cancel integration tests
• Update README with versioning policy and 0.12.0-SNAPSHOT release notes
• Add session/fork and session/set_config_option (unstable)
• Add elicitation/create and elicitation/complete (unstable)
• Add @UnstableAcpApi stability marker annotation
• Add session/list, session/close, session/resume methods
• Bump version to 0.12.0-SNAPSHOT

​

0.11.0 (2026-05-12)

• Remove MCP SDK dependency, add own JSON abstraction layer
• Update .gitignore with local tool config
• Bump version to 0.11.0-SNAPSHOT

​

0.10.0 (2026-04-10)

• Restore Duration import removed by PR #1
• Add Implementation type with clientInfo/agentInfo fields
• Add UsageUpdate support to SessionUpdate types
• Add support for UsageUpdate in SessionUpdate interface and related tests
• Update README for 0.9.0 release
• Bump version to 0.10.0-SNAPSHOT
• style: remove unused imports

​

0.9.0 (2026-03-31)

• Initial release.