agents-can-communicate 0.1.9 → 0.1.11

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-claude-code/plugin/.claude-plugin/plugin.json

@@ -1,5 +1,4 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.1.6",
   "description": "Coordinate this Claude Code session with other AI agent sessions working in the same workspace: shared presence, resource claims, typed messages, and handoffs."
 }

package/node_modules/@agents-can-communicate/adapter-claude-code/src/install.mjs

@@ -1,10 +1,11 @@
-import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { cp, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 import { fileURLToPath } from "node:url";
 
 import { acccreatedFile, bakeSkillCommand, blankJson, mergeOwnedEntries, ownedEntries,
+  keepOnlyVersion, ownVersion, stampPluginVersion,
   removeIfEmpty,
   removeInstalledTree,
   removeOwnedEntries, writeForeignJson, writeHookShim }
@@ -122,7 +123,9 @@ const writeRegistry = async (file, value, remaining) => {
   return rm(file, { force: true });
 };
 
-const pluginVersion = async () => (await readJson(manifest, {})).version ?? "0.0.0";
+// One version on this machine: the package's own. The shipped manifest carries
+// none, so there is nothing in the repository to fall out of step.
+const pluginVersion = async () => ownVersion(import.meta.url);
 
 /** The marketplace manifest, in the shape the client's own directory sources use. */
 const marketplaceManifest = () => ({
@@ -147,6 +150,11 @@ async function layOutPlugin(target, { runner, node }) {
   // The bundle's hooks.json names this script, and nothing else writes it.
   await writeHookShim({ dir: path.join(target, "hooks"), adapterId: "claude_code",
     runner, node });
+  // The copy the client reads says which ACC wrote it. The shipped manifest
+  // carries no version, so there is nothing in the repository to fall out of
+  // step - which is how every client came to report 0.1.6 while running 0.1.9.
+  await stampPluginVersion({ file: path.join(target, ".claude-plugin", "plugin.json"),
+    version: await pluginVersion(), io: { readFile, writeFile } });
 }
 
 export async function installClaudePlugin({ configDir, runner, node, now = new Date() }) {
@@ -172,6 +180,11 @@ export async function installClaudePlugin({ configDir, runner, node, now = new D
   // run `claude plugin install`, exactly as the Codex adapter does, because the
   // command's only effect is this copy plus the two registry entries below.
   await layOutPlugin(cached, { runner, node });
+  // One copy, the one just written. A client caches a plugin under its version,
+  // so every upgrade would otherwise leave the previous release's tree beside
+  // this one - invisible while the version never moved, three deep once it did.
+  await keepOnlyVersion({ root: path.dirname(cached), version,
+    io: { readdir, rm } });
 
   await writeClientJson(knownMarketplacesPath(configDir), {
     ...known,

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/plugin/.codex-plugin/plugin.json

@@ -1,9 +1,13 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.1.6",
   "description": "Coordinate this Codex session with other AI agent sessions working in the same workspace.",
   "license": "UNLICENSED",
-  "keywords": ["coordination", "multi-agent", "claims", "handoff"],
+  "keywords": [
+    "coordination",
+    "multi-agent",
+    "claims",
+    "handoff"
+  ],
   "skills": "./skills/",
   "hooks": "./hooks.json",
   "interface": {
@@ -12,6 +16,9 @@
     "longDescription": "Attaches this session to a local coordination plane shared with Codex, Claude Code, Gemini CLI, and MCP clients working in the same workspace. Publishes what this session is doing, warns before two sessions edit the same resource, carries typed messages between participants, and records a handoff at the end.",
     "developerName": "automatis-tools",
     "category": "Developer Tools",
-    "capabilities": ["Read", "Write"]
+    "capabilities": [
+      "Read",
+      "Write"
+    ]
   }
 }

package/node_modules/@agents-can-communicate/adapter-codex/src/adapter.mjs

@@ -68,8 +68,10 @@ export function createCodexAdapter() {
           "write guards cover apply_patch and the shell writes ACC can read; a model "
             + "without apply_patch edits through the shell, where a redirection or an "
             + "mv is matched and a runtime opening the file is not",
-          "Codex requires hooks to be trusted before they run; an untrusted plugin is "
-            + "installed but inert",
+          // Was a standing sentence here, true and useless: it said the same
+          // thing on a machine whose hooks were trusted, on one whose were not,
+          // and on one with nothing installed. Detection reads the client's own
+          // record now and speaks only when it has something to report.
         ],
       };
     },

package/node_modules/@agents-can-communicate/adapter-codex/src/install.mjs

@@ -1,8 +1,9 @@
-import { cp, mkdir, readFile, rm, rmdir, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, readdir, readFile, rm, rmdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { bakeSkillCommand, blankJson, blankText, removeIfEmpty, removeInstalledTree,
+  keepOnlyVersion, ownVersion, stampPluginVersion,
   removeTomlBlock, stripBlock, tomlString,
   writeForeignJson, writeHookShim, writeTomlBlock }
   from "@agents-can-communicate/adapter-sdk";
@@ -199,11 +200,19 @@ export async function installCodexPlugin({ home, agentsHome = home,
 
