agents-can-communicate 0.1.18 → 0.3.0

package/node_modules/@agents-can-communicate/installer/src/shell-bootstrap.mjs

@@ -0,0 +1,210 @@
+import { createHash } from "node:crypto";
+import { chmod, mkdir, readdir, readFile, rename, rm, rmdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { AccError, EXIT, assertPortableId } from "@agents-can-communicate/protocol";
+
+// The reversible shell half of native delivery: one marked PATH block in the
+// user's zsh rc and one per-command shim in an ACC-owned directory. The shim
+// keeps the user's command name, runs the bounded bootstrap check, and then
+// replaces itself with the real vendor executable through `exec`; ACC is never
+// the parent of a model session. Every byte ACC writes is recorded with its
+// hash so uninstall removes only what is still ACC's and refuses a block or
+// shim someone has edited.
+
+export const BLOCK_BEGIN = "# >>> agents-can-communicate native delivery >>>";
+export const BLOCK_END = "# <<< agents-can-communicate native delivery <<<";
+export const SHIM_MARKER = "# agents-can-communicate native delivery shim";
+export const SUPPORTED_SHELLS = Object.freeze(["zsh"]);
+export const SHIM_POLICIES = Object.freeze(["actionable", "all"]);
+const COMMAND_NAME = /^[a-z][a-z0-9_.-]*$/;
+
+const usage = (message, details = {}) => { throw new AccError(EXIT.USAGE, message, details); };
+const sha256 = text => createHash("sha256").update(text).digest("hex");
+// Single-quoted POSIX literal: the only escaping is the quote itself, so no
+// byte of a path or argument is ever interpreted by the shell.
+export const shellLiteral = value => `'${String(value).replaceAll("'", "'\\''")}'`;
+const isAbsolute = value => typeof value === "string" && path.isAbsolute(value);
+const inside = (root, candidate) => {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+};
+
+export function renderPathBlock(shimDir) {
+  return `${BLOCK_BEGIN}\nexport PATH=${shellLiteral(shimDir)}:"$PATH"\n${BLOCK_END}\n`;
+}
+
+export function validateShimEntry(entry) {
+  if (entry === null || typeof entry !== "object") usage("a shim entry must be an object");
+  for (const key of Object.keys(entry)) {
+    if (!["adapterId", "command", "realExecutable", "prefixArgs", "livePolicy"].includes(key)) {
+      usage(`unknown shim entry field ${key}`, { key });
+    }
+  }
+  assertPortableId(entry.adapterId, "shim adapter id");
+  if (typeof entry.command !== "string" || !COMMAND_NAME.test(entry.command)) {
+    usage("a shim command must be a bare command name", { command: entry.command });
+  }
+  if (!isAbsolute(entry.realExecutable)) usage("a shim realExecutable must be an absolute path");
+  if (!Array.isArray(entry.prefixArgs) || entry.prefixArgs.some(arg => typeof arg !== "string"
+    || arg === "" || /[\0\n]/.test(arg))) {
+    usage("shim prefixArgs must be non-empty argument strings without NUL or newline");
+  }
+  if (!SHIM_POLICIES.includes(entry.livePolicy)) {
+    usage("a shim livePolicy must be actionable or all; off means no shim", { livePolicy: entry.livePolicy });
+  }
+  return Object.freeze({ ...entry, prefixArgs: Object.freeze([...entry.prefixArgs]) });
+}
+
+export function renderCommandShim({ node, bootstrap, dataHome, entry }) {
+  const shim = validateShimEntry(entry);
