agents-can-communicate 0.10.2 → 0.10.4

package/docs/ARCHITECTURE.md

@@ -275,7 +275,9 @@ read, keeps it a hold. A client that wakes later runs its next hook through the
 the active generation. A binding that names its client stops holding when that process exits,
 or when the process that now has its pid started after the binding was last written, since a
 client runs when it writes its binding (#276); a start time that cannot be read decides
-nothing. Otherwise presence TTL, `acc finish`, and delivery off do not prove native lifecycle
+nothing. A zombie, a process that has exited but that its parent has not collected, counts as
+exited for a binding, an ACC lease and a pin (#280); a process state that cannot be read
+decides nothing. Otherwise presence TTL, `acc finish`, and delivery off do not prove native lifecycle
 end. A pending release that cannot activate is replaced by a newer one when `acc update` runs
 or an automatic check is due (#277). Normal background updates never
 restart a vendor daemon. An explicitly approved maintenance job can do so through the

package/docs/TROUBLESHOOTING.md

@@ -158,6 +158,16 @@ delivery, start Codex without it; put a setting you need in `config.toml` instea
 If a reply stays queued with `transport_permission_denied`, the sender's permissions
 blocked local transport. This is distinct from an unavailable recipient. The message was
 recorded successfully; the error does not mean it was read or acknowledged.
+For Codex sends, use the exact installed ACC wrapper through the client's approved
+command path (`exec_command` with `sandbox_permissions: "require_escalated"`). The
+installed ACC prefix rule can authorize that command. Keep it separate from other
+shell commands. If delivery was already attempted, retry the same arguments and
+the original `--client-message-id` printed by the CLI. This retries the recorded
+message instead of recording another one. An initial execution refusal records
+nothing; a refused retry does not erase an earlier recorded message.
+On Codex 0.162.0 on macOS, even an installed socket allowlist did not permit direct
+access to the daemon socket from the sandbox. A configured profile alone therefore
+does not prove that a sandboxed sender can reach another Codex session.
 On Codex 0.153.4 or newer, rerun `acc install --adapter codex` with existing
 live consent. Add `--delivery actionable` when new consent is required, then start a new session.
 With ACC 0.8.0 or 0.8.1, every live offer from a Codex session to Claude Code failed this way:

package/docs/UPGRADING.md

@@ -1,5 +1,21 @@
 # Upgrading
 
+## From 0.10.3
+
+Update as usual with `acc update`. Version 0.10.4 preserves sender permission
+failures as `transport_permission_denied`, including when access to socket
+metadata or an expired delivery binding is denied. The CLI prints the original
+retry key so the same recorded message can be offered again without a duplicate.
+
+The refreshed Codex skill uses the client's approved command path for outgoing
+ACC messages. ACC's existing exact-wrapper rule can authorize those commands.
+An initial execution refusal records no message; a refused retry preserves an
+earlier durable message. See [sender permissions](TROUBLESHOOTING.md#i-enabled-live-delivery-but-got-fallback)
+for the recovery procedure.
+
+This release keeps store contract 7 and adds no data migration. The update
+refreshes installed integrations while preserving their recorded delivery policy.
+
 ## Store contract 6 to 7
 
 ACC moves each workspace's store from contract 6 to 7 by itself, right after an update
@@ -69,6 +85,8 @@ acc update
 `--pin none` keeps following stable releases and drops a pending release that is not pinned.
 From 0.10.2, the update does this by itself: a pending release that cannot activate is replaced
 by a newer one, and a binding whose pid another program now has no longer holds the update.
+From 0.10.3, a process that has exited but that its parent has not collected (a zombie, `Z` in
+`ps`) no longer holds it either.
 
 ## From 0.8.x
 
@@ -368,7 +386,10 @@ PID/start time, executable, socket ownership and versions before stopping the se
 It refreshes integrations, starts the service again and verifies the result. If refreshing
 integrations fails, it still restores the service and reports the incomplete update.
 A later update worker can resume an already approved recovery without another question.
+A daemon that its parent leaves as a zombie after the stop counts as stopped, and the worker
+starts the service again.
 `acc doctor --json` exposes `update.maintenance`; ordinary `acc doctor` describes its state.
+A failed or cancelled job is no longer reported once its release is active by another path.
 A current launcher can use the newer management reader while the old runtime is active.
 When admission is blocked, doctor returns an update-only report without inspecting the
 workspace or repairing it. Older launchers gain this reader after activation, or through

package/node_modules/@agents-can-communicate/adapter-antigravity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-antigravity",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-antigravity/plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "acc",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Coordinate this Antigravity CLI session with other AI agent sessions working in the same workspace."
 }

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/plugin/skills/acc/SKILL.md

@@ -16,6 +16,25 @@ Use this skill when hook context reports peers or actionable attention, or
 the user asks for coordination between sessions. An `ACC CLI (append):` header
 by itself supplies identity for later use; continue the user's ordinary work.
 