   // The client runs the cached copy, so this has to happen after the shim and
   // the rewritten hooks.json are in place.
-  const { version } = await readJson(
-    path.join(target, ".codex-plugin", "plugin.json"), { version: "0.0.0" });
+  // One version on this machine: the package's own. The shipped manifest carries
+  // none, so nothing in the repository can fall out of step with it - which is
+  // how every client came to report 0.1.6 while running 0.1.9. The copy the
+  // client reads is stamped, so it says which ACC wrote it.
+  const version = await ownVersion(import.meta.url);
+  await stampPluginVersion({ file: path.join(target, ".codex-plugin", "plugin.json"),
+    version, io: { readFile, writeFile } });
   const cached = cachedVersionPath(codexHome, version);
   await rm(cached, { recursive: true, force: true });
   await cp(target, cached, { recursive: true });
+  // One copy, the one just written - and only inside this plugin's own
+  // directory. The marketplace cache root above it holds other people's plugins.
+  await keepOnlyVersion({ root: path.dirname(cached), version, io: { readdir, rm } });
 
   // The plugin's own directory in the cache. Not the versioned one inside it,
   // which goes stale the moment the version changes - and not the marketplace
@@ -229,33 +238,6 @@ async function removeEmptyDirs(directories) {
   }
 }
 
-/**
- * Drop the client's trust record for hooks that are about to stop existing.
- *
- * Scoped to tables whose key begins with ACC's own `plugin@marketplace:` - a
- * table belonging to any other plugin is the client's business and stays. The
- * file is rewritten only when something was found, so an install that never ran
- * here leaves the config byte for byte as it was.
- */
-export async function removeHookTrust(file, prefix) {
-  const before = await readFile(file, "utf8").catch(() => null);
-  if (before === null || !before.includes(`hooks.state."${prefix}`)) return false;
-
-  const lines = before.split("\n");
-  const kept = [];
-  let dropping = false;
-  for (const line of lines) {
-    const header = /^\s*\[([^\]]*)\]\s*$/.exec(line);
-    if (header !== null) dropping = header[1].startsWith(`hooks.state."${prefix}`);
-    if (dropping) continue;
-    kept.push(line);
-  }
-  // A table's trailing blank line goes with it rather than piling up.
-  const text = kept.join("\n").replace(/\n{3,}/g, "\n\n");
-  if (text === before) return false;
-  await writeFile(file, text, "utf8");
-  return true;
-}
 
 export async function uninstallCodexPlugin({ home, agentsHome = home,
   codexHome = path.join(home, ".codex"), keep = [] }) {
@@ -268,15 +250,18 @@ export async function uninstallCodexPlugin({ home, agentsHome = home,
     await writeMarketplace(file, { ...existing, plugins: kept });
   }
   if (await removeTomlBlock(configPath(codexHome))) changes.push(configPath(codexHome));
-  // This client keeps its own record of which hook files it has trusted, one
-  // table per hook, keyed by the plugin that declared them. ACC never writes
-  // those - they are the client's bookkeeping about ACC - but once the plugin is
-  // gone they name a thing that does not exist, five of them per install, and
-  // nothing else will ever clear them. Verified inert first: a hook whose hash
-  // no longer matches still runs, so this is tidiness rather than repair.
-  if (await removeHookTrust(configPath(codexHome), `${PLUGIN_NAME}@${MARKETPLACE}:`)) {
-    if (!changes.includes(configPath(codexHome))) changes.push(configPath(codexHome));
-  }
+  // The client's `[hooks.state."<plugin>:…"]` tables stay. 0.1.9 removed them as
+  // litter naming a plugin that was gone; that was wrong, and wrong in a way
+  // worth writing down. The check behind it perturbed the record - a hook whose
+  // recorded hash no longer *matched* was seen still running - and concluded the
+  // record was inert. Absence was never tested, and absence is what matters:
+  // with the tables gone this client runs no hook at all, prints
+  // `hook: SessionStart Completed` while executing nothing, and ACC's write
+  // guard is silently off while `acc doctor` reports the adapter installed.
+  //
+  // The record is granted once, by a person, and survives ACC upgrades - hashes
+  // captured under 0.1.6 still admitted 0.1.10's hooks. Nothing ACC writes can
+  // put it back. So it is not ACC's to remove.
   // The marketplace directory is ACC's too, so it goes rather than being left
   // behind empty.
   // A blank TOML config and an absent one are the same to this client, and a
@@ -319,6 +304,13 @@ export async function detectCodex({ home, agentsHome = home,
   const enabled = config.includes(`[plugins."${QUALIFIED}"]`);
   const cached = await stat(cachePath(codexHome))
     .then(() => true).catch(() => false);
+  // The condition that decides whether ACC runs here at all, and the only one
+  // this client will not tell you about: with no trust record it runs no hook,
+  // prints `hook: SessionStart Completed`, and executes nothing. Everything else
+  // - published, registered, enabled, cached - can be true while the write guard
+  // is off. Only asked when something is wired: a warning about hooks that do
+  // not exist is how a real one gets ignored.
+  const untrusted = cached && !config.includes(`hooks.state."${QUALIFIED}:`);
   return { ok: true, changes: [], diagnostics: [
     published ? "acc plugin published in the marketplace" : "acc plugin not registered",
     registered && enabled
@@ -330,7 +322,25 @@ export async function detectCodex({ home, agentsHome = home,
     cached
       ? "plugin installed in the client's cache"
       : `plugin not installed yet; run: codex plugin add ${QUALIFIED}`,
-  ] };
+    // The condition that decides whether ACC runs here at all, and the only one
+    // this client will not tell you about: with no trust record it runs no hook,
+    // prints `hook: SessionStart Completed`, and executes nothing. Everything
+    // else - published, registered, enabled, cached - can be true while the
+    // write guard is off. Said only when there is something to trust, because a
+    // warning on a machine with nothing wired is how a real one gets ignored.
+    ...(untrusted
+      ? ["hooks are not trusted, so this client reports them completed and runs "
+        + "nothing"]
+      : []),
+  ],
+  // Said as an action rather than an observation, because a person has to do it
+  // and no acc command can: the client grants this once, from its own prompt.
+  // A diagnostic alone would have stayed in `--json`, which is where the first
+  // version of this fix put it and where nobody would have read it.
+  needsAction: untrusted
+    ? ["start codex once and accept the hook trust prompt  "
+      + "# its hooks run nothing until then"]
+    : [] };
 }
 