+  for (const [name, value] of Object.entries({ node, bootstrap, dataHome })) {
+    if (!isAbsolute(value)) usage(`shim ${name} must be an absolute path`, { [name]: value });
+  }
+  const real = shellLiteral(shim.realExecutable);
+  const check = [node, bootstrap, "--adapter", shim.adapterId, "--real-executable",
+    shim.realExecutable, "--data-home", dataHome].map(shellLiteral).join(" ");
+  const prefix = shim.prefixArgs.map(shellLiteral).join(" ");
+  return [
+    "#!/bin/sh",
+    `${SHIM_MARKER} for ${shellLiteral(shim.command)}. Generated; do not edit.`,
+    "# ACC_BYPASS=1 runs the vendor command untouched. A failed or missing check",
+    "# does the same: the vendor command is never blocked on ACC.",
+    'if [ "${ACC_BYPASS-}" = "1" ]; then',
+    "  unset ACC_NATIVE_DELIVERY_POLICY",
+    `  exec ${real} "$@"`,
+    "fi",
+    `if ${check} </dev/null >/dev/null 2>&1; then`,
+    `  ACC_NATIVE_DELIVERY_POLICY=${shellLiteral(shim.livePolicy)}`,
+    "  export ACC_NATIVE_DELIVERY_POLICY",
+    `  exec ${real}${prefix === "" ? "" : ` ${prefix}`} "$@"`,
+    "fi",
+    "unset ACC_NATIVE_DELIVERY_POLICY",
+    `exec ${real} "$@"`,
+    "",
+  ].join("\n");
+}
+
+export function planShellBootstrap({ shell, rcFile, shimDir, entries = [], runtime = null }) {
+  if (!SUPPORTED_SHELLS.includes(shell)) {
+    return Object.freeze({ eligible: false, reasonCode: "unsupported_shell", shell: shell ?? null,
+      rcFile: null, shimDir: null, block: null, shims: Object.freeze([]), runtime: null });
+  }
+  if (!isAbsolute(rcFile) || !isAbsolute(shimDir)) usage("rcFile and shimDir must be absolute");
+  const validated = entries.map(validateShimEntry);
+  const commands = new Set();
+  for (const entry of validated) {
+    if (commands.has(entry.command)) usage(`duplicate shim command ${entry.command}`);
+    commands.add(entry.command);
+    // A shim that resolved to itself would loop forever; the real executable
+    // is resolved before the shim directory is ever on PATH.
+    if (inside(shimDir, entry.realExecutable)) {
+      usage("a shim realExecutable cannot live inside the shim directory",
+        { realExecutable: entry.realExecutable });
+    }
+  }
+  return Object.freeze({ eligible: true, reasonCode: null, shell, rcFile, shimDir,
+    block: renderPathBlock(shimDir), runtime,
+    shims: Object.freeze(validated.map(entry => Object.freeze({
+      path: path.join(shimDir, entry.command), entry }))) });
+}
+
+const defaultIo = Object.freeze({ readFile, writeFile, mkdir, chmod, rename, rm, rmdir, readdir });
+
+async function readText(io, file) {
+  try {
+    return await io.readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+async function writeAtomic(io, file, content, mode) {
+  const temporary = `${file}.${process.pid}.tmp`;
+  await io.writeFile(temporary, content, { mode });
+  await io.rename(temporary, file);
+  await io.chmod(file, mode);
+}
+
+// The block's exact span inside the rc text, or null. The block is matched by
+// its two sentinel lines so a user's other lines are never touched.
+export function locateBlock(text) {
+  if (typeof text !== "string") return null;
+  const begin = text.indexOf(BLOCK_BEGIN);
+  if (begin === -1 || (begin > 0 && text[begin - 1] !== "\n")) return null;
+  const endLine = text.indexOf(BLOCK_END, begin);