+### Send through Codex's approved command path
+
+Run `message`, `request`, `reply`, and `finish` with `exec_command` and
+`sandbox_permissions: "require_escalated"`. Put the installed `{{ACC}}` wrapper
+first in the command. ACC's installed prefix rule can then authorize that exact
+local command. Do not combine it with other shell commands. These sends stay
+on this machine and reach the user's own agent sessions.
+
+Codex can deny its daemon socket inside the sandbox even when the ACC profile
+allows the socket. The approved command path preserves that sandbox boundary.
+An initial execution refusal records no message. If a retry is refused, the
+earlier recorded message remains durable. Report which case occurred.
+
+Choose a distinct `--client-message-id` for each new send. If delivery reports
+`transport_permission_denied`, retry the same command through approved execution
+with the same key and content. The CLI prints the original key when it generated
+one. A retry uses the recorded message and offers it again only while queued.
+Use normal sandboxed execution for local reads and claims.
+
 ## Use your own CLI credentials
 
 When this turn's ACC hook supplies `ACC CLI (append):`, append those exact

package/node_modules/@agents-can-communicate/adapter-codex/src/maintenance-host.mjs

@@ -181,6 +181,12 @@ export async function observeMaintenanceProcess(pid, paths, run, { system = WIND
   if (response.status !== 0) return { state: "unknown" };
   const match = /^(.{24})\s+(.+)$/.exec(response.stdout.trim());
   if (!match || !startTimeValid(match[1])) return { state: "unknown" };
+  // A zombie has exited; only its parent has not collected it. `ps` names it
+  // `<defunct>` on macOS and `[name] <defunct>` on Linux. On 2026-10-06 the
+  // daemon `daemon stop` ended stayed one under Codex's own pid-update-loop,
+  // and reading it as alive left the stop unverified and the start refused
+  // (#280).
+  if (/<defunct>$/.test(match[2])) return { state: "dead" };
   return { state: "alive", processStartTime: match[1], command: match[2] };
 }
 

package/node_modules/@agents-can-communicate/adapter-codex/src/native-delivery.mjs

@@ -168,22 +168,25 @@ async function bindAttempt({ event, clientPid, clientVersion, runtimeDir,
 // what `codex --version` printed, and a daemon that had updated under its CLI
 // was refused here on that difference alone.
 async function receiverFor(binding, runtimeDir, platform = process.platform) {
-  const endpoint = await readNativeEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef, platform });
-  return endpoint !== null && await socketIsReady(endpoint.socketPath, { platform }) ? endpoint : null;
+  const endpoint = await readNativeEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef,
+    platform, throwPermissionErrors: true });
+  return endpoint !== null && await socketIsReady(endpoint.socketPath,
+    { platform, throwPermissionErrors: true }) ? endpoint : null;
 }
 
 export async function refreshNativeSession({ binding, runtimeDir, timeoutMs = 750,
   now = Date.now, open = openCodexAppServer, platform = process.platform } = {}) {
   const rejected = reason => closed(binding?.clientVersion, reason);
-  const endpoint = await receiverFor(binding, runtimeDir, platform);
-  if (endpoint === null) return rejected("handshake_failed");
   try {
+    const endpoint = await receiverFor(binding, runtimeDir, platform);
+    if (endpoint === null) return rejected("handshake_failed");
     return await usingPeer(endpoint.socketPath, timeoutMs, open, async peer => {
       const { reasonCode, servingVersion } = await verifyReceiver(peer, endpoint);
       return reasonCode === null
         ? handshake({ ...endpoint, clientVersion: servingVersion }, now) : rejected(reasonCode);
     });
   } catch (error) {
+    if (["EPERM", "EACCES"].includes(error?.code)) return rejected("transport_permission_denied");
     return rejected(error?.code === "ETIMEDOUT" ? "handshake_timeout" : "handshake_failed");
   }
 }
@@ -192,9 +195,9 @@ export async function offerMessage({ binding, message, runtimeDir, timeoutMs = 5
   open = openCodexAppServer, platform = process.platform } = {}) {
   const rejected = safeErrorCode => ({ accepted: false, transport: "codex-app-server",
     clientVersion: binding?.clientVersion ?? null, safeErrorCode });
-  const endpoint = await receiverFor(binding, runtimeDir, platform);
-  if (endpoint === null) return rejected("recipient_unavailable");
   try {
+    const endpoint = await receiverFor(binding, runtimeDir, platform);
+    if (endpoint === null) return rejected("recipient_unavailable");
     return await usingPeer(endpoint.socketPath, timeoutMs, open, async peer => {
       const { reasonCode, servingVersion } = await verifyReceiver(peer, endpoint);
       if (reasonCode !== null) return rejected(reasonCode === "handshake_timeout" ? "transport_error"

package/node_modules/@agents-can-communicate/adapter-codex/src/native-endpoint.mjs

