agents-can-communicate 0.1.18 → 0.3.0

package/README.md

@@ -4,101 +4,119 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%E2%89%A524-brightgreen.svg)](https://nodejs.org)
 
-**Give the agent sessions you already opened a shared room — and stop being the wire
-between them.**
+ACC connects independently opened AI sessions so they can discover, ask, answer, acknowledge, and hand off without becoming one managed agent team.
 
-ACC is a local-first coordination layer for independent AI coding sessions on one repo.
-They see who else is here, claim the files they touch, message each other directly, and
-hand work across — while each keeps its own client, checkout, permissions, and human. It
-runs entirely on your machine, on Node's standard library with **zero runtime
-dependencies**, and your transcripts never leave the client.
+It is a local-first communication layer for sessions you already run. Each session keeps
+its own client, model, checkout, permissions, context, and human direction. ACC supplies a
+shared room with presence, intent, narrow file claims, durable conversation threads, and
+truthful per-recipient receipts. It does not launch, steer, supervise, or terminate agents.
 
-## The wall is you
+The project uses Node's standard library with **zero runtime dependencies**. Coordination
+state stays in platform app data outside the repository, and ACC never collects raw
+transcripts.
 
-One session refactors and is about to remove a field called `item.drive`. Another, in a
-file you're not looking at, still reads it. Neither terminal knows the other exists — so
-either you carry the warning across by hand, or it ships broken.
+## Stop relaying between windows
 
-**Without ACC**, every warning, question, and handoff between sessions stops at you and
-starts again from you. **With ACC**, the sessions carry them to each other: the second
-agent sees the claim, gets the measured impact as a message, and the change lands in one
-piece. You go back to directing.
+One session finds that removing `item.drive` will break another area. A second session is
+working there, but neither client knows the other exists. Without ACC, the warning stops at
+you: copy it to the other window, copy the answer back, and repeat for every question.
+
+With ACC, the first session sends an attributed question. The second retrieves it, replies
+in the same thread, and thereby acknowledges the original. The first retrieves the answer.
+The message is durable throughout; neither model gains authority over the other.
 
 ```mermaid
-flowchart TB
-  Y["You — set direction"]
-  A["session A"]
-  B["session B"]
-  C["session C"]
-  R["ACC shared room<br/>presence · claims · messages · handoffs"]
-  Y --> A
-  Y --> B
-  Y --> C
-  A <--> R
-  B <--> R
-  C <--> R
+flowchart LR
+  A["session A — independently opened"] <--> R["ACC room<br/>presence · messages · receipts · claims"]
+  B["session B — independently opened"] <--> R
+  U["You — direction and authority"] --> A
+  U --> B
 ```
 
+The product's canonical activation event is simple: a second independently opened session
+completes a useful acknowledged interaction without the human copying peer message content.
+
 ## Install
 
-Two commands, once per macOS or Linux machine where your clients run:
+On macOS or Linux with Node 24 or newer:
 
 ```bash
 npm install -g agents-can-communicate
 acc install
 ```
 
-`acc install` wires ACC into the clients you have — Codex, Claude Code, Gemini CLI, Grok,
-Kimi Code — and names everything it changed. **Restart the client afterwards** (hooks load
-at startup); Codex also needs you to trust the plugin. Then just open a session in a
-project and it joins that project's room by itself; open a second and they coordinate.
-`acc doctor` shows what's active, `acc update --apply` keeps it current, `acc uninstall`
-removes only what ACC wrote.
+Restart the clients whose hooks were installed; Codex also requires trusting the plugin.
+Then open two sessions in the same repository or plain directory as usual. They remain
+independent and join the same ACC workspace. Use `acc doctor` to see exact versions,
+installation health, and delivery downgrades.
 
-Coordination data lives in the platform app-data directory (`~/Library/Application
-Support/acc`, `~/.local/share/acc`; override with `ACC_DATA_HOME`), never in your repo.
-Every worktree of a repo shares one room; a plain folder works the same.
+Runtime state lives in `~/Library/Application Support/acc` on macOS or the XDG data
+directory on Linux. `ACC_DATA_HOME` can override it, but ACC refuses a location inside a
+workspace. Git is optional; worktrees of one repository share awareness.
 