 /**

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-kimi",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/plugin/.kimi-plugin/plugin.json

@@ -1,6 +1,5 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.1.6",
   "description": "Coordinate this Kimi Code session with other AI agent sessions working in the same workspace: shared presence, resource claims, typed messages, and handoffs.",
   "skills": "./skills/",
   "sessionStart": {

package/node_modules/@agents-can-communicate/adapter-kimi/src/install.mjs

@@ -5,6 +5,7 @@ import { AccError, EXIT } from "@agents-can-communicate/protocol";
 import { fileURLToPath } from "node:url";
 
 import { assertRunner, bakeSkillCommand, blankText, defaultRunner, removeIfEmpty,
+  ownVersion, stampPluginVersion,
   removeInstalledTree, runnerExists, writeForeignJson }
   from "@agents-can-communicate/adapter-sdk";
 
@@ -132,6 +133,10 @@ export async function installKimiPlugin({ home, runner = defaultRunner(), node }
   const target = pluginPath(home);
   await rm(target, { recursive: true, force: true });
   await cp(bundle, target, { recursive: true });
+  // The copy this client reads says which ACC wrote it. Nothing here reads it
+  // back, but a manifest that names a version it is not is a lie either way.
+  await stampPluginVersion({ file: path.join(target, ".kimi-plugin", "plugin.json"),
+    version: await ownVersion(import.meta.url), io: { readFile, writeFile } });
   // The skill ships with a placeholder where the command belongs: `acc` is
   // not on PATH everywhere, and an agent that cannot run it improvises.
   await bakeSkillCommand({ root: target, node });

package/node_modules/@agents-can-communicate/adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-sdk",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/src/index.mjs

@@ -9,6 +9,7 @@ export { BEGIN, END, removeTomlBlock, renderBlock, stripBlock, tomlString, write
   from "./toml-block.mjs";
 export { projectContext } from "./context-projector.mjs";
 export { shellWriteTargets } from "./shell-writes.mjs";
+export { keepOnlyVersion, ownVersion, stampPluginVersion } from "./own-version.mjs";
 export { editJson, readJson } from "./json-text.mjs";
 export { formatJsonAs, jsonStyleOf, mergeOwnedConfig, mergeOwnedEntries, ownedEntries, ownedKeys,
   acccreatedFile, removeIfEmpty, removeOwnedConfig, removeOwnedEntries, writeForeignJson,