@@ -50,18 +50,25 @@ async function directory(runtimeDir, create = false, platform = process.platform
  * 0.159.3), so there the socket counts while its directory lists it; Codex keeps
  * that directory to its user.
  */
-export async function socketIsReady(socketPath, { platform = process.platform } = {}) {
+export async function socketIsReady(socketPath, { platform = process.platform,
+  throwPermissionErrors = false } = {}) {
   if (isWindowsPlatform(platform)) {
     if (!absolute(socketPath)) return false;
     const name = path.basename(socketPath).toLowerCase();
-    const names = await readdir(path.dirname(socketPath)).catch(() => []);
+    const names = await readdir(path.dirname(socketPath)).catch(error => {
+      if (throwPermissionErrors && ["EPERM", "EACCES"].includes(error.code)) throw error;
+      return [];
+    });
     return names.some(entry => entry.toLowerCase() === name);
   }
   if (!absolute(socketPath)) return false;
   try {
     const info = await lstat(socketPath);
     return info.isSocket() && !info.isSymbolicLink() && own(info);
-  } catch { return false; }
+  } catch (error) {
+    if (throwPermissionErrors && ["EPERM", "EACCES"].includes(error.code)) throw error;
+    return false;
+  }
 }
 
 /** The socket a control socket path leads to, or null. Codex 0.157.1 keeps a
@@ -104,7 +111,8 @@ export async function writeNativeEndpoint({ runtimeDir, record, platform = proce
 
 // Expired records are metadata for revalidation, never proof of reachability.
 // Refuse links and oversized files before reading; no foreign error text escapes.
-export async function readNativeEndpoint({ runtimeDir, endpointId, platform = process.platform }) {
+export async function readNativeEndpoint({ runtimeDir, endpointId, platform = process.platform,
+  throwPermissionErrors = false }) {
   if (typeof endpointId !== "string" || !ENDPOINT.test(endpointId)) return null;
   let handle;
   try {
@@ -116,7 +124,10 @@ export async function readNativeEndpoint({ runtimeDir, endpointId, platform = pr
     }
     const record = JSON.parse(await handle.readFile("utf8"));
     return valid(record) && record.endpointId === endpointId ? record : null;
-  } catch { return null; }
+  } catch (error) {
+    if (throwPermissionErrors && ["EPERM", "EACCES"].includes(error.code)) throw error;
+    return null;
+  }
   finally { await handle?.close().catch(() => null); }
 }
 

package/node_modules/@agents-can-communicate/adapter-gemini-cli/extension/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Coordinate this Gemini CLI session with other AI agent sessions working in the same workspace.",
   "contextFileName": "skills/acc/SKILL.md"
 }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-grok/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-grok",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-kimi",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-sdk",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/src/index.mjs

@@ -29,7 +29,7 @@ export { clearSessionBinding, listSessionBindings, loadSessionBinding,
 
 export { clearNativeAttempt, loadNativeAttempt, storeNativeAttempt } from "./native-attempt.mjs";
 export { channelSocketDirectory } from "./channel-directory.mjs";
-export { readProcessArgs, readProcessTable, readWindowsProcess, splitWindowsCommandLine }
+export { processIsZombie, readProcessArgs, readProcessTable, readWindowsProcess, splitWindowsCommandLine }
   from "./process-table.mjs";
 export { npmShimTarget, resolveExecutable, runExecutable } from "./executables.mjs";
 export { pathOf } from "./executables.mjs";

package/node_modules/@agents-can-communicate/adapter-sdk/src/native-vocabulary.mjs

@@ -29,6 +29,8 @@ export const NATIVE_REASON_CODES = Object.freeze([
   "prerelease_not_captured", "below_minimum_version", "known_bad_version",
   "feature_probe_failed", "probe_timeout", "probe_version_mismatch", "protocol_mismatch",
   "native_endpoint_unavailable", "native_session_unavailable",
+  // A caller can be denied access to a healthy receiver's local transport.
+  "transport_permission_denied",
   "handshake_failed", "handshake_timeout", "handshake_version_mismatch",
   "session_generation_stale", "client_process_unknown", "unsupported_shell",
   // The current session's canonical workspace identity could not be verified.

package/node_modules/@agents-can-communicate/adapter-sdk/src/process-table.mjs

@@ -165,6 +165,26 @@ export async function readProcessTable({ platform = process.platform, from = pro
   return posixTable({ run, timeoutMs });
 }
 