-## What the room holds
+## The communication loop
 
-| | |
-|---|---|
-| **presence** | who's live, their client and branch, and what each intends — one `acc status`. |
-| **claims** | the files each session is touching; on guardable clients a clashing edit is refused and the owner named. |
-| **messages** | questions, decisions, notes — attributed, delivered on the recipient's next turn, and data they weigh rather than orders. |
-| **requests & handoffs** | work addressed to a participant, so it waits across restarts and carries the answer back. |
+```bash
+# Session A publishes awareness and reserves only what it will edit.
+acc work --summary "changing the item schema" --mode edit --hint 'file:src/item.mjs'
+acc claim --resource 'file:src/item.mjs' --reason "changing the item schema"
 
-A targeted `acc inbox` survives context compaction, and `acc reply` answers and
-acknowledges in one operation. A session alone in a repo pays nothing — no banner, no
-protocol, nothing left behind.
+# Session A asks a participant named by `acc status`.
+acc message --to models --type question --subject "item.drive" \
+  --body "Can your code stop reading item.drive before I remove it?"
 
-## Everyday controls
+# Session B reads and answers the exact message.
+acc inbox --message message_x
+acc reply --message message_x --body "Yes. Commit abc123 removes the final read."
 
-The installed guidance teaches your agents to claim, ask, request, and hand off on their
-own. These give you a direct view when you want one:
+# Either session records a handoff while context is still available.
+acc finish --goal "remove item.drive" --status complete \
+  --completed "schema and reader updated" --remaining "none"
+```
 
-| Command | For |
+Messages commit before any delivery attempt. `queued`, `offered`, `retrieved`, and
+`acknowledged` describe different observable facts: an offer is not a read, retrieval is
+not proof of model attention, and a reply resolves communication rather than proving a
+requested task finished.
+
+Durable inbox recovery is the baseline for every client. Certified next-turn injection
+reduces the polling for the exact captured client version and platform. Native live push is
+opt-in, experimental, and off until you choose it: **Claude Code 2.1.258 and Codex 0.152.1
+on macOS arm64 have passing live-push captures** and deliver an addressed message into a
+running session through the vendor's own transport, falling back to the durable inbox on any
+failure. Every other client, and any client below the captured minimum, stays next-turn or
+inbox only. The retained failed captures are shipped beside the passing ones as honest
+evidence.
+
+| Client | Native delivery |
 |---|---|
-| `acc status` | who's here, what they claim, and the room's protection level |
-| `acc inbox` | recover an addressed message without a workspace dump |
-| `acc reply` | answer and acknowledge in one operation |
-| `acc doctor` | confirm which client integrations are active and current |
-| `acc update --apply` | install the latest release and refresh integrations |
-| `acc uninstall` | remove ACC's integrations — settings you changed stay yours |
+| Claude Code 2.1.258 (darwin-arm64) | experimental Channel: idle offer, queue-after-turn, native reply, off until opt-in |
+| Codex 0.152.1 (darwin-arm64) | experimental App Server queue: idle/after-turn, reply via `acc reply`, off until opt-in |
+| Gemini CLI, Kimi Code | next-turn or inbox only; no captured transparent transport |
+| Grok | awaiting a compatibility capture; inbox only |
 
-## Documentation
+## What ACC owns
+
+| ACC owns | ACC does not own |
+|---|---|
+| participant and session presence | process or model lifecycle |
+| current intent and resource claims | prompts, permissions, or token budgets |
+| messages, threads, replies, acknowledgements | work queues or execution state |
+| delivery evidence and visible fallback | raw transcripts or shared model memory |
 
-Start at the **[documentation map](docs/index.md)** — it lays out a path for whatever
-brought you here: [why ACC](docs/WHY_ACC.md) and [concepts](docs/CONCEPTS.md) to evaluate
-it, [getting started](docs/GETTING_STARTED.md) to run it, the [CLI](docs/CLI.md) /
-[protocol](docs/PROTOCOL.md) / [capabilities](docs/CAPABILITIES.md) reference, and
-[adapter authoring](docs/ADAPTER_AUTHORING.md) to extend it. New to the vocabulary? The
-[glossary](docs/GLOSSARY.md) defines every term in one line.
+A peer message is untrusted input, never system authority. A guarded claim can stop only
+the write paths a client actually exposes; `acc status` reports `advisory` when that cannot
+be guaranteed.
 