+  if (endLine === -1) return null;
+  const end = text.indexOf("\n", endLine);
+  return { start: begin, end: end === -1 ? text.length : end + 1 };
+}
+
+export async function installShellBootstrap({ plan, io = defaultIo }) {
+  if (!plan?.eligible) return { ok: false, reasonCode: plan?.reasonCode ?? "unsupported_shell" };
+  const { node, bootstrap, dataHome } = plan.runtime ?? {};
+  const current = await readText(io, plan.rcFile);
+  const span = locateBlock(current);
+  const existing = span === null ? null : current.slice(span.start, span.end);
+  if (existing !== null && existing !== plan.block) {
+    return { ok: false, reasonCode: "rc_block_modified", rcFile: plan.rcFile };
+  }
+  await io.mkdir(plan.shimDir, { recursive: true, mode: 0o700 });
+  await io.chmod(plan.shimDir, 0o700);
+  const shims = [];
+  for (const shim of plan.shims) {
+    const content = renderCommandShim({ node, bootstrap, dataHome, entry: shim.entry });
+    await writeAtomic(io, shim.path, content, 0o700);
+    shims.push({ path: shim.path, command: shim.entry.command, sha256: sha256(content) });
+  }
+  let appended = false;
+  if (existing === null) {
+    const base = current ?? "";
+    const separator = base === "" || base.endsWith("\n") ? "" : "\n";
+    await writeAtomic(io, plan.rcFile, `${base}${separator}${plan.block}`, 0o600);
+    appended = true;
+  }
+  return { ok: true, reasonCode: null, shell: plan.shell, shimDir: plan.shimDir,
+    rcFile: { path: plan.rcFile, blockSha256: sha256(plan.block), appended },
+    shims };
+}
+
+export async function uninstallShellBootstrap({ ownership, io = defaultIo }) {
+  const result = { ok: true, reasonCode: null, removedShims: [], keptShims: [],
+    missingShims: [], rcBlock: "absent" };
+  for (const shim of ownership?.shims ?? []) {
+    const content = await readText(io, shim.path);
+    if (content === null) { result.missingShims.push(shim.path); continue; }
+    if (sha256(content) !== shim.sha256) { result.keptShims.push(shim.path); continue; }
+    await io.rm(shim.path, { force: true });
+    result.removedShims.push(shim.path);
+  }
+  const shimDir = ownership?.shimDir;
+  let remaining = [];
+  if (typeof shimDir === "string") {
+    const names = await io.readdir(shimDir).catch(() => []);
+    for (const name of names) {
+      const content = await readText(io, path.join(shimDir, name));
+      if (content !== null && content.includes(SHIM_MARKER)) remaining.push(name);
+    }
+  }
+  const rcFile = ownership?.rcFile;
+  const text = typeof rcFile?.path === "string" ? await readText(io, rcFile.path) : null;
+  const span = locateBlock(text);
+  if (span !== null) {
+    const block = text.slice(span.start, span.end);
+    if (sha256(block) !== rcFile.blockSha256) {
+      result.rcBlock = "modified";
+      result.ok = false;
+      result.reasonCode = "rc_block_modified";
+    } else if (remaining.length > 0) {
+      result.rcBlock = "kept";
+    } else {
+      await writeAtomic(io, rcFile.path, text.slice(0, span.start) + text.slice(span.end), 0o600);
+      result.rcBlock = "removed";
+    }
+  }
+  if (typeof shimDir === "string" && remaining.length === 0 && result.keptShims.length === 0) {
+    await io.rmdir(shimDir).catch(() => null);
+  }
+  return result;
+}