+/**
+ * Whether a process has exited and only waits for its parent to collect it -
+ * the POSIX zombie, `ps` state `Z`. `kill(pid, 0)` succeeds for one and `ps`
+ * still lists its start time, so a liveness check that stops there calls it
+ * alive: on 2026-10-06 a stopped Codex daemon left as a zombie under Codex's
+ * own pid-update-loop kept an ACC update blocked and its restart refused
+ * (#280). True or false when `ps` answers; null when it does not. Windows has
+ * no such state.
+ */
+export async function processIsZombie(pid, { platform = process.platform, run = execFileAsync,
+  timeoutMs = 2_000 } = {}) {
+  if (platform === "win32") return false;
+  try {
+    const { stdout } = await run("/bin/ps", ["-p", String(pid), "-o", "stat="],
+      { timeout: timeoutMs, env: { ...process.env, LC_ALL: "C" } });
+    const state = String(stdout).trim();
+    return state === "" ? null : state.startsWith("Z");
+  } catch { return null; }
+}
+
 /**
  * The words one process was started with, or null when they cannot be read.
  *

package/node_modules/@agents-can-communicate/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/cli",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/cli/src/main.mjs

@@ -6,6 +6,7 @@ import { AccError, CONFIG_FILENAME, EXIT, GENERIC_MESSAGE_KINDS, VALID_OBLIGATIO
   failure, ok }
   from "@agents-can-communicate/protocol";
 import { createCoordinationService } from "@agents-can-communicate/core";
+import { shellQuote } from "@agents-can-communicate/adapter-sdk";
 import { describeNativeReason } from "@agents-can-communicate/installer";
 import { openFilesystemStore } from "@agents-can-communicate/storage-filesystem";
 
@@ -162,7 +163,10 @@ export function recordedText(message, delivery) {
       ? `woke ${item.recipientParticipantId} via ${item.transport}; the message arrives with its next turn`
     : item.outcome === "queued"
       ? item.errorCode === "transport_permission_denied"
-        ? "live offer blocked by sender permissions; message remains queued; run acc doctor in the sending session"
+        ? "live offer blocked by sender permissions; message remains queued; retry the same command "
+          + "through approved execution"
+          + (typeof message.clientMessageId === "string"
+            ? ` with --client-message-id ${shellQuote(message.clientMessageId)}` : " with its original retry key")
         : item.errorCode === "no_live_transport"
           ? `${item.recipientParticipantId} has no live transport`
             + `${item.nativeReasonCode ? ` (${describeNativeReason(item.nativeReasonCode,

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/activation.mjs

@@ -7,7 +7,7 @@ import { readdir, rm, stat } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { promisify } from "node:util";
-import { readWindowsProcess } from "@agents-can-communicate/adapter-sdk";
+import { processIsZombie, readWindowsProcess } from "@agents-can-communicate/adapter-sdk";
 import { classifySessionPresence } from "@agents-can-communicate/core";
 import { assertPortableId } from "@agents-can-communicate/protocol";
 import { readSessionRecord, withWriterMutex } from "@agents-can-communicate/storage-filesystem";
@@ -83,11 +83,18 @@ async function pidReused(pid, file, startedAt) {
   return started !== null && written !== null && started > written + 1_000;
 }
 
-// One start-time reading per pid for one pass: a vendor service can hold several bindings.
-const perPass = startedAt => {
+// A zombie has exited; only its parent has not collected it, and kill(pid, 0)
+// still succeeds for it. On 2026-10-06 the Codex daemon `daemon stop` ended
+// stayed one under Codex's own pid-update-loop and kept 0.10.2 pending (#280).
+// A state that cannot be read decides nothing.
+const exitedProcess = async (pid, pidIsAlive, zombie) =>
+  await confirmedDead(pid, pidIsAlive) || await zombie(pid) === true;
+
+// One reading per pid for one pass: a vendor service can hold several bindings.
+const perPass = read => {
   const seen = new Map();
   return pid => {
-    if (!seen.has(pid)) seen.set(pid, Promise.resolve().then(() => startedAt(pid)).catch(() => null));
+    if (!seen.has(pid)) seen.set(pid, Promise.resolve().then(() => read(pid)).catch(() => null));
     return seen.get(pid);
   };
 };
@@ -100,7 +107,7 @@ const perPass = startedAt => {
  * process, or a record or store that cannot be read, keeps the binding a hold.
  * On 2026-10-06 the maintainer's 0.10.0 waited behind 32 such bindings from
  * 0.5.10 to 0.9.0 that no client could clear (#273). */
-async function staleWithoutPid(workspaceRoot, workspaceId, record, pidIsAlive, file, startedAt) {
+async function staleWithoutPid(workspaceRoot, workspaceId, record, pidIsAlive, file, startedAt, zombie) {
   if (record?.schemaVersion !== 1) return false;
   let session;
   try {
@@ -109,7 +116,7 @@ async function staleWithoutPid(workspaceRoot, workspaceId, record, pidIsAlive, f
   } catch { return false; }
   if (session === null) return true;
   if (Number.isSafeInteger(session.pid) && session.pid > 0) {
-    return await confirmedDead(session.pid, pidIsAlive) || pidReused(session.pid, file, startedAt);
+    return await exitedProcess(session.pid, pidIsAlive, zombie) || pidReused(session.pid, file, startedAt);
   }
   // No process to ask, so the probe is never called.
   return classifySessionPresence(session, new Date().toISOString(), () => true) === "offline";
@@ -117,10 +124,10 @@ async function staleWithoutPid(workspaceRoot, workspaceId, record, pidIsAlive, f
 