-See it run: [three workstreams](examples/three-workstreams.md) · [research in a plain
-folder](examples/non-git-research.md). Contributing starts with [AGENTS.md](AGENTS.md).
+## Documentation
 
-## Requirements & license
+Start with [Getting started](docs/GETTING_STARTED.md), then read
+[How ACC works](docs/HOW_IT_WORKS.md) for the end-to-end engineering tour or use the
+[documentation map](docs/index.md). The exact surfaces are in the [CLI](docs/CLI.md),
+[MCP](docs/MCP.md), [Protocol](docs/PROTOCOL.md), and
+[Capabilities](docs/CAPABILITIES.md) references. Adapter evidence lives beside each
+adapter in its `COMPATIBILITY.md` and `certification.json`.
 
-Node 24+, macOS or Linux, Git optional. MIT — use it, fork it, keep it
-([LICENSE](LICENSE)).
+Contributing starts with the repository's
+[AGENTS.md](https://github.com/automatis-tools/agents-can-communicate/blob/main/AGENTS.md).
+Node 24+, Git optional, MIT licensed.

package/SECURITY.md

@@ -0,0 +1,31 @@
+# Security policy
+
+## Reporting
+
+Report privately via [GitHub security advisories](https://github.com/automatis-tools/agents-can-communicate/security/advisories/new).
+
+Please do not open a public issue first.
+
+Include: what you ran, what happened, what you expected, and the client and
+version. A reproduction against a throwaway `ACC_DATA_HOME` is ideal.
+
+## Scope
+
+| In scope | Out of scope |
+|---|---|
+| Peer text escaping its quoted block | An attacker who already has write access to your data home |
+| Any path escaping the managed root | A model choosing to obey persuasive peer text |
+| Uninstall deleting files ACC did not write | Vulnerabilities in Codex, Claude Code, Gemini, Grok, or Kimi themselves |
+| ACC writing into a repository | Denial of service by a trusted peer |
+| Session impersonation across MCP | |
+
+Reasoning behind each: [docs/SECURITY_MODEL.md](docs/SECURITY_MODEL.md).
+
+## Supported versions
+
+Pre-1.0: the latest release only.
+
+## What we will do
+
+Acknowledge, reproduce, and tell you whether it is in scope. If it is, the fix
+ships with a test in `tests/security/` so it cannot come back quietly.

package/bin/acc-bootstrap.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+// Internal entry point behind an ACC-owned shell shim: is this exact vendor
+// executable eligible for native delivery right now? Exit 0 means yes and the
+// shim exports its owned policy before `exec`; any other exit - including a
+// crash, a missing adapter, or a damaged install - means the shim launches the
+// vendor command untouched. Nothing is ever written to stdout, and stderr stays
+// empty unless ACC_BOOTSTRAP_DEBUG=1 asks for one safe line.
+import { checkNativeBootstrap } from "@agents-can-communicate/installer";
+
+import { createClaudeCodeAdapter } from "@agents-can-communicate/adapter-claude-code";
+import { createCodexAdapter } from "@agents-can-communicate/adapter-codex";
+import { createGeminiCliAdapter } from "@agents-can-communicate/adapter-gemini-cli";
+import { createGrokAdapter } from "@agents-can-communicate/adapter-grok";
+import { createKimiAdapter } from "@agents-can-communicate/adapter-kimi";
+
+const FLAGS = new Map([["--adapter", "adapter"], ["--real-executable", "realExecutable"],
+  ["--data-home", "dataHome"]]);
+
+function debug(line) {
+  if (process.env.ACC_BOOTSTRAP_DEBUG === "1") process.stderr.write(`acc-bootstrap: ${line}\n`);
+}
+
+function parse(args) {
+  const options = {};
+  for (let index = 0; index < args.length; index += 2) {
+    const key = FLAGS.get(args[index]);
+    const value = args[index + 1];
+    if (key === undefined || typeof value !== "string" || value === "" || key in options) return null;
+    options[key] = value;
+  }
+  return FLAGS.values().every(key => key in options) ? options : null;
+}
+
+try {
+  const options = parse(process.argv.slice(2));
+  if (options === null) {
+    debug("usage: --adapter <id> --real-executable <path> --data-home <path>");
+    process.exit(2);
+  }
+  const registry = {
+    claude_code: createClaudeCodeAdapter, codex: createCodexAdapter,
+    gemini_cli: createGeminiCliAdapter, grok: createGrokAdapter, kimi: createKimiAdapter,
+  };
+  const adapter = registry[options.adapter]?.();
+  if (adapter === undefined) {
+    debug(`${options.adapter}: unknown adapter`);
+    process.exit(1);
+  }
+  const result = await checkNativeBootstrap({ adapter, realExecutable: options.realExecutable,
+    platform: `${process.platform}-${process.arch}`, dataHome: options.dataHome, timeoutMs: 750 });
+  debug(`${options.adapter}: ${result.supported ? "supported" : result.reasonCode}`);
+  process.exit(result.supported ? 0 : 1);
+} catch (error) {
+  debug(`failed: ${String(error?.code ?? error?.name ?? "error")}`);
+  process.exit(1);
+}