package/node_modules/@agents-can-communicate/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/mcp-server",
-  "version": "0.1.18",
+  "version": "0.3.0",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/mcp-server/src/input-validator.mjs

@@ -0,0 +1,79 @@
+class InputValidationError extends Error {}
+
+const fail = (path, message) => {
+  throw new InputValidationError(`${path} ${message}`);
+};
+
+const isObject = value => value !== null && typeof value === "object"
+  && !Array.isArray(value);
+
+function matches(schema, value, path) {
+  try {
+    validateSchema(schema, value, path);
+    return true;
+  } catch (error) {
+    if (!(error instanceof InputValidationError)) throw error;
+    return false;
+  }
+}
+
+function validateSchema(schema, value, path) {
+  if (schema.const !== undefined && !Object.is(value, schema.const)) {
+    fail(path, `must equal ${JSON.stringify(schema.const)}`);
+  }
+  if (schema.enum !== undefined && !schema.enum.some(item => Object.is(item, value))) {
+    fail(path, `must be one of ${schema.enum.map(item => JSON.stringify(item)).join(", ")}`);
+  }
+
+  const objectKeywords = schema.type === "object" || schema.properties !== undefined
+    || schema.required !== undefined || schema.additionalProperties !== undefined;
+  if (objectKeywords) {
+    if (!isObject(value)) fail(path, "must be an object");
+    const properties = schema.properties ?? {};
+    for (const key of schema.required ?? []) {
+      if (!Object.hasOwn(value, key)) fail(`${path}.${key}`, "is required");
+    }
+    if (schema.additionalProperties === false) {
+      for (const key of Object.keys(value)) {
+        if (!Object.hasOwn(properties, key)) fail(`${path}.${key}`, "is not a known field");
+      }
+    }
+    for (const [key, child] of Object.entries(properties)) {
+      if (Object.hasOwn(value, key)) validateSchema(child, value[key], `${path}.${key}`);
+    }
+  } else if (schema.type === "array") {
+    if (!Array.isArray(value)) fail(path, "must be an array");
+    if (schema.items !== undefined) {
+      value.forEach((item, index) => validateSchema(schema.items, item, `${path}[${index}]`));
+    }
+  } else if (schema.type === "string" && typeof value !== "string") {
+    fail(path, "must be a string");
+  } else if (schema.type === "boolean" && typeof value !== "boolean") {
+    fail(path, "must be a boolean");
+  } else if (schema.type === "integer" && !Number.isInteger(value)) {
+    fail(path, "must be an integer");
+  }
+
+  if (schema.minimum !== undefined && value < schema.minimum) {
+    fail(path, `must be at least ${schema.minimum}`);
+  }
+  if (schema.maximum !== undefined && value > schema.maximum) {
+    fail(path, `must be at most ${schema.maximum}`);
+  }
+  if (schema.anyOf !== undefined
+    && !schema.anyOf.some(branch => matches(branch, value, path))) {
+    fail(path, "must match an accepted shape");
+  }
+  if (schema.oneOf !== undefined
+    && schema.oneOf.filter(branch => matches(branch, value, path)).length !== 1) {
+    fail(path, "must match exactly one accepted shape");
+  }
+  if (schema.not !== undefined && matches(schema.not, value, path)) {
+    fail(path, "contains fields that cannot be combined");
+  }
+  return value;
+}
+
+export function validateToolInput(schema, value) {
+  return validateSchema(schema, value, "arguments");
+}

package/node_modules/@agents-can-communicate/mcp-server/src/resources.mjs

@@ -15,42 +15,37 @@ function escapeText(value) {
   return result;
 }
 
+function escapePeerValue(value) {
+  if (typeof value === "string") return escapeText(value);
+  if (Array.isArray(value)) return value.map(escapePeerValue);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value)
+      .map(([key, child]) => [key, escapePeerValue(child)]));
+  }
+  return value;
+}
+
 const attributedMessage = message => ({
-  messageId: message.messageId,
-  from: message.fromSessionId,
-  type: message.type,
-  priority: message.priority,
-  requiresAck: message.requiresAck,
-  sentAt: message.sentAt,
+  ...escapePeerValue(message),
   trust: "untrusted peer content",
-  subject: escapeText(message.subject),
-  body: escapeText(message.body),
 });
 
-export async function readResource(uri, { service, participantId, workspaceId }) {
-  const snapshot = await service.store.snapshot(workspaceId);
+export async function readResource(uri, { service, participantId, workspaceId, session }) {
   switch (uri) {
-    case "acc://snapshot":
-      return { ...snapshot,
-        messages: snapshot.messages.map(attributedMessage) };
+    case "acc://snapshot": {
+      const { snapshot } = await service.sync({ workspaceId, scope: "full" });
+      return { ...snapshot, messages: snapshot.messages.map(attributedMessage) };
+    }
     case "acc://roster":
       return (await service.sync({ workspaceId })).roster;
-    case "acc://workstreams":
-      return snapshot.workstreams;
-    case "acc://tasks":
-      return snapshot.tasks;
     case "acc://inbox": {
-      const mine = new Set(snapshot.receipts
-        .filter(receipt => receipt.recipientParticipantId === participantId)
-        .map(receipt => receipt.messageId));
-      // A participant sees what was addressed to it, plus what it sent, so a
-      // fresh reader can follow its own thread.
-      return snapshot.messages
-        .filter(message => mine.has(message.messageId)
-          || message.toParticipantIds.includes(participantId)
-          || snapshot.sessions.some(session => session.sessionId === message.fromSessionId
-            && session.participantId === participantId))
-        .map(attributedMessage);
+      if (session === undefined) {
+        throw new AccError(EXIT.DATA, "the inbox resource requires a resolved session",
+          { participantId });
+      }
+      const inbox = await service.readInbox({ workspaceId, sessionId: session.sessionId,
+        generation: session.generation });
+      return inbox.map(item => attributedMessage(item.message));
     }
     default:
       throw new AccError(EXIT.DATA, `unknown resource: ${uri}`, { uri });