 /** Native bindings outlive finish/TTL; MCP process lifetime is covered by its runtime lease. */
 export async function listNativeHolds(root, { pidIsAlive = defaultPidIsAlive, strict = false,
-  startedAt = processStartedAt } = {}) {
+  startedAt = processStartedAt, zombie = processIsZombie } = {}) {
   const workspaces = path.join(path.dirname(await canonicalManagerRoot(root)), "workspaces");
   if (!await managedDirectory(workspaces)) return [];
-  const started = perPass(startedAt);
+  const started = perPass(startedAt), zombieNow = perPass(zombie);
   const holds = [];
   for (const entry of await readdir(workspaces, { withFileTypes: true })) {
     if (!entry.isDirectory()) {
@@ -142,9 +149,10 @@ export async function listNativeHolds(root, { pidIsAlive = defaultPidIsAlive, st
       if (record === undefined) continue; // Concurrent lifecycle removal, before fencing.
       if (await isMcpContinuity(record, name, path.dirname(bindings), entry.name)) continue;
       const pid = clientPidOf(record);
-      if (pid !== null && (await confirmedDead(pid, pidIsAlive) || await pidReused(pid, file, started))) continue;
+      if (pid !== null && (await exitedProcess(pid, pidIsAlive, zombieNow)
+        || await pidReused(pid, file, started))) continue;
       if (pid === null && await staleWithoutPid(path.dirname(bindings), entry.name, record, pidIsAlive,
-        file, started)) continue;
+        file, started, zombieNow)) continue;
       holds.push({ kind: "native", pid, reason: pid === null ? "unknown_client_pid" : "client_running",
         storeVersion: Number.isSafeInteger(record?.storeVersion) ? record.storeVersion : null });
     }
@@ -159,8 +167,9 @@ const lifecycleLocks = (workspaceRoot, harnessSessionId) => ({ locks: path.join(
   "lifecycle-locks", createHash("sha256").update(String(harnessSessionId)).digest("hex")) });
 
 /** Remove the bindings that listNativeHolds no longer counts and an older
- * generation still does: those without a client pid that are stale (#273), and
- * those whose pid was given to another program (#276). An older generation
+ * generation still does: those without a client pid that are stale (#273),
+ * those whose pid was given to another program (#276), and those whose client
+ * is a zombie (#280). An older generation
  * activates its successor with its own rule, and loads the pending generation's
  * refresh before it lists blockers, so that refresh calls this. A binding whose
  * pid is merely dead holds nothing for either and stays, as the record a resumed
@@ -168,11 +177,11 @@ const lifecycleLocks = (workspaceRoot, harnessSessionId) => ({ locks: path.join(
  * lifecycle lock, so a hook that renews it is either seen or comes after (AI
  * review of #274); a lock that stays busy leaves the binding as it is. */
 export async function sweepStaleBindings(root, { pidIsAlive = defaultPidIsAlive,
-  startedAt = processStartedAt } = {}) {
+  startedAt = processStartedAt, zombie = processIsZombie } = {}) {
   const workspaces = path.join(path.dirname(await canonicalManagerRoot(root)), "workspaces");
   if (!await managedDirectory(workspaces)) return 0;
   const clock = { now: () => new Date().toISOString() };
-  const started = perPass(startedAt);
+  const started = perPass(startedAt), zombieNow = perPass(zombie);
   let removed = 0;
   for (const entry of await readdir(workspaces, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
@@ -187,8 +196,11 @@ export async function sweepStaleBindings(root, { pidIsAlive = defaultPidIsAlive,
         if (record === undefined || record === null || typeof record.harnessSessionId !== "string"
           || await isMcpContinuity(record, name, workspaceRoot, entry.name)) return false;
         const pid = clientPidOf(record);
-        if (pid !== null) return !await confirmedDead(pid, pidIsAlive) && pidReused(pid, file, started);
-        return staleWithoutPid(workspaceRoot, entry.name, record, pidIsAlive, file, started);
+        if (pid !== null) {
+          return !await confirmedDead(pid, pidIsAlive)
+            && (await zombieNow(pid) === true || pidReused(pid, file, started));
+        }
+        return staleWithoutPid(workspaceRoot, entry.name, record, pidIsAlive, file, started, zombieNow);
       };
       const judged = await readManagedJson(file).catch(() => undefined);
       if (!await stale(judged)) continue;
@@ -221,9 +233,12 @@ export const blocksActivation = (hold, incomingStoreVersion) =>
  * generation's, or when either side declares none.
  */
 export async function listActivationBlockers(root, { pidIsAlive = defaultPidIsAlive,
-  ignorePid = null, incomingStoreVersion = null, strictNative = false, startedAt } = {}) {
-  const leases = (await listRuntimeHolds(root, { pidIsAlive })).filter(lease => lease.pid !== ignorePid);
-  const native = await listNativeHolds(root, { pidIsAlive, strict: strictNative,
+  ignorePid = null, incomingStoreVersion = null, strictNative = false, startedAt,
+  zombie = processIsZombie } = {}) {
+  const zombieNow = perPass(zombie);
+  const leases = (await listRuntimeHolds(root, { pidIsAlive, zombie: zombieNow }))
+    .filter(lease => lease.pid !== ignorePid);
+  const native = await listNativeHolds(root, { pidIsAlive, strict: strictNative, zombie: zombieNow,
     ...(startedAt === undefined ? {} : { startedAt }) });
   const holds = [
     ...leases.map(({ pid, kind, runtime }) => ({ pid, kind, nativeBindings: 0,
@@ -303,8 +318,11 @@ async function resolveCandidate(value) {
 // reclaimed need to tell that from a pass that found nothing to remove.
 const POSTPONED = Object.freeze({ removed: [], postponed: true });
 