package/bin/acc-claude-channel.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+// The ACC Channel binary Claude Code spawns as a stdio MCP child. It composes
+// the same workspace discovery, session binding, core service, and local
+// data-home rules as acc-hook, opens a session-scoped endpoint for the delivery
+// router, and turns the model's explicit acc_reply / acc_ack into real ACC
+// records. It never collects a transcript or runs a model, and it fails open:
+// any composition error leaves Claude a plain MCP server that simply offers no
+// tools rather than crashing the session.
+import { randomBytes } from "node:crypto";
+import { realpathSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { createClaudeCodeAdapter } from "@agents-can-communicate/adapter-claude-code";
+import { listSessionBindings } from "@agents-can-communicate/adapter-sdk";
+import { createCoordinationService } from "@agents-can-communicate/core";
+import { resolveClientPid } from "@agents-can-communicate/hook-runner/client-pid";
+import { readProcessTable } from "@agents-can-communicate/hook-runner/process-table";
+import { createId } from "@agents-can-communicate/protocol";
+import { openFilesystemStore } from "@agents-can-communicate/storage-filesystem";
+import { createGitProbe, discoverWorkspace, platformDataHome, runtimePaths }
+  from "@agents-can-communicate/cli";
+
+import { createAccChannel, createInertChannel, endpointDir, routeAck, routeReply }
+  from "@agents-can-communicate/adapter-claude-code/channel";
+
+const clock = { now: () => new Date().toISOString() };
+const ids = { next: kind => createId(kind, randomBytes) };
+
+/**
+ * The ACC session this Claude process opened - decided by which client process
+ * this Channel is running under, never by how many sessions happen to be
+ * visible.
+ *
+ * There used to be a fallback here: if exactly one session was live, it was
+ * taken to be this one. On a single-session machine that looked safe, and with
+ * two sessions it silently handed one client the other's identity. The Channel
+ * starts while its own SessionStart hook is still writing its binding, so the
+ * only binding a second client can see at that moment is the *first* client's -
+ * and the wait that was added to survive that race then locks the wrong answer
+ * in on the first attempt, because it is a complete, live, plausible binding.
+ *
+ * Measured on two real 2.1.259 sessions: both Channels registered an endpoint
+ * under the first client's pid. `bindNativeSession` refuses two registrations
+ * for one pid, so the session that had been receiving live messages dropped
+ * back to the durable inbox - and an `acc_reply` from the second window would
+ * have been recorded as the first session's answer, which is a false record
+ * rather than a lost message.
+ *
+ * This process was spawned by its client, so its own ancestry names that
+ * client, and no race can change that. Ownership is decided by it.
+ */
+export async function resolveSession({ runtimeDir, service, env, ownClientPid,
+  listBindings = listSessionBindings }) {
+  if (!Number.isInteger(ownClientPid)) return null;
+  const bindings = await listBindings({ runtimeDir });
+  if (bindings.length === 0) return null;
+  const status = await service.collectStatus({});
+  const live = new Set(status.participants
+    .filter(participant => participant.presence !== "offline")
+    .map(participant => participant.sessionId));
+  const mine = bindings.filter(binding => live.has(binding.accSessionId)
+    && binding.clientPid === ownClientPid);
+  // One client process can outlive a session and open another, so the pid alone
+  // can still name two. The harness session id the client exports separates
+  // them; with nothing to separate them the answer is nobody, as before.
+  const exported = new Set(Object.values(env ?? {}).filter(value => typeof value === "string"));
+  const matched = mine.filter(binding => exported.has(binding.harnessSessionId));
+  const chosen = mine.length === 1 ? mine[0] : matched.length === 1 ? matched[0] : null;
+  return chosen === null ? null
+    : { sessionId: chosen.accSessionId, generation: chosen.generation, clientPid: chosen.clientPid };
+}
+
+/** The client process this Channel was spawned by, or null when nobody knows. */
+export async function ownClient({ table = null, from = process.pid,
+  command = createClaudeCodeAdapter().client.command } = {}) {
+  return resolveClientPid({ table: table ?? await readProcessTable(), from, command });
+}
+
+// How long the Channel will wait for the hook to publish this session's