package/node_modules/@agents-can-communicate/mcp-server/src/server.mjs

@@ -1,14 +1,18 @@
-import { AccError, EXIT } from "@agents-can-communicate/protocol";
-import { noteNudge } from "@agents-can-communicate/core";
+import { createRequire } from "node:module";
+
+import { AccError, EXIT, GENERIC_MESSAGE_KINDS, VALID_OBLIGATIONS }
+  from "@agents-can-communicate/protocol";
 import { clearSessionBinding, loadSessionBinding, storeSessionBinding }
   from "@agents-can-communicate/adapter-sdk";
 
 import { readResource } from "./resources.mjs";
+import { validateToolInput } from "./input-validator.mjs";
 import { MCP_CAPABILITIES, PUBLIC_TOOLS, RESOURCES } from "./tools.mjs";
 
 export const PROTOCOL_VERSION = "2026-07-28";
 export const SUPPORTED_VERSIONS = Object.freeze([PROTOCOL_VERSION]);
-const SERVER_INFO = Object.freeze({ name: "agents-can-communicate", version: "0.0.0" });
+const PACKAGE_VERSION = createRequire(import.meta.url)("../package.json").version;
+const SERVER_INFO = Object.freeze({ name: "agents-can-communicate", version: PACKAGE_VERSION });
 
 const META = "io.modelcontextprotocol";
 const HEARTBEAT_CADENCE_MS = 60_000;
@@ -72,20 +76,40 @@ async function resolveSession(context) {
   return session;
 }
 
-// Kept for clients released before acc_inbox existed. New clients should use
-// the narrow inbox tool, but removing mail from acc_sync would strand deployed
-// clients that only know this response field. Returning a body is delivery, so
-// only those returned messages advance to injected.
-async function syncWithMail(service, owner, context, args) {
-  const sync = await service.sync({ ...owner, cursor: args.cursor ?? null,
-    scope: args.scope, limit: args.limit });
-  const messages = await service.pendingMessages({ workspaceId: context.workspaceId,
-    participantId: context.participantId, exceptSessionId: owner.sessionId });
-  for (const message of messages) {
-    await service.markDelivery({ ...owner, messageId: message.messageId,
-      state: "injected" }).catch(() => null);
+export async function recordAndOffer({ record, router, selectMessage = value => value }) {
+  const recorded = await record();
+  const message = selectMessage(recorded);
+  if (router === null || router === undefined
+    || !Array.isArray(message?.toParticipantIds) || message.toParticipantIds.length === 0) {
+    return { recorded, delivery: [] };
+  }
+  try {
+    return { recorded, delivery: await router.offer(message) };
+  } catch {
+    return { recorded, delivery: message.toParticipantIds.map(recipientParticipantId => ({
+      recipientParticipantId, outcome: "queued", transport: "durable",
+      errorCode: "transport_error",
+    })) };
+  }
+}
+
+const clientMessageId = (args, service) =>
+  args.clientMessageId ?? service.ids.next("client");
+
+function obligationFor(kind, explicit, addressed) {
+  if (!GENERIC_MESSAGE_KINDS.includes(kind)) {
+    const command = kind === "answer"
+      ? "acc_reply" : kind === "handoff" ? "acc_finish" : null;
+    throw new AccError(EXIT.USAGE, command === null
+      ? `unknown message kind: ${kind}` : `${kind} messages require ${command}`);
+  }
+  const obligation = explicit ?? VALID_OBLIGATIONS[kind][0];
+  if (!VALID_OBLIGATIONS[kind].includes(obligation)
+    || (!addressed && obligation !== "none")) {
+    throw new AccError(EXIT.USAGE,
+      `message obligation ${obligation} is invalid for ${kind}`);
   }
-  return messages.length === 0 ? sync : { ...sync, messages };
+  return obligation;
 }
 
