simonferquel/claude-hsp-kit:latest

HSP-capable variant of the built-in `claude` sandbox kit -- the same `claude` CLI (stock `--dangerously-skip-permissions` entrypoint, no fork, no research-preview flags), plus a `SessionStart`-hook-launched sidecar shim (this repo's `claude/`) that exposes the Harness Steering Protocol (hsp/1) by writing accepted steers into Claude Code's own cross-session inbox Unix socket. Built to test/demo the Agentic Platform's custom-kit-only HSP capability (APT-1293/APT-1382). Everything below this point through `agentInstructions` is copied verbatim from the built-in `claude` kit spec (docker/sandboxes, sandboxlib/agentkits/agents/claude/spec.yaml) -- see this repo's root README.md, section 11 ("Claude Code adapter and sandbox kit: claude-hsp-kit"), for the diff summary; the only changes are this description, `sandbox.image`, `sandbox.entrypoint`, and the `hooks`/`crossSessionInbound` keys baked into `/etc/claude-code/managed-settings.json` at image build time (kits/claude-hsp-kit/Dockerfile) -- nothing in this file itself changes beyond `sandbox.image`, `sandbox.entrypoint`, `name`, `displayName`, and this description. Note: `crossSessionInbound: "accept"` applies to every session launched from this image, not only HSP-enabled ones (managed-settings.json is a static, image-baked file -- it cannot be conditioned on the per-launch $HSP_SOCKET environment variable the platform sets only for HSP-capable sessions). This is an accepted, documented trade-off, not an oversight: see README §11.1 for why it does not widen this kit's trust boundary in practice (the inbox socket Claude Code binds is already restricted to the same OS user, inside the same sandbox, where every co-located process already has full filesystem/exec access to the agent's session).