+// binding. Claude spawns this child while SessionStart is still running - both
+// landed in the same second on a real 2.1.259 launch - and a single lookup
+// loses that race often enough to make native delivery activate or not per
+// launch. Bounded, because a session with no ACC binding must still be answered.
+const BINDING_WAIT_MS = 5_000;
+const BINDING_POLL_MS = 100;
+
+/**
+ * The session binding, once it exists - or null when the wait runs out.
+ *
+ * A binding with no `clientPid` names no process, and the Channel binds an
+ * exact one, so it does not count as resolved: the hook writes the identity
+ * first and the certified facts after, and reading in between must keep waiting
+ * rather than settle for the half-written answer.
+ */
+export async function resolveWithin({ resolve, deadline, intervalMs = BINDING_POLL_MS,
+  now = () => Date.now(), sleep = ms => new Promise(resolve_ => setTimeout(resolve_, ms)) }) {
+  for (;;) {
+    const session = await resolve();
+    if (session !== null && Number.isInteger(session?.clientPid)) return session;
+    if (now() >= deadline) return null;
+    await sleep(intervalMs);
+  }
+}
+
+async function main() {
+  const descriptor = await discoverWorkspace({ cwd: process.cwd(), env: process.env,
+    gitProbe: createGitProbe() });
+  const paths = runtimePaths({ dataHome: platformDataHome({ platform: process.platform,
+    env: process.env }), workspaceId: descriptor.id, workspaceRoots: descriptor.roots });
+  const store = await openFilesystemStore({ root: paths.root, clock, ids,
+    workspaceId: descriptor.id });
+  const service = createCoordinationService({ store, clock, ids });
+  const write = payload => process.stdout.write(`${JSON.stringify(payload)}\n`);
+  // Read once: the ancestry that decides ownership cannot change while this
+  // process runs, and re-reading it on every poll would spawn `ps` in a loop.
+  const clientPid = await ownClient();
+  const session = await resolveWithin({
+    resolve: () => resolveSession({ runtimeDir: paths.root, service, env: process.env,
+      ownClientPid: clientPid }),
+    deadline: Date.now() + BINDING_WAIT_MS });
+  // No binding to serve - but Claude is already speaking MCP to this child, and
+  // returning here left the event loop empty: the process exited in 75ms
+  // without answering `initialize`, and Claude reported the server as failed to
+  // connect on every session that enables the plugin without ACC's shim.
+  if (session === null || !Number.isInteger(session.clientPid)) {
+    const inert = createInertChannel({ write });
+    pump(inert.handleLine, () => process.exit(0));
+    return inert;
+  }
+
+  const channel = createAccChannel({
+    endpointDir: endpointDir(paths.root),
+    clientPid: session.clientPid,
+    write,
+    routeReply: ({ messageId, body }) => routeReply({ service, session, messageId, body }),
+    routeAck: ({ messageId }) => routeAck({ service, session, messageId }),
+    // This process is the only party that knows the endpoint is still being
+    // served, and Claude publishes no heartbeat, so nothing else would move
+    // ACC's lease while the session sits idle - which is when live delivery is
+    // worth having.
+    refreshBinding: leaseUntil => service.refreshDeliveryBinding({
+      sessionId: session.sessionId, generation: session.generation, leaseUntil }),
+  });
+  await channel.listen();
+  pump(channel.handleLine, () => { channel.close(); process.exit(0); });
+  return channel;
+}
+
+/** One line-delimited JSON pump, for the bound server and the unbound one alike. */
+function pump(handleLine, shutdown) {
+  let buffer = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", async chunk => {
+    buffer += chunk;
+    let newline = buffer.indexOf("\n");
+    while (newline !== -1) {
+      const line = buffer.slice(0, newline).trim();
+      buffer = buffer.slice(newline + 1);
+      newline = buffer.indexOf("\n");
+      if (line !== "") await handleLine(line);
+    }
+  });
+  process.stdin.on("end", shutdown);
+  process.once("SIGTERM", shutdown);
+  process.once("SIGINT", shutdown);
+  // Keeps the child answerable for as long as Claude holds the transport open.
+  process.stdin.resume();
+}
+
+const invokedDirectly = typeof process.argv[1] === "string"
+  && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+if (invokedDirectly) {
+  // Fail open: a Channel that cannot compose is simply absent, never a crash in
+  // front of the user's session.
+  await main().catch(() => { process.stdin.resume(); });
+}