 /**
@@ -93,7 +117,7 @@ async function syncWithMail(service, owner, context, args) {
  *
  * The hook runtime hands a session its pending messages when it builds a turn,
  * and marks them delivered. An MCP client has no turn and no hook, and no tool
- * ever handed it anything: it saw a `direct_request` line carrying a subject and
+ * ever handed it anything: it saw a `reply_required` line carrying a subject and
  * an id, and to read what a peer had actually said it had to ask for the whole
  * snapshot and search every message in the workspace for its own name.
  *
@@ -102,7 +126,7 @@ async function syncWithMail(service, owner, context, args) {
  * that had answered it.
  *
  * Returning them here is delivery, in the same sense and with the same honesty
- * as the turn: what is handed over is marked `injected`, and nothing else is.
+ * as the turn: what is handed over is marked `retrieved`, and nothing else is.
  * Acknowledgement stays a separate act, because being shown something is not
  * agreeing to it.
  */
@@ -113,72 +137,66 @@ async function callTool(name, args, context) {
   const service = context.service;
 
   switch (name) {
+    case "acc_status":
+      return service.collectStatus({});
     case "acc_sync":
-      return syncWithMail(service, owner, context, args);
+      return service.sync({ ...owner, cursor: args.cursor ?? null,
+        scope: args.scope, limit: args.limit });
     case "acc_work":
-      if (args.clear === true) return service.clearIntent({ ...owner });
+      if (args.clear === true) {
+        await service.clearIntent({ ...owner });
+        return { cleared: true };
+      }
       return service.setIntent({ ...owner, summary: args.summary, mode: args.mode,
-        state: args.state, workstreamId: args.workstreamId ?? null,
-        resourceHints: args.resourceHints ?? [] });
+        state: args.state, resourceHints: args.resourceHints ?? [] });
     case "acc_claim":
-      if (args.action === "release") return service.releaseClaim({ ...owner,
-        claimId: args.claimId }) ?? { released: args.claimId };
       if (args.action === "renew") return service.renewClaim({ ...owner,
         claimId: args.claimId, leaseSeconds: args.leaseSeconds });
       return service.acquireClaim({ ...owner, resource: args.resource,
         mode: args.mode ?? "exclusive", enforcement: "advisory",
         reason: args.reason ?? "unspecified", leaseSeconds: args.leaseSeconds });
+    case "acc_release":
+      await service.releaseClaim({ ...owner, claimId: args.claimId });
+      return { released: args.claimId };
     case "acc_message": {
-      const message = await service.sendMessage({ ...owner, toParticipantIds: args.to ?? [],
-        subject: args.subject, body: args.body, type: args.type ?? "note",
-        priority: args.priority, requiresAck: args.requiresAck === true,
-        workstreamId: args.workstreamId ?? null });
-      // A note that reads like it wants a reply was sent fire-and-forget; hand
-      // the nudge back with the message so the model that sent it can reconsider.
-      const advice = noteNudge(message);
-      return advice ? { ...message, advice } : message;
+      const kind = args.kind ?? "note";
+      const toParticipantIds = args.to ?? [];
+      const routed = await recordAndOffer({ router: context.deliveryRouter, record: () =>
+        service.sendMessage({ ...owner, clientMessageId: clientMessageId(args, service),
+        toParticipantIds, subject: args.subject, body: args.body, kind,
+        obligation: obligationFor(kind, args.obligation, toParticipantIds.length > 0) }) });
+      const message = routed.recorded;
+      return { message, delivery: routed.delivery };
     }
     case "acc_inbox":
       return service.readInbox({ ...owner, messageId: args.messageId });
-    case "acc_reply":
-      return service.replyToMessage({ ...owner, messageId: args.messageId,
-        body: args.body, subject: args.subject, type: args.type, priority: args.priority });
-    case "acc_task":
-      if (args.action === "claim") return service.claimTask({ ...owner,
-        taskId: args.taskId, force: args.force === true });
-      if (args.action === "decline") return service.declineTask({ ...owner,
-        taskId: args.taskId, reason: args.reason });
-      if (args.action === "transition") return service.transitionTask({ ...owner,
-        taskId: args.taskId, state: args.state });
-      return service.createTask({ ...owner, workstreamId: args.workstreamId,
-        title: args.title, detail: args.detail, taskId: args.taskId,
-        assigneeParticipantId: args.assigneeParticipantId,
-        dependsOn: args.dependsOn ?? [] });
-    case "acc_request":