package/node_modules/@agents-can-communicate/adapter-sdk/src/own-version.mjs

@@ -0,0 +1,81 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * The version of the ACC that is running.
+ *
+ * Every plugin manifest used to carry its own version literal, updated by hand
+ * and by nobody: three releases after 0.1.6 the package was 0.1.9 while every
+ * client had cached, listed and reported 0.1.6. That is not cosmetic - the
+ * version string is how a client decides whether its cached copy is current, so
+ * a bundle whose version never changes is one it has no reason to replace.
+ *
+ * Read by walking up for the nearest `package.json`, which lands on the calling
+ * package in a checkout and on the same file once bundled, where every package
+ * is versioned together. Answers `0.0.0` rather than throwing: an install that
+ * cannot read its own version should still lay a plugin down, under a version
+ * that is visibly wrong rather than crash.
+ */
+export async function ownVersion(fromUrl) {
+  let directory = path.dirname(fileURLToPath(fromUrl));
+  for (;;) {
+    const candidate = path.join(directory, "package.json");
+    const text = await readFile(candidate, "utf8").catch(() => null);
+    if (text !== null) {
+      try {
+        const version = JSON.parse(text).version;
+        if (typeof version === "string" && version !== "") return version;
+      } catch {
+        // A manifest that will not parse is not this package's version.
+      }
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) return "0.0.0";
+    directory = parent;
+  }
+}
+
+/**
+ * Stamp a laid-out plugin manifest with the version that wrote it.
+ *
+ * The shipped manifest carries no version of its own, so there is nothing in the
+ * repository to fall out of step. Best-effort: a manifest that is not there was
+ * not ours to stamp.
+ */
+export async function stampPluginVersion({ file, version, io }) {
+  const text = await io.readFile(file, "utf8").catch(() => null);
+  if (text === null) return false;
+  let manifest;
+  try {
+    manifest = JSON.parse(text);
+  } catch {
+    return false;
+  }
+  await io.writeFile(file, `${JSON.stringify({ ...manifest, version }, null, 2)}\n`);
+  return true;
+}
+
+/**
+ * Leave one copy of a versioned plugin, the one just written.
+ *
+ * These clients cache a plugin under its version. Until the version tracked the
+ * package it never changed, every install landed in the same directory and
+ * overwrote itself, and nothing accumulated. Once it started moving, the first
+ * upgrade left three copies of ACC in a home that should hold one.
+ *
+ * Scoped to the plugin's own directory. The marketplace cache root above it
+ * holds every plugin installed from that marketplace, and removing that root
+ * once took a plugin the user had installed themselves - so a sibling here is
+ * an older ACC, and a sibling one level up is somebody else's.
+ */
+export async function keepOnlyVersion({ root, version, io }) {
+  const entries = await io.readdir(root, { withFileTypes: true }).catch(() => []);
+  const removed = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name === version) continue;
+    await io.rm(path.join(root, entry.name), { recursive: true, force: true });
+    removed.push(entry.name);
+  }
+  return removed;
+}

package/node_modules/@agents-can-communicate/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/cli",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/cli/src/doctor-command.mjs

@@ -130,6 +130,9 @@ async function diagnoseAdapters({ options, runtime }) {
     if (owned.missing.length > 0) {
       remediation.push(`acc install --adapter ${entry.adapterId}  # files are missing`);
     }
+    // An adapter can name something only a person can do - the client's own
+    // trust prompt, most of all. It goes where a person reads, not into --json.
+    remediation.push(...(entry.needsAction ?? []));
     const installed = record.installs.find(one => one.adapterId === entry.adapterId);
     const stale = staleInstall({ recorded: installed?.accVersion ?? null, running });
     if (stale !== null) {

package/node_modules/@agents-can-communicate/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/core",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/hook-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/hook-runner",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/installer",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": { ".": "./src/index.mjs" },

package/node_modules/@agents-can-communicate/installer/src/detect.mjs

@@ -44,7 +44,8 @@ export async function detectInstallation({ adapters, context, probe = spawnProbe
     .map(async adapter => {
       const entry = { adapterId: adapter.id, displayName: adapter.displayName,
         present: false, version: null, versionOutput: null, installed: false,
-        diagnostics: [], capabilities: adapter.capabilities ?? {}, error: null };
+        diagnostics: [], needsAction: [], capabilities: adapter.capabilities ?? {},
+        error: null };
 
       try {
         const output = await withTimeout(
@@ -65,6 +66,9 @@ export async function detectInstallation({ adapters, context, probe = spawnProbe
       try {
         const detected = await adapter.detect(context);
         entry.diagnostics = detected.diagnostics ?? [];
+        // What a person has to do, as opposed to what is true. Adapters that
+        // have nothing to ask for say nothing.
+        entry.needsAction = detected.needsAction ?? [];
         // "Installed" is the adapter's own answer, phrased in its own terms.
         // The installer does not second-guess it by looking at files it does
         // not understand.

package/node_modules/@agents-can-communicate/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/mcp-server",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/protocol",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/storage-filesystem/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/storage-filesystem",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "private": true,
   "type": "module",
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "type": "module",
   "description": "Local-first coordination for independently opened AI agent sessions.",
   "keywords": [