-export async function reclaimGenerations({ root, active = null, pidIsAlive = defaultPidIsAlive } = {}) {
+export async function reclaimGenerations({ root, active = null, pidIsAlive = defaultPidIsAlive,
+  zombie = processIsZombie } = {}) {
   root = await canonicalManagerRoot(root);
+  // A lease or a pin of a client that exited uncollected keeps no generation (#280).
+  const zombieNow = perPass(zombie);
   return withManagerLock(root, async () => {
     const generations = path.join(root, "generations");
     if (!await managedDirectory(generations)) return { removed: [] };
@@ -343,7 +361,7 @@ export async function reclaimGenerations({ root, active = null, pidIsAlive = def
       if (resolved.root) referenced.add(resolved.root);
     }
     let holds;
-    try { holds = await listRuntimeHolds(root, { pidIsAlive }); }
+    try { holds = await listRuntimeHolds(root, { pidIsAlive, zombie: zombieNow }); }
     catch { return POSTPONED; } // An unreadable lease is an unknown holder.
     for (const lease of holds) {
       const resolved = await resolveCandidate(lease.runtime?.root);
@@ -353,7 +371,7 @@ export async function reclaimGenerations({ root, active = null, pidIsAlive = def
     // A client that exits without a clean session end leaves its pin behind;
     // reap confirmed-dead ones before treating every remaining pin as live,
     // the same way admission already reaps confirmed-dead leases.
-    await reapPins({ root, pidIsAlive });
+    await reapPins({ root, pidIsAlive, zombie: zombieNow });
     const pins = path.join(root, "pins");
     if (await managedDirectory(pins)) {
       for (const name of await readdir(pins)) {
@@ -421,7 +439,7 @@ const recipe = c => JSON.stringify([c.active, c.pending, c.home, c.targets, c.au
 
 /** Detection is outside the fence; every integration write and commit stays inside it. */
 export async function activatePending(root, { prepare = prepareCandidate, env = process.env,
-  pidIsAlive = defaultPidIsAlive, ignorePid = null, beforeActivation = null, startedAt } = {}) {
+  pidIsAlive = defaultPidIsAlive, ignorePid = null, beforeActivation = null, startedAt, zombie } = {}) {
   root = await canonicalManagerRoot(root);
   const before = await readControl(root);
   if (!before?.pending) return { activated: false, reason: "no_pending_update" };
@@ -432,7 +450,7 @@ export async function activatePending(root, { prepare = prepareCandidate, env =
     if (!current || recipe(current) !== recipe(before)) return { activated: false, reason: "state_changed" };
     if (beforeActivation) await beforeActivation(current);
     const blockers = await listActivationBlockers(root, { pidIsAlive, ignorePid, startedAt,
-      incomingStoreVersion: current.pending.storeVersion });
+      ...(zombie === undefined ? {} : { zombie }), incomingStoreVersion: current.pending.storeVersion });
     if (blockers.length) {
       const notice = activationBlockerNotice(current.pending.version, blockers);
       await writeControl(root, { ...current, notice });
@@ -466,7 +484,8 @@ export async function activatePending(root, { prepare = prepareCandidate, env =
   // turn an already-completed activation into a reported failure - it can
   // always run again on the next activation.
   if (outcome.activated) {
-    try { await reclaimGenerations({ root, active: activatedRoot, pidIsAlive }); }
+    try { await reclaimGenerations({ root, active: activatedRoot, pidIsAlive,
+      ...(zombie === undefined ? {} : { zombie }) }); }
     catch { /* Best effort; never fails an activation that already succeeded. */ }
     // The reclaim above is this, older, code's rule (#208). The activated
     // generation's own rule runs next, from its own files as its refresh did,