-      return service.requestWork({ ...owner, toParticipantId: args.toParticipantId,
-        title: args.title, detail: args.detail, workstreamId: args.workstreamId,
-        priority: args.priority, dependsOn: args.dependsOn ?? [] });
+    case "acc_reply": {
+      const routed = await recordAndOffer({ router: context.deliveryRouter,
+        selectMessage: value => value.reply,
+        record: () => service.replyToMessage({ ...owner, messageId: args.messageId,
+          body: args.body, subject: args.subject,
+          clientMessageId: clientMessageId(args, service) }) });
+      return { message: routed.recorded.reply, delivery: routed.delivery };
+    }
+    case "acc_request": {
+      const routed = await recordAndOffer({ router: context.deliveryRouter,
+        record: () => service.sendMessage({ ...owner,
+          clientMessageId: clientMessageId(args, service),
+          toParticipantIds: [args.toParticipantId], kind: "request", obligation: "reply",
+          subject: args.title, body: args.detail ?? args.title }) });
+      return { message: routed.recorded, delivery: routed.delivery };
+    }
     case "acc_ack":
-      return service.markDelivery({ ...owner, messageId: args.messageId,
-        state: args.state ?? "acknowledged" });
-    case "acc_decide":
-      return service.recordDecision({ ...owner, title: args.title, outcome: args.outcome,
-        authority: args.authority ?? "workstream", workstreamId: args.workstreamId ?? null,
-        decidedBy: args.decidedBy, supersedes: args.supersedes ?? null,
-        humanConfirmed: args.humanConfirmed === true });
-    case "acc_workstream":
-      if (args.action === "coordinate") {
-        return service.acquireCoordinator({ ...owner, workstreamId: args.workstreamId });
-      }
-      if (args.action === "release") {
-        return service.releaseCoordinator({ ...owner, workstreamId: args.workstreamId });
-      }
-      return service.createWorkstream({ ...owner, title: args.title,
-        objective: args.objective });
-    case "acc_finish":
-      return service.finishSession({ ...owner, goal: args.goal, status: args.status,
+      return service.acknowledgeMessage({ ...owner, messageId: args.messageId });
+    case "acc_finish": {
+      const routed = await recordAndOffer({ router: context.deliveryRouter,
+        selectMessage: value => value.message,
+        record: () => service.finishSession({ ...owner,
+        clientMessageId: clientMessageId(args, service), goal: args.goal, status: args.status,
         completed: args.completed ?? [], remaining: args.remaining ?? [],
-        blockers: args.blockers ?? [], toParticipantId: args.toParticipantId ?? null });
+        blockers: args.blockers ?? [], toParticipantId: args.toParticipantId }) });
+      return { message: routed.recorded.message, delivery: routed.delivery };
+    }
     default:
       throw new AccError(EXIT.USAGE, `unknown tool: ${name}`, { name });
   }
@@ -198,15 +216,27 @@ async function handle(message, context) {
     case "resources/list":
       return complete({ resources: [...RESOURCES] });
     case "resources/read": {
-      const value = await readResource(params.uri, context);
+      // Snapshot and roster are observation-only. Inbox is a delivery boundary:
+      // resolve this configured participant's durable session and let the core
+      // inbox service record that the returned bodies were retrieved.
+      const resourceContext = params.uri === "acc://inbox"
+        ? { ...context, session: await resolveSession(context) }
+        : context;
+      const value = await readResource(params.uri, resourceContext);
       return complete({ contents: [{ uri: params.uri, mimeType: "application/json",
         text: JSON.stringify(value, null, 2) }] });
     }
     case "tools/call": {
       try {
-        const value = await callTool(params.name, params.arguments ?? {}, context);
+        const args = params.arguments === undefined ? {} : params.arguments;
+        const tool = PUBLIC_TOOLS.find(candidate => candidate.name === params.name);
+        if (tool === undefined) {
+          throw new AccError(EXIT.USAGE, `unknown tool: ${params.name}`, { name: params.name });
+        }
+        validateToolInput(tool.inputSchema, args);
+        const value = await callTool(params.name, args, context);
         return complete({ content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
-          structuredContent: JSON.stringify(value) });
+          structuredContent: value });
       } catch (error) {
         // A failing operation is a tool result, not a transport failure: the
         // model must see it and be able to react.