package/bin/acc-hook.mjs

@@ -6,6 +6,8 @@
 // someone's session stops working. Unknown adapter, malformed payload, broken
 // store, missing binding - all of them end in "allow, exit 0".
 import { randomBytes } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 import { createId } from "@agents-can-communicate/protocol";
 import { runHook } from "@agents-can-communicate/hook-runner";
@@ -36,20 +38,100 @@ const readStdin = () => new Promise(resolve => {
   return undefined;
 });
 
-const [adapterId] = process.argv.slice(2);
+export const writeOutput = (stream, output, { deadlineAt } = {}) => {
+  if (output === "") return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let timer;
+    const finish = error => {
+      if (settled) return;
+      settled = true;
+      if (timer !== undefined) clearTimeout(timer);
+      if (error === undefined || error === null) resolve();
+      else reject(error);
+    };
+    if (deadlineAt !== undefined) {
+      const remaining = deadlineAt - Date.now();
+      if (remaining <= 0) {
+        finish(new Error("hook budget exhausted before stdout write"));
+        return;
+      }
+      timer = setTimeout(() => finish(
+        new Error("hook budget exhausted waiting for stdout callback")), remaining);
+    }
+    try {
+      stream.write(output, finish);
+    } catch (error) {
+      finish(error);
+    }
+  });
+};
+
+const DIAGNOSTIC_BYTES = 512;
+
+function boundedDiagnostic(label, error) {
+  const detail = String(error?.message ?? error).replace(/[\u0000-\u001f\u007f]/g, " ");
+  let line = `acc: ${label}: ${detail}`;
+  while (Buffer.byteLength(`${line}\n`, "utf8") > DIAGNOSTIC_BYTES && line.length > 0) {
+    line = line.slice(0, -1);
+  }
+  return `${line}\n`;
+}
 
-let payload = null;
+function tryWrite(stream, output) {
+  if (output === "") return;
+  try {
+    stream.write(output, () => {});
+  } catch {
+    // A broken diagnostic stream must not turn a failed-open hook into a crash.
+  }
+}
+
+export async function completeHookOutput(result,
+  { stdout = process.stdout, stderr = process.stderr } = {}) {
+  try {
+    await writeOutput(stdout, result.stdout ?? "", { deadlineAt: result.deadlineAt });
+  } catch (error) {
+    tryWrite(stderr, boundedDiagnostic("stdout write failed", error));
+    return { exitCode: 0, wroteStdout: false, committedOffers: false };
+  }
+
+  let committedOffers = true;
+  try {
+    await result.commitOffers?.();
+  } catch (error) {
+    committedOffers = false;
+    tryWrite(stderr, boundedDiagnostic("offer commit failed", error));
+  }
+  if (result.stderr) tryWrite(stderr, `${result.stderr}\n`);
+  return { exitCode: 0, wroteStdout: true, committedOffers };
+}
+
+async function main() {
+  const [adapterId] = process.argv.slice(2);
+
+  let payload = null;
+  try {
+    payload = JSON.parse(await readStdin());
+  } catch {
+    payload = null;
+  }
+
+  const result = await runHook({ adapterId, payload, adapters,
+    runtime: { clock: { now: () => new Date().toISOString() },
+      ids: { next: kind => createId(kind, randomBytes) } },
+    env: process.env });
+
+  const completed = await completeHookOutput(result);
+  process.exitCode = result.exitCode ?? completed.exitCode;
+}
+
+let isMain = false;
 try {
-  payload = JSON.parse(await readStdin());
+  isMain = process.argv[1] !== undefined
+    && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
 } catch {
-  payload = null;
+  isMain = false;
 }
 