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/diagnostics.mjs

@@ -27,7 +27,12 @@ export async function managedUpdateDiagnostic(root, manager, running) {
       : activationBlockerNotice(manager.pending.version, blockers),
     ...(blockers === null ? {} : { holds: blockers.length, blockers }) };
   const maintenance = await readMaintenance(root);
-  if (maintenance && (maintenance.target.root === (manager.pending ?? manager.active).root
+  // A job that failed or was cancelled for the release that is now active is
+  // history: another path activated it, and "run acc update to retry" asked
+  // for an update already done (#281). A completed job still reports its restart.
+  const settled = maintenance && manager.pending === null && maintenance.target.root === manager.active.root
+    && ["failed", "cancelled"].includes(maintenance.status);
+  if (maintenance && !settled && (maintenance.target.root === (manager.pending ?? manager.active).root
     || MAINTENANCE_ACTIVE.includes(maintenance.status))) {
     update.maintenance = maintenanceReport(maintenance);
     update.notice = maintenanceNotice(maintenance);

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/leases.mjs

@@ -31,8 +31,10 @@ export async function acquireRuntime(root, { pid = process.pid, kind = "cli" } =
 /** Management decisions call this under withManagerLock to exclude admissions.
  * Records are immutable and uniquely named; confirmed-dead cleanup also works
  * outside a transaction. No release-on-return or timestamp expiry exists.
+ * A decision passes `zombie` so a holder that exited but was never collected
+ * holds nothing (#280); admission leaves it out and spawns no process.
  */
-export async function listRuntimeHolds(root, { pidIsAlive = defaultPidIsAlive } = {}) {
+export async function listRuntimeHolds(root, { pidIsAlive = defaultPidIsAlive, zombie = null } = {}) {
   root = await canonicalManagerRoot(root);
   if (!await managedDirectory(root)) return [];
   const directory = path.join(root, "leases");
@@ -50,7 +52,7 @@ export async function listRuntimeHolds(root, { pidIsAlive = defaultPidIsAlive }
       || typeof lease.kind !== "string" || !lease.kind
       || !Number.isFinite(Date.parse(lease.createdAt))) throw new Error("invalid runtime lease");
     const runtime = await validateRuntime(root, lease.runtime);
-    if (await confirmedDead(lease.pid, pidIsAlive)) {
+    if (await confirmedDead(lease.pid, pidIsAlive) || zombie !== null && await zombie(lease.pid) === true) {
       await rm(file, { force: true });
       removed = true;
     } else holds.push({ ...lease, runtime });

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/pins.mjs

@@ -115,7 +115,7 @@ export async function resolvePinnedGeneration({ root, harnessSessionId, active }
  * already reaps dead leases; pins follow the same confirmed-death rule. A pin
  * that names no client, which 0.8.0 and earlier wrote when the pid was not yet
  * known, is reaped outright: nothing could ever prove its session over. */
-export async function reapPins({ root, pidIsAlive = defaultPidIsAlive } = {}) {
+export async function reapPins({ root, pidIsAlive = defaultPidIsAlive, zombie = null } = {}) {
   root = await canonicalManagerRoot(root);
   const directory = path.join(root, "pins");
   if (!await managedDirectory(directory)) return;
@@ -125,7 +125,8 @@ export async function reapPins({ root, pidIsAlive = defaultPidIsAlive } = {}) {
     const file = path.join(directory, name);
     const record = await readManagedJson(file).catch(() => null);
     if (record?.schemaVersion !== SCHEMA_VERSION) continue; // Unknown shape: an unknown holder.
-    if (!isPid(record.clientPid) || await confirmedDead(record.clientPid, pidIsAlive)) {
+    if (!isPid(record.clientPid) || await confirmedDead(record.clientPid, pidIsAlive)
+      || zombie !== null && await zombie(record.clientPid) === true) {
       await rm(file, { force: true });
       removed = true;
     }

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/refresh.mjs

@@ -2,7 +2,9 @@ import path from "node:path";
 import { applyPlan, detectInstallation, livePolicyOf, loadOwnership, planInstallation }
   from "@agents-can-communicate/installer";
 import { ALL_ADAPTERS, clientContext, probeTimeout } from "../install-command.mjs";
+import { processIsZombie } from "@agents-can-communicate/adapter-sdk";
 import { sweepStaleBindings } from "./activation.mjs";
+import { listRuntimeHolds } from "./leases.mjs";
 import { stablePaths, writeLaunchers } from "./launchers.mjs";
 import { bridgeLegacyMaintenance } from "./legacy-maintenance.mjs";
 
@@ -12,6 +14,9 @@ export async function prepareRefresh({ control, root, env = process.env, callerP
   // An older generation lists its blockers right after this returns, by a rule
   // that counts a binding without a client pid as a live client forever (#273).
   await sweepStaleBindings(root).catch(() => {});
+  // It counts a zombie's lease as a live ACC process too (#280); a zombie's lease
+  // is removed like a dead process's.
+  await listRuntimeHolds(root, { zombie: processIsZombie }).catch(() => {});
   const dataHome = path.dirname(path.dirname(root));
   const wanted = new Set(control.targets);
   const adapters = ALL_ADAPTERS().filter(adapter => wanted.has(adapter.id));

package/node_modules/@agents-can-communicate/cli/src/native-session-diagnostics.mjs

