feat: add TCP connection protocol

[Kyle Cutler (kycutler)]

Summary

Add optional, session-scoped TCP channels to Agent Host Protocol.

Clients can open a byte stream to a destination on the Agent Host’s network over the existing AHP connection. This enables remote browsing of development servers without a separate forwarding endpoint or transport-specific proxy.

Channel model

Each private ahp-tcp: channel represents one outbound TCP connection:

• capability-gated, atomic creation through subscribe.create;
• a parent session that scopes authorization, ownership, and lifetime;
• base64 payloads with ordered byte offsets and bounded, per-direction flow control;
• independent input/output EOF, graceful close, and reset;
• same-socket recovery through complete action replay.

DNS, loopback, and routing belong to the Agent Host’s network. Session ownership does not implicitly move the connection into an agent sandbox or delegated execution environment.

Reconnect and delivery

TCP channels retain their original socket, consumer, and pending actions across transport replacement. Replay reconciles acknowledgments before resending unacknowledged actions with their original sequences and offsets.

Snapshots cannot restore byte streams. Missing channels, unavailable replay, or lost local state terminate the connection rather than silently opening a replacement socket.

TCP delivery is loss-sensitive: payload actions cannot be coalesced or dropped. Ordinary-channel replay remains independently checkpointed to avoid applying existing state twice.

SDK support

Adds reducers and owned byte-stream adapters across TypeScript, Rust, Go, .NET, Swift, and Kotlin.

• Adapters own buffering, chunking, credit, acknowledgments, close handling, and replay.
• Client-backed SDKs integrate atomic creation and reconnect, including managed-host reconnect.
• Kotlin provides a transport-independent adapter without adding a network runtime.
• Strict event receivers support lower-level integrations that must fail explicitly on delivery loss.

Deliberate boundaries

• Hosts own destination sockets, authorization, resource limits, and retention policy.
• Consumers own transport selection, application retry policy, and native stream bridges.
• Browser proxy integration remains a separate VS Code change.
• Binary framing, listeners, reverse forwarding, and datagrams are outside this revision.

Generated surfaces and validation

The contract is propagated through JSON Schema, reference documentation, all six SDKs, shared reducer fixtures, and wire round-trip fixtures.

Validation includes root checks, SDK builds and tests, native routing/reconnect regressions, documentation builds, and the companion VS Code real-socket integration suite.

[Connor Peet (connor4312)]

Kyle Cutler (@kycutler) I like this addition. I opened #492 to explore moving flow control into the general channel/subscription model, so busy TCP, terminal, or telemetry channels cannot crowd out other traffic on the connection.

The idea is to negotiate receive windows in subscribe, split large logical messages into small string fragments, and schedule those fragments fairly across channels. A started message could finish beyond the target window, within hard safety limits, so callers would not need to predict its encoded size. Credit would return when the bounded consumer releases the data—not just when JSON is parsed.

Could TCP use that shared mechanism, replacing its dedicated window and consumed-credit actions while keeping byte offsets, EOF/close/reset, and lossless replay? I would prefer one flow-control mechanism rather than two. This does not need to block this PR, but I would appreciate your take on the direction and any TCP-specific requirements it would need to cover.