-const result = await runHook({ adapterId, payload, adapters,
-  runtime: { clock: { now: () => new Date().toISOString() },
-    ids: { next: kind => createId(kind, randomBytes) } },
-  env: process.env });
-
-if (result.stdout !== "") process.stdout.write(result.stdout);
-if (result.stderr) process.stderr.write(`${result.stderr}\n`);
-process.exitCode = result.exitCode ?? 0;
+if (isMain) await main();

package/bin/acc-mcp.mjs

@@ -3,8 +3,9 @@ import { randomBytes } from "node:crypto";
 
 import { EXIT, createId } from "@agents-can-communicate/protocol";
 import { createCoordinationService } from "@agents-can-communicate/core";
+import { createDeliveryRouter } from "@agents-can-communicate/delivery-router";
 import { openFilesystemStore } from "@agents-can-communicate/storage-filesystem";
-import { createGitProbe, discoverWorkspace, platformDataHome, runtimePaths }
+import { ALL_ADAPTERS, createGitProbe, discoverWorkspace, platformDataHome, runtimePaths }
   from "@agents-can-communicate/cli";
 import { serve } from "@agents-can-communicate/mcp-server";
 
@@ -40,13 +41,16 @@ const paths = runtimePaths({
 });
 const store = await openFilesystemStore({ root: paths.root, clock, ids,
   workspaceId: descriptor.id });
+const service = createCoordinationService({ store, clock, ids });
+const adapters = Object.fromEntries(ALL_ADAPTERS().map(adapter => [adapter.id, adapter]));
 
 await serve({
   input: process.stdin,
   output: process.stdout,
   log: message => process.stderr.write(`acc-mcp: ${message}\n`),
   context: {
-    service: createCoordinationService({ store, clock, ids }),
+    service,
+    deliveryRouter: createDeliveryRouter({ service, adapters, clock }),
     workspaceId: descriptor.id,
     participantId,
     descriptor,

package/bin/acc.mjs

@@ -3,7 +3,10 @@ import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 
 import { createId } from "@agents-can-communicate/protocol";
-import { askConfirmation, main } from "@agents-can-communicate/cli";
+import { createDeliveryRouter } from "@agents-can-communicate/delivery-router";
+import { ALL_ADAPTERS, askConfirmation, main } from "@agents-can-communicate/cli";
+
+const adapters = Object.fromEntries(ALL_ADAPTERS().map(adapter => [adapter.id, adapter]));
 
 // The composition root is the only place allowed to reach for ambient time and
 // randomness; everything below it receives them as ports.
@@ -15,13 +18,20 @@ const runtime = {
   stderr: process.stderr,
   clock: { now: () => new Date().toISOString() },
   ids: { next: kind => createId(kind, randomBytes) },
+  createDeliveryRouter: ({ service, clock }) =>
+    createDeliveryRouter({ service, adapters, clock }),
   // Asked only by `acc config init`, and only when stdout is a terminal. There
   // was no port here at all, so the question went to the fallback that always
   // answers no: in a real terminal the command printed "not written" and never
   // said why, and `--yes` - the flag documented for runs with nobody to ask -
   // was the only way to write the file.
-  confirm: question => askConfirmation(question,
-    { input: process.stdin, output: process.stdout }),
+  confirm: (question, io = { input: process.stdin, output: process.stdout }) =>
+    askConfirmation(question, io),
+  // The two streams and the fact that a person is at both ends, for the
+  // per-client native delivery question `acc install` asks only interactively.
+  input: process.stdin,
+  output: process.stdout,
+  isInteractive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
   // Asked for only by `acc version`, so a package missing its own manifest
   // fails that one command rather than every command.
   version: async () => JSON.parse(