@@ -97,6 +97,8 @@ export async function updateNativeSessions(adapters, { service, status, root, no
 }
 
 const failures = {
+  transport_permission_denied: "this command cannot access the local delivery channel; "
+    + "check the sender's command permissions",
   client_process_unknown: "the client process could not be identified; start a new client session",
   handshake_failed: "the session handshake failed; check the client's integration/channel setup",
   handshake_timeout: "the session handshake timed out; check the local channel and retry on the next turn",

package/node_modules/@agents-can-communicate/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/core",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/delivery-router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/delivery-router",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/delivery-router/src/refresh-binding.mjs

@@ -1,6 +1,7 @@
 import { validateNativeHandshake } from "@agents-can-communicate/adapter-sdk";
 
 const MAX_REFRESH_LEASE_MS = 120_000;
+const refused = (errorCode = "recipient_unavailable") => ({ refreshed: false, errorCode });
 
 function sameBinding(current, expected, leaseUntil) {
   return current !== null && current !== undefined
@@ -15,24 +16,26 @@ function sameBinding(current, expected, leaseUntil) {
 
 export async function refreshExpiredBinding({ service, adapter, binding, runtimeDir,
   clock, timeoutMs = 750 }) {
-  if (typeof adapter?.refreshNativeSession !== "function") return false;
+  if (typeof adapter?.refreshNativeSession !== "function") return refused();
   const now = Date.parse(clock.now());
-  if (!Number.isFinite(now)) return false;
+  if (!Number.isFinite(now)) return refused();
   try {
     const handshake = await adapter.refreshNativeSession({ binding, runtimeDir, timeoutMs });
     const validated = validateNativeHandshake(adapter, {
       clientVersion: binding.clientVersion, handshake,
     });
-    if (!validated.ok || validated.opaqueEndpointRef !== binding.opaqueEndpointRef) return false;
+    if (!validated.ok) return refused(validated.reasonCode === "transport_permission_denied"
+      ? "transport_permission_denied" : "recipient_unavailable");
+    if (validated.opaqueEndpointRef !== binding.opaqueEndpointRef) return refused();
     const requestedLease = Date.parse(validated.leaseUntil);
-    if (!Number.isFinite(requestedLease) || requestedLease <= now) return false;
+    if (!Number.isFinite(requestedLease) || requestedLease <= now) return refused();
     const leaseUntil = new Date(Math.min(requestedLease,
       now + MAX_REFRESH_LEASE_MS)).toISOString();
     await service.refreshDeliveryBinding({ sessionId: binding.sessionId,
       generation: binding.generation, leaseUntil });
     const current = await service.store?.ephemeral?.get("deliveryBinding", binding.sessionId);
-    return sameBinding(current, binding, leaseUntil);
+    return sameBinding(current, binding, leaseUntil) ? { refreshed: true, errorCode: null } : refused();
   } catch {
-    return false;
+    return refused();
   }
 }

package/node_modules/@agents-can-communicate/delivery-router/src/router.mjs

@@ -132,7 +132,12 @@ export function createDeliveryRouter({ service, adapters, clock, readLivePolicy,
     if (Date.parse(binding.leaseUntil) <= Date.parse(now)) {
       const refreshed = await refreshExpiredBinding({ service, adapter, binding,
         runtimeDir: service.store?.root, clock });
-      if (!refreshed) return durable(participantId, "recipient_unavailable");
+      if (!refreshed.refreshed) {
+        if (refreshed.errorCode === "transport_permission_denied") {
+          await recordFailure(binding, message, participantId, "live-adapter", refreshed.errorCode);
+        }
+        return durable(participantId, refreshed.errorCode);
+      }
       const current = (await service.listDeliveryBindings({
         participantId, now: clock.now() })).filter(item => item.sessionId === binding.sessionId
           && item.generation === binding.generation

package/node_modules/@agents-can-communicate/hook-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/hook-runner",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/installer",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/installer/src/delivery-diagnostics.mjs

@@ -10,6 +10,7 @@ const REASONS = Object.freeze({
   known_bad_version: "this client version has a known native delivery failure",
   native_endpoint_unavailable: "the client's local delivery service is unavailable",
   native_session_unavailable: "the local delivery service has no loaded client session",
+  transport_permission_denied: "the calling process lacks permission to access the local delivery channel",
   feature_probe_failed: "the native protocol probe did not succeed",
   probe_timeout: "the native protocol probe timed out",
   probe_version_mismatch: "the local service and CLI versions differ",

package/node_modules/@agents-can-communicate/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/mcp-server",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/protocol",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/storage-filesystem/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/storage-filesystem",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "private": true,
   "type": "module",
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "accManagedUpdateProtocol": 2,
   "accStoreVersion": 7,
   "type": "module",