acp registry support

[andymac4182]

What changed

Added an ACP-backed agent plugin for DeepSec process and revalidate, with support for ACP registry agents and
explicit custom ACP bridge commands.

Why

DeepSec should be able to run investigations and revalidation through any Agent Client Protocol-compatible server, not
just built-in Claude/Codex integrations. Requiring an explicit registry agent or command avoids hidden local defaults
and makes the selected ACP backend clear and reproducible.

Verification

• pnpm test passes
• pnpm lint passes
• pnpm knip passes
• If this adds a matcher: ran it against at least one real repo and confirmed the candidate count is sane

Additional targeted checks:

• pnpm exec vitest run --project processor packages/processor/src/__tests__/acp-agent.test.ts packages/processor/src/__tests__/registry.test.ts
• pnpm exec vitest run --config packages/deepsec/vitest.config.ts --dir packages/deepsec src/__tests__/preflight.test.ts
• pnpm --filter @deepsec/processor build
• pnpm --filter deepsec build
• pnpm exec biome check packages/processor/src/agents/acp-agent.ts packages/processor/src/__tests__/acp-agent.test.ts packages/deepsec/src/cli.ts packages/deepsec/src/commands/process.ts packages/deepsec/src/commands/revalidate.ts packages/deepsec/src/preflight.ts packages/deepsec/src/__tests__/preflight.test.ts docs/models.md docs/configuration.md

Note: pnpm test requires the bundled CLI artifact, so I ran pnpm bundle first.

Notes for reviewer

ACP usage is explicit by design. --agent acp requires either:

--acp-registry-agent <id>

or:

--acp-command <cmd>

There is no default ACP agent and no local vendor-specific shortcut.

Registry support currently handles distribution.npx and distribution.uvx entries from:

https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json

Binary-only registry entries intentionally fail with an actionable error telling users to install the binary and pass
it through --acp-command.

Custom command examples:

pnpm deepsec process --project-id my-app --agent acp \
  --acp-command 'my-acp serve --stdio'

pnpm deepsec process --project-id my-app --agent acp \
  --acp-command my-acp \
  --acp-args '["serve","--stdio"]'

Credential preflight is skipped for ACP agents because auth belongs to the selected ACP bridge/server rather than
DeepSec’s Claude/OpenAI environment checks.

[vercel]

@andymac4182 is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​agentclientprotocol/​sdk@​0.21.0

View full report